# The SEC custody rule: when an RIA has custody, and what follows

URL: https://www.financialadvsr.com/guides/sec-custody-rule-explained
Updated: 2026-10-10
Publisher: Financial ADVSR (https://www.financialadvsr.com)

The SEC custody rule, Rule 206(4)-2 under the Investment Advisers Act of 1940, requires a registered investment adviser that has custody of client funds or securities to keep them with a qualified custodian, such as a bank or registered broker-dealer, and in most cases to undergo an annual surprise examination by an independent public accountant. An adviser has custody when it holds client assets directly or indirectly, or has any authority to obtain possession of them, which can include deducting fees, acting as trustee or general partner, holding a power of attorney, or using certain standing letters of authorization.

Key points:
- Under Rule 206(4)-2, custody means holding client funds or securities, directly or indirectly, or having any authority to obtain possession of them.
- An adviser with custody must have a reasonable basis to believe the qualified custodian sends account statements directly to clients at least quarterly, according to the SEC.
- Advisers with custody generally need an annual surprise exam; advisers whose only custody comes from deducting fees are exempt from it, under amendments adopted in 2009.
- SEC staff said in a February 21, 2017 no-action letter that standing letters of authorization to third parties give an adviser custody, but waived the surprise exam if seven conditions are met.
- The SEC proposed replacing the custody rule with a broader Safeguarding Rule on February 15, 2023, then withdrew that proposal on June 12, 2025.
- On October 1, 2026, the SEC proposed new custody rules for advisers and funds that include a conditional path to self-custody of crypto assets; as of 2026 it is only a proposal.
- SEC sweeps produced settled custody rule cases against nine advisers in September 2022 (over $1 million in penalties) and five more in September 2023 (over $500,000).

## What is the SEC custody rule?

The custody rule is Rule 206(4)-2 under the Investment Advisers Act of 1940, codified at 17 CFR 275.206(4)-2. It applies to SEC-registered investment advisers and is designed to protect client assets from loss, misuse or theft by the adviser.

The rule's core requirement is that an adviser with custody keep client funds and securities with a qualified custodian. Under the rule, qualified custodians include banks, broker-dealers registered with the SEC that hold client assets in customer accounts, and registered futures commission merchants.

The adviser must also have a reasonable basis, after due inquiry, to believe that the qualified custodian sends account statements directly to clients at least quarterly. The SEC's investor bulletin on custody explains that the point is to let clients compare the custodian's statements with what their adviser tells them and check whether transactions, including fee deductions, are proper.

This guide is general information about the rule, not legal advice. Firms should review the current rule text and SEC staff guidance with counsel.

## When does an RIA have custody?

The rule defines custody broadly: holding client funds or securities, directly or indirectly, or having any authority to obtain possession of them. That means an adviser can have custody even though the assets sit at a third-party custodian such as a bank or broker-dealer.

Common triggers include authority to deduct advisory fees directly from client accounts, which law firm Katten noted gives an adviser custody under the rule, and a power of attorney that lets the adviser withdraw client funds. Serving as general partner of a client limited partnership or managing member of a client LLC also gives the adviser legal ownership of, or access to, the entity's assets, and so creates custody.

Trustee roles are another trigger. Summaries of the SEC staff's custody FAQs by Keiter CPA say that when an employee of an advisory firm serves as trustee for a firm client, the firm generally has custody, with a narrow exception for a supervised person appointed because of a family or personal relationship with the grantor or beneficiary.

Client login credentials can also create custody. According to those same summaries and an EisnerAmper analysis, holding a client's username and password counts as custody if the credentials let the adviser withdraw or transfer assets, regardless of the adviser's intent in getting them.

## What is the surprise examination, and who is exempt?

An adviser with custody generally must hire an independent public accountant to verify client assets through an annual examination conducted on a date the adviser does not announce in advance, under amendments the SEC adopted in December 2009. The adviser must have a written agreement with the accountant covering the accountant's duties.

According to law firm summaries of the 2009 amendments, the accountant files Form ADV-E with the SEC within 120 days of the exam date it chose, must notify the SEC within one business day if it finds material discrepancies, and must file Form ADV-E within four business days if it resigns or is dismissed.

There are exceptions. Advisers whose only custody comes from authority to deduct advisory fees are exempt from the surprise exam; Katten reported that the SEC concluded the risk from fee overcharging did not justify the cost. Advisers to pooled investment vehicles such as private funds can instead have each fund audited annually and distribute the audited financial statements to investors within 120 days of fiscal year-end. A separate exception covers custody that arises only because an operationally independent related person holds client assets.

## How do standing letters of authorization affect custody?

A standing letter of authorization, or SLOA, is an instruction a client sets up with a custodian that lets the adviser direct money to a third party. On February 21, 2017, SEC staff issued a no-action letter to the Investment Adviser Association stating that an adviser acting under an SLOA to send client money to a third party has custody, but that staff would not recommend enforcement if the adviser skipped the surprise exam and met seven conditions.

According to summaries by Dechert and ThinkAdvisor, the conditions are: the client gives the custodian a signed written instruction naming the third party and giving its address or account number; the client authorizes the adviser in writing to direct transfers to that third party; the custodian verifies the authorization and notifies the client promptly after each transfer; the client can end or change the instruction; the adviser cannot designate or change the third party or its details; the adviser keeps records showing the third party is not related to it and does not share its address; and the custodian sends the client an initial notice confirming the instruction and an annual reconfirmation.

The staff also updated its custody FAQs the same day. Compliance firm Comply noted that transfers between a client's own accounts at different institutions do not trigger custody when the client's signed authorization lists the receiving account numbers, and that advisers should report SLOA assets in Item 9 of Form ADV after October 1, 2017.

## What does Form ADV require on custody?

Item 9 of Form ADV Part 1A asks whether the adviser or its related persons have custody, and asks for the total dollar amount of client funds and securities and the number of clients involved, according to summaries of the 2010 form changes.

Item 9 also asks whether a qualified custodian sends account statements to clients and whether an independent accountant performs an audit, surprise exam or internal control report. If so, the adviser completes Schedule D Section 9.C for each accountant.

Private fund advisers face a related disclosure in Schedule D Section 7.B.(1), which reports whether each fund's financial statements are audited and whether the audit opinion has been received. Failing to update those answers on time was part of the SEC's 2022 and 2023 custody sweep cases.

## What happened to the SEC's 2023 safeguarding proposal?

On February 15, 2023, the SEC voted 4-1, with Commissioner Hester Peirce dissenting, to propose redesignating the custody rule as new Rule 223-1, the Safeguarding Rule. The proposal would have extended the rule from client funds and securities to all client assets, including crypto assets and other non-securities, and would have treated discretionary trading authority as custody.

The SEC formally withdrew the proposal on June 12, 2025, as one of 14 pending rule proposals it pulled, according to the SEC. The agency said it did not intend to finalize those proposals and that any future rulemaking in those areas would require a new proposal and comment period.

The SEC returned to the subject in 2026. On October 1, 2026, it proposed custody rules for investment advisers and regulated funds that would allow self-custody of crypto assets in specified circumstances or custody through state-chartered trust companies, subject to conditions, according to Lowenstein Sandler. The proposal, published in the Federal Register on October 6, 2026, would also modernize and redesignate the existing custody rule. As of October 2026 it has not been adopted, so Rule 206(4)-2 remains in effect.

## How has the SEC enforced the custody rule?

On September 9, 2022, the SEC announced settled charges against nine investment advisers that it said failed to comply with the custody rule, failed to promptly update Form ADV on the audit status of private funds they advised, or both. The firms agreed to combined penalties of more than $1 million, and the cases came out of a targeted sweep by the SEC's examinations and enforcement divisions.

On September 5, 2023, the SEC announced a second round from that sweep: settled cases against five advisers, Lloyd George Management (HK), Bluestone Capital Management, The Eideard Group, Disruptive Technology Advisers and Apex Financial Advisors. The firms neither admitted nor denied the findings and agreed to penalties from $50,000 to $225,000, totaling more than $500,000.

The conduct in those cases included funds that were never audited, audited financial statements delivered to investors late, and Form ADV answers that were not updated when audits were completed.

## Questions

**What is Rule 206(4)-2?** Rule 206(4)-2 is the SEC custody rule under the Investment Advisers Act of 1940. It requires registered advisers with custody of client funds or securities to use qualified custodians and, in most cases, to get an annual surprise exam by an independent accountant.

**Does deducting advisory fees give an RIA custody?** Yes. Authority to deduct fees from client accounts is custody, but an adviser whose only custody comes from fee deduction is exempt from the annual surprise examination.

**Who counts as a qualified custodian?** Under the rule, qualified custodians include banks, SEC-registered broker-dealers that hold client assets in customer accounts, and registered futures commission merchants.

**Does holding a client's password create custody?** It can. According to summaries of SEC staff guidance, holding login credentials that let an adviser withdraw or transfer client assets is treated as custody, whatever the reason the adviser has them.

**What did the 2017 SLOA no-action letter do?** SEC staff said on February 21, 2017 that an adviser acting under a standing letter of authorization to a third party has custody, but would not need a surprise exam if seven conditions covering client instructions, custodian notices and the third party's independence are met.

**Is the 2023 safeguarding rule in effect?** No. The SEC proposed it in February 2023 and withdrew it on June 12, 2025. A separate custody proposal released on October 1, 2026 had not been adopted as of October 2026.

**What happens to advisers that violate the custody rule?** In settled SEC cases from 2022 and 2023, advisers accepted censures and cease-and-desist orders and paid civil penalties; the 2023 penalties ranged from $50,000 to $225,000 per firm.

Sources:
- SEC: Investor Bulletin: Custody of Your Investment Assets (https://www.investor.gov/news-alerts/investor-bulletins/investor-bulletin-custody-your-investment-assets)
- Katten: SEC Adopts Custody Rule Changes for Investment Advisers (https://katten.com/SEC-adopts-custody-rule-changes)
- Keiter CPA: Frequently Asked Questions About the SEC Custody Rule (https://keitercpa.com/blog/frequently-asked-questions-about-sec-custody-rule/)
- EisnerAmper: Digital access risks: implications of the custody rule (https://www.eisneramper.com/insights/artificial-intelligence-insights/digital-access-risks-implications-of-custody-rule-0925/)
- SEC: Investment Adviser Association, February 21, 2017 (no-action letter) (https://www.sec.gov/divisions/investment/noaction/2017/investment-adviser-association-022117-206-4.htm)
- Dechert: SEC Staff Issues No-Action Relief on the Use of Standing Letters of Instruction and Related Guidance for Investment Advisers (https://www.dechert.com/knowledge/onpoint/2017/4/sec-staff-issues-no-action-relief-on-the-use-of-standing-letters.html)
- ThinkAdvisor: SEC Issues No-Action Letter on Advisors' 'Imputed Custody' (https://thinkadvisor.com/2017/02/22/sec-issues-no-action-letter-on-advisors-imputed-cu/?amp=1)
- Comply: SEC issues RIA standing letter of authorization custody guidance (https://www.comply.com/blog/sec-issues-ria-standing-letter-of-authorization-custody-guidance)
- RIA Compliance Consultants: Form ADV Part 1 Custody Changes (https://ria-compliance-consultants.com/2010/11/form-adv-part-1-custody-changes)
- Bryan Cave Leighton Paisner: SEC Proposes Sweeping Expansion of Custody Rule (https://bclplaw.com/en-US/events-insights-news/sec-proposes-sweeping-expansion-of-custody-rule.html)
- SEC: Safeguarding Advisory Client Assets (withdrawal) (https://www.sec.gov/rules-regulations/2025/06/safeguarding-advisory-client-assets)
- Lowenstein Sandler: SEC Proposes Crypto Custody Rules for Investment Advisers and Regulated Funds, Including a Path to Self-Custody (https://www.lowenstein.com/news-insights/publications/client-alerts/sec-proposes-crypto-custody-rules-for-investment-advisers-and-regulated-funds-including-a-path-to-self-custody-fctm)
- Federal Register: Adviser and Regulated Fund Custody Rules; Crypto Custody Rules (https://www.federalregister.gov/documents/2026/10/06/2026-20466/adviser-and-regulated-fund-custody-rules-crypto-custody-rules)
- SEC: Press Release 2022-156 (https://www.sec.gov/news/press-release/2022-156)
- SEC: Press Release 2023-168 (https://www.sec.gov/news/press-release/2023-168)