Yeliz Akmaca 
US regulators have authorized banks to offer crypto custody services. The rules are clear: legal compliance, security, and risk management take priority.
The Federal Reserve (Fed), the Federal Deposit Insurance Corporation (FDIC), and the Office of the Comptroller of the Currency (OCC) issued a joint statement granting banks the authority to hold Bitcoin and other crypto assets on behalf of their clients. However, this move does not introduce new regulations. Banks must fully comply with existing laws such as 12 CFR 9 or 150, relevant state laws, and documentation governing fiduciary relationships. Institutions offering custody services as fiduciaries carry all responsibilities outlined under these frameworks.
The document emphasizes that banks must conduct a comprehensive risk assessment before starting any crypto custody activities. This assessment should cover the nature of the assets, technological infrastructure, and legal obligations.
Risk Assessment and Sub-Custody Warning
Banks can hold crypto assets directly or via sub-custodians. However, under the terms of customer agreements, the primary bank remains liable for all actions of the sub-custodian. The statement includes:
“Conducting due diligence before selecting a sub-custodian is a critical component of sound risk management.”
Banks must thoroughly evaluate the sub-custodian’s cryptographic key management, internal controls, and compatibility with existing custody risk management practices. Furthermore, the document states that banks should be operationally prepared against threats such as key loss, unauthorized access, cyberattacks, and asset transfers.
Security, Compliance, and Expertise Required
To provide these services sustainably, banks are expected to employ skilled personnel, secure system infrastructure, and maintain proficiency in current technologies. In addition, all service providers must fully comply with the Bank Secrecy Act (BSA), Anti-Money Laundering (AML) laws, Countering the Financing of Terrorism (CFT) requirements, and OFAC regulations without exception.
“Crypto asset custody relationships are subject to the same federal regulations as any other banking service.”
Banks must also ensure transparent customer disclosures, define responsibilities clearly in comprehensive agreements, enhance internal audit processes, and consider seeking independent audit support if necessary.
You can also freely share your thoughts and comments about the topic in the comment section. Additionally, don’t forget to follow us on our Telegram, YouTube, and Twitter channels for the latest news and updates.