A digital asset strategy for a bank or asset manager should commit to one or two activities the institution can already run under its licences, each with a named owner and a dated production gate. The rules moved in that direction in 2025 and 2026: in March 2025 the OCC confirmed that national banks may offer crypto-asset custody without first obtaining supervisory nonobjection, and its GENIUS Act final rule takes effect on 18 January 2027. The step that still fails is the one from approved strategy to a live client service.
Who decides this
The board approves the mandate, the risk appetite and the stop date; the head of digital assets owns delivery against them. The board is accountable for which business lines the programme serves and how much capital, operational risk and reputational exposure it may carry. The head of digital assets is accountable for the activity choice, custody model, vendors, the regulatory file and the production date.
Keep the two roles apart. A committee that both sets the risk appetite and runs delivery tends to approve scope it cannot staff. Give the head of digital assets authority over the budget lines the plan depends on, and a direct line to the board risk committee.
Which activities belong in scope?
Start with activities that extend a client relationship you already have; for a bank we would look first at custody or tokenized cash, and for an asset manager at a tokenized share class of an existing fund. New asset classes and proprietary exposure come later, if at all.
The activities differ on what they require, which rule set they open and where the hard part sits. The table shows the main candidates.
| Activity | What it requires | Main rule set to check (as of October 2026) | Where the hard part sits |
|---|---|---|---|
| Custody for clients | Key management, segregation, reporting | US national banks: OCC Interpretive Letter 1183; accounting under SAB 122 | Operational controls and bankruptcy remoteness |
| Payment stablecoin issuance | A permitted issuer, reserves, redemption | US: GENIUS Act and the OCC final rule; EU: MiCA e-money token rules | Distribution and redemption liquidity |
| Tokenized deposits | Your own deposit liability on a ledger | Your existing banking rules, confirmed with the supervisor; MiCA excludes deposits | Counterparties on the same ledger |
| Tokenized fund units | A distribution wrapper for an existing product | Securities and fund rules; MiCA excludes financial instruments | Transfer controls on each holder |
| Treasury or principal exposure | Capital, valuation, limits | Basel cryptoasset standard as adopted locally | Capital treatment and price risk |
Our view: choose one row, and at most two. An asset manager rarely needs custody of its own if a regulated sub-custodian already serves the fund. A bank with a custody franchise should usually start there, because the clients and controls already exist.
What has changed in the US rules?
US bank rules loosened in 2025 and a statutory stablecoin regime takes effect in 2027; plan around the new rules, but sequence launches to their effective dates. In Interpretive Letter 1183 (opens in new tab), the OCC confirmed that crypto-asset custody, certain stablecoin activities and participation in distributed-ledger node networks are permissible for national banks and federal savings associations. It also removed the requirement to obtain supervisory nonobjection before starting them.
The permission does not lower the bar on controls. The OCC said it expects the same risk management for these activities as for traditional ones. Examiners will look for the same evidence: policies, limits, reconciliation and incident plans.
Stablecoin issuance now has a statute. The GENIUS Act was enacted on 18 July 2025 and generally bars anyone other than a permitted payment stablecoin issuer from issuing a payment stablecoin in the US. The OCC’s final implementing rule (opens in new tab), issued on 21 October 2026, covers reserve assets, redemption, risk management, audits and custody. It takes effect on 18 January 2027, the same day as the Act. Anti-money-laundering and sanctions rules will follow in a separate rulemaking with the Treasury.
Build, partner or buy custody?
Decide custody before choosing any platform vendor, because the custody model sets the accounting, the operational risk and who answers to the supervisor. The three options are self-custody under your own charter, a regulated sub-custodian, or a split model in which you operate and a third party holds.
The accounting obstacle has eased for US reporters. SEC Staff Accounting Bulletin 122 (opens in new tab), effective 30 January 2025, rescinded the earlier staff guidance on safeguarding crypto-assets held for platform users. Entities now assess any loss liability under the contingency guidance in ASC 450-20 or IAS 37. The SEC staff reminded entities that disclosure obligations about safeguarding continue.
What we would do: a bank with an existing custody business builds or partners at the key-management layer and keeps the client relationship. An asset manager uses a regulated sub-custodian and spends its effort on distribution. In both cases, write down which risk the institution keeps and which it transfers, before signing.
How much capital, and under which standard?
Treat capital treatment as a moving input, not a settled constraint, and design the programme so a change alters the asset mix rather than the whole plan. The Basel Committee’s revised cryptoasset standard (opens in new tab) carried an implementation date of 1 January 2026, and included clarified criteria for stablecoins to receive the preferential Group 1b treatment.
That date is not the end of the story. In February 2026 the Committee said it had expedited a review (opens in new tab) of targeted elements of the standard and would provide an update later in the year. As of October 2026, check whether that update has been published before relying on the 2024 text. The Committee also notes that its decisions have no legal force; what binds a bank is the national rule that adopts them.
In the EU, scope comes first. MiCA (opens in new tab) does not apply to crypto-assets that qualify as financial instruments or deposits, among other exclusions. A tokenized fund unit or deposit therefore stays under the rules that already govern the underlying product. Confirm the classification with counsel before any build.
Who should the institution talk to first?
Talk to the supervisor before selecting vendors, and to two or three existing clients before writing the business case; both conversations change the scope more than any market study. A strategy written without either tends to describe a market rather than a service someone will use.
With the supervisor, the aim is not approval in principle. It is to learn which evidence the examiners will ask for, and in what order. Bring a one-page description of the activity, the custody model and the controls you intend to run, and record what you are told.
With clients, test willingness rather than interest. Ask an asset-management client whether it would move a share class onto a tokenized register next year, and on what conditions. Ask a corporate client what it would need before holding tokenized cash. The answers set the production gate.
Our view: if neither conversation has happened, the strategy is not ready for the board, however strong its analysis.
What should the board approve, and in what order?
The board should approve five items in sequence: the activity, the risk appetite, the custody model, the operating model with a named owner for each workstream, and a production gate with a kill criterion. Approving them as one bundle hides the dependencies between them.
The operating model is where strategies tend to be thinnest. Name the person accountable for the legal opinion, custody, treasury operations, reconciliation, technology, the regulatory file and client communications. If a line reads “working group”, it has no owner.
Set the production gate as a date and a client outcome, not a technology milestone. “First client assets in custody, reconciled daily against the core ledger” is a gate. “Platform deployed” is not.
What goes wrong: the strategy nobody could execute
The common failure is a strategy that reads well and has no path past its first month. The board receives a market overview, five candidate activities and a vendor longlist. Each function waits for another: legal for the activity choice, technology for the custody model, custody for legal.
Months pass in a sandbox. The pilot never holds client assets, never reconciles against the core ledger and never reaches the supervisor. The budget cycle closes, the sponsor moves on, and the programme is renamed for the next one.
The warning signs appear in the board paper itself: more than two activities in scope, no production date, no kill criterion, and supervisory engagement scheduled after the build. Fix the sequence, and give each workstream a person rather than a committee.
How Alcyone approaches it
Alcyone builds the plan in three to six weeks after a fixed-scope, fixed-fee assessment, and every part of it has a named owner. Its record with regulated clients includes a national banking association, for which its partners delivered a live, compliant sustainability NFT initiative to the security and compliance standards of a regulated financial-sector client. That engagement and others are described in Alcyone’s institutional advisory engagements (opens in new tab). There is no obligation to use TrustSwap products.
Where the programme needs institutional custody, Panthea’s institutional platform (opens in new tab) is one option to assess. Panthea is the technology layer; custody sits with Blockfort AG, a Swiss-regulated financial intermediary and VQF member.