New Product Approval for Digital Assets: Security Gates

By Owen Thurm Published November 6, 2026 6 min read

Quick answer. A bank's NPAP for a crypto product should add security gates at each stage. That means a threat model and key custody review at design, vendor evidence before approval, audits and pentests before launch, and a post-launch review.

Watch: New Product Approval for Digital Assets: Security Gates 1:36

Video transcript

US bank regulators dropped their crypto approval steps in 2025. That moves the security gate inside the bank, into the new product approval process.

The OCC still expects sound risk management. For most banks, that proof belongs in the NPAP.

Crypto changes where the answers sit. Keys are control. Code holds the asset. Vendors may hold keys, yet the bank stays responsible. Public chains sign no contract with you.

Add a gate at each stage. Concept maps every key, chain and vendor. Design adds a threat model and custody review. Approval sets residual risk and limits. Pre-launch means audits and pentests. Launch assigns monitoring owners.

Ask for evidence, not assurances. The New York DFS list is a good model, from flows of funds and third parties to key policy and an exit strategy.

New York banking organizations should still give DFS at least 90 days notice before launch.

Approval is not the end. A new chain, asset, custodian or contract version should send the product back through NPAP.

Guardian's Assurance Pilot is built for vendor approval: architecture, standards alignment, assurance engineering, a smart contract audit and offchain pentests of systems that reach your keys.

Read the full guide for the NPAP addendum questions, or talk to Guardian about bringing security evidence to your committee.

In 2025, US federal bank regulators dropped their crypto-specific notice and approval steps.

The OCC rescinded its nonobjection process in March. The FDIC said its banks need no prior approval; the Fed stopped expecting notice.

That moves the gate inside the bank. The OCC's letter says new activities "should be developed and implemented consistent with sound risk management practices."

For most banks, that gate is the new product approval process (NPAP). This guide adds the security reviews a digital asset product needs at each stage.

This article explains the technical and security side of OCC Bulletin 2017-43, the Basel Committee's operational risk principles and the other supervisory texts it cites. It is not legal advice; confirm how they apply to you with counsel.

How NPAP Works in Banks

OCC Bulletin 2017-43 (October 20, 2017) sets risk management principles for new, modified or expanded products at OCC-supervised banks. It defines three kinds of change:

New: offerings that "may differ substantially from previous bank offerings."
Modified: products that differ substantially "in nature, terms, purpose, scale, or use."
Expanded: offerings beyond current customers, markets, venues or delivery channels.

The board oversees. Management runs due diligence, policies, change management and performance monitoring.

Due diligence includes "determining the expertise needed" to manage the activity, and consulting functions such as legal, IT, information security, audit and compliance.

The Basel Committee's operational risk principles (March 2021) cover the same ground in Principle 7.

The first line should assess each new product from planning "to the implementation and post-implementation review." The second line should challenge it and involve compliance, legal, ICT and risk.

The July 2025 interagency statement on crypto safekeeping cites Bulletin 2017-43: banks "should consider potential risks prior to offering" the service.

Why Crypto Needs Extra Gates

A standard NPAP asks the right questions. A crypto product changes where the answers sit.

Keys are control. The agencies call key compromise or loss "one of the primary risks" of safekeeping.
Code holds the asset. Banks should oversee smart contracts a custodied asset depends on "throughout their life cycle."
Vendors hold keys. Providers may serve banks by API or white label; the bank stays responsible.
Chains are dependencies. A public chain, oracle or bridge signs no contract with you.

Basel says approval should consider inherent risks "including legal, ICT and model risks," and new systems "especially when outsourced."

For the wider control set, see digital asset security for banks.

Security Gates by Stage

1. Concept

Classify the product: custody, trading, stablecoin, tokenized deposit or lending.
List every key, chain, contract and vendor it touches.
Name who could move or freeze client assets, alone or compromised.

2. Due diligence and design

A threat model of every path to client assets, onchain and off.
Key custody design: HSM, MPC or multisig, quorum, recovery and revocation.
Admin powers on every contract: who can upgrade, pause, mint or freeze.
Vendor diligence on key management, segregation and treatment in insolvency.

3. Approval

Residual risk stated in plain words, with an owner.
Limits: asset caps, hot wallet caps, per-customer and velocity limits.
An exit strategy, and the metrics that trigger it.

4. Pre-launch

Bulletin 2017-43 says change management should include "proper testing of new or modified operational systems, processes, and technology." For crypto:

A smart contract audit of the code you will deploy, with fixes re-reviewed.
Pentests of the app, APIs, signing services and cloud accounts.
A witnessed key ceremony and a tested recovery.
Deployed contracts and settings checked against what was approved.

5. Launch

Monitoring of roles, upgrades, signer changes and wallet outflows, each with an owner.
Daily reconciliation of onchain balances against the books.
A post-launch review date, set at approval.

Evidence the Committee Should See

NYDFS publishes a detailed list. Its December 2022 letter tells New York banking organizations what to file before new virtual currency activity.

Banks elsewhere can borrow it:

Evidence	Where the ask comes from
Operating model, technology architecture and all flows of funds	NYDFS letter: business plan
Every third party, its services and its SLAs	NYDFS letter: business plan
Technology risk of the blockchain itself	NYDFS letter: risk management
Key and wallet management policy	NYDFS checklist
Independent review of the cybersecurity program	NYDFS checklist
Audit of key generation, storage and deletion	2025 safekeeping statement
Risk limits and how they will be recalibrated	NYDFS checklist
Exit strategy and the metrics that trigger it	OCC Bulletin 2017-43
Copies of internal approvals and board papers	NYDFS letter: governance

The letter says to inform DFS at least 90 days before launch. Activity run through a third party may still need its approval.

Post-Launch Review

Approval is not the end. Bulletin 2017-43 says monitoring should include "processes to periodically compare actual results with projections."

Basel adds that changes should be monitored "during and after their implementation." Risk may grow as a product moves from introductory to material revenue.

Review security alongside volume:

Open audit and pentest findings, and their age.
Incidents and near misses, onchain and off.
Signer changes, contract upgrades and new vendors since approval.
Assets held against the caps set at approval.

Some changes should send the product back through NPAP: a new chain, asset, custodian or contract version.

Bulletin 2017-43 counts new venues or delivery channels as expanded products. Treat a new chain the same way.

Report the results in one page: see our board report template.

NPAP Addendum Template

Add these to your NPAP form as a digital asset addendum.

Which keys can move or freeze client assets, and who holds each?
What is the signing quorum, and how is a lost signer replaced?
Which smart contracts does the product rely on, and who can change them?
Was the deployed code audited, and does it match the audited version?
Which vendors hold keys or reach signing systems, and what diligence did each pass?
Do contracts require notice of key compromise and irreversible errors?
Which chains, oracles and bridges does it depend on?
Which apps, APIs and cloud accounts were pentested, and when?
What is monitored, who owns each alert, and who may pause?
What are the limits, and which metrics trigger the exit strategy?
When is the post-launch review, and what sends the product back to NPAP?

How Guardian Helps

The Digital Asset Assurance Pilot is "built for vendor approval and scoped to the modules you choose." Its five modules:

Architecture assessment: custody, issuance, operating model and threat model.
Standards alignment: MiCA, DORA, VARA, GENIUS and more, read as design demands.
Assurance engineering: invariant suites, review gates and deployment validation.
A smart contract audit of the contracts in scope.
Offchain pentests of consoles, APIs and signing services that can reach your keys.

Guardian's institutional advisory adds committee-ready evidence: plain-language risk framing, residual exposure and control ownership.

Frequently Asked Questions

What is a new product approval process in banks?

A governance process that reviews a new, modified or expanded product before launch. Risk, compliance, legal, technology and audit assess it, a committee or the board approves it, and performance is reviewed after launch.

Do US banks need regulator approval before launching a crypto product?

Federal agencies withdrew their crypto prior-notice steps in 2025, though the OCC says new activities should follow sound risk management practices. New York banking organizations should still seek NYDFS approval and give at least 90 days' notice.

What security evidence should an NPAP committee see for a crypto product?

A threat model, the key custody design, vendor diligence, a smart contract audit of the deployed code, pentests of apps, APIs and signing services, monitoring owners, limits and an exit strategy.

When should a crypto product go back through new product approval?

When it changes materially: a new chain, asset, custodian, signing setup or contract version. OCC Bulletin 2017-43 treats offerings in new venues or delivery channels as expanded products.

Sources

Bring security evidence to your NPAP committee

Guardian's Digital Asset Assurance Pilot assesses the architecture, contracts and offchain systems behind a new digital asset product.

Talk to Guardian Explore the Assurance Pilot