Digital Asset Custody: Navigating a Rapidly Evolving Landscape

The digital asset custody landscape is undergoing a profound transformation. The convergence of regulatory clarity, institutional adoption and technological innovation is reshaping how digital assets are safeguarded—and who is trusted to do so.

At the center of this shift is the Office of the Comptroller of the Currency (OCC), which issued Interpretive Letter 1184 on May 7, 2025. This letter reaffirms and expands the authority of national banks and federal savings associations to provide custody services for crypto assets. It clarifies that banks may act in both fiduciary and non-fiduciary capacities, outsource custody and execution services to third parties and use sub-custodians. Perhaps most notably, it confirms that banks may facilitate crypto-to-fiat exchanges and settlement services, provided they maintain robust risk management and compliance frameworks.^1,2

This guidance builds on earlier OCC letters and signals a strong institutional endorsement of crypto custody as a legitimate banking function. It also opens the door for more traditional financial institutions to enter the space, provided they can meet operational and regulatory demands. This means updating third-party risk assessments, enhancing cybersecurity protocols and ensuring that all custody arrangements align with fiduciary obligations under 12 CFR parts 9 and 150.

According to Kim Prior, a partner at Winston & Strawn and co-head of its digital assets practice, “One of the most significant practical implications of Interpretive Letter 1184 is that it paves the way for national banks to offer digital asset wallets and trading through third-party sub-custodians.” Kim also noted, “[w]hile demand for this long-anticipated product is expected to be strong, banks must carefully manage the compliance and operational risks involved.”

Meanwhile, the SEC has taken a significant step by repealing Staff Accounting Bulletin (SAB) 121. Originally issued in 2022, SAB 121 required entities safeguarding crypto assets to record those assets and corresponding liabilities on their balance sheets—even when held on behalf of clients. This accounting treatment created a substantial capital burden for banks and custodians, effectively discouraging many from entering the market. Its repeal via SAB 122 removed this barrier, aligning crypto custody accounting more closely with traditional asset servicing.³

Despite these regulatory advances, misconceptions about digital asset custody persist. One of the most dangerous is the belief that holding private keys equates to legal control or ownership. In reality, custody involves a complex interplay of legal, technical and operational responsibilities. Other myths include the assumption that all custodians offer equal protection, that blockchain transparency eliminates the need for internal controls.⁴ Institutions must now navigate a custody environment that is both more permissive and demanding. The OCC’s pro-custody stance offers new business opportunities, but it also raises the bar for due diligence, vendor oversight and regulatory reporting. This raises the risk for enforcement actions and private litigation. “Regulators are likely to focus on the sub-custodian’s licensing, account segregation practices and complaint resolution protocols. They’ll also scrutinize how digital asset products are advertised and presented to users. The FDIC imposes specific visual requirements for advertising both deposit and non-deposit products—including digital assets—and OCC guidance on retail investment products may also apply,” said Thania Charmani, a partner at Winston & Strawn.

The Future of Crypto Custody for Community Banks and SPDIs

For community banks and smaller institutions, the question is whether they can keep pace. While large national banks could be well-positioned to capitalize on the OCC’s guidance, smaller institutions may struggle with the resource demands of compliance, cybersecurity and vendor management. This raises concerns about a two-tiered custody ecosystem that could exacerbate existing disparities in financial services.⁵

The OCC's recent crypto custody rules may have significant competitive implications for state-chartered trust companies, such as Wyoming's Special Purpose Depository Institutions (SPDIs). These rules create direct competition between national banks and SPDIs, potentially reshaping the custody landscape.

SPDIs were designed to bridge the gap between traditional banking and digital assets. SPDIs operate with full reserves, eliminating riskier fractional-lending and speculative practices common in traditional banks. While not FDIC insured, they are prohibited from lending and must maintain 100% reserves against deposits, making them full-reserve institutions. SPDIs now face increased competition from national banks that can offer similar services. This competition could drive innovation and improve service quality but may also challenge the viability of smaller, specialized institutions.

Anticipated OCC Anti-Money Laundering Guidance

A critical component will be the integration of anti-money laundering (AML) compliance into the operational frameworks of banks engaging in digital asset services. As the crypto ecosystem matures, so does the regulatory expectation that institutions will implement robust AML controls tailored to the unique risks of digital assets.

The Financial Crimes Enforcement Network (FinCEN) has long emphasized the importance of safeguarding the financial system from illicit finance threats, and its advisories frequently address vulnerabilities in the crypto sector.⁶ As such, any future OCC guidance is likely to be developed in close coordination with FinCEN to ensure that AML compliance is not only preserved but strengthened as banks expand their crypto offerings. “The appropriate governance, policies and procedures and monitoring of transactional activity for digital assets will need to be designed and implemented prior to offering these products,” according to Tom Bock, Head of Kroll’s Financial Crime and Advisory practice.

Path for Broker-Dealer Crypto Custody: Latest Move Signals Regulatory Shift

On May 15, 2025, the SEC and FINRA withdrew their 2019 Joint Staff Statement on broker-dealer custody of digital asset securities, signaling a regulatory shift toward greater clarity and flexibility in crypto asset custody. Simultaneously, the SEC’s Division of Trading and Markets issued a new set of FAQs addressing how existing broker-dealer financial responsibility and transfer agent rules apply to crypto asset activities and distributed ledger technologies. The FAQs clarify that Rule 15c3-3’s possession and control requirements apply only to securities, excluding non-security crypto assets such as bitcoin and ether. They also affirm that broker-dealers may facilitate in-kind creations and redemptions for spot crypto exchange-traded products (ETPs) and that transfer agents may use distributed ledger technology for official recordkeeping. The FAQs and related staff guidance note that digital assets not registered under the Securities Act of 1933 are not protected under the Securities Investor Protection Act (SIPA). In such cases, customer claims would be treated as general creditor claims in broker-dealer liquidation.⁷

These developments are widely viewed as a foundational step toward institutional adoption of crypto custody. While the FAQs do not resolve all regulatory uncertainties, they provide much-needed regulatory clarity for broker-dealers and transfer agents navigating the evolving digital asset custody landscape. The withdrawal of the 2019 statement and the new guidance are expected to encourage broader participation by traditional financial institutions in crypto markets, aligning regulatory expectations with technological innovation and market demand.

Neel Maitra, Partner at Dechert and former crypto specialist in the SEC’s Division of Trading and Markets, says, “Restrictions around broker-dealer custody of crypto asset securities deprived markets of securities of liquidity, effectively making them unviable. The withdrawal and the FAQs can inject new life into those markets, and so does the SEC’s recognition that broker-dealers can custody and trade crypto non-securities such as bitcoin.”

Insights from the SEC’s ‘Know Your Custodian’ Roundtable

The SEC's Crypto Task Force roundtable held on April 25, 2025, titled 'Know Your Custodian,' brought together regulators, legal experts and industry leaders to discuss the evolving landscape of crypto custody. Commissioner Mark Uyeda emphasized the importance of aligning crypto custody practices with investor protection principles. The roundtable highlighted the challenges of adapting traditional broker-dealer frameworks to crypto assets. The SEC’s recent position suggests a growing recognition of the need for tailored custody frameworks that reflect the unique characteristics of digital assets. Commissioner Mark Uyeda emphasized that crypto custody must be treated with the same rigor as traditional asset protection and called for greater flexibility in allowing state-chartered trust companies to serve as qualified custodians in compliance with Rule 206(4)-2 under the Advisers Act (known as the “Custody Rule”).⁸

Furthermore, SEC Chairman Paul Atkins, in a keynote address on May 12, 2025, outlined his top crypto priorities: establishing a rational regulatory framework, enhancing clarity for market participants and fostering innovation in custody solutions. He supports expanding flexibility in registrants’ custody crypto assets and welcomed the rescission of Staff Accounting Bulletin No. 121, which he criticized as regulatory overreach.

Atkins also urged the SEC to clarify what qualifies as a “qualified custodian” and to allow reasonable exceptions, particularly for self-custody solutions using advanced technology. He advocates replacing the restrictive “special purpose broker-dealer” (SPBD) framework and clarifying how customer protection and net capital rules apply to crypto custody.⁹ Notably, the SEC’s May 15 withdrawal of the 2019 Joint Staff Statement and the accompanying FAQs aim to address longstanding industry concerns by clarifying that the SPBD framework is not mandatory for broker-dealers seeking to custody crypto asset securities. Instead, broker-dealers may demonstrate compliance with Rule 15c3-3 through alternative means, thereby broadening the regulatory pathways available for digital asset custody.

The SEC’s Shift toward Self-Custody and Direct Ownership

For a long time, starting around 1994, the U.S. financial system moved away from letting people directly own their stocks. Traditionally, investors held securities directly, with their names recorded on issuer registers. Now instead of owning the actual shares, people basically get IOUs from financial institutions (like banks or brokerages), saying, “We’re holding these shares for you.” This system was formalized in a law called UCC Article 8, which made indirect ownership the norm.¹⁰

Critics believe that change took away real ownership rights from individuals and handed too much control to middlemen. They call this one of the biggest “thefts” of property rights ever, because you no longer owned the stock directly—just a promise that someone else was holding it for you. Per Caitlin Long, Founder and CEO of Custodia Bank, “I’ve long referred to UCC Article 8 as probably the biggest theft of property rights in human history because it turned stocks into IOUs (i.e., credit instruments) instead of directly held investments (i.e., property, not an IOU)”.¹¹

In a recent speech on June 9, 2025, Chairman Paul Atkins remarked at the Crypto Task Force Roundtable on Decentralized Finance, “Another core feature of blockchain technology is the ability for individuals to have self-custody of crypto assets in a personal digital wallet. The right to have self-custody of one’s private property is a foundational American value that should not disappear when one logs onto the internet. I am in favor of affording greater flexibility to market participants to self-custody crypto assets, especially where intermediation imposes unnecessary transaction costs or restricts the ability to engage in staking and other on-chain activities.”¹²

This kind of “self-custody” is seen as a return to foundational property rights. The SEC appears to be reversing that system, signaling a shift toward enabling direct ownership of digital assets without intermediaries. This shift challenges the long-standing system established by UCC Article 8, which has traditionally required assets to be held through intermediaries, effectively turning direct ownership into a form of credit relationship. This could eventually enable individuals to hold digital stocks directly, eliminating the need for intermediaries. Atkins went on to say, “I do not believe that we should allow century-old regulatory frameworks to stifle innovation with technologies that could upend and most importantly improve and advance our current, traditional intermediated model.”

The CLARITY Act

The Digital Asset Market Clarity (CLARITY) Act is a bipartisan bill introduced in May 2025 to resolve the persistent regulatory ambiguity surrounding digital assets in the U.S. It aims to clearly define the roles of the SEC and Commodity Future Trading Commission (CFTC), define key terms, establish regulatory frameworks for exchanges, stablecoins and DeFi, and position the U.S. as a global leader in digital asset regulation. The bill is currently under committee review in Congress and has garnered strong bipartisan support. A key motivation behind the legislation is to prevent crypto firms from relocating overseas due to unclear or conflicting U.S. regulations. The CLARITY Act aims to ensure that financial innovation and development of digital assets occurs in the U.S. House Committee on Financial Services Subcommittee on Digital Assets, Financial Technology and Artificial Intelligence Chairman Bryan Steil said during the announcement of the bipartisan CLARITY Act, “Our bill secures American dominance, democratizes digital assets, unleashes innovation and protects consumers from fraud.”

The CLARITY Act addresses digital asset custody by expanding the definition of “qualified custodian” to include CFTC-registered entities, thereby allowing both banks and non-bank institutions, such as trust companies and SPBDs, to serve as custodians. Section 105 of the CLARITY Act directs the SEC and CFTC to jointly establish rules governing custody, including requirements for the segregation of customer assets, operational risk controls and disclosure standards. Additionally, Section 310 prohibits federal regulators from requiring custodians to treat customer digital assets as liabilities on their balance sheets or to hold additional capital against them. The compliance timeline grants regulators 270 days from enactment to finalize these rules, followed by a 180-day implementation period for firms.

Developing effective regulatory frameworks for over 19,500 cryptocurrencies and determining the appropriate regulatory body is an inherently complex and evolving challenge. At 236 pages, the CLARITY Act is a complex bill, and it is unclear how many members of Congress currently fully understand its provisions and implications. Former CFTC Chair Timothy Massad warned that the CLARITY Act’s complexity could render it both obsolete and counterproductive. He argued that its detailed provisions are likely to become outdated as technology evolves, and more critically, that the bill could “generate massive exploitation of its provisions and regulatory arbitrage”.¹³

The Exchanges: Gaps, Exits and Collapses

While exchanges like Coinbase and Gemini are often described as “unregulated,” they are in fact subject to a complex and fragmented U.S. regulatory regime. For example, both are registered as Money Services Businesses (MSBs) with FinCEN and hold state-level Money Transmitter Licenses (MTLs), with Gemini also operating under New York’s stringent BitLicense. However, the absence of a unified federal framework, where oversight is codified among the SEC, CFTC and state regulators, has created significant regulatory ambiguity. Under SEC Chair Gary Gensler, the agency’s approach of “regulation by enforcement” further deepened this uncertainty, discouraging proactive compliance and driving many exchanges and digital asset firms to relocate overseas in search of clearer, more predictable regulatory environments. This lack of cohesive oversight enabled entities like FTX, Voyager and Celsius to exploit jurisdictional gaps, operate with minimal scrutiny, and ultimately collapse, causing widespread investor harm and prompting renewed calls for comprehensive U.S. crypto regulation.

Risks Associated with Only One Primary Custodian for Bitcoin ETFs

As the digital asset custody landscape evolves, one emerging concern is the concentration of custodial services for bitcoin ETFs. Coinbase, a leading cryptocurrency exchange, has positioned itself as the primary custodian for several bitcoin ETFs. While this centralization offers operational efficiencies, it also introduces significant risks.

The primary risk is systemic vulnerability. If Coinbase were to experience a security breach, operational failure or regulatory action, the impact could be widespread, affecting multiple ETFs and their investors simultaneously. This concentration risk is particularly acute given the volatile nature of the cryptocurrency market and the evolving regulatory environment.

Blackrock recently added Anchorage Digital, a federally chartered digital asset bank, as a custodian for some of the cryptocurrency that backs its crypto ETFs. The iShares IBIT Bitcoin ETF is the largest crypto ETF, and until recently Coinbase Custody Trust was the primary crypto custodian. Anchorage is currently the only federally chartered digital asset bank.¹⁴

Custody Risks of a U.S. Government Bitcoin Reserve

A key advantage of the U.S. government establishing a bitcoin national reserve is the strategic benefit of early adoption in securing a scarce, decentralized asset. Bitcoin’s fixed supply (capped at 21 million coins) and its robust security profile make it a compelling store of value, often referred to as “digital gold.” By being among the first nations to formally establish a sovereign bitcoin reserve, the U.S. could potentially position itself to benefit from bitcoin’s long-term appreciation and its potential role in the future global financial system. This move is framed as analogous to managing other national resources, with the aim of leveraging digital assets to advance national prosperity.¹⁵ 

However, if the U.S. government or other state authority were to hold bitcoin reserves, the assets could quickly become a political football—subject to shifting regulatory interpretations, executive orders or changing policy priorities. Political transitions or simple administrative missteps could lead to mismanagement or even forced liquidation of these reserves under duress. This risk is compounded by the potential for perceived conflicts of interest. If retail customers lose money in crypto held at banks—like in the collapses of FTX or Celsius—while the government simultaneously holds bitcoin, it could create political pressure to use those reserves to make customers whole. Public trust in the government’s ability to manage digital assets could erode, especially if its custodial practices mirror the same failures seen in the private sector. Policymakers will need to consider codifying legal safeguards, segregating reserve funds, ensuring transparent oversight and establishing an independent custodial authority to prevent misuse and uphold public trust.

When Custody Fails

The importance of robust custody arrangements cannot be overstated. History has repeatedly demonstrated that failures in custody can result in catastrophic financial losses, undermine investor confidence and destabilize entire markets. Two of the most notorious financial collapses, Bernie Madoff’s Ponzi scheme and the implosion of FTX, serve as stark reminders.

In Madoff’s case, the absence of independent custodial oversight enabled fraudulent activity to persist undetected for years, ultimately leading to losses exceeding $60 billion. Similarly, FTX’s collapse was characterized by a complete breakdown in custodial discipline, where customer assets were co-mingled and misappropriated without adequate controls or transparency.

These were not isolated lapses in judgment, they reflected deep structural flaws in custody implementation and a lack of effective regulatory oversight. Notably, FTX operated outside the U.S., in part to avoid the fragmented and ambiguous regulatory environment surrounding digital assets domestically. SEC Commissioner Hester Peirce remarked that the U.S. had “dropped the ball,” on crypto regulation and she says the “knock-on effects” of that failure keep her up at night.¹⁶

As digital assets become more integrated into the financial system, the stakes are even higher. Unlike traditional assets, crypto holdings are often bearer instruments, meaning that whoever controls the private keys effectively controls the assets. This makes the role of the custodian not just operational, but existential. Institutions must therefore treat custody as a core pillar of risk management, not a back-office function. They must demand transparency, enforce segregation of assets and implement rigorous internal controls. However, if regulation becomes overly complex, it risks producing the opposite of its intended effect, inviting regulatory arbitrage. Complex legislation often becomes fertile ground for legal workarounds, with firms investing heavily in exploiting ambiguities to minimize compliance obligations. Getting custody rights is not just about compliance, it’s about trust, accountability and the long-term viability of the digital asset ecosystem.

Digital asset custody is no longer a theoretical concern. It is here, it is regulated and it demands a new level of operational and legal sophistication. Those who rise to the challenge will help shape the future of finance.

If you would like to discuss any aspect of this article, please reach out to us or your usual Kroll contact.

 

Sources:
¹ Office of the Comptroller of the Currency. (2025). Interpretive Letter 1184. Retrieved from https://www.occ.gov/topics/charters-and-licensing/interpretations-and-actions/2025/int1184.pdf
² Banks Crypto Custody Stablecoin OCC. Retrieved from https://beincrypto.com/banks-crypto-custody-stablecoin-occ/
³ JD Supra. (2025). SEC Staff Withdraws Statement on Broker-Dealer Custody of Digital Asset Securities. Retrieved from https://www.jdsupra.com/legalnews/sec-staff-withdraws-statement-on-broker-7435207/)
⁴ Forbes Technology Council. (2025). Five Misconceptions About Custody That Could Put Institutional Digital Assets At Risk. Forbes. Retrieved from https://www.forbes.com/councils/forbestechcouncil/2025/05/20/five-misconceptions-about-custody-that-could-put-institutional-digital-assets-at-risk/).
⁵ Evans, T. (2025). Can Community Banks Keep Up With The OCC's New Pro-Crypto Custody Rules? Forbes. Retrieved from https://www.forbes.com/sites/tonyaevans/2025/05/19/can-community-banks-keep-up-with-the-occs-new-pro-crypto-custody-rules/.
⁶ Financial Crimes Enforcement Network. (2025). Anti-Money Laundering Compliance for Cryptocurrency-Related Activities. Retrieved from https://www.fincen.gov/resources/advisories/fincen-advisory-fin-2025-a001
⁷ U.S. Securities and Exchange Commission. (2019, July 8; withdrawn 2025, May 15). Joint staff statement on broker-dealer custody of digital asset securities. https://www.sec.gov/newsroom/speeches-statements/joint-staff-statement-broker-dealer-custody-digital-asset-securities 
⁸ Uyeda, M. T. (2025, April 25). Remarks at the Crypto Task Force Roundtable on Custody. U.S. Securities and Exchange Commission. https://www.sec.gov/newsroom/speeches-statements/uyeda-remarks-crypto-task-force-roundtable-custody-042525
⁹ Atkins, P. S. (2025, May 12). Remarks at the SEC Crypto Roundtable on Tokenization. U.S. Securities and Exchange Commission. https://www.sec.gov/newsroom/speeches-statements/atkins-remarks-crypto-roundtable-tokenization-051225#_ftnref10
¹⁰ Financial Markets Law Committee. (2012, October). Background paper on Article 8 of the Uniform Commercial Code. https://fmlc.org/wp-content/uploads/2018/02/Issue-3-Background-paper-on-Article-8-of-the-Uniform-Commercial-Code.pdf
¹¹ Long, Caitlin. (2025, June 10). LinkedIn. https://www.linkedin.com/feed/update/urn:li:activity:7337919409862127616/
¹² Atkins, P. S. (2025, June 9). Remarks at the Crypto Task Force Roundtable on Decentralized Finance. U.S. Securities and Exchange Commission. https://www.sec.gov/newsroom/speeches-statements/atkins-remarks-defi-roundtable-060925
¹³ Massad, T. (2025, June 5). Testimony on the CLARITY Act before the U.S. House Financial Services Committee. U.S. House Committee on Financial Services. https://democrats-financialservices.house.gov/uploadedfiles/06052025_massad_clarity_act_house.pdf
¹⁴ Ledger Insights. (2025, April 9). BlackRock diversifies crypto custodians to include Anchorage Digital. https://www.ledgerinsights.com/blackrock-diversifies-crypto-custodians-to-include-anchorage-digital/
¹⁵ The White House. (2025, March 6). Establishment of the Strategic Bitcoin Reserve and United States Digital Asset Stockpile. https://www.whitehouse.gov/presidential-actions/2025/03/establishment-of-the-strategic-bitcoin-reserve-and-united-states-digital-asset-stockpile/