OCC Crypto Custody Rules in 2026: How Banks Can Now Hold Your Digital Assets

For years, cryptocurrency holders faced a frustrating paradox: traditional banks—the most heavily regulated and insured financial institutions—refused to touch digital assets. Crypto custody meant choosing between self-custody (with its technical risks) or specialized crypto custodians (with their regulatory uncertainties and, as events like the FTX collapse demonstrated, significant counterparty risks).

That changed in 2025 when the Office of the Comptroller of the Currency (OCC) issued Interpretive Letter 1183 (March 2025) and Interpretive Letter 1184 (May 2025), confirming that national banks and federal savings associations may provide cryptocurrency custody services. This regulatory clarity—combined with the broader shift toward “regulatory clarity over enforcement” under SEC Chairman Atkins—has opened the door for traditional banking institutions to enter the digital asset custody market.

This article examines what the OCC guidance authorizes, what limitations apply, and what market participants should consider as bank crypto custody services become available.

Key Takeaways

• OCC Interpretive Letter 1183 (March 2025) confirmed that national banks may provide cryptocurrency custody services as a permissible banking activity under the National Bank Act’s incidental powers clause (12 U.S.C. § 24(Seventh))
• OCC Interpretive Letter 1184 (May 2025) withdrew the prior supervisory non-objection requirement, allowing qualifying banks to offer crypto custody without seeking advance OCC approval
• FDIC insurance does NOT cover cryptocurrency—digital assets in bank custody are not deposits and are not federally insured, regardless of where they are held
• Banks must implement comprehensive risk management frameworks addressing cybersecurity, key management, BSA/AML compliance, and third-party vendor oversight
• Securities law questions remain unresolved—banks must carefully evaluate which digital assets they can custody without triggering broker-dealer registration requirements

What Changed: Before and After the 2025 OCC Guidance

The Pre-2025 Landscape

The OCC first addressed cryptocurrency custody in Interpretive Letter 1170 (July 22, 2020), which concluded that national banks could provide cryptocurrency custody services as a modern form of traditional safekeeping. However, the practical impact was limited by subsequent regulatory developments.

In November 2021, the OCC issued Interpretive Letter 1179, requiring banks to obtain a “supervisory non-objection” from the OCC before engaging in certain crypto-related activities, including custody. This effectively created a prior-approval requirement that chilled bank participation. Additionally, federal banking regulators issued a Joint Statement on Crypto-Asset Risks (January 3, 2023) expressing “significant safety and soundness concerns” about bank crypto exposures.

The result: institutional crypto custody remained dominated by specialized firms (Coinbase Custody, BitGo, Anchorage Digital, Gemini Custody), while traditional banks stayed on the sidelines despite theoretical legal authority.

The 2025 Regulatory Shift

Two OCC interpretive letters fundamentally changed the landscape:

Interpretive Letter 1183 (March 2025) reaffirmed and expanded the analysis from IL 1170, confirming that cryptocurrency custody is permissible under the National Bank Act. The letter emphasized that “the essential banking function of safekeeping—holding valuable property for customers—applies equally to digital assets secured by cryptographic keys.”

Interpretive Letter 1184 (May 2025) withdrew the supervisory non-objection requirement from IL 1179 for banks that demonstrate adequate risk management capabilities. Banks meeting standard safety and soundness requirements may now offer crypto custody services through normal supervisory channels rather than seeking advance approval.

This shift aligned with broader regulatory developments in 2025, including the SEC’s reduced enforcement posture (enforcement actions down 27%, total settlements down 45% to $808 million) and the launch of the SEC Crypto Task Force in January 2025.

What Legal Authority Allows Banks to Custody Crypto?

The OCC’s authorization rests on established statutory and regulatory foundations:

The Incidental Powers Clause

Under 12 U.S.C. § 24(Seventh), national banks may exercise “all such incidental powers as shall be necessary to carry on the business of banking.” Courts and regulators have long interpreted this provision to authorize activities that are “convenient or useful” in connection with banking powers, even if not explicitly enumerated in statute. See NationsBank of N.C., N.A. v. Variable Annuity Life Ins. Co., 513 U.S. 251, 258 n.2 (1995).

Safekeeping services—holding valuable property for customers—are a traditional banking function with roots predating the National Bank Act. The OCC’s interpretive letters conclude that safekeeping cryptographic private keys is a modern extension of this established power, not a new activity requiring additional statutory authorization.

OCC Regulations

Banks providing custody in a fiduciary capacity must comply with 12 C.F.R. Part 9 (governing fiduciary activities of national banks). Non-fiduciary custody arrangements are governed by general safety and soundness standards under 12 C.F.R. Part 30 and the Interagency Guidelines Establishing Standards for Safety and Soundness (12 C.F.R. Part 30, Appendix A).

Bank Secrecy Act Requirements

Banks offering crypto custody remain fully subject to the Bank Secrecy Act (31 U.S.C. § 5311 et seq.) and FinCEN’s implementing regulations (31 C.F.R. Chapter X). This includes:

• Customer Identification Program (CIP) requirements under 31 C.F.R. § 1020.220
• Customer Due Diligence (CDD) and beneficial ownership requirements under 31 C.F.R. § 1020.230
• Suspicious Activity Report (SAR) filing obligations under 31 C.F.R. § 1020.320
• Travel Rule compliance for transfers of $3,000 or more under 31 C.F.R. § 1010.410(f)

What Services Can Banks Provide Under the OCC Guidance?

Authorized Activities

Private Key Custody: Banks may hold cryptographic private keys on behalf of customers using secure key management systems, including hardware security modules (HSMs), multi-party computation (MPC) arrangements, or cold storage solutions.

Transaction Facilitation: IL 1184 clarifies that banks may initiate blockchain transactions at customer direction—meaning banks can offer active custody services rather than cold-storage-only arrangements.

Stablecoin Reserve Custody: Following the GENIUS Act (signed July 2025), which requires stablecoin issuers to maintain 1:1 reserve backing in qualifying assets, banks are positioned to serve as reserve custodians. Cash and short-term Treasury holdings backing stablecoins can be maintained in bank accounts, while banks may separately custody the stablecoin tokens themselves.

Institutional Services: Banks may provide custody infrastructure for institutional clients including investment advisers, hedge funds, family offices, and corporate treasury functions.

What Remains Outside the Guidance

The OCC interpretive letters do not authorize banks to:

• Trade cryptocurrency for their own accounts (principal trading)
• Issue proprietary cryptocurrency tokens or stablecoins (separate regulatory analysis required)
• Provide custody for digital assets that constitute securities without addressing broker-dealer requirements
• Extend unsecured credit based solely on cryptocurrency collateral (standard credit underwriting applies)

What About FDIC Insurance—Are My Crypto Holdings Protected?

No. FDIC insurance does not cover cryptocurrency held at banks.

The Federal Deposit Insurance Act defines “deposit” as “the unpaid balance of money or its equivalent received or held by a bank” (12 U.S.C. § 1813(l)(1)). Cryptocurrency does not satisfy this definition. The FDIC has consistently stated that crypto-assets are not deposits and are not insured by the FDIC.

Banks offering crypto custody must provide clear, prominent disclosure to customers that:

1. Cryptocurrency held in custody is not an insured deposit
2. Cryptocurrency is not insured by the FDIC or any other federal government agency
3. Cryptocurrency is not guaranteed by the bank or any government agency
4. Cryptocurrency may lose value

These disclosure requirements parallel longstanding requirements for bank sales of non-deposit investment products. See Interagency Statement on Retail Sales of Nondeposit Investment Products (OCC, Federal Reserve, FDIC, OTS, February 15, 1994, as updated).

While FDIC insurance does not apply, banks may offer private insurance coverage for custodied crypto assets. Institutional-grade crypto insurance is available from specialized markets (Lloyd’s syndicates, Bermuda carriers), though coverage limits and premiums vary significantly based on custody architecture and security controls.

What Risk Management Requirements Apply?

The OCC guidance emphasizes that crypto custody must comply with existing safety and soundness standards. Banks should address:

Cybersecurity Controls

Banks must maintain information security programs consistent with the Interagency Guidelines Establishing Information Security Standards (12 C.F.R. Part 30, Appendix B). For cryptocurrency custody, this includes:

• Secure cryptographic key generation using certified random number generators
• Multi-signature or MPC-based transaction authorization requiring multiple approvals
• Air-gapped cold storage for assets not required for immediate liquidity
• Regular penetration testing and independent security audits
• Incident response procedures specific to blockchain-related security events

Business Continuity and Key Recovery

Unlike traditional assets, lost cryptographic keys mean permanently inaccessible assets. IL 1183 emphasizes that banks must “implement robust backup and recovery procedures for cryptographic keys” integrated with broader business continuity planning. This includes geographically distributed key backups, succession procedures, and regular recovery testing.

Third-Party Risk Management

Banks partnering with technology vendors for custody infrastructure must comply with OCC Bulletin 2023-17 (Third-Party Relationships: Risk Management Guidance). Key requirements include:

• Due diligence before engagement (financial condition, security practices, regulatory compliance)
• Written contracts addressing security requirements, audit rights, and business continuity
• Ongoing monitoring of vendor performance and risk profile
• Contingency planning for vendor failure or termination

BSA/AML Program Integration

Crypto custody must integrate with the bank’s BSA/AML compliance program:

• Blockchain analytics tools for transaction monitoring and risk scoring
• OFAC sanctions screening for wallet addresses (using tools like Chainalysis, Elliptic, or TRM Labs)
• Enhanced due diligence procedures for high-risk customers (privacy coin users, mixing service exposure)
• Staff training on cryptocurrency-specific money laundering typologies

What Securities Law Considerations Apply?

While the OCC has addressed banking law authority, securities law questions create significant complexity for bank crypto custody:

Token Classification Uncertainty

Under the test established in SEC v. W.J. Howey Co., 328 U.S. 293 (1946), an asset constitutes an “investment contract” (and thus a security under 15 U.S.C. § 77b(a)(1)) if it involves: (1) an investment of money, (2) in a common enterprise, (3) with an expectation of profits, (4) derived from the efforts of others.

The SEC has consistently stated that Bitcoin is not a security. The classification of other digital assets remains unsettled, though the SEC’s dismissal of cases against major exchanges in 2025 and the ongoing work of the SEC Crypto Task Force suggest potential regulatory evolution. Banks must carefully evaluate which assets they are willing to custody pending further clarity.

Broker-Dealer Considerations

If a bank custodies digital assets that constitute securities, it may trigger registration requirements under the Securities Exchange Act of 1934 (15 U.S.C. § 78o). Banks have an exception from broker-dealer registration for certain activities (15 U.S.C. § 78c(a)(4)(B)), but the scope of this exception for digital asset custody remains unclear. Banks should consult with securities counsel before custodying assets with arguable securities characteristics.

Qualified Custodian Status

Investment advisers registered with the SEC must maintain client assets with “qualified custodians” under the Custody Rule (17 C.F.R. § 275.206(4)-2). Banks generally satisfy qualified custodian requirements, which may make bank crypto custody attractive for advisers seeking compliant custody solutions. However, the SEC has not issued definitive guidance on how the custody rule applies to digital asset private keys, and advisers should document their analysis.

SAB 121 Accounting Treatment

SEC Staff Accounting Bulletin 121 (March 2022) requires entities custodying crypto assets for others to recognize both an asset and a corresponding liability on their balance sheets, measured at fair value. This treatment differs from traditional custody and has capital implications for banks. The status of SAB 121 has been subject to ongoing debate, and banks should confirm current accounting requirements with their auditors before launch.

Which Banks Are Entering the Market?

As of February 2026, several institutions have announced crypto custody initiatives:

BNY Mellon: Launched institutional digital asset custody in late 2025, initially supporting Bitcoin and Ethereum with plans to expand asset coverage.

US Bank: Announced a crypto custody partnership with institutional infrastructure providers, with services expected in 2026.

State Street: Has indicated plans to offer digital asset custody services through its institutional servicing platform.

Several regional banks are also exploring custody offerings, often through partnerships with established crypto custody technology providers rather than building proprietary infrastructure.

Note: Specific bank offerings, timelines, and supported assets are subject to change. Confirm current availability directly with institutions.

What to Do Now: Actionable Steps

For Institutional Investors and Asset Managers

1. Conduct custody due diligence. Request detailed information from prospective bank custodians regarding key management architecture, security controls, insurance coverage, and regulatory status.
2. Compare fee structures. Bank custody may carry different fee models than specialized custodians—evaluate total cost including transaction fees, storage fees, and minimum balances.
3. Update investment policy statements. If your IPS addresses custody requirements, update to reflect the availability of bank custody and any preferences or restrictions.
4. Assess qualified custodian compliance. For SEC-registered advisers, document your analysis of how bank crypto custody satisfies custody rule requirements.

For Crypto Companies and Founders

1. Explore banking relationships. Banks offering custody may be more receptive to broader banking relationships, potentially addressing persistent banking access challenges for crypto companies.
2. Evaluate treasury options. Bank custody may enable more integrated treasury management, combining crypto holdings with traditional cash management and credit facilities.
3. Review stablecoin reserve arrangements. If you issue or plan to issue stablecoins, evaluate whether bank custody satisfies GENIUS Act reserve requirements more efficiently than current arrangements.

For Banks Considering Entry

1. Conduct regulatory gap analysis. Map existing compliance infrastructure against OCC expectations for crypto custody, identifying areas requiring enhancement.
2. Engage supervision proactively. While prior approval is not required, early engagement with OCC examiners can identify issues before formal examination.
3. Assess build vs. partner. Evaluate whether to develop proprietary custody technology or partner with established providers, weighing speed to market against third-party risk management obligations.
4. Address accounting and capital impacts. Analyze SAB 121 implications and any capital treatment considerations under Basel frameworks.

Practical Implications

Institutional Access Expands: Many institutional investors operate under mandates requiring custody at regulated banks or similarly supervised entities. Bank crypto custody removes a significant barrier to institutional allocation.

Counterparty Risk Profile Changes: National banks operate under comprehensive prudential supervision, capital requirements, and examination regimes that specialized custodians historically lacked. This may reduce—though not eliminate—counterparty risk for custodied assets.

Market Remains Fragmented: Banks will likely begin with limited asset coverage (Bitcoin, Ethereum, major stablecoins), while specialized custodians continue serving long-tail assets that banks won’t touch. Multi-custodian arrangements may remain necessary for diversified portfolios.

State Bank Authority Varies: The OCC guidance applies to national banks and federal savings associations. State-chartered banks operate under different regulatory frameworks. Some state regulators have issued parallel guidance, but multi-state operations require careful jurisdictional analysis.

Insurance Gaps Persist: The absence of FDIC coverage means crypto custody risk—while potentially reduced at banks—is not eliminated. Evaluate private insurance options and understand coverage limitations.

Conclusion

The OCC’s 2025 interpretive letters represent a significant step toward integrating cryptocurrency with traditional banking infrastructure. By confirming that national banks may provide crypto custody services and removing prior-approval requirements, the OCC has created a clear pathway for bank entry into this market.

However, important limitations apply. FDIC insurance does not cover cryptocurrency. Securities law questions remain unresolved. Accounting treatment creates balance sheet implications. And banks are proceeding cautiously, initially offering limited asset coverage to institutional clients.

For market participants, the emergence of OCC crypto custody banks creates new options worth evaluating—but not a simple solution to all custody challenges. Careful due diligence, clear documentation, and ongoing monitoring remain essential regardless of custodian type.

---

This article is for informational and educational purposes only and does not constitute legal advice. Reading this content does not create an attorney-client relationship. Laws and regulations in the cryptocurrency space change rapidly—consult a qualified attorney for advice specific to your situation and jurisdiction. Seth Goettelman is licensed to practice law in Wisconsin and Florida.