Crypto-as-a-Service for Banks: Build or Buy?

By Owen Thurm Published November 6, 2026 6 min read

Quick answer. Buy when speed matters and a provider's licensed custody and trading fit your product; build when you need control and can staff key management. Either way, the bank stays responsible for overseeing the provider.

Watch: Crypto-as-a-Service for Banks: Build or Buy? 1:41

Video transcript

A bank can offer crypto through a provider or build its own stack. Either way, the bank stays responsible.

PNC now offers spot bitcoin to eligible private bank clients, running on Coinbase's crypto-as-a-service infrastructure. In 2025, the OCC confirmed banks may outsource crypto custody and execution.

But accountability does not move with the work. The agencies' July 2025 statement says the bank is responsible for its sub-custodian's activities, subject to the customer agreement.

The bank still owns asset selection, account takeover controls, scam warnings, API keys, customer disclosures and audit coverage of the whole activity.

Diligence covers the provider's key management, segregation and dual control, insolvency treatment of customer assets, and recordkeeping. Commingling is the red flag.

New York banks should still seek NYDFS approval, even for services a third party provides, and inform DFS at least 90 days before launch.

Buying hands keys, licenses and the asset list to one provider. Building gives control, but needs new technology, strong controls and expert staff.

Ask five questions: what the product is, who runs key management, whether you can test the provider, how you exit, and which approvals apply. Buy narrow and fast. Build when crypto is core.

Guardian reviews the custodians you would depend on and pentests the app, API and cloud around them. Read the full guide, or talk to Guardian.

On December 9, 2025, PNC launched spot bitcoin trading for eligible PNC Private Bank clients, inside its own online banking platform.

PNC says the service runs on Coinbase's Crypto-as-a-Service infrastructure, which provides trading and custody. The bank keeps the client; a provider runs the crypto.

US regulators made this easier in 2025. The OCC confirmed banks may outsource crypto custody and execution, and the FDIC and Fed dropped their prior-notice steps.

The responsibility did not move with the work. This guide covers the build or buy choice, and what stays with the bank either way.

Where this article discusses regulation, it covers the technical and security side only. It is not legal advice; confirm how the rules apply to you with counsel.

What Crypto-as-a-Service Covers

A crypto-as-a-service (CaaS) provider runs the crypto side: custody, trading and often staking or stablecoin payments. The bank offers it inside its own app.

US agencies note that such providers may serve banks "through various models, including API-based integrations or by white labeling their underlying platform."

Three examples, each described from its own pages. This is not a ranking or an endorsement.

Provider	What it says it offers	Status it states
BitGo	Trading, staking, transfers and wallets through APIs	BitGo Bank & Trust, N.A., a federally chartered national trust bank
Paxos	Trading and custody through a single integration	"Federally chartered by the OCC"; custody on a fiduciary basis
Zerohash	Embedded trading, custody, staking and stablecoin payments through APIs	NYDFS virtual currency license; FinCEN-registered money services business

BitGo lists banks, neobanks and credit unions among the clients for its CaaS, with trading "within your own UI."

These claims are the providers' own. Verify each one in diligence.

What Stays With the Bank

Outsourcing moves the work, not the accountability.

OCC Interpretive Letter 1184 (May 7, 2025) says a bank may use a sub-custodian "subject to appropriate third-party risk management practices." It must still run the activity "in a safe and sound manner."

The agencies' July 2025 safekeeping statement is direct. Subject to the customer agreement, the bank "is responsible for the activities performed by the sub-custodian."

That includes choosing which crypto-assets to support, even when the provider helps analyze them. So these stay with you:

Asset selection: which coins and chains you offer, and the review behind each.
Customer login, devices and account takeover controls in your app.
Scam warnings and withdrawal limits on your side of the integration.
API keys, webhooks and the bank systems that call the provider.
Customer disclosures and agreements, whoever drafts them.
Audit coverage of the whole activity, provider included.

On audit, the statement says a crypto safekeeping audit should cover key generation, storage and deletion, and transfer and settlement controls.

Without audit expertise in-house, management should engage outside resources "with sufficient independence."

For the app side, see our neobank crypto integration plan.

Vendor Risk and Examiners

The 2023 interagency guidance says a bank's use of third parties "does not diminish its responsibility" to operate safely and lawfully.

Its life cycle runs from planning, due diligence and selection to contract negotiation, ongoing monitoring and termination. Higher-risk activities get "more comprehensive and rigorous oversight."

For a crypto sub-custodian, the safekeeping statement says diligence includes:

Its key management: policies, processes and internal controls.
Segregation, dual control and separation of duties.
How customer assets would be treated if it became insolvent.
Its recordkeeping and contingency planning.

Commingling is the red flag. If a sub-custodian mixes its own assets with yours, they could be treated as its property in bankruptcy, the statement warns.

Contracts can require notice of key compromise, any use of backup material and transaction errors that cannot be reversed.

Then test what you are told. OCC Bulletin 2017-43 says management "should not overly rely on the service provider's assertions."

Our third-party risk playbook tiers crypto vendors by what they can move. Our OCC crypto guidance post covers the letters in full.

New York banks

NYDFS expects New York banking organizations to seek its approval before any new or significantly different virtual currency activity.

Its December 2022 letter covers digital wallet services "whether the services are in fact provided by the Covered Institution or by a third party."

The letter says to inform DFS at least 90 days before launch. Its checklist includes your vendor program under Part 500.11: see our NYDFS vendor guide.

Cost and Time

Compare provider quotes on scope: which assets, chains, services and support each one covers.

Building costs more than software. The agencies say safekeeping may need "significant resources and attention."

They name three: new technology, a strong control environment and staff with the right technical expertise.

Buying still takes time. PNC announced its Coinbase partnership in July 2025 and launched in December, starting with bitcoin for eligible private bank clients.

Factor	Crypto-as-a-service	Build in-house
Keys and signing	Provider	Bank, or a sub-custodian it picks
Licenses	Provider's own, plus your approvals	Your own
Assets and features	Provider's supported list	Your choice
Staff you need	Integration, vendor oversight, fraud	Key management, operations, audit
Concentration	One provider for custody and trading	Spread across vendors
Exit	Move assets and clients to a new provider	Replace components one at a time

A Decision Framework

Five questions settle most cases:

What is the product? Trading, custody, staking or payments. Narrow products suit a provider.
Can your people run key management? The agencies say the board, officers and employees should have "the requisite knowledge."
Can you test the provider? You need evidence on its keys and controls, not only reports.
Can you exit? Know who signs the transfer out, to which addresses, and how long it takes.
Which approvals apply? Federal steps are lighter since 2025; New York still expects prior approval.

Buy when the product is narrow, time matters and the provider passes diligence. Build when crypto is core to the bank and you can staff it.

There is a middle path. The statement describes banks that hold custody directly while using third-party technology.

How Guardian Helps

Guardian's institutional practice reviews the custodians and protocols a bank would depend on, "as concentrations of risk rather than as logos on a slide."

It also prepares committee-ready evidence, in the form a risk committee, a board or a regulator will read.

Guardian pentests the systems around the integration: the web app, the API and the cloud infrastructure.

The Digital Asset Assurance Pilot is a low-commitment start, "built for vendor approval." Its architecture module covers custody, key ceremony and every route value can take.

Frequently Asked Questions

What is crypto-as-a-service for banks?

A provider runs crypto custody, trading and sometimes staking or payments, and the bank offers it in its own app through APIs or a white label. The bank keeps the customer relationship and stays responsible for overseeing the provider.

Can a US national bank outsource crypto custody and trading?

Yes. OCC Interpretive Letter 1184 (May 7, 2025) says banks may buy and sell custodied crypto at the customer's direction and use sub-custodians, subject to appropriate third-party risk management practices.

Is a bank responsible if its crypto provider fails?

The agencies' July 2025 statement says that, subject to the customer agreement, the bank is responsible for the sub-custodian's activities. Diligence includes the provider's key management and how customer assets would be treated in its insolvency.

Do banks need regulator approval to offer crypto through a provider?

The OCC, FDIC and Fed withdrew their prior-notice steps in 2025. New York banking organizations should still seek NYDFS approval, including for services a third party provides, and tell DFS at least 90 days ahead.

Sources

Test your crypto provider before you sign

Guardian reviews the custodian behind your crypto offering and pentests the app, API and cloud around it.

Talk to Guardian Explore Guardian for institutions