While investors and practitioners grappling with virtual currency compliance have gradually seen increased U.S. financial crime, tax and other regulatory guidance over time, there had been little or no guidance from federal bank and financial institution regulators with respect to virtual currency custody issues. However, the release by the Office of the Comptroller of the Currency (the “OCC”) of Interpretive Letter #1170 (the “Letter”) on July 22, 2020, permits OCC-regulated banks, effective immediately, to custody virtual assets, provided other conditions specified in the Letter were met.[1]
Regulators tend to tread cautiously when issuing guidance that encompasses new technologies, and virtual currencies have been no exception. The Letter, however, demonstrates both an in-depth understanding of how virtual currencies function and clearly delineates both the benefits and the potential challenges virtual currency might create in the traditional banking system. Custody services provided by traditional national banks could impute these institutions’ legitimacy, trust and easy access with their customers to virtual currencies that are so custodied.
From individual investors who may prove more willing to access the virtual currency markets through their existing banking relationships up through potentially large institutional investors with much more rigorous custody requirements, regulatory endorsement such as the Letter seems likely to broaden the pool of virtual currency investors.[2] Indeed, the increased air of legitimacy provided by large banks is warranted; most virtual currency exchanges today are either offshore or organized as trust companies, generally under significantly less regulatory scrutiny than banks.
The duty of safeguarding money and property represents a basic, core banking function.[3] Historically these services have involved the safekeeping of physical assets. Such custody arrangements typically involved safe deposit boxes and other special types of deposits; more recently, such services have also encompassed the safekeeping of intangible assets that necessitated the escrow of encryption keys, secure storage of electronic documents, and safekeeping of other purely electronic items.[4] In addition to these traditional custody services, banks generally provide a suite of corollary services such as trade settlement, pricing, assorted recordkeeping services, among others.[5]
The Letter concludes that, under existing OCC guidance and interpretation, national banks are unequivocally permitted to custody virtual assets.[6] Indeed, the Letter explicitly states that the “OCC generally has not prohibited banks from providing custody services for any particular type of asset,” including electronic assets.[7] These custody services are permissible for banks to offer either as a fiduciary or a non-fiduciary, via traditional or electronic means.[8]
These conclusions are a direct result of a synthesized application of prior OCC guidance covering various issues, including the custody of digital certificates. Banks are permitted to escrow encryption keys for such digital certificates only if their technological solutions are sufficient to guarantee the digital keys’ safety.[9] While the challenges presented by virtual currency custody are in some ways novel, in other ways they are readily analogous to custody of such encryption keys.[10] Because existing digital key escrow services are functionally equivalent to physical custody, the OCC will apply broadly similar authorization to custody of virtual currencies.[11]This implies that a host of specific existing regulatory requirements will be imported into virtual currency custody analysis, such as the specific new asset risk management framework outlined in OCC Bulletin 2017-43.[12] However, custody of virtual currency assets may require new, unique solutions unnecessary for other existing asset types.[13]
Furthermore, the application of existing custody practices or any new, unique solutions must remain in compliance with not only the applicable OCC guidance, but any applicable state law or other regulatory requirements.[14] These requirements might include, for example, state banking laws (or other applicable state laws) and any other specific legal or contractual framework governing the relationship between the custodian and the owner.[15] If the virtual asset is a security, other relevant considerations may include securities law custodial requirements.[16]
The Letter makes clear that the OCC expects national banks and federal savings associations to conduct all their business in compliance with any such applicable federal and state laws, OCC guidance, or other regulatory or contractual requirements.[17] Traditional “banking” activities, such as lending, deposit and payment services, are already subject to numerous established federal and state laws and regulations that continue to evolve in the age of technological advancements. In addition, most U.S. jurisdictions have already either adopted or proposed laws and regulations that specifically relate to virtual currencies or other intangible digital assets.
The OCC cites a 2019 report on recent legislative developments dealing with emerging technologies.[18] Wyoming, for example, enacted digital asset legislation (effective on July 1, 2019) which is applicable to assets that include cryptocurrencies. Among others, recent amendments to Wyoming’s Uniform Commercial Code expressly allow banks to provide digital asset custodial services, and address issues such as security interests in digital assets and perfecting those security interests.[19] Several other states have also adopted laws dealing with treatment of virtual currency under their applicable money transmitter and securities laws and regulations. Financial institutions must be aware of continued developments and remaining uncertainty in the legal and regulatory framework concerning virtual currencies.
Virtual custody solutions are also appropriately tested against standards for existing practices.[20] The Letter lists a variety of these requirements, such as dual controls, accounting controls, segregation of duties, settlement concerns, and physical access controls, as well as various others.[21] The list is explicitly non-exhaustive, noting that the various applicable controls must be “tailored in the context of digital custody.”[22]
The Letter closes with two specific, targeted notes. First, anti-money laundering (“AML”) rules are stressed.[23] Holders of virtual currencies do tend to be extremely concerned with privacy.[24] However, the Letter is clear that bank custody of virtual currency assets will explicitly be subject to the same AML regulatory framework and due diligence requirements as any other banked asset.[25] Second, the Letter specifies any bank seeking to expand into cryptocurrency custody should first consult with the OCC, specifically about security, potential loss mitigation, and novel technological requirements, as well as the varying requirements imposed by different virtual assets.[26]
As it was issued by the OCC, the Letter is unable to answer one key question: While this guidance is applicable to national banks, will the FDIC issue guidance with respect to banks chartered under the various state laws?
Overall, the Letter is an important development that should facilitate the custody of virtual currencies by national banks and other financial institutions regulated by the OCC. Although it frames additional requirements that eligible banks must meet, including compliance with controls and procedures under the Letter and related OCC guidance, as well as other applicable federal and state laws, it is a favorable development for banks, retail and institutional customers and the virtual currency market.
[1] Although the Letter generally uses the term “cryptocurrency,” this article will broadly employ the term “virtual currency.”
[2] One week before the Letter, on July 15th, 2020, one Bitcoin was worth approximately $9,200 USD. By a week after the Letter, on July 29th, one Bitcoin was worth over $11,000 USD, per coinmarketcap.com. While prices are always a combination of numerous market forces, the Letter almost certainly played some role in this increase.
[3] Letter at 6.
[4] Letter at 6.
[5] Letter at 6-7.
[6] Letter at 7, “Providing custody services for cryptocurrency falls within these longstanding authorities to engage in safekeeping and custody activities. As discussed below, this is a permissible form of a traditional banking activity that national banks are authorized to perform…”
[7] Given that certain capability and legality questions are satisfied. Letter at 7.
[8] Letter at 7-8.
[9] Letter at 6 citing OCC Conditional Approval 267 (Jan. 12, 1998).
[10] Letter at 8. “Rather, a bank “holding” digital currencies on behalf of a customer is actually taking possession of the cryptographic access keys…”
[11] Letter at 8.
[12] Letter at 8-9 citing OCC Bulletin 2017-43.
[13] Letter at 9.
[14] Letter at 9.
[15] Letter at 9.
[16] See, e.g., Andrew Shipe, Custody of Blockchain Securities Under the Federal Securities Laws, 21 FinTech Law Rep. 4, 5 (July/Aug. 2018).
[17] Letter at 9.
[18] Dale Werts, Lathrop GPM, Blockchain & Cryptocurrency: State Law Roundup, 2019. https://www.jdsupra.com/legalnews/blockchain-cryptocurrency-state-law-59816/
[19] See WY Stat. 34-29-102, WY Stat. 34-29-103, WY Stat. 34-29-104.
[20] Letter at 9.
[21] Letter at 10.
[22] Letter at 10.
[23] Letter at 10.
[24] See, e.g.¸ Individual Claims Digital Currency Exchange Subpoenas Violated Rights, 2020 TNTF 142-29 (July 24, 2020). Note that Bitcoin itself was at least partially founded on the basis of distrust for traditional financial systems, and mandatory disclosure likely contributed.
[25] Letter at 10.
[26] Letter at 10.
