TLDR:
- U.S. banks may offer crypto custody services, but must comply with existing legal frameworks.
- Holding cryptographic keys places full liability on banks for security and asset protection.
- Outsourcing custody doesn’t reduce responsibility; due diligence on vendors is mandatory.
- Regulators demand traditional compliance for all digital asset custody operations by banks.
Banks may now hold digital assets for clients, but must do so under tight scrutiny and within existing legal limits.
The U.S. Office of the Comptroller of the Currency (OCC), Federal Reserve, and FDIC have issued a joint statement on how banks should approach crypto custody. While the notice doesn’t introduce new rules, it reinforces that institutions must comply with current legal, compliance, and risk standards. The message is clear: crypto custody is allowed, but it’s high risk and demands full responsibility.
Regulators appear focused on ensuring safe custody without exposing the system to unchecked vulnerabilities.
Regulatory Green Light for Crypto Custody
The joint guidance confirms that banks can act as custodians of crypto assets, either in fiduciary or non-fiduciary roles.
However, institutions must apply the same regulatory frameworks used for traditional financial products. The emphasis lies in reinforcing risk management, legal compliance, and operational accountability across all crypto services.
According to reporter Eleanor Terrett, the guidance underlines that any digital asset service must meet the same standards as other custodial services. This means banks cannot sidestep traditional compliance, even with new financial instruments like cryptocurrencies.
🚨NEW: The “big three” banking regulators — @USOCC, @federalreserve & @FDICgov — just issued joint guidance on how banks should approach custodying crypto assets. 🏦
The guidance doesn’t create new rules, but reaffirms that banks must apply existing risk management, legal, and… pic.twitter.com/HW3AEIaVeT
— Eleanor Terrett (@EleanorTerrett) July 14, 2025
Control of Keys Equals Control of Risk
A key point in the guidance is about key custody.
If a bank holds private cryptographic keys on behalf of customers, it carries full liability. Regulators state that for a bank to maintain full control, no customer should be able to access those keys.
The burden of risk is therefore entirely on the bank when it assumes direct custody. This approach ensures accountability and leaves no room for shared control models that could weaken security standards.
Banks may use third-party vendors for custody services, but this doesn’t reduce their responsibility. Institutions must carry out thorough due diligence and continuously monitor vendors. Even with outsourcing, banks remain accountable for any failures or breaches.
Regulators expect institutions to ensure vendors meet the same risk and compliance standards. This includes issues such as key security, anti-money laundering (AML), sanctions compliance, and market risk exposure.
Crypto Custody Allowed, but with Heavy Scrutiny
The bottom line is that banks are permitted to hold crypto assets, but must do so with full awareness of the risks involved. Regulators have made it clear that while crypto custody is not prohibited, it is far from a light-duty role.
From cybersecurity controls to legal accountability, every aspect will be monitored closely. Banks entering this space must operate with strict discipline, knowing they remain liable for any outcome.
