Two questions decide most of what follows. What can anyone at your firm actually do to a client’s digital asset, and can you show from paper what you decided and why. Every page below is downstream of one of those, and the second one fails more often than the first.
Part of our guide: Family Office.
The client’s version of this is a question about what to hold. Yours is a question about what your firm has become. You carry a filing that describes the business, an agreement fixing its scope, a manual an examiner samples for implementation rather than adoption, and a custody obligation that follows access rather than intention. Digital assets leave all of that machinery in place and take away the intermediary whose statement used to do most of the proving.
Worth settling before anything else: the ground moved through 2025 and 2026, in both directions at once. 17 CFR 275.206(4)-2 is still the operative custody rule, because the 2023 safeguarding proposal was withdrawn on 17 June 2025 alongside the outsourcing, cybersecurity risk management, predictive data analytics and ESG proposals, with the Commission stating it “does not intend to issue final rules with respect to these proposals” (90 FR 25531). Staff relief dated 30 September 2025 opened a conditional route to treating a state-chartered trust company as a bank for crypto custody. FinCEN’s adviser anti-money-laundering rule moved from 1 January 2026 to 1 January 2028. And an interpretation effective 23 March 2026 took up classification:
“Digital commodities, digital collectibles, and digital tools … are not themselves securities.”
SEC and CFTC, 91 FR 13714, effective 23 March 2026
That reaches further into this cluster than it looks, since the custody rule’s own words are funds or securities, so classification decides how much of a position the rule touches. A compliance calendar inherited from 2024 now carries dead lines, one new route, and a build date two years further out than its budget assumed.
Start here
Crypto compliance checklist for RIAs generates the list rule by rule instead of from headlines, since the provision creating a line also fixes what the answer has to look like to an outside reader. The sharpest pairing on the page: the compliance rule requires the annual review, and the books and records rule separately requires the documentation of it, so a thorough review leaving no artifact satisfies one and fails the other. It also works the marketing rule’s conditions on paid promoter arrangements at 17 CFR 275.206(4)-1(b), where token grants and waived fees are the compensation firms overlook, and it dates every deletion so a withdrawn proposal cannot reappear out of an old conference deck.
Qualified custody for RIAs managing digital assets works the rule that fixes your firm’s regulatory position, and its central observation is that the trigger sits inside your own firm. It runs the 30 September 2025 conditions as a checklist with an annual repeat, and it flags the paragraph governing an adviser acting as its own qualified custodian, which requires the accountant to reconcile against a custodian other than you. An arrangement built so that only the firm can move an asset leaves nothing outside itself to reconcile to.
Read those two first. Everything else here reports into one of them.
Proving it happened
Crypto due diligence checklist for RIAs starts from an absence. No adopted rule tells an adviser how to vet a provider, since the outsourcing proposal died in that same June 2025 action, so the duty runs through section 206, the compliance rule, and the books and records rule. Two lines are drafted for you already and both read as background rather than as instructions: the custody rule’s due inquiry into whether the custodian sends the client a statement each quarter, and the marketing rule’s treatment of anything modeled or backtested. Retention is a location rule as well as a period, which is how a careful firm fails on where the file sits.
How should RIAs document crypto recommendations? takes the opposite angle on the same rulebook. The recordkeeping list enumerates orders, communications, agreements and policies, and never asks why the advice suited this client, so the reasoning is the one thing you have to decide to keep. Written reasons are demanded in a single situation, for a communication recommending a specific security that does not state them, which reaches an advertisement and anything sent to ten or more people. The quarterly note naming an asset has been sitting inside that paragraph the whole time.
An examiner reads an unfindable file and an absent one the same way, which is why these two pages carry more weight than their subject matter suggests.
The assets you do not hold
Can RIAs advise on self-custodied crypto? answers yes in most cases and moves the hard constraint into the duty of care. Looking at a position changes nothing about your status; the ability to move it changes everything. The page splits the 2019 fiduciary interpretation the way an adviser uses it (Release IA-5248): after a reasonable inquiry a firm can generally rely on what the client says about their own circumstances, while the asset itself gets a real investigation. It then ranks the evidence of control, from a signed message down to a photograph of a screen, and notes that none of it reveals whether the position is pledged.
Crypto held away from advisor: what should RIAs do? is the standing policy, and its most useful correction is arithmetic. Regulatory assets under management is a supervision test, counting portfolios the firm supervises continuously and regularly, and the Form ADV instruction names advice delivered on client request as failing it. Assets under advisement has no Form ADV definition at all, which is why the brochure item permitting a different method also obliges the firm to document the method it chose.
Client owns crypto outside our firm. What should we do? is the meeting rather than the manual. Seven answers belong in the file before anyone forms a view, and the position then takes one of three honest placements: named in the agreement, excluded in writing, or referred out. The fourth is the one nobody chooses on purpose, where the adviser glances at the position each quarter as a courtesy and the client has spent two years believing somebody covers it.
When the work moves to another firm
What is crypto sub-advisory? covers the arrangement where a second adviser runs the digital asset sleeve under a contract between the firms. One fact to carry into any diligence conversation: the same account can sit inside both firms’ reported assets by design, so neither figure tells you who performs the work. The page also puts the exit in the first draft rather than the last, covering key rotation, whitelist removal, model access, notice periods, staking lock-ups and basis records, because a change of control at the specialist is already a consent event under the assignment provision.
When should an advisor refer crypto clients to a specialist? sets the trigger on the mechanic: custody arrangements, entity and trust titling, record reconstruction, transfer authority. Then it turns the question back on the referring firm, because compensation converts an introduction into a regulated communication. The de minimis exemption is $1,000 or its non-cash equivalent over the preceding twelve months, and a reciprocal flow of introductions, a sponsored client event, or office space nobody invoices you for all count as value received. The CFP Board standard adds the sentence clients most often never receive: a written statement of the work you will not be performing.
One document, many accounts
Crypto model portfolios for financial advisors is the operational page, and its premise is that the model holds nothing. Every account assigned to it owns its own property at its own venue with its own basis, so a single instruction produces a different result in each. Two constraints bind before anything reaches a client. Displaying what the model would have done is hypothetical performance, and the conditions attaching to it turn on whether the policies existed on the date the page shipped, so a mailing to one person stays inside the rule once it carries that performance. Then the tax half, where a single line in the model’s report lands as one disposition in every taxable account it touches, with the units leaving identified at or before the trade.
What I actually see with crypto for advisers and RIAs
The paper describes a smaller firm than the one that exists. Item 9 was answered honestly in year one, and since then a service was added, a credential accepted, a fee introduced, a signer appointed, and none of it went back to the filing. Nobody was careless on the day. Each change was small, sensible, and made by someone with no reason to think a form was involved, which is why the drift compounds unnoticed.
The calendar nobody dated. I have seen an open readiness workstream for a proposal withdrawn a year earlier, running beside a budget built for an anti-money-laundering program whose date had moved out by two years, while the conditions on a live compensated referral belonged to no one. Urgency arrives with the alert and never leaves with the proposal.
And the work that happened where the file cannot show it. This is where capable firms fail, rather than on substance: the analysis sits in a departed employee’s mailbox, the memo records a conclusion with no author and no version of the document reviewed, and a sound judgment becomes unprovable in front of somebody entitled to ask.
Two dates against every document
Four documents describe your firm to somebody outside it: Items 5.F and 9 of Form ADV Part 1, the Part 2A brochure, the advisory agreement your firm actually sends, and the compliance manual the annual review covers. Put them in a column and write two dates beside each. The date it was last amended, and the date the thing it describes last changed in operations.
Most firms fill the first column in ten minutes and stall on the second, and the stall is itself the finding, because it means nobody owns the trigger that should have started an amendment. Where both dates go in and the operational one is later, you have found the gap this cluster is about, and you found it before an examiner did.
Where crypto for advisers and RIAs fits
This cluster reads one set of facts from the professional’s side of the table, and the other nine hubs are written for the person who owns the assets, which makes them the better thing to send a client. Custody covers the arrangements you are evaluating. Wyoming LLCs and trusts cover the entities and instruments deciding whose asset it is and who may sign, which is where a supervised person picks up a capacity that changes your firm’s status. Estate planning covers the access failure that surfaces at a death, and tax covers the basis history your recommendation assumes exists. Banking covers the institution that has to receive the proceeds. Wealth management and family office cover the households sitting above a single advisory relationship, and founders covers the concentrated position whose restrictions are contractual and cannot be traded around.
The join fails differently on your side of it. Your file is the only one in the set built to be read by an outsider, while the attorney’s instrument, the CPA’s basis history and the custodian’s account agreement each answer to a different reader, and none of the three is obliged to tell you when it changes. So the party carrying the fiduciary obligation is the one most dependent on documents it does not control. Name who reads them together, and give that reading a date on the calendar. If you would rather have your filings, your agreements and your operations describing the same firm than reconciled for the first time in an examination, adviser and RIA coordination is where my firm starts.
Sources
- 17 CFR 275.206(4)-2, Custody of funds or securities of clients by investment advisers (Cornell Legal Information Institute)
- 17 CFR 275.206(4)-7, Compliance procedures and practices (Cornell Legal Information Institute)
- 17 CFR 275.204-2, Books and records to be maintained by investment advisers (Cornell Legal Information Institute)
- 17 CFR 275.206(4)-1, Investment adviser marketing (Cornell Legal Information Institute)
- SEC Division of Investment Management, no-action response to Simpson Thacher & Bartlett LLP (30 September 2025)
- SEC, Withdrawal of Proposed Regulatory Actions, 90 FR 25531 (GovInfo, Federal Register, 17 June 2025)
- SEC and CFTC, Application of the Federal Securities Laws to Certain Types of Crypto Assets, 91 FR 13714 (GovInfo, Federal Register, 23 March 2026)
- FinCEN, Delaying the Effective Date of the AML/CFT Program and SAR Filing Requirements for Registered Investment Advisers and Exempt Reporting Advisers (GovInfo, Federal Register)
Last updated: 6 August 2026. This hub indexes the adviser and RIA articles published so far and grows as more are added.
This page is general education, not legal, tax, or investment advice. It describes obligations that apply to registered investment advisers, recommends no allocation, asset, model, or provider, and compliance measures can reduce certain risks but do not eliminate them. Talk to qualified compliance counsel and a securities attorney about your own firm’s situation.
