On August 16, 2022, The Federal Reserve Board (the “FRB”) issued Supervision and Regulation Letter 22-6 (SR 22-6), which included guidance for FRB-regulated banks that are engaged or looking to engage in activity related to cryptocurrency and other digital assets. The letter applies to all FRB-related banks, including those with $10 billion or less in consolidated assets. The supervisory letter adopts a broad definition of crypto-asset-related activity and includes crypto-asset safekeeping and traditional custody services, ancillary custody services, the facilitation of customer purchases and sales of crypto-assets, loans collateralized by crypto-assets, and the issuance and distribution of stablecoins.

The letter required FRB-regulated banks to:

1. Analyze and confirm if the crypto-related activities are legally permissible under relevant state and federal laws and determine whether any filings are required under federal banking laws, including the Bank Holding Company Act, Home Owners’ Loan Act, Federal Reserve Act, Federal Deposit Insurance Act, or the regulations promulgated pursuant thereto, and to determine if any regulatory filings are required to engage in the crypto activities.
2. Notify their lead supervisory point of contact at the Federal Reserve prior to engaging in any crypto-asset-related activity. Any bank that is already engaged in crypto-asset-related activities should notify the FRB promptly if it has not already done so. State member banks are also encouraged to notify their state regulator prior to engaging in any crypto-asset-related activity.
3. Implement adequate systems, risk management, and controls to conduct such activities in a safe and sound manner and consistent with all applicable laws, including applicable consumer protection statutes and regulations.

The guidance also highlights certain key risks that are caused by the crypto-asset sector while also presenting potential opportunities for the banking sector. Key risks include:

• Technology and operations: Recognizing that the technology supporting crypto-assets is relatively new and evolving, the FRB highlights risks such as cybersecurity and governance of the underlying network, especially those that are open, permissionless networks.
• Anti-money laundering and countering of financing of terrorism: Crypto-assets may be used to facilitate money laundering and illicit financing due to some crypto-assets’ limited transparency and the challenges to identify and track crypto-asset ownership.
• Consumer protection and legal compliance: Crypto-assets pose significant consumer risks, including price volatility, misinformation, fraud, and theft or loss of assets. In addition, banks engaging in crypto activities face potential legal and consumer compliance risks stemming from uncertainty regarding the legal status of many crypto-assets as well as potential legal exposure arising from consumer losses, operational failures, and relationships with crypto-asset service providers.
• Financial stability: Certain types of crypto-assets, such as stable coins, could also pose risks to financial stability if adopted at a large scale, including potentially through destabilizing runs and disruptions in the payment systems.

Banks should implement and have in place adequate systems to identify, measure, monitor, and control the risks associated with crypto-related activities on an ongoing basis and cover:

• Operational risk (for example, the risks of new, evolving technologies)
• Cybersecurity and fraud risks (risk of hacking, fraud, and theft, and the risk of third-party relationships)
• Financial risk
• Legal risk
• Compliance risk (including, but not limited to, compliance with the Bank Secrecy Act, anti-money laundering requirements, and sanctions requirements)
• Other risks necessary to ensure the activities are conducted in a manner that is consistent with safe and sound banking and in compliance with applicable laws, including applicable consumer protection statutes and regulations