“Crypto bank” is a broad, non-uniform label, not proof that a business is dealing with a licensed bank. In practice, a provider may perform one or several distinct functions, such as custody, trading, lending, or token issuance. A business should identify the entity responsible for each service, trace how funds and crypto assets are handled, and verify legal-status and security claims against current, attributable evidence relevant to the service and jurisdiction.

What the term “crypto bank” can mean

The phrase “crypto bank” does not, by itself, establish what a provider does or what regulatory status it has. Treat it as a label to investigate, not as a description that resolves those questions. Start by listing the exact services proposed and the entity offering each one.

Separate functions that are often bundled together. For example, centralized crypto exchange operators may combine trading, proprietary activity, lending, token issuance, and custody, although not every operator performs every function. A provider’s presence in one category does not establish that it performs the others, or explain the terms under which it does so. (source )

Custody means a party manages access to private keys on a customer’s behalf. Crypto exchanges are among the possible third-party custodians, but custody structure, customer rights, segregation, insurance, regulation, and insolvency treatment vary by provider and jurisdiction. Do not infer any of those details from the word “bank” or “custodian.” (source )

For each proposed service, ask what it does operationally, which entity provides it, and what contract or documentation describes the arrangement. Keep the answers separate: custody, trading, lending, and token issuance are not interchangeable simply because one provider may offer several of them.

Map the service, provider, and counterparties

Build a service map before assessing a provider’s broader claims. Record the contracting entity, the service it provides, and each other party involved in handling funds, assets, or transactions. If one entity offers multiple functions, note that operational dependency rather than assuming the functions are independent. A provider may combine several roles, but that does not establish the arrangements for a particular customer or product. (source )

For custody, identify which party manages access to private keys on the business’s behalf and what customer rights and safeguards the provider documents. Those details vary, so a general description of third-party custody cannot settle the terms of a specific arrangement. (source )

For any other part of the service—such as fiat access, payments, or crypto transactions—identify the responsible entity and request current service documentation or contract terms. The available evidence here does not establish which counterparties a particular provider uses, how a specific transfer is executed, or whether a service is available to a particular business. Treat those as open verification questions rather than assumptions.

A useful service map has one row per function and records: the responsible legal entity; the service it performs; the relevant contract or disclosure; any other named parties; and unresolved questions about who holds, authorizes, or processes funds or assets. This makes it easier to see when a provider’s general description leaves a specific operational role unclear.

Assess security and recovery claims

Turn broad assurances into requests for evidence. Ask what documented controls govern access to assets, who may authorize movements, and what procedures the provider says apply when access or operations are disrupted. Request the current documents that describe those controls, their scope, and any stated limitations. Do not treat a provider’s description as independent verification.

For recovery claims, ask what the documented procedure covers, which entity is responsible, who can initiate it, and what conditions or limitations apply. The evidence available here does not establish any provider’s key-management design, transaction approval process, monitoring, incident response, or recovery capability. Those points must be verified from current, attributable documentation specific to the service under consideration.

If a provider mentions insurance, guarantees, or asset protection, ask for the underlying terms and evidence that identify what is covered, by whom, and within what limits. The claims available here do not establish that any particular service offers such protection. Do not translate an unsupported assurance into a conclusion that assets or funds are protected.

Keep a record of what is a provider statement, what is supported by documents, and what—if anything—has been independently verified. This distinction helps prevent a marketing description from being mistaken for evidence about operational security.

Check compliance and jurisdictional boundaries

Ask which legal entity offers each service, which jurisdiction and customer type the provider’s statement covers, and what current evidence supports claims about registration, authorization, or licensing. Verify those statements against current primary records or obtain qualified, jurisdiction-specific review. The phrase “crypto bank” is not sufficient evidence of bank status or permission to conduct a particular activity.

The evidence available here does not establish licensing, registration, regulatory status, permitted activities, onboarding rules, fees, or availability for any provider or jurisdiction. Do not infer one from branding or from a provider’s presence in a different service category. Record each claim, the entity and service it concerns, the jurisdiction identified, and the date and source of the evidence used to assess it.

Compliance responsibilities also depend on the parties and jurisdiction involved. In the United States, U.S. persons and virtual-currency businesses subject to U.S. jurisdiction are responsible for avoiding prohibited sanctions transactions and applying a tailored, risk-based compliance program appropriate to their activities. That statement is limited to U.S. sanctions compliance; it does not determine obligations elsewhere or whether a particular merchant is a regulated virtual asset service provider. (source )

For a global stablecoin arrangement, Financial Stability Board recommendations call for transparent information about governance, stabilization, reserve composition and custody, legal claims, redemption rights, operations, risk management, and financial condition. These are policy recommendations, not proof that any particular arrangement meets them. If a provider makes such claims, request current, attributable information and identify which arrangement and entity the evidence covers. (source )

Build a business due-diligence record

Use a structured record to separate what the business needs from what the provider says it can supply. For each service, document:

  • The specific function required and the entity proposed to provide it.
  • The parties involved, including the documented custody arrangement where applicable.
  • The contract, disclosure, or other current evidence describing the service and its limits.
  • The jurisdiction and customer type covered by any claim about regulatory status or compliance.
  • The evidence date, its source, and whether it is a provider statement or has been independently verified.
  • Unresolved questions assigned to the appropriate legal, security, finance, or operations reviewer.

Request evidence for security, recovery, compliance, fees, availability, and any stated yield or protection rather than relying on a general description. The claims available here do not establish those provider-specific details. Keep unsupported or unclear points visible in the record so decision-makers do not mistake an assumption for a verified fact.

Before reaching a decision, confirm that the service map matches the proposed contract, that each material claim is tied to the correct entity and jurisdiction, and that unresolved questions have an owner. This process does not determine whether a provider is suitable or legally authorized; it gives a business a disciplined way to identify what remains to be verified without treating the label “crypto bank” as an answer.

Sources and references