Board of Governors of the Federal Reserve System
Federal Deposit Insurance Corporation
Office of the Comptroller of the Currency
January 3, 2023
Joint Statement on Crypto-Asset Risks to Banking Organizations
The Board of Governors of the Federal Reserve System (Federal Reserve), the Federal Deposit
Insurance Corporation (FDIC), and the Office of the Comptroller of the Currency (OCC)(collectively, the agencies) are issuing the following statement on crypto-asset 1 risks to banking
organizations.
The events of the past year have been marked by significant volatility and the exposure ofvulnerabilities in the crypto-asset sector. These events highlight a number of key risks associatedwith crypto-assets and crypto-asset sector participants that banking organizations should beaware of, including:
•••

••••
•

Risk of fraud and scams among crypto-asset sector participants.
Legal uncertainties related to custody practices, redemptions, and ownership rights, some ofwhich are currently the subject of legal processes and proceedings.
Inaccurate or misleading representations and disclosures by crypto-asset companies,
including misrepresentations regarding federal deposit insurance, and other practices that
may be unfair, deceptive, or abusive, contributing to significant harm to retail andinstitutional investors, customers, and counterparties.
Significant volatility in crypto-asset markets, the effects of which include potential impacts
on deposit flows associated with crypto-asset companies.
Susceptibility of stablecoins to run risk, creating potential deposit outflows for banking
organizations that hold stablecoin reserves.
Contagion risk within the crypto-asset sector resulting from interconnections among certain
crypto-asset participants, including through opaque lending, investing, funding, service, andoperational arrangements. These interconnections may also present concentration risks forbanking organizations with exposures to the crypto-asset sector.
Risk management and governance practices in the crypto-asset sector exhibiting a lack ofmaturity and robustness.
Heightened risks associated with open, public, and/or decentralized networks, or similarsystems, including, but not limited to, the lack of governance mechanisms establishingoversight of the system; the absence of contracts or standards to clearly establish roles,
responsibilities, and liabilities; and vulnerabilities related to cyber-attacks, outages, lost ortrapped assets, and illicit finance.

It is important that risks related to the crypto-asset sector that cannot be mitigated or controlled
do not migrate to the banking system. The agencies are supervising banking organizations that
may be exposed to risks stemming from the crypto-asset sector and carefully reviewing any
1

By “crypto-asset,” the agencies refer generally to any digital asset implemented using cryptographic techniques.

1

proposals from banking organizations to engage in activities that involve crypto-assets. Throughthe agencies’ case-by-case approaches to date, the agencies continue to build knowledge,
expertise, and understanding of the risks crypto-assets may pose to banking organizations, theircustomers, and the broader U.S. financial system. Given the significant risks highlighted byrecent failures of several large crypto-asset companies, the agencies continue to take a carefuland cautious approach related to current or proposed crypto-asset-related activities and exposuresat each banking organization.
Banking organizations are neither prohibited nor discouraged from providing banking services tocustomers of any specific class or type, as permitted by law or regulation. The agencies arecontinuing to assess whether or how current and proposed crypto-asset-related activities bybanking organizations can be conducted in a manner that adequately addresses safety andsoundness, consumer protection, legal permissibility, and compliance with applicable laws andregulations, including anti-money laundering and illicit finance statutes and rules. Based on theagencies’ current understanding and experience to date, the agencies believe that issuing or
holding as principal crypto-assets that are issued, stored, or transferred on an open, public, and/or
decentralized network, or similar system is highly likely to be inconsistent with safe and soundbanking practices. Further, the agencies have significant safety and soundness concerns withbusiness models that are concentrated in crypto-asset-related activities or have concentrated
exposures to the crypto-asset sector.
The agencies will continue to closely monitor crypto-asset-related exposures of bankingorganizations. As warranted, the agencies will issue additional statements related to engagementby banking organizations in crypto-asset-related activities. The agencies also will continue toengage and collaborate with other relevant authorities, as appropriate, on issues arising fromactivities involving crypto-assets.
Each agency has developed processes 2 whereby banking organizations engage in robust
supervisory discussions regarding proposed and existing crypto-asset-related activities. 3 Banking
organizations should ensure that crypto-asset-related activities can be performed in a safe andsound manner, are legally permissible, and comply with applicable laws and regulations,
including those designed to protect consumers (such as fair lending laws and prohibitions against
unfair, deceptive, or abusive acts or practices). Banking organizations should ensure appropriate

See OCC Interpretive Letter 1179 “Chief Counsel’s Interpretation Clarifying: (1) Authority of a Bank to Engage inCertain Cryptocurrency Activities; and (2) Authority of the OCC to Charter a National Trust Bank,” (November 18,2021); Federal Reserve SR 22-6 / CA 22-6: “Engagement in Crypto-Asset-Related Activities by Federal ReserveSupervised Banking Organizations,” (August 16, 2022); and FDIC FIL-16-2022 “Notification and Supervisory
Feedback Procedures for FDIC-Supervised Institutions Engaging in Crypto-Related Activities,” (April 7, 2022).
3Entities seeking to become regulated banking organizations will also be expected to adopt and demonstrate
appropriate risk management processes and controls to mitigate risks associated with planned activities, which
would include any crypto-asset-related activities, before receiving a charter or otherwise being authorized tocommence business. The entities should discuss all planned activities with the appropriate regulator prior to filing anapplication.
22

risk management, including board oversight, policies, procedures, risk assessments, controls,
gates and guardrails, and monitoring, to effectively identify and manage risks. 4See Interagency Guidelines Establishing Standards for Safety and Soundness 12 CFR 30, Appendix A (OCC); 12CFR 208, Appendix D-1 (Federal Reserve) and 12 CFR 364, Appendix A (FDIC). See also OCC Guidelines
Establishing Heightened Standards for Certain Large Insured National Banks, Insured Federal Savings Associations,and Insured Federal Branches, 12 CFR 30, Appendix D (OCC).
43