What is the SEC custody rule?
The custody rule is Rule 206(4)-2 under the Investment Advisers Act of 1940, codified at 17 CFR 275.206(4)-2. It applies to SEC-registered investment advisers and is designed to protect client assets from loss, misuse or theft by the adviser.
The rule's core requirement is that an adviser with custody keep client funds and securities with a qualified custodian. Under the rule, qualified custodians include banks, broker-dealers registered with the SEC that hold client assets in customer accounts, and registered futures commission merchants.
The adviser must also have a reasonable basis, after due inquiry, to believe that the qualified custodian sends account statements directly to clients at least quarterly. The SEC's investor bulletin on custody explains that the point is to let clients compare the custodian's statements with what their adviser tells them and check whether transactions, including fee deductions, are proper.
This guide is general information about the rule, not legal advice. Firms should review the current rule text and SEC staff guidance with counsel.
When does an RIA have custody?
The rule defines custody broadly: holding client funds or securities, directly or indirectly, or having any authority to obtain possession of them. That means an adviser can have custody even though the assets sit at a third-party custodian such as a bank or broker-dealer.
Common triggers include authority to deduct advisory fees directly from client accounts, which law firm Katten noted gives an adviser custody under the rule, and a power of attorney that lets the adviser withdraw client funds. Serving as general partner of a client limited partnership or managing member of a client LLC also gives the adviser legal ownership of, or access to, the entity's assets, and so creates custody.
Trustee roles are another trigger. Summaries of the SEC staff's custody FAQs by Keiter CPA say that when an employee of an advisory firm serves as trustee for a firm client, the firm generally has custody, with a narrow exception for a supervised person appointed because of a family or personal relationship with the grantor or beneficiary.
Client login credentials can also create custody. According to those same summaries and an EisnerAmper analysis, holding a client's username and password counts as custody if the credentials let the adviser withdraw or transfer assets, regardless of the adviser's intent in getting them.
What is the surprise examination, and who is exempt?
An adviser with custody generally must hire an independent public accountant to verify client assets through an annual examination conducted on a date the adviser does not announce in advance, under amendments the SEC adopted in December 2009. The adviser must have a written agreement with the accountant covering the accountant's duties.
According to law firm summaries of the 2009 amendments, the accountant files Form ADV-E with the SEC within 120 days of the exam date it chose, must notify the SEC within one business day if it finds material discrepancies, and must file Form ADV-E within four business days if it resigns or is dismissed.
There are exceptions. Advisers whose only custody comes from authority to deduct advisory fees are exempt from the surprise exam; Katten reported that the SEC concluded the risk from fee overcharging did not justify the cost. Advisers to pooled investment vehicles such as private funds can instead have each fund audited annually and distribute the audited financial statements to investors within 120 days of fiscal year-end. A separate exception covers custody that arises only because an operationally independent related person holds client assets.
How do standing letters of authorization affect custody?
A standing letter of authorization, or SLOA, is an instruction a client sets up with a custodian that lets the adviser direct money to a third party. On February 21, 2017, SEC staff issued a no-action letter to the Investment Adviser Association stating that an adviser acting under an SLOA to send client money to a third party has custody, but that staff would not recommend enforcement if the adviser skipped the surprise exam and met seven conditions.
According to summaries by Dechert and ThinkAdvisor, the conditions are: the client gives the custodian a signed written instruction naming the third party and giving its address or account number; the client authorizes the adviser in writing to direct transfers to that third party; the custodian verifies the authorization and notifies the client promptly after each transfer; the client can end or change the instruction; the adviser cannot designate or change the third party or its details; the adviser keeps records showing the third party is not related to it and does not share its address; and the custodian sends the client an initial notice confirming the instruction and an annual reconfirmation.
The staff also updated its custody FAQs the same day. Compliance firm Comply noted that transfers between a client's own accounts at different institutions do not trigger custody when the client's signed authorization lists the receiving account numbers, and that advisers should report SLOA assets in Item 9 of Form ADV after October 1, 2017.
What does Form ADV require on custody?
Item 9 of Form ADV Part 1A asks whether the adviser or its related persons have custody, and asks for the total dollar amount of client funds and securities and the number of clients involved, according to summaries of the 2010 form changes.
Item 9 also asks whether a qualified custodian sends account statements to clients and whether an independent accountant performs an audit, surprise exam or internal control report. If so, the adviser completes Schedule D Section 9.C for each accountant.
Private fund advisers face a related disclosure in Schedule D Section 7.B.(1), which reports whether each fund's financial statements are audited and whether the audit opinion has been received. Failing to update those answers on time was part of the SEC's 2022 and 2023 custody sweep cases.
What happened to the SEC's 2023 safeguarding proposal?
On February 15, 2023, the SEC voted 4-1, with Commissioner Hester Peirce dissenting, to propose redesignating the custody rule as new Rule 223-1, the Safeguarding Rule. The proposal would have extended the rule from client funds and securities to all client assets, including crypto assets and other non-securities, and would have treated discretionary trading authority as custody.
The SEC formally withdrew the proposal on June 12, 2025, as one of 14 pending rule proposals it pulled, according to the SEC. The agency said it did not intend to finalize those proposals and that any future rulemaking in those areas would require a new proposal and comment period.
The SEC returned to the subject in 2026. On October 1, 2026, it proposed custody rules for investment advisers and regulated funds that would allow self-custody of crypto assets in specified circumstances or custody through state-chartered trust companies, subject to conditions, according to Lowenstein Sandler. The proposal, published in the Federal Register on October 6, 2026, would also modernize and redesignate the existing custody rule. As of October 2026 it has not been adopted, so Rule 206(4)-2 remains in effect.
How has the SEC enforced the custody rule?
On September 9, 2022, the SEC announced settled charges against nine investment advisers that it said failed to comply with the custody rule, failed to promptly update Form ADV on the audit status of private funds they advised, or both. The firms agreed to combined penalties of more than $1 million, and the cases came out of a targeted sweep by the SEC's examinations and enforcement divisions.
On September 5, 2023, the SEC announced a second round from that sweep: settled cases against five advisers, Lloyd George Management (HK), Bluestone Capital Management, The Eideard Group, Disruptive Technology Advisers and Apex Financial Advisors. The firms neither admitted nor denied the findings and agreed to penalties from $50,000 to $225,000, totaling more than $500,000.
The conduct in those cases included funds that were never audited, audited financial statements delivered to investors late, and Form ADV answers that were not updated when audits were completed.