On July 23, 2020, the Office of the Comptroller of the Currency (OCC) released Interpretive Letter #1170 (Letter) confirming that safekeeping and custody of cryptocurrency and crypto-assets (collectively, cryptocurrency) are traditional banking services and, therefore, are permissible activities for national banks and federal savings associations. The Letter also provides the usual admonition that banks may provide permissible services as long as they manage the risks and comply with applicable law, which, for cryptocurrency-related services, involves additional technological and practical challenges.
Banks have long provided safekeeping and custody services for their customers, and, over time, these services evolved along with the business of banking to now include safekeeping and custody of various physical and electronic assets. There is a well-established body of laws, regulations, and guidance supporting banks acting in both fiduciary and nonfiduciary capacities when performing such safekeeping and custody activities. The Letter recognizes this evolution, and states that safekeeping and custody of cryptocurrency is a logical outgrowth of national banks’ existing authority.
Key Takeaways
Custody services for cryptocurrency generally involve holding the unique cryptographic keys used to access units of cryptocurrency in “hot” or “cold” wallets and providing related services, including facilitating the customer’s cryptocurrency and fiat currency exchange transactions, transaction settlement, trade execution, record keeping, valuation, tax services, and reporting. While there is a well-developed body of law for custody services, the OCC found that the uniqueness of cryptocurrency-related services requires banks to pay particular attention to certain practices.
Key takeaways from the Letter for a bank engaging in custody and safekeeping services for cryptocurrency include the following:
- As with any new activity, cryptocurrency-related services must align with the bank’s overall business plan and strategy, and the bank must develop and implement a cryptocurrency custody services program consistent with sound risk management practices.
- The bank must understand the various cryptocurrencies and their differences, which may require different risk management procedures and may be subject to different laws, regulations, and guidance (some of which may be beyond those applicable to OCC-chartered institutions). Therefore, a thorough legal analysis is necessary to ensure the activity is conducted in a manner that is consistent with all applicable laws and regulations.
- Custody agreements are an important risk management tool, and they should clearly establish the bank’s duties and responsibilities and address any unique handling, treatment, and servicing issues related specifically to cryptocurrency.
- Risks associated with an individual account should be addressed prior to the bank’s acceptance of the cryptocurrency (or of the cryptographic keys), including understanding the customer’s needs and wants, along with the operational requirements of the account.
- The activity must be conducted in a safe and sound manner, including having adequate systems that are tailored to the applicable cryptocurrencies to identify, measure, monitor, and control the unique risks of the custody services.
- The bank must maintain effective internal controls that are tailored to the applicable cryptocurrencies, including systems for safeguarding assets, controlling access, producing reliable financial reports, conducting specialized audits, and complying with laws and regulations.
The OCC Takes a Long Position
The OCC recognizes in the Letter that “as financial markets become increasingly technological, there will likely be increasing need for banks and other service providers to leverage new technology and innovative ways to provide traditional services on behalf of customers.” This drive is what will enable banks to continue to fulfill the financial intermediation function they have historically played by providing payment, loan, and deposit services.
Just as sending electronic funds transfers is a modern form of paying checks, taking custody of cryptocurrency is a modern form of taking deposits of gold and other physical assets. This is common sense, and many have already assumed it to be the case. However, from an industry perspective, the Letter provides more evidence that the OCC is positioning national banks as the best charter for fintech activities and all bank–fintech partnerships. The Letter comes on the heels of the OCC’s final rule codifying the “valid when made” doctrine and proposed rule addressing the “true lender” issue, both of which will further help national banks and federal savings associations build their partnership portfolios.
Banks and fintech companies that are developing cryptocurrency-related product offerings, seeking to establish bank–fintech partnerships, or considering the relative merits of the various bank charter options should contact the authors.