US banking regulators have detailed how traditional banks can provide crypto custody services, emphasizing risk management and clear control over digital assets. The Federal Reserve, Federal Deposit Insurance Corporation (FDIC), and the Office of the Comptroller of the Currency (OCC) defined crypto safekeeping as holding assets on behalf of customers after issuing joint guidance on July 14, 2025.
Defining crypto custody in banking
Crypto custody refers to a bank’s practice of safeguarding digital assets for clients by controlling transfer credentials, managing access, and setting internal approval procedures. Unlike traditional deposits, crypto assets exist on a blockchain, requiring specialized systems to manage their movement.
In their guidance, the regulators specified that to meet the definition of custody, a bank must have sole control over transferring assets. Possession of cryptographic keys alone does not guarantee exclusive authority if a customer can independently move their assets.
The custody relationship may be fiduciary, carrying specific legal responsibilities, or non-fiduciary, with the arrangement and applicable laws determining obligations and fees. Banks outline these details in custody agreements, which can differ between providers.
US banking agencies indicated that a bank generally needs controls in place to prevent any other party from transferring a customer’s crypto asset without the bank’s involvement.
Operational procedures and security measures
The custody process starts when a customer sends digital assets to a blockchain address managed under the bank’s custody arrangement. The blockchain records the transaction, and the bank maintains a record linking the asset to the client. When a customer initiates a transfer, the bank verifies permissions and applies internal controls before approving the blockchain transaction. Once approved, crypto is sent to the designated address, with transfers generally irreversible.
Banks employ different types of wallets, such as “cold” storage—offline, disconnected from the internet—and “hot” wallets, which remain online for easier transactions. While hot wallets can process trades more efficiently, agencies warn they are typically less secure.
Safeguards often include limiting access to transfer credentials, monitoring for suspicious activity, and adapting procedures to each service’s risk level. Some banks use third-party service providers. On May 7, 2025, the OCC confirmed that national banks and federal savings associations may outsource crypto custody or execution—including buying and selling assets for clients—if they manage third-party risk appropriately.
Mini dictionary: The Office of the Comptroller of the Currency (OCC) is a US federal agency responsible for regulating and supervising national banks and federal savings associations to ensure the safety and soundness of the banking system.
Limitations and customer considerations
Crypto custody services focus on the safekeeping and authorized movement of digital assets. However, banks do not guarantee the value of assets, nor do they prevent losses from price volatility, theft, operational errors, or blockchain disruptions.
Outsourcing custody functions introduces additional risk. Customers are advised to verify who controls their assets, query withdrawal processes, review service disruption procedures, and understand how losses are addressed. Bank custody does not automatically provide insurance coverage or eliminate risk.
Regulatory guidelines on custody accounting continue to evolve. On January 30, 2025, the Securities and Exchange Commission (SEC) implemented Staff Accounting Bulletin No. 122, replacing previous guidance and requiring institutions to apply relevant accounting standards to crypto safeguarding. On October 1, 2026, the SEC proposed additional custody rule changes for investment advisers and regulated funds. This proposal is not yet in force.
Custody services are not a guarantee of insurance or repayment, and customers must remain aware of ongoing risks from blockchain technology, third-party providers, and asset volatility.
Differences with other crypto custody options
Certain investment products allow individuals to hold shares that represent crypto assets managed by a custodian, rather than directly owning the underlying wallets. This approach differs from direct custody, where a bank acts solely on behalf of its customers’ assets.
Bank agreements may restrict supported tokens, networks, and functions such as trading or decentralized finance (DeFi) use. Coverage, legal terms, and third-party arrangements can all vary. Customers should review contracts for details on asset eligibility and operational procedures.
As of November 2026, US regulators have established a risk-management framework for crypto safekeeping at banks, but arrangements continue to depend on each provider’s policies and the specifics of the custody agreement.
| Custody Provider | Direct Asset Control | Supported Features | Insurance Coverage |
|---|---|---|---|
| Bank | Yes, subject to agreement | Varies, often limited | Not guaranteed |
| Investment product manager | No (investor owns shares) | Product-defined | Depends on structure |
| Crypto-native custodian | Usually yes | May include staking/trading | Varies by provider |
