The Office of the Comptroller of the Currency (“OCC”) recently signaled its approval for banks to fully wade into the cryptocurrency custodian space. On in a July 22, 2020 interpretive letter, the OCC concluded that a national bank may provide cryptocurrency custody services on behalf of its customers, including by holding the unique cryptographic keys associated with cryptocurrency, so long as the institution is able to effectively manage the risks and complies with applicable law.
In the letter, the OCC recognized a growing demand for banks to hold unique cryptographic keys associated with cryptocurrencies on behalf of customers and to provide related custody services. The demand is driven by the need for secure custody of cryptographic keys, which are irreplaceable and loss of the key is essentially loss of the cryptocurrency assets themselves. Existing cryptocurrency exchanges that currently offer custodial services have proven vulnerable to hacking and theft. The OCC also recognized a benefit to permitting investment advisers that manage cryptocurrencies on behalf of their clients to use national banks as custodians for the managed assets.
The OCC highlighted several key differences between providing custody for cryptocurrencies as opposed to other assets. First, because digital currencies exist only on the blockchain or distributed ledger on which they are stored, there is no physical possession of the asset; rather, ownership of a particular unit of digital currency is transferred from party to party by the use of unique cryptographic keys. As such, a bank holding digital currencies on behalf of a customer would take possession of the cryptographic asset keys and maintain them in a wallet that shields the key from discovery by a third party. Second, bank custody of digital assets also implicates the distinction between non-fiduciary and fiduciary custodians. Non-fiduciary custodians, including many existing cryptocurrency exchanges, simply provide safekeeping services that allow for control and transfer of the asset. In contrast, a bank holding assets in a fiduciary capacity (e.g., as a trustee, an executor or administrator of an estate, a receiver, or an investment advisor) is subject to heightened standards of care.
A bank engaging in new activities, such as custody of cryptocurrency assets, should develop and implement those activities through the lens of a comprehensive risk assessment. A number of factors make cryptocurrency custodial services a high risk activity, including cryptocurrency’s particular susceptibility to cyberattack, its attractiveness to money launderers, and its unique, nonfungible value. In addition, Banks will need to establish specialized audit procedures to ensure the effectiveness of their controls for digital custody activities and compliance with all applicable laws. Finally, would-be digital custodians will have to strictly assess the risks associated with each individual cryptocurrency account, before opening. The custodian will have to demonstrate its capacity to meeting all required initial and ongoing diligence obligations associated with such accounts, including the Bank Secrecy Act, 31 U.S.C. § 5311, et seq., and anti-money laundering considerations, information security, and the banking institutions own knowledge of the different cryptocurrencies and their individual characteristics.