On July 22, 2020, the Office of the Comptroller of the Currency (“OCC”), the primary federal regulator for national banks and federal thrifts (collectively “Banks”), issued Interpretive Letter #1170 (the “Letter”). The Letter clarifies that Banks have the legal authority to provide custody services for cryptocurrency assets as a service to customers.
The OCC Staff issued the Letter in response to an inquiry from a Bank regarding offering cryptocurrency custody services to its customers. As published the Letter does not identify the inquiring party but importantly, while the Letter does not have the force of a formal regulation, it applies by its terms to all Banks.
In the Letter, the OCC Staff clarifies that the Bank may provide “cryptocurrency custody services to its customers” and has the power to take possession of the cryptographic access keys to given units of cryptocurrency owned by its customers, whether the keys that are held in hot or cold wallets, in paper form or in hardware form.
The OCC Staff’s reasoning is straightforward and in many respects not surprising. Banks have long been able to provide custody services for customers relating to physical assets, such as when a Bank holds customer documents, jewelry, or other valuables in safe deposit boxes. Over recent decades, the OCC has extended the powers of Banks to provide custody services from this physical type of custody to electronic custody of digital assets. For example, for decades national banks have been permitted to hold encryption keys used in connection with digital certificates, and have been permitted to provide “secure Web-based document storage and retrieval of documents and files containing personal information or valuable confidential trade or business information.” Pursuant to existing OCC guidance, Banks may also provide custody services with respect to assets that transfer electronically, such as book-entry securities. In the Letter the OCC Staff concludes that Banks have the legal authority to provide custody of cryptocurrencies consistent with longstanding abilities of Banks to provide custody services, physical or digital.
The Letter indicates that the OCC intends to review Banks’ cryptocurrency custody activities only as part of its ordinary supervisory processes. Nonetheless the OCC Staff recognizes that custody of cryptocurrencies may present unusual requirements and create unusual risks. The Letter lays out a number of requirements related to systems, controls, and procedures that a Bank must consider before providing cryptocurrency custody services. Notably, these requirements include having adequate internal controls to safeguard the assets under custody, as well as a due diligence process for customer onboarding that includes a review for compliance with AML requirements.
S&K Observations and Insights
As the OCC Staff’s analysis suggests, there has been little doubt that Banks have the legal authority to custody cryptocurrency (and other digital assets). Banks, however, have been uncertain about the OCC’s position on whether they could feasibly provide custody services relating to cryptocurrencies at all, in a manner consistent with their general safety and soundness obligations. The Letter says that they can (even though it only addresses Banks holding private keys as opposed to the cryptocurrency themselves, see below). Whether Banks will begin to offer such services in significant magnitudes remains unclear, and will depend on whether Banks consider custody of cryptocurrency for customers to fit with their business models and whether they can effectively manage risks, such as AML risks, that will accompany such services in accordance with their safety and soundness obligations with respect to each asset and customer.
The Letter only directly affects the roughly 1,100 Banks that are federally chartered. It does not directly affect more than 4,000 other banks in the United States whose powers derive from state law. Some state-chartered trust companies already provide custody services relating to cryptocurrencies, including in South Dakota. Wyoming’s banking regulator has promulgated regulations permitting custody of digital assets by Wyoming-chartered banks. It remains unclear whether more state banking regulators will make similar determinations as the OCC Staff have made in the Letter with regard to custody of cryptocurrency, but the Letter may encourage some state regulators to follow suit.
With respect to the federal securities laws, the Letter refers to the fact that Banks are qualified custodians for assets managed by registered investment advisers. The Letter is silent, however, with respect to broker-dealers. The Division of Trading and Markets of the SEC has been unwilling to agree that that a broker-dealer holding a private key can “hold in possession or control digital asset securities” in a manner consistent with relevant SEC rules under the Securities Exchange Act. The Letter does not appear to change this aspect of the current landscape, that broker-dealers remain unable to hold digital asset securities in custody.
Nonetheless, as the Letter indicates, there is demand in the cryptocurrency industry for custody services from Banks. The OCC Staff offered three reasons: (1) Banks may be able to provide more security than some other current options for holders of cryptocurrency, such as state-registered cryptocurrency exchanges, (2) Banks can provide a way for customers to ensure they do not lose access keys enabling them to access their cryptocurrency, and as discussed above, (3) Banks can act as qualified custodians for assets managed by registered investment advisers. The Letter could increase the number of Banks offering custody services for cryptocurrency, and indirectly could potentially increase uptake and use of cryptocurrency generally.
Even though the Letter was not issued as a formal notice-and-comment rulemaking, it should serve as an important signal that the OCC supports Banks providing services to the cryptocurrency industry and that Banks may be able to provide additional safety and security for customers holding cryptocurrencies. It may provide a path for Banks that have thus far been hesitant to provide custody services for cryptocurrencies to begin to evaluate the benefits of providing such services for their businesses, and to plan appropriate policies and procedures and to evaluate appropriate risk management measures to be able to provide its customers with custody services for cryptocurrencies.
* * * * *
We will continue to follow developments closely in this space, including as it relates to those in the virtual currency industry. If you have any questions regarding the implications of this ruling, please contact Paul Clark (202-661-7145 or clark@sewkis.com), Nathan Brownback (202-661-7156 or brownback@sewkis.com) or any attorney in Seward & Kissel’s Blockchain & Cryptocurrency Group.
