OCC Crypto Custody Rules 2026: What Banks Need to Know About Digital Asset Services

National banks can now custody cryptocurrency, hold stablecoin reserves, and facilitate digital asset transactions for customers — without seeking prior regulatory approval. After years of regulatory whiplash that effectively locked banks out of the digital asset market, the Office of the Comptroller of the Currency has restored and expanded a permissive framework for bank participation in digital asset services. Combined with the SEC’s rescission of the SAB 121 accounting barrier and parallel moves by the FDIC and Federal Reserve, 2025 marked a decisive turning point. For banks evaluating digital asset custody in 2026, the OCC crypto custody rules now provide a clear — if still evolving — legal foundation.

Key Takeaways

• National banks may custody crypto assets without prior supervisory non-objection. The OCC rescinded its case-by-case approval requirement in early 2025, restoring the permissive framework established in 2020–2021.
• The foundational OCC interpretive letters remain in effect. IL 1170 (custody), IL 1174 (stablecoin reserves), and IL 1176 (blockchain payments) continue to define the scope of permissible bank digital asset activities.
• All three federal banking regulators moved together. The OCC, FDIC, and Federal Reserve each rescinded or revised restrictive crypto guidance in 2025, signaling coordinated federal policy.
• SAB 121’s rescission removed the balance-sheet barrier. Custodied digital assets are now treated as off-balance-sheet items, eliminating the capital adequacy penalty that had made bank custody uneconomical.
• Existing safety-and-soundness standards apply. Banks must adapt their BSA/AML, cybersecurity, third-party risk management, and consumer protection programs to address digital asset-specific risks — the OCC has not issued separate crypto-specific rules.

The Regulatory Foundation: OCC Interpretive Letters 1170, 1174, and 1176

The OCC’s authority to permit national bank involvement in digital assets rests on a trio of interpretive letters issued between July 2020 and January 2021. These letters have not been rescinded and remain the governing framework in 2026.

Interpretive Letter 1170 (July 22, 2020) confirmed that national banks and federal savings associations may provide cryptocurrency custody services as a permissible banking activity under the National Bank Act. The OCC grounded its analysis in the bank custody powers found in 12 U.S.C. § 24(Seventh) and the fiduciary activities regulation at 12 C.F.R. Part 9, reasoning that safekeeping digital assets — including holding cryptographic keys — is a modern form of the safekeeping and custody services banks have offered for over a century.

Interpretive Letter 1174 (September 21, 2020) extended this framework to stablecoin reserves, confirming that national banks may hold deposits that serve as reserves for stablecoins backed 1:1 by a single fiat currency. With the GENIUS Act now establishing federal reserve requirements for stablecoin issuers, IL 1174 positions national banks as the natural custodians for compliant stablecoin reserves — a potentially significant new line of business.

Interpretive Letter 1176 (January 4, 2021) completed the framework by authorizing banks to use independent node verification networks (i.e., blockchains) and stablecoins to facilitate payment activities. This letter established that participating in blockchain networks, including running nodes, is a permissible payment-related activity for national banks.

What Happened Between 2021 and 2025?

Despite the permissive 2020–2021 framework, a series of regulatory actions effectively froze bank participation in digital asset services:

The supervisory non-objection requirement (November 2021). Under Acting Comptroller Michael Hsu, the OCC issued guidance requiring national banks to obtain written supervisory non-objection before engaging in the crypto activities authorized by ILs 1170, 1174, and 1176. This imposed a de facto case-by-case approval process, and — critically — few banks received non-objection letters. The requirement transformed a general permission into a bottleneck.

SEC Staff Accounting Bulletin 121 (March 2022). SAB 121 required entities custodying crypto assets on behalf of others to record both a safeguarding liability and a corresponding asset on their balance sheets at fair value. For regulated banks, this created a punishing capital adequacy problem: the balance-sheet treatment consumed regulatory capital under Basel III requirements, making crypto custody economically irrational for most institutions. Congress passed a resolution to overturn SAB 121 in 2024, which President Biden vetoed.

The interagency joint statement (January 2023). The OCC, FDIC, and Federal Reserve issued a joint statement on crypto-asset risks cautioning banking organizations about the risks of crypto-asset activities and signaling heightened supervisory scrutiny. While not a prohibition, the statement reinforced the chilling effect on bank participation.

FDIC pause letters. In parallel, the FDIC issued informal “pause letters” to supervised banks, directing them to halt or refrain from expanding crypto-related activities pending further guidance. These letters, which were not publicly released at the time, were later disclosed through FOIA requests and congressional inquiries.

The cumulative effect was clear: despite having legal authority under OCC interpretive letters, national banks overwhelmingly stayed on the sidelines.

The 2025 Reset: How All Three Regulators Reversed Course

The regulatory posture shifted dramatically in early 2025 as all three federal banking regulators moved to rescind or revise their restrictive crypto guidance:

• OCC: Rescinded the supervisory non-objection requirement in early 2025, restoring the ability of national banks to engage in crypto custody, stablecoin reserves, and blockchain payment activities through their standard risk management processes. Subsequent OCC guidance has further clarified that banks may facilitate the purchase and sale of digital assets held in custody on behalf of customers.
• SEC: Rescinded SAB 121, removing the balance-sheet accounting barrier. The replacement guidance (SAB 122) reverted to standard custodial accounting treatment, where custodied assets are recorded off-balance-sheet with appropriate disclosure in financial statement footnotes.
• FDIC: Rescinded Financial Institution Letter FIL-16-2022, which had required FDIC-supervised institutions to notify the agency before engaging in crypto-related activities. The FDIC replaced it with guidance emphasizing that crypto activities should be evaluated under existing risk management frameworks.
• Federal Reserve: Rescinded SR Letter 22-6 and related supervisory guidance that had imposed additional scrutiny on state member banks seeking to engage in digital asset activities.

The coordinated nature of these actions is significant. Rather than a single agency acting in isolation, the OCC crypto custody rules now exist within a broader interagency consensus that regulated banks should be permitted to participate in digital asset markets — subject to existing safety-and-soundness standards.

What Activities Can National Banks Perform in 2026?

Under the current framework, national banks and federal savings associations may engage in the following digital asset activities without prior supervisory non-objection:

1. Custodying digital assets — Holding private cryptographic keys and safekeeping digital assets on behalf of customers, including both institutional and retail clients. This encompasses cold storage, warm storage, and multi-signature custody arrangements.
2. Holding stablecoin reserves — Maintaining fiat currency deposits that back stablecoins pegged 1:1 to a single currency. Under the GENIUS Act’s reserve framework, this positions national banks as primary reserve custodians for compliant issuers.
3. Facilitating blockchain payments — Using distributed ledger networks and stablecoins to process payment transactions and settlements.
4. Buy/sell facilitation — Executing purchases and sales of digital assets held in custody on behalf of customers, either directly or through third-party execution partners.

These activities remain subject to all existing supervisory expectations. The OCC has not created a separate regulatory regime for digital assets — rather, it has clarified that digital asset services fall within existing bank powers and must be conducted within existing risk management frameworks.

What Risk Management and Compliance Standards Apply?

Banks offering digital asset services must address several compliance obligations that require adaptation for blockchain-specific risks:

BSA/AML and sanctions compliance. Full compliance with the Bank Secrecy Act (31 U.S.C. §§ 5311–5336) is non-negotiable. FinCEN’s guidance on convertible virtual currency (FIN-2019-G001) applies to bank-offered crypto services. Banks must implement blockchain-specific transaction monitoring, wallet screening against OFAC’s Specially Designated Nationals (SDN) list (31 C.F.R. Part 501), and procedures for identifying and reporting suspicious blockchain activity. The FinCEN Travel Rule (31 C.F.R. § 1010.410(f)) applies to digital asset transfers exceeding $3,000.

Information security and key management. The OCC’s heightened standards for information security under 12 C.F.R. Part 30, Appendix B apply to private key management. Banks must develop robust controls for key generation, storage, backup, and recovery — including cold storage protocols, hardware security modules (HSMs), and multi-signature governance. A compromised private key is the digital equivalent of a vault breach.

Third-party risk management. Banks using sub-custodians, blockchain analytics providers, pricing oracles, or exchange execution partners must comply with interagency guidance on third-party relationships (OCC Bulletin 2023-17). Given that the digital asset ecosystem relies heavily on specialized technology providers, the third-party risk management program is often the most complex compliance workstream for bank custody operations.

Consumer protection. Retail-facing digital asset services must include clear disclosures regarding: the nature of custody arrangements, the fact that custodied digital assets are not insured by the FDIC, the volatility and risks of digital assets, applicable fees, and the circumstances under which the bank may restrict access to custodied assets.

How Do OCC Rules Interact with State Banking Laws?

National banks operate under federal preemption principles established in the National Bank Act (12 U.S.C. § 21 et seq.) and the Supreme Court’s decision in Barnett Bank of Marion County v. Nelson, 517 U.S. 25 (1996). As a general matter, state laws that “prevent or significantly interfere with” a national bank’s exercise of its powers are preempted.

However, preemption analysis is fact-specific, and several state-level considerations remain relevant:

• New York: The BitLicense regime (23 NYCRR Part 200) does not apply to nationally chartered banks, but banks serving New York customers should monitor DFS expectations for digital asset consumer protection disclosures.
• Wyoming: The Special Purpose Depository Institution (SPDI) charter (Wyo. Stat. § 13-12-101 et seq.) provides an alternative state-chartered path for digital asset custody. SPDIs are not FDIC-insured and are subject to different capital and reserve requirements.
• State money transmitter laws: National banks are generally exempt from state money transmitter licensing requirements under both federal preemption and the express exclusions in most state money transmission statutes. However, the scope of these exemptions varies by state and by the specific activities performed.

Practical Implications

For National Banks Considering Digital Asset Services

The regulatory path is now clear, but operational readiness is a different question. Banks should conduct a comprehensive gap analysis addressing: private key custody infrastructure (cold storage, HSMs, multi-sig), blockchain transaction monitoring capabilities for BSA/AML, staff expertise in digital asset operations, insurance and bonding for custodied assets, and third-party vendor due diligence for blockchain analytics and execution partners. Engaging your OCC supervisory team early — even though pre-approval is no longer required — is prudent risk management.

For State-Chartered Banks

OCC interpretive letters apply only to nationally chartered institutions. State-chartered banks must look to their primary federal regulator (FDIC or Federal Reserve) and state banking department for parallel guidance. The FDIC’s rescission of FIL-16-2022 and the Fed’s rescission of SR 22-6 are encouraging signals, but state-chartered banks should obtain written confirmation of permissibility from their regulators before launching digital asset services.

For Crypto Companies and Fintechs

The emergence of bank custody creates both opportunities and competitive pressure. Crypto-native custodians (Coinbase Custody, BitGo, Anchorage Digital) now face competition from banks with deeper capital, broader customer relationships, and regulatory credibility. At the same time, these incumbents may become acquisition targets or technology partners for banks entering the space. Evaluate whether banking partnerships — for custody, fiat on/off ramps, or stablecoin reserves — strengthen your regulatory posture.

For Retail Investors

Bank-custodied crypto offers the convenience of a familiar institution, but comes with an important caveat: digital assets held in bank custody are not covered by FDIC insurance. Nor do SIPC protections — which cover securities held at broker-dealers — extend to digital assets. Any bank marketing crypto custody services must disclose this clearly, but investors should independently verify their understanding of what protections apply and what risks remain.

What to Do Now

• Bank executives: Present a digital asset services business case to your board. The regulatory window is open, and first movers will capture institutional and retail custody market share. Include a detailed risk assessment alongside the revenue opportunity.
• Bank compliance teams: Update BSA/AML programs with blockchain-specific typologies — wallet screening, chain analysis integration, and Travel Rule procedures for digital asset transfers. Begin vendor selection for blockchain analytics tools.
• Legal counsel: Review the full text of OCC ILs 1170, 1174, 1176, and subsequent 2025 guidance to advise clients on the specific scope of permitted activities. Pay particular attention to any conditions or limitations on buy/sell facilitation versus pure custody.
• Crypto companies: Open discussions with national bank partners about custody and reserve arrangements. The regulatory clarity that banks needed now exists — the remaining question is operational capability and pricing.
• All market participants: Monitor the OCC, FDIC, and Federal Reserve for potential interagency rulemaking that could formalize the current interpretive letter framework into binding regulation.

---

This article is for informational and educational purposes only and does not constitute legal advice. Reading this content does not create an attorney-client relationship. Laws and regulations in the cryptocurrency space change rapidly — consult a qualified attorney for advice specific to your situation and jurisdiction. Seth Goettelman is licensed to practice law in Wisconsin and Florida.