OCC Crypto Custody Rules: Will Community Banks Be Left Behind?

What the OCC Actually Did

On May 7, 2025, the Office of the Comptroller of the Currency published Interpretive Letter 1184. It confirms that national banks and federal savings associations may buy and sell crypto-assets held in custody when a customer directs them to. It also confirms they may outsource bank-permissible crypto activities, including custody and trade execution, to third parties, provided they apply appropriate third-party risk management. 5

The letter responded to a request for clarification. It leans on earlier guidance: Interpretive Letter 1170, from 2020, which found that banks may offer crypto custody in either a fiduciary or non-fiduciary capacity, and Interpretive Letter 1183, which recently reaffirmed that position. 2 The core legal framing is that holding crypto for customers is simply a modern version of the custody business banks have always run. 2 The agency attached its usual caveat. Any such activity, including work routed through a sub-custodian, must be conducted safely and soundly and in line with applicable law. 5

The Federal Reserve and FDIC took parallel steps, so the shift extends beyond a single regulator. 1

A Building Block, Not a One-Off

IL 1184 is best read as one piece of a deliberate sequence. A June 2025 bank-law bulletin noted that this was the OCC's second crypto-related interpretive letter in roughly two months. The bulletin read that pace as a sign that new agency leadership wants to define clearly what banks may do with digital assets. 4

Later guidance confirms that reading. In December 2025, the OCC issued Interpretive Letter 1188. It concluded that banks acting as "riskless principal" in crypto transactions are doing the functional equivalent of brokerage, and that such activity is a logical outgrowth of crypto custody. 3 That letter explicitly cites IL 1184's affirmation that banks can buy and sell assets they hold in custody. 3 Each letter becomes the foundation for the next permission, moving banks from safekeeping toward fuller market intermediation.

The reach also extends past federally chartered institutions. Many state laws tie state-bank powers to what national banks are allowed to do. These letters may therefore shape activity at state-chartered banks too. 4

The Two-Tier Concern

The more pointed critique concerns who can realistically use these permissions. Coverage in Forbes argues that large financial institutions are positioned to scale into digital assets quickly. Community banks and minority depository institutions, by contrast, may find more obstacles than opportunities. 1 The risk it identifies is a two-tier crypto economy that entrenches the same disparities crypto was supposed to disrupt. 1

This is where the details of IL 1184 cut both ways. On paper, the outsourcing provision looks like it was made for smaller banks. A community lender without in-house blockchain engineers or key-management infrastructure could partner with a specialist sub-custodian rather than build everything itself. 5

But the permission is conditioned on "appropriate" third-party risk management and on safe-and-sound operation. 5 In practice, vetting a crypto vendor, monitoring its controls, and satisfying examiners are largely fixed costs. A global bank can spread those costs across a large customer base. A small institution has far fewer customers to absorb them. The legal door is open to everyone, but the compliance toll to walk through it is not proportional to size.

How the Sources Line Up

There is little factual disagreement in the record. The OCC's letter and press release, the law-firm bulletin, and Forbes all describe the same authority in consistent terms. 1245 The divergence is in emphasis. The regulator frames the guidance as clarification of existing powers. 5 Legal commentators frame it as a signal of policy direction with spillover to state banks. 4 Forbes frames it as a question of distribution: who benefits and who does not. 1

The Takeaway

IL 1184 is less a revolution than a confirmation. It is significant because it removes ambiguity and, as IL 1188 shows, serves as a stepping stone to broader crypto trading powers. 3

The two-tier warning deserves to be taken seriously, but it is not inevitable. Whether smaller banks participate will likely depend less on what the OCC permits and more on how examiners apply the risk-management expectations. It will also depend on whether a competitive market of affordable, examiner-friendly custody providers emerges. Regulators have made the permissions uniform. Making them practical for a small-town bank may require supervisory guidance as clear as the legal letters themselves.