Can your bank hold your crypto? What changed for US banks in 2025

Until 2025, a US bank that wanted to hold crypto for customers had to clear extra steps first: its federal regulator expected advance notice or a formal non-objection, and SEC staff had issued specific accounting guidance for companies holding crypto for others. In 2025 that changed: the bank regulators removed their special steps one by one, and the SEC staff withdrew the guidance.

This guide explains what changed, what a bank has to do when it holds crypto for you, and what protection you do and don’t get. For your other options, see hot vs cold wallets and is your crypto insured?

What “custody” means

In their July 2025 joint statement, the Federal Reserve Board, the FDIC and the OCC define safekeeping as the service of holding an asset on a customer’s behalf. For crypto, that means controlling the cryptographic keys associated with the asset, in a way that complies with the law.

The statement says banks can provide safekeeping in a fiduciary capacity, for example as a trustee or an investment adviser, or a non-fiduciary one, where the terms are set by the client contract.

The 2025 timeline

The SEC’s accounting change

SAB 121 was SEC staff guidance titled Accounting for Obligations to Safeguard Crypto-Assets an Entity Holds for its Platform Users. SAB 122 rescinded it with effect from 30 January 2025.

Since then, a company with an obligation to safeguard crypto for others decides whether to record a liability for the risk of loss by applying the general accounting rules for contingencies: FASB ASC Subtopic 450-20 in the US, or IAS 37 for companies using international standards.

The bank regulators’ changes

Banks in the US answer to different federal regulators depending on their charter, which is why three agencies acted separately:

• OCC (national banks and federal savings associations): Interpretive Letter 1183 removed the requirement to receive supervisory non-objection and demonstrate adequate controls before starting these activities. The OCC said it expects banks to have the same strong risk management controls for novel activities as for traditional ones.
• FDIC (state banks that aren’t Fed members): FIL-7-2025 says its banks may engage in permissible crypto-related activities without prior FDIC approval, provided they adequately manage the associated risks.
• Federal Reserve (state member banks): the Board said it will monitor banks’ crypto activities through the normal supervisory process instead of advance notification.

In May 2025, the OCC’s Interpretive Letter 1184 went further on custody. It confirmed that banks may buy and sell assets held in custody at the customer’s direction, and may outsource crypto activities, including custody and execution, to third parties, including through a sub-custodian, with appropriate third-party risk management.

What a bank has to get right

The July 2025 joint statement says it doesn’t create new supervisory expectations. Instead, it explains how existing rules and risk-management principles apply. The main points:

• Key control. The statement calls the compromise or loss of keys one of the primary risks, and says the bank could be held liable for customers’ losses. A bank generally has control when no other party, including the customer, has enough information to move the crypto out of the bank’s control on their own.
• Taking real control. To establish control, a bank will usually require the crypto to be transferred to it on the blockchain. Simply taking possession of existing keys may not be enough, since a customer may have kept copies.
• Sub-custodians. The same control standards apply to any sub-custodian the bank uses.
• Key generation and backups. Secure generation of keys, and contingency plans for lost or compromised keys.
• Cybersecurity as a key focus, given the operational risks.
• Reviewing each asset before holding it, since different crypto assets may need different key management.
• Account structure. Considering the risks of omnibus versus separate accounts.
• Compliance. The usual anti-money laundering, counter-terrorist financing and OFAC sanctions requirements apply, including identity checks and suspicious activity reporting.

What this means for you

More choice, not more insurance. Bank custody adds an option alongside exchanges and your own wallet. But the FDIC is clear that deposit insurance applies to products such as checking accounts, savings accounts and certificates of deposit, and doesn’t apply to crypto assets. It also says FDIC insurance doesn’t protect against the failure of non-bank firms such as crypto custodians, exchanges and wallet providers. See is your crypto insured?

What the FDIC does cover is cash in deposit accounts at an insured bank, such as the dollars in a checking account you use to buy crypto, up to $250,000 per depositor, per ownership category, at each bank. The crypto itself isn’t a deposit.

Questions to ask a bank before using its service:

1. Does it hold the crypto as a fiduciary or under a custody contract?
2. Are customers’ assets in an omnibus account or held separately?
3. Does it use a sub-custodian, and who is it?
4. What happens if keys are lost or compromised, and who bears the loss?
5. What are the fees, and can you withdraw the crypto to your own wallet?

If a provider tells you your crypto is “FDIC-insured”, treat it as a warning sign and ask for the details in writing. For what happens when a crypto firm fails, see crypto exchange bankruptcy.