Crypto-Asset Safekeeping by Banking Organizations: Regulatory Guidance and Risk Assessments

As digital assets become increasingly integrated into the financial sector, banking organizations are under growing pressure to provide secure, compliant safekeeping solutions for crypto-assets. The Office of the Comptroller of the Currency (OCC), Federal Reserve Board, and Federal Deposit Insurance Corporation (FDIC) have issued a joint statement clarifying how existing laws, regulations, and risk management principles apply to crypto-asset safekeeping. This article provides a detailed overview of the regulatory landscape, risk management expectations, and practical considerations for cybersecurity and IT professionals at financial institutions.

NETBankAudit experts have over 25 years of experience in cybersecurity and risk management audits. We offer Crypto-Asset Safekeeping Risk Assessments designed to help your organization not just adapt, but lead with confidence in this new frontier. If you have any questions after reading this guide, please reach out to our team.

Defining Crypto-Asset Safekeeping: Scope and Regulatory Context

‍

What Constitutes Crypto-Asset Safekeeping?

Crypto-asset safekeeping is the service of holding digital assets on behalf of customers. This is distinct from broader custody services, which may include a range of activities such as settlement, reporting, and asset servicing. Safekeeping can be provided in either a fiduciary or non-fiduciary capacity, each with its own regulatory requirements and risk profiles.¹

Regulatory Applicability and Oversight

Banking organizations subject to OCC, Federal Reserve, and FDIC oversight must comply with federal and state laws, including 12 CFR 9 or 150 for fiduciary activities. The agencies’ statement does not introduce new supervisory expectations but clarifies how existing frameworks apply to crypto-asset safekeeping. Fiduciary safekeeping requires adherence to heightened standards and compliance with specific regulations and state laws, while non-fiduciary safekeeping is governed by client contracts and must still meet baseline regulatory and risk management standards.¹

• Fiduciary safekeeping involves acting as a trustee, executor, administrator, or investment advisor, with authority to manage assets as permitted by law and the governing instrument.
• Non-fiduciary safekeeping is established by client contract and must be consistent with the institution’s control environment and risk management practices.

Risk Management Fundamentals for Crypto-Asset Safekeeping

Risk Assessment and Governance

Before offering crypto-asset safekeeping, banking organizations must conduct a thorough risk assessment. This assessment should consider the institution’s core financial risks, the complexity of the asset class, the strength of the control environment, and contingency planning for unexpected challenges. The evolving nature of the crypto-asset market and underlying technologies requires a dynamic risk governance framework that adapts to new threats and opportunities.

• Boards, officers, and employees must possess sufficient knowledge and understanding of crypto-asset safekeeping to establish operational capacity and appropriate controls.
• Significant resources may be needed to develop or procure new technology, establish a robust control environment, and ensure staff have appropriate technical expertise.
• Price volatility and rapid technological evolution can impact both the demand for safekeeping services and the value of assets held.

Cryptographic Key Management: The Core Security Challenge

The primary risk in crypto-asset safekeeping is the compromise or loss of cryptographic keys, which could result in asset loss or unauthorized transfers. Effective key management is essential to maintaining control and meeting the standard of care required by law. Control is established when the institution can demonstrate that no other party, including the customer, has access to information sufficient to unilaterally transfer the asset.

Key Management Best Practices

• Initial control typically requires transferring the asset to the institution’s address on the distributed ledger, not just taking possession of existing keys.
• Key management systems must be regularly evaluated and updated to address technological developments and emerging threats.
• Contingency planning for lost or compromised keys is critical, as is the secure generation and storage of keys and backup materials.
• Wallets used for key storage exist on a spectrum from “cold” (offline) to “hot” (online), with varying security implications. Not all wallets are compatible with all crypto-assets.

Cybersecurity Environment: A Critical Focus

Given the virtual nature of crypto-assets, the cybersecurity environment is a key focus of risk management. Institutions must ensure that their cybersecurity controls are robust and aligned with industry standards such as the NIST Cybersecurity Framework. The OCC’s Cybersecurity Supervision Work Program provides additional considerations for aligning with supervisory guidance.

Additional Risk Management Considerations

Asset Selection and Technical Due Diligence

Not all crypto-assets are created equal. Different assets may require different key management solutions and may present unique technical, operational, and legal risks. Institutions should perform a detailed analysis of each asset before accepting it for safekeeping, including identifying vulnerabilities and dependencies that could impact safety and soundness.

• Analyze technical, operational, strategic, market, legal, and compliance considerations for each asset and its underlying ledger.
• Stay informed about material developments related to supported assets and their ledgers.
• Perform a comprehensive analysis of each crypto-asset before safekeeping, including identifying vulnerabilities and dependencies that could create material risks.

Control Environment and Account Models

Maintaining an effective control environment is essential. This includes regular independent assurance by individuals with the necessary expertise. The choice between omnibus and separate account models also introduces different risk profiles. Omnibus accounts may offer efficiency but can create larger targets for theft, while separate account models require managing more key pairs but may enhance security and segregation of assets.

• Standard custodial risk management principles apply to the storage of cryptographic keys and sensitive information, but may need to be tailored to the specific services provided.
• Carefully consider the potential risks associated with different types of account models for safekeeping crypto-assets.

Legal and Compliance Risk: Navigating the Regulatory Landscape

BSA/AML, CFT, and OFAC Compliance

Crypto-asset safekeeping is subject to Bank Secrecy Act (BSA), anti-money laundering (AML), countering the financing of terrorism (CFT), and Office of Foreign Assets Control (OFAC) requirements. These laws require customer identity verification, due diligence, ongoing monitoring, and transaction blocking in accordance with sanctions. Distributed ledger technology may complicate compliance, especially when identifying information is not readily available.

Compliance Challenges and Best Practices

• Involve the BSA officer, board, and senior management in assessing money laundering and illicit finance risks before offering services.
• Draft clear customer agreements outlining duties, responsibilities, and specifics such as on-chain governance, forks, airdrops, and storage methods.
• Provide transparent, accurate, and timely information to customers about the institution’s role and responsibilities.
• Follow all applicable recordkeeping and reporting requirements, including those related to the “Travel Rule” and evolving tax laws that may affect customer obligations.

Customer Communication and Disclosure

Crypto-asset safekeeping activities present a risk that the customer could be misinformed of the banking organization’s role in the arrangement. Banking organizations may be able to mitigate this risk by providing clear, accurate, and timely information to customers about their crypto-asset safekeeping activities, including the banking organization’s role in any governance or other voting matter related to the crypto-asset.

Third-Party Risk Management: Sub-Custodians and Technology Providers

Engaging Sub-Custodians

Some institutions may contract with third-party sub-custodians or technology providers to deliver safekeeping services. The banking organization remains responsible for the activities performed by these third parties and must ensure robust risk management practices are in place. Conduct thorough due diligence on sub-custodians, evaluating their key management solutions, internal controls, and adherence to standard practices.

• Analyze the treatment of customer assets in the event of sub-custodian insolvency or operational disruption.
• Ensure contracts specify notification requirements for material events, such as key compromise or transaction errors.
• Segregate customer assets from those of the sub-custodian to avoid commingling and potential loss in bankruptcy scenarios.
• Evaluate the appropriateness of the sub-custodian’s risk management and recordkeeping practices.

Third-Party Technology Risk

Even when providing safekeeping directly, institutions may rely on third-party software or hardware. Effective risk management includes weighing the risks of purchasing versus maintaining technology as a service and ensuring ongoing oversight. Evaluate the effectiveness of third-party technology solutions and ensure they align with the institution’s control environment and risk management objectives.

NETBankAudit’s Crypto-Asset Safekeeping Risk Assessment: Your Strategic Advantage

Why a Specialized Risk Assessment is Crucial Now

Providing crypto-asset safekeeping services opens up new opportunities, but also exposes your institution to significant risks. Without a clear understanding of these risks, your organization could face financial losses, legal trouble, reputation damage, and operational headaches. NETBankAudit’s Crypto-Asset Safekeeping Risk Assessment is designed to help you identify and address these risks before they become costly problems.

• Financial Losses: Due to theft, technical failures, or losing control of digital keys.
• Legal Trouble: Not following the latest laws and rules for digital money.
• Reputation Damage: If customer assets are lost or systems are breached.
• Operational Headaches: Struggling with new technologies and complex processes.

Our Unique Approach: What We Cover

NETBankAudit’s assessment examines every angle of crypto-asset safekeeping, providing a clear picture of your organization's strengths and weaknesses:

• Strategic & Business Risks: Do you fully understand the digital asset landscape? Do you have the right people and tools? Are you ready for fast changes in prices and technology?
• Operational Risks: How safe are your cryptographic keys? Are your systems and controls robust? Is your cybersecurity ready for digital threats?
• Compliance & Legal Risks: Are you following all laws to prevent misuse of digital assets? Are your customer agreements and records strong?
• Third-Party Risks: Are your sub-custodians and technology partners safe and reliable? Do you check them carefully?
• Audit & Oversight Risks: Do you have strong ways to check your own digital asset safekeeping? Do your auditors know enough about digital money?

Benefits for Your Executive Team

Our Crypto-Asset Safekeeping Risk Assessment empowers your leadership by:

• Clarity: Providing a simple, clear understanding of complex risks.
• Confidence: Helping you make informed decisions about offering digital asset services.
• Protection: Identifying weaknesses before they are exploited.
• Compliance: Ensuring you meet regulatory expectations and build a strong, compliant program.
• Competitive Edge: Positioning your organization as a secure and reliable partner in the digital economy.

Why NETBankAudit is the Trusted Partner for Crypto-Asset Safekeeping Audits

As regulatory expectations and technological complexities continue to evolve, financial institutions need a trusted partner to navigate the challenges of cybersecurity, including crypto-asset safekeeping. NETBankAudit offers specialized audit and compliance services tailored to the unique needs of banking organizations engaging in digital asset safekeeping. Our team brings over 25 years of experience in IT, cybersecurity, and regulatory compliance, ensuring your institution meets all applicable requirements while maintaining a strong control environment.

Contact NETBankAudit today to learn how our audit and risk assessment services can help your institution manage risk, enhance compliance, and build trust with your customers.

References

Board of Governors of the Federal Reserve System, Federal Deposit Insurance Corporation, & Office of the Comptroller of the Currency. (2023). Interagency statement on crypto-asset safekeeping by banking organizations. https://www.fdic.gov/interagency-statement-crypto-asset-safekeeping.pdf