U.S. Regulators Issue New Crypto Custody Guidelines for Banks

U.S. federal banking regulators have issued new guidelines instructing banks to enhance their risk controls when offering crypto custody services. The Federal Reserve, Federal Deposit Insurance Corporation, and Office of the Comptroller of the Currency have jointly outlined these directives, underscoring the necessity for banks to manage cryptographic keys, assess risks, and train staff before providing crypto safekeeping services.

The regulators have emphasized that banks must maintain control over the cryptographic keys that grant access to crypto assets, ensuring compliance with all relevant laws and regulations. Before initiating custody services, banks are required to evaluate how these operations align with their overall risk profile and strategy. They must stay updated on industry practices and be prepared for potential surprises. The agencies stated that an effective risk assessment should consider the banking organization’s core financial risks, given its strategic direction and business model.

Every employee, from the C-suite to IT, must be trained and have the operational knowledge to run crypto custody services properly. The statement emphasized that all parts of the bank must establish adequate operational capacity and appropriate controls to conduct the activity in a safe and sound manner. Without this foundation, banks are not permitted to offer these services.

The guidelines also mandate contingency plans. Banks must have a real plan in place for when systems fail or if a crypto custody process malfunctions. This is not optional and must be integrated into the bank’s setup from the beginning. The agencies noted that the entire framework should be flexible enough to adapt to the rapidly changing crypto landscape.

Banks are allowed to work with third-party companies for crypto safekeeping, such as sub-custodians or tech providers. However, the statement stressed that banks will still carry all the responsibility. This responsibility covers everything from the types of crypto assets supported to the sub-custodian’s technology. Even if a third party is doing most of the work, the bank must conduct due diligence beforehand. This includes checking how keys are created, stored, and deleted, and confirming that the sub-custodian uses strong safeguards. Banks are also expected to consider what would happen to customer assets if the sub-custodian goes bankrupt or suffers operational problems.

The regulators also addressed the scenario where a bank handles custody in-house but still uses third-party technology. Whether it’s software, hardware, or anything in between, banks are expected to evaluate the risks. This includes deciding whether it’s safer to build their own systems or rely on someone else’s tools. The statement said that effective risk management will generally include weighing the risks of purchasing third-party software or hardware versus maintaining such software or hardware as a service.

Auditing is another requirement. Banks must create audit programs specifically for their crypto custody operations. This includes reviewing key generation, storage, and deletion processes, verifying transfer controls, and checking that IT systems meet security standards. These audits should also assess whether staff have the skills to manage crypto-related risk—and if not, outside help must be brought in. The agencies stated that when audit expertise does not exist within the banking organization, management should engage appropriate external resources with sufficient independence to assess crypto-asset safekeeping operations.

The new instructions replace earlier warnings and restrictions that made it harder for banks to enter the crypto market. The update comes just months after regulators pulled back previous guidance on crypto-related risks and revoked the directive that forced banks to notify regulators in advance before engaging in any crypto activity. From now on, crypto operations will be monitored as part of routine supervision, just like any other banking business. The agencies warned that any bank stepping into crypto custody must understand what it’s getting into and build out systems that can handle it.

Banks offering crypto custody services may do so under fiduciary or non-fiduciary arrangements, depending on their legal status. Fiduciary arrangements involve banks acting as trustees on behalf of their clients. These require adherence to specific federal regulations, including 12 CFR 9 or 150. State-level laws and other applicable legal standards must also be observed in fiduciary setups.

These financial institutions are required to establish effective protection of non-fiduciaries. Such protective measures are expected to prevent cyberattacks, preserve secret keys, and prevent asset mismanagement. Regulators emphasized that to ensure customer support, meaningful internal controls are to be used, and the risk-management method should be detailed.

The joint statement comes amid changes in federal policy regarding digital assets. Earlier this year, President Donald Trump signed an executive order focused on crypto regulation. The order aimed to move digital asset businesses under more structured federal oversight.

Following that development, the FDIC eliminated reputational risk from its supervisory considerations. This move enabled supervised banks to participate in crypto-related activities without prior approval. New guidance from the FDIC clarified the regulatory path for banks offering crypto services.

The statement issued on Monday signals a shift from earlier restrictions that had limited bank involvement in the crypto sector. While not establishing new rules, the agencies reaffirmed their position on operational risk, legal compliance, and custody responsibilities. Institutions engaged in crypto custody must continue to follow established frameworks while updating protections against evolving digital threats.