Duane Morris LLP - Banks As Crypto Custodians May Rest On SEC Bulletin's Fate

With the U.S. Securities and Exchange Commission's January approval of 11 spot bitcoin exchange-traded funds[1] and the surprise approval of rule changes on May 23 that allowed for spot ether ETFs, it may seem a bit odd that none of the ETF custodians so far is a bank.

Banks maintain custody of a variety of financial assets for customers. In addition, coming changes to the Uniform Commercial Code[2] will facilitate lending against crypto-assets as long as a lender obtains the cryptographic keys to the crypto.

There are many reasons why a bank might choose not to accept custody of crypto-assets. One significant hurdle for those that might otherwise want to is SEC Staff Accounting Bulletin No. 121.[3]

The SEC may not be the first regulator that comes to mind when thinking about banks. However, many banks have publicly traded stock or otherwise have outstanding equity securities that subject them to the reporting requirements of the Securities Exchange Act. Such SEC requirements have been enforced by the Office of the Comptroller of the Currency, a more typical bank regulator.[4]

SAB 121, issued March 31, 2022, provides "interpretive guidance for entities to consider when they have obligations to safeguard crypto-assets held for their platform users." More specifically, it affects the reporting requirements under Sections 13(a) and 15(d) of the Exchange Act, which include annual and quarterly financial statements. The bulletin states that the guidance is given by the SEC staff in the belief that it will result in enhanced information regarding the unique risks and uncertainties relating to crypto custody, which will help investors and others make informed investment decisions.

SAB 121 identifies three particular areas of risk with crypto-assets that are not present with other assets. First, the rapidly changing nature of crypto-assets can lead to technological risks in safeguarding such assets.

Second, the legal framework and precedent for dealing with common asset risks such as theft, loss, fraud, and bankruptcy are nascent or nonexistent as they relate to crypto-assets, which can leave the legal effect of such events in significant doubt.

Third, there are fewer regulations relating to the holding of crypto-assets and fewer safeguards to ensure that custodians are complying with the regulations that are in effect.

To account for the risks that a custodian takes in obtaining the cryptographic keys, whether in its own name or in the name of its customers, and performing the actions of a custodian in relation to the crypto, SAB 121 takes the view that the custodian should reflect a liability on its balance sheet. The SEC staff believes that this liability should be valued at the full fair market value of the crypto, measured as of acquiring the keys and as of each reporting date.

The SEC staff also believes that it is appropriate for the balance sheet to reflect an asset as of such dates in the same amount. For accounting purposes, the asset being brought onto the custodian's balance sheet is not the crypto itself, but in the nature of an indemnification asset equal to the value of the crypto in custody.

Since the asset and liability cancel each other out, it might appear that there is no harm from the rule. However, the ramifications can be prohibitively expensive for a bank.

Regulated banks are subject to minimum capital requirements to manage investment risk and prevent a collapse if there is financial stress and a run on the bank.[5] Assets under custody are usually not included on a custodian's balance sheet, since they belong to the customers. Correspondingly, the final Basel III rules relating to capital requirements for crypto-assets were revised to clarify that such assets under custody are generally not subject to the liquidity risk requirements.[6]

The characterization of the indemnification asset for purposes of SAB 121 may not be inconsistent per se with the treatment normally given to the actual asset under custody. Nonetheless, the liability is one for which a regulated bank must establish a reserve.

Every dollar that a bank must reserve is a dollar that the bank cannot lend out or invest in other income-producing assets. This can limit a bank from expanding its traditional custody services from securities and other financial assets, which do not require such a reserve, to crypto. The larger a bank's crypto custody business, the less profitable, through the net of the lost investment income, it becomes.

SAB 121 has not gone unnoticed in the banking community. Several major banks have put crypto custody plans on hold.

On a broader industry level, the Securities Industry and Financial Markets Association and the American Bankers Association sent a joint letter to the SEC on June 27, 2022, outlining mitigating factors applicable to banks that already address the risks covered by SAB 121.[7] Moreover, the letter asserted that the OCC, the Federal Deposit Insurance Corp., the Federal Reserve Board and the National Credit Union Association already exercise broad regulatory and supervisory powers over banks and credit unions.

More recently, the discussion over SAB 121 has been taken up in Congress.

On Oct. 31, 2023, the U.S. Government Accountability Office determined[8] that SAB 121 is an agency rule for purposes of the Congressional Review Act[9] and the Administrative Procedures Act.[10] Although the SEC asserted that SAB 121 is just interpretive guidance, the GAO said it met the standard for being a rule because it is "an agency statement of general or particular applicability and future effect designed to implement, interpret or prescribe law or policy or describing the organization, procedure, or practice requirements of an agency." Under the Congressional Review Act, a report on each rule must be submitted by an agency to the U.S. House of Representatives, the U.S. Senate and the comptroller general.

Based on the GAO decision, a bipartisan group[11] of senators and members of Congress sent a letter on Nov. 15, 2023, to the FDIC, the Fed, the OCC and the NCUA asking them to clarify that SAB 121 is not enforceable.

Taking more direct action, members of the House introduced House Joint Resolution 109[12] on Feb. 1, 2024, providing for congressional disapproval of SAB 121. After passing the House on May 8 in a 228 to 182 vote, the resolution was passed by the Senate a few days later on May 16 by a 60 to 38 vote.

However, on the same day the House passed the resolution, the Executive Office of the President issued a statement saying that the president would veto it, citing the SEC's "work to protect investors in the crypto-asset markets and to safeguard the broader financial system."[13] On May 31, the resolution was formally vetoed.

On June 3, the House tabled further action on the resolution until July 10. Although the resolution passed by wide margins, neither chamber passed it by the two-thirds vote necessary to override the veto.

With the future of crypto custody by banks at stake, this is likely not the last to be heard on SAB 121.