OCC requires that any third-party providers working with banks must implement and uphold robust security protocols to protect customer assets and ensure the integrity of the services offered

Quotes that support claims

The OCC stated that institutions may buy and sell assets held in custody at the customer’s direction and outsource crypto-asset functions, including custody and trade execution services, to third parties. These activities remain subject to the same oversight and operational standards applied to traditional financial services, including due diligence, third-party risk management, and cybersecurity protocols.

Third-party providers must follow proper controls to protect customer assets. Banks remain responsible for the oversight of all outsourced services.