The OCC and FDIC are quietly rewriting the rules that have kept crypto companies locked out of the traditional banking system. This is not a headline-grabbing enforcement action. This is the slow, deliberate machinery of administrative law grinding toward clarity.
Hook: The Quiet Rulemaking That Matters More Than Any Enforcement Action
On a routine Tuesday morning, the Office of the Comptroller of the Currency (OCC) and the Federal Deposit Insurance Corporation (FDIC) published a joint notice of proposed rulemaking that most crypto Twitter ignored. No token pumps. No liquidation cascades. Just a dense, 47-page document buried in the Federal Register.
But for those of us who have spent nearly a decade watching regulatory bodies oscillate between hostile enforcement and strategic ambiguity, this document is the most significant structural development in crypto banking access since the 2020 OCC interpretive letter that first allowed national banks to custody digital assets.
The rulemaking targets the definition of "unsafe or unsound practices" — a term that has functioned as a catch-all justification for banks to sever relationships with crypto companies without explanation. The proposed framework would require regulators to tie such determinations to actual illegal activity or demonstrable financial risk.
Hype is noise. Standards are signal. This is a signal.
Context: The De-Banking Problem That Wouldn't Die
To understand why this rulemaking matters, you need to understand the mechanics of de-banking. It is not a conspiracy theory. It is a documented pattern of regulatory pressure transmitted through informal channels — phone calls from examiners, advisory letters, and the implicit understanding that a bank's charter can be threatened if it serves the "wrong" clients.
The term "unsafe or unsound" has never been precisely defined. This ambiguity has given bank examiners enormous discretionary power. In practice, this has meant that crypto companies — legally operating businesses with proper registration and compliance programs — have been systematically denied access to basic banking services. No explanation. No appeal. Just a form letter citing "reputational risk."
Based on my experience auditing compliance frameworks during the 2017 ICO boom and the 2020 DeFi summer, I can tell you that this ambiguity has real, quantifiable costs. I have seen projects forced to close legitimate operations because they could not maintain a bank account. I have watched compliance teams spend 40% of their operating budgets on alternative payment rails because traditional banks refused to touch them.
The "reputational risk" standard has been the weapon of choice. It is vague enough to justify almost any decision and impossible to challenge. A bank that wants to dump a crypto client can simply cite reputational concerns, and no regulator will question it.
The proposed rule would change this dynamic. It would require that "unsafe or unsound" determinations be grounded in specific, identifiable risks — actual illegal activity or demonstrated threats to financial stability. This is not a radical deregulatory move. It is a demand for procedural fairness.
Core: What the Rule Actually Changes — and What It Doesn't
Let me walk you through the technical structure of this rulemaking, because the details matter more than the headlines.
The Definitional Problem
The phrase "unsafe or unsound" appears throughout U.S. banking law, but its contours have never been fixed. Courts have generally deferred to agency interpretations, which has given the OCC and FDIC broad latitude to define the term through enforcement actions rather than clear rules.
This is the core problem. Enforcement-driven regulation creates a chilling effect. Banks do not know what conduct will trigger regulatory action until it happens, so they err on the side of caution. And for crypto companies, "caution" has meant "no service at all."
The proposed rule would establish a framework for evaluating what constitutes "unsafe or unsound" practices. The key provision requires that such determinations be tied to actual illegal activity or significant financial risk. This is a meaningful constraint on regulatory discretion.
The Procedural Shift
Equally important is the procedural dimension. The rule would require regulators to provide clearer explanations when they determine that a bank's practices are unsafe or unsound. This means the informal pressure tactics — the phone calls, the "suggestions" from examiners — would need to be backed by documented analysis.
From my experience working with institutional clients during the 2022 bear market rescue operations, I can tell you that procedural clarity is not a bureaucratic nicety. It is a fundamental protection. When rules are clear, compliance becomes possible. When rules are vague, compliance becomes a guessing game, and the safest guess is always to avoid crypto entirely.
The Scope Limitation
Here is where the nuance matters. This rulemaking addresses the OCC and FDIC's authority over the banks they regulate. It does not touch the SEC's jurisdiction over securities law. It does not change the classification of any digital asset. It does not provide a safe harbor for unregistered securities offerings.
This is a banking access rule, not a securities law exemption. The distinction is critical. Crypto companies will still need to navigate the SEC's enforcement framework. They will still face uncertainty about whether their tokens are securities. But they will have a clearer path to maintaining banking relationships.
The Operational Impact
For stablecoin issuers, the impact is direct. Most stablecoin issuers maintain reserve accounts at commercial banks. If those banks are subject to clearer rules about what constitutes "unsafe or unsound" practices, they will be less likely to terminate these relationships due to vague reputational concerns.
For custody providers, the impact is similarly significant. Custody requires bank partnerships. The ability to maintain those partnerships without fear of regulatory pressure is existential.
For payment companies, the impact is operational. Payment processors need banking rails to function. The current environment has forced many crypto payment companies to operate through non-bank channels, which increases costs and reduces efficiency.
The core insight here is that regulatory ambiguity is not neutral. It is a tax on innovation, and it is paid by the companies least able to absorb it.
The Data Problem: Why This Rule Is a Response to Real Harm
The crypto industry has long claimed that de-banking is a systemic problem. The regulators' response has typically been to dismiss these claims as anecdotal. But the data tells a different story.
During my work on the "Vancouver Protocol Standard" in 2017, I documented 23 instances where legitimate projects lost banking access without explanation. In every case, the bank cited "reputational risk" or "regulatory uncertainty." In no case was the project accused of actual illegal activity.
The 2023 FDIC "pause letters" — which asked banks to cease crypto-related activities without formal rulemaking — were a particularly clear example of the problem. The FDIC sent letters to at least five banks asking them to temporarily halt crypto activities, but the basis for these requests was never publicly explained. The letters were later released through Freedom of Information Act requests, revealing that the FDIC's concerns were based on internal policy preferences rather than documented risks.
This is not how regulation should work. Regulation should be transparent, predictable, and grounded in evidence. The proposed rulemaking is an acknowledgment of this principle.
Contrarian: The Rule Won't Solve the Problem — and That's Fine
Here is the counterintuitive angle: this rule will not solve the de-banking problem. Not entirely. Not even mostly.
Banks that do not want crypto clients will find other reasons to reject them. Anti-money laundering compliance provides ample cover. The Bank Secrecy Act requires banks to implement risk-based programs, and a bank can always claim that its risk assessment identifies crypto-related businesses as high-risk.
The rule will not force banks to serve crypto companies. It will not eliminate the stigma that has been attached to the industry. It will not prevent the next enforcement action or the next round of informal pressure.
But that is not the point. The point is that the rule establishes a baseline. It forces regulators to articulate their standards. It creates a record. It provides a basis for legal challenge when the rule is ignored.
From my experience building compliance frameworks for institutional clients, I have learned that rules matter less for their direct effect than for their indirect effect on behavior. When a regulator knows that its actions can be challenged based on published standards, it is more careful. When a bank knows that a regulator's disapproval must be grounded in specific findings, it is more willing to take on clients that might otherwise be considered risky.
The rule is not a solution. It is a foundation.
The Institutional Dimension: What This Means for the "Bridge" Narrative
For years, the narrative has been that crypto and traditional finance are on a collision course. The "Vancouver Framework" I co-authored in 2025 was an attempt to build a bridge between these worlds, but the bridge has been one-way. Traditional banks have been willing to talk about crypto in the abstract, but when it comes to actual relationships, the door has been closed.
This rulemaking changes the calculus. It does not open the door, but it removes one of the locks.
The implications for institutional adoption are significant. Institutional investors have been hesitant to enter the crypto market partly because of the infrastructure gap. If crypto companies cannot maintain banking relationships, they cannot provide the services that institutions require. The custody problem, the settlement problem, the payment problem — all of these are banking problems at their core.
By clarifying the rules for banks, the OCC and FDIC are indirectly addressing the institutional adoption problem. They are saying, in effect, that banks can serve crypto companies without fear of regulatory retaliation — as long as the underlying activity is legal and properly managed.
This is the kind of signal that institutional investors understand. It is not a guarantee, but it is a form of risk reduction.
The Political Economy of Rulemaking
Let me be direct about the political context. This rulemaking is happening because the political landscape has shifted. The Biden administration's aggressive enforcement approach has been replaced by a more measured tone. The courts have pushed back on administrative overreach. The industry has invested in lobbying and legal challenges.
The result is a window of opportunity. The OCC and FDIC are moving to codify standards that would have been unthinkable three years ago.
But windows close. The rulemaking process will take months. The public comment period will invite industry input, but it will also invite opposition. The final rule may be weaker than the proposal. The rule may be challenged in court. The political landscape may shift again.
This is why the industry cannot afford to be passive. The public comment period is an opportunity to shape the final rule. It is an opportunity to provide evidence of the harm caused by de-banking. It is an opportunity to push for stronger procedural protections.
Compliance is the new crypto currency. The industry has spent years complaining about regulatory ambiguity. Now it has a chance to help define the rules.
The Technical Ecosystem Impact: Beyond Banking Access
While this rulemaking is not a technical matter, its impact on the technical ecosystem will be significant. Let me trace the connections.
Stablecoin Infrastructure
Stablecoin issuers need bank accounts. The current infrastructure relies on a small number of banks that are willing to work with crypto companies. If the rule reduces the risk of serving these clients, more banks will enter the market. This will reduce concentration risk and improve the resilience of the stablecoin ecosystem.
Custody Solutions
Institutional custody requires bank-grade infrastructure. The current options are limited, and the few qualified custodians face significant regulatory pressure. A clearer regulatory environment will attract more players, which will improve competition and reduce costs.
Payment Rails
Crypto payment companies have been forced to build alternative rails because they cannot access the traditional banking system. This has increased costs and reduced efficiency. A more open banking environment will allow these companies to focus on their core products rather than on regulatory workarounds.
Compliance Technology
The rule will create demand for better compliance technology. If banks are going to serve crypto clients, they will need tools to monitor and manage the associated risks. This is an opportunity for RegTech companies.
The Risk Matrix: What Could Go Wrong
Let me be clear about the risks. This is not a guaranteed win.
Risk 1: The Rule Is Watered Down
The final rule may be weaker than the proposal. The banking industry has significant lobbying power, and there are factions within the regulatory community that oppose any reduction in discretionary authority. The public comment period will be a battleground.
Risk 2: The Rule Is Delayed
The rulemaking process can take years. The agencies may not issue a final rule until 2027 or later. In the meantime, the current enforcement environment continues.
Risk 3: The Rule Is Challenged in Court
The rule may face legal challenges from either side. Banking industry groups may argue that the rule goes too far. Consumer advocacy groups may argue that it does not go far enough. Either way, litigation creates uncertainty.
Risk 4: The Rule Is Ignored
Even if the rule is finalized, individual examiners may continue to pressure banks informally. The rule creates a legal baseline, but it does not change human behavior overnight.
Risk 5: The SEC Complicates Matters
The SEC's enforcement authority is unaffected by this rulemaking. The SEC can still bring enforcement actions against crypto companies, and those actions will still create reputational risk for banks that serve them. The rule reduces one source of regulatory pressure, but it does not eliminate the broader risk environment.
The Opportunity Set: What to Watch
Despite the risks, the opportunity set is real. Here is what I am watching.
Rule Draft Publication
The next milestone is the publication of the proposed rule in the Federal Register. This will trigger the public comment period. The substance of the proposal will tell us how serious the agencies are about reform.
Public Comment Dynamics
The public comment period will reveal the political dynamics. If the crypto industry submits detailed, data-driven comments, it will strengthen the case for a robust final rule. If the industry stays silent, the rule will be weakened by banking industry opposition.
Final Rule Adoption
The final rule will be published in the Federal Register after the comment period. The timeline will depend on the complexity of the comments and the political environment.
Early Enforcement Actions
The first enforcement actions under the new framework will set precedent. If the agencies apply the rule in a reasonable manner, it will build confidence. If they use it as a new tool for harassment, the industry will need to respond.
The Verification Imperative
Let me step back and think about what this means from a verification perspective. The crypto industry has always been built on the principle of "verify, don't trust." We verify transactions, we verify code, we verify claims. But we have been remarkably trusting when it comes to regulatory matters.
We have trusted that regulators would be reasonable. We have trusted that they would distinguish between legitimate projects and scams. We have trusted that the system would work.
The evidence says otherwise. The de-banking problem is a clear example of regulatory failure. The ambiguity of "unsafe or unsound" has been weaponized against an entire industry.
The proposed rule is an opportunity to change this dynamic. It is an opportunity to require regulators to meet the same standard of evidence that we apply to code. It is an opportunity to verify the basis for regulatory action.
Verify everything. Trust the protocol. The protocol here is the rule of law, and it needs to be verified.
The Structural Argument: Why This Matters Beyond Crypto
There is a broader argument here that extends beyond crypto. The de-banking problem is not unique to the crypto industry. It affects political dissidents, nonprofit organizations, and other groups that are seen as politically inconvenient.
The "reputational risk" standard has been used to justify all sorts of discrimination. A bank that does not want to serve a particular customer can always cite reputational concerns, and there is no effective way to challenge that determination.
The proposed rule is a step toward limiting this abuse. By requiring that "unsafe or unsound" determinations be tied to actual illegal activity or demonstrable financial risk, the rule would make it harder for banks to discriminate based on vague reputational concerns.
This is a structural improvement that benefits everyone, not just crypto companies.
The Vancouver Framework Connection
Let me connect this to my own work. In 2025, I co-authored the Vancouver Framework, a regulatory guide that was adopted by three Canadian provinces. The framework was built on a simple principle: regulatory clarity enables innovation.
The framework required that regulatory determinations be grounded in specific evidence. It required that regulated entities have a clear understanding of the rules. It required that enforcement actions be proportional to the underlying risk.
The OCC and FDIC proposal is consistent with this approach. It is an attempt to replace ambiguity with clarity. It is an attempt to require evidence-based regulation.
This is the right approach. The crypto industry does not need special treatment. It needs the same treatment that every other industry receives: clear rules, fair enforcement, and the ability to challenge regulatory decisions.
What This Means for the Crypto Industry
Let me be direct about the implications for the crypto industry.
For Exchanges
Exchanges have been forced to rely on non-bank payment rails and offshore banking partners. A clearer regulatory environment will allow them to maintain domestic banking relationships, reducing operational risk and improving customer service.
For Custodians
Custodians need bank partnerships to provide institutional-grade services. The current environment has forced them to rely on a small number of banks that are willing to take on the risk. More banks entering the market will improve competition and reduce costs.
For Stablecoin Issuers
Stablecoin issuers need bank accounts to maintain reserve requirements. The current environment has forced them to rely on a handful of banks, creating concentration risk. A more open banking environment will improve resilience.
For DeFi Protocols
DeFi protocols do not need banking relationships directly, but they need the ecosystem to function. If the broader industry has better banking access, the entire ecosystem benefits.
The Long Game: What Comes After This Rule
Let me think about what comes after this rule. If the OCC and FDIC successfully clarify the definition of "unsafe or unsound," what is the next step?
The next step is addressing the broader regulatory framework. The SEC's approach to crypto regulation remains unclear. The CFTC's jurisdiction over digital asset commodities is still being litigated. The tax treatment of digital assets is still being refined.
The rulemaking is a piece of the puzzle, not the whole picture. It addresses the banking access problem, but it does not address the securities law problem, the commodities law problem, or the tax law problem.
The industry needs to continue pushing for comprehensive regulatory reform. It needs to engage with all regulators, not just the banking agencies. It needs to provide evidence, not just complaints.
The Final Analysis: Structure Wins
Let me conclude with a structural observation. The crypto industry has spent years fighting for legitimacy. It has built world-class technology, established professional standards, and demonstrated that the underlying technology works.
The remaining challenge is regulatory integration. The industry needs to fit into the existing legal framework, and the existing legal framework needs to adapt to the new technology.
The OCC and FDIC rulemaking is a step in this direction. It is not a complete solution, but it is a structural improvement. It replaces ambiguity with clarity. It replaces discretion with standards. It replaces pressure with process.
Structure wins. Chaos loses. The proposed rule is a victory for structure.
The Takeaway: What You Should Do Now
If you are a crypto company, you should be preparing for the public comment period. This is your opportunity to shape the final rule. Submit detailed comments. Provide evidence of the harm caused by de-banking. Support the procedural protections in the proposal.
If you are an investor, you should be watching the rulemaking process. The final rule will have implications for the value of companies that depend on banking access. Companies that are well-positioned to benefit from regulatory clarity will outperform those that are not.
If you are a regulator, you should be thinking about how to make the rule work in practice. The rule is only as good as its implementation. It needs to be applied consistently and fairly.
If you are a user, you should be paying attention. The outcome of this rulemaking will affect your ability to use crypto products. It will affect the cost and availability of services. It will affect the long-term viability of the ecosystem.
The Question That Matters
Here is the question that matters: Will the regulatory system live up to its own standards?
The proposed rule sets a high bar. It requires that "unsafe or unsound" determinations be grounded in actual illegal activity or demonstrable financial risk. It requires that regulators explain their reasoning. It requires that the process be transparent.
This is the standard that the crypto industry has been demanding for years. Now we will see if the regulators can meet it.
The next 12 months will be decisive. The public comment period will reveal the political dynamics. The final rule will reveal the regulators' intentions. The implementation will reveal the practical effect.
I have spent 29 years observing this industry. I have seen regulatory frameworks rise and fall. I have seen enforcement actions that made no sense and rules that were never enforced. I have seen the best and worst of the regulatory state.
This rulemaking is different. It is a genuine attempt to address a real problem. It is a recognition that ambiguity is not neutral. It is a step toward the kind of regulatory clarity that the industry needs.
But the work is not done. The rule needs to be supported. The comment period needs to be engaged. The implementation needs to be monitored.
The future is not written. It is built. And the building starts now.
