US encryption regulation advances again: Banking regulatory authorities release guidelines for encryption asset custody

Written by: FinTax

News Overview

According to reports, on July 14, 2025, the Federal Reserve, the Federal Deposit Insurance Corporation (FDIC), and the Office of the Comptroller of the Currency (OCC) issued a joint statement (hereinafter referred to as "the Statement") guiding banks on how to provide custody services for cryptocurrency assets to their customers. This is the latest initiative taken by regulatory agencies during the Trump era as they weigh how traditional lending institutions should engage in digital asset businesses. The Statement notes that banks considering providing custody services for cryptocurrency assets should take into account the constantly changing characteristics of the cryptocurrency market, including the technology behind cryptocurrency assets, and they must implement a risk management framework that can appropriately adapt to the relevant risks.

Previously, regulators withdrew guidance on risks in the cryptocurrency industry in April, allowing lending institutions to more freely offer products and services to clients engaged in digital asset trading. At that time, the Federal Reserve also rescinded its 2022 directive requiring banks to notify in advance about cryptocurrency activities.

FinTax Brief Review

1. Declaration Content: Six Key Risk Points of Bank Custodial Crypto

The joint statement lists a series of existing laws, regulations, guidelines, and risk management principles related to the provision of cryptocurrency custody services, focusing on various risk management, legal, and compliance risks, and elaborating on the relevant mitigation measures. The statement is divided into six parts:

(1) General Risk Management Considerations: Banking institutions should consider potential risks before providing custody services for crypto assets. Effective risk assessment should involve the core financial risks of the banking institution, the ability to understand asset classes, the ability to ensure a strong control environment, contingency planning, and the necessary knowledge of staff regarding crypto asset custody, thereby providing services in a safe and robust manner. In addition, banking institutions providing custody services for crypto assets should also consider the constantly changing characteristics of the crypto asset market and build a risk governance framework that can appropriately adapt to relevant changes.

(2) Management of encryption keys: The loss or leakage of encryption keys or other sensitive information is one of the main risks in the custody of encrypted assets. Banking institutions should have control over encrypted assets, meaning they must reasonably prove that no other party can obtain sufficient information to transfer the encrypted assets out of the control of the banking institution. Such control standards should also apply to the secondary custodians of the banking institutions. In addition, banking institutions should consider how to securely generate encryption keys, establish emergency plans for key loss or leakage, and focus on their cybersecurity environment as part of risk management.

(3) Other risk management considerations: Different types of crypto assets require different key management solutions, or there may be software or hardware requirements that banks lack experience or capability to handle. The potential risks involved in different account models may also vary. Therefore, while banking institutions adhere to standard custodial risk management principles, they also need to adjust based on the specific custodial services provided.

(4) Legal and Compliance Risks: First, like other banking activities, cryptocurrency custody activities must comply with the Bank Secrecy Act (BSA), Anti-Money Laundering (AML), Counter-Terrorism Financing (CFT), and the requirements of the Office of Foreign Assets Control (OFAC). Second, changes in the regulatory environment for cryptocurrencies can also lead to higher compliance risks, and banking institutions should ensure that relevant activities comply with all applicable laws and regulations. Finally, clients may misunderstand the role of banking institutions in custody arrangements, which can lead to risks. This requires banks to provide clients with clear, accurate, and timely information about their custody activities to mitigate such risks. At the same time, banking institutions should also adhere to applicable record-keeping and reporting requirements.

(5) Third-Party Risk Management: "Third-party risk" refers to the risks posed by sub-custodians or other service providers (such as technology providers, cash management institutions) that collaborate with banking institutions. Banking institutions are responsible for the activities carried out by their sub-custodians under the terms and conditions, therefore, banks should conduct adequate due diligence, including assessing the sub-custodian's key management solutions, their compliance with custody risk management principles, how they handle client assets in the event of bankruptcy or operational failure, and the appropriateness of their risk management and record-keeping practices. For other service providers, banks should weigh the risks of purchasing third-party software or hardware, as well as the risks of maintaining such software or hardware as a service.

(6) Audit Requirements: Audit procedures are essential for effective risk management and internal controls. Therefore, the audit procedures of banking institutions should adequately cover cryptocurrency custody services (including third-party risk management), focusing on the unique risks associated with cryptocurrency custody, such as key generation, storage, and deletion, the transfer and settlement of cryptocurrency assets, the adequacy of relevant information technology systems, and assessing employees' capabilities in identifying and controlling cryptocurrency risks. If a banking institution lacks audit expertise, it should engage an appropriate independent third party for the audit.

2. Policy Background: Trump Promotes Cryptocurrency Regulatory Reform

Since Trump's second term began, the U.S. government's attitude towards crypto assets has undergone a significant shift, and this joint statement was released against that backdrop. Over the past few months, various banking regulatory agencies in the U.S. have taken a series of actions, retracting a number of interpretive letters and regulatory statements related to crypto assets from the Biden era. One significant measure was the removal of "reputational risk" assessments from regulatory procedures, replacing the vague reputational risk with more specific categories of financial risk. This move effectively prevented regulatory bodies from pressuring banks to refrain from providing services to crypto asset companies, helping to alleviate banks' real concerns about offering services to controversial industries such as crypto assets.

Another significant measure is the removal of the prior notification requirement for participating in activities related to crypto assets. Under the previous policy, banks were required to obtain a written "no-objection letter" from regulatory authorities before engaging in activities related to crypto assets. Now, banks' crypto activities do not need to follow this procedure and are instead monitored through regular regulatory processes.

In addition, various banking regulatory agencies have restored regulatory policies that previously conflicted with the Biden administration's regulatory philosophy, such as the OCC again allowing its regulated entities to buy and sell custodial crypto assets based on customer instructions, and permitting them to outsource custodial and execution services to third parties, provided that those third parties can manage risks appropriately.

After Trump took office, he changed the previous U.S. government's guidelines urging banks to exercise caution in the cryptocurrency sector and implemented comprehensive regulatory reforms for crypto assets. This was a fulfillment of his political commitments and an important measure to establish the U.S. as the "crypto capital" of the world, stimulating innovative development in the U.S. economy. The joint statement released this time constitutes part of the U.S. regulatory reform for crypto assets, marking the government's shift from several enforcement-focused regulatory policies to enhance market vitality. It now begins to guide banks and other entities to participate in crypto asset activities in a compliant, secure, and stable manner through refined regulatory rules and enhanced business guidance, supporting the innovative development of the crypto industry. In the future, more crypto-friendly statements may be released.

3. Significance and Outlook: The Regulatory Future of Bank Crypto Custody

Overall, the statement discusses how existing laws, regulations, and risk management principles apply to the custody of crypto assets, aiming to provide guidance for banks that offer or are considering offering crypto asset custody services. It reflects a more relaxed regulatory stance but still emphasizes that banks should strictly control risks in crypto asset custody activities and adhere to core principles such as safety, soundness, and consumer protection, reflecting the regulatory baseline of U.S. banking authorities in the crypto industry.

For banks engaged in or considering the custody of crypto assets, on one hand, the declaration provides an entry opportunity into the crypto asset custody field for banks that claim to have appropriate risk control capabilities and sound governance structures, bringing new opportunities. On the other hand, the declaration also provides specific references for the risk control matters of banks already engaged in the custody of crypto assets, and the regulatory authorities will still focus on reviewing the compliance and safety of all aspects including operations, legal, and financial. According to the declaration, banks may need to make certain adjustments to product rules and internal policies and procedures to reflect the unique risks and compliance obligations of crypto asset custody, such as improving cybersecurity protocols, key management systems, and conducting regular security tests.

It is important to note that although the statement provides some clarity, there remains uncertainty in the federal and state regulatory and legal environment against the backdrop of government reforms in cryptocurrency regulation. Merely meeting the elements of the statement may not fully comply with regulatory requirements. Banks and regulatory bodies at all levels must maintain ongoing communication and keep compliance records in preparation for strict regulatory scrutiny.

From a longer-term perspective, the refinement of the United States' crypto custody regulatory rules may attract more crypto asset companies to return to or enter the U.S., and promote the innovative development of the U.S. blockchain industry. As traditional financial institutions gradually deepen their participation in the crypto asset field, related services such as crypto asset custody will be incorporated into the existing regulatory framework, and financial activities surrounding crypto assets will flourish in a more secure and regulated environment.