The SEC submitted a proposed rule change to the White House on August 25. The RIN is 3235-AN46. The designation: economically significant. The character: deregulatory.
That last word is the anomaly. The previous SEC chair pushed custody rules that would have restricted qualified custodians to a narrow class of banks, trusts, and registered broker-dealers. The industry pushed back. The proposal was withdrawn. Now the agency is reversing course, claiming it wants to remove investor protection burdens that are no longer necessary.
Logic is binary; incentives are fractal. Let's dissect what this actually means.
The Context: A Regulatory Pendulum with a Two-Year Latency
In 2023, under Gary Gensler, the SEC proposed amendments to the custody rules under the Investment Advisers Act of 1940 and the Investment Company Act of 1940. The intent was clear: force digital asset custodians into a traditional finance straitjacket. The qualified custodian definition was narrow enough to exclude most crypto-native players. Banks, trust companies, SEC-registered broker-dealers, and CFTC-regulated futures commission merchants — that was the entire universe. MPC wallets, self-custody solutions, decentralized custody networks — all excluded.
The backlash was immediate. Financial institutions objected to the compliance burden. Crypto platforms saw existential threat. Federal agencies questioned the SEC's jurisdictional reach. The proposal died.
Now, Paul Atkins chairs the SEC. The agency has submitted a new proposal to OIRA, the Office of Information and Regulatory Affairs. The stated goal: remove outdated provisions that impose investor protection burdens no longer necessary. The target date for formal publication: October 2025.
I audited institutional risk disclosures in 2024, cross-referencing custody solutions against actual on-chain key management practices. Two of three major asset managers relied on multi-signature wallets with key holders in weak legal jurisdictions. The marketing said "bank-grade custody." The operational reality was a jurisdiction arbitrage play. This new proposal is a direct response to that gap between institutional narrative and operational reality.
The Core: A Systematic Teardown of the Regulatory Mechanics
The proposal's technical structure matters more than its political framing. Let's examine the components.
The Deregulatory Designation
"Deregulatory" is a specific legal classification, not a rhetorical flourish. Under Executive Order 12866, an economically significant rule has an annual impact exceeding $100 million. The SEC has voluntarily applied this designation to a rule that removes regulatory burdens. This is the inverse of the 2023 approach.
The agency's own language is revealing: it seeks to remove "investor protections that are no longer necessary." This is a recognition that the 2023 framework was over-engineered for the actual risk profile of digital assets. The custody rule was designed for a world where assets sit in a bank vault. Digital assets exist on a ledger. The custody model itself is different — the risks are different — and the regulatory framework must reflect that variance.
The Qualified Custodian Expansion Vector
Here is where the analysis gets interesting. The 2023 proposal's narrow definition of qualified custodian created a structural bottleneck. Investment advisers managing client crypto assets had limited compliant options. This wasn't just a regulatory problem — it was a market structure problem. The custody bottleneck constrained institutional capital flows into digital assets.
A revised definition could open the door to:
- State-chartered trust companies with digital asset expertise (the Wyoming and New York model)
- Broker-dealers with demonstrated crypto custody capabilities
- Potentially, non-custodial technology providers with auditable key management systems
The Federal Trust Bank charter approvals in early 2025 — which I noted as a parallel signal — suggest the market is already solving this problem through alternative channels. The SEC is now catching up to market reality rather than leading it.
The Companion Rule: RIN 3235-AN48
Less discussed but equally significant: RIN 3235-AN48 will clarify broker-dealer compliance requirements for crypto assets. This is a systematic approach. The SEC is not revising custody rules in isolation; it is recalibrating the entire regulatory framework for digital asset intermediaries.
Tokenized securities exemptions are also pending. If custody rules are relaxed and broker-dealer requirements clarified, the tokenized securities market gets a compliance framework that actually works. I have written extensively about how the DA layer is overhyped for rollups — 99% of them don't generate enough data to need dedicated DA. The same principle applies here: the custody rules were designed for a scale of institutional adoption that hadn't materialized. The regulatory framework was building for a world that didn't exist.
The Timing Signal
The OIRA submission in August, with a target publication date in October, suggests this is a priority item. The regulatory review process typically takes 60-90 days. The SEC is signaling that this rule revision is not a back-burner item. It is the first major deregulatory action of the Atkins era, and it is designed to be a signal to the market.
The Contrarian Angle: What the Bulls Get Right
I have been critical of regulatory overreach in this industry. But let me be precise about what the bulls are correct about here.
The market has partially priced in this regulatory shift. The appointment of Paul Atkins signaled a friendlier SEC. The withdrawal of the 2023 proposal was already a victory for the industry. This new submission is confirmation of a direction that was already anticipated.
But there is a deeper structural point that the market is missing. This rule revision is not just about custody. It is about the SEC's recognition that digital assets require a different regulatory architecture than traditional securities. The "code is law" narrative was always oversimplified, but the opposite — that traditional securities law maps cleanly onto digital assets — has proven equally flawed.
The SEC is now acknowledging this through action, not rhetoric. The custody rule revision is an admission that the 2023 framework was based on a misunderstanding of how digital asset custody actually works. The key management, the settlement process, the risk profile — all different from traditional assets. The regulatory framework must adapt to the technology, not the other way around.
This is what I call the "institutional reality gap" — the difference between how regulatory frameworks are designed and how the technology actually operates. My 2020 Uniswap V2 audit taught me this lesson early: the mathematical invariant of the constant product formula was theoretically sound, but the economic edge cases created practical vulnerabilities. Regulatory design has the same problem. The theoretical framework must be tested against operational reality.
The Takeaway: The Signal Beyond the Rule
The SEC is not just revising custody rules. It is signaling a fundamental shift in how the agency approaches digital asset regulation. The "deregulatory" designation is not an accident. The timing — submitted before the October target — is not an accident. The companion rules — broker-dealer clarification, tokenized securities exemptions — are not accidents.
Probability does not forgive edge cases. The edge case here is the gap between the SEC's stated intent and the actual execution. The proposal is at the OIRA review stage. It can still be modified. It can still be delayed. The formal publication in October may not happen as scheduled. And the final rule — after public comment and revision — may still contain restrictive provisions.
But the direction is clear. The SEC under Paul Atkins is building a different regulatory framework for digital assets. The custody rule is the foundation. If it holds, the rest of the framework — broker-dealer rules, tokenized securities exemptions, potential stablecoin guidance — can follow.
The market should not treat this as a single event. It should treat this as the first block in a new chain. The custody rule revision is not the destination. It is the starting point.
Code executes exactly as written, not as intended. The same applies to regulation. The SEC's intent is now clear. The execution remains to be audited. But for the first time in years, the direction of the audit is positive.
The custody question was never really about where assets are stored. It was about whether the regulatory framework would recognize the structural differences of digital assets. This proposal says yes. Now we wait for the final rule to confirm it.
Certainty is a luxury; risk is the baseline. The risk here is that the final rule underdelivers. The opportunity is that it exceeds expectations. The probability distribution is skewed toward positive outcomes, but the variance remains high. That is the honest technical assessment.
I will be watching the OIRA review process closely. The October publication date is the next data point. The public comment period will reveal the industry's position. The final rule will determine the actual impact. Until then, the analysis remains provisional. But the structural signal is clear: the SEC is changing its approach to digital asset custody, and that change will ripple through the entire institutional adoption timeline.
