The US Office of the Comptroller of the Currency (OCC) issued an interpretive letter on July 22 allowing national banks and federal savings associations (FSAs) to provide cryptocurrency custody services to their customers in their existing custody businesses. Before doing so, national banks and FSAs should implement appropriate risk management systems related to cryptocurrency custody, consider whether other laws or regulations apply to such custody services, and inform their OCC supervisors prior to engaging in cryptocurrency custody services.

Custody Services Should Evolve Consistent with Fintech Developments

The interpretive letter notes a growing market demand for “safe places, including banks” to hold unique cryptographic keys associated with cryptocurrencies and to provide related custody services, based on several factors including:

• The underlying keys to a unit of cryptocurrency are essentially irreplaceable if lost and, as a result, owners may lose access to their cryptocurrency and significant value if they misplace their keys.
• Banks may offer more secure storage services than existing options.
• Investment advisers may wish to manage cryptocurrency on behalf of customers, using national banks as custodians for managed assets.

The OCC confirms in the letter that the provision of custody services for crypto assets is consistent with the longstanding authority of national banks to provide safekeeping and custody services for physical assets. For example, the OCC has already permitted national banks to escrow encryption keys used for digital certificates because such escrow service is functionally equivalent to physical safekeeping.

TAILORED RISK MANAGEMENT SYSTEMS FOR CRYPTOCURRENCY CUSTODY

To provide cryptocurrency custody services in a safe and sound manner, national banks and FSAs must establish and maintain adequate systems to identify, measure, monitor, and control the risks of their custody services. A bank should have policies, procedures, internal controls, and information systems that govern its custody services and that encompass the following areas highlighted by the OCC:

• Safeguarding assets under custody
• Effective information security systems that mitigate against hacking, theft, and fraud
• Producing reliable financial reports
• Complying with laws and regulations, including anti-money laundering rules
• Maintaining dual controls, segregation of duties, and accounting controls for custody activities
• Having accounting records and internal controls to ensure that assets of each custody account are kept separate from the assets of the custodian and maintained under joint control to prevent an asset from becoming lost, destroyed, or misappropriated by internal or external parties
• Procedures for verifying that a bank maintains access controls for a cryptographic key (which will differ from the procedures applicable to physical assets)
• Risk management procedures that are tailored to the cryptocurrency, depending on the technical characteristics of the cryptocurrency

While these areas of focus are generally consistent with the requirements for providing custody services more generally, the OCC’s interpretive letter emphasizes that risk management systems, policies and procedures, internal controls, and management information systems may need to be tailored to address the unique attributes and risks of digital custody. The OCC advises national banks to consult with OCC supervisors prior to engaging in cryptocurrency custody activities.

WHAT’S NEXT

While the OCC’s confirmation of the legal authority of national banks and FSAs to provide custody services in respect of crypto assets is helpful, it is also in our view rather unsurprising in light of prior OCC precedent. We expect that risk management and supervisory considerations associated with the provision of custody services for crypto assets will likely prove to be far more significant issues for most market participants. Therefore, now that the OCC has formally “blessed” cryptocurrency custody from a legal authority perspective, the question remains whether traditional banks will begin offering these services to a greater extent, or whether they will be reluctant to do so in light of the potentially significant risks involved with custodying cryptocurrency.

[View source.]