Client Owns Crypto Outside Our Firm. What Should We Do?

Establish exactly what the client holds and where it sits, then place it deliberately: inside the advisory agreement, excluded from it in writing, or referred out. My view is that the placement matters less than naming it. The failure I see most often is the fourth option nobody chooses on purpose, where a firm watches a position informally and the client believes somebody is covering it.

The short version

• Get the facts before you form a view. Venue, wallet type, account title, and who else can move it come first.
• Custody reaches any authority to obtain possession, so accepting a client’s exchange login can change your regulatory posture before you have seen a balance.
• There are three honest placements: named in the advisory agreement, excluded from it in writing, or referred out.
• For units in a wallet the client controls, no broker form is coming and no identification relief applies. Their contemporaneous records are the whole record.
• Name the placement in the meeting and in the file. Nearly every complaint here began as an unstated expectation.

The conversation that has to happen first

I would form no view on a held-away position until seven answers sit in the file, taken in one sitting.

What is held, and where? Take the venue or wallet type and the exact account title, since titling decides who can act and which documents govern. Who else can move it? A spouse with the passphrase, a former partner on an old exchange sub-account, a developer who configured a multisig two years ago. Clients get this one wrong constantly, because access granted casually never feels like access.

How was each position acquired: purchase, mining, staking, an airdrop, a vesting token grant? That drives basis and holding period. What records exist, and where? Who has already advised on it? And what does the client want from you: monitoring, advice, or neither? Ask in those words and write the answer down. Last, what happens if they die this month? Estate failures with digital assets are almost always access failures.

Custody is a line you can cross by accepting a favor

Somewhere in the second meeting the client offers to hand over the login. It is meant helpfully, and it is the most consequential moment in the engagement, because the rule never asks whether you used the access.

“Custody means holding, directly or indirectly, client funds or securities, or having any authority to obtain possession of them … (ii) Any arrangement (including a general power of attorney) under which you are authorized or permitted to withdraw client funds or securities maintained with a custodian upon your instruction to the custodian.”

17 CFR 275.206(4)-2(d)(2)

Read that against an exchange account. A full-permission login carries withdrawal capability whether or not anyone uses it. Most venues issue permission-scoped API keys, so the working answer is a read-only key rather than a password, recorded on issue.

Two caveats. The rule speaks to client funds or securities, and whether a given digital asset is a security stays contested. And the rule is current: the SEC withdrew its 2023 replacement proposal on 17 June 2025, stating it “does not intend to issue final rules with respect to these proposals” (Withdrawal of Proposed Regulatory Actions). Supervision mechanics belong to your standing held-away policy; in the room, what matters is that accommodation does not create a custody question by accident.

Three placements, and the fourth one nobody chooses

Scope is yours to set, and the federal fiduciary duty “may not be waived, though it will apply in a manner that reflects the agreed-upon scope of the relationship” (SEC Release IA-5248), which is why the engagement document carries the weight here.

Inside the engagement. Choose this when the assets are named in the agreement, the valuation source is written down, there is a way to see them that avoids the problem above, and the firm can supervise what it recommends. Self-custodied positions carry their own conditions.

Excluded in writing. Legitimate, and only legitimate if the client is told what it means: nobody at the firm monitors the position, nobody reconciles it, and the tax records stay with them. Then name who picks up each task, usually the CPA for records, an attorney for access and succession, and the client for a written inventory. An exclusion that hands off each task protects both sides; one that lives only in a clause reads as boilerplate.

Referred out. Choose this when the work sits outside what the firm can supervise: a custody migration, entity titling, lot-level reconstruction across closed venues, a lock-up, an estate instrument. Sub-advisory arrangements and outright referral carry different disclosure consequences, and if compensation moves in either direction the client hears it in the same sentence as the recommendation. The adviser marketing rule (17 CFR 275.206(4)-1) governs how a paid referral gets disclosed on the receiving side.

The fourth option is informal monitoring, where the position sits outside the agreement and the adviser glances at it each quarter as a courtesy. Pick one of the three and write it down.

The record problem you can start on today

Whichever placement you choose, the client has a records problem that decays every month, and this is where an adviser earns the meeting.

Brokers report gross proceeds on digital asset transactions on or after 1 January 2025, and basis on certain transactions on or after 1 January 2026, on Form 1099-DA. That reaches the custodial part of a client’s holdings and stops there. For broker-custodied units, Notice 2026-20 extends temporary relief letting the taxpayer identify units in their own books and records through 31 December 2026. Its scope is explicit:

“The temporary relief described in section 4.02 of this notice is available only with respect to units of a digital asset held in the custody of a broker that are sold, disposed of, or transferred during the relief period.”

IRS Notice 2026-20, section 4.01

The same notice repeats that the relief “does not apply to digital asset units not held in the custody of a broker.” For the self-custodied portion no form arrives in February, and what the client wrote down at the time is what they have.

One window has already closed. Rev. Proc. 2024-28 offered a safe harbor for allocating unused basis to wallets and accounts as of 1 January 2025, and the allocation generally had to be complete by the first sale of that asset type on or after that date. A client who has sold since either did it or did not, and which one is a first-meeting question rather than an April one. The recurring record failures are cheap to fix early and expensive late.

What I actually see

The position surfaces in the wrong meeting. It comes out during an estate review or three days after a liquidity event, years into the relationship, because the intake form asked about “other assets” in language nobody reads as covering a hardware wallet in a drawer. Every recommendation made in between rested on a picture missing its largest line.

Second, the credential handed over in a helpful moment. Someone accepts a login because the client is frustrated and the alternative is another week of back and forth. It is rarely written down and never scoped, and it outlives the employee who accepted it. I have seen it found by the person cleaning up after that employee left.

Third, and most common, the informal watch. The position sits outside the agreement, the adviser looks at it each quarter because refusing feels unhelpful, and neither party ever says out loud whether it is covered. The expectation settles on the client’s side of the table and nothing in the file contradicts it. That gap costs more than the first two combined, because it surfaces only once something has gone wrong.

The exercise I would run before your next review cycle: take the ten largest relationships and answer three questions about each from the file alone. Does the file record whether this client holds digital assets? Does the agreement say whether they are in scope? Is there a dated note showing the client was told which? Any relationship returning a blank goes to the top of the list, and the blanks cluster in the oldest and largest relationships, onboarded before anyone thought to ask.

Where this goes wrong

Almost every bad outcome here traces to a position that was known about and never placed.

The specific failures: an intake form asking about “other assets” that draws a blank because the client does not think of a seed phrase as an asset held anywhere. Access accepted informally, leaving an unrecorded credential and a custody question the firm never decided to take on. An exclusion buried in a clause with no conversation attached. Advice given on the managed accounts with the held-away position out of view, so both the allocation and the tax picture rest on a partial inventory. Acquisition history left on a venue that closes eighteen months later. And the annual review that never re-asks, so an onboarding answer still governs a position since moved, grown, or pledged as collateral.

The decision rule

1. Ask the direct question at every review, naming wallets, exchanges, and staking rather than “other assets.”
2. Record where each position sits: venue or wallet type, account title, and everyone who can move it.
3. Decline the login. Ask for read-only access or a scoped key, and record which credential the firm holds.
4. Choose one placement and write it into the advisory agreement: inside, excluded, or referred.
5. Tell the client what that placement means for them, in the meeting and in the follow-up letter.
6. Start the record work immediately, separately from the advice question, since self-custodied units generate no broker form.
7. Disclose any referral compensation in the same conversation as the referral.
8. Date the file and re-ask next year, because the answer expires the moment the position moves.

Where this sits

This page covers the situation in front of you. The standing policy behind it, covering supervision, reporting, and billing mechanics, sits in held-away crypto policy for RIAs. Qualified custody for digital assets is the regime you are steering around, documenting recommendations is how a placement becomes evidence, and the custody hub collects the questions clients ask back.

Held-away positions sit across four desks at once. The attorney drafts the succession documents, the CPA carries the basis history, the keys are with a custodian or with the client, the recommendation is yours, and none of those four sees the other three files. Breaks show up at the join: an agreement that excludes the largest holding, an instrument naming assets nobody can reach, a sale reported against basis never allocated. Whoever owns the join owns the outcome, and in most engagements nobody has been asked to. If you would rather have the scope decision, the custody arrangement, and the tax records settled in one conversation than reconciled after a sale forces the question, adviser and RIA coordination is where my firm starts.

Sources

• 17 CFR 275.206(4)-2, Custody of funds or securities of clients by investment advisers (Cornell Legal Information Institute)
• SEC, Withdrawal of Proposed Regulatory Actions (Federal Register, 17 June 2025)
• SEC Release No. IA-5248, Commission Interpretation Regarding Standard of Conduct for Investment Advisers (Federal Register, 12 July 2019)
• 17 CFR 275.206(4)-1, Investment adviser marketing (Cornell Legal Information Institute)
• IRS Notice 2026-20, Extension of temporary relief under section 1.1012-1(j)(3)(ii)
• IRS Rev. Proc. 2024-28, Guidance for taxpayers to allocate basis in digital assets to wallets or accounts as of January 1, 2025
• IRS, Instructions for Form 1099-DA

Related

• Crypto held away from advisor: what should RIAs do?
• Can RIAs advise on self-custodied crypto?
• When should an advisor refer crypto clients to a specialist?
• How should RIAs document crypto recommendations?
• Qualified custody for RIAs managing digital assets
• Crypto for advisers and RIAs

Last updated: 3 August 2026.

This article is general education, not legal, tax, or investment advice. Scope, custody, and reporting outcomes depend on your firm’s registration, its agreements, and the facts of each account, and written procedures can reduce certain risks but do not eliminate them. Talk to qualified compliance counsel and a CPA about your own situation.