Who checked the people who moved FTX’s money

The week

In November 2022 FTX, one of the largest cryptocurrency exchanges in the world, collapsed in about a week. An exchange, in this world, is a platform where customers deposit money or digital assets and trade them. Customers trust the exchange to hold their assets safely and hand them back on request.

FTX had grown fast. It had raised money from well-known venture firms and institutional investors, bought naming rights and sports sponsorships, and positioned its founder as a sympathetic voice in Washington on crypto regulation. Its group included an international exchange based in the Bahamas and a separate US exchange. Alongside both stood Alameda Research, a trading firm owned by the same founder.

The trouble began with a news report on November 2, 2022, which raised questions about the balance sheet of Alameda Research. The report, by the crypto news outlet CoinDesk, described a leaked balance sheet. It said much of Alameda’s assets consisted of FTT, a token FTX itself had created. For a trading firm so closely tied to the exchange, that was enough to make people nervous about FTX too. If Alameda’s value rested on a token FTX could issue at will, the two firms’ fortunes were bound together.

On November 6, the chief executive of Binance, a rival exchange, said it would sell its holdings of FTX’s token. Binance had received those tokens when it sold its early stake in FTX. A token here is a digital asset an exchange creates and issues itself, which can then be bought and sold. A large holder announcing a sale was a public vote of no confidence.

Customers did what customers do when confidence breaks: they rushed to withdraw. It was a classic bank run, except at an exchange with no deposit insurance and no central bank behind it. FTX stopped processing withdrawals.

On November 8 Binance announced a nonbinding deal to acquire FTX, then abandoned it the next day after reviewing the company. In walking away, Binance cited the results of its corporate due diligence, reports of mishandled customer funds and US agency investigations. The same day, one of FTX’s best-known venture backers told its own investors it was writing its FTX stake down to zero.

Regulators outside the United States moved first. On November 10 the Securities Commission of the Bahamas froze the assets of FTX Digital Markets, the group’s Bahamian subsidiary, and sought the appointment of a provisional liquidator. Other crypto firms with exposure to FTX began limiting withdrawals of their own. The lender BlockFi paused withdrawals that day, and filed for bankruptcy later in the month.

On November 11, FTX and about 130 affiliated companies filed for Chapter 11 bankruptcy. Chapter 11 lets a failing company reorganize or wind down under court supervision while creditors’ claims are sorted out. The founder resigned. Within hours of the filing, the company reported unauthorized transfers out of its wallets, a sign that even after the collapse nobody had firm control of its digital assets.

The new chief executive was a veteran restructuring specialist, someone whose career consisted of taking charge of failed companies. He had overseen the wind-down of Enron. He soon told the court he had found an extraordinary absence of basic corporate controls and reliable records. Money was missing, and the company also lacked the ordinary machinery that would have shown where the money was supposed to be.

Within weeks, prosecutors and regulators set out what had happened. Their December 2022 complaints alleged that customer deposits had been diverted to Alameda. Some customers had wired dollars to bank accounts held by Alameda-controlled entities rather than by the exchange. Those details showed that the failure had passed through the ordinary banking system, not around it.

FTX turned out to be a fraud, as later proceedings established. It was also a failure of diligence by sophisticated parties. Venture investors, banks, payment partners and sponsors had all done business with it. Most had examined growth, valuation and market position. Few appear to have tested governance: whether anyone other than the founder could stop money from moving, and whether customer funds were where customers believed.

Banks, credit unions and other financial institutions meet fast-growing, founder-led counterparties all the time, as depositors, borrowers, fintech partners and vendors. Their diligence usually starts with financial statements. FTX showed that the statements are only as reliable as the structure that produces them. Three questions about that structure cover most of what failed. Who can move the money? Who checks them? And whose money is it?

The questions require no technical expertise in cryptocurrency. They are the same questions a careful board member would ask of any business that handles other people’s money. What FTX added was speed, scale and a technology that removes some of the usual safety nets, which made the answers matter more.

The article first defines the handful of terms the questions depend on. It then takes each question in turn and shows how the three fit into a bank’s existing routines. It contrasts two ways of onboarding the same counterparty, and closes with the costs of getting it wrong and where the exposure tends to hide.

Controls, custody and keys

A few terms come up again and again in this story, and each has a simple meaning.

Internal controls are the routines a company uses to make sure money moves only when it should, records are accurate and mistakes or theft are caught. They are mundane on purpose: two signatures on large checks, separate people for paying bills and balancing the books, regular reviews of who can access what.

Custody means holding assets on someone else’s behalf. A bank has custody of your deposits; a brokerage has custody of your shares. The core promise of custody is that the assets are kept separately and returned when the owner asks.

Segregation is how that promise is kept. Customer assets are held apart from the company’s own money, in accounts or structures that make clear who owns what. If the company fails, segregated customer assets should not be available to pay the company’s other debts.

Reconciliation is the routine of checking that two sets of records agree. A company’s own ledger says customers are owed a certain total; the bank or the blockchain shows what is actually held. Reconciliation compares the two, every day, and investigates any gap.

In cryptocurrency, control rests on private keys. A private key is a long secret code that authorizes moving digital assets. Whoever holds it can move the assets, with no bank in the middle to question or reverse a payment. Possession is control.

Why the usual safety nets were missing

In regulated finance, many of these protections are imposed from outside. A broker-dealer registered with the SEC must follow the customer protection rule, Rule 15c3-3, which requires it to keep customer securities in its possession or control and to hold a reserve for customer cash. A futures commission merchant must segregate customer funds under CFTC rules. An investment adviser with custody of client assets must generally keep them with a qualified custodian under the SEC’s custody rule. Banks are examined and their deposits are insured up to the legal limit.

FTX’s international exchange sat outside all of those regimes. Its promise to keep customer assets separate rested on its own terms of service and its own systems. Nobody outside the company tested the segregation each day, and no reserve requirement forced cash to be set aside. When a firm is not bound by those rules, a counterparty that deals with it has to do some of that testing itself, or price the absence of it.

How the run actually worked

The mechanics explain why the collapse was so fast. Alameda’s balance sheet leaned heavily on FTT, a token whose value depended on confidence in FTX. When Binance said it would sell its FTT, the token’s price fell, which weakened Alameda, which raised doubts about FTX, which pushed customers to withdraw. Each step fed the next.

A bank facing a run can pledge assets to the central bank for cash, and insured depositors have less reason to rush. An exchange has neither cushion. If customer assets have been lent out or spent, withdrawals expose the gap within days. FTX’s customers learned in a week what a bank’s customers might never have discovered at all.

With those terms in hand, the three questions become concrete.

Who can move the money

In a well-run company, authority to move funds is divided. Payments above set amounts need two approvers. The people who initiate payments cannot also approve them or reconcile the accounts. Access to wallets, bank accounts and payment systems is limited, logged and reviewed. FTX’s court filings described the opposite: a few insiders with broad control, and spending approved by informal message.

The idea of dividing authority is sometimes called segregation of duties. It works like a restaurant where the person who takes cash at the register is not the person who counts the till at night. Neither distrusts the other; the arrangement simply makes mistakes and temptation visible.

Diligence can test this directly. Ask for the delegation of authority and the payment approval policy. Ask who holds administrative access to treasury systems and crypto wallets, and how that access is reviewed. Ask for evidence, such as a sample of large payments with their approvals. A company that cannot produce these within a few days is telling the bank something important. The answers belong in the relationship file next to the financials, and they should be refreshed as the company grows, since controls that suited fifty employees rarely suit five hundred.

A delegation of authority is a document that says who may approve what, up to which amount. A treasury system is the software a company uses to manage its cash and move money between accounts. “Administrative access” is the ability to change settings, add users or approve payments outright.

Crypto businesses add a specific item. Control of digital assets rests on private keys, and whoever holds them can move the assets with no bank in the middle to stop a payment. The new management later told the court that FTX had stored keys with little protection. Diligence on a crypto counterparty should ask how keys are generated, stored and split among people, and whether any single person can move funds alone. Well-designed arrangements require several people, or several devices, to act together before assets can move, which is the digital version of two signatures on a check.

Reading the evidence a counterparty provides

Documents are easy to write. The test is whether practice matches them. A delegation of authority that names approval limits is a start. A sample of real payments that shows the named approvers signing off, in the system rather than by chat message, is evidence. A list of system administrators that includes the founder, the founder’s close associates and nobody from finance is a warning, whatever the policy says.

Some signals need no documents at all. Consider a counterparty whose founder answers every control question personally, or whose finance lead is new or absent. Its bank accounts may be opened in the names of affiliates rather than the operating company. Each pattern shows how authority actually flows. The December 2022 complaints alleged that FTX customers had been told to wire money to accounts held by Alameda-linked entities. Any bank holding such accounts could see that the account name and the stated purpose did not match.

The limits of this question

Segregation of duties can be defeated. If the people who approve payments collude with the people who make them, two signatures become one. A founder with enough authority can override any policy. A bank reviewing documents will not catch a determined fraud by insiders who control both the records and the explanation.

That limit argues for asking the question anyway, for two reasons. Most control failures are not fraud; they are growth outrunning process, and the question catches those. And a counterparty that cannot show divided authority at all has removed the obstacle that collusion would otherwise have to overcome. The answer does not prove honesty. It shows how much honesty the arrangement depends on.

Who checks them

The second question is oversight. A board with independent members, an audit committee, an internal audit function and an external auditor with relevant experience are the usual checks. FTX had no functioning board in the ordinary sense. Its financial statements had been audited, but by firms with little profile in auditing complex financial businesses.

Each of those checks plays a different role. Independent directors are board members without a stake in management, who can question the founder without risking their jobs. An audit committee is the group of directors that oversees financial reporting and controls. Internal audit is a team inside the company that tests whether controls actually work, and reports to the audit committee rather than to the people it is checking. The external auditor is an independent firm that examines the financial statements and gives an opinion on them.

For a counterparty, the practical tests are simple. Who sits on the board, and how many are independent of the founder. Whether an audit committee meets and sees internal audit reports. Who the external auditor is, and whether that firm is credible for a business of this size and complexity. And whether the company has had a recent independent review of its controls, such as a service organization controls report. A bank need not demand public-company governance from a startup. It should calibrate its exposure to how much checking actually exists.

A service organization controls report, often called a SOC report, is an independent auditor’s assessment of how well a service company’s controls are designed and whether they operated as described.

What each check does and does not prove

Each form of oversight has a known scope. An audit opinion on financial statements says they are fairly presented in all material respects. It is not a guarantee that controls work, and for a private company the auditor usually gives no separate opinion on internal control. A SOC 1 report addresses controls relevant to customers’ financial reporting; a SOC 2 report addresses security, availability, confidentiality and similar criteria. A Type 1 report describes controls at a point in time; a Type 2 report tests whether they operated over a period.

A bank reading these reports should check the scope as closely as the conclusion. A SOC 2 report on a counterparty’s technology platform may say nothing about how its treasury moves money. A report that excludes the entity holding customer funds does not cover the question the bank cares about. The exceptions section, where the auditor lists controls that failed testing, is often the most useful page.

Matching the check to the counterparty

Investors in FTX included firms with deep experience in technology companies. Their diligence focused, reasonably for their purposes, on growth and market position. A bank’s purpose is different. It needs to know whether money held for others will be there, and whether payments through its accounts are what they appear. That calls for different questions, even when a well-known investor has already done its own review.

Mapping the group and its related parties

FTX was a group of about 130 companies, and the money moved between them. That structure is common among fast-growing firms, which often add entities for each country, product or funding round. Oversight that covers one entity may miss the others.

A bank can ask for a group structure chart and mark three things on it. One is which entity contracts with customers. Another is which entity holds the bank accounts and digital wallets. The third is which entities the external auditor actually covers. Where those differ, the gaps are where customer money can move without anyone checking.

Related-party transactions deserve the same attention. These are dealings between the company and its owners, executives or affiliates: loans, shared services, trading arrangements. The December 2022 complaints alleged large loans from Alameda to the founder and other executives, and an arrangement that let Alameda draw on the exchange in ways other customers could not. A counterparty should be able to list its related-party dealings and show who approved them. Silence on the subject, or an affiliate that trades on the counterparty’s own platform with special terms, should change the bank’s view of the whole relationship.

The same questions apply to vendors. Third-party risk programs ask detailed information security questions and look at financial health. Governance questions, especially for young, fast-growing or founder-controlled suppliers, deserve equal weight.

The case for proportion is strong. A three-year-old company with sixty staff will not have a fully independent board and an internal audit department, and a bank that demanded them would bank no startups. The workable approach sets a minimum, such as a named finance lead separate from the founder, an external auditor appropriate to the business and dual approval for large payments. It then limits exposure until more exists: smaller credit lines, lower deposit caps, more frequent reviews.

Whose money it is

The third question is the one that mattered most to FTX’s customers. Customer assets were not held separately from company and affiliate funds, and money moved between the exchange and the founder’s trading firm. When withdrawals surged, the assets were not there.

For a bank, this question arises whenever a counterparty holds other people’s money: a payments company, a fintech program manager, a crypto platform, a broker. The bank should know how customer funds are held, in which accounts and under what legal arrangements, and how the counterparty reconciles them. Where the bank itself holds those accounts, it has a direct view. It can see whether balances in accounts labeled for customers move to affiliates or are used for operations.

Reconciliation is the weak point even without fraud. In 2024 the collapse of Synapse, a middleware firm that kept the ledgers for fintech programs at several partner banks, left end users unable to reach their money while the records were untangled. A bank that holds pooled customer accounts for a partner should be able to reconcile them to individual customers on its own, without relying solely on the partner’s systems.

A pooled account, sometimes called an omnibus account, is a single bank account that holds money for many end customers at once. The bank sees one big balance. The partner keeps the ledger that says how much of it belongs to each person. If that ledger is wrong, or the partner fails, the bank may hold the right total but be unable to say who is owed what. Middleware, in this setting, is the technology layer between a bank and the consumer-facing app, and in the Synapse case it was where the individual records lived.

Why the records decide who is protected

Pooled accounts carry a legal consequence that many partners misunderstand. FDIC deposit insurance can pass through a custodial account to each underlying owner, but only if the account records show the custodial relationship and the records of who owns what are maintained. If the records are missing or wrong, the end customer may not be treated as an insured depositor. Marketing that tells consumers their money is insured does not make it so.

That gives the bank a practical task. It should know where the beneficial ownership records live, how often they are reconciled to the bank’s balance, who performs the reconciliation and what happens to unreconciled differences. A bank that receives a daily file of individual balances and checks that they add up to the pooled total has a defensible process. A bank that sees only the total has handed the question to its partner.

How the question differs by institution

A community bank that runs a banking-as-a-service program faces the question most directly, because it holds the pooled accounts and its name is on the deposit. A credit union is less likely to hold accounts for crypto exchanges, given field-of-membership limits, but it meets the same structure in fintech partnerships and in credit union service organizations that handle member money. The NCUA has long asked Congress for authority to examine third-party vendors directly, which it lacks, so a credit union’s own diligence carries more of the weight.

A broker-dealer or wealth manager meets the question from the other side. It may itself hold client assets at a crypto platform or a payments firm, or recommend products that do. Its own segregation duties under SEC rules do not travel with the money once it leaves for an unregulated counterparty. The diligence has to establish how that counterparty segregates, in writing, before client assets move.

Deposit concentration is the bank’s own version of this risk. Several banks had built large deposit bases from crypto firms. Those deposits were cheap and growing, but correlated and flighty, since many depositors would react to the same news at once. Measuring deposits by sector, stress testing correlated outflows and holding liquidity accordingly turns that risk from a surprise into a priced choice.

Stress testing here means working out, in advance, what would happen if a large share of these depositors withdrew in the same week. It checks whether the bank could pay them without selling assets at a loss. Liquidity is the cash and easily sold assets a bank holds to meet such withdrawals.

Boards of financial institutions are part of the answer. They approve strategies that bring in concentrated deposits and new partners. Reporting that shows the governance quality of major counterparties, alongside sector concentration, gives directors something to challenge before the next collapse rather than after.

How this works inside a bank, day to day

Governance diligence needs no separate department. It slots into routines most banks already run, and the practical challenge is making sure the three questions travel through each of them.

At onboarding, a relationship manager gathers documents and a credit or risk team reviews them. This is the natural moment to request the delegation of authority, the payment approval policy, board composition and the auditor’s name. A business holding customer money should also describe how those funds are held and reconciled. A short standard checklist makes the request routine rather than awkward; founders are less likely to bristle at a form everyone receives.

Banks already have a legal hook for this. The customer due diligence rule under the Bank Secrecy Act requires covered institutions to understand the nature and purpose of customer relationships. They must also identify beneficial owners of legal entity customers and monitor on an ongoing basis. Those duties exist to fight money laundering. The information they produce, about who owns and controls a business and what its accounts are for, is the same information the governance questions need.

During the relationship, the bank sees something no outside investor sees: the actual flow of money through the accounts it holds. Transaction monitoring systems already scan those flows for signs of money laundering and fraud. The same visibility can answer governance questions: whether funds in an account labeled for customers are moving to an affiliate, or whether large payments are leaving accounts at unusual times or to unusual destinations. Someone has to be asked to look, and told what to do when they see it.

Turning visibility into monitoring rules

A few rules cover most of the risk. One flags transfers from an account designated for customer funds to any account owned by an affiliate or insider. Another flags incoming customer payments to an account whose holder is not the entity the customer is supposed to be paying. A third watches the ratio of the pooled balance to the partner’s reported customer liabilities, where the bank receives those figures, and flags any persistent shortfall.

Each alert needs an owner who understands the business as well as an anti-money-laundering analyst. A transfer to an affiliate may be a legitimate fee. Someone in the relationship or credit team has to judge it, document the explanation and escalate when the explanation does not hold.

At annual review, the relationship file is refreshed. For a stable, slow-growing customer that may take little effort. A counterparty that has doubled its staff, entered new markets or raised large sums is a different case. The review should repeat the governance questions, because controls built for a small company often lag behind a large one.

Event triggers matter as much as the calendar. A new funding round, a change of chief financial officer or auditor, a move into a new product line or a sharp rise in deposits should each prompt an early review. A resignation in the finance function at a fast-growing counterparty is information a bank should act on within weeks, not at the next anniversary.

At the portfolio level, treasury and risk teams aggregate. They add up deposits by sector, model how fast those deposits could leave, and report concentrations to management and the board. This is where one relationship’s risk becomes visible as part of a pattern.

Who owns each step

The work crosses lines that banks usually keep apart. Relationship managers own the customer and the documents. Credit and risk teams own the assessment. Financial crimes teams own transaction monitoring. Treasury owns liquidity and concentration. Third-party risk management owns vendors and fintech partners. Without a named owner for counterparty governance across those teams, each assumes another has it.

A simple fix assigns the governance file to the credit or risk function, with inputs from the others written into their procedures. The relationship manager collects, the financial crimes team reports relevant alerts, treasury reports concentration, and one team pulls it together for each significant counterparty.

The work requires no new technology, only the right questions written into the forms, monitoring rules and reports the bank already uses.

Two ways to onboard a payments company

Suppose a regional bank is approached by a fast-growing payments company that wants to open operating accounts and a pooled account for its customers’ funds. The relationship would bring in substantial deposits.

A bank doing this well treats the onboarding as more than a credit decision. Alongside the financial statements, it asks for the delegation of authority and the payment approval policy. It also asks for a list of people with administrative access to treasury systems and a sample of recent large payments with their approvals. It looks at the board and the auditor. It asks how customer funds are reconciled, and it builds its own ability to match the pooled balance to individual customers. Its treasury team adds the new deposits to a sector concentration report and runs a scenario in which they leave quickly. The relationship manager is told to refresh the governance file each year, and sooner if the company’s headcount or volumes jump.

That bank also writes its expectations into the account agreement. The agreement requires a daily file of individual customer balances, notice of changes to key finance staff or the auditor, and the right to review reconciliations. It sets a deposit level above which the relationship goes back to committee. None of those terms is unusual in banking-as-a-service contracts, but each must be asked for at the start.

A bank doing this badly approves the account on the strength of growth figures and a well-known investor list, files the financials, and moves on. Two years later it has no idea whether the controls kept pace with the company, and its customer-funds account is reconciled only by the partner’s software.

What the careful approach costs

The careful approach has a price. It takes more time at onboarding, and a fast-growing company courted by several banks may go to the one that asks less. Relationship managers paid on deposit growth will feel that. Building an independent reconciliation means data feeds, staff time and agreement from the partner. Smaller banks may lack people with the experience to judge a crypto key-management arrangement.

Those costs are real but bounded. The checklist and monitoring rules are one-time work reused across relationships. The reconciliation is a condition the bank can price into the deal. And the cost of the alternative, a counterparty failing with the bank’s name on its customer accounts, falls on the bank’s balance sheet, its supervisory standing and its reputation at once.

The errors are easy to spot in hindsight:

• Mistaking reputation for diligence. Famous investors and sponsors are not evidence of controls. In FTX’s case, few of them appear to have tested governance either.
• Reading the numbers, not the structure. Financial statements describe what the company says happened. Governance determines whether that description can be trusted.
• Diligence once, at onboarding. A company that doubles in size each year is a different company each year.
• Relying entirely on a partner’s ledger. If the bank cannot reconcile customer funds independently, it is trusting rather than verifying.
• Counting cheap deposits as stable deposits. Money from one sector can leave together, and fast.
• Ignoring the names on the accounts. Customer payments to an affiliate’s account are a governance signal, whatever the stated reason.

The cost of a collapsed counterparty

The direct costs of getting this wrong are obvious: losses on loans, frozen relationships, legal bills and remediation. The indirect costs can be larger. A bank associated with a collapsed counterparty draws attention from supervisors, questions from its own depositors and uncomfortable headlines. A sudden outflow of concentrated deposits can strain liquidity at exactly the wrong moment.

There is a customer dimension as well. When a partner fails, the people stranded are often ordinary consumers who never knew which bank sat behind their app. They will remember the episode, and regulators will ask what the bank knew. Asking three plain questions early is cheap by comparison.

How the costs travel

Losses from a failed counterparty spread through several channels. Credit exposure is the obvious one. Litigation is another: customers and bankruptcy estates may sue banks that processed payments for a failed firm, and defending those suits is costly even when the bank prevails. Supervisory attention is a third. Examiners who find weak counterparty oversight can require remediation plans, restrict new business or, in serious cases, issue public enforcement actions.

The liquidity channel can be the fastest. When one firm in a sector fails, depositors from the same sector often withdraw from banks seen as exposed, whether or not those banks dealt with the failed firm. The bank’s exposure to FTX itself may be small while its exposure to FTX’s peers is large.

The argument against all this

A serious objection is that banks should not police the internal governance of their customers. Too much scrutiny of a lawful business can slide into refusing whole sectors, which leaves legitimate firms without banking. Supervisors and lawmakers have criticized that pattern, often called de-risking or debanking.

The governance questions are a different tool. They do not ask whether a sector is acceptable. They ask whether a specific counterparty has the structure its role requires, and they size exposure to the answer. A well-governed crypto firm should pass them more easily than a poorly governed payments company. That is a narrower and more defensible standard than refusing a sector, and it is the one a bank can explain to an examiner and a customer alike.

Where counterparty risk hides in the portfolio

• For our largest fast-growing counterparties, do we have a delegation of authority, a payment approval policy and evidence that large payments are actually approved as described?
• Who at each counterparty can move money alone, including through crypto wallets or private keys?
• For every account we hold that contains other people’s money, can we reconcile the balance to individual customers ourselves?
• How much of our deposit base comes from a single sector, and what happens if it leaves in a week?
• What does the board see about counterparty governance, as well as counterparty size?

The places to look first follow from those questions. Banking-as-a-service programs hold other people’s money in pooled accounts. Deposit relationships with a single industry concentrate correlated outflows. Vendors that process payments on the bank’s behalf hold funds in transit. Lending to founder-controlled companies relies on statements produced by structures nobody has tested.

A practical first pass ranks counterparties by two measures: how much of other people’s money they touch through the bank, and how fast they have grown. The top of that list is where the governance file should be thickest. For many institutions the list is short, and the review can be finished within a quarter using the documents and monitoring the bank already has.

With hindsight

FTX’s founder was arrested in the Bahamas in December 2022, the same month the SEC and CFTC filed civil charges and federal prosecutors in New York unsealed an indictment. Several of his closest associates pleaded guilty and cooperated. He was convicted of fraud and conspiracy in November 2023 and sentenced in March 2024 to twenty-five years in prison.

The bankruptcy took longer. The court confirmed a reorganization plan in October 2024, and the estate recovered enough to begin repaying customers in 2025, based on the dollar value of their claims at the time of the collapse. For customers, that meant waiting years and receiving value fixed at the moment the exchange failed. Those who had held assets that later rose in price did not share in the rise.

The banking consequences came sooner. In January 2023 the Federal Reserve, FDIC and OCC issued a joint statement on crypto-asset risks to banking organizations. In February they followed with a statement on liquidity risks, which singled out deposits from crypto firms, including deposits held for the benefit of the firms’ customers. Both statements described the risks this article covers: correlated deposits, fragile counterparties and unclear ownership of pooled funds.

In March 2023 Silvergate Bank, which had served many crypto firms, announced it would wind down. Regulators closed Signature Bank, which also held large crypto-related deposits, in the same week Silicon Valley Bank failed. Those events showed that the deposit concentration risk described above was not theoretical. Deposits from one sector, and from customers who reacted to the same news, could leave together.

Third-party oversight tightened in parallel. In June 2023 the three federal banking agencies issued final interagency guidance on third-party relationships, applying one framework to banks’ vendors and fintech partners alike. After Synapse failed in 2024, the agencies issued a joint statement on bank arrangements with fintechs that deliver deposit products. The FDIC also proposed a rule requiring banks to keep better records for custodial accounts that hold money for many end users. Those steps went at the “whose money is it” question directly.

Supervisors then pressed harder on deposit concentration and liquidity. From 2025, with federal stablecoin legislation and a more permissive stance from bank regulators, banks have re-entered digital asset businesses. The agencies withdrew their 2023 crypto statements and earlier notification expectations during 2025, and the GENIUS Act, signed in July 2025, set a federal framework for payment stablecoins. A stablecoin is a digital token designed to hold a steady value, typically tied to a currency such as the dollar, which makes it a natural point of contact between crypto firms and banks.

That re-entry makes the governance questions more relevant, not less. Banks are once again opening accounts for, lending to and partnering with fast-growing digital asset firms. The same pressures that shaped FTX’s relationships, competition for deposits, the appeal of rapid growth and the reassurance of famous backers, are present again. Stablecoin reserves held at banks add a new kind of concentrated, correlated deposit to watch.

What held up from 2022 is the diagnosis. The failures that followed, from Silvergate’s wind-down to Synapse’s missing records, turned on concentrated deposits and unclear ownership of pooled funds, the ground the third question covers. What changed is the policy mood: the caution of 2023 gave way to encouragement by 2025. That shift moves more of the burden onto each institution’s own diligence.

The three governance questions remain the cheapest diligence a bank can do on any fast-growing counterparty, crypto or not. Asking who can move the money, who checks them and whose money it is takes days, not months. A counterparty that answers them clearly is easier to trust; one that cannot is telling a bank what it needs to know before anything else goes wrong.