Decide in writing whether each held-away position sits inside or outside the advisory relationship, then make supervision, valuation, billing, Form ADV, and the books and records all agree with that decision. My view: the firm-side failure almost never starts with the crypto. It starts with a firm that touches the position enough to owe something on it while its filings still describe a smaller business.
Held-away crypto: the short version
- Custody follows authority, and authority can sit in a password. Staff have said an adviser has custody where password access carries the ability to withdraw assets or move them to an account not in the client’s name.
- A related person’s authority counts as the firm’s, so a supervised person acting as trustee or LLC manager pulls the position into the rule.
- Regulatory assets under management is a supervision test. Item 5.F counts securities portfolios the firm supervises continuously and regularly, and advice given “upon client request” fails that test by name.
- Any asset figure the firm publishes has to be reproducible. Part 2A Item 4.E permits a method different from RAUM only where the firm documents it.
- The refusal path belongs in the policy before it is needed, because the client who declines is the one most likely to complain later.
Where the custody line actually falls
Custody attaches to authority rather than to where the asset sits, and the Form ADV glossary carries a branch that catches firms by surprise:
“You have custody if a related person holds, directly or indirectly, client funds or securities, or has any authority to obtain possession of them, in connection with advisory services you provide to clients.”
A supervised person serving as trustee of a client trust, or as manager of a client’s LLC that holds a wallet, can carry the firm across that line without the firm ever receiving a credential. Asked whether an adviser holding a client’s account ID and password to rebalance the account has custody, the staff answered:
“The adviser has custody if password access provides the adviser with the ability to withdraw funds or securities or transfer them to an account not in the client’s name at a qualified custodian.”
SEC, Staff Responses to Questions About the Custody Rule, Question II.6
For a firm-wide policy, that is an instruction to inventory capability rather than intent. Exchange API keys are permission-scoped, so two keys that look identical in a password manager can differ on whether withdrawal is enabled. Record the scope of every credential when it is issued, re-test it at renewal, and revoke it when the holder leaves.
Fee debiting is the branch firms forget. Authority to withdraw from a client account to pay the firm is custody, and the relief in 17 CFR 275.206(4)-2(b)(3) from the annual surprise examination is written around assets “maintained by a qualified custodian,” so whether it reaches a fee debited from a retail exchange account turns on that venue’s status. Settle that before the debit is configured. The rule text is current: the Commission withdrew its 2023 replacement proposal on 17 June 2025 (Withdrawal of Proposed Regulatory Actions). Qualified custody for digital assets covers the far side of that line.
Supervising an asset the firm cannot transact in
Obligations do not scale down because the asset is out of reach. The compliance program rule requires written policies and procedures “reasonably designed to prevent violation,” a review “no less frequently than annually,” and a named chief compliance officer (17 CFR 275.206(4)-7). A held-away practice with no written procedure still has one, and it gets reconstructed from emails during an examination.
The books and records rule requires copies of communications “relating to: (i) Any recommendation made or proposed to be made and any advice given or proposed to be given,” and separately a record of every account in which the firm “is vested with any discretionary power” (17 CFR 275.204-2). Held-away advice generates the first and usually nothing for the second, so documenting the recommendation is the only artifact the firm will have.
Valuation is where firms improvise. A position the firm cannot query has no natural price feed, so the policy has to name one source, one time of day, and one rule for units with no reliable quote, applied to every client alike. A screenshot the client sent on Tuesday is a fact about Tuesday. Publish that number in a performance report and the firm has to stand behind it, because the marketing rule bars any “material statement of fact that the adviser does not have a reasonable basis for believing it will be able to substantiate upon demand by the Commission” (17 CFR 275.206(4)-1).
Billing, Form ADV, and the numbers the firm publishes
Regulatory assets under management is narrower than most firms assume. The instruction is to “include the securities portfolios for which you provide continuous and regular supervisory or management services.” An account counts as a securities portfolio only where “at least 50% of the total value of the account consists of securities,” and the calculation excludes “the portion of an account … under management by another person.” The instruction also names what fails the test, including advice given “on an intermittent or periodic basis (such as upon client request, in response to a market event, or on a specific date).” Most held-away arrangements land there, and a firm folding them into Item 5.F anyway has overstated its RAUM.
Assets under advisement is the honest label for the rest, and it has no Form ADV definition, which is why it needs an internal one. Item 4.E supplies the discipline: a firm may compute “client assets you manage” by a method other than RAUM, and if it does, “you must keep documentation describing the method you use” (SEC, Form ADV Part 2). That memo runs one page: asset classes included, valuation source, as-of convention, reconciliation step. Firms that write it once stop arguing about it.
Then reconcile the fee schedule to it. A held-away tier priced by complexity behaves differently from a basis-point charge on a balance the firm cannot verify, and the second puts firm revenue on a number the client supplied. Item 5.A still requires the brochure to “describe how you are compensated for your advisory services,” so a new charge means a new disclosure. Where that fee is debited rather than invoiced, the firm is back in the custody analysis above. The crypto compliance checklist is where these settle into a review cycle.
What the policy says when the client declines
Some clients will not disclose a wallet, and some will not move an exchange position. Three clauses cover it. Record the limitation in the file and repeat it on the face of any plan built on a partial inventory. Narrow the written scope where the undisclosed portion is large enough to make advice on the rest unreliable. And name who signs off and when the question gets re-asked, since a refusal is a dated answer about a position that moves.
What I actually see with held-away crypto
The read-only credential that is not read-only. A firm collects exchange logins to pull balances for reporting, files them as view access, and never tests what they can do. I have seen a full-permission login sit in a shared vault for two years while the firm’s Form ADV reported no custody. Nobody withdrew anything, which is beside the point, because the rule asks about capability.
Second, the report that includes what the firm never supervised. Household statements show the full picture because clients ask for the full picture. The held-away line is priced off whatever the client last sent, the timestamp is unstated, and no document authorizes the firm to publish it. That number gets quoted back to the firm the following quarter.
Third, the fee that outgrew the filing. A firm adds a coordination charge for digital assets, applies it to a household figure including held-away positions, and updates neither the brochure nor the memo behind the figure. In my experience that is a documentation failure rather than a pricing one, and it stays cheap to fix until an examiner asks how the invoice was calculated.
The check I would run this quarter: pull the last statement sent to every client holding digital assets, and for each held-away line write down four things. The price source. The time that price was taken. The document authorizing the firm to include the position. And where those assets appear on Form ADV. Any line with a blank is a representation the firm cannot substantiate.
Where held-away crypto goes wrong
Nearly every problem here comes from a firm running one standard in practice and describing another on paper.
The specific failures: credentials collected for convenience and never scoped, so custody arrives through the back door and the annual review never catches it. A supervised person serving as trustee or LLC manager, which the firm treats as a favor and the rule treats as a related-person arrangement. Valuation improvised per household, so two clients holding the same asset see different numbers on the same date. Performance reports blending supervised and unsupervised assets into one figure. RAUM that absorbs advised-only positions because a spreadsheet totals everything visible. A brochure amended for the new service line but not the new fee. And no clause at all for the client who declines.
The decision rule for held-away crypto
- Inventory by authority before you inventory by asset. List who at the firm or its related persons can move each position, and by what mechanism.
- Test every credential against the withdrawal question, recording scope at issuance, re-testing at renewal, revoking on departure.
- Write the scope into the advisory agreement, marking each position included, excluded, or advised-only, and repeat those words in the brochure.
- Adopt one valuation convention firm-wide: source, time of day, and the rule for units with no reliable quote.
- Separate RAUM from advised assets in the source data, so Item 5.F is built from supervised portfolios.
- Keep the Item 4.E methodology memo current, and reconcile each invoice back to it.
- Assess custodial status before configuring any fee debit against an exchange or wallet account.
- Put the refusal clause in the manual and rehearse it annually, so the firm’s answer exists before the client’s does.
Where held-away crypto fits
The conversation producing these facts belongs to the client meeting; this page is the standing policy behind it. Advising on self-custodied positions carries its own conditions, sub-advisory arrangements move part of the work into another firm’s manual, and the custody hub holds the client-side questions the same facts generate. Tax coordination starts with planning for concentrated holders.
These questions cross professional boundaries, and the crossing is where firms get hurt. The attorney who drafted the trust never reads the advisory agreement. The CPA reconstructing basis never sees which positions the firm supervises. The custodian knows its own account and nothing about the wallet beside it. Each record is internally consistent and the set of them is not, so the firm holds the only document that could reconcile them and usually has not written it. Owning that reconciliation is the work, and the estate hub shows what it costs when nobody does.
Sources
- 17 CFR 275.206(4)-2, Custody of funds or securities of clients by investment advisers (Cornell Legal Information Institute)
- SEC, Staff Responses to Questions About the Custody Rule (Division of Investment Management)
- SEC, Withdrawal of Proposed Regulatory Actions (Federal Register, 17 June 2025)
- 17 CFR 275.206(4)-7, Compliance procedures and practices (Cornell Legal Information Institute)
- 17 CFR 275.204-2, Books and records to be maintained by investment advisers (Cornell Legal Information Institute)
- SEC, Form ADV Instructions and Glossary
- SEC, Form ADV Part 2
Related
- Client owns crypto outside our firm. What should we do?
- Qualified custody for RIAs managing digital assets
- Crypto compliance checklist for RIAs
- How should RIAs document crypto recommendations?
- Can RIAs advise on self-custodied crypto?
- Crypto for advisers and RIAs
Last updated: 3 August 2026.
This article is general education, not legal, tax, or investment advice. Custody, scope, and reporting outcomes turn on your firm’s registration, its agreements, and the facts of each account, and written procedures can reduce certain risks but do not eliminate them. Talk to qualified compliance counsel about your own situation.
