OCC Debanking Report: What It Means for Crypto Firms
The US Office of the Comptroller of the Currency released a formal debanking report on 14 October 2026, confirming that major banks had adopted policies restricting services to digital asset businesses. For accounting firms, auditors, and CFOs with crypto-adjacent clients, the report is significant not for what it resolves, but for what it leaves open. Banking access remains precarious for the sector, and the compliance rationale banks used to justify those restrictions has not been formally invalidated.
Background: From Executive Order to Formal Review
The OCC's report did not emerge in isolation. In August 2025, President Trump signed an executive order directing federal regulators to investigate and prevent what he characterised as unlawful debanking, a practice his administration linked to politically motivated pressure on financial institutions to cut off disfavoured industries.
The "Operation Chokepoint 2.0" allegation
The crypto industry had been raising concerns about coordinated debanking well before that executive order. In late 2024, more than 30 technology and crypto executives publicly reported losing access to banking services. Industry participants informally labelled the pattern "Operation Chokepoint 2.0," drawing a parallel to an Obama-era Department of Justice initiative that was later criticised for pressuring banks to sever ties with lawful but politically sensitive businesses, including payday lenders and firearms dealers.
The allegation was that the Biden administration had similarly, though unofficially, encouraged financial institutions to restrict services to crypto firms. That claim underpinned the August 2025 executive order and, ultimately, the OCC's mandate to investigate.
Scope of the OCC review
The agency reviewed nine major US banks. It found that many had both public-facing and internal, nonpublic policies that restricted banking services across several sectors: oil and gas, tobacco, firearms, and digital assets among them. The digital asset restrictions specifically targeted issuers, exchanges, and administrators, and the OCC noted these were "often attributed to financial crime considerations" by the institutions themselves.
What the Report Actually Says About Crypto
Acknowledging the problem and documenting it with specifics are two different things, and the OCC's report lands squarely on the acknowledgement side.
No named cases, no quantified scope
The 47-page document does not include a single named example of a crypto firm that was debanked, nor does it provide figures on how many businesses were affected or for how long. The OCC stated plainly that it had been "unable to quantify on a comprehensive basis the full extent of debanking or alleged debanking actions." That admission matters for firms seeking documentary evidence to support a regulatory challenge or a client's compliance history.
Financial crime as the stated justification
Banks that restricted digital asset services pointed to financial crime risk as the primary driver. Anti-money laundering exposure, sanctions compliance, and the reputational cost of association with an industry under regulatory scrutiny were cited internally. OCC Acting Comptroller Jonathan Gould addressed a related point about coal-industry debanking directly, stating that the decisions "were not based on financial risk" but on concerns about "negative headlines, public protests, and the perceived reputational consequences of supporting the industry." While Gould's remark focused on coal, the framing applies equally to the crypto findings: where reputational risk rather than genuine financial risk drives debanking, the regulator views the practice as problematic.
Digital assets alongside other sensitive sectors
Crypto was grouped with oil and gas, tobacco, and firearms in the report's findings. That grouping matters for how firms frame banking access conversations. Digital assets were not singled out as uniquely problematic; instead, they appear as one example of a broader pattern where banks applied sweeping sector-level restrictions rather than individual risk assessments. For a CFO or general counsel arguing that their firm deserves individual underwriting, the report provides some rhetorical support, even if it stops short of creating a legal right to banking services.
Compliance and Banking-Access Implications
The report has immediate practical relevance for accounting professionals advising digital asset businesses, particularly those helping clients maintain or restore banking relationships.
AML documentation remains the front line
Because banks cited financial crime risk to justify their restrictions, the most direct response is robust, current AML documentation. Clients seeking or retaining banking services should maintain up-to-date know-your-customer files, transaction monitoring policies, suspicious activity report logs (where applicable), and evidence of FATF Travel Rule compliance if they operate as a virtual asset service provider. These materials are the first thing a correspondent bank or onboarding compliance team will request, and gaps create leverage for denial.
The FinCEN CVC mixing rule withdrawal and CFTC framework review earlier in 2026 already shifted some of the AML landscape for crypto firms in the US. Firms should verify that their compliance programmes reflect the current regulatory position rather than rules that have since been retracted or modified.
Banking relationship risk as an audit consideration
For auditors and accounting firms, the OCC's findings introduce a clearer basis for treating banking access as a going-concern risk factor. If a client operates in the digital asset space and relies on a small number of banking relationships, and those relationships have historically been volatile, the audit team needs to assess whether that concentration creates a material liquidity risk. The OCC report, while not a regulatory prohibition on debanking, provides public documentation that the practice has been widespread and that even major institutions applied nonpublic internal policies without client-level risk assessment.
Board and CFO-level reporting
CFOs at digital asset firms, or at traditional companies with significant crypto treasury holdings, should consider whether banking counterparty risk is adequately disclosed in financial statements and board reporting. The OCC's acknowledgement that the extent of debanking cannot be quantified is itself a risk signal: it means the problem is systemic enough to resist measurement, yet not resolved enough to be dismissed. That is the kind of uncertainty that belongs in a risk register.
What the Report Does Not Do
It is equally important to be clear about what this report cannot deliver, because firms should not overread it when managing client expectations or regulatory strategy.
No enforcement action against banks
The OCC has not announced any enforcement action against the nine banks reviewed, and the report does not indicate that any bank will face penalties for its debanking policies. The document is diagnostic, not punitive. Banks retain broad discretion in customer selection, subject to fair lending and anti-discrimination rules that do not currently extend to industry-sector classifications like "crypto."
No right to a bank account
US law does not guarantee any business a bank account. The executive order that prompted this review directed regulators to study the problem and discourage unlawful debanking, but it did not create a new statutory right. Firms that were cut off from banking services cannot use this report alone as a basis to compel reinstatement. Legislative action would be required to change that, and no such legislation has been enacted as of the report's publication.
Crypto-specific findings remain thin
The report's crypto section is notable for what it lacks: data, case studies, and regulatory conclusions specific to digital assets. Practitioners should treat this as a first step in a longer regulatory process rather than a resolution. Monitoring subsequent OCC guidance, congressional hearings, and any follow-up from the Financial Stability Oversight Council will be necessary to track how the debanking issue evolves for the sector. Keeping abreast of AML licensing and enforcement trends in other jurisdictions also helps firms benchmark what regulators elsewhere expect of digital asset businesses seeking banking access.
Practical Next Steps for Accounting and Compliance Teams
Given the report's findings, the following steps are worth reviewing now rather than waiting for further regulatory development.
Audit the client's banking concentration
Map each digital asset client's banking relationships and identify single points of failure. A client with one primary bank and no secondary relationship is materially exposed. Where possible, diversification across jurisdictions and institution types reduces the risk that a policy change at one bank creates an immediate operational crisis.
Review AML programme currency
The financial crime rationale that banks cited is the compliance team's direct jurisdiction. Ensure that client AML programmes are current, that risk assessments have been updated within the last twelve months, and that transaction monitoring thresholds reflect actual activity volumes. Outdated programmes signal to bank compliance teams exactly the kind of risk they have been using as justification for restrictions.
Use robust crypto accounting software for audit trails
Banks conducting enhanced due diligence on crypto clients will often request transaction-level reporting, reconciliation records, and chain-of-custody documentation for digital asset flows. Having reliable crypto accounting software that produces audit-ready outputs is not just a bookkeeping convenience; it is increasingly a prerequisite for maintaining banking access. The same applies to digital asset accounting software used internally by CFO teams: clean records that can be shared with banking compliance officers on short notice reduce friction at the relationship management level.
Document the risk assessment rationale
If a bank does restrict services, having contemporaneous documentation of the client's compliance posture at the time of restriction is valuable. It creates a record that the firm was not debanked for genuine financial crime risk, which could matter in any future regulatory review, congressional inquiry, or litigation. The OCC's own admission that it could not quantify the extent of debanking suggests that bank-level records are inconsistent; a well-documented client file may be one of the few reliable sources of evidence in a dispute.
Frequently Asked Questions
What did the OCC find about crypto debanking?
The OCC found that many banks had both public and internal nonpublic policies restricting services to digital asset businesses, including issuers, exchanges, and administrators. Banks cited financial crime concerns as the primary justification. However, the report did not name specific firms or quantify how many businesses were affected across the nine banks reviewed.
Does the OCC report give crypto firms a legal right to banking services?
No. The report is a diagnostic document produced in response to an executive order. It does not create a statutory right to a bank account or trigger enforcement action against banks that restricted crypto services. Legislative change would be required to establish any enforceable entitlement.
How should auditors treat banking access risk for crypto clients?
Auditors should assess whether a client's banking relationships are sufficiently diversified and stable. Where a client has limited banking access and operates in the digital asset sector, concentration risk may rise to the level of a going-concern consideration or at minimum a risk factor warranting disclosure and board-level reporting.
What compliance steps can help a crypto firm retain its banking relationship?
Maintaining current and detailed AML documentation is the most direct mitigation. This includes up-to-date KYC files, transaction monitoring policies, suspicious activity report logs where applicable, and Travel Rule compliance evidence for VASPs. Producing clean, audit-ready records through reliable crypto bookkeeping software also reduces friction during a bank's due diligence review.
Is "Operation Chokepoint 2.0" an official regulatory designation?
No. The term is an informal industry label, not an official regulatory programme or legal finding. The OCC report acknowledges that executive order claims included references to the alleged operation, but the agency did not confirm or deny that a coordinated government-directed debanking campaign existed. The report's findings focus on bank-level policies rather than government direction.
Source: Cointelegraph