The SEC Custody Rule and Bill Pay: What RIAs Need to Know in 2026

Use a qualified custodian

Client assets must be held by a “qualified custodian”—typically a bank, broker-dealer, or other regulated financial institution. The custodian must:

• Maintain client assets in a separate account under the client’s name, or in the adviser’s name as agent or trustee

• Have proper controls to safeguard those assets

• Send account statements directly to clients

You can’t simply hold client funds in your firm’s operating account or a general bank account you control. Your clients’ assets need proper separation and security controls.

Send account statements and expect a surprise examination

If you have custody, your qualified custodian must send account statements directly to clients at least quarterly. These statements help clients verify their holdings independently.

You must also undergo an annual surprise examination by an independent public accountant. The accountant will:

• Verify that client funds and securities are where they should be

• Confirm that qualified custodians are sending statements as required

• File Form ADV-E with the SEC after completing the examination, as the custody rule directs

The “surprise” element means the accountant picks the timing, not you. This independent check helps ensure assets haven’t been misused.

Step 1: Assess whether your service creates custody

Start by mapping exactly what authority you have over client funds. Ask:

• Can we initiate transfers from client accounts?

• Do we have check-writing authority?

• Can we decide which vendors get paid and when?

If the answer to any of these is yes, you likely have custody.

Step 2: Set up approval controls

Build workflows that require multiple approvals before any funds move. This creates a clear record and reduces the risk of unauthorized transactions. Consider:

• Requiring client approval for each payment or batch of payments

• Using dual authorization so no single person can move funds alone

• Separating the person who enters a payment from the person who approves it

Step 3: Document authority clearly

Keep written records of what authority clients have granted and any limitations. If clients have restricted your discretion (for example, only paying pre-approved vendors), document those restrictions clearly.

Step 4: Keep detailed records

Rule 204-2 under the Advisers Act requires you to maintain books and records related to your advisory business. For bill pay, this includes:

• Payment histories and approvals

• Client authorizations

• Vendor information

• Reconciliation records

Good records make surprise examinations smoother and demonstrate your compliance efforts.

Step 5: Coordinate with your custodian and accountant

Make sure your qualified custodian understands your bill pay arrangements and can support the required reporting. Line up an independent accountant for your annual surprise examination well before it’s due.

What is a standing letter of authorization?

A SLOA is a client instruction that authorizes recurring transfers to a third party—like a mortgage company or utility provider. The client specifies the payee, and the adviser simply executes the pre-authorized payments.

When SLOAs reduce custody obligations

Under an SEC staff no-action letter, advisers with SLOA authority can avoid a surprise examination if they meet certain conditions. These include:

• The client provides written authorization for the specific third-party transfer

• The client can change or revoke the instruction at any time

• The adviser has no discretion over the payee (the recipient is pre-designated by the client)

• The qualified custodian verifies the instruction directly with the client

If the adviser has discretion as to the payee, this arrangement falls outside the no-action letter and triggers the full custody requirements, including the annual surprise exam.

Structuring bill pay to minimize custody exposure

To keep custody obligations manageable:

• Limit bill pay to pre-approved, client-designated vendors whenever possible

• Have clients authorize each payee individually rather than giving you broad discretion

• Use systems that log client authorizations and link them to each payment

These steps don’t eliminate custody, but they can reduce operational complexity and exam burden.

Does paying a client’s bills always create custody?

Not always. If you simply advise a client on what bills to pay but they execute the payments themselves, you don’t have custody. Custody arises when you have the authority to move funds—whether or not you actually exercise that authority.

Who is eligible for a custody rule audit exemption?

Advisers to pooled investment vehicles (like hedge funds or private equity funds) may qualify for the “audit exception.” Instead of undergoing a surprise examination, they can deliver audited financial statements to investors after fiscal year-end under the audit provision of the custody rule. This exception doesn’t typically apply to individual client bill pay services.

What does Rule 204-2 require advisers to keep?

Rule 204-2 is the books and records rule under the Advisers Act. It requires advisers to make and keep books and records that relate to their advisory business, including client communications. For bill pay, you should keep payment histories, client approval documentation, and vendor details.

What is a custody rule no-action letter?

A no-action letter is SEC staff guidance indicating they won’t recommend enforcement action if an adviser follows specific conditions. The SEC staff guidance on SLOAs, for example, provides relief from surprise examination requirements for advisers who meet certain conditions when transferring client funds to pre-designated third parties.