Crypto custodian ongoing monitoring is the stage of vendor management that banks most often underfund. Selection gets a committee, a questionnaire and a decision memo. What follows is a folder of annual reports that nobody reads until something goes wrong. The 2023 interagency guidance on third-party relationships treats monitoring as a stage of its own, and for a provider that holds customer assets it expects more than a yearly file review.
This guide sets out what the guidance asks for, which signals are specific to digital asset custody, a workable calendar, and the point at which monitoring turns into an exit.
What the guidance expects after onboarding
The interagency guidance, issued by the OCC, the Federal Reserve and the FDIC in June 2023, says ongoing monitoring enables a bank to confirm the quality and sustainability of a third party's controls and its ability to meet contractual obligations, to escalate significant issues, and to respond to them. The issues it names include material or repeat audit findings, deterioration in financial condition, security breaches, data loss, service interruptions and compliance lapses.
Three points in the text matter for custody. Monitoring should be commensurate with the risk and complexity of the activity, and more comprehensive and frequent when the relationship supports critical activities. Typical activities include reviewing reports on the third party's performance and controls, periodic meetings with its representatives, and regular testing of the bank's own controls over the relationship, with direct testing of the provider's controls where risk warrants. And the bank should dedicate staff with the expertise, authority and accountability to do this work. The Federal Reserve transmitted the same guidance to its institutions as SR 23-4.
The agencies' 2025 statement on crypto-asset safekeeping adds the custody-specific layer. A bank is responsible for the activities its sub-custodian performs, and its contract can require notice of any potential compromise of keys or sensitive information, any use of backup material, and any material transaction error that cannot be reversed. Those notices are only useful if someone at the bank is watching for them.
The custody-specific signals
| Area | What to track | Escalate when |
|---|---|---|
| Assets and records | Daily reconciliation of on-chain balances to the bank's ledger; aged breaks; segregation of customer, provider and bank assets | Any unexplained difference, or any sign of commingling |
| Keys and signing | Failed or delayed signings, quorum availability, key rotation events, hardware health | A signing path that worked without the bank's key, or any fallback to software |
| Transaction policy | Rejected and overridden instructions, rule changes and who approved them, open exceptions | Overrides without a named approver, or rules changed outside change management |
| Security events | Incident notices against contract terms, time to notify, time to contain, repeat causes | Late notice of a suspected key compromise or an irreversible transaction error |
| Compliance | Alert volumes and aging, blocked transactions, screening coverage of new assets or chains | Alerts aging past the bank's own standard, or a gap in coverage |
| Financial and corporate | Audited statements, insurance coverage, litigation, ownership or management changes | A lapse in coverage, a qualified opinion, or a change of control |
| Subcontractors | Cloud, node, analytics and hardware providers the vendor depends on, and changes to them | A new critical dependency the bank has not reviewed |
| Independent review | Security review findings and their remediation status | High-risk findings open past their due date |
Most of these signals exist inside the provider's systems. The practical question for the bank is whether it can see them without asking. A provider that gives each bank its own analytics, a health endpoint and an audit log the bank can query has made monitoring possible. One that sends a quarterly summary has not.
A monitoring calendar
- Daily. Reconciliation results, failed or held transactions, system health, and any incident notice.
- Monthly. Rejected and overridden instructions with reasons, alert aging, policy changes, support tickets and resolution times.
- Quarterly. A meeting with the provider on performance and open items, review of subcontractor changes, a test of the bank's own controls over the relationship, and a report to the risk committee.
- Annually. Financial statements, insurance certificates, the independent security review and its remediation, a refresh of the due diligence questions, and a test of the exit plan.
- On events. Any security incident, change of control, regulatory action or material change in the service triggers a targeted review outside the calendar.
When to escalate and when to leave
The guidance's termination stage lists what a bank should have ready: options for transitioning the service, the capabilities and time needed to move to another provider or bring the activity in-house, the costs of termination, and the handling of data retention, system connections and access rights. For custody there is one more item that outranks the others: whether the bank can move customer assets to a new arrangement without the provider's cooperation.
That capability is decided at design time, not at exit. In a two of three signing model where the bank holds one key in its own hardware and a recovery key is held under dual control, the bank can recover assets on its own. In a model where the provider holds every key, the exit plan depends on the provider's goodwill and solvency. The agencies' safekeeping statement warns that a sub-custodian's failure to maintain proper recordkeeping or contingency planning could leave customers unable to access their assets for an extended period or permanently.
Escalation should be written down before it is needed: which signals go to the vendor manager, which to the risk committee, and which trigger the exit plan. Repeated late incident notices, any commingling, any signing outside the bank's control, and a lapse in insurance belong in the last group.
What a good provider gives you without asking
Monitoring is easier when the provider is built to be examined. LedgerBridge Bitcoin Custody gives each bank self-service analytics over its own data, a health endpoint covering the database, the hardware security modules, the Bitcoin node and messaging, an append-only audit log, and an independent security review whose findings are tracked to closure. The bank's officers operate the stop and freeze controls themselves, and the transaction policy changes are logged with author and approver. The security and compliance overview lists the rest.
Set the monitoring program before the first customer asset arrives, and ask any provider, including us, to show you the data it will produce for it. We will walk your vendor management team through ours.
Frequently asked questions
How often should a bank review its crypto custodian?
The 2023 interagency guidance does not set an interval. It ties the depth and frequency of monitoring to the risk and criticality of the activity, and custody of customer assets is a critical activity. A workable pattern is daily operational signals, monthly control metrics, a quarterly meeting and committee report, and a full annual review, with targeted reviews after any incident or material change.
What should trigger an immediate escalation?
Any sign that assets moved outside the bank's control, any commingling of the provider's assets with customer assets, a suspected key compromise, an irreversible transaction error, a reconciliation break that is not explained the same day, a lapse in insurance, or a change of control at the provider. The 2025 safekeeping statement suggests contract clauses requiring notice of several of these.
Does the bank have to test the provider's controls itself?
The guidance expects regular testing of the bank's own controls over the relationship and allows direct testing of the provider's controls where risk warrants it. For custody, most banks rely on an independent security review of the provider plus their own tests of reconciliation, access and the emergency stop. A provider should expect and support both.
What belongs in the exit plan for a crypto custodian?
Alternative providers or an in-house option, the time and capabilities required to transition, termination costs, and the handling of data and system access. Above all, a tested procedure for moving customer assets without the provider's cooperation. In a two of three model, the bank's key and the recovery key make that possible; the plan should prove it with a rehearsal.
Is a report from the provider enough?
No. The guidance treats provider reports as one input alongside meetings, the bank's own testing and independent assessments. A report describes what the provider chose to show. Monitoring means the bank can see reconciliation results, rejected transactions, policy changes and incidents directly, and can compare them with the contract and with its own expectations.
This article is general information, not legal advice. Third-party risk management requirements depend on your charter and your regulator. Consult your counsel and your supervisory team.