Digital Assets

Subscribe to Digital Assets via RSS

In our client alert of September 30, 2026,1 we provided an executive summary of federal banking regulators’ Proposed Third-Party Risk Management Guidance (the “Proposal”), a related joint statement on community banks’ engagement with core service providers, and a proposed Federal Reserve guide for traditional community banks (the “Community Bank Guide”).2 This blog post covers what these agency pronouncements mean for fintechs and the banks that sponsor their programs.

The Proposal’s effect on a fintech turns on the model it uses. In a vendor model, the fintech supplies software or services the bank uses for its own customers, whereas in a partnership model, the fintech markets and distributes the bank’s products directly to consumers. The Community Bank Guide explicitly excludes “complex bank-fintech partnerships,” or relationships where “the fintech company, rather than the bank, markets, distributes, or otherwise provides access to the products or services.”3 The result is two tracks: greater flexibility for vendors, and a set of risks that may limit how much relief partnership programs actually gain.

Continue Reading Proposed Third-Party Guidance: What It Means for Sponsor Banks and Fintechs

What You Need to Know

Key takeaway #1: Bank regulators have shifted from prior approval to examination scrutiny. Banks no longer need supervisory nonobjection to lend against crypto collateral. Regulators are likely to focus their examinations on collateral operations, BSA/AML and sanctions compliance, and third-party risk management.

Key takeaway #2: Control-based perfection trumps filing, with a June 3, 2027, New York deadline to re-perfect existing security interests. Under the 2022 UCC amendments, a security interest in controllable electronic records perfected by control as of June 3, 2027, will have priority over a filing-only perfection, regardless of timing. Lenders relying on filing alone should consider taking steps to comply with UCC Article 12’s control arrangements before the adjustment date.

Key takeaway #3: Custody terms determine ownership in insolvency. Documents that permit a custodian or platform to use or rehypothecate pledged assets may impair the secured nature of a claim, leaving the lender with an unsecured one. Parties should confirm segregation, retained borrower title, and a prohibition on rehypothecation in custody documentation.

Key takeaway #4: Bankruptcy safe harbors may not apply; margin mechanics are the practical protection. Because spot crypto lending may fall outside the Bankruptcy Code’s safe harbors, conservative advance rates and market-based loan-to-value triggers are the principal protections.

Key takeaway #5: No capital recognition for digital asset collateral, and state licensing may apply. Digital asset collateral currently earns no credit risk mitigation relief under U.S. capital rules, and nonbank lenders may face state licensing obligations.

Continue Reading Lending Against Digital Assets: Five Key Takeaways for Lenders After a Year of Regulatory and UCC Change

Crowell & Moring has added Cristina Diaz, former executive director and general counsel of UBS Bank USA, and most recently head of legal for UBS’s U.S. Remediation Management Office, to the firm’s Financial Services Group as senior counsel in New York. Diaz brings more than two decades of in-house counsel and law firm experience in bank regulation, compliance, and risk management.

Continue Reading Crowell & Moring Expands Financial Services Group with Former UBS Bank USA General Counsel Cristina Diaz

What You Need to Know

  • Key takeaway #1: Threat actors are no longer just looking for software bugs; they are spending months building fake identities to “befriend” organizations and conduct corporate espionage.
  • Key takeaway #2: The Drift incident reflects a familiar Democratic People’s Republic of Korea (DPRK) playbook with an in-person twist: identity deception, relationship-building, privileged access, and rapid monetization ― the same methods central to North Korea’s remote IT worker schemes.
  • Key takeaway #3: Where a small group of individuals can authorize consequential financial or administrative actions, social engineering and insider-enabled compromise present significant legal, compliance, and operational risk. High-risk approvals, access governance, and hiring controls should be treated as core security measures.

The recent $285 million theft from Drift Protocol serves as a high-stakes reminder that the human element remains one of the biggest cybersecurity gaps in any organization. This was not a “hack” in the traditional sense of breaking through a digital wallet. North Korean actors used sophisticated social engineering to exploit human trust ―  highlighting what looks like a “hacking” risk into valuable lessons learned for cybersecurity oversight.

Continue Reading Drift Protocol Exploit: Why “Social Trust” Is the Newest Cybersecurity Gap

Key Takeaways 

  • The U.S. Department of the Treasury’s Office of Foreign Assets Control (OFAC) designated six individuals and entities tied to Cartel del Noreste (CDN)—one of Mexico’s most violent drug trafficking organizations—including two CDN-affiliated casinos used for money laundering and drug operations near the U.S.-Mexico border. 
  • OFAC’s actions are the latest examples of a broader national security strategy to use sanctions, AML authorities, criminal prosecutions, and other tools to counter cartels on the U.S.-Mexico border. These efforts have targeted in particular non-traditional financial institutions such as casinos, public-facing professionals, and disinformation actors. 
  • The State Department designated CDN as a foreign terrorist organization (FTO) on February 20, 2026, and today’s designations were issued under both Executive Order 14059 (narcotics trafficking) and Executive Order 13224 (terrorism), underscoring the U.S. government’s treatment of major cartels as hybrid criminal-terrorist threats.
Continue Reading OFAC Sanctions Cartel-Linked Casinos and Financial Enablers on the Southern Border 

On Jan. 14, New York state Sen. Zellnor Myrie proposed legislation in the New York State Senate that would amend New York law to make it a criminal offense to operate a virtual currency business in the state without the proper license.

By introducing the possibility of criminal penalties, S.B. 8901 — the Cryptocurrency Regulation…

Overview

On March 12, 2026, the U.S. Commodity Futures Trading Commission (CFTC) took formal steps toward establishing additional regulations for prediction markets. The agency issued an Advanced Notice of Proposed Rulemaking (ANPRM) soliciting public input on potential new rules, and separately, released staff guidance outlining its views on how existing rules apply to prediction market platforms currently in operation. These developments signal a significant shift in the regulatory landscape for an industry that has grown rapidly over the past year.

Continue Reading CFTC Takes Additional Steps Toward Prediction Market Regulation: What You Need to Know

On January 14, 2026, State Senator Zellnor Myrie proposed legislation in the New York State Senate that would amend New York law to make it a criminal offense to operate a virtual currency business in New York without the proper license. By introducing the possibility of criminal penalties, Senate Bill S. 8901, the Cryptocurrency Regulation Yields Protections, Trust, and Oversight Act (CRYPTO Act), would mark a significant regulatory shift in the state’s oversight of virtual currency businesses, given New York’s prominence in virtual currency regulation in the U.S.

Continue Reading Proposed NY Legislation May Mean Potential Criminal Charges for Unlicensed Crypto Firms