Vastlink Design Partner Program · 2026 · Inviting 1–3 firms
Crypto custody for RIAs:
help build the controls behind it.
A secure wallet is only part of a responsible crypto custody arrangement. Investment advisers also need to decide who can move assets, which safeguards apply, what evidence is retained, and what happens when a key decision-maker is unavailable.
We are looking for 1–3 smaller registered investment advisory firms and wealth advisory teams to help shape an open, verifiable custody-governance approach, before we build a production product.
A short form. No commitment.
- Starts with a 15-minute call
- No program fee
- No transfer of client assets
- No private keys or seed phrases requested
Last updated · Regulatory status reviewed against the SEC docket on the same date
What is a crypto custody policy for RIAs?
In crypto custody for RIAs, a practical policy defines permitted custody arrangements, safeguards, decision rights, transfer procedures, reporting, continuity, and evidence of control effectiveness. It should let a firm answer one question at any time: who approved this transfer, under which policy, based on what evidence, and what would happen if that person could not act tomorrow?
Why this conversation matters in 2026
The SEC proposed a new crypto custody framework on 1st October 2026. It has not become a final rule.
The proposal would provide limited paths for investment advisers and regulated funds to maintain certain crypto assets in self-custody, subject to conditions. In particular, an adviser would need to document, for each relevant asset and at least quarterly, why no qualified custodian is available. The proposed requirements also address safeguarding systems, joint authorization, client reporting, and independent control assessment.
For an advisory firm, that makes the central question bigger than “Which wallet or custodian should we choose?” It becomes “Can we explain, operate, and demonstrate our custody decisions, consistently, even when something goes wrong?”
SEC announces the proposal (press release 2026-100).
Proposed deadline for an independent internal control report after taking self-custody, then at least annually.
The SEC's published public comment deadline.
Under the proposal, an adviser relying on the self-custody exception would, among other things, need an internal control report from an independent public accountant within six months after taking self-custody and at least once each calendar year thereafter. These are proposed conditions, not obligations newly in force today.
Where the proposal stands, and what comes next
- 1st October 2026 · SEC announces the proposal (press release 2026-100). Done
- 6th October 2026 · Proposal published in the Federal Register (Release No. IA-7023, File No. S7-2026-35). Done
- 7th December 2026 · Public comment period closes. Upcoming
- Final rule · Timing not yet known. The SEC may adopt, change, or not proceed with the proposal. To be determined
- Compliance date · Would be set only if a final rule is adopted. To be determined
We will update this page as the rulemaking moves forward. The eight-part policy framework below is useful whether or not the proposal is finalized, because crypto custody for RIAs already depends on clear decision rights, evidence, and continuity.
Primary sources: SEC proposed-rule docket (S7-2026-35) · Proposing release IA-7023 (PDF) · Federal Register, 6th October 2026 · SEC announcement, 1st October 2026 · Ropes & Gray analysis, 16th October 2026
A custody strategy has three layers
| Layer | The question it answers | What can still go wrong without governance |
|---|---|---|
| Custody arrangement | Who holds or controls the assets, and under what legal arrangement? | Responsibilities or provider dependencies are unclear. |
| Security technology | How are keys protected and transactions authorized? | Strong technology is configured around weak human processes. |
| Policy and evidence | Who may act, under what conditions, and how is every exception reviewed? | Decisions are hard to reconstruct when clients, auditors, or successors ask. |
Good providers may address all three layers. Our premise is that firms should be able to understand, review, and retain their own control decisions, rather than depend on opaque workflows or scattered conversations.
The working crypto custody policy framework
These eight sections form a discussion framework, not a substitute for a firm-approved policy or legal advice.
-
01
Permitted custodians and custody-option reviews
Document which providers and arrangements are acceptable for each asset, why they were selected, who approved the assessment, and when it must be revisited. Capture the alternatives considered rather than just the final provider name.
-
02
Conditions for adviser self-custody
If relevant, identify the legal basis, an asset-by-asset qualified-custodian availability assessment, segregation of client assets, designated key holders, and a scheduled review. Treat adviser self-custody as a conditional exception, not a default recommendation.
-
03
Signing authority and separation of duties
Define who can propose, approve, and execute a transaction; when two-person authorization is required; who acts as a management approver; and how permissions change when staff join, leave, or become unavailable.
-
04
Transfer limits and independent verification
Set rules for new destination addresses, unusual amounts, emergency transfers, independent confirmation, and escalation. Record how an exception was authorized, not just that a transaction succeeded.
-
05
Client reporting and reconciliation
Specify the transaction records, address-level evidence, reconciliation checks, statement frequency, exception handling, and responsibilities for explaining discrepancies to clients.
-
06
Continuity, incapacity, and succession
Identify backup decision-makers, access-recovery boundaries, documentation locations, service-provider dependencies, and a rehearsal process that never exposes live credentials.
-
07
Independent assurance and evidence readiness
Organize approvals, policy versions, exceptions, technical logs, and reconciliations so a qualified independent accountant and the firm's advisers can review the controls. A policy draft does not replace an independent control report.
-
08
Annual review, incidents, and corrective action
Assign owners for periodic reassessment of providers, key management, cyber risks, authorizations, and operational incidents. Track what changed, why, who approved it, and whether the fix worked.
The outcome we want to test
A firm should be able to answer who approved this transfer, under which policy, based on what evidence, and what would happen if that person could not act tomorrow?
Who this is for, and who it is not
This may be a good fit if…
Good fit- You are a smaller SEC- or state-registered advisory firm, multi-family office, or specialist wealth team
- You already face client questions about crypto exposure or custody
- A principal or compliance lead can participate
- You want to explore choices before committing client assets to an unproven product
- You do not need to hold crypto today
It is probably not the right fit if…
Not a fit- You need a production-ready custody provider immediately
- You want someone else to assume your regulatory responsibility
- You are looking for a consumer wallet (for personal plans, see crypto inheritance)
- You already have a mature custody-governance program with no unresolved operational questions
We are especially interested in firms willing to discuss actual workflows and trade-offs, even if the eventual conclusion is that an existing qualified custodian is the appropriate choice.
What you receive, and what we ask
- ✓ A custody-policy draft your compliance lead can take to counsel, with open decisions, gaps, and assumptions already listed
- ✓ A clear answer to “who approves what”, including who steps in when your principal is unavailable
- ✓ A rehearsed response to an unusual transfer or a missing decision-maker, tested in a tabletop exercise before it happens for real
You can keep the materials whether or not we continue together.
Also: your feedback informs which controls Vastlink explores first.
- ✓ Roughly three hours over six weeks
- ✓ Candid feedback about how decisions are made today
- ✓ Your perspective on which controls would be genuinely useful in software
We will not request wallet seed phrases, private keys, production credentials, or control of client assets. We can agree on confidentiality terms before sensitive discussions.
There is no program fee
Participation does not require a purchase commitment, product deployment, endorsement, or permission to use your firm's name publicly.
What a signing-authority outline can look like
Sample structure, illustrative only — not a client engagement| Transfer type | Proposes | Approves | If the approver is unavailable | Evidence retained |
|---|---|---|---|---|
| Routine, known address | Operations lead | Principal | Designated backup principal | Approval record, address-book entry, reconciliation |
| New destination address | Operations lead | Principal + compliance lead | Hold until two approvers are available | Independent address confirmation, call-back note |
| Above policy limit or urgent | Principal | Compliance lead + second principal | Escalate per continuity plan; no single-person override | Exception memo, reason, reviewer sign-off |
Roles and thresholds are placeholders. A real outline is drafted from your firm's own structure and reviewed by your compliance team and counsel.
How the first six weeks work
-
01Listen
Discuss your client demand, current custody choices, approval process, and operational concerns.
45 minutes
-
02Map
Vastlink prepares a first working policy and decision map from what we learned.
20–30-minute review
-
03Test controls
Walk through a transaction approval, exception, and escalation scenario.
45 minutes
-
04Refine
Revise the policy, noting open legal, technical, and operational questions.
20–30-minute review
-
05Rehearse
Run a tabletop continuity or succession exercise using fictional or test scenarios. No funds moved.
30 minutes
-
06Decide
Share your working draft, gap register, and product priorities. Decide independently whether to stay involved.
Optional conversation
The schedule is a starting point. We will adapt it to the constraints of a small advisory team rather than turn it into another compliance project.
What Vastlink is today
Vastlink is at the design and validation stage
We have a website and research articles and a demonstration application built in collaboration with Fystack. The demo is for exploration, not evidence that the proposed design-partner solution is deployable for client assets.
Frequently asked questions
Has the SEC approved adviser self-custody of client crypto assets?
Not through the October 2026 proposal. The SEC published proposed changes on 1st October 2026, but they are not a final rule. The contemplated self-custody path is limited and conditional, including a documented determination that a qualified custodian is unavailable. Firms should rely on current requirements and qualified legal advice when making custody decisions today.
What belongs in an RIA crypto custody policy?
A useful policy should connect custody choices to accountable people and reviewable evidence. Typical sections cover approved custodians, conditions for self-custody, signing authority, transfer verification, reconciliation and client reporting, incident response, continuity, and independent-control review. The right detail depends on the firm's assets, custody arrangement, risk profile, and legal obligations (see the working framework).
Does a design partner have to custody crypto today?
No. We are interested in firms that are considering client digital-asset exposure as well as firms with existing workflows. Questions about who would hold assets, approve transfers, or document controls can be explored without a live wallet. The program is about clarifying requirements before making a technology commitment.
Is Vastlink a custodian? Would it hold our clients’ assets?
No. Vastlink does not take custody of client assets and is not a qualified custodian. We are exploring the control and evidence layer that would sit on top of whichever custody route a firm chooses. Today Vastlink is at the design and validation stage, so there is no production product holding anyone’s assets.
Is the program free? Is there a product to buy?
The six-week design-partner program has no fee, and there is no production Vastlink custody product for sale through this program. We are asking for your experience and feedback, not a purchase order. Any future commercial proposal would be a separate discussion with terms shared explicitly rather than assumed at the outset.
Will we transfer assets or share private keys?
No. The proposed collaboration uses policy documents, interviews, and simulated scenarios. We will not ask for seed phrases, private keys, production credentials, or custody of your clients' assets. If sensitive business information needs to be discussed, we can first agree on suitable confidentiality arrangements and restrict what information is shared.
Is this legal, compliance, or audit advice?
No. Vastlink is exploring a governance workflow and may prepare a working policy draft for discussion. The draft will not certify compliance, serve as an independent internal control report, or replace the judgment of your chief compliance officer, qualified legal advisers, auditors, or regulated custodians. Final decisions and obligations remain with the appropriate professionals and the firm.
What happens after six weeks?
You keep the working documents and custody solution, and you decide whether further collaboration makes sense. We will share what we learned and which product ideas merit exploration. You are under no obligation to buy, deploy, endorse, or continue. We will not name your firm publicly without separate written permission.
Book a 15-minute call
Tell us where custody decisions feel hardest today, and we will reply by email to schedule a 15-minute call. One sentence is enough. We do not need a detailed asset list or confidential client information. No commitment.
Prefer not to use a form? Email johnny@vastlink.xyz directly.
Please don't include client names, wallet addresses, keys, or confidential account details. We will never ask for a seed phrase or private key. See our privacy policy.
Related reading
- Crypto custody for business
- Digital asset custody platforms compared (2026)
- What the $88 Million Coldcard Hack Teaches Us About Single-Vendor Custody Risk
Published for discussion as of , by Vastlink. Regulatory statements last reviewed . This page contains forward-looking product intentions and general educational information, not investment, legal, tax, custody, or compliance advice. Regulatory proposals and interpretations may change. Refer to the SEC rulemaking docket for current status. Vastlink never holds custody of client assets, and we never ask for seed phrases or private keys.