Bitcoin custody for community banks stopped being a question of permission during 2025. Between March and May of that year the OCC, the FDIC and the Federal Reserve each withdrew the approval or notification steps they had added in earlier years. What they left in place is the ordinary expectation that a bank understands a new activity, controls it, and can prove both.
That shifts the work from the regulator's desk to the boardroom. This guide sets out what changed, what examiners mean when they talk about control, the three operating models open to a smaller bank, and a sequence for getting from first discussion to a pilot.
Permission is settled, supervision is not
Four documents define the current position.
- OCC Interpretive Letter 1183, March 7, 2025. Confirms that national banks and federal savings associations may provide crypto-asset custody, and removes the earlier requirement to obtain supervisory nonobjection first.
- OCC Interpretive Letter 1184, May 7, 2025. Confirms that those banks may buy and sell assets held in custody at the customer's direction, and may outsource custody and execution to third parties, including a sub-custodian, subject to appropriate third-party risk management. The OCC release summarizes it.
- FDIC FIL-7-2025, March 28, 2025. States that FDIC-supervised institutions may engage in permissible crypto-related activities without receiving prior FDIC approval, provided they manage the associated risks.
- Federal Reserve, April 24, 2025. Withdraws the supervisory letter that required state member banks to give advance notice of crypto-asset activities. The Board now monitors those activities through the normal supervisory process.
On July 14, 2025 the three agencies added a joint statement on crypto-asset safekeeping. It creates no new supervisory expectations. It explains how existing law and risk management principles apply, and it is the closest thing to an examination outline a bank has.
"No prior approval" is not the same as "no conversation". State-chartered banks still need to confirm their state regulator's position, and every bank is better served by telling its supervisory team what it plans before the launch than after.
What examiners mean by control
The joint statement says that safekeeping a crypto-asset means controlling the cryptographic keys associated with it. A bank has control when it can reasonably demonstrate that no other party, including the customer, has access to information sufficient to unilaterally transfer the asset out of the bank's control.
Several consequences are easy to miss.
- A bank that simply takes possession of keys a customer already had may not have control, because copies may exist elsewhere. The asset normally has to be transferred to the bank on the ledger.
- The same control standard applies to any sub-custodian acting for the bank.
- The bank needs a plan for lost or compromised keys and a view on whether its key management remains adequate as technology changes.
- The audit program should cover key generation, storage and deletion, and the controls around transfer and settlement. Where the bank lacks that expertise internally, it should engage independent external resources.
The statement also asks banks to weigh account models. An omnibus account may be more efficient, but it creates a larger target for theft. Separate accounts mean more keys to generate and manage.
Three operating models
| Model | Who holds the keys | What the bank must be able to show |
|---|---|---|
| Sub-custodian | A third party holds the keys on the bank's behalf | Due diligence on the provider's key management, segregation of assets, treatment of customer assets if the provider fails, notification of material events |
| In-house build | The bank generates and holds all keys | Technical staff, secure key generation, cybersecurity, independent audit, ongoing investment as technology moves |
| Bank-controlled with a technology provider | The bank holds a signing key in its own hardware and the provider operates the platform | That neither party can move funds alone, and that the bank verified each transaction before signing |
The first model is the fastest to launch and the one that concentrates the most risk outside the bank. The joint statement is plain that a bank is responsible for the activities its sub-custodian performs, and that a sub-custodian commingling its own assets with those held for the bank is inconsistent with appropriate risk management.
The second model gives full control at a cost few community banks can carry. The third is the one we built LedgerBridge Bitcoin Custody around. Every withdrawal needs two of three signatures. One key lives in the bank's own hardware security module, so the bank is a signer in every movement of funds. Keys are generated in FIPS 140-3 Level 3 validated hardware and are held per client, with no master key. We explain the reasoning in why boards should require bank-controlled custody.
What the business case has to cover
The joint statement warns that safekeeping can require significant resources and attention. A credible business case lists them without optimism.
- Technology and provider fees, including the hardware for the bank's own key if the model requires one.
- People. The board, officers and staff need enough knowledge to run the activity, and at least one person has to own it.
- Audit. Internal audit coverage or an external firm with crypto-asset expertise.
- Compliance. The Bank Secrecy Act officer should be involved before launch. Customer identification, monitoring, sanctions screening and the Travel Rule all apply.
- Demand risk. Price volatility affects both the value held and the appetite for the service.
On the other side of the ledger are custody fees and, for many community banks, the more important benefit of keeping customers who would otherwise move balances to a nonbank platform.
A sequence that works
- Educate the board. One session on the control model and the regulatory position.
- Confirm authority. Counsel reviews the charter, trust powers and state law, and the bank briefs its supervisory team.
- Choose the model. Use the three options above and run the provider through a structured review. Our vendor due diligence questions are a starting point.
- Assess the asset. The agencies expect an analysis of each crypto-asset before it is safekept. Starting with Bitcoin alone keeps that analysis short.
- Write the customer agreement. It should address forks, airdrops, storage method and any use of a sub-custodian.
- Pilot with a limited group, with audit coverage in place from the first transaction.
The security and compliance overview covers how we answer each of these points. To see the Compliance Portal on a live test bank, request a demo.
Frequently asked questions
Does a bank need regulatory approval to offer bitcoin custody?
Generally no prior approval is required for a permissible custody activity. The OCC removed its supervisory nonobjection requirement in March 2025, the FDIC stated the same month that prior approval is not needed, and the Federal Reserve withdrew its advance notification letter in April 2025. Banks must still manage the risks and should confirm state law and brief their supervisors.
Can a community bank use a sub-custodian?
Yes. OCC Interpretive Letter 1184 confirms that banks may outsource custody, including through a sub-custodian, subject to appropriate third-party risk management. The 2025 joint statement adds that the bank remains responsible for the activities the sub-custodian performs and should evaluate its key management, segregation of assets and position in an insolvency before selecting it.
What does control of a crypto-asset mean?
According to the agencies' joint statement, a bank has control when it can reasonably demonstrate that no other party, including the customer, has access to information sufficient to unilaterally transfer the asset out of the bank's control. Simply receiving a copy of existing keys may not meet that standard, because other copies may remain in circulation.
Is bitcoin held in custody at a bank FDIC insured?
No. FDIC deposit insurance covers deposits, subject to ownership category and limits, and the FDIC lists crypto assets among the products it does not insure. Assets in custody belong to the customer, which is why segregation, key control and the customer agreement carry so much weight.
This article is general information, not legal advice. Authority to offer custody depends on your charter and state law. Consult your counsel and your primary regulator.