In what seems like an ironic turn of events, the US Office of the Comptroller of the Currency (OCC) recently issued an interpretative letter officially allowing national banks and federal savings associations to offer cryptocurrency custody and execution services.
This updated letter confirms and expands the positions established in earlier OCC guidance, and explicitly permits banks to outsource custody and execution to third parties, “subject to appropriate third-party risk management practices.”
Let that sink in: the same banks that sparked the 2008 financial crisis through opaque asset management are now cleared to safekeep your cryptographic keys. But don’t worry, the OCC assures this is all part of “the very old business of banking.”
“Providing crypto-asset custody services is a modern form of traditional bank custody activities,” the OCC wrote. They go on to say that “a bank may buy and sell assets held in custody on a customer’s behalf at the direction of the customer,” and even facilitate “cryptocurrency and fiat currency exchange transactions, transaction settlement, trade execution, recordkeeping, valuation, tax services, [and] reporting.”
The letter isn’t shy about the big shift; it explicitly rescinds Interpretive Letter 1179, which imposed a supervisory “non-objection” process for banks entering crypto, calling it unnecessary and “burdensome,” adding that the OCC aims to “encourage responsible innovation and enhance transparency.”
That sounds great in theory. But in practice, this means banks can now legally hold private keys—the very thing Bitcoin’s anonymous creator, Satoshi Nakamoto, invented the system to avoid. “Not your keys, not your coins” may now require a footnote: unless those keys are stored in a cold wallet at a bank.
Regulation as innovation?
Banks are also allowed to engage sub-custodians to hold crypto on their behalf, provided they follow proper controls. The OCC recommends “dual controls, segregation of duties, and accounting controls” and requires that assets be “kept separate from the assets of the custodian and maintained under joint control to ensure that an asset is not lost, destroyed or misappropriated.”
The OCC also nods to the reality that most cryptocurrencies are accessed—not possessed—through cryptographic keys. “In most, if not all, circumstances, providing custody for cryptocurrency will not entail any physical possession of the cryptocurrency. Rather, a bank ‘holding’ digital currencies on behalf of a customer is actually taking possession of the cryptographic access keys…” it wrote.
This semantic reframing allows traditional institutions to shoehorn digital asset services under their existing authority to provide “safekeeping services,” even if the nature of what’s being held is entirely intangible and radically different from bearer bonds or gold bars.
Meet third-party risk management
The OCC insists all of this is fine so long as it’s done in a “safe and sound manner” and in line with a bank’s “overall business plans and strategies.” It cautions that custody agreements should now include language around “forks or splits in the code underlying the cryptocurrency,” acknowledging the novel risks that come with trying to apply legacy infrastructure to volatile digital assets.
The updated stance emphasizes due diligence, internal controls, AML compliance, and information security. That’s reassuring, until one recalls that banks with robust compliance regimes still manage to get hacked, fined, or both.
Even the banks’ ability to use sub-custodians comes with a legal wink: “A bank acting as custodian may engage a sub-custodian… and should develop processes to ensure that the sub-custodian’s operations have proper internal controls to protect the customer’s cryptocurrency.”
But how many banks actually understand the security frameworks for cold wallets, multisig schemes, or the consequences of losing a key that unlocks a $100 million vault on the Ethereum blockchain?
Decentralization to deposit slip
It’s not just a technical evolution—it’s a philosophical reversal. The OCC’s letters acknowledge that “almost 40 million Americans own cryptocurrencies” and that “institutional investors also have invested in cryptocurrencies.”
In other words, the audience is now big enough—and rich enough—for banks to care.
“The OCC recognizes that, as the financial markets become increasingly technological, there will likely be increasing need for banks and other service providers to leverage new technology and innovative ways to provide traditional services…” it added.
But by wrapping itself in the cloak of innovation, the OCC has arguably just opened the door for centralized institutions to recapture the value once promised by decentralized finance.
Now, the digital asset is slowly moving from a decentralized framework to the one that is controlled by deposit slips, so to speak.
Information for this briefing was found via the sources mentioned. The author has no securities or affiliations related to this organization. Not a recommendation to buy or sell. Always do additional research and consult a professional before purchasing a security. The author holds no licenses.
