US Regulators Issue Joint Statement on Crypto Custody for Banks

The three major federal banking regulators in the United States—the Federal Reserve, the Office of the Comptroller of the Currency (OCC), and the Federal Deposit Insurance Corporation (FDIC)—have issued a joint statement outlining how existing rules will be implemented regarding banks offering cryptocurrency custody services on behalf of their customers. This statement aims to reduce uncertainty about how banks can participate in the crypto sector.

In the joint statement, the regulators detailed how the existing legal framework and risk management principles would apply to crypto asset custody activities, while emphasizing that no new auditing standards were introduced. “Banking institutions considering crypto asset storage should take into account the evolving nature of these markets and the technology they are based on, and create an appropriate risk management framework,” it said. Banks offering crypto asset custody services will be responsible for keeping digital assets secure on behalf of customers, and in this process, they will need to prioritize issues such as the protection of digital keys, cybersecurity risks, and operational controls.

The statement noted that storing crypto assets requires significant resources and expertise due to factors such as the complexity of the technology involved, market volatility, and rapid change. It added that banks must conduct comprehensive risk assessments and possess sufficient technical capacity before offering this service. Crypto assets can be held in both “fiduciary” and “non-fiduciary” capacities. Banks are required to comply with relevant federal regulations and state laws when acting as trustees, executors, or investment advisors.

Since the re-inauguration, there has been a noticeable increase in statements and positions regarding crypto regulations. In May, the OCC announced that US banks could trade crypto assets on their own behalf. The FDIC, on the other hand, lifted the previously mandatory prior notification requirement, allowing banks to more freely participate in crypto activities. Following these regulatory announcements, the appointment of pro-crypto figures to the helm of critical institutions is also attracting attention. Last week, the Senate confirmed the appointment of former blockchain executive to head the OCC. Previously served as general counsel at Bitfury and held senior positions at the OCC.

The Federal Reserve, the Federal Deposit Insurance Corporation (FDIC), and the Office of the Comptroller of the Currency (OCC) have jointly issued a statement outlining the risk-management considerations for banks involved in crypto-asset custody. The statement emphasizes the importance of robust risk management frameworks to address the unique challenges posed by cryptocurrencies, including hacking, system failures, and the loss of private keys. The regulators clarified that banks can hold crypto assets for their customers in either a fiduciary or non-fiduciary capacity. In fiduciary safekeeping, banks act as trustees or investment advisors, adhering to specific federal rules and applicable state laws. For non-fiduciary safekeeping, banks must still implement strong systems to protect the assets from various risks. The statement underscores the need for banks to build and continuously update their risk-management frameworks as the crypto market evolves.

The joint guidance aims to standardize crypto custodial practices across banks, ensuring safe execution and compliance with applicable laws. Banks are reminded to plan ahead, regularly check their safety measures, and be prepared to address issues promptly. The evolving nature of the crypto-asset market requires banks to consider the risks involved and implement effective risk management systems. The statement also highlights that while banks can use third-party custody vendors, the liability for safekeeping remains with the bank. Banks must demonstrate that no other party, including the customer, can access the assets while under the bank's safekeeping. This ensures that the bank maintains full control over the assets, including the keys.

The regulators' statement comes amid a shift in the regulatory approach to banks and crypto in the U.S. The FDIC and the Federal Reserve have previously issued guidance clarifying that banks can engage in crypto-related activities without seeking prior approval. This joint statement further solidifies the regulatory framework, providing banks with clear guidelines on how to manage the risks associated with crypto custody. The statement also notes that the crypto world is rapidly changing, and banks need to keep up with these changes. Any bank offering crypto storage must follow the law and ensure that all activities are conducted in a safe and sound manner, similar to other banking services. The regulators have been issuing several updates to guide banks in the crypto space, emphasizing the need for strong risk management frameworks.

In summary, the joint statement by the Federal Reserve, FDIC, and OCC provides a comprehensive guide for banks on managing the risks associated with crypto-asset custody. It clarifies the rules for holding crypto assets, emphasizes the importance of robust risk management, and ensures that banks operate within a safe and sound framework. This guidance is crucial for banks looking to engage in crypto-related activities, as it provides clear expectations and responsibilities for financial institutions.