Regulators Revise Bank Risk Rules Amid Crypto Custody Growth
US regulators are revisiting bank third-party risk rules as more banks outsource crypto custody to specialist providers.
The interagency guidance on third-party relationships, issued jointly by the Federal Reserve, OCC, and FDIC, was written with traditional vendors in mind and does not fully capture the risks associated with crypto custody.
Crypto custody breaks the assumption that a vendor relationship is similar to outsourcing payment processing or core banking software, where the bank can audit the vendor's operations and reasonably assume the underlying asset exists regardless of what happens to the vendor.
An updated framework would need to address questions specific to how digital assets are secured, including private key generation, storage, and backup, as well as what happens to client assets in a custodian bankruptcy under existing law.