Why Basel’s 1,250% risk weight pointed banks toward custody

The week

In the spring of 2021, bank boards everywhere were hearing the same question from clients, investors and their own children: why don’t we own bitcoin? Prices had soared, large investment firms were piling in, and the idea that banks were missing out had become a staple of financial television.

The enthusiasm had concrete markers. Tesla disclosed a $1.5 billion bitcoin purchase in February 2021. Coinbase listed its shares on Nasdaq in April. Bitcoin reached a record in mid-April, then fell sharply in May, as Chinese authorities moved against crypto mining and trading. By the time bank regulators spoke, boards had seen both the rally and the drop within a few weeks.

In the United States, the OCC had spent the previous year opening doors. Interpretive letters in July and September 2020 confirmed that national banks could provide crypto custody and hold deposits that serve as stablecoin reserves. A January 2021 letter said banks could act as nodes on blockchain networks and use stablecoins for payment activities. Permission to engage in an activity, though, says nothing about how much capital it consumes. That question belonged to the capital rules, and internationally to Basel.

On June 10, 2021, the Basel Committee on Banking Supervision gave its first detailed answer. The Basel Committee is the body through which banking regulators from the world’s major economies agree on common standards, most importantly on capital, the cushion of the bank’s own money that absorbs losses so depositors do not have to. Its standards are not law on their own, but national regulators generally write them into their rules.

The committee had circled the subject before. In March 2019 it published a statement setting minimum supervisory expectations for banks with crypto exposures. In December 2019 it issued a discussion paper asking how a prudential treatment should be designed. The June 2021 document turned those questions into a concrete proposal.

That day it published a consultative document, a formal proposal open for comment, on the prudential treatment of banks’ crypto-asset exposures. “Prudential” refers to rules meant to keep banks safe and solvent; an “exposure” is any position through which a bank could lose money.

It proposed two groups. Group 1 covered tokenized versions of traditional assets and stablecoins with effective stabilization mechanisms. A tokenized asset is a conventional asset, such as a bond or a deposit, represented as a digital token on a blockchain, the shared digital ledger that crypto assets run on. A stablecoin is a crypto token designed to hold a steady value, usually one US dollar, typically by being backed with reserves. These Group 1 assets would broadly be treated under existing capital rules for the equivalent assets, with some add-ons.

Group 2 covered other crypto assets, including bitcoin, which would face a new conservative treatment: a 1,250% risk weight, which in effect requires a bank to hold capital equal to the full value of the exposure. For every dollar of bitcoin a bank owned, it would need to set aside roughly a dollar of its own capital. No borrowed money, no deposits: the bank would be paying for the position entirely out of its own pocket.

The committee set a comment deadline of September 10, 2021. It described its proposals as preliminary, called crypto assets a rapidly evolving asset class, and said policy development was likely to involve more than one consultation. Banks, trade associations and crypto firms used the comment period to argue that the Group 2 treatment was too harsh and that hedging deserved recognition. Supervisors largely held their position on the core of it.

The committee was explicit about the stakes. Its press release described banks’ crypto exposures as currently limited, so the proposal was about what banks might do next rather than a clean-up of existing positions. Central bank digital currencies, which some central banks were then studying, were left out of scope. The capital question was being settled before the business had grown, which is the easiest time to set a conservative rule.

The consultation came amid strong institutional interest in crypto assets, and in the same week El Salvador’s legislature voted to make bitcoin legal tender, meaning it had to be accepted as payment in that country alongside the US dollar. Enthusiasm was high. The world’s bank regulators, in contrast, were signaling caution about one particular way banks might take part, while leaving room for others.

The document also carried a narrower signal about scope. It addressed banks’ own exposures: assets on the balance sheet, derivatives, and the operational risks of crypto activities. It did not try to regulate crypto markets themselves, which remained the business of securities, commodities and payments regulators. For a bank, the capital rules answered one question only: what each activity would cost to carry.

Suppose you sit on the board of a mid-sized bank in mid-2021. At the last meeting, a director asked, half joking, why the bank was “sitting out the biggest financial story of the decade.” A large commercial client has asked whether the bank can hold its bitcoin. The head of payments has been invited to a working group on stablecoins. A local credit union down the road has just announced that members can buy crypto through its app. Everyone seems to be talking about “crypto” as if it were one thing. Read carefully, the Basel proposal showed that it was not.

A 1,250% risk weight is a regulator’s way of saying a bank may hold an asset only if it funds the position entirely with capital. That makes a balance sheet position in bitcoin unattractive for any bank that needs its capital to earn a return. The consultation did not ban crypto activity. By pricing one activity out, it showed that banks interested in crypto assets were choosing among three separate businesses, each with its own economics, risks and supervisory concerns: holding crypto assets as principal, safeguarding them for clients, and moving value through tokens and stablecoins.

How one number settled the argument

A single number could settle a strategic debate because of the way bank capital works.

A bank funds itself mostly with other people’s money: deposits and borrowing. A smaller slice is the bank’s own money, its capital, contributed by shareholders and built up from retained profits. Capital is the shock absorber. If loans go bad or investments fall in value, capital takes the loss first. Regulators require banks to hold a minimum amount of it, and shareholders want that capital to earn a good return.

Not every asset is equally risky, so regulators do not ask for the same capital against everything. Instead, each asset is given a risk weight. A very safe asset gets a low weight, a riskier one a higher weight. The bank multiplies each asset by its weight to get its “risk-weighted assets,” and must hold capital equal to at least a set percentage of that total. Under the Basel framework, the baseline minimum total capital requirement is 8% of risk-weighted assets.

That is where the 1,250% figure comes from. Multiply 1,250% by 8% and you get 100%. A 1,250% risk weight is simply the number that makes the capital requirement equal to the full value of the asset.

Ten million dollars of bitcoin

Take a regional bank considering putting $10 million of bitcoin on its balance sheet. Under the proposed treatment, it would need to hold about $10 million of capital against that position. Compare a $10 million loan to an ordinary business borrower carrying a 100% risk weight: at the 8% minimum, that loan needs about $800,000 of capital. The bitcoin position ties up more than twelve times as much of the bank’s scarcest resource.

Then there is return on equity, the profit a bank earns on its shareholders’ capital. Even if bitcoin rose sharply, the gain would be spread across a mountain of capital. If it fell sharply, as volatile assets do, the loss would hit capital directly. The same capital could instead support many loans, each earning a steady margin. No board looking at those numbers would choose bitcoin on the balance sheet, and the proposal was built so that none would.

Why regulators chose a blunt number

Capital rules usually try to match capital to measured risk. For most assets, regulators and banks have decades of loss data, and risk weights reflect that history. In 2021, bitcoin had a short, extremely volatile price history and no record through a full credit cycle. There was no reliable basis for a model, and supervisors did not trust banks’ own models to fill the gap.

The 1,250% weight was not new. The Basel framework already used it for exposures supervisors could not measure with confidence, such as certain securitization positions and some fund investments where the bank cannot see the underlying holdings. Applying it to unbacked crypto assets placed them in that same category: positions to be paid for entirely with capital until better information exists.

The case against the number

Critics argued that the treatment ignored hedging and diversification, and that it would push crypto activity into less regulated firms. The second point had force. Clients who wanted exposure would get it elsewhere, from exchanges and nonbank platforms with weaker protections. The committee’s implicit answer was that keeping a volatile, unproven asset out of insured banks mattered more than where the activity went. The events of 2022 made that answer easier to defend. They did not settle whether pushing activity outside the banking system made customers safer overall.

Holding: priced out by design

The first business, principal exposure to unbacked crypto assets, was the one the proposal targeted most directly. “Principal” means the bank owns the asset itself and bears its gains and losses; “unbacked” means the asset, such as bitcoin, is not tied to any reserve or underlying claim. A volatile asset backed fully by capital produces a very low return on equity.

The proposal also limited recognition of hedges and raised operational risk questions. A hedge is an offsetting position meant to reduce risk. Banks normally get some capital relief for hedging; limiting that recognition removed an obvious route around the cost. For almost every bank and credit union, the arithmetic settled it: holding was not a business.

That mattered because much of the 2021 pressure on bank leaders, from boards, clients and the press, was framed as holding: why not own bitcoin, or offer exposure to it from the balance sheet? The proposal supplied a clear, external answer. It also exposed the distance between the business that attracted headlines and the businesses that might actually pay.

One nuance remained. Offering clients exposure through regulated funds, where the bank acts as broker or distributor, is a different activity from holding as principal. That is closer to the safeguarding and brokerage business, with conduct and suitability obligations in place of capital ones. Conduct and suitability rules are about treating customers fairly, including making sure a product fits the customer’s circumstances and understanding.

Beyond direct ownership

Holding is wider than buying coins. A bank can take price exposure through derivatives, through investments in funds that hold crypto assets, or by lending against crypto collateral. The proposal reached these routes too. Its conservative Group 2 treatment covered indirect positions, such as those held through funds or derivatives, as well as direct holdings.

That closed the obvious workaround of structuring price exposure as a derivative to lower the charge. Lending against crypto collateral raised a related question: how much, if at all, the collateral reduced the loan’s capital charge. Given the volatility, banks were wise to assume very little and to check the national rules that applied to them. Lending to crypto firms on ordinary terms remained possible, priced and limited like any other concentrated, volatile credit.

Exposure through clients

The capital rule priced the asset. It did not price the bank’s exposure to crypto businesses as customers. A bank could hold no bitcoin at all and still depend heavily on deposits from exchanges and crypto firms, or lend to miners whose ability to repay rose and fell with the coin’s price. Those exposures fell under ordinary credit, liquidity and concentration risk management.

They proved more dangerous than the capital debate suggested. Deposits from crypto firms tend to move together, because the firms react to the same market news. A bank with a large share of such deposits faces a correlated run risk that no risk weight captures. Boards that asked only about holding missed this channel entirely. The questions belong in the liquidity and concentration limits, with a named limit on deposits from any one industry.

Answering the board’s question

The director who asked why the bank was missing out deserved more than a capital calculation. Most of the gains the director had in mind went to holders of the asset, not to its custodians or brokers. A bank that wanted to let clients share in those gains could do so through brokerage or a partner platform, with the client taking the price risk. The bank would earn fees and carry conduct obligations rather than market risk. Separating “clients can own bitcoin through us” from “we own bitcoin” usually ended the debate.

Safeguarding: an operational business with modest capital

The second business was custody. Custody means looking after assets on behalf of their owners, the way a bank vault holds clients’ valuables or a custodian bank holds pension funds’ shares. The client keeps the gains and losses; the bank earns fees for keeping the assets safe.

With crypto assets, safekeeping has a particular meaning. Ownership on a blockchain is controlled by a private key, a long secret number that authorizes transfers. Whoever holds the key can move the asset, and there is usually no way to reverse a transfer once made. Losing the key is like losing the only key to a safe that cannot be drilled, and a stolen key usually means the assets are gone for good.

A bank safeguarding crypto assets for clients takes little price exposure but substantial operational risk: generating and protecting private keys, segregating client assets, reconciling on-chain and internal records, and answering for loss or theft. “Segregating” means keeping each client’s assets separate from the bank’s own, so they are protected if the bank fails. “Reconciling on-chain and internal records” means checking that the bank’s own books match what the public blockchain shows. In the United States, the OCC, which charters and supervises national banks, had confirmed in 2020 that national banks could provide crypto custody services, and several large custodians were building offerings.

Custody is an operations and technology business. Its economics depend on scale, automation and the cost of security controls such as hardware security modules, multi-party approval of transfers, and insurance. A hardware security module is a tamper-resistant device built to generate and store keys so they never appear in ordinary computer memory. Multi-party approval means no single employee can move assets alone.

Choices in key management

The core engineering decision in custody is how keys are generated, stored and used. Hardware security modules keep keys inside tamper-resistant devices. Multi-signature wallets require several keys, held by different people or systems, to approve a transfer. Multi-party computation splits a key into shares so that the full key never exists in one place. Each approach has different failure modes and different audit evidence.

Custodians also tier their storage. Most assets sit offline in cold storage, which is slow to access but hard to attack. A smaller working balance stays in warm or hot wallets for routine transfers. The split is a business decision as much as a technical one, because clients who want fast withdrawals push assets toward the riskier tiers. Key ceremonies, the formal procedures for creating and backing up keys, need witnesses, scripts and records an auditor can examine.

Who custody suits

Custody fits institutions that already run custody at scale. Global custodian banks had the client base, the operations and the regulatory standing, and BNY Mellon launched a digital asset custody platform in October 2022. State-chartered trust companies and Wyoming’s special purpose depository institutions offered another route for specialist firms.

The rules differ by type of firm. A broker-dealer holding digital asset securities faced SEC custody requirements, and a December 2020 Commission statement set conditions for special purpose broker-dealers to hold them. An investment adviser must keep client assets with a qualified custodian, which made the question of which banks and trust companies qualified for crypto assets a live one for wealth managers. Credit unions received NCUA guidance in December 2021 that federal credit unions could partner with third parties to offer digital asset services to members.

What custody looks like day to day

On an ordinary day in a crypto custody operation, a client might instruct the bank to send some of its holdings to an exchange. The request is checked against the client’s instructions and limits, screened for sanctions and money laundering concerns, and then routed for approval. Two or three authorized staff, often in different locations, each approve it separately. Only then does the system use the protected key to sign the transfer and send it to the blockchain. Afterward, operations staff confirm that the transfer appeared on the public ledger and that the bank’s internal books match.

Every step is a control, and every control costs money: people, specialist technology, audits and insurance. That is why scale matters so much. A large custodian spreads those fixed costs across many clients; a small one carries nearly the same costs with far fewer fees to pay for them.

How custody earns its keep

Custody revenue comes from fees on assets held and on transactions. Crypto exchanges often offered custody cheaply or bundled it with trading, so banks could not compete on price alone. Their advantage was trust: regulated status, segregation of client assets, audited controls and a familiar legal framework if something went wrong. Institutional clients such as pension funds, endowments and asset managers valued those features most, which is why bank custody aimed at them first.

The contract decides who owns what

When a custodian or platform fails, its contract terms often decide whether clients get their assets back. In January 2023, the bankruptcy judge in the Celsius case held that crypto deposited in the firm’s interest-bearing accounts belonged to the bankrupt estate, because the terms of use transferred ownership. Customers became unsecured creditors. Celsius was a lender rather than a custodian. Even so, any bank relying on a partner should read the terms that govern title before anything else.

A sub-custody agreement should therefore spell out several things. Client assets must be held in segregated accounts, identifiable by client, and never lent or pledged without consent. The provider must give independent assurance over its key management, such as a SOC 1 or SOC 2 report covering wallet controls. Insurance limits and exclusions should be stated plainly, since crime policies often cover far less than the assets held. And there must be a tested route to move assets to another custodian if the relationship ends.

Most institutions faced a build, buy or partner choice. Building suits only the largest custodians. Buying technology from a specialist still leaves the bank operating keys. Partnering with a sub-custodian outsources keys but concentrates third-party risk. Each route needed due diligence on the provider’s controls, financial strength and handling of client assets in insolvency, meaning what happens to clients’ holdings if the provider goes bust.

For community banks and credit unions, the realistic options were narrower still. They could partner with a specialist so customers or members could buy and hold crypto assets through the institution’s digital channels, or decline and explain why. A partnership meant relying on a third party for safekeeping and anti-money laundering compliance, with reputational exposure if the partner failed. Declining meant watching customers move funds to platforms outside the regulated banking system. Framing the decision as safeguarding through a partner made the due diligence questions concrete.

Moving: tokens and stablecoins

The third business interested regulators most and was least developed. Group 1 treatment for tokenized traditional assets and qualifying stablecoins signaled that supervisors saw potential in blockchain-based instruments for payments and settlement, provided the instruments were well backed and the technology sound. Settlement is the final step of a transaction, when money and assets actually change hands and the deal cannot be undone.

For banks, that opened tokenized deposits, participation in stablecoin arrangements, and settlement of traditional assets on distributed ledgers. A tokenized deposit is an ordinary bank deposit represented as a token that can move on a blockchain. A distributed ledger is a shared record of transactions kept in sync across many participants, rather than in one institution’s private books.

The economics are those of payments infrastructure: transaction volumes, network effects and operating costs. Network effects mean a payment system becomes more valuable as more participants join, which is why such systems build slowly. They require cooperation across institutions. In 2021 the business was largely experimental. It was also where the proposed capital treatment was least punitive and where incumbent banks held real advantages, including regulated status, deposit funding and existing client relationships.

Group 1 status was not automatic. The consultation set classification conditions: an effective stabilization mechanism, legally enforceable rights and obligations, a network designed to manage material risks such as settlement finality, and regulated, supervised entities performing redemption and settlement. Settlement finality is the assurance that a completed payment cannot later be reversed; redemption is the holder’s ability to swap the token back for ordinary money.

For a bank, those conditions read like a due diligence checklist. Any stablecoin or token arrangement it joined would need evidence on each one, and failure on any condition would drop the exposure into the punitive group. That made legal and operational review of the arrangement, more than the technology, the gating work.

Settlement on shared ledgers

The other half of the moving business is settlement of traditional assets on a distributed ledger. Its appeal is that cash and securities can change hands in a single step, removing the gap in which one side has delivered and the other has not. Its difficulties are legal and operational. Settlement finality laws were written for traditional systems, and a bank needs counsel’s view on when a ledger transfer is final.

The bank also depends on a network it does not control. If the ledger halts, is forked or is upgraded badly, the bank’s obligations to clients continue. Supervisors were most comfortable with permissioned networks run by identifiable, regulated operators, and most wary of public networks where no one answers for the ledger. A bank weighing a pilot should ask who operates the network, under what rules and with what resilience testing.

Four roles in a stablecoin arrangement

A bank can take part in a stablecoin arrangement in at least four ways. It can hold the reserves as deposits, as the OCC had confirmed national banks could. It can issue a token itself. It can act as an on-ramp, converting customers’ dollars to tokens and back. Or it can settle transactions between participants. Each role carries a different risk profile, and a bank should know which one it is being asked to play.

The reserve role looks simple and is not. Stablecoin reserves can leave in large amounts very quickly when confidence in the token falters. March 2023 showed the link running the other way. When Silicon Valley Bank failed, Circle disclosed that about $3.3 billion of its USDC reserves were held there, and the token briefly traded well below a dollar. A bank holding reserves is exposed to the token’s holders, and the token is exposed to the bank.

Tokenized deposits and stablecoins

A tokenized deposit and a stablecoin can look alike on a screen. Legally they differ. A tokenized deposit is a claim on the bank, within the deposit insurance framework where it applies. A stablecoin is a claim on its issuer, backed by a reserve pool whose quality depends on the issuer’s rules and supervision. For a bank, tokenized deposits keep funding on its own balance sheet. Stablecoins move it to someone else’s.

The difference shapes which institutions are interested. Large banks with wholesale clients can run permissioned token systems for payments among their own customers. Smaller banks are more likely to join shared networks or to act as reserve banks and on-ramps. In each case, the Basel classification conditions set the test. If the arrangement fails one, the exposure falls into the punitive group.

From one decision to three

The practical response was to stop treating crypto as one decision. Holding could be ruled out quickly on capital grounds. Safeguarding needed an honest build, buy or partner analysis with operating cost estimates. Moving needed a watching brief and, for larger institutions, careful pilots. Each required different expertise, vendors and conversations with supervisors.

That last point soon became formal. From late 2021, the OCC, and then the FDIC and Federal Reserve in 2022, told the banks they supervise to notify them before engaging in crypto activities. A bank that had separated the three businesses could say clearly which one it was proposing.

Return to the board from the opening. Separated this way, its agenda becomes manageable. The director’s question about owning bitcoin gets a short answer backed by the capital arithmetic. The commercial client’s custody request becomes a partner evaluation with a cost estimate and a list of due diligence questions. The stablecoin working group becomes a watching brief owned by the head of payments, with a report to the board once a year. That makes three conversations with three owners, none of them driven by headlines.

Governance for each business

Separating the businesses changes the governance. Each one belongs in the bank’s new product approval process as its own proposal, with its own risk assessment and its own line in the board’s risk appetite statement. Holding may get a single sentence: the bank does not take principal exposure to unbacked crypto assets. Custody needs limits on assets under custody, approved providers and loss tolerances. Payments needs criteria for joining an arrangement and a named executive owner.

The supervisory process reinforced that structure. The OCC’s November 2021 interpretive letter required national banks to obtain written supervisory non-objection before engaging in custody, stablecoin and node activities. The FDIC asked its supervised banks to notify it in April 2022, and the Federal Reserve set out similar expectations in August 2022. A notice that named one business, with its controls, was easier to review than a general plan to “do crypto.”

Measures for each business

Separate businesses need separate measures. Holding needs one: confirmation that principal exposure remains zero, or within the limit the board set. Custody needs assets under custody, reconciliation breaks between internal books and the ledger, failed or delayed transfers, and any key management exceptions. Payments needs transaction volumes, participant counts, network availability and the status of each Group 1 classification condition. Reporting these separately keeps a strong custody quarter from hiding a weak payments pilot, or the reverse.

Where the three overlap

A fair objection is that the businesses share infrastructure. Custody, brokerage and payments all need wallets, key management, blockchain analytics and sanctions screening. Building that platform three times would be wasteful. The answer is to share the platform and keep the decisions separate. The economics, risks and supervisory questions differ, even when the same technology team supports all three.

An exit plan for each

Each business also needs a way out. For custody, that means a tested process to return or transfer client assets if the bank or its partner withdraws. For payments, it means unwinding participation in an arrangement without stranding customers’ funds or breaking settlement obligations. Supervisors increasingly ask for these plans for any third-party dependency. In crypto, where markets and rules moved fast, they proved especially useful.

What each business asks of the bank

Holding crypto draws on the bank’s capital, custody on its operations and key security, and payments on years of patient investment. Each business carries a different kind of risk.

Money. Holding consumes capital on a scale few banks can justify. Custody consumes operating budget and needs scale to pay. Payments infrastructure needs patient investment over years. Knowing which one is on the table changes the financial conversation entirely.

Risk. The risks differ in kind as well as size. Holding is market risk: prices go down. Custody is operational and cyber risk: keys are lost or stolen. Payments arrangements carry legal and counterparty risk: the arrangement turns out not to work as promised, or a participant fails.

Customers. Customers asking about crypto often want access, not for the bank to speculate. Custody and brokerage through a partner may meet that need without the bank taking price exposure at all.

Regulators. Supervisors ask different questions about each business. A clear description of exactly which activity is proposed makes those conversations shorter and more productive.

Reputation. A partner’s failure, a lost key or a customer loss can damage trust in the bank’s name even where the bank’s own balance sheet is untouched. Boards should weigh that exposure alongside the financial case.

Financial crime. All three businesses expose the bank to sanctions and money laundering risk, and blockchain transfers cannot be reversed. In October 2021, the Financial Action Task Force updated its guidance on virtual assets, including the expectation that originator and beneficiary information travel with transfers. Banks needed blockchain analytics to trace where funds had been, and procedures for transfers to wallets they could not identify.

People. Each business draws on scarce skills: key management engineers, blockchain analysts, lawyers who understand both property law and token terms, and operations staff trained in irreversible transfers. Most banks did not have these people in 2021. That scarcity pushed many toward partners, and made the quality of a partner’s staff part of due diligence.

Accounting and reporting. Each business also lands differently in the financial statements. Holdings are measured and disclosed as assets. Custody may or may not appear on the balance sheet, depending on the accounting guidance in force. Payments arrangements raise questions about how token balances and reserves are classified. Finance teams should be part of the evaluation from the start, not after launch.

A one-page answer, and where banks went wrong

A well-prepared bank can explain, in one page, which of the three businesses it is in, which it is not, and why. Each live business has a named owner, a business case with realistic operating costs, and a clear account of how it fits the bank’s risk appetite, the level of risk the board has agreed to accept. Supervisors hear about plans early and in specific terms.

The page reads differently by institution. A community bank or credit union usually writes three short answers: no principal holdings; client access through a vetted partner, or a reasoned decision not to offer it; a watching brief on payments. A regional bank may add a custody evaluation for its wealth or commercial clients, through a sub-custodian. A global custodian or large dealer bank may be active in all three, with separate business lines and capital plans.

Broker-dealers and wealth managers write a different page again. For them, holding is rarely the issue. The live questions are which products clients may buy, how suitability and best-interest obligations apply to volatile assets, and which qualified custodian holds client positions. Their page should name the custodian, the product shelf and the person who approves additions to it. It should also say how client complaints and losses involving crypto products are escalated.

The point of the page is clarity for directors and supervisors. Anyone reading it should know what the bank does, what it will not do and who decides if that changes.

The errors tended to repeat:

• Treating crypto as one decision. Debating “should we do crypto?” instead of evaluating three distinct businesses.
• Chasing the headline business. Spending energy on holding, the activity the capital rules priced out, while neglecting custody and payments.
• Underestimating custody. Seeing safekeeping as low risk because there is little price exposure, while overlooking the operational demands of protecting keys.
• Thin partner diligence. Relying on a specialist provider without examining its controls, finances and the treatment of client assets if it fails.
• Assuming Group 1. Joining a stablecoin or token arrangement without checking it against each classification condition.

Most of these errors came from momentum. A board heard enthusiasm, a team was told to “look at crypto,” and the work drifted toward whatever generated the most excitement. The cure is procedural. Name the business, name the owner, cost it honestly and check it against the capital, conduct and supervisory rules that apply to that business alone.

Owners, keys and partners behind a crypto proposal

1. Which of the three businesses (holding, safeguarding, moving value) are we actually considering, and who owns each?
2. If we offer custody, are we building, buying or partnering, and what are the realistic operating costs of each?
3. Who controls the private keys, how many people must approve a transfer, and what happens if a key is lost?
4. If our partner failed tomorrow, what would happen to our customers’ assets?
5. For any stablecoin or token arrangement, do we have evidence on each condition that keeps it out of the punitive capital group?

A bank that can answer those questions in writing is ready for a supervisory conversation. One that cannot should finish the analysis before launching anything. The answers also age. Capital standards, accounting guidance and supervisory expectations for crypto assets changed several times between 2021 and 2026, so the page needs an annual review.

With hindsight

The Basel Committee finalized its standard in December 2022, after the collapse of several crypto firms, keeping the conservative treatment for unbacked assets and adding exposure limits. Those collapses gave the cautious approach of the 2021 proposal fresh justification: the business regulators had made least attractive was the one most directly exposed to wild swings in value.

The path to that final standard ran through a second consultation in June 2022, published just after the collapse of the Terra stablecoin and shortly before the bankruptcies of Celsius and Voyager. FTX failed in November. The final standard split Group 2 in two, allowing limited hedging recognition for a narrow set of assets that met strict criteria and keeping 1,250% for the rest. It also capped Group 2 exposures: in general no more than 1% of a bank’s Tier 1 capital, and never more than 2%. Targeted amendments followed in July 2024.

Implementation was deferred to January 2026, major jurisdictions including the United States and United Kingdom were slow to adopt it, and the committee has since been running an expedited review of parts of the standard. For banks operating across borders, that means the rules can differ by country for some time, and the international standard itself may still change.

American supervisors moved through two distinct phases. From late 2021 into 2022 they required notice or non-objection before crypto activities. In January 2023 the agencies issued a joint statement on crypto-asset risks to banks. Weeks later, in March 2023, Silvergate Bank announced it would wind down, and Signature Bank, another bank with large crypto-related deposits, was closed by regulators. Those failures turned on concentrated, flighty deposits, which fall under the moving and safeguarding businesses rather than holding.

The second phase reversed course. In 2025 the OCC withdrew its non-objection requirement, the FDIC replaced its prior-notice letter, and the Federal Reserve withdrew its supervisory letters on crypto activities. Banks no longer needed advance permission in the same form, though supervisors still expected sound risk management.

In the United States, the SEC’s 2022 staff accounting guidance on custodied crypto assets made bank custody expensive until it was rescinded in January 2025, and banking agencies withdrew earlier restrictive statements that spring. The guidance had, in effect, treated assets held for clients in a way that weighed on the custodian’s own balance sheet, which undercut the logic of custody as a low-capital business. Its removal reopened that path.

The GENIUS Act, signed in July 2025, created a federal framework for payment stablecoins and revived bank interest in moving value. A clearer legal footing for stablecoins strengthens the case that payments, the third business, may eventually matter most to banks.

The act permits subsidiaries of insured depository institutions to issue payment stablecoins, alongside licensed nonbank issuers, and requires reserves backing the tokens one for one. For banks, it turned the moving business from an experiment into a regulated product line. The law takes full effect after regulators issue implementing rules, or 18 months after enactment if that comes first.

Client access through regulated funds also became easier. In January 2024 the SEC approved spot bitcoin exchange-traded products, giving brokerage and wealth clients a familiar wrapper for exposure. That strengthened the case for meeting client demand through brokerage rather than the balance sheet.

The three-way split has held up, though the details moved. Holding remains a niche; custody and tokenized payments are where banks have focused. The more durable insight is about method rather than crypto. When a new technology arrives wrapped in excitement, the useful first step is to break it into the distinct businesses hiding inside it, price each one honestly, and let the economics, risk and regulation of each drive the decision, rather than the headlines.