Custody Rule

The custody rule is the SEC regulation — Rule 206(4)-2 under the Investment Advisers Act of 1940 — that dictates how a Registered Investment Adviser must protect client assets it holds or has the power to reach. Its core requirements: client funds and securities must be maintained by a qualified custodian, clients must be notified where their assets are held, the custodian must deliver account statements directly to clients at least quarterly, and, in most custody situations beyond simple fee deduction, an independent public accountant must verify the assets in a surprise annual examination. The rule exists to prevent theft and Ponzi-style fraud by making sure someone other than the adviser is always watching the money.

"Custody" is broader than physically holding assets. An adviser has custody if it possesses client funds or securities, has authority to withdraw them (a general power of attorney, check-writing authority, or certain standing instructions to move money to third parties), or serves in a role like trustee or general partner that gives it legal access. Even the routine practice of deducting advisory fees directly from a client's account counts as custody — though advisers whose only custody is fee deduction are spared the surprise-examination requirement.

The rule's architecture is separation of duties. The adviser recommends or directs; the qualified custodian — a bank, registered broker-dealer, trust company, or certain foreign financial institutions — actually holds the assets and reports to the client independently. That dual reporting is the fraud check: if an adviser's performance reports say one thing and the custodian's statement says another, the custodian's statement is the one tied to real assets. Bernie Madoff's scheme worked in part because his firm effectively controlled its own custody and statements; the SEC tightened this rule in 2009 largely in response. (In 2023 the SEC proposed replacing the custody rule with a broader "Safeguarding Rule," but it formally withdrew that proposal in June 2025 — Rule 206(4)-2 remains the governing rule, though the SEC has signaled interest in modernizing the custody framework in the future, particularly around digital assets.)

Consider a hypothetical: Marcus hires an advisory firm to manage his $600,000 IRA. The firm doesn't hold the money itself — the IRA sits at a large brokerage firm acting as qualified custodian. The advisory firm directs the investments and deducts its quarterly fee straight from the account, which gives it custody under the rule. So the brokerage sends Marcus a statement every quarter showing every holding, every trade, and every fee taken. If the adviser ever reported a balance that didn't match the custodian's statement, Marcus would have an independent paper trail to catch it.

Compare an advice-only engagement: the planner reviews Marcus's accounts, delivers recommendations, and invoices him directly, like an accountant would. The planner never holds assets, never has login authority to move money, and never deducts fees from the account — so no custody, and the rule's machinery isn't needed in the first place.

Pros

• Keeps client assets at an independent third party, making outright theft or a Madoff-style fake-statement fraud far harder to pull off.
• Guarantees clients an independent statement at least quarterly to check against the adviser's own reporting.
• The surprise-examination requirement adds an outside auditor to the highest-risk custody arrangements.

Cons

• It's a safeguard, not a guarantee — clients still have to actually read and compare their custodian statements for it to work.
• The definition of custody is technical, and compliance mistakes (inadvertent custody through a standing instruction or a trustee role) are among the most common adviser exam deficiencies.
• The rule protects against misappropriation, not bad advice — an adviser can fully comply and still recommend poor or conflicted investments.