Few banks held crypto. Many held crypto deposits.

The week

Weeks earlier, the crypto exchange FTX had collapsed, and its customers learned how exposed they had been. The shock raised an obvious question for anyone overseeing a bank: how much of this could reach us?

FTX and its affiliated trading firm, Alameda Research, had filed for Chapter 11 bankruptcy on November 11, 2022. Customers found that assets they believed were held for them had been used elsewhere, and withdrawals were frozen. Its founder, Sam Bankman-Fried, was arrested in the Bahamas in December and brought to the United States. On January 3, 2023, the day the bank regulators published their statement, he pleaded not guilty to fraud charges in federal court in Manhattan.

The damage had already reached the banking system. A small number of US banks had built businesses around crypto firms, mainly as places to hold their cash and as payment rails between exchanges and trading firms. Silvergate Bank in California and Signature Bank in New York were the best known. In December, Signature had said it would shrink its crypto-related deposits. On January 5, two days after the statement, Silvergate disclosed that more than $8 billion of deposits from digital-asset customers had left during the fourth quarter. To meet those withdrawals it had sold securities at a loss, and it said it would cut about 40 percent of its staff.

On January 3, 2023, the three main federal bank regulators, the Federal Reserve, the FDIC and the OCC, gave their answer in a joint statement on crypto-asset risks to banking organizations. A crypto-asset is a digital token, such as bitcoin, whose ownership is recorded on a blockchain: a shared electronic ledger copied across many computers rather than kept by one bank or company.

The statement capped more than a year of agency work. In November 2021 the three agencies had published a joint statement summarizing a policy sprint on crypto-assets and promising more clarity during 2022. Earlier OCC interpretive letters, issued in 2020 and January 2021, had said national banks could provide crypto custody, hold stablecoin reserves and take part in the networks that verify crypto transactions. The FDIC asked the banks it supervises to notify it of crypto activities in April 2022. The Federal Reserve set the same expectation for state member banks in August 2022. What the January statement added was the agencies’ shared view of what a year of those notices, and then FTX, had shown them.

Written after FTX’s collapse, the statement listed the risks the agencies were worried about. They included fraud and scams; legal uncertainty over custody and bankruptcy treatment, meaning doubt about who actually owns assets held for others if the holder fails; inaccurate or misleading representations by crypto firms; market volatility; stablecoin run risk; and contagion among interconnected crypto participants, where one firm’s failure drags down others. A stablecoin is a crypto token designed to hold a steady value, usually one dollar, backed by a pool of reserves. Like a bank facing a rush of withdrawals, it can suffer a “run” if holders lose confidence and all try to cash out at once.

The agencies then drew some lines. They said that issuing or holding crypto-assets as principal, meaning for the bank’s own account, on open, public or decentralized networks was highly likely to be inconsistent with safe and sound banking practices. They said business models concentrated in crypto-asset activities, or with concentrated exposures to the sector, raised significant safety and soundness concerns.

The statement was not a rule. It created no new legal requirement and went through no public comment process. It was a supervisory statement: a public signal of how examiners would judge what banks were doing. For a bank that distinction mattered less than it sounds, because examiners’ judgments drive ratings, the approval of new activities and, in the end, enforcement. The agencies also said they would continue to review proposals carefully.

They added a reassurance: banks were neither prohibited nor discouraged from serving any class of customer. But supervisors were watching closely.

Later that month, on January 27, the Federal Reserve denied an application from Custodia Bank, a Wyoming-chartered institution focused on crypto, to become a member of the Federal Reserve System. On the same day it issued a policy statement that state member banks would generally be limited to the activities permitted for national banks. In effect, that applied the same skepticism about holding crypto as principal. The direction across the month was consistent.

A follow-up statement on February 23 addressed liquidity risks from crypto-related deposits. Liquidity is a bank’s ability to pay out money when depositors want it, and the concern was that deposits from the crypto sector could vanish quickly and all at once.

That second statement named two kinds of deposit. The first was money placed by a crypto firm for the benefit of its own customers, whose stability depended on how those end customers behaved and on conditions in the crypto market. The second was deposits that made up a stablecoin’s reserves, which could leave quickly if holders redeemed in large numbers. The agencies asked banks to understand what drove those balances, to watch for concentration and interconnection, and to build the deposits into their contingency funding plans. They also asked banks to check what crypto firms told the public about deposit insurance.

Most coverage read the January statement as a ruling on whether banks could get into crypto. Its more useful message was for the many banks that were already in it without having decided to be.

Take a community bank board meeting in early 2023. A director has read the news about FTX and asks, reasonably, “Do we have any crypto exposure?” The chief executive answers, truthfully as far as anyone knows, “No. We don’t hold crypto and we have no plans to.” The meeting moves on.

That answer was almost certainly incomplete. Headlines focused on banks that wanted to custody crypto or issue tokens. Few banks were in that position. Many more carried crypto-related risk without ever having adopted a crypto strategy.

A bank’s exposure fell into three kinds, each needing a different response: direct activity, deposit concentration, and indirect exposure through partners and customers. The first was the most discussed and the least common. The third was the hardest to see. First, though, the technology, and why regulators were nervous about it.

Keys, ledgers and what worried the regulators

A traditional bank balance is an entry in the bank’s own ledger. The bank keeps the record, and if there is a dispute, the bank’s records, its regulators and the courts settle it. A crypto-asset works differently. Its ownership is recorded on a blockchain, a ledger shared among many computers, any of which can check new entries. A public or decentralized blockchain is one that anyone can join and that no single company controls.

Control of a crypto-asset comes from holding a private key, a long secret code that works like the only key to a safe deposit box. Whoever has the key can move the asset, and there is usually no help desk to reverse a mistaken or fraudulent transfer. That is why the statement’s concerns about custody, meaning holding assets on someone else’s behalf, were so pointed. A custodian has to protect keys perfectly, keep customers’ assets separate from its own, and be clear about who owns what if it fails. FTX’s collapse showed how badly things go when those basics are missing.

Three other features shaped the regulators’ view.

• Volatility. Crypto prices can swing sharply in days. Firms whose business depends on those prices see their revenue and their cash balances swing too.
• Stablecoins. These tokens promise a steady value, backed by reserves often held as bank deposits or short-term securities. If holders want their money back at once, the issuer must pull those reserves out quickly, and a bank holding them feels the outflow directly.
• Interconnection. Crypto firms lend to, trade with and hold assets at each other. When one fails, others can follow, which is what the statement meant by contagion.

Why custody failures are so hard to unwind

The way a custodian holds keys decides how a failure plays out. Some hold each customer’s assets at a separate blockchain address. Others pool many customers’ assets in shared, or omnibus, wallets and keep their own internal ledger of who owns what. Pooling is cheaper and faster, but the blockchain then shows only the custodian’s holdings. If the internal ledger is wrong or has been manipulated, nothing on the chain can correct it. Customers become creditors arguing over a shared pot.

Protecting keys is its own engineering discipline. Keys may be held in hardware security modules, devices built to store secrets without ever exposing them. They may be split so that several people or machines must cooperate to sign a transaction. Large balances are often kept offline, in so-called cold storage, with small amounts online for daily transfers. Each design trades speed for safety, and each needs people, procedures and audit trails that a bank’s existing operations staff may never have run.

Accounting added a further brake. In March 2022 the SEC staff issued Staff Accounting Bulletin 121, which told SEC-reporting companies that safeguard crypto for others to record a liability and a matching asset on their own balance sheets. For a bank, that treatment raised capital questions on top of operational ones, and it helped keep publicly traded banks out of crypto custody until the SEC staff rescinded it in January 2025.

A bank did not have to turn away every customer linked to crypto. It did need to know where the links were, because these features can turn a local problem into a sudden one.

Direct activity

Direct activity was the clearest category under the statement. Holding crypto-assets as principal on public blockchains was described as highly likely to be unsafe and unsound. Custody, stablecoin-related services and similar activities were not banned.

Each agency already had a notice process. An OCC interpretive letter from November 2021 required national banks to show their supervisor adequate controls before starting. The FDIC and the Federal Reserve set their own notification expectations in 2022.

Which process applied depended on who supervised the bank. National banks and federal savings associations dealt with the OCC under its 2021 letter. State-chartered banks that were members of the Federal Reserve System followed the Fed’s August 2022 supervisory letter. State nonmember banks notified the FDIC, and also had to satisfy their state regulator, some of which had their own crypto regimes. Credit unions sat outside the statement entirely. The NCUA had told federal credit unions in December 2021 that they could partner with third-party providers of digital asset services, under their own due diligence. Broker-dealers were in a different regime again, with the SEC and FINRA, where custody of digital asset securities raised its own questions under the customer protection rule.

For a bank considering such activity, the work was defined if demanding. It needed a legal analysis of permissibility under its charter, the license that sets what kind of bank it is and what it may do. It needed a risk assessment, supervisory notice, and controls for key management, segregation of custody assets and illicit finance monitoring. Key management is the protection of those private keys. Segregation means keeping customers’ assets clearly apart from the bank’s own. Illicit finance monitoring is watching for money laundering, sanctions evasion and fraud.

The statement made clear that supervisors expected those controls to be demonstrated in operation rather than described in a policy. In practice that meant very few new entrants in 2023.

What a notice package had to contain

A credible submission looked more like a new-product approval than a policy memo. It named a business owner and a separate risk owner. It described the custody architecture, including any sub-custodian or technology provider, and the contract terms that governed it. It set out how customer assets would be segregated, reconciled daily against the blockchain and reported. It showed how the anti-money laundering program would screen wallet addresses against sanctions lists and analyze blockchain transactions for links to illicit activity, usually with a specialist analytics vendor. It explained how the bank would exit the activity, and return customers’ assets, if it had to.

Supervisors had already shown they would test those claims. In January 2021 the OCC granted Anchorage Digital a national trust bank charter, the first for a crypto firm. In April 2022 it put that bank under a consent order over shortcomings in its anti-money laundering program. The order was a reminder that a charter granted on a business plan still had to be earned in day-to-day compliance.

The cost of all this fell heavily on smaller institutions. A large custody bank could spread specialist staff and vendor contracts across a big client base. A community bank exploring a crypto feature for a few customers faced most of the same fixed costs for a small line of business. That arithmetic, more than any formal prohibition, explains why so few banks moved.

The right question for a board was narrower than whether to “do crypto.” It was whether any business line, vendor contract or pilot already amounted to direct activity that had never been notified. Examples would be a trust department holding tokens for a client, or an innovation team testing a wallet, the software used to hold and send crypto-assets. Large organizations experiment in many places at once, and the board may be the last to hear about a promising pilot.

The places where unnotified activity tended to hide were predictable. Trust and wealth departments might accept a client’s tokens as part of an estate or a managed account. A correspondent or sponsor bank might provide settlement accounts to a crypto firm without treating that as crypto activity. A technology team might sign a proof-of-concept with a blockchain vendor. An inventory meant asking each business line, the vendor management office and the innovation team the same short set of questions, and recording the answers where the risk committee could see them.

Deposit concentration

The second category was more consequential, and it was the subject of the February 23 follow-up on liquidity. A handful of banks had built large deposit bases from crypto exchanges, stablecoin issuers and trading firms. Those deposits were highly correlated, meaning they tended to move in the same direction at the same time. When crypto prices fell or a major firm failed, they could leave together and fast.

To see why that matters, recall how banking works. A bank takes deposits and lends or invests most of them, keeping a cushion of cash and easily sold assets for withdrawals. That works because, in normal times, depositors do not all ask for their money on the same day. A deposit base dominated by customers who will all react to the same piece of news breaks that assumption.

Several mechanics made this worse. Some deposits were held for the benefit of an exchange’s own customers, so the bank’s real counterparties were thousands of retail traders it had never onboarded. Onboarding is the process of checking and accepting a new customer. In effect, the bank was holding money for people it had never met and could not see.

Stablecoin reserves could be pulled to meet redemptions within days. Some banks ran real-time payment networks for crypto firms, which tied operational dependence to deposit balances: the firms kept money at the bank because they used its network, and a shock that made them leave one would make them leave both.

Measuring the exposure

The compliance task for any bank with crypto-sector clients was measurement: which depositors were crypto firms, which balances were held for those firms’ customers, how stable those balances had been through earlier price shocks, and how quickly they could leave.

Many banks classified commercial customers by industry codes that could not tell a crypto exchange from a software company. An accurate picture usually required manual review of the largest relationships, then new fields in the customer record to keep the answer current.

Useful outputs were simple: the share of total deposits from crypto-related clients, the concentration among the top ten such clients, and a stress scenario that assumed most of those balances left within a week. A stress scenario is a rehearsal on paper: assume something bad happens, and check whether the bank could cope.

Treasury and asset-liability committees, the groups that manage a bank’s funding and the match between what it owes and what it owns, could then size liquidity buffers against a specific number rather than a general worry. The same numbers gave examiners evidence that management understood the exposure, which mattered as much as the size of the buffer itself.

One bank’s recount

Suppose a regional bank codes its commercial deposits by industry, and the crypto exchange that banks there is coded as “software.” A manual review of its largest deposit relationships finds that several are crypto firms, and that one holds most of its balance for its own retail customers. The bank adds a flag to the customer record, reruns its numbers, and presents the asset-liability committee with three figures and a one-week outflow scenario. The committee decides how much cash to hold against that scenario. The bank has not changed its strategy at all, but it now knows what it is managing, and so do its examiners.

Why the usual liquidity tools missed it

Banks already had liquidity rules and models, and they mostly did not catch this. The liquidity coverage ratio, the formal requirement to hold enough liquid assets for a 30-day stress, applies in full only to the largest banking organizations. Most regional and community banks rely instead on internal stress tests and a contingency funding plan, guided by the agencies’ 2010 policy statement on funding and liquidity risk management.

Those internal models usually assign each deposit category a runoff rate: an assumption about how much would leave under stress. A commercial operating account, used to pay bills and payroll, is normally assumed to be sticky. A crypto exchange’s operating account looked like that on paper. In reality its balance reflected the mood of thousands of traders, and it could fall by most of its value in days. A model that put it in the operating bucket understated the risk by design.

Deposit insurance made the picture murkier. Money held for a crypto firm’s customers in a for-the-benefit-of account can qualify for pass-through insurance to each underlying customer, but only if the account records and the firm’s own records meet FDIC requirements. Many end customers believed their crypto was insured when only the dollar deposits at the bank could ever be. The February statement asked banks to check how their crypto clients described deposit insurance for exactly that reason.

The backstops had their own limits. Federal Home Loan Bank advances and the Federal Reserve’s discount window require pledged collateral, signed agreements and tested operational steps. A bank that had never borrowed from the discount window could not count on doing so smoothly for the first time on a Friday afternoon.

How the analysis differs by institution

The work looked different depending on the institution. A bank that had chosen crypto firms as a niche needed full segment analysis, with board-approved limits on how much of its funding could come from one sector. A large regional bank with a broad commercial book needed mainly to find the crypto firms hidden among technology clients and to set a concentration trigger. A trust bank or custody bank faced the custody questions above more than the deposit questions. A credit union, outside the federal bank statement but supervised by the NCUA on liquidity and concentration, could run the same analysis on business members and fintech partners. In each case the method was identical; only the scale and the governance changed.

What a fast outflow looks like

The speed is what catches organizations out. Say bad news breaks about a large crypto firm on a Thursday evening. By Friday morning, traders are moving money off exchanges. The exchanges, in turn, draw down their bank balances to meet those withdrawals. A stablecoin issuer sees redemption requests climb and starts pulling reserves. Each of these customers is acting rationally, protecting itself. But they are all doing it at once, and they all bank at the same handful of institutions.

On Friday the bank’s problem is less whether it is solvent on paper than whether it has enough cash and easily sold assets on hand to pay everyone who asks, without selling longer-term holdings at a loss. A bank that ran the scenario in advance already knows the answer and has a plan. A bank that did not is calculating it in real time, while also answering calls from customers, examiners and, increasingly, reporters.

The operational ties matter for the same reason. If the same firms that hold deposits also depend on the bank’s payment network, a hasty exit disrupts both the bank’s funding and a service it may have promoted as a growth line. The risk committee and the business sponsor of that service should be looking at the same numbers.

Limits, triggers and an escalation playbook

Measurement only helps if it is tied to decisions made in advance. A bank with material crypto-sector deposits would set a board-approved limit on the share of funding from that sector and from its largest few clients. Below the limit it would set early-warning triggers. Examples include a sharp daily fall in sector balances, a large drop in crypto prices, a surge in stablecoin redemptions visible on public blockchain data, or bad news about a major counterparty.

Each trigger needs a named owner and a defined response. A first-level trigger might mean daily rather than weekly reporting and a call with the largest clients. A second level might move cash from investments into reserves, confirm that collateral is already pledged at the Federal Home Loan Bank and the discount window, and brief the board chair. The playbook should also cover communications, because a bank under pressure from one sector will be asked about it by other depositors, analysts and journalists within hours.

The trade-off is real. Holding extra liquidity against a volatile segment costs income, and limits may turn away profitable clients. A bank can decide that the business is worth it. What it cannot defend is taking the risk without having priced it.

A bank that offered a real-time payment network to crypto clients could also test the operational side. The scenario should list which clients would stop transacting if they moved their deposits and how much fee income depended on them. It should also show whether the network could be wound down for one client without disrupting others. Those answers belonged next to the liquidity figures.

Indirect exposure through partners and customers

The third category was where most banks and credit unions actually sat. A bank could have no crypto clients in its commercial book and still be exposed.

Fintech partners in banking-as-a-service programs sometimes let end users buy crypto through a third party. Banking-as-a-service is an arrangement in which a technology company offers accounts or cards to the public using a licensed bank behind the scenes; the customer sees the app’s brand, but the bank’s charter stands behind the account. Payment processors served crypto merchants. Retail customers moved funds to and from exchanges. Credit unions, which the statement did not cover, had similar exposure through their own partners and members.

The statement’s risk list, especially fraud, misleading representations and contagion, applied here directly. A fintech partner advertising crypto features to a bank’s customers could create consumer protection and reputation problems for the bank whose charter stood behind the account. A surge in customers sending funds to exchanges, often at the urging of a scammer, was a signal for fraud and anti-money laundering teams.

Addressing this category meant three practical changes. Third-party reviews had to ask partners which crypto features they offered, through which providers, and how they described them to customers. Transaction monitoring, the automated rules that flag unusual payments for a human to review, needed rules that recognized transfers to and from known exchange accounts, with thresholds tuned to the bank’s customer base. And complaint and fraud data had to be tagged so that crypto-related cases could be counted and trended.

Recognizing those transfers is mostly a reference-data problem. The bank needs a maintained list of the account and routing details that the major exchanges use for incoming wires and ACH payments, plus the names under which their card transactions appear. Card payments to exchanges are often coded by the networks as quasi-cash, which affects fees and disputes as well as monitoring. Rules built on that reference data can then distinguish a customer’s first transfer to an exchange from a routine one, and an unusually large transfer from a typical one.

Suppose a credit union has no crypto clients and offers no crypto products. Its fraud team notices that several older members have made unusually large transfers to an exchange in the same month, each after a phone call from someone claiming to be an investment adviser. Because the team tags crypto-related cases, the pattern appears in the monthly report rather than in a string of separate complaints months later. The credit union adds a warning to its online banking, briefs branch staff on what to ask before processing such transfers, and adjusts its monitoring threshold. No strategy decision was needed, only good data and attentive staff.

The fraud patterns behind the transfers

The fraud risk in this category was concrete and growing. The FBI’s Internet Crime Complaint Center reported in its annual report for 2022 that investment fraud had become the costliest type of complaint it received, and much of it involved crypto. Typical schemes started with a text message or a dating-app contact and built trust over weeks before steering the victim to a fake trading platform. Others involved callers impersonating a bank, a government agency or tech support and telling victims to move money to “protect” it, often through cash deposited at a crypto kiosk.

Each of these left traces in a bank’s data before the money left. Typical signs were a first-ever transfer to an exchange, a sudden jump in transfer size, or a customer who withdrew cash and asked branch staff about a crypto ATM. Teams that could see those traces had a short window to step in with a call or a delay. Teams that could not would see the case only when the customer filed a complaint, after the money was gone. Regulation E, the consumer protection rule for electronic transfers, generally does not treat a payment the customer authorized as unauthorized, even when fraud induced it. The cost therefore usually fell on the customer, and on the bank’s reputation, rather than on the bank’s balance sheet.

What the partner contracts needed to say

For banks in banking-as-a-service arrangements, the review questions needed to be written into contracts. Useful clauses required the fintech partner to notify the bank before launching any new crypto feature and to submit customer-facing marketing for review. Others required complaint data on a fixed schedule and the right to audit the third-party crypto provider’s controls. They also required daily reconciliation of the for-the-benefit-of accounts, so the bank always knew which end customer owned which dollars. A partner that resisted those terms was telling the bank something about its controls.

Broker-dealers and wealth managers met this category from another direction. Their clients asked to buy crypto exposure, and firms had to decide which products, if any, they would offer and how they would supervise advice about them. The regulators and rules differed, but the core task was the same: knowing what customers were doing with crypto through the firm, and being able to see it.

The same logic applies to a bank’s fintech partners. The bank may never see the partner’s marketing, but customers will hold the bank responsible if what they were told turns out to be misleading. Asking the right questions at the partner review is far cheaper than answering a complaint from a regulator later.

The same data, pointed at other depositors

The same data work answered a broader question. Customer classification and concentration analytics that find crypto-related deposits also find other correlated groups: deposits from one industry, from clients of one fintech partner, or from one region.

Within weeks of the statement, which depositors would move together under stress became the central question for the whole industry. A bank that had built the fields, the reports and the stress scenario for crypto clients could point them at any other cluster with little extra effort. A bank that had not was starting from scratch at the worst possible moment.

The technique travels well because it relies on behavior rather than labels. Analysts can group depositors by who they bank with, who refers them, what they do and where they are. Then they ask which groups would react to the same news. Venture-backed technology firms, clients of a single fintech platform, firms dependent on one large employer, and municipalities in one region all qualify. Uninsured balances deserve particular attention, because those depositors have the strongest reason to move first.

Some clusters behave differently from others. Public funds from municipalities are often collateralized under state law, which changes the bank’s risk but ties up securities that might otherwise be sold for liquidity. Deposits gathered through a single fintech app can move at the speed of a push notification. Deposits from one local employer may be stable for years and then leave together if the employer is sold. A concentration report that shows each cluster with its insurance status, its collateral and its likely speed of exit gives the asset-liability committee something it can act on.

The data model is not complicated. It needs a field for what the client does, a field for relationships that link clients, a flag for balances held for others, and a regular refresh from relationship managers. The hard part is discipline: keeping those fields current when the people who own client relationships see them as administrative work.

The business stakes are straightforward. Deposits are a bank’s cheapest and most important funding. Losing a concentrated block of them quickly can force a bank to sell assets at a loss or borrow at high cost. Regulators judge management partly on whether it saw the risk coming. Customers judge the bank on whether their money was safe. A bank’s reputation can survive a bad quarter; it rarely survives a run.

The strongest objections, and why the argument still holds

Critics of the January statement made three serious points. First, they said it chilled lawful business: banks read it as a warning to drop crypto clients, and some firms lost their accounts. Documents the FDIC released in 2025 showed that its supervisors had asked some banks to pause crypto activities during 2022 and 2023, which gave weight to that complaint. Second, they said concentration risk was not a crypto problem at all, and the failure of Silicon Valley Bank, which had no meaningful crypto business, proved it. Third, they argued that the compliance burden fell hardest on small banks and pushed crypto firms toward less regulated providers.

Each point has force. None of them undermines the case for measurement. A bank can disagree with the supervisory posture and still need to know which depositors move together. SVB’s failure strengthens rather than weakens the argument, because the same analysis applied to venture-backed depositors would have flagged that risk too. And the burden of measuring concentration is far lower than the burden of discovering it during a run. What the critics fairly reject is treating one industry as uniquely suspect. The analysis here does not need that assumption.

Organizations should confirm with counsel how current guidance applies to their charter, since the rules differ by regulator and changed later.

What a prepared bank could show

A bank that had done the work could say, from its own systems, what share of its deposits came from crypto-related clients and from any other group likely to move together. Its customer records carried flags reflecting what a client actually did, rather than an industry code chosen at account opening, and fields kept that answer current; a review done once goes stale. Industry codes were never designed to identify crypto firms, and they rarely do.

Its asset-liability committee had seen a specific outflow scenario and decided how much liquidity to hold against it, counting a single large account held for an exchange’s customers as what it was: potentially thousands of nervous retail accounts. Its partner reviews asked directly about crypto features, providers and customer disclosures, because a fintech partner may add a crypto feature without thinking of it as a matter for the bank. Its fraud and complaint data were tagged so new patterns showed up in monthly reporting.

The evidence an examiner would ask for

Preparation showed up as artifacts rather than assurances. An examiner reviewing liquidity and concentration risk would typically ask for the deposit concentration report and its definitions. Next would come the latest stress scenarios, the committee minutes that discussed them, and the contingency funding plan with its triggers and named owners. For third-party risk, the examiner would want the inventory of fintech and payment partners, the due diligence files, and the contracts with their notice and audit clauses. For fraud and compliance, it would be the monitoring rules for exchange transfers, evidence that thresholds had been tuned, and trend reports on crypto-related cases.

Ownership mattered as much as content. The treasurer usually owned the deposit analytics, the chief risk officer the concentration limits, the vendor management office the partner reviews, and the BSA officer the monitoring rules. A bank where each of those people could explain their piece, and show when the board last saw it, was in a strong position whatever the policy of the day.

The weaker banks were answering a different question. “We don’t hold crypto” says nothing about depositors, partners or customers.

What a board should ask about crypto depositors and partners

1. Is any part of our organization holding, testing or offering crypto-assets today, including trust services, pilots and vendor arrangements, and has it been notified to our supervisor where required?
2. Which of our depositors are crypto firms, and how much of those balances belongs to the firms’ own customers?
3. What share of our deposits would leave in a week if one sector, one partner or one region lost confidence at once, and has the asset-liability committee decided what to hold against it?
4. Which of our fintech and payment partners offer crypto features to customers on our charter, and how are they described?
5. If an examiner asked tomorrow how well we understand our concentrated deposits, what evidence would we show?

The aim is to make sure the board meeting answer, “we have no exposure,” is true because someone checked, rather than to make a bank anxious about one industry.

With hindsight

The concentration warning arrived quickly. Silvergate, whose deposits came heavily from crypto firms, announced its wind-down on March 8, 2023. Signature Bank, which also held significant crypto-related deposits, was closed on March 12 amid the wider run that followed Silicon Valley Bank’s failure. Within weeks of the January statement, the abstract question of which depositors move together had become a very concrete one, for banks well beyond those with crypto clients.

The mechanics matched what the February statement had described. Silvergate shut down its exchange network, the payment rail that had tied crypto firms to its deposits, on March 3. When Silicon Valley Bank failed on March 10, the stablecoin issuer Circle disclosed that about $3.3 billion of the reserves behind its USDC token were held there. USDC briefly traded well below one dollar that weekend, until regulators said all SVB depositors would be protected. A stablecoin’s reserves, a bank’s deposits and a crypto market’s confidence had turned out to be one connected system. Later reviews, including the FDIC’s report on Signature, attributed that failure mainly to management, rapid growth and heavy reliance on uninsured deposits, which is the concentration point in another form.

The fraud warnings also held up. In September 2023 FinCEN issued an alert on so-called pig butchering, the long-con investment scams that steer victims to fake crypto platforms. The FBI’s later annual reports continued to show crypto investment fraud among the largest sources of reported losses. Bank fraud teams that had learned to recognize transfers to exchanges were better placed to step in.

Policy then reversed. In March 2025 the OCC rescinded its 2021 notice requirement, and on April 24, 2025 the Federal Reserve and FDIC withdrew the January and February 2023 statements. In July 2025 Congress enacted the GENIUS Act, a federal framework for payment stablecoins, the dollar-linked tokens used to move money. Banks now have more room to offer crypto services.

Other pieces moved in the same direction. In March 2025 the FDIC told the banks it supervises that they no longer needed prior approval for permissible crypto activities. The Fed withdrew its own 2022 notification letter in April 2025. In August 2025 it ended the special program it had set up in 2023 to supervise novel activities, folding that work back into normal supervision. The SEC staff had rescinded its custody accounting bulletin in January 2025. Regulators also moved away from reputational risk as a basis for supervisory criticism, and an executive order in August 2025 directed agencies to address what it called politicized debanking.

Banking-as-a-service brought its own reminder. In 2024 Synapse, a middleware firm that sat between fintech apps and partner banks, went bankrupt. Many end users could not reach their money while banks and the bankruptcy trustee tried to reconcile who owned what. The FDIC proposed a recordkeeping rule for custodial accounts later in 2024. The underlying problem was the one this article’s third category described: a bank holding money for customers it could not see.

The 2023 statements were more than a passing mood in Washington. The rules on direct activity changed; the economics of concentrated deposits did not. A bank whose funding comes heavily from customers who all react to the same news is fragile, whatever the industry and whatever the policy of the day.

The measurement work the statement prompted has outlasted the policy, because supervisors judge concentration and liquidity risk the same way whatever industry the depositors are in. Customer fields that show what a client really does, reports that show how deposits cluster, and stress scenarios that test a fast outflow are useful for crypto firms, technology startups, a single large partner or a single local economy alike.

For a bank weighing the new room to offer crypto services, the sequence matters. The controls the 2023 statement described, from key management to segregation of customer assets to illicit finance monitoring, are still what make such services safe. Looser rules change what a bank may do. They do not change what it needs to know about its own balance sheet.