The impact of crypto-asset guidance on community banks

On July 14, the OCC, Federal Reserve, and FDIC issued joint guidance regarding risk-management considerations for crypto-asset safekeeping, applying existing risk-management principles to the world of digital assets. While the guidance is intended for all banking organizations, its implications for community banks are particularly profound. These smaller institutions, often characterized by their agility and strong local ties, face unique opportunities and challenges, which we discuss below..Strategic opportunities and challengesCommunity banks are uniquely positioned to serve as early adopters in the crypto-asset market. By offering safekeeping services for digital assets, they can attract a new generation of tech-savvy customers and local businesses, differentiating themselves from larger, more rigid competitors. However, the guidance also highlights a significant challenge for community banks: the need for an effective risk governance framework that can adapt to the volatile and rapidly evolving crypto-asset market. This requires a level of resources, expertise, and continuous education that many community banks may not possess internally. Regulator emphasis on staying "abreast of industry leading practices" and the "evolving nature" of the market places a considerable burden on smaller institutions to dedicate the necessary human and capital resources to technological and professional development.Navigating cryptographic key managementOne of the primary risks highlighted by the guidance is the potential compromise or loss of cryptographic keys, perhaps resulting in the irreversible loss of customer assets. To mitigate this, the primary federal prudential regulators require banking organizations to demonstrate control over these keys and related sensitive information. This complex requirement demands a sophisticated understanding of key generation, secure storage (including both “hot” and “cold” wallets), and robust contingency plans for lost or compromised keys. For a community bank, developing this specialized expertise and building the necessary technological infrastructure from scratch can be prohibitively expensive and resource-intensive. This creates a strategic crossroads: A bank must either make a substantial, long-term investment in building internal capacity or seek external solutions through a third-party sub-custodian.The crucial role of third-party risk managementFor many community banks, the most viable and cost-effective path to offering crypto-asset safekeeping will be through a partnership with a third-party sub-custodian. However, the guidance makes it clear that this choice does not absolve the bank of its responsibilities. The banking organization remains accountable for the activities performed by its sub-custodian. This necessitates a thorough third-party risk management process. Community banks must conduct extensive due diligence before selecting a partner, evaluating their overall risk management practices, as well as their cryptographic key management solutions and internal controls.Key areas for review include the sub-custodian's recordkeeping and contingency plans, and the potential treatment of customer assets in the event of their insolvency. The guidance warns against the commingling of assets, as this could put customer funds at risk due to insolvency, for example during a bankruptcy proceeding. The bank also retains the responsibility for clear and accurate customer communication, ensuring that clients fully understand the nature of the arrangement and the roles of the parties involved. Due diligence by the bank is not merely a one-time event, it will require ongoing oversight and monitoring to ensure the sub-custodian continues to meet the bank's standards and regulatory requirements.Addressing legal and compliance risksThe guidance reiterates that crypto-asset safekeeping is subject to existing legal and compliance frameworks, including the Bank Secrecy Act, anti-money laundering regulations, the Travel Rule, counter financing of terrorism and OFAC requirements, among other legal requirements. The unique features of distributed ledger technology present compliance challenges, as transactions often lack identifying information typically found in traditional financial systems. This requires a community bank to ensure its compliance program is robust enough to handle these nuances. The bank's BSA officer, board of directors, and senior management must be actively involved in assessing potential money laundering and illicit finance risks. A well-written customer agreement is also essential, serving as a tool to manage legal risks by clearly defining the duties and responsibilities of all parties involved in the safekeeping arrangement.The importance of audit and oversightTo ensure a safe and sound operation, the guidance mandates that a banking organization’s audit program must provide "appropriate coverage" over all crypto-asset safekeeping activities, including the oversight of third-party service providers. This can be difficult for community banks, as the specialized expertise needed for a comprehensive crypto-asset audit may not exist internally. In such cases, management is advised to engage "appropriate external resources, with sufficient independence," to assess the bank's crypto-asset safekeeping operations. This adds to the operational costs and management overhead, but it is a non-negotiable step to ensure the integrity of the bank’s internal controls and risk management systems.ConclusionThis joint guidance by these federal banking regulators highlights the need for community banks to adopt a careful and strategic approach to navigate this complex new terrain. A successful path forward will hinge on a bank's ability to balance the potential for growth with a rigorous and well-controlled risk management framework.Ethan Ostroff is a partner at Troutman Pepper Locke, and Matthew Russell Morris is an associate at the firm.