Third-Party Risk Management for Crypto: A Bank Playbook

Video transcript

Bank vendor programs were built for parties that sign contracts. Crypto products also depend on chains, oracles and protocols that sign nothing.

The 2023 interagency guidance from the Fed, FDIC and OCC covers any business arrangement, by contract or otherwise. It never names chains, but that line gives you a basis to list them.

Tier each party by what it can move. Critical parties can move or freeze client assets. Chains and oracles can halt settlement. Analytics tools touch only data.

Diligence needs evidence by type. Test custodians on key management. For chains, oracles and bridges, read the public record, including who holds admin keys. For protocols, match deployed code to the audited commit.

Contracts need crypto wording, grounded in NYDFS 500.11 and DORA Article 30. Require notice of key compromise, notice of new sub-custodians, asset return, and enough time to exit.

Then watch vendor reports, contract state, wallet outflows and shared dependencies. Each change triggers a re-review at the depth of the party's tier.

A crypto exit means moving the assets, retiring the keys, knowing the exit speed, and naming a substitute in advance.

Rehearse the asset move once with a small amount. An exit plan that has never moved funds is a guess.

Guardian's institutional advisory reviews the custodians, bridges, oracles and protocols you depend on. Read the full playbook, or talk to Guardian.

Third-party programs were built for vendors that sign contracts and send SOC 2 reports.

A crypto product also leans on parties that sign nothing: a public chain, an oracle, a DeFi protocol.

This playbook applies the US interagency life cycle to all of them, with DORA and NYDFS alongside. For the wider control set, see digital asset security for banks.

This article explains the technical and security side of the interagency guidance, DORA and NYDFS Part 500. It is not legal advice; confirm how they apply to you with counsel.

Who Counts as a Third Party

The Fed, FDIC and OCC finalized their Interagency Guidance on Third-Party Relationships in June 2023. It is supervisory guidance, not a rule.

It covers any business arrangement with another entity, “by contract or otherwise.” A relationship “may exist despite a lack of a contract or remuneration.”

The guidance does not name chains or protocols. That line still gives you a basis to list them:

Tier by What It Can Move

Under the guidance, relationships that support higher-risk or critical activities get “more comprehensive and rigorous oversight.” Each bank identifies its own critical activities.

For crypto, one question sorts most parties: could this party, alone or compromised, move or freeze client assets?

DORA asks EU financial entities a similar question before they contract: does the service support a “critical or important function” (Article 28(4))?

They must also weigh whether a provider is “not easily substitutable” (Article 29). One oracle or chain often sits under several products.

Due Diligence by Vendor Type

Past experience with a vendor “is not an adequate proxy” for diligence, the guidance says. Each crypto vendor type needs its own evidence.

Custodians and wallet vendors

The agencies’ July 2025 safekeeping statement says diligence on a sub-custodian includes evaluating its key management.

Send these vendors our vendor due diligence questionnaire, and require evidence with every answer.

Chains, oracles and bridges

There is no one to send a questionnaire to. The evidence is public, so read it yourself:

• Chains: who runs validators or the sequencer, how upgrades ship, past outages.
• Oracles: where prices come from, and what happens to a stale one.
• Bridges: how many parties must approve a message.
• All three: who holds the admin keys on their contracts.

Protocols and issuers

Check that deployed code matches the audited commit, and map who can upgrade, pause or mint. Our DeFi protocol due diligence checklist has the steps.

Some parties will not share. The guidance says to “identify and document any limitations” of your diligence, and consider other ways to cover the risk.

Contract Terms to Add

The guidance lists contract considerations, including audit rights, subcontracting and termination. Add crypto wording to each.

NYDFS 500.11 requires a covered entity’s vendor policies to address several of these, where applicable. DORA Article 30 sets minimum terms for ICT contracts.

The Article 30(3) terms apply to contracts for critical or important functions. See our DORA guide for crypto companies.

Ongoing Monitoring

Monitoring lets a bank “confirm the quality and sustainability of a third party’s controls,” the guidance says. More comprehensive or frequent monitoring is appropriate for critical activities.

Onchain, the chain itself is the best evidence. Watch four sources:

• Vendor reports: SOC 2 periods, pentest retests and incident notices.
• Contract state: upgrades, role grants and signer changes.
• Wallets: outflows from a custodian’s or issuer’s known addresses.
• Shared dependencies: incidents at an oracle, bridge or chain your vendors use.

Make each change a trigger to re-review the party, at the depth of its tier.

One practice the agencies have observed is “a current inventory of all third-party relationships.” For crypto, add each party’s chains and contract addresses.

Exit Planning

The guidance’s termination factors include transition options, time frames, costs and data handling.

DORA goes further for critical or important functions: exit plans must be “sufficiently tested and reviewed periodically.”

A crypto exit adds steps a software exit does not:

1. Move the assets. Know who signs the transfer out, and how long cold storage takes.
2. Retire the keys. Confirm that no copies or shares stay with the vendor.
3. Plan for failure. Know how client assets are treated if the vendor goes insolvent.
4. Know the exit speed. A protocol position leaves only as fast as its withdrawal queue.
5. Name a substitute. Pick a backup custodian, oracle or chain route in advance.

Rehearse the asset move once with a small amount. An exit plan that has never moved funds is a guess.

How Guardian Helps

Guardian’s institutional advisory reviews the custodians, bridges, oracles and protocols a bank would depend on, as concentrations of risk.

Findings come back in a form a risk committee, a board or a regulator can read.

For protocol positions, Guardian’s monitoring checks new implementations, proxy changes and parameter updates against what was last reviewed.

The Digital Asset Assurance Pilot is a low-commitment place to start.

Frequently Asked Questions

Does the interagency third-party guidance apply to crypto vendors?

Yes. It covers any business arrangement a bank has with another entity, by contract or otherwise. OCC Interpretive Letter 1184 says banks may use crypto sub-custodians, subject to appropriate third-party risk management practices.

Is a public blockchain a third party?

The guidance does not name chains. It says a relationship can exist without a contract, and the 2025 safekeeping statement points to tracking developments on each supported ledger. Tier and monitor each chain like any other dependency.

How does DORA differ from the US guidance?

DORA is binding EU law, applied from 17 January 2025; the US text is supervisory guidance. DORA firms remain fully responsible, keep a register of all ICT contracts and need tested exit plans for critical or important functions.

Sources

• Federal Register: Interagency Guidance on Third-Party Relationships: Risk Management, 88 FR 37920 (June 9, 2023)
• Federal Reserve, FDIC and OCC: Crypto-Asset Safekeeping by Banking Organizations, joint statement (July 14, 2025)
• OCC: Interpretive Letter 1184, Clarification of Bank Authority Regarding Crypto-Asset Custody Services (May 7, 2025)
• EUR-Lex: Regulation (EU) 2022/2554 (DORA), OJ L 333, 27 December 2022, Articles 28, 29, 30 and 64
• Cornell LII: 23 NYCRR 500.11, Third party service provider security policy (amended effective November 1, 2023)
• Guardian: Institutional
• Guardian: Capital Allocators
• Guardian: Digital Asset Assurance Pilot