OCC Concludes That National Banks May Provide Cryptocurrency Custody Services
The OCC sees holding the cryptographic access keys to control and transfer cryptocurrency as an "electronic corollary" of banking's traditional safekeeping methods.
On July 22, 2020, the Office of the Comptroller of the Currency ("OCC") concluded in Interpretive Letter #1170 that national banks may provide cryptocurrency custody services to customers in both a fiduciary and non-fiduciary role. The OCC Interpretive Letter explains that providing custody services for cryptocurrency falls within the longstanding, traditional authorities of a national bank to engage in safekeeping and custody activities, including through electronic means.
Prior to the OCC Interpretive Letter, as banks entered the internet-era, the OCC permitted them to hold electronic assets, including encryption keys through secure web-based storage. See OCC Conditional Approval 267 (Jan. 12, 1998) and OCC Conditional Approval 479 (July 27, 2001). The OCC has historically viewed these activities as "an electronic expression of traditional safekeeping services by banks" and an extension of a national bank's electronic banking authority under OCC rules. Id.
The OCC sees holding the cryptographic access keys that allow one to control and transfer cryptocurrency as an "electronic corollary of these traditional safekeeping activities." In short, cryptocurrency custody services are viewed as a natural outgrowth of the safekeeping services, such as safe deposit boxes, that banks have long been authorized to provide. See Colorado Nat. Bank of Denver v. Bedford, 310 U.S. 41, 50 (1940).
The OCC indicates that it will support differing cryptocurrency custody methods, including the storage of either cryptographic access keys or cryptocurrencies transferred to the bank by the customer.
Before offering cryptocurrency custody services, a bank should have appropriately tailored policies, procedures, internal controls, and information security systems. A bank must ensure that it provides cryptocurrency custody services in a manner that controls risks and comports with pertinent rules and the terms of the Comptroller's Handbook on Custody Services. Banks should employ specific risk management procedures to address the unique characteristics of particular cryptocurrencies. For example, OCC regulations on record keeping and confirmation requirements may apply to cryptocurrencies that are considered "securities" for purposes of the Federal securities laws. The OCC will review crypto-custody services as part of the normal supervisory process. Accordingly, the OCC recommends any bank that is considering cryptocurrency custody services to consult with the OCC before providing the services.
