US Banking Regulators Warn Banks on Crypto Exposure
Three of the most powerful financial watchdogs in the United States have sent a unified message to the banking sector: unmanaged exposure to crypto assets is unacceptable. On 3 January, the Federal Reserve Board (FRB), the Office of the Comptroller of the Currency (OCC), and the Federal Deposit Insurance Corporation (FDIC) released a Joint Statement on Crypto-Asset Risks to Banking Organizations. The message is clear for any institution relying on crypto accounting software or building out digital asset services: regulators expect banks to prove they can contain crypto-related risks before taking them on, not after. This development sits inside a week of regulatory activity that also swept up the European Central Bank and New York's top financial supervisor.
What the Joint Statement Actually Says
The tri-agency statement does not ban banks from touching crypto. That point deserves emphasis, because early coverage of the document has sometimes implied otherwise. What the FRB, OCC, and FDIC collectively state is that banks are permitted to engage in crypto-related activities, but they must demonstrate adequate risk controls beforehand. The document is explicit: risks from the crypto sector that cannot be mitigated or controlled must not be allowed to migrate into the banking system.
The Specific Risks Regulators Identified
The statement enumerates a range of hazards regulators believe banks face when they offer crypto asset services or maintain exposure to crypto businesses. Those hazards include fraud, financial crime, cybersecurity vulnerabilities, run risk (the possibility that large-scale, rapid withdrawals destabilize a crypto firm's banking partners), and legal uncertainty. The reference to "the events of the past year" points directly at the wave of crypto market collapses that characterised 2022, even though the document names no specific firms.
The timing of the statement was reinforced almost immediately when Silvergate Bank of California disclosed, on 5 January, that it had written off eight billion dollars in losses connected to its exposure to the now-defunct FTX exchange. The announcement came with a sharp fall in its share price and the elimination of roughly 40% of its workforce. It served as a live illustration of the contagion risk regulators had just warned about.
What Banks Must Demonstrate
Before engaging in any crypto-related activity, a bank must be able to show supervisors that it has identified the relevant risks and put in place controls capable of managing them. That is a higher standard than passive compliance after the fact. Regulators are signalling that they expect proactive documentation, not reactive explanations.
The Regulatory Context: This Is Not an Isolated Move
The Joint Statement is the most prominent item in a sequence of supervisory actions that has been building across late 2022 and into early 2023.
Basel Committee and Prudential Standards
In December 2022, the Basel Committee on Banking Supervision finalised prudential standards for banks holding crypto assets. Those standards introduce a tiered approach, with the most speculative or unbacked crypto assets attracting the most punishing capital requirements. The Basel framework sets the international floor; the US tri-agency statement operates within that context and aligns domestic supervisors with the same direction of travel.
New York DFS Enforcement and Coinbase
On 4 January, the New York Department of Financial Services announced its largest crypto-related enforcement action to date. Crypto exchange Coinbase agreed to pay a fifty million dollar settlement and commit a further fifty million dollars to compliance upgrades. The underlying deficiencies, uncovered during an examination spanning 2018 and 2019, included a significant backlog of transaction monitoring alerts and customer files requiring enhanced due diligence. The NYDFS finding highlights a structural challenge common across crypto and fintech: customer growth consistently outpacing compliance infrastructure. Separately, the NYDFS had already issued guidance in December 2022 reminding New York-chartered banks that they must obtain regulatory approval before undertaking crypto-related activities.
OCC Guidance from 2021
The OCC's current position builds on guidance it issued in late 2021, which told banks they needed written approval before engaging in services such as crypto custody or stablecoin issuance. The Joint Statement reinforces that position and broadens it across all three federal banking supervisors.
The ECB Weighs In: A European Dimension
On 5 January, Fabio Panetta, a member of the Executive Board of the European Central Bank, published a call for aggressive and comprehensive oversight of the crypto sector. Panetta argued that light-touch regulation is not adequate, given risks including investor harm and financial crime. In his view, the societal cost of an unregulated crypto industry is too high to ignore.
MiCA and Beyond
Panetta pointed to the EU's Markets in Crypto-Assets regulation, at the time nearing finalisation and scheduled for phased implementation across 2024, as a baseline example of the kind of comprehensive framework needed. He went further, arguing that even MiCA is insufficient on its own, and that regulators must extend oversight to decentralised finance and unhosted wallets. For EU-based accounting firms and CFOs, this signals that the regulatory perimeter will expand, not contract, over the coming years. Firms that treat MiCA compliance as a ceiling rather than a floor may find themselves caught out.
The ECB position also matters for banks with European operations that hold or facilitate crypto assets. Panetta's comments align with the Basel Committee's direction and suggest that ECB-supervised institutions will face pressure consistent with, and in some cases beyond, what US regulators are applying.
Accounting and Tax Implications for Firms and CFOs
The supervisory pressure described above translates directly into operational and financial reporting consequences for any bank, accounting firm, or corporate treasury with crypto exposure.
Balance Sheet Visibility
Regulators are demanding that banks identify and control crypto-related risks before engaging in activities. That presupposes a level of balance sheet visibility that many institutions still lack. Under US GAAP, crypto assets held by most entities have historically been accounted for as indefinite-lived intangible assets, meaning impairments are recognised but recoveries are not, until the asset is sold. The FASB's 2023 update to ASC 350 introduced a fair value model for certain crypto assets, which will improve balance sheet transparency going forward, but many institutions are still building the reporting infrastructure to support it.
Credit and Counterparty Exposure Tracking
Indirect exposure is as significant a concern as direct holdings. A bank may not hold a single satoshi of Bitcoin but can still face substantial crypto-related risk through lending to, or processing payments for, crypto businesses. The Joint Statement explicitly flags this indirect channel. Accounting teams need to ensure that counterparty categorisation in their systems is granular enough to surface crypto business relationships. Digital asset accounting software capable of tagging transactions by counterparty type is no longer optional for institutions with meaningful fintech or crypto client books.
Regulatory Capital Considerations
The Basel Committee's prudential standards, now finalised, require banks to hold significant capital against unbacked crypto asset exposures, with a 1,250% risk weight applying to the most speculative positions. CFOs at banks with any crypto exposure need to model the capital impact now, not at the next regulatory review cycle. Even indirect exposure through crypto business clients can attract heightened scrutiny under concentration risk frameworks.
AML and Financial Crime Controls
The Coinbase settlement is instructive for any compliance officer reading the Joint Statement. A backlog of unresolved transaction monitoring alerts, even at a firm experiencing rapid growth, is not a mitigating factor in regulatory proceedings; it is itself an aggravating one. Banks providing correspondent banking, payment processing, or lending services to crypto businesses need to ensure their transaction monitoring capacity scales with client volumes. Staffing, technology, and process maturity all factor into what regulators will consider adequate. For a closer look at how AI-enabled supervision is changing what regulators themselves can see, the analysis in AI reshaping crypto supervision across VARA, FCA, and HKMA provides relevant context.
What Accounting Firms and Auditors Should Do Now
For accounting firms advising bank clients, and for internal audit functions within financial institutions, the Joint Statement creates a set of near-term priorities.
Review Crypto Exposure Mapping
The first step is knowing the full extent of a bank's crypto-related exposures, both direct and indirect. That means mapping lending relationships, payment flows, custody arrangements, and any equity or debt investments in crypto businesses. Gaps in this mapping are precisely the kind of deficiency regulators will look for. Firms should also track how the Basel prudential standards affect the capital treatment of each exposure category, since the risk weights vary significantly depending on asset type and custody arrangement.
Evaluate Scalability of Compliance Controls
The Coinbase case illustrates that growth alone is not a defence. Any bank or crypto-adjacent firm whose client base or transaction volumes are increasing needs to verify that its compliance headcount, technology, and case management processes are keeping pace. The NYDFS found that Coinbase's compliance infrastructure had not grown proportionally with its business; regulators at the federal level will apply the same lens to banks. For firms building out or evaluating their compliance technology stack, the broader US regulatory picture, including the GENIUS Act and related AML requirements, is covered in US crypto regulation is being rewritten: what firms must know in 2026.
Document Pre-Activity Risk Assessments
The Joint Statement places the burden of proof on banks: risk controls must be demonstrable before activities commence. Accounting and compliance teams should ensure that any new crypto-related service or client relationship is preceded by a documented risk assessment that addresses each of the risk categories the statement identifies: fraud, financial crime, cybersecurity, run risk, and legal uncertainty. That documentation is what supervisors will request at the next examination.
Train Compliance Staff
The statement's implicit expectation is that bank compliance teams understand crypto asset risks at a level sufficient to manage them. Training gaps in this area are both a regulatory risk and a reputational one. Institutions that cannot demonstrate staff competency in crypto-related risk identification are likely to face harder questions during examinations.
Frequently Asked Questions
Does the Joint Statement prohibit banks from offering crypto services?
No. The FRB, OCC, and FDIC are explicit that banks are not prohibited from engaging in crypto-related activities. The requirement is that banks must be able to demonstrate adequate risk controls before they do so, and that crypto-related risks that cannot be mitigated must not be allowed to enter the banking system.
How does the Basel Committee's prudential standard relate to the US Joint Statement?
The Basel Committee's December 2022 finalised standards set international prudential floors, including capital requirements, for banks that hold crypto assets. The US Joint Statement operates within that international framework and aligns the three main US federal banking supervisors with the same risk-reduction direction. US banks will need to comply with both the domestic supervisory expectations and the Basel-derived capital requirements as they are incorporated into US rules.
What did the Coinbase NYDFS settlement reveal about compliance expectations?
The fifty million dollar settlement, combined with a further fifty million dollar commitment to compliance investment, reflects NYDFS findings that Coinbase had a substantial backlog of unresolved transaction monitoring alerts and customer files requiring enhanced due diligence. The core lesson is that compliance infrastructure must grow in proportion to business volumes. A rapidly expanding client base does not excuse compliance gaps; it makes closing them more urgent.
What is the EU's position on crypto regulation following the ECB's statement?
ECB Executive Board member Fabio Panetta called for comprehensive rather than light-touch regulation, describing the societal cost of an unregulated crypto industry as too high to ignore. He endorsed MiCA as a baseline but argued that further regulation is needed for DeFi and unhosted wallets. This signals that the EU regulatory perimeter will continue to expand beyond MiCA's initial scope.
How should an accounting firm advising a bank client respond to this guidance?
The immediate priorities are: map all direct and indirect crypto exposures; assess whether compliance controls are proportionate to crypto-related transaction volumes; ensure that any new crypto-related activity is preceded by a documented risk assessment covering the categories the Joint Statement identifies; and verify that compliance staff have adequate training in crypto asset risk identification. Each of these steps should be documented in a way that can be presented to supervisors at examination.
Source: Elliptic