When using a cryptocurrency service, one question deserves attention before any transaction: who actually controls the assets?
The answer affects how transfers are authorized, what happens if account access is lost, and which safeguards may apply if a service experiences a security incident.
On October 1, 2026, the U.S. Securities and Exchange Commission (SEC) proposed a framework addressing how registered investment advisers and regulated funds may custody certain crypto assets. The proposal covers safeguarding controls, cybersecurity, asset segregation, and recordkeeping. It remains a proposal, not a finalized rule.
For anyone exploring digital asset investments, this development highlights a practical lesson: understanding custody arrangements matters as much as understanding the technology itself.
What Is Cryptocurrency Custody?
Cryptocurrency custody refers to how digital assets are held and how access to them is controlled. Unlike a conventional account balance, many blockchain transactions require cryptographic authorization through private keys.
A private key enables its holder to authorize certain transactions associated with a digital wallet. Whoever controls the necessary keys may therefore have significant control over the assets.
Custody arrangements generally fall into three broad categories:
- Third-party custody: A service provider holds the keys or otherwise controls access to the assets.
- Self-custody: The owner maintains control of the necessary private keys.
- Shared-control arrangements: Multiple parties or authorization mechanisms are required to approve transactions.
Each arrangement presents different operational responsibilities. Third-party services may provide recovery procedures and account support, but introduce reliance on an external organization. Self-custody provides direct control, but places greater responsibility on the owner to protect keys and maintain recovery information.
Understanding these differences supports more informed participation in cryptocurrency investment activities without assuming that any custody model eliminates risk.
What the SEC’s October 2026 Proposal Covers
The SEC’s October 1 proposal addresses custody requirements for registered investment advisers and regulated funds under applicable federal securities laws. It also proposes updates to associated reporting, disclosure, and recordkeeping requirements.
Among its provisions, the proposal would establish conditions for certain self-custody arrangements and custody through qualifying state trust companies. It addresses safeguarding systems, cybersecurity controls, asset segregation, and oversight. The proposal also discusses records associated with crypto assets.
These details matter, but the scope requires careful interpretation.
The proposal does not automatically apply to every cryptocurrency business, wallet, exchange, or service provider. Its requirements concern specified entities and activities under the relevant federal laws. Whether a particular arrangement falls within those requirements depends on its circumstances and legal classification.
Readers should distinguish proposed requirements from existing obligations. They should also avoid assuming that a service receives regulatory approval simply because it discusses custody safeguards or follows selected security practices.
For background on the rulemaking, consult the SEC’s proposed custody rules.
Five Questions to Ask Before Using a Digital Asset Service
A custody provider’s marketing claims reveal only part of the picture. Asking specific operational questions can help clarify how assets are controlled and what protections are available.
1. Who Controls the Private Keys?
Ask whether the service holds the private keys, whether you retain direct control, or whether authorization is shared.
Clarify who can initiate transactions and whether any single party can move assets without additional approval. If the provider controls the keys, determine what contractual rights and withdrawal procedures govern your access.
This question is central to evaluating crypto asset management arrangements because control over transaction authorization directly affects operational dependence on a service provider.
2. How Are Withdrawals Authorized?
Withdrawal procedures help determine how a legitimate transfer is distinguished from an unauthorized request.
Ask whether withdrawals require multifactor authentication, address verification, transaction limits, approval by multiple authorized individuals, or additional checks for unusual activity.
Also establish whether withdrawal requests can be delayed or restricted. A delay may form part of a security process, but the service should explain the circumstances and applicable procedures clearly.
3. Are Assets Segregated?
Asset segregation concerns how client assets are separated from a provider’s own holdings and from assets associated with other clients.
Ask how the service records ownership, identifies the assets held for each customer, and handles discrepancies between internal records and on-chain balances.
Segregation arrangements can affect the practical and legal treatment of assets if a provider encounters financial distress. However, segregation alone does not establish that recovery will be immediate or complete.
These questions are relevant when evaluating digital asset management processes, particularly where several parties participate in custody and transaction execution.
4. What Happens if Access Is Lost?
Recovery procedures deserve attention before a problem occurs. A lost password may be recoverable through account verification, while a lost private key may be impossible to replace.
Ask the provider to explain its recovery process, identity verification requirements, backup arrangements, and procedures for handling compromised credentials. For self-custody, determine how recovery phrases are stored and who can access them.
A recovery plan should account for theft, device failure, accidental deletion, and the loss of access by an authorized person. Test the practical steps where possible, without exposing sensitive credentials.
Teams evaluating cryptocurrency investment solutions should also understand whether recovery depends on a single individual, a third-party service, or multiple authorization mechanisms.
5. How Are Security Incidents Handled?
Cybersecurity controls are only one part of a broader response plan. A service should explain how it detects suspicious activity, investigates incidents, communicates disruptions, and restores operations.
Useful questions include:
- How are unusual transactions detected and escalated?
- Who is responsible for responding to a suspected compromise?
- How and when are affected customers notified?
- What procedures govern access restrictions during an investigation?
- Are incident records maintained for subsequent review?
No security system can eliminate every threat. However, clearly documented procedures help establish how a provider prepares for foreseeable problems and communicates when circumstances change.
Custody Disclosures and Legal Protections
Before agreeing to a service, read its custody disclosures, terms of service, and withdrawal policies. These documents should clarify who holds the assets, which entity operates the service, and what happens if access is restricted or the provider ceases operations.
Pay particular attention to the following details:
- Ownership: How does the agreement describe your rights to the assets?
- Access: Can withdrawals be suspended, and under what circumstances?
- Service providers: Does another organization hold or control the private keys?
- Recovery: What procedures apply after a security incident or operational failure?
- Legal protections: Which laws, contractual terms, and dispute procedures apply to your specific arrangement?
A provider’s location, legal structure, and custody model can affect the rights available to customers. Do not assume that digital assets receive the same treatment under every legal framework.
Similarly, claims about security certifications, insurance, or regulatory status should be verified against the relevant documentation. A security feature is not proof of regulatory authorization, and a disclosure is not a guarantee of asset recovery.
These checks support a more disciplined approach to digital asset strategy by making operational responsibilities and limitations easier to identify.
The Kenson Perspective
At Kenson Investments, education, transparency, and capital stewardship are important considerations when examining the digital asset landscape. Custody is a useful example of why understanding operational risks matters alongside understanding market activity.
A thoughtful review considers who controls access, how transactions are authorized, whether records support ownership claims, and how the parties involved respond when something goes wrong.
This perspective also recognizes the limits of any framework. The SEC’s proposed requirements apply to specified regulated entities and activities, subject to the proposal’s scope and any eventual final rules. They should not be interpreted as a blanket endorsement of all digital asset services.
For those exploring blockchain-based investment opportunities, the underlying infrastructure and the arrangements used to hold assets deserve careful attention. A blockchain can record transactions, but it does not independently resolve every question involving custody agreements, account access, or legal recovery.
Kenson’s educational approach emphasizes understanding these distinctions before drawing conclusions about a service or its safeguards.
Practical Next Steps Before Choosing a Custody Arrangement
Use these questions as a starting point when reviewing a service:
- Identify who controls the private keys and who can authorize withdrawals.
- Read the custody agreement and understand the limits on access.
- Check how ownership records are maintained and reconciled.
- Review the provider’s recovery and incident response procedures.
- Verify any claims about insurance, certifications, or regulatory status.
- Revisit these checks when the provider changes its services or custody arrangements.
These steps do not remove uncertainty. They provide a practical foundation for evaluating risk management within a changing digital asset environment.
The SEC’s October 2026 proposal is a timely reminder that custody practices and regulatory frameworks continue to evolve. Understanding those developments can support more informed decisions about how digital assets are held and accessed.
To learn more about Kenson Investments’ educational approach, visit the Knowledge Centre or contact Kenson Investments to speak with a Digital Asset Specialist.
Disclaimer: The information provided on this page is for educational and informational purposes only and should not be construed as financial advice. Cryptocurrency assets involve inherent risks, and past performance is not indicative of future results. Always conduct thorough research and consult with a qualified financial advisor before making investment decisions.
The cryptocurrency and digital asset space is an emerging asset class that has not yet been regulated by the SEC and US Federal Government. None of the information provided by Kenson LLC should be considered as financial investment advice. Please consult your Registered Financial Advisor for guidance. Kenson LLC does not offer any products regulated by the SEC, including equities, registered securities, ETFs, stocks, bonds, or equivalents.
