The OCC Authorizes Cryptocurrency Custody

Introduction

On July 22, 2020, the OCC published an interpretive letterⁱ authorizing national banks and federal savings associations regulated by the agency to custody digital assets (also referred to by the OCC as cryptocurrencies, digital currencies, or virtual currencies) on behalf of their clients. Interpretive letters address legal and banking questions and provide legal interpretations and final enforcement decisions. While the OCC has not prohibited the institutions it regulates from engaging in digital asset custody, this is the first time it has provided a formal statement and clear guidance allowing banks to engage in the activity. The lack of guidance to date is a core reason that nationally chartered institutions have remained on the sidelines when it comes to providing digital asset services.

What is the OCC?

The Office of the Comptroller of the Currency (OCC) is an independent bureau within the United States Department of the Treasury that charters, regulates and supervises national banks and savings associations to ensure a safe, sound and fair banking system. The bureau was created by the National Currency Act of 1863 (later amended by the National Bank Act) to oversee a national banking system. The OCC is the primary regulator of banks chartered under the National Bank Act and federal savings associations chartered under the Home Owners' Loan Act. Institutions that seek to be nationally chartered (i.e. to build a nationwide branch networkⁱⁱ) must undergo an in-depth application process with the OCC. The OCC regulates almost 1,200 institutions that hold $12.9 trillion in total assets, almost 70% of all U.S. commercial banking assets.ⁱⁱⁱ A few of the largest national banks include JPMorgan Chase Bank, N.A., Bank of America N.A., and Wells Fargo Bank, N.A.^iv

The OCC is led by the Comptroller of the Currency. The Comptroller of the Currency is the administrator of the federal banking system and chief officer of the OCC. The Comptroller is also a director of the Federal Deposit Insurance Corporation and a member of the Financial Stability Oversight Council and the Federal Financial Institutions Examination Council. Brian P. Brooks is the current Acting Comptroller. Brian joined the OCC in March 2020 as chief operating officer (second in command) and took office as Acting Comptroller upon resignation of the former Comptroller (Joseph Otting) at the end of May 2020. Prior to joining the OCC, Brian was Chief Legal Officer at Coinbase, a crypto company that provides retail and institutional clients with trading, custody, payment, and other services for digital assets.

"As the administrator of the federal banking system we have a responsibility to defend the authority and the powers Congress granted that enable the federal banking system to evolve, to harness the power of rapidly changing technologies and financial markets, to support a nationwide economy, and to serve local needs." Brian P. Brooks (emphasis our own)^v

What does the interpretive letter say?

On July 22, 2020, the OCC issued an interpretive letter in response to a request by an unidentified bank and concluded that OCC-regulated institutions are authorized to custody cryptocurrencies in a fiduciary or non-fiduciary capacity, given that cryptocurrency custody is an extension of existing custody services that banks provide for physical and electronic assets.

The OCC originally deemed key escrow services and encrypted storage of electronic materials as activities that fall within "the business of banking" in 1998 and again in 2001, highlighting that these services "involve the use of modern technology to perform the established banking function of safekeeping." In the July 2020 interpretive letter, the agency referenced Conditional Approval #267 (1998) and Conditional Approval #479 (2001) and reiterated that cryptocurrency custody falls in the purview of traditional banking activities.

"The OCC has found that the authority to provide safekeeping services extends to digital activities and, specifically, that national banks may escrow encryption keys used in connection with digital certificates because a key escrow service is a functional equivalent to physical safekeeping."^vii

The letter highlighted three key reasons that there may be demand for banks to provide cryptocurrency custody services – cryptographic keys associated with digital assets are irreplaceable if lost or stolen, banks can offer secure custody services, and investment advisers that manage assets on behalf of clients may wish to hold assets at a national bank. The OCC articulated that banks should establish appropriate processes, controls, risk management, and security practices to abide by the rules laid out in the Comptroller's Handbook on Custody Services.

The letter also reinforced that nationally chartered banks and institutions may provide financial services to compliant digital asset businesses. Earlier this year, JPMorgan Chase started banking Coinbase and Gemini – the firm's first clients from the digital asset industry.^viii However, traditional banks have been skeptical about providing services to digital asset businesses given the regulatory uncertainty with the customer segment. The recent interpretive letter validated JPMorgan's decision, saying, "as the federal banking agencies have previously stated, banks are encouraged to manage customer relationships and mitigate risks based on customer relationships rather than declining to provide banking services to entire categories of customers."^ix

What are the implications of the letter?

Regulatory clarity and legitimization

Regulatory ambiguity has been a big obstacle to adoption and acceptance by traditional investors and service providers. Almost 40% of U.S. investors surveyed in our second institutional investor digital assets study cited concerns around regulatory dissatisfaction as a factor preventing them from making an investment in digital assets.^x Traditional financial institutions have refrained from providing digital asset-related services to avoid engaging in activities that the OCC may prohibit down the line. The lack of authoritative guidance, especially by federal regulators, has been an impediment to the maturation of the industry. The OCC's July 2020 interpretive letter represents a major step forward in increasing the comfort of traditional institutions with digital assets. To the extent that institutions regulated by the OCC actually provide digital asset custody services, a greater number of investors and users may also be more comfortable trading, holding and engaging with digital assets via intermediaries held to the strict regulatory standards of a federal agency in charge of administering the banking system in the United States.

While there are multiple regulated digital asset custodians that are state chartered trust companies from states such as New York, South Dakota, and Nevada, there are no federally regulated custodians for digital assets. An important advantage that national banks have is state pre-emption, or the ability to eliminate the process of obtaining state by state money transmitter licenses to serve clients throughout the United States.

The growth in involvement by traditional and regulated firms such as CME, Bakkt, J.P. Morgan, Susquehanna, Jump, Jane Street, Square, Fidelity Digital Assets, and more has had a substantial impact in legitimizing the industry in the eyes of investors and has attracted large institutional investors. Financial institutions are recognizing they can't ignore the digital asset industry and the recent OCC interpretive letter could add more fuel to the fire. Digital assets present a new revenue generating opportunity for traditional financial institutions who have clients that are increasingly inquiring about digital assets products and services.

Custody options for retail clients

The regulated custody landscape for institutional investors has evolved substantially in the last few years. Custody providers focus on institutional investors such as mutual funds, investment managers, family offices, public and private retirement plans, registered investment advisers, insurance companies, corporations, endowments, and foundations that face regulations and legal obligations that define their fiduciary responsibilities.^xi Initially, although platforms (especially exchanges to buy and sell digital assets) emerged to serve retail clientele, the lack of retail-specific custody platforms can be explained by the fact that retail investors don't have regulatory obligations to store their assets at regulated custodians.

While certain retail-focused exchanges leverage their institutional custody offerings to safeguard the assets of retail clients, other retail-focused platforms are not built for robust long-term custody and storage, as demonstrated by exchange hacks. In 2019, Chainalysis identified eleven exchange hacks resulting in $283 million in digital assets stolen.^xii While the total amount stolen declined year over year, indicating that exchanges are improving in responding to attacks, the number of hacks has since increased.

Thus, retail investors must evaluate the security and protections of custodial wallets and service providers independent of the exchanges where they trade or educate themselves about self-custody. Self-custody is a concept that is unique to digital assets and aligns with the ethos of the industry – we've heard the saying "not your keys, not your coins." However, self-custody can be complex and expensive, though economic options that are easier to implement are increasingly available.

What is important is that digital asset holders have the choice to self-custody or store assets securely on a third-party platform. If OCC-regulated institutions end up offering digital asset custody, their retail clients may have access to digital asset custody on familiar and regulated platforms that are subject to the OCC's supervisory and examination requirements.

Sub-custody and M&A opportunities

The security and risk management associated with the custody of digital assets is distinct from the custody of traditional assets such as stocks and bonds. Unlike traditional assets, digital assets are bearer instruments in which ownership is designated by a public/private key pair – if the private key is lost or stolen, it cannot be recovered. Establishing secure storage and management of private key material is of utmost importance and presents unique challenges compared to accounting for stocks and bonds that may be recovered. The safekeeping of digital assets is relatively more technical, requiring specialized expertise, especially in cryptography, cybersecurity, and software and hardware engineering, combined with robust risk management and operational processes common to the regulated financial services industry.

Given what's at stake, the initial priority of multiple digital asset service providers has been to perfect digital asset custody, spending years researching and evolving the techniques and processes necessary to offer secure storage of digital assets. Thus, financial institutions looking to go-to-market in a timely manner, without expending significant resources, may choose to work with existing digital asset custody providers to provide a white-label digital asset custody solution. The advantage to the sub-custodian is the ability to scale their offering to an entirely new market and generate new revenue opportunities beyond custody.

Financial institutions may also decide that the acquisition of an existing crypto-native custody provider is the best go-to-market strategy versus building or sub-custody. The acquisition target benefits from access to new resources, clientele and regulatory licenses and freedoms. One challenge is that there may be potential differences in culture between a traditional financial institution and a digital asset custodian.

Considerations

While clarity from a major regulator is an important first step in encouraging these regulated institutions to offer digital asset custody services, certain factors are worth considering that may determine whether and how quickly these institutions roll out support for digital assets.

An important highlight from the letter is that banks must consult the OCC before undertaking cryptocurrency custody, in accordance with its "ordinary supervisory processes."^xiii While the OCC has said that it is within the definition of a bank to provide cryptocurrency custody, the regulator recommends that banks engage with the OCC prior to entering the space. An unanswered question is whether banks will need approval from other federal regulators that they interface with (such as the Federal Deposit Insurance Corporation and Federal Reserve).

Additionally, many OCC-regulated institutions are likely still early in their education on digital assets. In order to speak to customers comfortably about digital assets, let alone offer digital asset services, they may need to spend time learning before deciding to enter the industry. Financial institutions must also tackle the lack of internal consensus on digital assets that may slow down the process. Certain executives and analysts at major financial institutions have spoken out against digital assets in the past, but their opinions may not be representative of the entire organization and vice versa. Coordinating stakeholder approval to support digital assets may be a non-trivial task. 

Another consideration that Caitlin Long, founder and CEO of Avanti, highlighted in her conversation with Anthony Pompliano, Co-Founder and Partner at Morgan Creek Digital and host of the Pomp Podcast, is that establishing a new business line that is material relative to the other activities of the bank may require the regulator to review the institution's business plan and the impact the new activity will have on the bank and its customers from a safety and soundness perspective. The choice to offer cryptocurrency custody is not a decision that a national bank can make in a vacuum. They must assess what impact, if any, the decision could have on the existing business.

Conclusion

Combined with other positive regulatory developments, such as the appointment of Hester Peirce (a long-time advocate for the industry) for a second term at the SEC^xiv and the announcement by the CFTC to develop a holistic digital asset regulatory framework by 2024^xv, the news that banks may custody digital assets is a positive move in the legitimization and maturation of the industry and one that speaks to the staying power of digital assets.