US Regulators Allow Banks to Offer Bitcoin Custody Services

US federal banking regulators have formally allowed banks to offer custody services for Bitcoin and other crypto-assets. The joint decision from the Federal Reserve, OCC, and FDIC outlines compliance obligations rather than new rules. It marks a significant expansion in regulated crypto access for financial institutions.

The new guidance confirms that banks can offer safekeeping of crypto in fiduciary or non-fiduciary capacities under current laws. Banks must meet all requirements under 12 CFR 9 or 150, state law, and applicable fiduciary provisions. They must also maintain strong cybersecurity, operational readiness, and internal controls.

The agencies emphasized that control over customers’ cryptographic keys is central to custody responsibilities. Banks must implement effective key management, monitor unauthorized transfers, and secure infrastructure. Anti-money laundering (AML), counter-financing of terrorism (CFT), and OFAC sanctions rules apply in full.

Before offering services, banks must conduct a full risk review of crypto custody operations. This includes evaluating asset types, technologies used, and legal obligations. Every bank must also ensure compliance with the Bank Secrecy Act (BSA) and internal control standards.

The statement allows banks to work with third-party sub-custodians but states they remain fully responsible. It reads, “Subject to the terms and conditions in the customer agreement, a banking organization is responsible for the activities performed by the sub-custodian.” This includes oversight of key generation, storage, and deletion procedures.

Regulators require banks to perform due diligence before engaging sub-custodians. Evaluation must include policies, internal controls, and adherence to safekeeping standards. Banks must also prepare contingency plans for tech failure or third-party collapse.

Banks using external hardware or software must weigh the risks of outsourcing versus in-house infrastructure. The agencies state, “Effective risk management… will generally include weighing the risks of purchasing third-party software or hardware.” They must also build internal audit systems for crypto-specific operations.

“When audit expertise does not exist within the banking organization, management should engage appropriate external resources,” the joint statement said. This includes reviewing safekeeping controls and ensuring staff are trained for crypto-asset risk management. These audits are required and must remain independent of routine financial audits.

This decision by US regulators to allow banks to custody Bitcoin and other crypto-assets under existing legal and risk frameworks is a significant step forward for the crypto industry. It provides a clear path for banks to offer these services while ensuring compliance with regulatory standards. The emphasis on cybersecurity, compliance, and control over cryptographic keys underscores the importance of these factors in the safekeeping of digital assets.

The joint statement from the Federal Reserve, OCC, and FDIC highlights the need for banks to conduct thorough risk assessments and maintain strong internal controls. This includes evaluating the technologies used, legal obligations, and the risks associated with outsourcing to third-party sub-custodians. The requirement for banks to remain fully accountable for the activities of sub-custodians ensures that customers' assets are protected.

Overall, this regulatory approval paves the way for greater integration of crypto-assets into the traditional financial system. It provides banks with the framework to offer custody services while ensuring that they meet all necessary compliance and security standards. This development is likely to boost confidence in the crypto industry and encourage more institutions to explore the potential of digital assets.