9 mega banks block crypto accounts, but new OCC rules bite back

The Office of the Comptroller of the Currency’s Oct. 14 debanking findings identify historical restrictions on digital asset issuers, exchanges, and administrators, often attributed to financial crime considerations.

The findings review crypto banking decisions across policies at the nine largest national banks the agency supervises.

For smaller crypto businesses, an individual bank’s risk assessment remains an important gate to access. Comptroller Jonathan Gould is preserving objective customer decisions while challenging improper exclusion.

The consequential test is how the OCC distinguishes financial, operational, or compliance constraints from disapproval of a lawful business, and whether its scrutiny produces usable banking services.

The functions at stake extend beyond opening a deposit account. On June 29, 2026, BNY announced stablecoin services for institutional clients, including holding USDC in BNY custody and instructing Circle through BNY to mint USDC from dollars or redeem it for dollars.

The arrangement links digital asset custody with the dollar side of stablecoin activity. BNY described service availability for its institutional clients, while eligibility for smaller crypto businesses and broader competitive effects remain unresolved.

Historical policies meet a current supervisory test

The OCC’s findings cover policies between 2020 and September 2025. The reviewed banks were JPMorgan Chase Bank, Bank of America, Citibank, Wells Fargo Bank, US Bank, Capital One, PNC Bank, TD Bank and BMO Bank.

The agency said it reviewed nearly 100,000 complaints and received about 50,000 documents totaling about 420,000 pages, as part of its broader inquiry across customer sectors.

Its official summary says many institutions restricted banking for digital-asset issuers, exchanges, or administrators, often citing financial crime considerations. Across the industries examined, restrictions ranged from categorical prohibitions to additional reviews and approvals.

The broad finding covers all nine banks, while the digital asset discussion describes restrictions at many institutions. Specific crypto policies and the grounds for individual refusals remain case-level questions.

In his Oct. 14 remarks, Gould said banks should evaluate customers using objective, risk-based criteria. His approach preserves decisions to decline individual customers on those grounds.

The administration’s August 2025 fair-banking executive order takes the same approach. It disclaims any privately enforceable right or benefit created by the order, leaving existing statutory protections intact.

The OCC and Federal Deposit Insurance Corporation issued their final reputation-risk rule on April 7, and it became effective June 9. Its prohibitions govern the agencies’ supervisory conduct and pressure on banks over customer relationships.

The final rule defines reputation risk in terms of public-perception concerns that are separate from a bank’s financial or operational condition. It preserves Bank Secrecy Act enforcement authority, and its account-relationship provision exempts OFAC-sanctioned persons, entities, or jurisdictions.

The accompanying explanation explicitly prohibits supervisors from using anti-money laundering concerns as a pretext for reputation-risk supervision.

In a separate BSA enforcement case, the OCC assessed a $750 million civil money penalty against Bank of America on Oct. 13, citing transaction-monitoring, reporting, expertise, and training deficiencies.

The Office of Foreign Assets Control’s standing guidance says US persons and others subject to its jurisdiction have the same obligations for digital currency transactions as for traditional fiat-currency transactions.

Together, these policies preserve supervision of financial crime and operational risk while limiting judgments based on a business’s unpopularity. The quality of the risk justification remains central to distinguishing the two.

Licensing and complaints provide the existing tools

The OCC already has ways to bring customer-access decisions into its supervisory work. In a September 2025 bulletin, it clarified that it considers banks’ debanking records and prevention policies case by case when applying relevant licensing factors.

Debanking may also be considered case by case in Community Reinvestment Act ratings, with treatment tailored to a bank’s size, complexity and overall risk profile.

A bank seeking a licensing decision may face an examination of its record and procedures under the applicable factors. Licensing review is case-by-case, and CRA consideration remains discretionary.

The OCC also updated its online complaint reporting in September 2025 and said it uses complaints and other data to refine examinations. Its Oct. 14 announcement cites complaint intake and licensing scrutiny among actions already taken.

For crypto businesses, these tools offer a way to examine how access policies work in individual cases. The useful test is whether a restriction’s stated reason is tied to the customer’s risks and the bank’s ability to manage them.

Customer risk, operational capacity, and the grounds for a restriction all remain relevant to that analysis.

The banking industry is arguing for a boundary that preserves risk management. The Bank Policy Institute responded by supporting fair access and clear, consistent standards while maintaining sound risk management.

JPMorgan also said that its policies prohibit political or religious discrimination, adding that it had corrected a WePay process that fell short of its standards.

For a new entrant, customer eligibility and the bank’s objective assessment still determine whether it can use a service such as BNY’s. The institutional offering includes custody and redemption functions, while leaving whether to extend comparable access to smaller issuers or exchanges an open competition question.

The OCC says it is still considering further regulatory and supervisory changes. The practical measure of progress will be broader eligibility that translates into actual customer access to banking functions, with financial, operational, AML, and sanctions requirements assessed on their merits.