The SEC Just Detached Its Post-Madoff Audit Backstop

KEY HIGHLIGHTS

• The release: SEC Releases IA-7023 and IC-36353, proposed October 1, 2026, rewrite adviser and regulated fund custody in a 760-page package, with comments due December 7, 2026, per the SEC rule page and press release 2026-100.
• The vote: All three sitting commissioners, Atkins, Peirce, and Uyeda, approved the proposal, per the commission's FOIA vote record.
• The quiet removal: The proposal eliminates the requirement that custody-rule accountants be PCAOB-registered and inspected, a gate adopted in the December 30, 2009 post-Madoff amendments (Release IA-2968), per Thomson Reuters.
• The crypto pathways: Adviser self-custody under proposed rule 223-1(b)(7), fund self-custody under 17f-9, and state trust companies under 223-1(d)(13)(v) and 17f-8, with quarterly unavailability determinations, dual key authorization, and segregated per-client addresses, per Securities.io and the proposing release.
• The context: 154 audit firms filed PCAOB withdrawal requests in 2025, the most since 2020, and 67 more through August 10, 2026, per SEC Release 34-106372.

On October 1, the Securities and Exchange Commission proposed the most consequential rewrite of the investment adviser custody framework since the post-Madoff amendments of 2009. The package, issued as Releases IA-7023 and IC-36353 under File No. S7-2026-35, runs 760 pages and was approved by all three sitting commissioners, Atkins, Peirce, and Uyeda. The headline half builds a tailored custody framework for crypto assets: advisers and regulated funds get new pathways, including conditional self-custody and state trust companies, replacing a 2023 proposal the agency withdrew in June 2025. Comments are due December 7, 2026.

But there is a second deregulation folded into the same document, and it has drawn far less attention. Deep in the modernization provisions, the commission proposes to eliminate a requirement that accountants performing certain custody-rule services be registered with, and subject to regular inspection by, the Public Company Accounting Oversight Board. That gate was installed in December 2009, in the direct aftermath of the Madoff fraud, as part of the amendments that created the surprise examination regime. The October 1 proposal would take it out.

One document, two deregulations. The loud one reorganizes who can hold crypto assets. The quiet one loosens who is qualified to verify that client assets exist at all.

The loud half: custody rebuilt for crypto

The crypto framework is the proposal's center of gravity, and it is genuinely structural. Under current rules, advisers generally must keep client assets with a qualified custodian, a category built for banks and broker-dealers that in practice has few members willing or able to custody crypto. Chairman Paul Atkins framed the problem in his statement accompanying the proposal: the rules "were designed to protect the assets of advisory clients and regulated funds from loss, theft, misuse, and misappropriation," but they contemplate "the custody and safekeeping only of traditional assets," which he called "an untenable situation in the 21st century." The proposal, he said, would "provide a clear regulatory framework for the custody of crypto assets, giving investment advisers and funds a compliant pathway where none existed before and replacing the grey of uncertainty created by custody rules crafted for a bygone era."

Three pathways replace the single qualified-custodian model for crypto assets. First, adviser self-custody, proposed rule 223-1(b)(7), lets a registered adviser hold client crypto assets itself, but only after a written determination, refreshed quarterly, that no permitted custodian is available for the asset. The adviser must have documented expertise in safeguarding each asset, systems for private key management that require joint authorization of transactions by at least two people, per-client segregation of assets to dedicated addresses on the network, at least annual reviews of cybersecurity controls, internal control reports from an independent public accountant obtained within six months of taking self-custody and annually thereafter, at least quarterly account statements, and a written agreement treating each self-custodied asset as a financial asset under state law. Second, a companion provision for regulated funds, proposed rule 17f-9, lets a fund custody crypto through its adviser, subject to the same conditions plus board review of the unavailability determination and an annual board finding of reasonable care. Third, state trust companies can serve as custodians, provided the adviser or fund has a reasonable basis, after due inquiry, for believing the company is authorized by its state banking authority to custody crypto and maintains written policies reasonably designed to safeguard crypto assets and related cash from theft, loss, misuse, and misappropriation.

Commissioner Hester Peirce, who led the Crypto Task Force and departs the commission this week, titled her statement "Roller Coaster Ride" and cast the proposal as the off-ramp from a decade of whiplash in which the 2023 proposal had left advisers believing "compliant crypto custody looked impossible." Commissioner Mark Uyeda called it "a workable path to compliance without compromising the protections the custody rules are designed to provide." Both statements read as endorsements of the direction, and both were written before the market structure debate in Congress resolves anything; the proposal proceeds under existing authorities while the CLARITY Act remains stalled in the Senate.

The quiet half: the PCAOB gate comes out

Buried among the modernization amendments is a single sentence of consequence. As summarized by Thomson Reuters, the proposal would "eliminate a requirement that certain accountants and auditors engaged under the investment adviser custody rule be registered with and subject to regular audit inspection by the Public Company Accounting Oversight Board." Under the current rule, a PCAOB-registered firm is required in three circumstances: when an adviser or related person acts as a qualified custodian and an accountant performs the surprise examination; when an accountant prepares the internal control report required for an adviser or related person acting as custodian; and when an adviser relies on the audit provision for a pooled investment vehicle. The proposal removes the PCAOB registration and inspection condition in all three.

The commission's rationale is candid. "Because the PCAOB does not currently examine or inspect accountants with respect to the services required under the Advisers Act custody rule, the PCAOB registration and inspection requirements are not an appropriate proxy for the quality of the audit and examination services required under the rule," the release states. The agency also forecast the effects: removing the requirement "could expand the pool of eligible accountants, increase competition, and lower advisers' compliance costs." What survives is the definition of an independent public accountant under Rule 2-01(b) and (c) of Regulation S-X, the general independence standard. What disappears is the requirement that the firm standing behind a custody verification submit to the PCAOB's registration, annual reporting, fee, and inspection regime.

Where the gate came from

The gate is not old administrative residue. The SEC adopted the custody amendments on December 30, 2009, in Release IA-2968, effective March 12, 2010, as the agency's structural answer to Madoff. As the Government Accountability Office later summarized, "In response to the Madoff and other recent frauds, SEC amended the rule again in 2009 to improve the safekeeping of client assets, in part by expanding the surprise examination requirement's reach," with the exams designed as "another set of eyes" on client assets. The rule requires the accountant to notify the commission within one business day of finding a material discrepancy during a surprise examination and to file Form ADV-E within 120 days of the examination date.

The 2009 commission explained the PCAOB gate in those same terms. "We have greater confidence in the quality of the surprise examination and the internal control report when prepared by an independent public accountant that is registered with, and subject to regular inspection by, the PCAOB," the adopting release stated. The gate was a quality screen: custody verification was reserved for firms that had chosen to live under the audit regulator's inspection regime. Seventeen years later, the screen is proposed for removal on the ground that the PCAOB never actually inspected those particular engagements. Both statements are accurate. That is what makes the change worth watching: the 2009 rule was a proxy, and everyone knew it was a proxy, and the proxy was the point.

The exodus the proposal is responding to

The proposal does not arrive in a vacuum. Audit firms have been leaving PCAOB registration on their own. The SEC's September 15 notice of the PCAOB's quality control amendments records that 154 withdrawal requests were filed in 2025, greater than any year since 2020, with eleven of them citing the PCAOB's new QC 1000 quality control standard as a reason, and that 67 more withdrawal requests were filed through August 10, 2026. QC 1000, adopted in 2024, takes effect December 15, 2026, and imposes a firm-level quality control system with an external quality control function that smaller audit practices have described as designed for the Big Four's scale. The PCAOB's own response, now pending SEC approval with comments due October 9, would rescind the design-only requirement and the mandatory external quality control function to slow the outflow.

Read against that backdrop, the custody proposal is the commission acknowledging the market's verdict: if the PCAOB regime is driving small and mid-tier firms out of registration, and if registered status was only ever a proxy for quality in custody work, then the proxy now excludes qualified accountants for reasons unrelated to custody. The deregulatory logic is coherent. The consequence is that the surprise examination, the 2009 rule's central investor protection, would be performable by any independent public accountant meeting the Regulation S-X test, with no registration, no inspection regime, and no fee obligation to the audit regulator.

The modernization package around it

The rest of the proposal cuts in both directions and is worth itemizing, because the modernization items are where the practical compliance load actually changes. For advisers, the rule would be redesignated from Rule 206(4)-2 to new rule 223-1 under section 223 of the Advisers Act, an authority Congress added in the Dodd-Frank Act. Audited financial statements under the pooled vehicle audit provision would have to be prepared under US GAAP, with an exception for foreign pooled vehicles. Delivery deadlines for audited financials would be extended for funds of funds and funds of funds of funds. The surprise examination requirement would gain an exception for advisers whose custody arises solely from a standing letter of authorization, an arrangement the current rule treats as custody that triggers verification. Client notices sent when an account is opened with a qualified custodian would need to include the client's account number. The rule would also codify an inadvertent receipt exception, excepting funds returned to the sender within three business days.

On the fund side, the proposal would amend Rule 17f-1 to permit custody with all registered broker-dealers subject to the customer protection rule, rather than only members of a national securities exchange, and would rescind Rule 17f-3 on free cash accounts. Face-amount certificate companies and unit investment trusts would not be able to rely on the fund self-custody or state trust company pathways. The release also discusses decentralized finance and considers, but does not propose, amendments related to crypto asset trading, which leaves a second package's worth of questions parked for later.

The trade the proposal makes

Strip the framing away and the deal on offer is specific. Advisers get a workable compliance path for an asset class their clients already hold, and a larger, cheaper pool of accountants for custody verification. Investors in advisory clients' positions get crypto holdings inside a framework with operational requirements that are, in several respects, stricter than anything the current qualified custodian regime imposes on crypto: dual control over private keys, segregated addresses per client, annual cybersecurity review, and accountant attestation on custody controls. Uyeda's claim that the package preserves the rules' protections is defensible on the crypto side.

The counterargument sits in the PCAOB removal. The 2009 gate was one of the few mechanisms that tied custody verification to an external inspection regime at all, even a loose one. The commission's answer, that the PCAOB never inspected these engagements, is true today and was true in 2009; the difference is that in 2009 the commission decided the proxy had value anyway, and in 2026 it decided the proxy had become a barrier. Neither determination is provably wrong. But the composition of the change matters: the audit gate comes out for every adviser, pooled vehicle, and fund that relies on the custody rule, crypto or not, while the new operational controls attach only to the crypto pathways. Traditional asset custody inherits the loosened audit gate with none of the new controls attached.

There is also a distributional question the release does not answer. The firms most likely to enter the newly opened pool of eligible accountants are those that left, or never joined, the PCAOB regime, which means smaller practices with fewer resources and no inspection history. That could mean cheaper audits for small advisers and a real competitive gain. It could also mean that the surprise examination, the mechanism built to catch the next Madoff, is increasingly performed by firms nobody inspects, on engagements nobody reviews, under a definition of independence the commission polices only through enforcement after the fact.

What to watch

The comment period runs to December 7, 2026. Four questions will determine what actually becomes law. First, whether the PCAOB removal survives the comment process at all, since it is the provision with the clearest investor protection cost and the weakest constituency defending it; expect state regulators and investor advocates to focus there. Second, whether the PCAOB or the commission responds to the coverage gap the release itself identifies; the alternative fix, extending PCAOB inspection to Advisers Act engagements, was available in 2009 and remains available now. Third, how state trust company due diligence works in practice, because the proposal shifts verification of those custodians onto advisers and funds through a reasonable-belief standard rather than an agency certification. Fourth, who carries the crypto framework forward after Peirce's departure this week, since the proposal is her task force's capstone and the final rule will be someone else's work.

The Free Markets Report has tracked this commission's method across the securities lending guidance, the proxy rule rescission, and the accredited investor proposal: headline a framework that expands markets, and fold the quieter removals into the same document. IA-7023 follows the pattern exactly. The crypto custody framework is loud because the market demanded it. The audit gate is quiet because no constituency lobbies for surprise examinations. Both would become final law together, and the comment window is the only point at which they can be pulled apart.

The Free Markets Report is provided by Lead-Lag Publishing, LLC. All opinions and views mentioned in this report constitute our judgments as of the date of writing and are subject to change at any time. Information within this material is not intended to be used as a primary basis for investment decisions and should also not be construed as advice meeting the particular needs of any individual situation. The accuracy, completeness, and timeliness of the information contained in this document is not guaranteed. The securities and strategies discussed may be unsuitable for investors depending on their specific financial position and investment objectives. Reproduction of this report without the express written consent of Lead-Lag Publishing, LLC is strictly prohibited. Past performance is not indicative of future results, and current performance may be lower or higher than the performance shown. Neither the information nor any opinion expressed in this report constitutes a solicitation, an offer to buy or sell any securities, or an offer to provide investment advice or services. Nothing in this report shall be construed to be an offer to provide investment advisory services in any jurisdiction in which Lead-Lag Publishing, LLC is not authorized to provide such services. All investments involve risk, including the risk of loss of principal. No representation is being made that any security, account, or strategy discussed is or is likely to achieve results similar to those shown. Investing in securities involves risks, and there is always the potential of losing money when you invest in securities. Before investing, consider your investment objectives, and Lead-Lag Publishing, LLC's charges and expenses. This report is not a prospectus and does not contain all of the information necessary to fully evaluate any security or strategy discussed, including, but not limited to, the risk of adverse effects of related market developments. You should not rely solely on the information contained in this report, and should seek advice based on your situation from a licensed investment professional. Carefully consider the investment objectives, risks, charges and expenses of any investment product before investing. This report may not be copied or distributed without the express written consent of Lead-Lag Publishing, LLC. Any decisions made based on any or all of the information in this writing are the sole responsibility of the user, and the user should exercise caution and take appropriate advice before acting.