U.S. Regulators Clarify Expectations for Banks Offering Crypto Custody Services

Highlights:

• US banking agencies have confirmed that banks must control released keys to offer digital asset custody services safely.
• The crypto custody rules require banks to assess risks and build strong systems before holding assets of customers.
• Banks can use vendors for crypto custody, but they remain fully responsible for contract clarity and the safety of assets.

The Federal Reserve, the FDIC, and the Office of the Comptroller of the Currency have released a joint statement guiding banks on handling digital asset custody. The agencies explained that this statement does not introduce new expectations. Instead, it confirms that existing laws still apply when banks offer crypto-related services. The guidance is for institutions already active or considering entering digital asset safekeeping.

@federalreserve @FDICgov @USOCC issue joint statement on risk-management considerations for crypto-asset safekeeping: https://t.co/1VFNYCx75T

— Federal Reserve (@federalreserve) July 14, 2025

Banks can offer custody services in two ways. They can work in a fiduciary arrangement where they act in place of the customer with legal accountability. They can also operate on a non-fiduciary basis, which entails only holding in safe custody but not running the assets. Banks in either scenario are required to adhere to all existing regulations and achieve standards of operation.

The statement underlined the relevance of control. When a bank possesses the cryptographic keys, it assumes all full responsibility over the asset. Banks have to make sure that none of the keys are available to any other party, including the customer. The minimum level of successful custody is complete key control. This norm should be in place in order to minimize the risks associated with the storage of digital assets.

Banks should be able to demonstrate that they have robust internal controls in place. They should also ensure that their employees can responsibly handle crypto activities. Such steps must be undertaken before entering into any custody arrangements for digital assets.

Banks Urged to Strengthen Systems Under Crypto Custody Rules

The agencies also identified some of the important risks that banks need to focus on to provide digital asset custody. These include loss of private keys, computer hacking, quick asset loss, and exposure to financial crimes. Owing to these concerns, banks should employ effective internal controls and high levels of operational supervision. They should adopt new technology and make sure that their employees are capable of dealing with technical issues regarding digital assets.

Although banks can hire outsourced custody providers, they do not escape liability for their activities. Before working with vendors, banks must conduct full evaluations, especially focusing on key storage practices. Contracts with vendors must clearly state the process to follow in case of loss, compromise, or insolvency. Every agreement must define each party’s duties and responses during asset-related events.

Banks must also follow rules related to anti-money laundering and the prevention of terrorism financing. They need to identify their customers and review transactions for signs of suspicious behavior. Although this can be difficult in blockchain systems, banks must still meet compliance standards.

Legal clarity continues to be a key factor in the process. Banks need to learn how smart contracts, token forks, or on-chain votes can influence the custodial duties. They need to be ready to handle complex activities like airdrops or adjustments to token making. In any event, legal responsibilities and results should be stipulated in agreements.

Policy Shift Clears Way for Greater Crypto Activity in U.S. Banking

The statement comes after developments that have left banks with greater flexibility in the crypto market. The FDIC recently eliminated reputational risk in its regulatory behavior, which had constrained crypto-related services earlier. Banks are no longer required to receive prior approval when providing custody services.