Last week, the Office of the Comptroller of the Currency (“OCC”) issued an interpretive letter clarifying the authority of national banks and federal savings associations to provide cryptocurrency custody services (the “Crypto Letter”). While this formal announcement is certainly noteworthy, it is not particularly surprising considering Acting Comptroller of the Currency Brian Brooks was most recently the chief legal officer at one of the largest digital currency exchanges in the world.1 The Crypto Letter also has certain significant implications for state chartered banks interested in exploring this rapidly developing area.2
In the two months since Brooks became the acting Comptroller,3 the OCC has released a wave of sweeping regulatory changes. The OCC has issued a proposed rule on standards for determining the true lender of loans made in bank-fintech partnerships, it has addressed the Madden problem by codifying the valid-when-made rule, and has indicated that it will soon create a new bank charter designed specifically for payments companies.4 These announcements show how Acting Comptroller Brooks is willing to take the lead on modernizing the financial regulatory framework to address the dramatic technological changes that have occurred in recent years. It remains to be seen whether there is some limit to the authority of banks to provide traditional banking services through electronic means.
The rest of this alert is focused specifically on the Crypto Letter.
Cryptocurrency Generally
In the most basic sense, cryptocurrency is a digital asset, or currency, that is secured by cryptography, which makes it nearly impossible to counterfeit or double-spend, and is designed to serve as a medium of exchange that is created and stored electronically. A defining characteristic of cryptocurrencies is that they are not governed by a central governmental authority like traditional fiat currencies, which is why most banks have not been able to provide crypto-related services until now.5 While technically all digital currencies are secured by cryptography, the term cryptocurrency has evolved to specifically refer to nonfiat currencies.
There are thousands of different cryptocurrencies–the original blockchain-based cryptocurrency that most people have heard of is Bitcoin.6 Blockchain is a specific type of distributed ledger technology that is commonly used as the foundational technology for cryptocurrencies.7 A comprehensive discussion of the different types of cryptocurrencies and related blockchain technologies is beyond the scope of this client alert. For purposes of the Crypto Letter, the primary concepts to understand is that cryptocurrencies only exist in digital form and that a particular unit of cryptocurrency is assigned to a party through the use of unique cryptographic keys that allow the owner to transfer the cryptocurrency to another party.8
Cryptocurrency Custody Services
The Crypto Letter is specifically focused on clarifying that national banks are authorized to provide cryptocurrency custody services for customers. In essence, the OCC likened cryptocurrency custody services to other safekeeping and custody services provided by banks that are among the most basic and fundamental activities banks provide to customers. Safekeeping and custody services for all types of customer assets, electronic and physical, are the primary services that customers expect from their banks. Fundamentally, it is difficult to distinguish exchanging cryptocurrencies from trading stocks for customers on a book entry basis or conducting foreign exchange activities–both of which are permissible traditional bank activities.
The reason that safeguarding cryptographic keys is such a critical matter is that whoever has the keys is able to transfer the currency. If someone loses the keys, they lose the ability to control their cryptocurrency associated with those keys. Additionally, if someone gains access to someone’s keys, that party can use the keys to transfer the cryptocurrency to themselves or others. The concept is not all that different from regular U.S. dollars, whoever holds the dollar can spend the dollar–which is why customers place their money in banks as a precautionary measure.
OCC regulations explicitly authorize national banks to perform through electronic means and facilities any activities that they are otherwise authorized to perform.9 Bank customers have long used safe deposit boxes for the safekeeping of a variety of physical objects, and the OCC recognized the permissibility of electronic safekeeping activities as an important corollary. Considering the importance of safeguarding cryptographic keys to protect ones ownership of cryptocurrency, it makes sense that banks should be able to provide such custody services.
As with traditional custody services, providing custody services for cryptocurrency is permissible in both non-fiduciary and fiduciary capacities. Cryptocurrency custody services in a non-fiduciary capacity would entail banks safekeeping the cryptographic key that allows for the control and transfer of the customer’s cryptocurrency. In nearly all circumstances, providing custody for cryptocurrency will solely consist of the bank safeguarding the cryptographic access keys of the specific unit of cryptocurrency.
National banks with trust powers are authorized to conduct cryptocurrency custody activities in a fiduciary capacity and have the authority to manage them in the same way banks manage other assets as fiduciaries. Banks acting as fiduciaries for cryptocurrency have to consider how to ensure their custody models comply with applicable laws and regulations, including the laws related to the instrument that created the fiduciary relationship.10
Broader Cryptocurrency Services
While the Crypto Letter specifically addresses the authority of banks to safeguard the cryptographic keys associated with cryptocurrency, the OCC also clarifies that “crypto custody services may extend beyond passively holding `keys.'” Banks interested in providing cryptocurrency services or creating new cryptocurrency products have to make a variety of important decisions. The OCC cites research finding that almost 40 million Americans own cryptocurrencies and it is reasonable to suspect that many would appreciate the ability to have their banks safeguard those cryptocurrencies just as their banks safeguard their money and other assets.
Among the decisions that a bank has to make when considering offering new cryptocurrency products or services, is what specific cryptocurrencies to support. Because a cryptocurrency is essentially just computer code, anyone with relatively basic computer programming skills can create a cryptocurrency– most established cryptocurrency exchanges only support cryptocurrencies that have reached a certain market cap and meet other standards.11 It is also important to note that there is currently no statutory definition of “cryptocurrency” at the federal or state level.12
The OCC does not provide an exhaustive list of the non-custody types of cryptocurrency products or services that banks are authorized to provide, but services that assist customers with spending cryptocurrencies would be a natural extension. Application programming interfaces (“APIs”) are one way to allow customers to spend and transfer cryptocurrency without directly exposing the private keys. The Crypto Letter also states that banks have discretion on whether to simply hold the cryptographic keys of the customers or have customers transfer the cryptocurrency to the bank so that a new set of keys are issued in the banks name–a unique key is created each time a cryptocurrency is transferred to a new owner.
Tax related products or services are another type of service that would pair well with cryptocurrency custody services. The IRS has taken the position that cryptocurrency transactions are taxable by law just like any other property transactions.13 This creates a significant barrier for anyone wishing to use cryptocurrency for everyday transactions. Accurate tax reporting requires careful consideration of the basis in the cryptocurrency by capturing the value when the cryptocurrency was acquired as well as the associated gain when it is subsequently transferred. Banks or third party service providers can develop software that is able to accurately track the value of cryptocurrencies and generate year-end financial reports similar to standard brokerage statements.14
The Crypto Letter notes that it expresses no opinion on whether cryptocurrencies may be “exchange” for purposes of 12 USC 24(Seventh).15 This language appears to be a signal to the industry that banks that wish to buy and sell cryptocurrencies for their own account may be able to convince the OCC that doing so would be permissible under that line of authority. It would not surprise us if the OCC were to release another interpretive letter on the permissibility of this activity in the near- to mid-term.
State Cryptocurrency Activities and State Chartered Bank Implications
There are a variety of states that have enacted cryptocurrency and blockchain laws aimed at attracting new business as well as improving the ability of financial institutions to serve those businesses. The OCC’s news release on the Crypto Letter mentioned that its opinion is consistent with a number of states which have already authorized state banks or trust companies to provide similar functions. The Crypto Letter also reaffirmed the OCC’s position on the permissibility of national banks to provide banking services to any lawful business they choose, including cryptocurrency businesses, so long as banks effectively manage the risks and comply with applicable law. The FDIC has previously clarified that state banks may generally engage in any activity that is permissible for a national bank.16
Wyoming is among the most active states and several states have modeled their laws after those created by Wyoming–the Token Taxonomy Act first introduced by US Congress in 2018 was also modeled after a Wyoming bill.17 Wyoming Banking Commissioner, Albert Forkner, is actively pushing to create the most crypto-friendly regulatory framework in the country.18 Commissioner Forkner believes that the states focus on creating a highly favorable regulatory framework for businesses engaged in blockchain and cryptocurrency related activities will provide a significant boost for financial institutions chartered in the state.
Wyoming was the first legislature to create an entirely new asset class for digital assets in the Utility Token Bill, which is modeled after laws in the United Kingdom and Switzerland.19 One of the most notable bills passed by the state’s legislature in 2019 created three new asset classes that were incorporated into the state’s Uniform Commercial Code.20 Another important step taken by Wyoming was to specifically remove cryptocurrency from the state’s Money Transmitter Act so that cryptocurrency is now an unlicensed activity in the state.21
Not specifically limited to cryptocurrency, but still related, the Wyoming Fintech Sandbox was also created by one of the bills passed in 2019 and became operational in January of 2020–a key feature of which is that it enables linking to other state sandboxes as well as sandboxes at the federal and international level.22 Finally, the Wyoming Division of Banking facilitated the creation of the special purpose depository institution as an alternative type of bank specifically designed to allow crypto and blockchain related businesses to have a stable banking relationship. Wyoming is just an example of the broader innovative regulatory activity occurring at the state level with respect to businesses engaged in cryptocurrency and blockchain technology related activities.
Banks that are chartered in states without any cryptocurrency regulations may be able to rely on parity or “wild card” provisions in state banking statutes.23 These statutes essentially authorize state banks to exercise the same powers permitted to national banks and virtually all states have some variety of wild card laws. However, not all wild card statutes are self-effecting and may require action by the state or state bank regulator to promulgate rules. Some states even have what are referred to as “Super Wild Card” statutes that go even further and permit banks to conduct any activity that is permitted by any other bank in the United States.24
Regulatory Expectations Prior to Engaging in New Activities
While the Crypto Letter is clear with respect to authorizing national banks to conduct cryptocurrency custody services, banks are expected to follow established guidelines that should be followed whenever considering a new activity. Specifically, the OCC states that “[a] national bank or [federal savings association] engaging in new activities should develop and implement those activities consistent with sound risk management practices and align them with the bank’s overall business plans and strategies as set forth in OCC guidance.”25 Banks must take careful steps designed to ensure that any cryptocurrency activities are conducted in a safe and sound manner as well as in accordance with general Bank Secrecy Act and Anti-Money Laundering requirements.26
The first step that a bank is expected to take when considering offering crypto-related services is to conduct a thorough legal analysis. The extent of such an analysis will necessarily depend on the types of cryptocurrency services being considered as well as the locations where those services may be provided. The second step is to conduct a comprehensive risk assessment of the proposed activities–the legal analysis will serve as a guide for the extent of such assessment. Banks have to consider their expertise, risk appetite, and business models when identifying potential cryptocurrency services.
Once the bank has conducted a thorough legal analysis and completed its initial risk assessment, the board will need to formally approve the proposed activities by adopting resolutions. The board will have to approve a broad policy governing the activities and setting the framework for the development of banklevel policies and procedures. The policies and procedures should outline the expectations for systems that will be developed in order to identify, measure, monitor, and control the risks involved in the cryptocurrency services. The Comptroller’s Handbook on Custody Services specifically provides that custody services should include dual controls, segregation of duties and accounting controls.27
Throughout the entire process, banks will also have to maintain constant and clear communications with its direct state and federal regulators. The Crypto Letter concludes with noting that national banks are expected to consult with OCC supervisors prior to engaging in cryptocurrency custody activities. As should be expected, examiners will review cryptocurrency activities as part of the ordinary supervisory process. Banks are expected to establish a framework and engage professionals with the appropriate level expertise commensurate with the risks identified in the proposed cryptocurrency activities.
Closing Considerations
Banks interested in offering new cryptocurrency services or products should start by reviewing their current strategic and business plans as well as determining whether engaging in such activities is in line with the banks board approved risk appetite. It is important that the bank has the requisite expertise and information security infrastructure necessary for engaging in cryptocurrency activities.
Please note that this client alert should not be taken as an endorsement for cryptocurrency or for banks to start offering cryptocurrency services. We merely recognize that the OCC taking a formal position in the Crypto Letter marks a significant turning point for banks direct involvement in the cryptocurrency space. Combined with the coronavirus pandemic creating a surge in the adoption of digital financial products and services, we may see a significant shift in cryptocurrency becoming mainstream much sooner than many could have imagined only six months ago. The OCC is fortunate to have acting Comptroller Brooks, one of the foremost legal experts in the cryptocurrency space, guiding the agency during this transformational time.
