The institutional digital-asset checklist, 2026 edition

For most of the last cycle, institutional crypto due diligence ended where it began: with a custody question nobody could answer cleanly. That changed in 2025. The accounting guidance that kept banks out of the business was rescinded, the qualified-custodian universe widened, a federal tax-reporting regime took effect, and a federal stablecoin statute became law. The result is not a lighter review. It is a more demanding one, because allocators can now require specific answers where they once tolerated unsettled rules.

This is the checklist as it stands in mid-2026: what an institutional allocator expects a manager running digital-asset strategies to produce on request, and where the rules remain genuinely open.

Custody: the qualified-custodian question now has answers

The structural shift came early in 2025. In January, the SEC issued Staff Accounting Bulletin 122, rescinding SAB 121 — the guidance that had forced entities safeguarding crypto to carry a corresponding liability and asset on their own balance sheets. Safeguarding firms now apply standard contingency accounting instead, applied retrospectively for annual periods beginning after December 15, 2024. That rescission removed the accounting barrier that had effectively excluded banks from institutional crypto custody.

The rest of the year dismantled what remained of the prior posture. The Commission withdrew the 2023 proposed Safeguarding Rule, ending the planned expansion of the qualified-custodian regime, and the SEC and FINRA withdrew the 2019 joint staff statement that had blocked broker-dealer custody of digital asset securities. In September, the Division of Investment Management issued a no-action letter permitting state-chartered trust companies to serve as qualified custodians of crypto assets for registered advisers and registered funds, subject to conditions — a material widening of the custodian universe beyond banks and broker-dealers. And in December, the Division of Trading and Markets issued a statement addressing how the customer-protection rule applies to broker-dealers custodying crypto asset securities, including tokenized instruments, accompanied by a commissioner statement titled “No Longer Special” — a signal that the special-purpose broker-dealer framework is no longer the only path.

Offshore vehicles carry a parallel bar. The Cayman Islands brought Phase 2 of its VASP Act into force on April 1, 2025: virtual asset custody services and trading platforms now require a CIMA licence rather than mere registration, with client assets segregated from proprietary assets, at least three directors, and enhanced prudential and disclosure obligations.

What this means in diligence: “institutional-grade custody solution” has stopped being an acceptable sentence. The checklist now asks for the custodian by name, its charter or licence, how assets are titled and segregated, and — where the manager relies on staff relief — whether its conditions are actually being met. For Cayman-touching arrangements, it asks for the licence, not the registration.

Counterparty terms decide who owns the assets

The legal lesson of the last failure cycle was written in a bankruptcy courtroom. In In re Celsius Network LLC (No. 22-10964, Bankr. S.D.N.Y.), the court held in a January 2023 opinion that crypto deposited in the platform’s yield-bearing Earn accounts was property of the bankruptcy estate — because the terms of use said so. Customers who believed they owned their coins discovered they owned unsecured claims.

That holding is why custody and counterparty review is contract reading before it is technology review. The questions are unglamorous: who holds legal title, under what segregation arrangement, with what rehypothecation rights, and what happens to the assets if the counterparty files. The mechanics deserve — and have — a brief of their own; the checklist point is that every counterparty agreement in the stack gets read against the Celsius standard.

For managers operating as CPOs or CTAs, conduct rules attach as well. NFA Compliance Rule 2-51 has imposed anti-fraud, supervision, and disclosure duties on members active in spot bitcoin and ether since May 2023. In late 2025 the NFA repealed its standardized virtual-currency disclosure notice and amended the rule, so diligence should confirm a manager’s current disclosure practice rather than assume the old language still governs.

The 1099-DA era has arrived

The final broker regulations took effect on schedule: custodial trading platforms, certain hosted wallet providers, kiosks, and payment processors must report gross proceeds on Form 1099-DA for transactions from January 1, 2025, with basis reporting for certain transactions beginning January 1, 2026. The IRS extended transition relief in mid-2025 — no backup-withholding liability for 2026 transactions, conditional relief into 2027, and good-faith penalty relief for 2025-year forms — but the reporting obligation itself stands.

One boundary was redrawn by Congress: the separate rule that would have treated DeFi front-ends as brokers was nullified under the Congressional Review Act in April 2025. Non-custodial platforms are out; the custodial-broker regulations are unaffected.

For an allocator, the questions are operational. Can the manager’s brokers and custodians produce reconciled 1099-DA data. Is the administrator prepared for basis reporting. Does investor-level tax reporting depend on a counterparty that has never produced it before.

What is law and what is still a bill

The GENIUS Act was signed in July 2025, establishing a federal framework for payment stablecoins: one-to-one reserve backing in dollars and low-risk assets, with issuance limited to insured-depository subsidiaries, federal-qualified nonbank issuers, and state-qualified issuers. Stablecoin exposure in a portfolio now carries a concrete diligence question — is the issuer a permitted issuer under the act.

Market structure is the open file. The CLARITY Act passed the House in July 2025 and was advanced by the Senate Banking Committee in mid-May 2026 on a 15-9 vote, but it is not law: it still requires the full Senate, reconciliation with the House text, and a signature. A compliance narrative that assumes its passage is a projection, not a posture, and should be underwritten accordingly.

The checklist, compressed

Custody: a named, chartered or licensed custodian, with titling and segregation documented. Counterparties: agreements read for title, segregation, rehypothecation, and insolvency treatment. Conduct: registration status and current NFA and SEC disclosure practice. Tax: 1099-DA readiness across the broker and administrator stack. Legislation: a posture that works whether or not the pending bill becomes law.

None of these items measures investment skill, and all of them are now answerable. That is the real change from the checklist an allocator would have drafted two years ago: the unsettled-rules defense has expired. Managers should expect every line to be asked, and allocators who are not asking are behind their peers.

SetOne Labs pressure-tests digital-asset custody, counterparty, and compliance postures the way an allocator will — before the questions are asked in a meeting. To arrange a confidential review, begin a conversation.

SetOne Labs provides advisory services and general information. Nothing here is legal, tax, or investment advice.