In a joint statement released Monday, the Federal Reserve, the Office of the Comptroller of the Currency (OCC), and the Federal Deposit Insurance Corporation (FDIC) reiterated that banks intending to hold crypto assets for clients must follow established regulatory guidelines.
The agencies clarified that they are not introducing new rules but emphasised the need for strong risk management practices. Financial institutions must assess potential threats, ensure they have reliable safeguards, and remain prepared to respond quickly to any issues that may arise.
“Any banking organisation considering crypto-asset safekeeping should account for the rapidly evolving nature of the digital asset market,” the statement noted.
Banks can offer crypto custody in two forms: fiduciary and non-fiduciary. In fiduciary arrangements—where the bank is legally authorised to act on behalf of clients, such as a trustee or advisor—specific federal regulations (12 CFR 9 or 150) must be followed, along with any applicable state laws or contractual obligations.
For non-fiduciary services, banks are still required to implement robust protection systems to safeguard customer assets. This includes defending against cyber threats, data loss, and mismanagement of sensitive materials such as private keys.
The regulators stressed that crypto-related services must adhere to the same safety and soundness standards expected of traditional banking operations. As the digital asset space evolves, banks must regularly update their risk frameworks and operational strategies.
Recent regulatory developments have signalled growing flexibility. In May, the OCC acknowledged that banks can now directly trade crypto, while the FDIC no longer requires pre-approval for banks engaging in crypto-related activities.
