The OIRA review has begun. The 2023 proposal is dead. The No-Action Letter is alive. And the real signal is not in the text—it's in the timing.
Hook: The Signal Buried in the Federal Register
On a nondescript Tuesday in late 2025, the White House Office of Information and Regulatory Affairs—OIRA, the obscure but powerful gatekeeper of federal rulemaking—received a new submission from the Securities and Exchange Commission. The subject line read: Custody of Digital Asset Securities by Special Purpose Brokers and Investment Advisers.
Most market participants scrolled past. But for those of us who have spent years watching the slow, deliberate machinery of financial regulation, this single administrative action speaks volumes. It tells us that the SEC is finally moving from enforcement-driven crypto custody policy toward something more durable: a rules-based framework with conditional exemptions.
The custody rule is the institutional on-ramp. And the on-ramp is now under construction.
This is not about technology. It's not about consensus algorithms or smart contract audits. It's about something far more fundamental: whether the fiduciaries who manage trillions of dollars can legally hold digital assets on behalf of their clients without fear of regulatory reprisal.
Context: The Regulatory Pivot Nobody Noticed
To understand why this matters, we need to rewind to 2023. The SEC proposed a custody rule that would have dramatically expanded the definition of "custody" to include discretionary trading authority—a provision that sent shockwaves through the registered investment adviser community. The proposal was controversial, technically problematic, and ultimately withdrawn.
Then came September 30, 2025. The SEC's Division of Investment Management issued a No-Action Letter that, under specific conditions, allowed state-chartered trust companies to custody digital assets for registered investment advisers without triggering the full weight of the Custody Rule. The letter was narrow, conditional, and explicitly non-binding. But it was a signal.
The signal was this: the SEC is willing to create safe harbors for qualified custodians—if the conditions are right.
Now, with the OIRA review initiated, we're seeing the third phase of this evolution. The SEC is drafting a new proposal that will likely codify some of the logic from the No-Action Letter while establishing clearer standards for asset segregation, control reporting, and disclosure requirements.
Let me be precise about what this means in practice. The OIRA review is not a rubber stamp. It's a substantive review process where the White House examines the costs, benefits, and legal implications of proposed rules. The fact that the SEC has submitted a draft for review suggests the agency has reached internal consensus on the framework. The timeline matters: OIRA typically completes its review within 90 days, though extensions are common.
The target date of October 2026 for final rule adoption is a planning goal, not a legal deadline. But the direction is clear.
Core: The Institutional On-Ramp, Decoded
Let me walk through what this actually means for the market structure—because the implications are more nuanced than the headlines suggest.
The State Trust Company Advantage
The No-Action Letter created a de facto two-tier system. State-chartered trust companies that meet specific conditions—including maintaining custody of digital assets in segregated accounts, undergoing annual audits, and providing certain disclosures—can now serve as qualified custodians for RIAs without triggering the Custody Rule's full requirements.
This is not a small carve-out. State trust companies have been the quiet workhorses of the crypto custody ecosystem for years. They hold billions in digital assets for institutional clients, but they've operated in a regulatory gray zone. The No-Action Letter gives them a clear path forward.
Based on my experience auditing custody arrangements during the 2020 DeFi liquidity boom, I can tell you that the operational gap between "compliant" and "non-compliant" custody is often a matter of documentation, not technology. The No-Action Letter's conditions—segregation, audits, disclosures—are achievable for well-run institutions. The question is whether the final rule will maintain these conditions or tighten them further.
The RIA Dilemma
Registered investment advisers have been in a bind. Their clients want crypto exposure. Their compliance teams want regulatory clarity. And the Custody Rule—as currently written—creates significant operational burdens for advisers who custody digital assets with non-qualified custodians.
The No-Action Letter partially resolves this by creating a safe harbor for state trust companies. But it doesn't address the broader question of bank custody. Banks have been reluctant to enter the crypto custody space due to regulatory uncertainty, capital requirements, and the SEC's SAB 121 guidance—which requires banks to hold crypto assets as liabilities on their balance sheets.
The final rule could change this calculus. If the SEC extends the No-Action Letter's logic to banks—or creates a parallel framework for federally chartered institutions—we could see a significant shift in the competitive landscape. Traditional custodians like BNY Mellon, State Street, and Northern Trust have been waiting for this moment.
The ETF Feedback Loop
Here's where the analysis gets interesting. The approval of spot Bitcoin ETFs in January 2024 created a new class of institutional holders. But the ETFs themselves rely on custodians—primarily Coinbase—to hold the underlying assets. This concentration risk has been a persistent concern for regulators.
A broader custody framework would allow ETF sponsors to diversify their custodian relationships, reducing systemic risk and potentially enabling new product structures. This is not just about Bitcoin. If the custody rule creates a clear path for banks and trust companies to hold digital assets, we could see a wave of new ETF filings—for Ethereum, for Solana, for tokenized securities.
The custody rule is the infrastructure layer. Everything else—ETF flows, institutional adoption, tokenization—depends on it.
Contrarian: The No-Action Letter Is Not What It Seems
Here's where I need to push back on the prevailing narrative. The market has interpreted the No-Action Letter as a green light for institutional adoption. But that interpretation misses a critical detail: the No-Action Letter is not a rule. It's a statement of staff intent, and it can be withdrawn or overridden at any time.
Let me be clear about what a No-Action Letter actually is. It's a document issued by SEC staff indicating that, based on the specific facts presented, the staff will not recommend enforcement action to the Commission. It is not binding on the Commission itself. It does not have the force of law. And it can be rescinded if the staff's understanding of the facts changes or if the Commission takes a different position.
In other words, the No-Action Letter is a safe harbor with a time limit. It's a bridge, not a destination.
This creates a peculiar dynamic. State trust companies that rely on the No-Action Letter are building business models on a foundation that could shift beneath them. The final rule—whenever it arrives—could impose stricter conditions, grandfather existing arrangements, or create entirely new requirements.
The institutional investors who are treating the No-Action Letter as a permanent solution are making a category error. They're confusing a staff-level accommodation with a Commission-level rule. The former is a signal; the latter is a commitment.
There's also a deeper tension here that I've been tracking since my 2024 ETF regulatory analysis. The SEC is simultaneously trying to expand institutional access to crypto while maintaining its enforcement posture against unregistered securities offerings. The custody rule is part of the former effort. But the Howey Test—the four-pronged test for whether an asset constitutes an investment contract—remains the elephant in the room.
The custody rule does not resolve the Howey question. It simply creates a framework for holding assets that may or may not be securities. This means the SEC is building a custody infrastructure for an asset class whose legal status remains partially unresolved. That's not a contradiction—it's a hedge. The SEC is preparing for a future where some digital assets are deemed securities, and it wants the custody framework ready when that day comes.
Takeaway: The Gatekeeper's Clock
The OIRA review is the quietest signal in Washington. It doesn't generate headlines. It doesn't move markets. But it tells us that the machinery of institutional adoption is grinding forward.
The question is not whether the custody rule will arrive. The question is what it will contain—and who will be left outside the gates.
For state trust companies, the No-Action Letter provides an immediate opportunity. For RIAs, the final rule will determine whether crypto becomes a standard allocation or remains a niche exposure. For banks, the rule could be the key that unlocks the door to digital asset custody. And for the broader market, the custody rule is the infrastructure that will determine whether institutional capital flows into crypto through regulated channels or continues to seek workarounds.
Follow the money, not the noise. The money is moving toward a custody framework that will define the next phase of institutional adoption. The noise is the daily price action that distracts from the structural changes underway.
Volatility is the tax on impatience. The institutions that understand the custody rule's trajectory will be positioned for the next cycle. The ones that don't will be left watching from the sidelines.
The OIRA review is the first step. The proposal text will be the second. The final rule will be the third. Each step will take months. But the direction is clear: the SEC is building the on-ramp, and the institutions that prepare now will be the first to cross.
The gatekeeper's clock is ticking. The question is whether you're listening.