Joint Statement by Top US Regulators: Banks Can Custody Bitcoin and Crypto-Assets
On July 2, 2026, the Federal Reserve, the Office of the Comptroller of the Currency (OCC), and the Federal Deposit Insurance Corporation (FDIC) jointly issued a statement clarifying that banks may provide safekeeping services for crypto-assets, including Bitcoin, as long as they follow existing laws and maintain strong risk controls. The statement does not introduce new rules but reminds banks of their obligations when handling Bitcoin and other crypto-assets on behalf of customers.
The document states: “Banking organizations may provide safekeeping for crypto-assets in a fiduciary or a nonfiduciary capacity. Banking organizations that provide crypto-asset safekeeping in a fiduciary capacity must comply with 12 CFR 9 or 150, as applicable, state laws and regulations, and any other applicable legal provisions, such as the instrument that created the fiduciary relationship.”
Technical and Compliance Requirements for Crypto Custody
The agencies emphasize that safekeeping Bitcoin and other crypto-assets, primarily through control of customers’ cryptographic keys, requires strong cybersecurity, operational expertise, and full legal compliance. Banks offering these services must be prepared to protect against risks such as key loss, cyberattacks, and unauthorized asset transfers.
They also note that crypto-asset safekeeping may demand specialized staff, secure infrastructure, and constant monitoring of evolving technologies. Regulatory requirements like anti-money laundering (AML), countering the financing of terrorism (CFT), and OFAC sanctions still apply. “Like all other banking activities, crypto-asset safekeeping relationships are subject to applicable Bank Secrecy Act/anti-money laundering (BSA/AML), countering the financing of terrorism (CFT), and Office of Foreign Assets Control (OFAC) requirements,” the document states.
Risk Assessment and Due Diligence on Sub-Custodians
The statement also warns that banking organizations should conduct a full risk assessment before engaging in Bitcoin and other crypto-asset safekeeping. This includes evaluating the nature of different crypto-assets, the technology used, and the legal obligations involved. “Subject to the terms and conditions in the customer agreement, a banking organization is responsible for the activities performed by the sub-custodian… Conducting due diligence before selection of a sub-custodian is an important part of sound risk management, and includes evaluating the effectiveness of the sub-custodian’s cryptographic key-management solution, including policies, processes, and internal controls, as well as its adherence to standard safekeeping risk management practices,” the document states.