The U.S. Securities and Exchange Commission on October 1 proposed rules that would, for the first time, define how investment advisers and regulated funds may custody crypto assets — including a conditional path to adviser self-custody. Within two weeks of publication, the two largest U.S. banks ...
"Today's proposal would provide a clear regulatory framework for the custody of crypto assets, giving investment advisers and funds a compliant pathway where none existed before — and replacing the grey of uncertainty created by custody rules crafted for a bygone era." — Paul Atkins, Chairman, U.S. Securities and Exchange Commission
The U.S. Securities and Exchange Commission on October 1 proposed rules that would, for the first time, define how investment advisers and regulated funds may custody crypto assets — including a conditional path to adviser self-custody. Within two weeks of publication, the two largest U.S. banks by assets diverged publicly on crypto custody strategy: Citigroup confirmed it will launch native Bitcoin custody through its Custody+ platform before year-end 2026, folding digital assets into a network holding roughly $31.4 trillion in traditional assets under custody and administration. JPMorgan Chase, by contrast, said it will build crypto trading infrastructure while explicitly keeping custody "not on the table at the moment," according to global head of markets digital assets Scott Lucas.
The divergence illustrates a broader pattern. According to data from River, 60% of the 25 largest U.S. banks by assets are now offering, developing, or exploring Bitcoin-related services — up from under 20% in early 2024. The regulatory preconditions are largely in place: the SEC rescinded SAB 121 in January 2025, removing the balance-sheet liability requirement that had made bank custody uneconomic; the OCC confirmed through interpretive letters 1170, 1172, and 1174 that national banks may custody digital assets, including private key management; and the FDIC has withdrawn its prior notification requirement for supervised institutions seeking to engage in crypto-related activities. What remains contested is not whether banks can custody crypto, but whether they should — and on what terms.
The SEC's proposal, published in the Federal Register on October 6, 2026 (comment period closing December 7), addresses a gap that Chairman Atkins acknowledged directly: existing custody rules "were designed to protect the assets of advisory clients and regulated funds from loss, theft, misuse, and misappropriation" but "consider the custody and safekeeping only of traditional assets — an untenable situation in the 21st century."
Three structural provisions define the proposal:
Qualified Custodian Expansion. State trust companies would become qualified custodians for crypto assets under both the Investment Advisers Act of 1940 and the Investment Company Act of 1940. This expands the custodian universe beyond federally chartered banks and registered broker-dealers, potentially bringing dozens of state-chartered digital asset trust companies — including firms like Anchorage Digital, Paxos, and BitGo Trust — into the SEC's qualified custodian framework.
Adviser Self-Custody. An adviser may hold client crypto assets only after determining in writing that no qualified custodian will maintain the asset, reassessing that determination quarterly, and maintaining exclusive possession of private keys. If a custodian becomes available, assets must migrate "as soon as reasonably practicable." Annual surprise examinations or pooled vehicle audits continue to apply. Commissioner Hester Peirce noted the proposal "refers to advisers acting as custodians, not true investor self-custody," and said she prefers the term "shelf-custody."
Existing Obligations Preserved. The proposal does not relax requirements for surprise examinations, internal controls, or recordkeeping. It layers crypto-specific provisions on top of the existing Advisers Act framework rather than creating a parallel regime.
The economic subtext is direct: without a custody framework, the approximately $129 billion in U.S.-listed crypto ETF assets — and the growing pipeline of tokenized securities — remain structurally dependent on a handful of crypto-native custodians operating under varying regulatory standards.
None of the current bank custody expansion would be commercially viable without the January 2025 rescission of Staff Accounting Bulletin 121. SAB 121, issued in March 2022, required banks to record customer crypto holdings as both an asset and a liability on their own balance sheets — a treatment that no other custodied asset received.
The capital impact was prohibitive. Under Basel III, the grossed-up liability consumed regulatory capital at a 1:1 ratio, making every dollar of custodied crypto as expensive as an on-balance-sheet loan. BNY Mellon, which launched crypto custody in 2022, limited its offering to Bitcoin and Ether for ETF issuers in part because of the capital drag.
SAB 122, effective January 23, 2025, reversed course. Banks now apply normal loss-contingency accounting (ASC 450 / IAS 37): recognize a liability when a loss is probable and reasonably estimable, otherwise disclose. Custodied crypto returns to off-balance-sheet treatment, identical to equities, bonds, and other traditional assets held in custody.
The OCC subsequently reinforced the framework with a February 2026 final rule amending 12 CFR 5.20, codifying that custody services — including cryptocurrency custody — are permissible activities for national banks. Banks must demonstrate controls across technology risk, operational risk, cybersecurity, liquidity, and illicit finance. But the accounting barrier that kept most of Wall Street on the sidelines for three years is gone.
The October 13 CNBC appearances by executives from the two largest U.S. banks crystallized a strategic split that will shape institutional crypto infrastructure for years.
Citigroup: Full-Stack Custody. Biswarup Chatterjee, Citi's global head of partnerships and innovation in its services division, confirmed the bank has been building custody infrastructure for two to three years and expects to go live before year-end 2026. The August 18 announcement of Custody+ described the service as embedding Bitcoin into the same rails that hold $31.4 trillion in traditional assets under custody and administration — with cross-margining capabilities that would allow institutional clients to hold crypto alongside equities, fixed income, and other assets within a single margin framework.
Citi's approach uses a hybrid technology stack: some components are designed and built in-house for specific assets and client segments, while third-party solutions cover other asset classes. The bank has not disclosed which sub-custodians or technology partners it will use, nor has it specified which additional cryptocurrencies beyond Bitcoin will be supported at launch.
JPMorgan Chase: Trading Without Custody. Scott Lucas, speaking on CNBC's Squawk Box Europe on the same day, was explicit: "Jamie [Dimon] was pretty clear on the investor day that we're going to be involved in the trading and custody is not on the table at the moment." JPMorgan will build execution and liquidity services, leaving custody responsibilities to specialized firms.
Lucas cited "risk appetite and regulatory exposure" as factors shaping the approach. He added that the bank is "exploring" stablecoins and deposit tokens to meet institutional demand — but in a model where JPMorgan facilitates transactions without holding the underlying assets.
The strategic logic is not arbitrary. JPMorgan already processes approximately $3 billion in daily institutional settlement through its blockchain-based infrastructure and holds the largest balance sheet of any U.S. bank at $4.2 trillion. Adding direct crypto custody exposes that balance sheet to operational risks — private key management, smart contract interaction, blockchain fork handling — that its existing compliance and risk infrastructure was not designed to manage. Citi, with a smaller but still substantial balance sheet, appears to have concluded the revenue opportunity justifies the investment.
The Citi-JPMorgan split is a proxy for a broader industry realignment. Among the 25 largest U.S. banks by assets, according to River data, the current landscape includes:
| Bank | Strategy | Status | |------|----------|--------| | BNY Mellon | Custody (BTC, ETH), adding staking via Galaxy | Live since 2022; Abu Dhabi expansion 2026 | | Citigroup | Full-stack custody (Custody+) | Launch before year-end 2026 | | JPMorgan Chase | Trading only, no custody | Execution infrastructure in development | | Morgan Stanley | Tokenized equities ATS | Q1 2027 target | | Goldman Sachs | Stablecoin infrastructure exploration | Under development | | U.S. Bank | Crypto custody resumed | Live for institutional investment managers | | Bank of America | Bitcoin ETF advisory | 15,000+ advisors authorized Jan 2026 | | Charles Schwab | Spot BTC/ETH trading | Targeting H1 2026 | | State Street | Crypto custody services | Launch planned 2026 | | Standard Chartered | Multi-jurisdiction custody | Live in UAE, expanding | | Deutsche Bank | Custody (Europe focus) | End of 2026, pending regulatory approval |
Internationally, the pattern extends. Standard Chartered obtained its UAE VARA license on October 14 for closed-loop BTC and ETH trading for professional investors. Deutsche Bank, with $2.2 trillion in assets under management, is building wallet and private key management infrastructure under Europe's regulated banking framework.
The bank custody wave creates competitive pressure on the crypto-native firms that have held the institutional market largely to themselves.
Coinbase Custody Trust Company remains the largest regulated qualified custodian in crypto, with approximately $300 billion in total assets under custody. It holds assets for the majority of U.S.-listed Bitcoin and Ethereum ETFs. But its market position rests partly on the historical absence of bank competitors. As BNY Mellon, Citi, and State Street come online, ETF issuers and institutional allocators will have alternatives backed by balance sheets orders of magnitude larger than Coinbase's.
BitGo, which received an OCC national bank charter in December 2025 and completed its IPO in early 2026 at an $18 per share price for a $2 billion valuation, is positioning as a bridge between bank and crypto-native infrastructure. The firm processed over $1.5 trillion in transaction volume in 2024 and holds over $90 billion in assets under custody.
Fireblocks, operating across 300 million wallets and more than 2,400 institutional clients with over $10 trillion in cumulative transaction volume, launched its Trust Company under an NYDFS charter in mid-2025. Its model as an infrastructure provider rather than a direct custodian may insulate it from bank competition — banks may license Fireblocks technology rather than compete with it.
The economic value question is direct: as banks enter custody, fee compression is likely. Custody fees in crypto — historically 25 to 75 basis points annually — will face pressure toward the sub-5-basis-point fees that banks charge for traditional securities custody. The firms that survive will be those offering services banks cannot easily replicate: DeFi protocol interaction, cross-chain settlement, staking infrastructure, and real-time on-chain analytics.
The expansion of bank custody into crypto carries risks that the current regulatory framework acknowledges but does not fully resolve.
Private Key Management. Unlike traditional securities, where custody means book-entry ownership at a central depository, crypto custody requires managing private keys — cryptographic material whose compromise results in irreversible asset loss. The SEC proposal requires exclusive key possession for self-custody and qualified custodian standards for third-party holdings, but does not prescribe specific key management architectures (HSM-based, MPC, multisig, or hybrid). Banks must develop internal competence in technology historically alien to their operations.
Concentration Risk. If a small number of banks come to custody the majority of institutional crypto assets, the systemic risk profile shifts. A single bank's operational failure — or a coordinated attack on bank-managed keys — could affect a larger share of crypto market capitalization than any single exchange hack to date. DeFi protocols have lost $1.3 billion to exploits in the first eight months of 2026 alone, according to industry data, with compromised private keys overtaking smart contract bugs as the leading attack vector for the first time.
Regulatory Fragmentation. The SEC proposal applies to registered investment advisers and regulated funds. It does not cover retail custody, does not preempt state law, and operates alongside separate OCC, FDIC, and Federal Reserve frameworks. Banks operating across jurisdictions face overlapping and potentially conflicting requirements.
The U.S. banking system is crossing a threshold. The regulatory barriers that kept traditional custodians out of crypto — SAB 121's capital penalty, the absence of a qualified custodian framework, ambiguity around permissible activities — have been systematically removed over the past 18 months. The question is no longer whether banks can custody crypto. It is how much of the institutional market they will absorb, at what fee levels, and whether their operational infrastructure is ready for an asset class whose failure modes are fundamentally different from anything they have managed before.
The economic value will concentrate where it always does in custody: with the institutions that can offer the lowest fees, the deepest integration with existing portfolios, and the most robust regulatory credibility. For crypto-native custodians, the survival strategy is differentiation — staking, DeFi access, cross-chain operations — in services that banks cannot replicate without building entirely new technology stacks. For banks, the risk is overreach: entering a market where a single key management failure can produce losses that are permanent, public, and irreversible.