TLDR
Banks are liable for crypto losses even if assets are held by third parties.
AML and CFT compliance is mandatory for all crypto custody activities.
Independent crypto audits are required or must be outsourced to experts.
Banks must manage cryptographic keys securely and prevent outside access.
Three major U.S. banking regulators have issued joint guidance outlining key risks and responsibilities for banks considering crypto custody services. The document does not establish new rules, but it explains expectations for compliance, internal controls, and legal obligations as more financial institutions explore digital asset safekeeping.
Banks Face Liability in Crypto Custody Roles
The Federal Reserve, Federal Deposit Insurance Corporation (FDIC), and Office of the Comptroller of the Currency (OCC) jointly released a policy statement on the safekeeping of crypto-assets. The guidance clarifies that banks offering these services must meet strict operational, legal, and security standards.
The document confirms that when a bank holds cryptographic keys for clients, it assumes full liability for those digital assets. This responsibility extends even when the custody function is outsourced to a third-party vendor. The agencies said,
“The banking organization remains responsible for the activities performed by the sub-custodian.”
The regulators explained that banks must have clear procedures for managing cryptographic keys, protecting them from unauthorized access, and responding to security breaches. If assets are lost due to a cyberattack or key mismanagement, the bank may be held accountable regardless of whether the keys were managed in-house or by a third party.
Compliance and Audit Readiness Required
The joint guidance also reminds banks to fully comply with anti-money laundering (AML) and countering the financing of terrorism (CFT) regulations. This includes monitoring customer transactions, verifying identities, and reporting suspicious activity as required under the Bank Secrecy Act.
Since crypto transactions often occur through pseudonymous wallets, banks must develop processes that allow them to trace the origin and destination of funds. This may include using blockchain analytics tools or partnering with vendors that provide compliance infrastructure.
The document also recommends that banks implement independent audit programs to regularly assess their crypto custody controls. These programs should evaluate procedures for crypto key generation, wallet access control, and personnel qualifications. If a bank lacks in-house expertise, the agencies recommend hiring qualified third-party specialists.
Legal Frameworks and Vendor Oversight Emphasized
The guidance includes legal considerations around smart contracts, airdrops, and network forks. Banks must clarify their responsibilities in customer agreements to prevent disputes during events that alter asset ownership or structure.
Moreover, regulators stressed the importance of third-party vendor management. Banks are responsible for performing due diligence on any external crypto custody service providers, particularly regarding security and key management protocols. Contracts must include clear terms about responsibilities in the event of asset compromise or vendor insolvency.
Agencies reiterated that even when a sub-custodian manages the assets, the legal liability remains with the bank. Proper risk assessments and written agreements are essential to ensure legal clarity and customer protection.
Banks Show Increased Interest Amid Softer Regulatory Landscape
The new guidance comes at a time when some banks are exploring entry into digital asset services. In May 2025, a group of banks reportedly began talks on launching a shared stablecoin. Meanwhile, companies like Ripple and Circle have applied for banking licenses.
Recent changes in the regulatory landscape may be contributing to this interest. The Federal Reserve has removed the “reputational risk” factor from its oversight, a policy some argued discouraged banks from entering the crypto market.
Acting Comptroller Rodney Hood has also stated that banks can buy and sell cryptocurrencies held in custody for clients under certain conditions. These changes, along with the new guidance, may encourage more institutions to build crypto custody offerings while understanding their obligations.
Stay Ahead of the Market with Benzinga Pro!
Want to trade like a pro? Benzinga Pro gives you the edge you need in today's fast-paced markets. Get real-time news, exclusive insights, and powerful tools trusted by professional traders:
- Breaking market-moving stories before they hit mainstream media
- Live audio squawk for hands-free market updates
- Advanced stock scanner to spot promising trades
- Expert trade ideas and on-demand support
