SAB 121 Successor and Bank Custody of Digital Assets
On April 7, 2026, the FDIC issued its proposed rulemaking under the GENIUS Act, establishing custody and reserve standards for FDIC-supervised institutions providing crypto safekeeping, published in the Federal Register on April 10 with a 60-day comment period. By early 2026, most SEC-reporting entities had completed SAB 122 retrospective application for fiscal years beginning after December 15, 2024. The OCC issued charters to BitGo and Fidelity Digital Assets in December 2025; Interpretive Letter 1184 from May 2025 confirmed banks can act as fiduciary or non-fiduciary custodians, outsource to sub-custodians, and facilitate crypto-to-fiat exchange. For a compliance officer, the risk question is not whether banks should custody digital assets but what specific failure modes emerge when implementation runs ahead of the prudential framework.
Trigger and Mechanics
The failure mode is regulatory framework lag. SAB 122 removed the accounting penalty that kept banks out of crypto custody by no longer requiring them to recognize custodied digital assets as on-balance-sheet liabilities. What it did not do is specify capital treatment, contingent liability accounting under ASC 460, FDIC insurance disclosure rules, or detailed AML extensions for bank-custodied digital assets. SAB 122 did not eliminate all accounting considerations — contingent liability requirements may still apply under existing GAAP.
The trigger event: a bank with significant crypto custody experiences an operational incident — a sub-custodian breach, signing authority failure, or enforcement action against a key vendor. In the gap between SAB 122 and a complete prudential framework, the bank's accounting treatment, regulatory capital calculation, and customer recourse path are not clearly defined. Resolution mechanics differ from a traditional bank failure because custody assets are not the bank's property and should not enter the bank estate, but the procedural rules for separating them in resolution are not yet written.
Blast Radius
Three groups face distinct exposure. Custody clients with bank-held digital assets are first-line. If segregation is maintained operationally but not protected by an established legal framework, clients face the same risk Galois Capital faced when FTX collapsed — assets held with a non-qualified path enter the bankruptcy estate as unsecured claims. OCC Interpretive Letter 1184 plus state trust company charters mitigate this for federally chartered banks like BitGo Bank & Trust, but the precedent has not been tested in resolution.
Depositors of the same bank face a second-order concern. FDIC insurance does not extend to crypto custody, and the FDIC's April 7 rule requires custody reserves segregated as customer property. If a bank materially commingles operational liquidity with crypto fee revenue or hot wallet operations, contagion could affect FDIC-insured deposits through reputational or capital impact. The third group is the broader regulated system: a bank custody failure under an incomplete framework could trigger defensive overreaction from regulators and stall existing OCC and FDIC accommodations.
Early Warning Indicators
Three indicators precede a failure. First, the gap between OCC interpretive guidance and rulemaking — Interpretive Letters 1183 and 1184 establish banks' authority but are not regulations, and until the OCC or FDIC promulgates formal rules on capital treatment, segregation requirements, and recovery procedures, the legal framework is thinner than it appears. Track the FDIC April 7 comment period (closes mid-June) and any subsequent supervisory guidance.
Second, SAB 122 footnote treatment in bank 10-Ks. SAB 122 requires disclosure of risks but allows entities to determine measurement methods. Thin or vague disclosures in a bank's first SAB 122-era annual report signal weak internal accounting policy. Third, sub-custodian concentration: banks entering crypto custody typically partner with technology providers (Fireblocks, BitGo, Anchorage) for key management, and concentration at one provider creates correlated exposure across multiple banks simultaneously.
Real Defenses vs Fake Defenses
Real defenses include the federal trust bank charter, which establishes legal separation between custody assets and the institution's own balance sheet — BitGo Bank & Trust, Anchorage Digital Bank, and Fidelity Digital Assets operate under this structure. F/B/O account titling, required by NYDFS and SEC frameworks in 2026, ensures client assets are legally outside the custodian's bankruptcy estate. Continuous on-chain attestation of segregation, rather than annual snapshots, provides verifiable evidence.
Fake defenses include reliance on FDIC insurance disclosures for crypto custody (which do not exist), general statements about OCC supervision without specific examination of the bank's custody policies (since OCC supervision is being calibrated in real time), and comfort drawn from SAB 122 alone (treating the accounting change as a complete prudential framework rather than the opening salvo of a longer rule-writing process).
Residual Risk and What Is Improving
The residual risk is that a bank enters crypto custody under SAB 122 accommodation, experiences an operational incident in 2026 or 2027, and the resolution exposes gaps in the prudential framework not visible during normal operations. The FDIC April 7 rulemaking, OCC consolidated guidance expected through 2026, and SEC-CFTC harmonization initiative all reduce this risk over time. Every federal banking regulator has now issued at least one accommodative crypto custody framework, and the rulemaking calendar through end of 2026 should close most of the framework gaps. The mitigation is to use federally chartered crypto-native trust banks (BitGo, Anchorage, Fidelity) rather than traditional banks newly entering custody, until the latter group's prudential treatment is fully clarified.
For informational purposes only. Not an offer to buy or sell any security. Available only to accredited investors who meet regulatory requirements.
