Federal Regulators Clarify Crypto Custody Rules for Banks

The Federal Reserve, the Federal Deposit Insurance Corporation (FDIC), and the Office of the Comptroller of the Currency (OCC) have issued a joint statement clarifying the guidelines for banks to handle cryptocurrency custody. This statement confirms that banks are permitted to hold crypto assets for their customers, either in a fiduciary or non-fiduciary capacity. The regulators emphasize that while banks can engage in crypto custody, they must adhere to stringent cybersecurity measures, operational expertise, and comprehensive risk management practices.

The OCC had previously clarified in May that national banks can handle crypto transactions and outsource services, provided that third-party risks are properly managed. This latest joint statement builds on that clarification, providing a more detailed framework for banks to offer crypto custody services. The regulators warn that safekeeping bitcoin and other crypto-assets demands strong cybersecurity protocols, operational expertise, and full compliance with existing regulations.

The joint guidance from the OCC, Fed, and FDIC outlines the legal and operational risks for financial institutions considering crypto custody. It emphasizes the need for banks to have robust risk management strategies in place to mitigate potential threats. The statement also reiterates that banks do not require new supervision to engage in crypto custody, as long as they adhere to the existing regulatory framework.

The regulators' joint statement provides a clear framework for banks to offer crypto custody services while adhering to existing regulations. It outlines the expectations for institutions engaged in the safekeeping of digital assets, ensuring that banks can manage cryptocurrencies in a secure and compliant manner. The statement also reaffirms the regulators' stance on the importance of risk management in the context of crypto custody, reminding banks to follow risk-management considerations to protect both their customers and the broader financial system.

In a related development, the U.S. Federal Reserve announced that it is eliminating the use of “reputational risk” as a supervisory factor. This decision could shift how banks approach relationships with crypto businesses. The regulators want banks to adjust their internal controls as the crypto market changes. They wrote: “A banking organization that is contemplating providing safekeeping for crypto-assets should consider the evolving nature of the crypto-asset market.” Banks are expected to maintain risk controls, response plans, and strong oversight. These steps should match the standards already in place for traditional financial products.

In recent months, each agency has taken steps to allow more crypto use by banks. In May, the OCC said banks can buy and sell digital assets for their own portfolios. The FDIC followed by stating that banks do not need to notify the agency before starting crypto services. Meanwhile, these changes make it easier for banks to offer crypto-related products such as trading, custody, and settlement. Industry watchers say the joint statement is a move toward clear and consistent rules.

Last week, the Senate confirmed Jonathan Gould as head of the OCC. Gould worked at blockchain company Bitfury and held senior roles at the OCC in the past. His background suggests more crypto experience at the top of the agency. Banks and regulators are now expected to work more closely as interest in digital assets continues to grow.