Few banks held crypto. Many held crypto deposits.
The January 2023 joint statement was read as a verdict on what banks could do with crypto. Its sharper warning was about exposure banks already had through depositors, partners and customers, which most could not measure from their own data.
Looking Back revisits one week at a time, from January 2020 to today, and asks what it meant for the banks, health systems and public agencies we serve. The series was written in 2026, with the benefit of hindsight, and each article says which week it looks back on.
The week
On January 3, 2023, the Federal Reserve, the FDIC and the OCC issued a joint statement on crypto-asset risks to banking organizations. Written after FTX’s collapse, it listed fraud and scams, legal uncertainty over custody and bankruptcy treatment, inaccurate or misleading representations by crypto firms, market volatility, stablecoin run risk, and contagion among interconnected crypto participants. The agencies said that issuing or holding crypto-assets as principal on open, public or decentralized networks was highly likely to be inconsistent with safe and sound banking practices. They said concentrations of deposits from crypto-related entities raised significant safety and soundness concerns. They added that banks were neither prohibited nor discouraged from serving any class of customer, but that supervisors were watching closely. A follow-up statement on February 23 addressed liquidity risks from crypto-related deposits.
Headlines focused on banks that wanted to custody crypto or issue tokens. Few banks were in that position. Many more carried crypto-related risk without ever having adopted a crypto strategy. A bank’s exposure fell into three kinds, each needing a different response: direct activity, deposit concentration, and indirect exposure through partners and customers. The first was the most discussed and the least common. The third was the hardest to see.
Direct activity
Direct activity was the clearest category under the statement. Holding crypto-assets as principal on public blockchains was described as highly likely to be unsafe and unsound. Custody, stablecoin-related services and similar activities were not banned. Each agency already had a notice process. An OCC interpretive letter from November 2021 required national banks to show their supervisor adequate controls before starting. The FDIC and the Federal Reserve set their own notification expectations in 2022.
For a bank considering such activity, the work was defined if demanding. It needed a legal analysis of permissibility under its charter, a risk assessment, supervisory notice, and controls for key management, segregation of custody assets and illicit finance monitoring. The statement made clear that supervisors expected those controls to be demonstrated in operation, not described in a policy. In practice that meant very few new entrants in 2023. For boards, the right question was narrower than whether to “do crypto.” It was whether any business line, vendor contract or pilot already amounted to direct activity that had never been notified, such as a trust department holding tokens for a client or an innovation team testing a wallet.
Deposit concentration
The second category was more consequential. A handful of banks had built large deposit bases from crypto exchanges, stablecoin issuers and trading firms. Those deposits were highly correlated. When crypto prices fell or a major firm failed, they could leave together and fast.
Several mechanics made this worse. Some deposits were held for the benefit of an exchange’s own customers, so the bank’s real counterparties were thousands of retail traders it had never onboarded. Stablecoin reserves could be pulled to meet redemptions within days. Some banks ran real-time payment networks for crypto firms, which tied operational dependence to deposit balances.
The compliance task for any bank with crypto-sector clients was measurement. Which depositors were crypto firms? Which balances were held for those firms’ customers? How stable had those balances been through earlier price shocks, and how quickly could they leave? Many banks classified commercial customers by industry codes that could not tell a crypto exchange from a software company. An accurate picture usually required manual review of the largest relationships, then new fields in the customer record to keep the answer current.
Useful outputs were simple: the share of total deposits from crypto-related clients, the concentration among the top ten such clients, and a stress scenario that assumed most of those balances left within a week. Treasury and asset-liability committees could then size liquidity buffers against a specific number rather than a general worry. The same numbers gave examiners evidence that management understood the exposure, which mattered as much as the size of the buffer itself.
Indirect exposure through partners and customers
The third category was where most banks and credit unions actually sat. A bank could have no crypto clients in its commercial book and still be exposed. Fintech partners in banking-as-a-service programs sometimes let end users buy crypto through a third party. Payment processors served crypto merchants. Retail customers moved funds to and from exchanges. Credit unions, which the statement did not cover, had similar exposure through their own partners and members.
The statement’s risk list, especially fraud, misleading representations and contagion, applied here directly. A fintech partner advertising crypto features to a bank’s customers could create consumer protection and reputation problems for the bank whose charter stood behind the account. A surge in customers sending funds to exchanges, often at the urging of a scammer, was a signal for fraud and anti-money laundering teams.
Addressing this category meant three practical changes. Third-party reviews had to ask partners which crypto features they offered, through which providers, and how they described them to customers. Transaction monitoring needed rules that recognized transfers to and from known exchange accounts, with thresholds tuned to the bank’s customer base. And complaint and fraud data had to be tagged so that crypto-related cases could be counted and trended.
The same data work answered a broader question. Customer classification and concentration analytics that find crypto-related deposits also find other correlated groups: deposits from one industry, from clients of one fintech partner, or from one region. Within weeks of the statement, which depositors would move together under stress became the central question for the whole industry. Organizations should confirm with counsel how current guidance applies to their charter, since the rules differ by regulator and changed later.
With hindsight
The concentration warning arrived quickly. Silvergate, whose deposits came heavily from crypto firms, announced its wind-down on March 8, 2023. Signature Bank, which also held significant crypto-related deposits, was closed on March 12 amid the wider run that followed Silicon Valley Bank’s failure. Policy then reversed. In March 2025 the OCC rescinded its 2021 notice requirement, and on April 24, 2025 the Federal Reserve and FDIC withdrew the January and February 2023 statements. In July 2025 Congress enacted the GENIUS Act, a federal framework for payment stablecoins. Banks now have more room to offer crypto services. The measurement work the statement prompted has outlasted the policy, because supervisors judge concentration and liquidity risk the same way whatever industry the depositors are in.