Crypto custody vendor due diligence is where a bank's digital asset project is won or lost with its examiner. Three documents frame it. OCC Interpretive Letter 1184 confirms that a bank may outsource custody, including through a sub-custodian, subject to appropriate third-party risk management. The 2023 interagency guidance on third-party relationships says that using a third party does not diminish or remove the bank's responsibilities. The agencies' 2025 statement on crypto-asset safekeeping applies both to keys and ledgers.
The questions below follow those documents. We have grouped them the way a risk committee would read them, and we have marked the answers that should stop a selection process.
The 2023 guidance describes a life cycle with five stages: planning, due diligence and third-party selection, contract negotiation, ongoing monitoring, and termination. The depth of work at each stage should be commensurate with the risk and criticality of the activity. Custody of customer assets sits at the demanding end of that scale.
The safekeeping statement is more specific. A bank is responsible for the activities its sub-custodian performs. Due diligence before selection includes evaluating the effectiveness of the provider's key management solution, with its policies, processes and internal controls. The bank should also analyze how customer assets would be treated if the provider became insolvent or suffered an operational disruption.
Keys and control
- Where are private keys generated, and can they ever be exported from that hardware?
- Is the hardware validated, and to which standard? We specify FIPS 140-3 Level 3 validated hardware.
- Can the provider move customer assets without a signature from the bank?
- How many signatures does a withdrawal need, and who holds each key?
- Does the bank verify the exact transaction before it signs, or does it approve a summary prepared by the provider?
- What happens if a key is lost or suspected to be compromised, and how long does recovery take?
- If the hardware is unavailable, does the system refuse to sign or fall back to software?
Question 3 is the one that matters most. The agencies define control as the ability to demonstrate that no other party has access to information sufficient to unilaterally transfer the asset. If a provider can act alone, the bank is trusting it completely, whatever the contract says.
Segregation, records and insolvency
- Are customer assets held in separate wallets with separate keys, or in an omnibus wallet?
- Are the provider's own assets ever held in the same wallets as assets held for the bank?
- How are on-chain balances reconciled to the bank's books, and how often?
- What legal analysis supports the treatment of customer assets if the provider enters bankruptcy?
- Can the bank recover customer assets without the provider's cooperation?
The safekeeping statement calls commingling of a sub-custodian's own assets with those held for the bank inconsistent with appropriate risk management, because the assets could be treated as the provider's property in a bankruptcy. A yes to question 9 should end the conversation.
Compliance and operations
- Where in the transaction flow do sanctions screening and transaction monitoring run, and can a transfer complete before they finish?
- Who can freeze a wallet or hold a deposit, and is every such action attributed to a named person?
- Is there an emergency stop, who can trigger it, and at which points in the flow does it act?
- How does the platform support suspicious activity reporting and the Travel Rule?
- Is each bank's data isolated from other clients, and how is personal data encrypted?
- Which other providers does the vendor depend on, such as cloud, node or analytics services, and how are they monitored?
- What is the tested recovery time after an outage, and when was the last test?
The guidance treats a vendor's reliance on its own subcontractors as part of the bank's review. Ask for the list in writing.
Contract, audit and exit
- Does the contract require notice of any potential key compromise, any use of backup material and any material transaction error that cannot be reversed?
- Does the bank have the right to audit, and to receive independent security review reports?
- Has the codebase been reviewed by an independent party, and are findings tracked to closure?
- Which assets are supported, and who decides when a new one is added?
- How are forks, airdrops and network upgrades handled, and what does the customer agreement say about them?
- What is the exit plan, and can the bank move every customer asset to another arrangement on its own timetable?
The notification items in question 20 come directly from the safekeeping statement, which suggests them as contract terms. The decision in question 23 stays with the bank even when the provider helps with the analysis.
How to use the answers
Score the answers, but treat four of them as conditions rather than points: the provider cannot move funds alone, its assets are never commingled with customer assets, the bank has its own stop control, and keys cannot leave the hardware. A provider that fails any of these is asking the bank to accept a risk its examiner will not.
Keep the record. The guidance expects ongoing monitoring, so the same questions should be asked again on a schedule the bank sets according to risk, and after any material change at the provider.
We answer these questions for every bank that evaluates LedgerBridge Bitcoin Custody. The short version: the bank holds a signing key in its own hardware, keys are per client with no master key, and the bank's officers operate the stop and freeze controls. The details are in our security and compliance overview and in why boards should require bank-controlled custody. If you are earlier in the process, start with the decision guide for community banks.
Send us your questionnaire and we will answer it in full.
Frequently asked questions
Can a bank outsource crypto custody to a vendor?
Yes. OCC Interpretive Letter 1184, issued May 7, 2025, confirms that national banks and federal savings associations may outsource bank-permissible crypto-asset activities, including custody and execution, to third parties and may use a sub-custodian. The condition is appropriate third-party risk management and operation in a safe and sound manner.
Is the bank still responsible if the sub-custodian fails?
Yes. The interagency guidance on third-party relationships states that using a third party does not diminish or remove the bank's responsibilities. The 2025 safekeeping statement adds that, subject to the customer agreement, a bank is responsible for the activities its sub-custodian performs. That is why insolvency treatment and recovery without the provider belong in the review.
What is the single most important due diligence question?
Whether the provider can move customer assets without the bank. The agencies define control as being able to demonstrate that no other party has access to information sufficient to unilaterally transfer the asset. A structure in which the bank must sign every withdrawal answers that question in a way a contract clause cannot.
How often should custody vendor due diligence be repeated?
The 2023 guidance treats ongoing monitoring as a stage of the life cycle and ties its depth to the risk and criticality of the activity. It does not set a fixed interval. For custody of customer assets, most banks will want a full review at least annually and a targeted review after any material change, incident or audit finding at the provider.
This article is general information, not legal advice. Third-party risk requirements depend on your charter, your regulator and the activity. Consult your counsel and your supervisory team.