Author: Ian Irlander, Galaxy Ventures venture capital advisor; Source: Galaxy Digital; Compiler: Shaw, Golden Finance

As investment behavior gradually migrates to the chain,Registered Investment Advisors (RIAs) are facing increasingly prominent conflicts between the federal custody regulatory framework and the actual operating model of decentralized finance (DeFi). At the same time, registered investment advisors still have a fiduciary duty to identify and adopt investment opportunities that are reasonably designed to generate returns for their clients. If a client wishes to incorporate DeFi-related strategies into the institutional investment logic and fiduciary investment scope, it will be difficult to give a reasonable explanation if the investment advisor completely rejects DeFi allocation.

Rule 206 (4)-2 under the Investment Advisers Act of 1940, commonly known in the industry as custody rules, was originally formulated to adapt to the centralized financial system: The entire system relies on licensed intermediaries, traditional account structures, and a custody model that can be verified and audited by regulatory agencies at any time. However, most DeFi investment strategies require advisors to directly deploy client assets on the chain through smart contracts and encrypted authority control mechanisms. This set of operating logic is difficult to match the preset conditions of existing regulatory rules. There is a disconnect between the rigid requirements of rules and regulations and the operating mechanism of modern on-chain investments, and the compliance gap continues to widen.

Background on the introduction of custody rules

The U.S. Securities and Exchange Commission (SEC) promulgated custody rules in 1962 to regulate the behavior of registered investment advisers in custody of client funds and securities. The core purpose is to reduce the risk of advisers misappropriating and misappropriating client assets. Subsequently, in response to systemic violations and major fraud cases, the SEC revised the rules multiple times. The two revisions in 2003 and 2009 had the greatest impact: they significantly expanded investment advisory obligations and added multiple control measures, such as strengthening self-custody model reviews and surprise on-site inspections.

Custody rules are in effect when a registered investment adviser holds client funds or securities in its own advisory capacity (either directly, or has the authority to withdraw assets). The above reform measures have effectively improved the investor protection mechanism in the traditional financial market.

The rules have dual guarantee requirements for client funds and securities custody setup procedures and structures: Customer assets must be placed in the custody of a qualified custodian (QC); investment advisors must reasonably confirm that the custodian will send account statements directly to clients at least every quarter; asset positions of collective investment products must be independently verified through surprise inspections or audited financial statements. If an investment adviser or its affiliates assume the custody function themselves, additional control measures will need to be added, including hiring an independent certified public accountant to issue an annual internal control report. This process will incur continued high audit, operational and compliance costs.

For registered investment advisors who invest in native DeFi protocols and digital assets for clients, implementing custody rules will encounter unique compliance challenges. Digital assets exist in the form of data records on distributed ledgers, and the core criterion for asset custody becomes: who has the authority to transfer and retrieve assets. Escrow solutions based on smart contracts, multi-signature wallets or multi-party secure computing (MPC) wallets often require the joint authorization of multiple parties to initiate transactions, which makes the traditional ownership, control, and custody identification logic under the rules framework become fuzzy and complicated.

The current status of the custody rule compliance industry

Whether they are traditional financial custodians or crypto-native custodians,most qualified custodians are unable or unwilling to support long-tail tokens, smart contract-native assets, and complex DeFi businesses. Each type of digital asset runs on an independent blockchain with different technical standards. Custodian institutions require customized development and long-term operation and maintenance. The relevant costs are ultimately passed on to investment advisors and customers in the form of custody fees. For registered investment advisers, entrusting a qualified custodian to hold such assets is either commercially unfeasible or prohibitively expensive.

For assets that currently do not have qualified custody institutions, registered investment advisors can only rely on the multi-party secure computing (MPC) custody structure to manage encrypted private keys and transaction authorizations. The multi-party secure computing system splits signature authority into multiple independent entities, uses a voting threshold mechanism to complete transaction approval, eliminates single points of failure, and prevents unilateral private transfer of assets. Although multi-party security computing has extremely strong security protection and operational stability, it still cannot fully meet the rigid requirement of "customer funds and securities are managed by qualified custody institutions" in the custody rules. The nature of this conflict reflects a deep structural contradiction:The existing rules are completely based on the design of centralized custody scenarios, while a large number of on-chain investment strategies adopt decentralized architecture.

Custody rules do not allow investment advisers to take custody of client funds and securities on their own, even if they use high-intensity technical protection measures, unless the assets are placed in the custody of a qualified custody institution. The rules default that customer assets can be held and controlled by qualified third-party custodians, but a large number of native DeFi assets do not meet this premise. Such assets generally have no paper certificates and are only recorded on distributed ledgers. They are issued by agreements rather than legal entities. They can be transferred freely through smart contracts and there is no centralized registration agency or transfer agent. At the same time, the development of most DeFi assets is still immature, and custodians are unable to complete system docking at low cost and in a timely manner. Due to the above characteristics, the vast majority of native DeFi assets cannot apply to the existing exemptions from custody rules.

The structural compliance gap faced by registered investment advisers in deploying DeFi

Multiple constraints have created a structural compliance gap for investment advisors who carry out on-chain DeFi strategies: According to the custody rule determination standards, as long as the advisor has the authority to initiate transactions and withdraw assets, it is deemed to constitute custody; however, at the practical level, there is no qualified custody institution that can undertake the corresponding assets and business, resulting in the failure to implement compliance at the technical level. Under such circumstances, even if registered investment advisers act in good faith and build a complete protection system to protect client assets, they will still face regulatory risks. At the same time, the fiduciary obligations stipulated in the "Investment Advisor Law" require advisors to always put the interests of their clients first, fully understand their clients' investment objectives before providing investment advice, and provide an allocation plan with reasonable basis. For a large number of customers, DeFi market investment strategies are one of their asset allocation needs. This creates a practical problem: how to build a regulatory framework that is adapted to on-chain businesses and based on custody rules, which can not only retain the core goal of protecting investors by rules, but also be compatible with the DeFi decentralized operating model.

Industry best practices for registered investment advisors to participate in DeFi

Recent regulatory developments show that regulators are fully aware of the above contradictions. SEC members have publicly stated that if investment advisers try their best to meet the requirements of custody rules in good faith, but are unable to fully implement them due to objective structures, regulators are willing to moderately relax regulatory standards. In June 2025, SEC Chairman Paul Atkins gave a speech, defining self-custody of encrypted assets and direct participation in decentralized systems as "core American values", emphasizing that if the existing regulatory framework brings unnecessary costs and hinders on-chain innovation, the SEC should adjust existing rules. He further revealed that he has instructed internal staff to study relevant rule revisions and introduce exemption regulations to fully cover the encryption custody, self-custody model and DeFi track.

Before the implementation of the special regulatory rules, market institutions explored a number of practical plans. On the premise of implementing the core goal of investor protection under the custody rules, taking into account technical feasibility, they were divided into two categories: technical control means and information transparency.

For registered investment advisors who currently do not have a qualified custodian to undertake the underlying assets and plan to carry out on-chain DeFi business, the most efficient path to implementation is to build a high-intensity encrypted private key management and transaction authorization control system, supporting a power and responsibility isolation governance structure, and completely split the three functions of transaction approval, system operation and maintenance, and investment decision-making. Relying on the multi-party secure computing custody model to implement the above-mentioned control mechanism, signature authority is split among multiple entities, and transactions must reach legal voting thresholds before they can be executed. This avoids excessive concentration of authority and prevents a single person from transferring customer assets privately. After multiple controls are superimposed, a basic framework for safe custody of assets on the chain can be formed. Although the multi-party security calculation model still cannot fully meet the standards according to the current provisions and implementation standards, this plan can fulfill the core legislative purpose of protecting investors behind the custody rules.

If there is no qualified custody institution to provide services, independent external supervision can be introduced to further improve the custody system: hire a US Public Company Accounting Oversight Board (PCAOB) certified public accounting firm to conduct annual audits, verify the balance of digital assets, review the custody control process and transaction links, and clarify the responsibility boundaries of the entire process of customer asset holding and management. The public chain is naturally transparent, allowing real-time query of asset balances and transfer records, and high-frequency monitoring of asset changes during audit intervals. Proper use of the real-time traceability feature on the chain can be used as a supplement to regular independent audits to strengthen investor protection.

Registered investment advisors also need to establish a rigorous due diligence process, covering two types of entities: self-custody service providers that provide self-custody technology and delivery of subscription-based software services, and various DeFi protocols in which customer assets will be invested. Due diligence includes: network security capabilities, private key management and operational risk control, solvency and bankruptcy isolation mechanisms, credit risks, legal compliance qualifications, smart contract audit completeness and coverage, governance structure, third-party infrastructure dependence risks, and rapid redemption channels for customer assets. At the same time, a written agreement is signed with the service provider to stipulate the contract terms related to asset protection. The comprehensive application of the above measures can ensure that customer assets are deployed in a stable and transparent environment and comply with the underlying logic of custody rules to protect investors.

Breaking the current regulatory deadlock on custody rules

Although the SEC is studying the formal revision of custody rules, registered investment advisers are still in a dilemma:Either carry out on-chain investments, but there is huge uncertainty about the compliance of the custody model; or give up providing customers with DeFi investment channels with profit potential.

During the transition period, investment advisors can manage and control risks in the following ways: adopt custody solutions that can protect customer assets, improve information transparency, and comply with the legislative spirit of custody rules to the greatest extent, continue to provide customers with investment channels in the emerging DeFi market, and maximize customer interests. By integrating the five major methods of multi-party secure computing private key management, separation of rights and responsibilities, full disclosure of risks to investors, in-depth due diligence of self-custody service providers and DeFi protocols, and third-party independent audit supervision, investment advisors can build a custody system that can basically achieve the core goal of protecting investors by the rules even if it cannot fully meet the hard technical terms of the rules. This set of layered, risk-oriented solutions has become an emerging common best practice in the field of digital asset management, and also provides investment advisors with a feasible path: to implement innovative on-chain investment strategies while adhering to long-term fiduciary obligations.