The SEC’s Division of Investment Management (the “Division”) recently published an important no-action letter (the “Letter”)[i] that clarifies when State Trust Companies[ii] (or “STCs”) may serve as qualified custodians of Crypto Assets and Related Cash and Cash Equivalents[iii] for SEC registered investment advisers (“RIAs”) and registered investment companies (“Regulated Funds”) under the Investment Company Act of 1940 (the “1940 Act”).The Letter drew quick praise from Commissioner Peirce[iv] and condemnation from Commissioner Crenshaw.[v]The Division indicated that the SEC is also considering rulemaking regarding custodial requirements for Crypto Assets applicable to RIAs and Regulated Funds.

Under the Investment Advisers Act of 1940 (the “Advisers Act”) and Rule 206(4)-2 (the “Custody Rule”), RIAs deemed to have custody of client funds and securities are generally required to maintain those assets with a “qualified custodian” which includes a “bank” as defined in Advisers Act Section 202(a)(2). The term “bank” includes a “. . . trust company. . . doing business under the laws of any State or of the United States, a substantial portion of the business of which consists of receiving deposits or exercising fiduciary powers similar to those permitted to national banks . . .and which is supervised and examined by State or Federal authority having supervision over banks. . . .”[vi] 

The Letter reviews the sophisticated controls implemented by State Trust Companies over the past decade to ensure safekeeping of Crypto Assets and concludes it would be permissible to treat an STC as a “bank” (and therefore an institution permitted to custody Crypto Assets) provided that:

• Prior to engaging the STC (and annually), the RIA has a reasonable basis for believing that:
  • The STC is authorized by its state banking authority to custody Crypto Assets and Related Cash; and
  • The STC has written policies and procedures designed: (i) to safeguard Crypto Assets and Related Cash from loss or misappropriation, and (ii) to ensure among other things, private key management and cybersecurity. In making such a determination, the RIA:
    • Reviews the STC’s most recent annual GAAP financial statements; and
    • Reviews the STC’s most recent internal control report prepared by an independent public accountant during the current or prior calendar year (e.g., SOC-1 or SOC-2 report) that opines that custodial controls are suitably designed and effective;
• The RIA enters into a written custodial agreement which provides that:
  • The STC will not lend, pledge, hypothecate, or rehypothecate any Crypto Assets (or Related Cash) held in custody for the RIA Client without prior written consent of the RIA Client, and then only for the account of such RIA Client; and
  • All Crypto Assets (and Related Cash) held in custody for the RIA Client will be segregated from the STC’s assets;
• The RIA discloses to its RIA Clients material risks associated with using an STC as a Crypto Asset custodian; and
• The RIA (and, as applicable, its board of directors or trustees), reasonably determines that engaging the STC as custodian is in the Client’s best interest.

[i] The Incoming Letter the Division responded to provides an overview of why broker dealers and traditional banks are not generally acting as custodians for Crypto Assets.

[ii] The Letter (FN 1) defines a State Trust Company as a legal entity organized under state law that is: (i) supervised and examined by a state authority having supervision over banks and (ii) permitted to exercise fiduciary powers under applicable state law.

[iii] Crypto Assets refers to assets that are digital representations of value that are recorded on a cryptographically secured distributed ledger. The no-action assurances provided in the Letter are limited to Crypto Assets and Related Cash and/or Cash Equivalents reasonably necessary to effect transactions in Crypto Assets. Subsequent references to Cash Equivalents will be implied but not stated when referring to Related Cash.

[iv] See Commissioner Hester M. Peirce’s statement: Out of the Gray Zone. “For too long, registered advisers and regulated funds have been caught up in a guessing game as to whether their entity of choice for crypto asset custody, which also may be the only available custodian for such service, is a permissible custodian . . . .”See also Cultivating Confidence: The Role of Custody in Institutional Confidence – Public Trust and Oversight.

[v] See Commissioner Caroline A. Crenshaw’s statement: Poking Holes. “Degrading our custody framework is a serious matter.”

[vi] Sections 17(f) and 26(a) of the 1940 Act and the rules thereunder generally provide that Registered Funds must place and maintain securities and similar investments with certain specified custodians, which include most banks as defined in Section 2(a)(5) of the 1940 Act. For the sake of brevity, this note will only refer to RIAs and the Advisers Act.