OCC, FDIC, and Fed Eye Stricter Vendor Rules for Crypto Custody Banks

US regulators are revisiting third-party risk management rules for banks as crypto custody services expand, signaling potential new compliance requirements for financial institutions engaging with digital asset custodians. The review comes amid growing institutional demand for crypto custody solutions and increasing scrutiny of how banks manage risks associated with external vendors handling digital assets.

The specific US regulators leading this review include the Office of the Comptroller of the Currency (OCC), the Federal Deposit Insurance Corporation (FDIC), and the Federal Reserve, which collectively oversee the nation's banking system. These agencies have historically issued joint guidance on third-party risk management, most notably through the 2023 interagency guidance that established a framework for managing risks in bank-vendor relationships.

While specific rule changes have not been formally proposed, regulators are considering amendments to existing third-party risk management frameworks to address the unique characteristics of crypto custodians. Potential changes could include enhanced due diligence requirements specifically tailored to digital asset service providers, addressing areas such as cybersecurity protocols, cold storage practices, and insurance coverage.

The timeline for any proposed changes remains uncertain, with regulators still in the information-gathering phase of their review. Industry observers expect that formal guidance or proposed rules could emerge within the next six to twelve months, though this timeline could shift depending on the complexity of the issues involved and the level of stakeholder engagement.