Digital Asset Security for Banks: How It Differs From IT

By the Guardian team Updated November 2026 6 min read

Quick answer. Transactions are final, control sits in the keys, and public chains expose the code and ledger to all. So prevention outweighs recovery, keys become the perimeter, and banks must monitor systems they do not run.

Watch: Digital Asset Security for Banks: How It Differs From IT 1:47

Video transcript

In 2025, the OCC, the Fed and the FDIC withdrew their crypto approval steps. The risk stayed, and the CISO inherits it.

Transactions are final, so prevention outweighs recovery. Keys are the perimeter. And public chains expose code and ledger to everyone.

Attackers took about 1.5 billion dollars from Bybit in February 2025. Five days later, the FBI said some was already dispersed across thousands of addresses.

So controls move in front of the signature. Simulate every transaction, allowlist destinations, enforce value and velocity limits, and set a confirmation depth per chain.

Bank networks check access at many layers. A public blockchain checks one. The agencies' 2025 joint statement calls compromise or loss of keys one of the primary risks of safekeeping.

DORA requires a key management policy covering each key's whole lifecycle. For signing keys, keep evidence of generation, storage, recovery and revocation.

On public chains, attackers read the same code you do. So monitoring must cover contracts, chains and counterparties you do not run, with an owner for every alert.

Most of the program is familiar. What changes is where each control sits, so payment recall becomes pre-signing simulation, and the perimeter becomes key custody.

The Digital Asset Assurance Pilot is Guardian's low-commitment start, from architecture assessment to smart contract audits and offchain pentests. Read the full guide, or talk to Guardian at guardian.security.

In 2025, the OCC, the Federal Reserve and the FDIC each withdrew the approval or notice steps they had set for bank crypto activity.

The risk stayed. The OCC still requires crypto activities to be run in a "safe, sound, and fair manner". The FDIC's relief holds only if banks "adequately manage the associated risks".

This guide is for the CISO and risk team that inherit it.

This article explains the technical and security side of these supervisory texts. It is not legal advice; confirm how they apply to you with counsel.

Transactions Are Final

Bank fraud controls assume time to act after a payment. Onchain, that window mostly does not exist.

Ethereum's documentation says interactions with smart contracts "are irreversible".

The US agencies' 2025 safekeeping statement lists "material transaction errors that cannot be reversed" among the events a bank could require a sub-custodian to report.

Funds also move fast. Attackers took about $1.5 billion from Bybit around February 21, 2025. Five days later, the FBI said some of it was already "dispersed across thousands of addresses on multiple blockchains".

So the controls move in front of the signature:

Decode and simulate every transaction before anyone signs it.
Allowlist destination addresses, with a delay on any change.
Enforce value and velocity limits in the signing system itself.
Set a confirmation depth per chain: settlement can be probabilistic.

Keys Are the Perimeter

A bank network checks access at many layers. A public blockchain checks one: a valid signature from the right key.

As the OCC put it in 2020, anyone who gains access to the keys "can use the keys to transfer the cryptocurrency to themselves."

The 2025 statement calls compromise or loss of keys "one of the primary risks" of safekeeping. A bank generally has control when it can show that no other party, "including the customer", could move the asset unilaterally.

Banks apply the same test to any sub-custodian. Our crypto custody guide covers custody and sub-custody models.

DORA's ICT risk management standard requires a key management policy covering each key's "whole lifecycle". Apply it to signing keys, with evidence at each stage:

Generation: a witnessed ceremony on hardware you control.
Storage: HSM, MPC or multisig, with the quorum written down.
Recovery: backups tested on a schedule, with dated records.
Revocation and replacement: a measured offboarding time and a rehearsed key replacement.

Our private key management guide compares HSMs, KMS and MPC. Our vendor due diligence questionnaire turns these stages into questions for custodians.

The Attack Surface Is Public

Bank systems are private by design. On Ethereum, smart contracts "are public" and "can be thought of as open APIs."

Anyone can deploy or call one, and attackers read the same code and state you do.

Smart contract risk

If custodied assets depend on smart contracts, the statement says a bank should oversee them "throughout their life cycle."

That means audits tied to the deployed code, review of every upgrade, and a map of who can pause, mint or upgrade. Budget for it: see the cost to tokenize an asset.

Counterparty and network risk

An asset inherits the risk of everything it touches: the chain, its validators, oracles, bridges, the issuer and any sub-custodian.

The statement warns that if a sub-custodian commingles its own assets with yours, they could be treated as its property in bankruptcy.

Permissioned ledgers narrow the audience, not the job. Canton shows participants only what they are entitled to, but its docs warn that your validator sees all your data. See our Canton Network security guide.

Using DeFi directly? Start with our DeFi protocol due diligence checklist.

What Supervisors Have Said

No single rulebook covers bank digital asset security. Four sets of texts shape it:

Text	Status
OCC Interpretive Letters 1170, 1183, 1184, 1186, 1188	Interpretive letters, July 2020 to December 2025
Fed, FDIC and OCC safekeeping statement	Joint statement, July 14, 2025; no new expectations
Basel cryptoasset standard (SCO60)	Global standard, due January 1, 2026; under targeted review
DORA, Regulation (EU) 2022/2554	EU regulation, applies from January 17, 2025

US banking agencies

Letter 1183 rescinded the OCC's 2021 nonobjection process and reaffirmed the 2020 custody letter.

Letter 1184 confirms banks may trade custodied assets at a customer's direction and outsource custody, "subject to appropriate third-party risk management practices."

Letters 1186 and 1188, from late 2025, cover holding crypto to pay network fees and riskless principal trades.

The joint statement "does not create any new supervisory expectations". It applies existing rules to safekeeping.

Audits, it says, should assess key generation, storage and deletion, and transfer and settlement controls. Without that expertise in-house, banks should engage outside resources "with sufficient independence".

Basel Committee

The standard sorts cryptoasset exposures into four groups, which banks must reassess on an ongoing basis.

Group 2 exposures should not generally exceed 1% of Tier 1 capital. Any excess gets the strictest (Group 2b) capital treatment; above 2%, all Group 2 exposures do.

Implementation was agreed for January 1, 2026. The Committee's decisions "do not have legal force" on their own: it expects members to write standards into local rules.

In November 2025 it agreed to expedite a review of "targeted elements". In February 2026 it promised an update that year.

As of early November 2026, the Basel Framework still shows the 2024 text, so check for changes.

DORA

DORA covers EU financial entities, including credit institutions and MiCA crypto-asset service providers.

It requires major ICT incident reporting and a testing program that can include source code reviews. Identified firms run threat-led pentests at least every three years.

Entities "remain fully responsible" when they use ICT providers. For the vendor side, see institutional security requirements for onchain teams.

Monitoring Changes Too

A SOC watches systems the bank runs. Digital asset monitoring also watches contracts, chains and counterparties it does not run.

The statement says effective risk management may also entail staying "apprised of material developments" for each supported asset and its ledger. Watch for:

Owner, role and signer changes on contracts you rely on.
Upgrades and parameter changes against the version you reviewed.
Unusual outflows from your wallets and your counterparties'.
Oracle, bridge and validator incidents, forks and governance votes.

Give every alert an owner, and decide in advance who may pause or block.

Mapping Your Existing Controls

Most of the program is familiar. What changes is where each control sits.

Traditional control	Digital asset equivalent
Payment recall and fraud review	Pre-signing simulation and address allowlists
Network perimeter and IAM	Key custody, signing quorum and signer devices
Change management	Contract upgrade review and timelocks
Vulnerability management	Smart contract audits and advisory tracking
SOC and SIEM	Onchain monitoring of roles, upgrades and flows
Third-party risk	Sub-custodians, issuers, oracles, bridges and chains
Backup and recovery	Tested key recovery ceremonies

How Guardian Helps

Guardian's institutional practice covers advisory, smart contract audits and offchain pentests. Advisory includes control design, counterparty review and committee-ready evidence.

The Digital Asset Assurance Pilot is a low-commitment start, easy for a vendor process to accept. Choose from five modules:

Architecture assessment: custody, issuance, operating model and threat model.
Standards alignment: MiCA, DORA, VARA, GENIUS and others.
Assurance engineering: the properties that must hold, their controls and their tests.
A smart contract audit of the contracts in scope.
Offchain pentests of the consoles, APIs and signing services that can reach your keys.

Frequently Asked Questions

How is digital asset security different from traditional bank cybersecurity?

Transactions are final, so controls must act before a signature. Control of an asset is control of its keys. Public chains expose code and state to everyone, so banks must monitor systems they do not run.

Can US national banks custody crypto-assets?

Yes. OCC Interpretive Letter 1170 said so in 2020, and Letter 1183 reaffirmed it in March 2025. Letter 1184 adds that they may buy and sell custodied assets at the customer's direction and use sub-custodians, subject to third-party risk management.

What is the biggest security risk in crypto custody?

The US agencies' 2025 statement names compromise or loss of cryptographic keys as one of the primary risks of safekeeping. A stolen key can move assets out of the bank's control, usually for good.

Sources

Pressure test your digital asset program

Guardian assesses the architecture, keys, contracts and offchain systems behind a regulated digital asset program, starting with the modules your roadmap needs.

Talk to Guardian Explore institutional security