The custody rule explained

Under Rule 206(4)-2, an investment adviser has custody if it holds client funds or securities, or has any authority to obtain possession of them, and an adviser with custody must keep those assets with a qualified custodian and, in most cases, have them verified by a surprise examination each year. Most advisers with custody never touch a client's money: they deduct fees, move money under a standing instruction, or act as general partner of a fund.

The rule is 17 CFR 275.206(4)-2, in its current form since amendments effective 12 March 2010 (75 FR 1484). It applies to advisers registered or required to be registered with the SEC. State-registered advisers are subject to their state's custody rules, which can differ from the SEC's, so check your state's rule rather than assuming the federal one applies.

Step one: do you have custody?

Paragraph (d)(2) defines custody as "holding, directly or indirectly, client funds or securities, or having any authority to obtain possession of them." You also have custody if a related person does, in connection with advisory services you provide. The definition names three situations:

• Possession of client funds or securities. There is an exception for assets received inadvertently and returned to the sender promptly, and in any case within three business days. Checks drawn by clients and made payable to third parties are not client funds for this purpose.
• Any arrangement, including a general power of attorney, under which you can withdraw client funds or securities from a custodian on your instruction. Fee deduction authority falls here.
• Any capacity that gives you or a supervised person legal ownership of or access to client assets, such as general partner of a limited partnership, managing member of an LLC, or trustee of a trust.

Common ways advisers have custody without realizing it:

• Fee deduction. It carries lighter obligations, covered below, but it is custody.
• Standing letters of authorization (SLOAs) that let you direct payments to third parties.
• Online access with a client's login. The staff's custody FAQ (Question II.6) says an adviser has custody "if password access provides the adviser with the ability to withdraw funds or securities or transfer them to an account not in the client's name at a qualified custodian."
• Serving as trustee for a client's trust, or holding a general power of attorney, including for a family member who is also a client.
• The custodial agreement itself. IM Guidance Update No. 2017-01 warns that the agreement between the client and the custodian may give the adviser broader authority than the advisory agreement does, and that a conflicting clause in the advisory agreement does not cure it. Read the custodian's forms, not only your own contract.

The staff's FAQ (Question II.4) says limited authority to move money between a client's own accounts, authorized in writing with the accounts named, is generally not custody.

What the rule requires when you have custody

Paragraph (a) lists the conditions. Having custody without meeting them is a fraudulent, deceptive or manipulative practice under Section 206(4).

1. A qualified custodian holds the assets

Under (a)(1), a qualified custodian must hold client funds and securities either in a separate account for each client in the client's name, or in accounts containing only your clients' assets, in your name as agent or trustee. Paragraph (d)(6) defines qualified custodians:

• a bank or an FDIC-insured savings association
• a registered broker-dealer, holding the assets in customer accounts
• a registered futures commission merchant, for futures-related assets only
• a foreign financial institution that customarily holds financial assets for customers and keeps client assets segregated from its own

Mutual fund shares can be held through the fund's transfer agent instead ((b)(1)). Certain privately offered securities that are uncertificated, recorded only on the issuer's books and transferable only with consent are excepted from the qualified custodian requirement ((b)(2)); for a pooled vehicle, only if it is audited under (b)(4).

2. Notice to clients

When you open an account with a qualified custodian for a client, (a)(2) requires prompt written notice of the custodian's name, address, and how the assets are held, and again after any change. If you also send your own account statements, the notice and each of your statements must urge the client to compare your statements with the custodian's.

3. Quarterly statements from the custodian

You must have "a reasonable basis, after due inquiry," for believing the qualified custodian sends each client a statement at least quarterly, showing holdings at period end and all transactions in the period ((a)(3)). For a fund where you or a related person is general partner, the statements go to each limited partner ((a)(5)). A client can designate an independent representative to receive notices and statements ((a)(7)).

4. The annual surprise examination

Under (a)(4), an independent public accountant must verify the client funds and securities in your custody by actual examination at least once each calendar year, under a written agreement, at a time the accountant chooses "without prior notice or announcement to you and that is irregular from year to year." The agreement must:

• provide for the first examination within six months of becoming subject to the requirement
• require the accountant to file Form ADV-E with the Commission within 120 days of the examination date it chose
• require the accountant to notify the Commission within one business day of finding any material discrepancy
• require the accountant to file Form ADV-E within four business days of resigning, being dismissed or otherwise ending the engagement, with an explanation of any scope or procedure problems

5. Where you or a related person is the qualified custodian

If you or a related person acts as qualified custodian, (a)(6) adds an annual internal control report from an independent public accountant registered with and inspected by the PCAOB, and the surprise examination must also be performed by a PCAOB-registered and inspected accountant. The first internal control report is due within six months of becoming subject to the paragraph.

The exceptions most advisers rely on

Fee deduction

Under (b)(3), you do not need a surprise examination if you have custody solely because you can withdraw your advisory fee from client accounts held at a qualified custodian. The rest of the rule still applies: a qualified custodian, quarterly statements from it, and the client notice. Form ADV Part 1A, Item 9.A, tells SEC-registered advisers to answer "No" to the custody questions where custody arises solely from fee deduction, and to leave those assets out of the custody totals.

The exception is available only where fee deduction is the sole source of custody. A SLOA, a trusteeship or a client login with withdrawal rights brings back the surprise examination for those assets unless another exception applies.

Pooled vehicles: the audit approach

Under (b)(4), an adviser to a pooled vehicle is treated as meeting the surprise examination requirement, and is excused from the notice and quarterly statement requirements, if the fund:

• is audited at least annually by an independent public accountant registered with and inspected by the PCAOB
• distributes audited financial statements prepared under GAAP to all investors within 120 days of its fiscal year end
• has a final audit on liquidation, with the statements distributed promptly after it is completed

The staff's FAQ (Question VI.7) says it would not recommend enforcement action where a fund of funds distributes audited financials within 180 days of its fiscal year end, and (Question VI.8B) within 260 days for a top-tier fund investing in funds of funds. Paragraph (c) adds that delivery only to investors that are themselves related pooled vehicles does not count.

Operationally independent related persons

Under (b)(6), no surprise examination is needed where you have custody solely because a related person holds client assets and that related person is operationally independent of you. Paragraph (d)(5) presumes it is not operationally independent unless four conditions are met, covering creditor claims, access by advisory personnel, common supervision and shared premises. Rule 204-2(b)(5) requires a memorandum recording why the presumption was overcome.

Standing letters of authorization

A SLOA lets an adviser direct the custodian to pay a third party named by the client. In a no-action letter to the Investment Adviser Association dated 21 February 2017, the staff said an adviser with that authority has custody, but that it would not recommend enforcement action for not obtaining a surprise examination if seven conditions are met:

1. The client gives the custodian a signed written instruction naming the third party and either its address or its account number at a custodian.
2. The client authorizes the adviser in writing to direct transfers to that third party, on a schedule or from time to time.
3. The custodian verifies the instruction and sends the client a transfer notice promptly after each transfer.
4. The client can terminate or change the instruction.
5. The adviser has no authority to designate or change the third party's identity, address or other details.
6. The adviser keeps records showing the third party is not a related party and is not located at the adviser's address.
7. The custodian sends the client an initial notice confirming the instruction and an annual reconfirmation.

The relief covers the surprise examination only. The staff said the assets should still be included in Form ADV Item 9. Footnote 1 adds that a SLOA giving the adviser no discretion over amount, payee or timing does not implicate the rule at all. Condition five is the easiest to fail: if anyone at the firm can edit payee details in the custodian's system, there is no relief.

Records

Rule 204-2(b) adds records for an adviser with custody or possession of client assets: a journal of all purchases, sales, receipts and deliveries and other debits and credits; a separate ledger for each client; copies of confirmations; a record for each security showing which clients hold it, how much and where; and the operational independence memorandum. Paragraph (e)(1) requires these to be kept for five years from the end of the fiscal year of the last entry, the first two in an appropriate office of the adviser.

The 2026 proposal

On 1 October 2026 the Commission proposed amendments in Release IA-7023 (File No. S7-2026-35) that would redesignate the rule as Rule 223-1 and address custody of crypto assets. It would also add exceptions for discretionary trading authority, SLOAs and inadvertent custody, drop the PCAOB requirement for the accountant, and extend fund of funds audit deadlines. It is a proposal: Rule 206(4)-2 applies as written until a final rule takes effect.

What examiners look for

The Division of Examinations names custody as a core area in its fiscal year 2026 priorities. Examiners look for:

• Whether the firm knows it has custody. SLOAs, trusteeships, client logins and custodial agreement language the firm never reviewed.
• Form ADV Item 9 answers that do not match the firm's own population of SLOAs, fee-deducting accounts and fund relationships.
• Surprise examinations that were not performed, that started late, or where the adviser picked the date.
• Private fund audits distributed after the deadline, or not distributed to every investor.
• Adviser statements sent without the legend urging comparison with the custodian's statements.
• Inadvertently received client funds or securities not returned to the sender within three business days.

Common questions

Does deducting fees mean I have custody?

Yes. Fee deduction authority is custody under (d)(2)(ii). It does not require a surprise examination, under (b)(3), and an SEC-registered adviser answers "No" to Form ADV Item 9.A if fee deduction is its only source of custody. The qualified custodian, quarterly statement and notice requirements still apply. State-registered advisers should check their state's rule.

Does a SLOA give an adviser custody?

In the staff's view, yes, where the adviser has discretion over the amount, payee or timing of transfers to a third party. If all seven conditions in the 2017 letter are met, no surprise examination is expected, but the assets are still reported as in your custody.

When is the custody surprise exam due?

Once each calendar year, on a date the accountant chooses without telling you, irregular from year to year. The accountant files Form ADV-E within 120 days of that date. The first examination must be within six months of becoming subject to the requirement.

Do private fund advisers need a surprise exam?

Not if each fund is audited annually by a PCAOB-registered and inspected accountant and the GAAP financial statements reach all investors within 120 days of fiscal year end (180 days for a fund of funds, under staff FAQ relief). A fund that misses the deadline cannot rely on the audit provision for that year.

Write down the determination

Luna's custody policy template covers when the firm has custody, the pooled vehicle audit approach, related persons as qualified custodians and inadvertent receipt. The books and records guide covers the records behind it, and the Form ADV annual amendment guide covers where the answers go each year. The rule text and the 2017 SLOA letter are in the library at Rule 206(4)-2 and the IAA no-action letter.