Crypto Custody for Banks: Controls Examiners Expect

By Owen ThurmPublished November 12, 202611 min read

Quick answer. A bank needs to show no one, including the customer, can move assets alone; a documented key lifecycle with tested recovery; per-asset risk reviews; sub-custodian diligence; independent audits of key and transfer controls; and evidence examiners can test.

Watch: Crypto Custody for Banks: Controls Examiners Expect 1:47

Video transcript

To offer crypto custody, a bank should be able to show that no one, including the customer, can move assets alone. Here is how examiners test it.

The OCC's final GENIUS Act rule takes effect January 18, 2027. FDIC and Federal Reserve custody standards are still proposals.

Control is the core test. Taking over a customer's existing keys may not pass it, because copies may survive. Generate fresh keys in a bank-run ceremony instead.

Document every stage: generation in a witnessed ceremony, signing by an enforced quorum, backups under dual control, and a compromise plan that names who acts.

Outsourcing moves the work, not the accountability. Test the sub-custodian's key controls, and check that its SOC 2 scope actually covers signing.

For EU banks, DORA has applied since January 17, 2025, with tested exit plans for services supporting critical or important functions. For custody, Recover is the hard part, so rehearse and time it.

Build the file before the exam. Each control should leave an artifact an examiner can test, from a quorum map to timed recovery records.

Start narrow, with one asset and one signing path. Inventory keys and signers, map controls to NIST and CCSS, confirm a single-signer send fails, rehearse a compromise, then fix and retest.

Read the full guide for the evidence table, or talk to Guardian about the Digital Asset Assurance Pilot, which reviews custody models, key ceremonies and signing services.

Why Banks Are Entering Now

In 2025, the OCC rescinded its non-objection process, and the FDIC said in FIL-7-2025 (March 28, 2025) that its banks need no prior approval. The Federal Reserve withdrew its notice guidance on April 24, 2025. Office of the Comptroller of the Currency, Federal Deposit Insurance Corporation, Board of Governors of the Federal Reserve System

In May 2025, the OCC confirmed that banks may execute trades at customer direction and outsource custody, subject to third-party risk management.

On July 14, 2025, the OCC, Federal Reserve and FDIC issued a joint safekeeping statement. It applies existing law and creates no new supervisory expectations. OCC, Federal Reserve and FDIC

The OCC's GENIUS Act final rule takes effect January 18, 2027. It sets custody standards for national banks, federal savings associations and federal branches that hold stablecoin reserves, stablecoins they know are pledged as collateral, or issuing keys. Federal Register, Office of the Comptroller of the Currency

Subpart C requires consent-based control, segregation, sub-custodian safeguards and written custody agreements. FDIC and Fed custody standards, proposed by the FDIC in April and published by the Fed on September 29, 2026, are not yet final. Federal Deposit Insurance Corporation, Federal Register, Board of Governors of the Federal Reserve System, Federal Register

The accounting barrier moved too. SEC Staff Accounting Bulletin 122 rescinded SAB 121 effective January 30, 2025. U.S. Securities and Exchange Commission

SAB 122 is staff guidance, not a Commission rule.

This guide gives the bank's control view across all three agencies. For the letters one by one, see our guide to OCC crypto guidance and expected controls.

It covers security controls only. Charter, fiduciary, state-law and accounting conclusions need counsel and your auditor.

Key Management Expectations

Control is the core test. A bank should be able to show that no other party, including the customer, holds enough information to move an asset alone. OCC, Federal Reserve and FDIC

Taking over a customer's existing keys may not meet that test, because copies may survive. Generate fresh keys in a bank-run ceremony and move the assets to them.

The statement names secure key generation and contingency plans for lost or compromised keys. It calls cybersecurity a key focus of risk management.

Guardian's advice: document the full lifecycle, from generation and storage through signing, backup, recovery and deletion.

CCSS v9 adds crypto-specific detail, such as keeping each signer's key material on separate logical or physical devices and logging every action in a trusted environment. CryptoCurrency Certification Consortium

Omnibus wallets can be more efficient but could create larger theft targets, while separate accounts add key-management work. Our omnibus vs segregated wallets guide compares both.

Each supported asset and ledger needs its own review before launch, covering technical, operational, legal, compliance, vulnerability and dependency risk. Then keep watching as the technology changes.

Key tiers, quorums, ceremonies and rotation are covered in depth in our private key management controls guide.

Generation: a witnessed ceremony on bank-controlled hardware, with a dated record.
Signing: a quorum the system enforces, so no one person can approve and send.
Backup: held under dual control, and recovered from on a schedule.
Compromise plan: who revokes access, who moves funds to clean keys, who notifies.

Sub-Custodian Risk

Outsourcing moves the work, not the accountability. Subject to the customer agreement, the bank remains responsible for its sub-custodian's activity. OCC, Federal Reserve and FDIC

Before selection, test the sub-custodian's key-management policies and internal controls. The statement also names segregation, dual control, separation of duties, insolvency treatment, recordkeeping and contingency planning.

Apply the same control test to the provider. No single party there should be able to move your customers' assets alone.

A bank that holds custody directly may still use third-party technology. It should weigh buying software or hardware against using it as a service.

A SOC 2 report tests controls against AICPA criteria for security, availability, processing integrity, confidentiality and privacy. AICPA

Check its period, the systems in scope, the exceptions and the complementary user-entity controls you must run. A report that leaves out signing says little about keys.

If a provider will run custody end to end, our crypto-as-a-service for banks guide covers what stays with the bank.

To compare models, read our crypto custody guide. To shortlist providers, see best crypto custodians.

Red flag: the provider commingles its own assets with those it holds for the bank.
Gap: no duty to report key compromise, backup use or irreversible errors, terms the agencies suggest considering.

Operational Resilience and DORA

For EU banks, DORA has applied since January 17, 2025. Its ICT third-party rules can reach a custody or signing platform. European Banking Authority, European Union, EUR-Lex

Articles 28 to 30 require a third-party risk strategy, concentration and subcontracting assessments, and a register of ICT contractual arrangements.

Every ICT contract must cover incident assistance and the access, recovery and return of data (Art. 30(2)).

Article 30(3) adds unrestricted access, inspection and audit rights and exit strategies where the service supports a critical or important function. Article 28(8) requires exit plans to be sufficiently tested.

Our DORA Article 30 clause checklist lists each required contract term from the vendor side.

US banks can borrow the structure. NIST CSF 2.0 organizes a program into six concurrent functions: Govern, Identify, Protect, Detect, Respond and Recover. National Institute of Standards and Technology

CSF is a framework, not a bank rule.

For custody, Recover is the hard part. Rehearse a lost-key recovery and a provider exit, and time both.

Evidence for Examiners

The statement says a custody audit should assess key generation, storage and deletion, transfer and settlement controls, and IT sufficiency. It should cover third-party risk where relevant, and may assess management and staff expertise. OCC, Federal Reserve and FDIC

Where internal skill falls short, management should bring in independent outside expertise.

Build the file before the exam. Each control should leave an artifact an examiner can test.

Control	Evidence to show	Red flag
Control of keys	Key inventory and quorum map	One person or vendor can sign alone
Key lifecycle	Generation, backup and deletion records	Undated or missing ceremony logs
Asset review	Risk file for each asset and ledger	Assets added without review
Wallet structure	Omnibus or separate rationale, tied to threat model	No documented reason for the choice
Sub-custodian	Diligence file and notice terms	Commingled assets
Attestations	SOC 2 report with scope mapped to custody	Signing systems out of scope
Independent testing	External assessment and audit reports	Self-assessment only
Recovery	Timed recovery and exit test records	Recovery never rehearsed

A Pilot Approach

Start narrow: one asset, one wallet structure, one signing path. Prove each control before adding scope.

How SOC 2, CCSS and NIST CSF differ is set out in our security standards comparison.

Wallet setup is a control point too. In Guardian's Ethena Pay Updates review, an authorized deployer could choose the first signer for a prefunded wallet address and take its funds (Medium, acknowledged). Guardian

That was a wallet product review, not a bank incident. The bank lesson: bind wallet setup to a verified, bank-run ceremony, with quorum approval before any address is funded.

Guardian's Digital Asset Assurance Pilot runs in modules: architecture and threat model, standards alignment, assurance engineering, smart contract audit and offchain pentests.

Its custody review covers where keys live, who holds each share, what a quorum requires in practice and what happens when someone leaves or a device is lost.

Guardian states its own controls are NIST CSF 2.0 and CCSS aligned, with its SOC 2 Type II audit underway. Statutory audits, legal opinions and approvals stay with the appropriate providers.

Inventory wallets, keys, shares, signers, roles, ledgers, contract dependencies, sub-custodians, recovery paths and evidence owners. OCC, Federal Reserve and FDIC, National Institute of Standards and Technology, CryptoCurrency Certification Consortium
Map each control to a CSF 2.0 function and a CCSS aspect, and note where a SOC 2 covers it. AICPA
Test approval and transfer: attempt a single-signer send and confirm it fails.
Rehearse an incident: a compromised signer, revoked access and funds moved to clean keys.
Fix findings, retest, and file the evidence before production.

Frequently Asked Questions

Does SAB 122 change a bank's duty to safeguard crypto?

No. SAB 122 is accounting guidance only and does not lift the duty to safeguard assets. Filers apply it retrospectively, no later than annual periods beginning after December 15, 2024, and keep applying ASC 450-20 or IAS 37 to safeguarding loss contingencies, with Regulation S-K disclosures. U.S. Securities and Exchange Commission

Does the joint safekeeping statement apply to state-chartered banks?

Yes: state member banks (Fed) and insured state nonmember banks (FDIC). FDIC (April 2026) and Fed (comments due November 30) GENIUS proposals cover stablecoin reserves, pledged stablecoins and issuing keys. NYDFS expects New York-chartered banks to seek approval, with at least 90 days' notice, before new virtual currency activity. OCC, Federal Reserve and FDIC, Federal Deposit Insurance Corporation, Federal Register, Board of Governors of the Federal Reserve System, Federal Register, New York State Department of Financial Services

Do BSA/AML rules apply to bank crypto custody?

Yes. The joint statement lists BSA/AML considerations for safekeeping, and sanctions compliance still applies. Plan screening and monitoring of custody flows alongside the key controls, not after launch. OCC, Federal Reserve and FDIC

Sources

Test your custody controls before examiners do

Guardian's Digital Asset Assurance Pilot reviews your custody model, key ceremonies, signing services and smart contracts, in the modules you choose.

Talk to Guardian Explore the service