OCC Crypto Guidance: Bank Activities and Expected Controls
Quick answer. OCC letters let banks custody crypto, hold stablecoin reserves, run nodes, use stablecoins for payments, pay network fees and trade as riskless principal. No pre-clearance is needed, but guidance stresses key control, dual controls, audits and sub-custodian diligence.
Video transcript
National banks may custody crypto, hold stablecoin reserves, run nodes and trade as riskless principal. The real question is whether their controls hold up.
Since March 2025, banks no longer need supervisory non-objection first. They must still act in a safe, sound and fair manner, and examiners check.
Each letter adds an activity. But read the fine print: the network fee letter answers one bank's facts, and the riskless principal letter could change on different facts.
In general, a bank has control when it can show no other party, including the customer, can move the asset alone. Taking possession of existing keys may not be enough.
Expect dual controls, segregation of duties, a review of each asset and its ledger, and audit coverage of key generation, storage and transfers.
The bank stays responsible for any sub-custodian. Diligence should cover its key management, segregation, dual control and insolvency treatment.
And plan your incident path. The OCC expects notice within 36 hours of determining a notification incident.
Have evidence ready before examiners ask: a risk assessment per activity, a key inventory, dated key ceremony records and a sub-custodian file.
Guardian maps this guidance to the controls that answer it. Read the full guide, or talk to Guardian at guardian.security.
The OCC wrote crypto into national bank powers through interpretive letters, starting in 2020.
In March 2025 it dropped the requirement that banks get supervisory non-objection first. The question is no longer whether a bank may, but whether its controls hold up when examiners look.
This guide reads each letter, and the July 2025 interagency statement on crypto-asset safekeeping, for the controls behind it.
This article explains the technical and security side of the OCC's crypto interpretive letters and the July 2025 joint statement on crypto-asset safekeeping. It is not legal advice; confirm how it applies to you with counsel.
The Interpretive Letters
These letters set the OCC's current position. Of them, only IL 1179 has been rescinded.
| Letter | Date | What it says |
|---|---|---|
| IL 1170 | July 22, 2020 | Banks may custody crypto, including holding the keys |
| IL 1172 | Sept. 21, 2020 | Banks may hold deposits that back certain stablecoins |
| IL 1174 | Jan. 4, 2021 | Banks may run nodes and use stablecoins for payments |
| IL 1179 | Nov. 18, 2021 | Required written notice and non-objection first (rescinded) |
| IL 1183 | Mar. 7, 2025 | Rescinds IL 1179; reaffirms IL 1170, 1172 and 1174 |
| IL 1184 | May 7, 2025 | Custody includes trading at customer direction; sub-custodians allowed |
| IL 1186 | Nov. 18, 2025 | One bank may hold crypto to pay network fees and test platforms |
| IL 1188 | Dec. 9, 2025 | Riskless principal crypto trades are permissible |
When it issued IL 1183 on March 7, 2025, the OCC also withdrew from two interagency statements: one on crypto-asset risks, one on liquidity risks from crypto-asset market vulnerabilities.
IL 1183 keeps the core duty. Banks "must conduct all crypto-asset activities in a safe, sound, and fair manner," and the OCC examines them in its ongoing supervisory process.
IL 1179's risk list still works as a checklist, in our view: operational risk (new technology, hacking, fraud, theft, third parties), liquidity, strategic and compliance risk.
What Banks May Do
| Activity | Source | Condition to note |
|---|---|---|
| Custody, fiduciary or not | IL 1170 | May include settlement, trade execution, valuation, reporting |
| Trading held assets | IL 1184 | At the customer's direction, per the customer agreement |
| Stablecoin reserve deposits | IL 1172 | 1:1 single-fiat coins; bank verifies reserves at least daily |
| Nodes and payments | IL 1174 | Validate payments; buy, sell and issue stablecoins for payments |
| Network fees, testing | IL 1186 | Bank represented de minimis holdings for foreseeable needs |
| Riskless principal trades | IL 1188 | No inventory; main risk is counterparty settlement |
| Staking | Charter decisions | Called permissible in the OCC's Crypto.com decision, Feb. 2026 |
Read the fine print. IL 1186 answers one bank's request on its facts, and IL 1188 says different facts could change its conclusion.
Issuing payment stablecoins now has its own rules: see our post on the OCC's GENIUS Act final rule, effective January 18, 2027.
Keys and Custody Controls
The fullest statement of controls is the July 14, 2025 joint statement by the OCC, Federal Reserve and FDIC.
It "does not create any new supervisory expectations." It explains how existing rules and risk management principles apply to safekeeping.
Control of keys
In general, a bank assumes "control" when it "can reasonably demonstrate" that no other party, including the customer, "has access to information sufficient to unilaterally transfer the crypto-asset."
- Taking possession of existing keys may not be control: the customer may have kept copies.
- A bank "would apply these same control standards" to any sub-custodian.
- Seed phrases and backup material count as sensitive information.
- The statement names secure key generation and plans for lost or compromised keys.
- Cybersecurity "should be a key focus of risk management."
Custody controls
- IL 1170: custody should include "dual controls, segregation of duties and accounting controls."
- IL 1170: each custody account's assets should be kept separate from the custodian's, under joint control.
- Analyze each crypto-asset and its ledger before safekeeping it, including vulnerabilities and dependencies.
- Weigh omnibus against separate wallets: omnibus accounts "could also create larger targets for theft."
- Where assets depend on smart contracts, govern them "throughout their life cycle."
Audit
Audit should cover key generation, storage and deletion, transfer and settlement controls, and IT sufficiency.
IL 1170 adds that verifying access controls for a key differs from verifying them for physical assets.
Where audit expertise does not exist in-house, management should engage external resources "with sufficient independence."
Sub-Custodians and Third Parties
IL 1184 confirms a bank may use a sub-custodian, "subject to appropriate third-party risk management practices."
Under the joint statement, the bank stays responsible for the sub-custodian's work, subject to the customer agreement. That includes choosing which assets to support.
Due diligence should evaluate the sub-custodian's key management solution. The statement lists:
- Policies, processes and internal controls.
- Segregation of its own assets from the bank's.
- Dual control and separation of duties.
- How customer assets are treated in insolvency or disruption.
- Recordkeeping and contingency planning.
Letting a sub-custodian commingle its own assets with those it holds for the bank would be "inconsistent with appropriate risk management."
A bank could consider contract terms requiring notice of any key compromise, any use of backup material, and irreversible transaction errors.
Beyond custody, the agencies' June 2023 guidance (OCC Bulletin 2023-17) sets the third-party life cycle.
Appendix B to 12 CFR part 30 requires vendor diligence, contract terms and monitoring.
Exam Readiness
Guardian's reading, not rule text: the evidence to have ready before examiners ask.
- A risk assessment for each activity, covering the risks IL 1179 listed.
- A board-approved information security program under Appendix B, with independent tests.
- A key inventory showing no single party can move customer assets.
- Dated key ceremony, backup and recovery records, and a lost-key plan.
- A review of each supported asset, its ledger and any smart contracts.
- A sub-custodian file: key management diligence, segregation, insolvency and notice terms.
- Audit coverage of key generation, storage, deletion, transfers and settlement.
- An incident path that notifies the OCC within 36 hours of determining a notification incident (12 CFR 53.3).
- Limits on any network fee wallet that match what the bank represented.
Seeking a charter instead? Our guide to OCC crypto trust charters covers the approval conditions.
How Guardian Helps
Guardian's Regulatory & Compliance practice maps the federal banking agencies' crypto guidance, including the July 2025 statement and IL 1183 and 1184, to the controls that answer it.
Its custody assessment covers segregation, key generation and storage, signing thresholds, cold storage ratios and recovery.
The OpSec audit reviews custody and key ceremony: where keys live, who holds which share and what a quorum requires in practice.
Choosing a sub-custodian? Compare two chartered ones in BitGo vs Anchorage Digital, or read our crypto custody guide.
Frequently Asked Questions
Do national banks need OCC approval to offer crypto custody?
Not prior supervisory non-objection: IL 1183 rescinded that requirement on March 7, 2025. Banks must still conduct it in a safe, sound and fair manner, and fiduciary custody must comply with 12 CFR part 9.
What did OCC Interpretive Letter 1184 confirm?
Issued May 7, 2025, it confirmed that a bank may buy and sell assets held in custody at the customer's direction. It may also use a sub-custodian to provide those custody services, subject to appropriate third-party risk management practices.
What does the OCC mean by control of a crypto-asset?
The July 2025 joint statement's test: the bank can reasonably demonstrate that no other party, including the customer, has information sufficient to move the asset alone. Simply taking possession of a customer's existing keys may not meet it.
Can national banks hold crypto on their balance sheet?
In limited cases. IL 1186 let one bank hold amounts needed for network fees and platform testing, and IL 1188 permits riskless principal trades. A footnote in IL 1186 adds foreclosing on crypto collateral and physically hedging customer-driven derivatives.
Sources
- OCC: Interpretive Letter 1170, Authority of a National Bank to Provide Cryptocurrency Custody Services (July 22, 2020)
- OCC: Interpretive Letter 1172, Authority to Hold Stablecoin Reserves (September 21, 2020)
- OCC: Interpretive Letter 1174, Independent Node Verification Networks and Stablecoins for Payment Activities (January 4, 2021)
- OCC: Interpretive Letter 1179, Chief Counsel's Interpretation Clarifying Authority of a Bank to Engage in Certain Cryptocurrency Activities (November 18, 2021)
- OCC: Interpretive Letter 1183, OCC Letter Addressing Certain Crypto-Asset Activities (March 7, 2025)
- OCC: News Release 2025-16, OCC Clarifies Bank Authority to Engage in Certain Cryptocurrency Activities (March 7, 2025)
- OCC: Interpretive Letter 1184, Clarification of Bank Authority Regarding Crypto-Asset Custody Services (May 7, 2025)
- OCC: Interpretive Letter 1186, Holding Crypto-Assets as Principal to Pay Network Fees (November 18, 2025)
- OCC: Interpretive Letter 1188, Riskless Principal Transactions in Crypto-Assets (December 9, 2025)
- Federal Reserve, FDIC and OCC: Crypto-Asset Safekeeping by Banking Organizations (July 14, 2025)
- Federal Reserve: Agencies issue joint statement on risk-management considerations for crypto-asset safekeeping (July 14, 2025)
- OCC: Corporate Decision 1367, Foris DAX National Trust Bank (February 20, 2026)
- OCC: Bulletin 2023-17, Third-Party Relationships: Interagency Guidance on Risk Management (June 6, 2023)
- eCFR: 12 CFR part 30, Appendix B, Interagency Guidelines Establishing Information Security Standards
- eCFR: 12 CFR 53.3, Notification of computer-security incidents
- Guardian: OCC GENIUS Act Final Rule, What Changed for IT and Keys
- Guardian: Regulatory & Compliance
Show examiners your crypto controls
Guardian tests your key management, custody and sub-custodian controls and maps the evidence to the OCC guidance it answers.