From “Who Issues” to “Who Safeguards”: SEC’s Custody Rule Completes the Picture as Stablecoin Rules Go Live

With the CLARITY Act stalled, administrative power is pushing US crypto regulation into its last frontier: custody. The SEC used a 760-page proposal to close the final gap in institutional access, while stablecoin oversight shifts from federal rulemaking to state-level implementation.

The SEC Custody Framework: the Last Piece, a 760-Page “Compliant Pathway”

On October 1, the US Securities and Exchange Commission formally proposed a crypto asset custody framework under the Investment Advisers Act and the Investment Company Act (SEC Press Release 2026-100, RIN 3235-AN46). Chair Paul Atkins said plainly in his statement that the existing custody rules “largely predate the internet,” leaving advisers and funds without a clear path for an asset class their clients increasingly demand. The 760-page proposal covers custody arrangements for client crypto assets held by registered investment advisers (RIAs) and regulated funds, with a 60-day public comment window after Federal Register publication.

The proposal revolves around the definition of a “qualified custodian” and explicitly recognizes state-chartered trust companies as eligible custodians, provided they meet the relevant authorization and asset-safeguarding standards. This matters because much of the bitcoin-native custody infrastructure has operated for years in a regulatory gray area under state trust charters. If the final rule keeps this tier, these firms will compete on equal footing with large bank custodians and gain a structural advantage they have never had. The core problem the SEC cites is a timing mismatch: for newly issued crypto assets, qualified custody capacity often lags asset deployment by months or longer, and the proposal is designed to close that gap.

Contrary to market intuition, “self-custody” in the proposal is a narrow exception, not a broad green light. It is available only when an adviser certifies quarterly that no qualified third-party custodian is available, and it still requires cybersecurity measures, asset segregation, and client disclosures. Both Atkins and Commissioner Hester Peirce made clear that self-custody here means the adviser acting as custodian for client assets, not individuals holding their own keys, and it is not a license for RIAs to routinely hold client private keys. Peirce said in her statement that “true self-custody is not the right choice for everyone, but many crypto owners prize being able to custody their own assets.”

This proposal effectively supersedes the never-finalized 2023 Safeguarding Rule from the Gensler era. That rule stalled amid broad industry opposition and failed to give RIAs a workable framework; the Atkins-led SEC is now re-regulating with the promise of “a compliant pathway where none existed before.” More importantly, in January the SEC used SAB 122 to repeal SAB 121, the rule that had treated bank-custodied bitcoin as a balance-sheet liability and kept banks out. Together, the two actions close the loop on institutional access to bitcoin for the first time, from ETF issuance to bank custody to adviser and fund holdings.

The timing carries symbolic weight. One day after the proposal, Commissioner Hester Peirce, who led the SEC’s Crypto Task Force, formally departed on October 2 for an academic post in Virginia, leaving the SEC with only two sitting commissioners (Atkins and Uyeda). Earlier this week the SEC lowered its quorum requirement from three to two to keep rulemaking from freezing before new commissioners arrive. Atkins said the US still intends to be the “leading jurisdiction for crypto innovation” and hinted that more proposals are on the way. The custody framework is the capstone of the crypto regulatory roadmap he laid out earlier this year.

Taken together, the shift in regulatory logic becomes clear. The debate of recent years centered on whether crypto is a security and who may issue it; after the CLARITY Act fell short 49:50 on September 15, the executive branch stopped waiting for legislation and directly answered “who holds the assets and how money moves.” Tokenization guidance sets the issuance boundary, Regulation Crypto Assets governs fundraising, the Innovation Exemption governs compliant issuance, and the custody framework governs institutional holdings. With all four pillars in place, Atkins’ administrative path is complete.

Stablecoin Regulation Moves from “Setting Rules” to “Running Them”: State Dual Tracks and a Redemption Gap

If the SEC custody framework is the federal groundwork, then stablecoin regulation has in the last two days entered real implementation, with a clear “shift to the states.” On October 1, Florida’s payment stablecoin rules took effect (under HB 175). State trust companies issuing payment stablecoins must first obtain an “eligible payment stablecoin issuer” approval certificate from the Office of Financial Regulation (OFR), and meet prudential requirements aligned with the federal GENIUS Act: maintain at least 1:1 reserves (cash, bank demand deposits, short-term US Treasuries with maturities of 93 days or less, and money market funds investing only in permitted reserve assets), publish monthly reserve composition and custody locations, undergo independent CPA examinations, and have the composition certified by the CEO and CFO. More importantly, once a state issuer’s total outstanding issuance hits the $10 billion threshold, it must move into the federal framework within 360 days unless it obtains a federal waiver.

That $10 billion threshold is not unique to Florida; it is the nationwide dividing line set by the GENIUS Act. Issuers with total outstanding issuance of no more than $10 billion (on a consolidated basis) may choose the state track, provided their home state’s regulator certifies that the regime is “substantially similar” to the federal framework and passes federal review. Issuers above the threshold are barred from the state track and must transition to the federal framework. This design splits the stablecoin market into two parallel tracks and explains why, a week after the Treasury finalized the SCRC procedural rules, it followed this week with a flexible arrangement for state certifications.

On October 1, the Treasury allowed states to submit “conditional certifications” before their rules are finished, so they can meet the initial filing window and move into substantive review once legislative or regulatory work is completed. But the Treasury also drew a line: incomplete filings do not start the committee’s 30-day approval-or-denial clock, and certification of a state regime does not grant licenses to individual issuers. This arrangement effectively “catches” the initial state-certification deadline set by the GENIUS Act (projected at January 18, 2028 based on a January 18, 2027 effective date), giving state regulators room to finish their work.

Yet as federal rules move downward, a structural gap has surfaced. The Fed’s stablecoin proposal, published in the Federal Register on September 29 (proposed §247.12), would require a Board-supervised payment stablecoin issuer to complete redemption within two business days of a redemption request. But this two-day clock only governs an issuer’s response to an eligible redemption request. According to a July 28 snapshot by the Andersen Institute for Finance and Economics, roughly $76 billion in reserve-backed dollar stablecoins sits at centralized exchanges. For these users, the first step is whether the venue releases or converts their balance, a step that falls entirely outside the issuer’s two-day obligation.

Historical data show the real weight of this gap. In the March 2023 USDC episode, the Andersen team found that, using March 9 as the pre-shock baseline, exchanges held 15.2% of USDC supply but accounted for 40% of the subsequent supply decline; from March 10 to 13, USDC supply fell $2.7 billion while exchange balances actually rose $600 million; after March 13, supply fell another $8.1 billion and exchange balances fell $4.9 billion. In other words, run pressure tends to hit exchanges first, and the regulatory redemption clock currently cannot cover that most congested channel.

What This Means for Practitioners