The OCC stated that institutions may buy and sell assets held in custody at the customer’s direction and outsource crypto-asset functions, including custody and trade execution services, to third parties. These activities remain subject to the same oversight and operational standards applied to traditional financial services, including due diligence, third-party risk management, and cybersecurity protocols.
