Investment Adviser Custody

Custody depends on access and authority

An adviser can have custody without storing certificates in its own office. Under the SEC custody rule, custody broadly includes holding client funds or securities, directly or indirectly, or having authority to obtain possession of them. Certain capacities, including serving as a general partner of a private fund or trustee with access to client assets, can also create custody. The precise definition and exceptions in current Rule 206(4)-2 control.

Physical possession is the easiest case. If an adviser keeps a client's check or securities certificate, it has custody. But the analysis also reaches authority to withdraw funds or securities. An adviser with a power of attorney that permits withdrawals may have custody even when the assets remain at a bank or broker. Calling the arrangement ‘administrative’ does not settle the legal question.

Limited authority to deduct advisory fees from a client account is treated differently under the rule's definitions and conditions. The adviser should keep fee calculations and invoices, and the client should receive account statements showing deductions. Other withdrawal authority, such as the ability to wire money to the adviser or a third party, can create custody. Review the specific authority rather than assuming all account access is equivalent.

Qualified custodian and notice

For SEC-registered advisers with custody, Rule 206(4)-2 generally requires client funds and securities to be maintained with a qualified custodian in a separate account for each client or in a pooled account under the rule. Qualified custodians include banks, certain savings associations, registered broker-dealers, futures commission merchants for specified assets, and foreign financial institutions meeting conditions. The rule's exact categories and restrictions matter.

The adviser must notify clients promptly in writing of the qualified custodian's name and address and the manner in which client assets are maintained. If the custodian or arrangement changes, the adviser must update clients as required. Notice should help the client recognize where assets are held and how to verify account information. A statement from the adviser alone is not a substitute for the qualified custodian's own account records.

A client should verify the custodian independently using trusted contact information. If an email provides a new wire instruction, call the custodian at a previously known number. Custody controls reduce the risk that assets are misdirected, but they do not eliminate fraud or cyber risk. Clients should compare balances and transactions with statements received directly from the financial institution.

Quarterly statements and independent verification

The rule generally requires an adviser with custody to have a reasonable basis, after due inquiry, for believing the qualified custodian sends account statements to each client at least quarterly. The statements show transactions and holdings. Advisers may also send their own reports, but they must urge clients to compare those reports with statements from the custodian. Direct custodian statements create an independent reference point.

The rule also generally requires an annual surprise examination by an independent public accountant to verify client funds and securities, with the accountant chosen without prior notice to the adviser and with examinations conducted at irregular intervals. The accountant files the required report and related materials with the SEC under the rule. The exact requirement can depend on custody facts and exceptions.

An adviser that serves as the qualified custodian for client assets can face additional requirements, including an internal control report from an independent accountant. The rule also contains an operational-audit approach for certain pooled investment vehicles. Do not memorize ‘custody always means surprise exam’ without checking the exception, account type, and the adviser’s role as custodian.

Exceptions require conditions

The rule includes exceptions, such as certain privately offered securities held by a qualifying private fund, but the exception has defined conditions. A private fund must meet the rule's criteria, and the adviser must satisfy reporting, audit, and delivery requirements where applicable. A security's illiquidity or private placement label alone does not excuse custody safeguards.

A pooled investment vehicle may use an annual audit in lieu of the surprise examination if the rule's conditions are met, including an audit by an independent public accountant and timely delivery of audited financial statements to investors. The required timing and audit standards matter. An adviser cannot simply call an internal valuation review an annual audit.

The current custody rule remains in effect as of the source check, while the SEC issued a 2026 proposal to amend it. A proposal is not a final rule. For present compliance questions, apply the operative rule and monitor the rulemaking separately. Do not describe a proposed safeguarding regime as already replacing Rule 206(4)-2.

Worked custody cases

Case one: an adviser has online access to view a client's account and place trades, but cannot withdraw or transfer money. Trading authority alone does not necessarily constitute custody under the SEC definition. The adviser should still assess discretion, trading authorization, records, and state law. If the login permits money movement, the custody analysis changes.

Case two: a client signs a standing letter directing the custodian to send the adviser's quarterly fee to the adviser. Fee deduction may fall under a limited treatment in the rule if conditions are satisfied. The adviser should calculate fees accurately, notify the client, and ensure the authority is restricted to fees. A broad power to wire any amount to any person is different.

Case three: an adviser serves as trustee for a client's family trust and can distribute securities to beneficiaries. The adviser may have custody through its legal capacity even if it never physically holds the assets. It should identify the trust authority, determine the applicable rule, use the required custodian, and satisfy verification or exception requirements.

Case four: a private fund adviser receives audited financial statements from an independent accountant 120 days after fiscal year end and sends them to investors. Determine whether the audit and delivery timing satisfy the applicable pooled-vehicle exception. Do not assume the audit exception applies to an individual managed account or to an audit performed by a non-independent accountant.

Case five: a client receives an adviser-generated statement showing $500,000 while the custodian statement shows $460,000. The client should promptly compare transactions, fees, valuation dates, and any pending deposits, then contact the custodian and adviser through verified channels. The discrepancy could be a timing or valuation issue, but the independent statement is an important safeguard. The adviser should not discourage verification.

Controls for advisers and clients

An adviser should inventory every form of asset access: physical possession, check authority, wire authority, standing letters, fee deduction, trustee roles, private fund control, and login permissions. Legal and operations staff should compare documents with how the custodian actually configured the account. Authority can change through amendments or digital permissions, so controls need periodic review.

Use segregation of duties for asset movement. A staff member who requests a transfer should not be the only person who approves it. Verify instructions through a trusted channel, document client consent, and reconcile movements to custodian statements. These operational controls complement the rule; they do not replace qualified-custodian and independent-verification duties.

Clients can take simple steps too. Read custodian notices, activate alerts, review quarterly statements, and compare holdings with adviser reports. Contact the custodian directly if a statement is missing or a transfer seems unfamiliar. Keep the adviser's contract, account authorization, and fee schedule so that a client can tell whether a deduction was permitted.

Exam framework

First identify whether the adviser has possession or authority to obtain assets. Then identify the asset and the person's role. Next apply the qualified-custodian, client-notice, statement, and verification requirements. Finally test a specific exception against every condition. The question may distinguish custody from discretion: an adviser can have discretion to trade without custody, while authority to withdraw funds can create custody even if no trades are made.

A custody question should not be answered from a job title or a document label alone. Read what the person can do. Can the person move money, endorse a check, act as trustee, or direct securities to another account? Can they only place trades within the existing account? The actual power is more important than whether the form is titled ‘limited authorization.’

The purpose of the custody framework is to reduce misappropriation and improve independent verification. It does not guarantee that an investment will retain value or that a custodian can never fail. The client still faces market risk, and a qualified custodian arrangement has specific legal protections rather than a promise against every loss. Explain those limits accurately.

Understand the surprise examination in context

A surprise examination is performed by an independent public accountant to verify client funds and securities. ‘Surprise’ means the adviser should not know the exact timing in advance; the accountant chooses the date without prior notice, and examinations occur at irregular intervals. The adviser cannot schedule a convenient annual inventory and call it a surprise exam. The accountant's independence and the procedures used are part of the safeguard.

The independent accountant reports the results to the SEC as required by the rule. The adviser should cooperate, provide records, and resolve discrepancies. If the accountant finds a difference between the books and the custodian's records, the firm should investigate promptly. A clean prior examination does not remove the obligation for later periods or excuse weak controls between exams.

The adviser should understand which assets are covered and how they are valued. Securities held in street name, physical certificates, private fund interests, and cash can require different confirmation methods. A custody inventory should reconcile client-level records with custodian statements and issuer records. If a security cannot be independently confirmed, the adviser should not assume that a spreadsheet entry proves it exists.

Custody through legal capacity

A person's legal role can create custody even without ordinary account access. An adviser serving as a trustee, general partner, or managing member may be able to direct distributions or possess assets. Analyze the governing instrument and the rule's treatment of the capacity. A person named as trustee with no practical authority may still require legal analysis; do not decide from the title alone.

A family member might appoint an adviser as a trustee solely to make investment selections, while a corporate trustee holds assets and controls distributions. Whether the adviser has custody depends on the actual legal and practical authority, the custody rule's definition, and the governing documents. The adviser should document the analysis and consult compliance counsel where authority is ambiguous.

A standing letter of authorization can permit a custodian to send money to a third party on recurring instructions. The adviser should assess whether the client retains control and whether the specific arrangement meets any SEC staff position or rule condition. A client signature on a form does not automatically prevent custody. The firm must understand whether it can initiate transfers, change instructions, or redirect assets.

Operational red flags

Watch for statements delivered only by the adviser, unexplained balance differences, stale custodian addresses, unusual wire changes, blank transfer forms, and staff who can both request and approve a movement. These facts do not each prove misappropriation, but they weaken controls and deserve prompt review. Verify account details directly with the custodian using independently sourced contact information.

If a client reports an unfamiliar withdrawal, the adviser should preserve records, restrict further movement where authorized, notify the custodian and compliance personnel, and investigate. It should not tell the client to wait for the next quarterly statement. Quick escalation can limit losses and preserve transaction evidence. The firm should follow its incident response and regulatory reporting procedures.

A custody control review should test the actual workflow. Select transfers and fee deductions, inspect authorization, compare the instruction to the account records, and confirm the recipient with custodian documentation. Review whether system permissions match job responsibilities. An annual policy review that never tests real transactions may not identify a gap between written procedure and actual practice.