Most firms that get the custody question wrong do not get it wrong because they were hiding client assets. They get it wrong because someone read the phrase “custody of client funds or securities,” pictured a vault, decided it did not apply to them, and moved on. Then an examiner asks how the firm deducts its advisory fees, and the answer that felt safe for three years turns into a deficiency letter.
That gap between “we don’t have custody” and “yes, and we never realized it” is the single most common way otherwise careful RIAs walk into the most common SEC exam deficiencies. The rule is not obscure. What is obscure is how quietly custody attaches to ordinary business arrangements you already have in place.
The short answer: Under SEC Rule 206(4)-2, you have custody any time you hold client funds or securities, or hold any authority that lets you obtain them. Deducting your fees directly from client accounts is custody. Holding a standing letter of authorization to move client money is custody. Having custody does not make you non-compliant. Failing to apply the required safeguards, which usually means a qualified custodian, quarterly statements sent to clients, and in many cases an annual surprise examination, is what makes you non-compliant.
What is the RIA custody rule (Rule 206(4)-2)?
Rule 206(4)-2 under the Investment Advisers Act of 1940 is the SEC regulation that governs how a registered investment adviser safeguards client assets it holds or can reach. It was adopted in 1962 and last meaningfully amended in 2009, in the aftermath of the Madoff and Stanford frauds, which is worth remembering because the entire rule is built around a single assumption: an adviser who can touch client assets can, in the worst case, take them.
The rule defines custody deliberately broadly. You have custody when you hold client funds or securities directly, and also when you have any arrangement that gives you the authority to obtain possession of them. That second clause is where firms get caught. Authority is enough. You do not have to move a dollar to trigger the rule. You only have to be able to.
For a working definition an examiner would recognize, custody is not “do we keep client money in a drawer.” It is “is there any mechanism by which this firm could get its hands on client assets without the client taking a separate action.” If the answer is yes, the rule is in play.
Do you have custody? The triggers firms miss
Here is where the theory stops mattering and the arrangements you already run start mattering. Most inadvertent custody comes from one of these, and none of them looks like custody until it is pointed out.
- Direct fee deduction. If you instruct the custodian to pull your advisory fee straight from client accounts, you have custody. This is the most common trigger and the one firms are most surprised by, because deducting fees feels like billing, not possession. The rule sees authority over the account, not intent.
- Standing letters of authorization (SLOAs). A signed standing instruction that lets you move client money to a third party gives you custody, because you can direct assets somewhere the client did not separately approve each time. SEC guidance made this explicit, and it caught a large number of firms that had treated SLOAs as a convenience rather than a custody event.
- Login credentials to client accounts. If your firm holds a client’s username and password and can transact in the account, you have functionally obtained the ability to possess assets. Convenience access is still access.
- Serving as trustee or general partner. Acting as trustee for a client trust, or as general partner or managing member of a pooled vehicle you advise, gives you custody of those assets almost by definition.
- Bill-paying authority and receiving client assets. Authority to pay a client’s bills from their account is custody. So is inadvertently receiving client funds or securities, for example a check made out to a third party that you are supposed to forward. The rule requires you to return most misdirected assets promptly rather than hold them.
The pattern underneath all five is the same. Custody is not about ownership or intent. It is about reachability. When you review your own firm, do not ask “do we take client money.” Ask “what can we do to a client account without the client doing anything.” That question surfaces in the compliance manual.
What the custody rule actually requires
Once you have established that you have custody, the rule imposes a specific set of protections. They exist to make theft difficult and detectable, which is the whole point.
- Use a qualified custodian. Client funds and securities must be held by a qualified custodian, typically a bank or broker-dealer, either in the client’s name or in your name as agent for the client.
- Ensure clients receive account statements. The qualified custodian must send account statements directly to clients at least quarterly. Direct delivery from the custodian is the control. It gives the client an independent record you did not produce.
- Undergo an annual surprise examination. In most custody situations, an independent accountant registered with the PCAOB must verify client assets once a year, on a date the accountant does not announce in advance. The surprise is the safeguard. A scheduled audit is easy to prepare for in ways that defeat the purpose.
- Confirm a reasonable basis for belief. You need a reasonable basis, formed after due inquiry, for believing the qualified custodian is actually sending those statements to clients.
Custody also reaches your recordkeeping obligations, because verifying assets is impossible without a clean trail. The overlap with SEC Rule 204-2 books and records is not incidental. An examiner testing custody will ask for the records that prove statements went out and assets reconcile, and a firm that cannot produce them fails the custody question on documentation alone.
The fee-deduction and SLOA exceptions, and where firms get overconfident
This is the part firms hear about secondhand, apply too broadly, and then rely on.
If the only reason you have custody is that you deduct advisory fees from client accounts, you are generally not required to obtain the annual surprise examination. That is a real and useful carve-out. It is also narrow. It applies to fee deduction and not to the other triggers, so a firm that deducts fees and also holds SLOAs cannot use the fee exception to cover the SLOAs.
SLOAs have their own path. Under SEC no-action relief, an adviser whose only custody comes from SLOAs can avoid the surprise examination if it meets a specific set of conditions, including that the client signs the instruction, the client can terminate or change it, the adviser has no authority to name or change the third-party recipient, and the custodian sends the client a written confirmation of the transfer. Miss one condition and the relief does not apply, and the surprise examination requirement comes back.
The overconfidence failure looks like this: a firm decides it is “fee-deduction only,” never re-checks as it adds SLOAs and account access over the years, and discovers during an exam that its custody footprint grew while its custody controls did not. Custody is not a one-time determination. It is a status that changes every time you add an arrangement that touches a client account, which is exactly why it belongs inside your RIA compliance management program and not in a memo someone wrote at registration.
What changed: the Safeguarding Rule, its withdrawal, and why custody is back on the 2026 agenda
If you have read anything about custody in the last few years, you have probably seen the phrase “Safeguarding Rule,” and you may be unsure whether it is now the law. It is not. Here is the honest state of play.
In 2023 the SEC proposed replacing the custody rule with a broader Safeguarding Rule, recodified as new Rule 223-1, that would have extended custody obligations beyond funds and securities to essentially any client asset an adviser could possess, crypto assets included. The proposal drew heavy industry opposition, largely on the grounds that it swept too broadly and would have been operationally punishing for advisers and custodians alike. The SEC withdrew the proposal in 2025.
That withdrawal did not settle the question. The custody rule has returned to the SEC’s regulatory agenda for 2026, which means a revised approach is expected rather than closed. Separately, SEC staff have continued to address narrow, modern custody questions, including digital-asset custody, through no-action relief rather than through the rule itself.
The practical takeaway is not “wait and see.” It is the opposite. Rule 206(4)-2 is fully in force today, the version most likely to reach you is the one already on the books, and the direction of travel is toward more scope, not less. Firms that treat custody as settled because one proposal died are preparing for the wrong exam. The SEC exam priorities for 2026 reward firms that harden current obligations now instead of betting on a rule that got pulled.
How to know where you stand: a custody self-assessment
You do not need a law firm to figure out whether custody applies. You need to answer a short set of honest questions and then match your controls to the answer. Run this before an examiner runs it for you.
- List every arrangement that can reach a client account. Fee deductions, SLOAs, held credentials, trustee or GP roles, bill-pay authority. If it can move or access assets, it goes on the list.
- Classify each one. For each item, decide whether it creates custody. When in doubt, assume it does, because the rule’s definition of authority is broad and examiners read it broadly.
- Map controls to each custody source. Qualified custodian in place, quarterly statements going directly to clients, and either a completed surprise examination or a documented, fully met exception (fee-only or the SLOA conditions).
- Check your Form ADV. Your custody disclosures on Form ADV must match reality. A mismatch between what you disclose and what you actually do is its own finding, separate from the underlying custody issue.
- Reconcile and document. Keep the records that prove statements were delivered and assets verified. Custody compliance you cannot evidence is custody compliance you cannot defend.
The firms that clear custody cleanly are not the ones with the fewest custody triggers. They are the ones who know exactly which triggers they have and can show the matching control for each. Treat this like any other exam-critical area and proactively prepare for the audit rather than reconstructing your custody posture the week the notice arrives.
Getting this right by hand, across a growing set of accounts and arrangements, is where most firms quietly fall behind. Purpose-built RIA compliance software keeps the custody determination current, ties each source to its control, and holds the evidence trail in one place, so custody stays a known status instead of an exam-day surprise.
Frequently asked questions:
The SEC custody rule is Rule 206(4)-2 under the Investment Advisers Act of 1940. It requires registered investment advisers that have custody of client funds or securities to safeguard those assets, primarily by using a qualified custodian, ensuring clients receive account statements directly, and in most cases undergoing an annual surprise examination by an independent accountant.
You have custody if you hold client funds or securities, or if you have any authority that lets you obtain them. Common sources include direct fee deduction, standing letters of authorization, holding client login credentials, and serving as trustee or general partner. If any arrangement lets your firm reach a client account without the client acting, you likely have custody.
Yes. Deducting fees directly from client accounts is custody under the rule. However, if fee deduction is your only source of custody, you are generally not required to obtain the annual surprise examination, provided you meet the conditions of that exception.
Generally yes. A SLOA that lets you move client assets to a third party creates custody. You can avoid the surprise examination only if you satisfy the specific conditions in the SEC’s no-action relief, such as the client signing and being able to change the instruction and the custodian confirming transfers to the client.
It is an annual verification of client assets performed by an independent accountant registered with the PCAOB, conducted on a date the firm is not told in advance. The unannounced timing is the safeguard, because it prevents a firm from arranging assets specifically for a known audit date.
The 2023 Safeguarding Rule that would have replaced the custody rule was withdrawn in 2025, so it is not in effect. The custody rule has returned to the SEC’s 2026 regulatory agenda, meaning a revised proposal is anticipated. Rule 206(4)-2 remains fully in force in the meantime, so firms should comply with the current rule now.
Non-compliance with the custody rule is a common and serious exam finding. Consequences range from deficiency letters requiring remediation to enforcement action, depending on severity, along with the reputational cost of a custody failure, which speaks directly to whether client assets were protected.
