U.S. encryption regulation advances again: Banking regulatory authorities release guidelines for the custody of encryption assets.

Author: FinTax

Original link:

Disclaimer: This article is a reprinted content, and readers can obtain more information through the original link. If the author has any objections to the form of reprinting, please contact us, and we will make modifications according to the author's request. Reprinting is for information sharing only and does not constitute any investment advice, nor does it represent Wu's views and positions.

News Overview According to reports, on July 14, 2025, the Federal Reserve, the Federal Deposit Insurance Corporation (FDIC), and the Office of the Comptroller of the Currency (OCC) issued a joint statement (hereinafter referred to as "the Statement") guiding banks on how to provide custody services for crypto assets to customers. This is the latest initiative by regulators from the Trump era as they weigh how traditional lending institutions should participate in the digital asset business. The Statement states that banks considering providing custody services for crypto assets should take into account the ever-changing characteristics of the crypto market, including the technology behind crypto assets, and they must implement a risk management framework that can adequately adapt to the relevant risks. Previously, regulators withdrew guidance on the risks of the crypto industry in April, allowing lending institutions to more freely offer products and services to customers engaged in digital asset trading. At that time, the Federal Reserve also rescinded a directive from 2022 that required banks to give prior notice of crypto asset activities. FinTax Commentary 1. Statement Content: Six Key Risk Points of Bank Crypto Custody The joint statement enumerates a series of existing laws, regulations, guidance, and risk management principles related to providing crypto asset custody services, highlighting various risk management, legal, and compliance risks, and outlining relevant mitigation measures. The Statement is divided into six sections: (1) General Risk Management Considerations: Banking institutions should consider potential risks before providing crypto asset custody services, and effective risk assessments should involve the institution's core financial risks, the ability to understand the asset class, the ability to ensure a strong control environment, emergency plans, and necessary knowledge of crypto asset custody among employees, so as to provide services in a secure and robust manner. Additionally, banks providing custody services for crypto assets should also consider the constantly changing characteristics of the crypto asset market and build a risk governance framework that can adequately adapt to relevant changes. (2) Crypto Key Management: The loss or leak of crypto keys or other sensitive information is one of the main risks of crypto asset custody. Banking institutions should maintain control over crypto assets, which means reasonably proving that no other party can obtain sufficient information to transfer the crypto assets out of the bank's control. Such control standards should also apply to the bank's sub-custodians. Furthermore, banks should consider how to securely generate crypto keys, develop emergency plans for key loss or leakage, and focus on their cybersecurity environment as a key area of risk management. (3) Other Risk Management Considerations: Different types of crypto assets require different key management solutions, or there may be a lack of experience or capability on the part of banks to handle software or hardware requirements, and potential risks involved with different account models may vary. Therefore, while banking institutions adhere to standard custody risk management principles, they also need to adjust based on the specific custody services provided. (4) Legal and Compliance Risks: First, like other banking activities, crypto asset custody activities must comply with the Bank Secrecy Act (BSA), Anti-Money Laundering (AML), Counter-Terrorism Financing (CFT), and the Office of Foreign Assets Control (OFAC) requirements. Second, changes in the regulatory environment for crypto assets may also bring higher compliance risks, and banking institutions should ensure that relevant activities comply with all applicable laws and regulations. Finally, customers may misunderstand the role of banking institutions in custody arrangements, leading to risks. This requires banks to provide customers with clear, accurate, and timely information about their custody activities to mitigate such risks. At the same time, banks should also adhere to applicable record-keeping and reporting requirements. (5) Third-Party Risk Management: "Third-party risk" refers to the risks arising from sub-custodians or other service providers (such as technology providers, cash management agencies) that banks collaborate with. Banks are responsible for the activities conducted by their sub-custodians according to the terms and conditions; therefore, banks should perform adequate due diligence, including assessing the sub-custodian's key management solutions, their adherence to custody risk management principles, how they handle customer assets in the event of bankruptcy or operational failure, and the adequacy of their risk management and record-keeping. For other service providers, banks should weigh the risks of purchasing third-party software or hardware, as well as the risks of maintaining such software or hardware as a service. (6) Audit Requirements: Audit procedures are essential for effective risk management and internal controls. Therefore, a bank's audit procedures should appropriately cover crypto asset custody services (including third-party risk management), focusing on risks unique to crypto asset custody, such as key generation, storage, and deletion, the transfer and settlement of crypto assets, the adequacy of relevant information technology systems, and assessing employees' capabilities in identifying and controlling crypto asset risks. If a bank lacks auditing expertise, it should engage appropriate independent third parties for auditing. 2. Policy Background: Trump Pushes for Crypto Regulatory Reform Since Trump's second term began, the U.S. government's attitude toward crypto assets has undergone a significant shift, and this joint statement was issued against this backdrop. In recent months, multiple banking regulatory agencies in the U.S. have taken a series of actions to withdraw various interpretive letters and regulatory statements regarding crypto assets from the Biden era. One significant move was the removal of the "reputational risk" assessment from the regulatory process, replacing it with more specific categories of financial risk. This effectively avoided situations where regulatory agencies pressured banks not to provide services to crypto asset companies, helping to alleviate banks' real concerns about providing services to controversial industries such as crypto assets. Another significant move was the cancellation of the prior notification requirement for participating in crypto asset-related activities. Under previous policies, banks were required to obtain written "no objection letters" from regulatory agencies before engaging in crypto asset-related activities. Now, banks' crypto activities no longer need to follow this procedure but are monitored through regular regulatory processes. Furthermore, various banking regulatory agencies have restored previously conflicting regulatory policies with the Biden administration's regulatory philosophy. For example, the OCC has again allowed its regulated entities to buy and sell custody crypto assets based on customer instructions and permitted them to outsource custody and execution services to third parties, provided that those third parties can manage the risks adequately. Since Trump took office, he has reversed the previous U.S. government's guidance urging banks to exercise caution in the crypto space, implementing comprehensive crypto asset regulatory reforms. This is a fulfillment of his political commitment and an important step in establishing the U.S. as the world "crypto capital" and stimulating innovation and growth in the U.S. economy. The joint statement released constitutes a part of the U.S. crypto asset regulatory reform, marking the U.S. government's shift away from enforcement-focused regulatory policies to release market vitality, and starting to guide banks and other entities to comply with, secure, and robustly participate in crypto asset activities through refined regulatory rules and enhanced business guidance, supporting the innovative development of the crypto industry. In the future, more crypto-friendly statements may be released. 3. Significance and Outlook: The Regulatory Future of Bank Crypto Custody Overall, the statement discusses how existing laws, regulations, and risk management principles apply to crypto asset custody, aiming to provide guidance for banks that provide or consider providing crypto asset custody services, reflecting a more relaxed regulatory environment while still emphasizing that banking institutions should strictly control risks in crypto asset custody activities and adhere to core principles of safety, soundness, and consumer protection, reflecting the regulatory bottom line of U.S. banking regulatory agencies in the crypto industry. For banking institutions engaged in or considering engaging in crypto asset custody business, on one hand, the statement provides entry opportunities in the crypto asset custody field for those with adequate risk control capabilities and improved governance structures, bringing new opportunities. On the other hand, the statement also provides specific references for risk control matters for banks already engaged in crypto asset custody business, with regulatory bodies still focusing on reviewing compliance and safety across various aspects, including operations, legal, and financial. According to the statement, banking institutions may need to make certain adjustments to product rules and internal policies and procedures to reflect the unique risks and compliance obligations of crypto asset custody, such as improving cybersecurity protocols and key management systems and conducting regular security testing. It is important to note that while the statement provides a certain level of clarity, under the backdrop of the government's crypto regulatory reforms, there remains uncertainty in the regulatory and legal environment at the federal and state levels. Simply meeting the various elements of the statement may not fully comply with regulatory requirements. Banks and regulatory agencies at all levels should maintain ongoing communication and keep compliant records to prepare for stringent regulatory scrutiny. From a longer-term perspective, the refinement of U.S. regulatory rules on crypto custody may attract more crypto asset companies to return or enter the United States and promote innovation and development in the U.S. blockchain industry. As traditional financial institutions deepen their involvement in the crypto asset industry, related services such as crypto asset custody will be integrated into existing regulatory frameworks, and financial activities surrounding crypto assets will flourish in a more secure and regulated environment.