Exam Findings and Termination of Crypto Activities

FDIC
Federal Deposit Insurance Corporation
10 10th Street NE, Suite 900
Atlanta, Georgia 30309-3849

Atlanta Regional Office
Division of Risk Management Supervision
Division of Depositor and Consumer Protection
(678) 916-2200

January XX, 2024

Via Secure Email
Board of Directors
XXXXX

Subject: Matters Requiring Board Attention

Dear Members of the Board:

In a letter dated August 5, 2022, Bank management notified the FDIC and the XXXXX, in response to Financial Institution Letter 16-2022 Notification of Engaging in Crypto-Related Activities, of its intent to XXXXX through XXXXX, the Bank’s core service provider, and XXXXX. On August 26, 2022, the FDIC sent a letter to the Board requesting information necessary to allow the FDIC to assess the safety and soundness, consumer protection, and financial stability implications of such activities; the letter requested that the Bank refrain from providing the service until we complete that review. FDIC Examiner XXXXX commenced an examination of XXXXX on September 26, 2022. The findings of the examination were transmitted on July 26, 2023. The findings included Matters Requiring Board Attention (MRBA) addressing the Bank’s intent to provide crypto-asset related services to its customers.

The examination noted that the Bank’s risk management framework, including policies for assessing, monitoring, and managing the XXXXX third-party relationship, needed improvement. Due to limited risk assessment and vendor due diligence undertaken by management, the Board of Directors (Board) had not ensured management properly assessed and measured the risks associated with the proposed new service. To communicate these concerns to the Board to ensure risks are appropriately identified, evaluated, and mitigated, the examination included detailed MRBA addressing the following areas: risk assessment, vendor due diligence, Board oversight, and the compliance management system.

On July 18, 2023, the Bank notified this office that XXXXX was terminating its agreement with the Bank, and that management would soon present the termination letter to the Board. On September 8, 2023, we received your response to the examination findings. Your response confirmed that the Board discussed the XXXXX termination letter at the July 19, 2023 meeting, and decided to “XXXXX.” Your response also stated that all test accounts were closed and notifications were provided to all accountholders.

---

Board of Directors
XXXXX

Page 2 of 2

Based on your response to the examination findings, the MRBA are closed. The FDIC acknowledges the Bank’s updated status related to this activity, and the August 26, 2022 FDIC letter to the Board is superseded as a result of the July 18, 2023 and September 8, 2023 communication to the FDIC. The FDIC requests that the Bank notify this office if the status of this activity, or other crypto-related activity, changes in the future. In addition, management and the Board should address the issues noted in the MRBA prior to any decision to enter into similar activity in the future.

This letter is confidential and may not be disclosed or made public in any manner under part 309 of the FDIC Rules and Regulations (12 CFR part 309). As a reminder, all official correspondence to the FDIC should be submitted as a PDF file to XXXXX@FDIC.gov using the secure message center at https://securemail.fdic.gov. Should you have any questions, please contact Case Manager XXXXXXX at XXXXXXX or at XXXXXXX.

Sincerely,

Timothy D. Rich
Regional Director

cc: XXXXXXX