A crypto compliance checklist for RIAs is a structured list a registered investment adviser uses to confirm that any digital asset service is backed by accurate disclosures, a documented custody analysis, vendor due diligence, defined billing policies, and supervision procedures. It maps each crypto activity to the firm's existing compliance obligations so nothing goes unaddressed.
What This Checklist Covers
The checklist is not a substitute for compliance counsel; it is a working agenda you adapt to your firm's facts. It generally spans the points where digital assets touch an RIA's regulatory duties: how a service is described in Form ADV, how assets are custodied, how the firm bills, and how third-party vendors are overseen. Because this is your money and your registration on the line, treat each item as a prompt for documentation, not a box to check and forget.
The Checklist
- Define crypto services offered. State plainly whether the firm advises, manages, reports on, or merely educates about digital assets.
- Classify each asset. Identify whether crypto is discretionarily managed, advised, reported, or held away from the firm.
- Run a custody analysis. Determine whether the activity triggers custody under the SEC custody rule, and document the reasoning.
- Review Cryptocurrency qualified custodians have emerged to serve institutional requirements. Qualified custody may be required for register">qualified custodian status. Where custody applies, confirm whether assets sit with a qualified custodian and review available SOC 1 / SOC 2 reports. See qualified custody for digital assets.
- Update disclosures. Reflect crypto risks, conflicts, and fees in Form ADV Part 2A and client agreements.
- Review billing practices. Confirm how fees are calculated on crypto and whether held-away positions are billed.
- Review marketing materials. Check crypto claims against the SEC Marketing Rule, including testimonial and performance rules.
- Document vendor due diligence. Record the basis for selecting any sub-advisor, TAMP, custodian, or reporting provider.
- Train advisory personnel. Ensure staff understand the firm's crypto policies and their limits.
- Create escalation procedures. Define who answers client crypto questions and when to refer out.
- Coordinate tax and estate limits. Note where crypto raises tax (IRS treats digital assets as property) or estate-planning questions that need a qualified professional.
A short way to read the list: classify the activity, test it against custody and the Marketing Rule, disclose it, and supervise it.
Held-Away Assets
Many clients hold crypto outside the advisor's platform, in self-custody wallets or on exchanges. The firm should decide, in writing, whether it will advise, report, bill, or simply educate on those positions, since each choice carries different custody and billing implications. The questions involved are covered in whether RIAs can bill on held-away crypto and what to do when a client owns crypto outside the firm.
Vendor Oversight
When an RIA relies on a crypto sub-advisor, TAMP, custodian, or reporting provider, the firm remains responsible for supervising that relationship. Document the initial due diligence and schedule periodic review of the vendor's controls, financial condition, and reported incidents. The crypto custody due diligence questions are a useful starting point for that file.
Related Questions
Does offering crypto advice always trigger the custody rule?
Not automatically. Whether the SEC custody rule applies generally depends on the facts, including whether the firm holds client keys or can access assets. The analysis should be documented and reviewed with compliance counsel.
Are crypto assets covered by FDIC or SIPC insurance?
Generally no. Digital assets held in advisory arrangements are typically not covered by FDIC or SIPC insurance, and no custody arrangement removes market, custody, or operational risk. Confirm coverage terms in writing for any specific custodian.
Does SEC registration mean a firm is qualified to handle crypto?
Registration is a baseline regulatory status; it does not by itself guarantee skill or signal that a firm is suited to a particular digital asset mandate. Evaluate experience, supervision, and disclosures on their own merits.
Sources
Compliance Note
This article is educational and does not provide legal, compliance, tax, investment, or custody advice. RIAs should consult compliance counsel before implementing crypto services. Registration does not imply a certain level of skill or training.