Banks Offering Crypto Trading: The Security Architecture

By Owen Thurm Published November 6, 2026 6 min read

Quick answer. Five layers: custody, a signing service with a policy engine above the keys, controlled venue access, AML and sanctions surveillance, and real-time reconciliation to the core ledger. Using a sub-custodian does not move the bank's responsibility.

Watch: Banks Offering Crypto Trading: The Security Architecture 1:31

Video transcript

National banks now have room to offer crypto trading. The permission is the easy part. Every layer underneath it needs controls before the first trade.

The architecture has five layers. Custody, a signing service with a policy engine, controlled venue access, sanctions surveillance, and real-time reconciliation to the core ledger.

Partnering does not shift the risk. Under the agencies' 2025 statement, the bank is responsible for what its sub-custodian does.

A key store does not judge transactions. It signs whatever an authorized caller submits. So approval belongs above it, in a policy engine that checks allowlists, limits and request IDs.

At the venues, scope API keys to trading, cap balances left on exchanges, credit clients only at finality, and keep a tested kill switch.

Then three ledgers must agree. Korea's FSC will require exchanges to reconcile every five minutes. In our view, that is a useful bar for a bank too.

Guardian's Digital Asset Assurance Pilot maps to that build, from architecture assessment at design to offchain pentests before launch and as you scale.

Guardian is aligned with NIST CSF 2.0 and CCSS, and its SOC 2 Type II audit is underway.

Read the full article, then talk to Guardian about pressure testing your trading stack before launch.

National banks now have explicit room to offer crypto trading. In May 2025, the OCC confirmed they may buy and sell custodied crypto at a customer's direction. They may outsource custody and execution, subject to third-party risk management.

In December 2025, it confirmed national banks may act as riskless principal in crypto trades. PNC launched bitcoin trading for eligible Private Bank clients on December 9, 2025.

The permission is the easy part. Every layer underneath it, from keys to reconciliation, needs controls before the first trade.

Where this article discusses regulation, it covers the technical and security side only. It is not legal advice; confirm how the rules apply to you with counsel.

Build, Partner or White-Label

The first decision is who runs the stack. Two banks show the range:

Partner: PNC's service runs on Coinbase's Crypto-as-a-Service infrastructure, which PNC says offers trading, custody and financing.
Own custody: BBVA said in March 2025 it would use "its own cryptographic key custody platform" in Spain.

The Federal Reserve, FDIC and OCC's July 2025 statement notes sub-custodians may work through "API-based integrations or by white labeling their underlying platform."

Outsourcing does not move accountability. Subject to the customer agreement, the bank "is responsible for the activities performed by the sub-custodian."

What the statement says to cover with a sub-custodian:

Diligence first: its key management policies, processes and internal controls.
No commingling: mixed assets could be treated as its property in bankruptcy.
Notice: of key compromise, any use of backup information, and irreversible transaction errors.

For the wider control map, see digital asset security for banks.

Custody and Key Decisions

Custody is control of keys. A bank generally has control when no other party, "including the customer," could move the asset unilaterally.

The same standard applies to any sub-custodian. And the statement calls key compromise or loss "one of the primary risks" of safekeeping.

The decisions to make and write down (our list; the quotes are the statement's):

Wallet tiers: how much sits hot. The statement notes more accessible wallets "may be less secure."
Account model: omnibus wallets are efficient but "could also create larger targets for theft."
Key generation: a bank may decide keys from widely available wallets fail its control environment.
Key storage: HSM, cloud KMS or MPC, with the quorum written down.
Recovery: contingency plans for lost or compromised keys, tested on a schedule.

Signing and Policy Engine

Next, approval. A key store does not judge transactions. AWS KMS, for example, signs the message or digest it is given, for any caller with kms:Sign permission.

Our recommendation: put approval above the key store, in a policy engine. It decodes every transaction and checks it before calling sign:

The destination is on an allowlist, with a delay on changes.
Value and velocity limits per wallet and per client.
A matching ID from the order or withdrawal system.
Separate approvers for large or unusual transfers.
Policy changes held to the same quorum as large payouts.

The statement lists dual control and separation of duties among the controls to look for at a sub-custodian. Hold your own signing path to the same bar.

Our HSM vs KMS guide covers where the key should live and why approval belongs above it.

Market Access and Settlement

Riskless principal is the model the OCC confirmed in December 2025. The bank buys only against an offsetting customer order, and holds no inventory except in rare cases.

The OCC calls counterparty credit risk, "in particular, settlement risk," the main risk. After a settlement default, a bank would typically have procedures to sell the asset as soon as possible.

For security, the venue connections are the exposure. Guardian's checklist:

Venue API keys scoped to trading, with withdrawals off or allowlisted.
Balances left at venues capped, and swept back on a schedule.
Client positions credited only at each chain's finality.
A tested kill switch for each venue.

The OCC adds that smart contracts may reduce settlement risk, such as a trade that executes only if its offsetting trade does.

Surveillance and Reconciliation

Crypto safekeeping is subject to BSA/AML, CFT and OFAC requirements like any other banking activity, the statement says. That includes the Travel Rule.

It warns that distributed ledgers can make compliance harder where it depends on identifying information, such as names and addresses.

Our recommended surveillance layer:

Screening of deposit sources and withdrawal destinations before funds move.
Travel Rule data exchange with other providers.
Monitoring that joins onchain flows to customer records.
Trade surveillance across orders, executions and venues.

Three ledgers must agree

The core banking ledger, the custody books and the chains themselves must match. We recommend building the core banking integration so every posting has an onchain match.

Korea's FSC said in April 2026 that exchanges will be required to reconcile ledger and wallet balances "on a real-time basis (every five minutes)." Large mismatches are to trigger an automated kill switch.

In our view, that is a useful bar for a bank too. Alert on any onchain outflow with no matching order or withdrawal ID.

Our hot wallet monitoring guide lists the rules to start with.

Standards Alignment

The agencies' statement cites OCC cybersecurity guidance aligned with the NIST Cybersecurity Framework. CSF 2.0 organizes outcomes into six functions: Govern, Identify, Protect, Detect, Respond and Recover.

The CSF "does not prescribe how outcomes should be achieved." The crypto evidence, from key ceremonies to policy rules, has to come from you.

The statement says a safekeeping audit should assess key generation, storage and deletion, and transfer and settlement controls.

Where that expertise is missing in-house, management should engage external resources "with sufficient independence."

A Pilot Roadmap

Guardian's Digital Asset Assurance Pilot is built for vendor approval and scoped to the modules you choose. It maps to the build:

Stage	Pilot modules
Design	Architecture assessment; standards alignment
Build	Assurance engineering
Pre-launch	Smart contract audit; offchain pentests
Live and scaling	Standards alignment; offchain pentests

The architecture assessment covers custody and key ceremony: where the keys live, who holds what share, and what a quorum actually requires in practice.

Standards alignment maps CCSS levels, ISO 27001 and NIST CSF onto the actual key ceremony and change control. The offchain pentests target the consoles, APIs and signing services that can reach your keys.

Guardian's own standing, as the pilot page states it:

NIST CSF 2.0: aligned, with internal controls mapped to the framework.
CCSS: aligned, with Guardian's own key management held to the same bar it assesses yours against.
SOC 2 Type II: auditor engaged, audit underway.

More on Guardian's institutional practice.

Frequently Asked Questions

Can US banks offer crypto trading?

National banks can, per the OCC. Interpretive Letter 1184 (May 2025) says banks may buy and sell custodied crypto at the customer's direction and outsource custody and execution. Letter 1188 (December 2025) permits riskless principal crypto trades.

Should a bank hold crypto keys itself or use a sub-custodian?

Either can work. The agencies apply the same control standard to both, and the bank stays responsible for a sub-custodian's activities. Choose on key management quality, insolvency treatment and the controls you can evidence.

What is a policy engine in crypto custody?

The service that approves transactions before keys sign them. It decodes each transaction, checks destinations, limits and request IDs, and collects approvals. A key store signs what an authorized caller submits, so transfer control has to live above it.

What should a bank crypto custody audit cover?

The US agencies' 2025 statement says a crypto safekeeping audit should assess key generation, storage and deletion, controls over transfer and settlement of customer assets, and the sufficiency of relevant IT systems.

Sources

Pressure test your trading stack before launch

Guardian assesses the custody, signing and offchain systems behind a bank crypto trading service, starting with the pilot modules your roadmap needs.

Talk to Guardian Explore the assurance pilot