Federal banking regulators issued a joint statement today emphasizing that banks involved in bitcoin and crypto-assets-related custody and other activities by following existing laws and maintaining strong risk controls. The statement, issued by the Federal Reserve, OCC, and FDIC, clarifies that it does not introduce new rules but reminds banks of their obligations when handling bitcoin and other crypto on behalf of customers.
“Banking organizations may provide safekeeping for crypto-assets in a fiduciary or a nonfiduciary capacity,” the document stated. “Banking organizations that provide crypto-asset safekeeping in a fiduciary capacity must comply with 12 CFR 9 or 150, as applicable, state laws and regulations, and any other applicable legal provisions, such as the instrument that created the fiduciary relationship.”
The agencies emphasize that safekeeping bitcoin and other crypto-assets, mainly through control of customers’ cryptographic keys, requires strong cybersecurity, operational expertise, and full legal compliance. Banks offering these services must be prepared to protect against risks such as key loss, cyberattacks, and unauthorized asset transfers.
They also note that bitcoin and other crypto safekeeping may demand specialized staff, secure infrastructure, and constant monitoring of evolving technologies. Regulatory requirements like anti-money laundering (AML), countering the financing of terrorism (CFT), and OFAC sanctions still apply.
“Like all other banking activities, crypto-asset safekeeping relationships are subject to applicable Bank Secrecy Act/anti-money laundering (BSA/AML), countering the financing of terrorism (CFT), and Office of Foreign Assets Control (OFAC) requirements,” said the document.
The statement also warns that banking organizations should conduct a full risk assessment before engaging in bitcoin and other crypto safekeeping. This includes evaluating the nature of different crypto-assets, the technology used, and the legal obligations involved.
“Subject to the terms and conditions in the customer agreement, a banking organization is responsible for the activities performed by the sub-custodian…” the document mentioned. “Conducting due diligence before selection of a sub-custodian is an important part of sound risk management, and includes evaluating the effectiveness of the sub-custodian’s cryptographic key-management solution, including polices, processes, and internal controls, as well as its adherence to standard safekeeping risk management practices.”
