OCC Interpretive Letter 1170

Someone who does not want to protect their BTC keys themselves may seek a custodian. Customer interest alone is not enough for a bank: it must also have authority to provide the service. In Letter 1170 of 22 July 2020, the OCC, the US authority supervising certain banking institutions, confirmed that cryptocurrency custody, including holding the associated keys, can fall within existing banking powers. That is the central conclusion. It is not an announcement that bitcoin can now be deposited at any branch. Legal authority, a bank’s decision to offer a service and actually operating it are separate steps. [1]

Banks safeguarded documents and valuables long before Bitcoin. The letter asks whether the same function can be delivered electronically. It refers to 12 CFR 7.5002, a provision of US banking regulations allowing otherwise permissible activities to be performed electronically. With BTC, a bank is not putting digital coins in a physical vault. It protects private keys, secret information needed to create a signature authorizing a transfer; the Bitcoin network records the transactions themselves. Technology has changed while the purpose of safekeeping remains. That reasoning does not make bitcoin legal tender or give a bank unlimited new powers. [1]

The conclusion covers US national banks, meaning federally chartered banks, and expressly extends to federal savings associations, federally chartered savings institutions. Letter 1170 is not a worldwide rule for all banks. Here, national bank does not mean a state-owned bank or a central bank. For a particular service, establish which legal entity provides it, where it is licensed and what role it undertakes in the contract. This US interpretation alone does not give a customer outside the United States access to a local service. [1]

The letter distinguishes fiduciary and non-fiduciary custody. A fiduciary role carries special legal responsibility when administering another person’s property, for example an estate; it is not merely a polite way to describe a trustworthy firm. For national banks with the necessary powers, the letter refers to 12 CFR Part 9, and for federal savings associations to Part 150. By contrast, a provider merely safeguarding keys and following customer instructions may act in a non-fiduciary capacity. An estate administrator handling BTC and that provider therefore need not have the same mandate. Fiduciary duty is also no guarantee of positive returns or protection against every loss. [1]

Footnote 37 describes both storing a copy of a customer’s key and transferring assets to the bank’s control. In an example where a signature from a single key is enough to transfer, two copies of the same secret allow either holder to act independently. This is not Multisig, an arrangement specifying how many signatures from different keys a transfer needs. When describing safekeeping, the agencies’ joint statement of July 2025 explains control under which neither the customer nor another party can unilaterally move assets outside the bank’s control. An old key copy alone does not establish that state. The statement creates no new supervisory expectations and does not simply ban the key-copy service in the original letter; the actual service provided must be distinguished. [1] [4]

Footnote 39 also lists related services: trade execution, settlement, recordkeeping, valuation and reporting. It permits subcustody, where another custodian performs part of the safekeeping and its operational controls need scrutiny. Letter 1184 of May 2025 confirms customer-directed purchases and sales and the use of third parties for permissible services. If a customer instructs the bank to sell 2 BTC, that does not give it free rein to invest the entire remaining account. The particular contract and instruction define the mandate, not the general word custody. [1] [3]

The letter requires safe and sound operations and discusses risk management, separation of duties, asset protection, reliable records and audit, meaning independent scrutiny of controls. For example, two people may approve a withdrawal in a banking application. That alone does not show that nobody has uncontrolled key access or that access can be restored after a failure. Before accepting an account, the bank should assess the customer’s needs, operational demands and its own capabilities. An OCC reference in a contract or advertisement does not certify that a particular system has passed such scrutiny. [1]

In March 2025, Letter 1183 rescinded the special process under Letter 1179 of 2021 and reaffirmed the conclusions of 1170. It removed a special advance supervisory nonobjection procedure, not ongoing supervision and legal duties. May’s Letter 1184 then clarified trades and outsourcing, meaning the involvement of an outside provider. A standalone sentence from 2020 is therefore insufficient for a service today. Later developments and the particular contract matter too. None of these letters turned BTC into an insured cash deposit: US FDIC insurance does not cover crypto-assets themselves. [2] [3] [5]