Part 2: What Can Credit Unions Actually Do With Digital Assets?
This article is Part 2 of our series examining the legal, regulatory, and governance considerations surrounding credit unions’ involvement with digital assets. For an overview of why digital assets have become an immediate issue for credit union boards and management, read Part 1: Digital Assets and Credit Unions: Why This Is Now a Legal and Governance Issue.
| LEGAL FOCUS This article is educational and intended to frame the legal and governance issues credit unions should evaluate with counsel based on charter, state law, product structure, and current regulatory guidance. |
“Digital assets” is not a single activity. A credit union that introduces members to a third-party trading platform presents a different legal question from one that wants to custody cryptocurrency, use blockchain infrastructure, invest through a CUSO, or participate in a stablecoin issuer. The legal analysis begins by defining the activity precisely.”
Start With the Activity, Not the Technology
One of the easiest ways to create confusion in a digital-asset discussion is to ask whether a credit union can “offer crypto.”
That phrase can describe several legally distinct arrangements. The institution might merely provide an access point to a third-party provider. It might seek to custody assets. It might use distributed ledger technology behind the scenes for a traditional financial function. It might make an investment connected to a permitted payment stablecoin issuer. Each structure raises a different authority and risk analysis.
The National Credit Union Administration’s (NCUA) digital-asset guidance is useful precisely because it separates those concepts. Rather than treating blockchain or cryptocurrency as categorically permissible or impermissible, the agency repeatedly directs credit unions to determine whether the underlying activity is authorized and then evaluate the technology and risk profile.
Third-Party Member Access Is Permissible Under Defined Conditions
In Letter 21-CU-16, NCUA stated that federally insured credit unions may establish relationships with third-party providers that allow members to buy, sell, and hold uninsured digital assets with the third party outside the credit union. The agency emphasized that these are third-party services: the digital assets are not shares of the credit union, are not insured by the National Credit Union Share Insurance Fund, and remain outside the credit union.
For a federal credit union, NCUA identified authority to provide members access to third-party services in connection with the credit union’s business. For a federally insured state-chartered credit union, the institution must separately analyze authority under applicable state law. In either case, the relationship remains subject to due diligence, risk assessment, planning, member communications, and ongoing vendor oversight.
This means a credit union can potentially create a member-facing digital-asset experience without becoming the custodian or principal counterparty. But the legal structure must match the operational reality. Marketing, user interfaces, disclosures, data flows, and contracts should make clear which entity provides the digital-asset service and which entity bears the relevant obligations.
Custody Is a Different Question
NCUA’s current share-insurance FAQs state that federal credit unions are not authorized to serve as custodians for cryptocurrencies and other digital assets. That is a materially different position from NCUA’s treatment of third-party access arrangements. A federal credit union therefore should not assume that authority to partner with a digital-asset provider implies authority to hold members’ digital assets itself.
Federally insured state-chartered credit unions require a state-specific analysis. NCUA notes that state-chartered institutions may have authority to conduct custody activity depending on state law and regulation, provided the activity can be conducted safely, soundly, and in compliance with applicable requirements.
This is a recurring lesson in digital-asset structuring: labels are less important than control. Recent legislative proposals have similarly focused on whether a provider exercises unilateral and independent control over users’ assets. Counsel and management should identify who holds the private keys, who has legal or practical control over the asset, whose books reflect the asset, who executes transfers, and what happens in insolvency or operational failure.
Using Blockchain Technology Is Not the Same as Offering Cryptocurrency
Letter 22-CU-07 makes a separate point that is easy to overlook: NCUA does not prohibit federally insured credit unions from using distributed ledger technology (DLT) as underlying infrastructure for permissible activities. DLT can therefore be evaluated as a technology layer rather than as an investment product.
The agency’s framework is sequential. First, determine whether the activity itself is permissible. Second, evaluate the risks associated with using DLT to perform that activity. NCUA identifies information security, privacy, recordkeeping, BSA/AML, fraud protection, smart-contract governance, third-party risk, strategic risk, reputation risk, and liquidity risk among the considerations that may apply. Depending on the proposed activity, the institution may also need to assess whether its provider maintains an appropriately designed AML compliance program for digital-asset businesses.
A credit union evaluating tokenized records, blockchain-based settlement, or smart-contract automation should therefore resist the temptation to treat “blockchain” as the legal issue. The legal issue is what function the system performs, who bears responsibility for that function, and whether the institution can satisfy the same regulatory obligations that would apply if the function were performed through conventional infrastructure.
Stablecoin Issuance Creates a New Category
The GENIUS Act establishes a federal framework for permitted payment stablecoin issuers and gives NCUA a role in licensing and supervising certain issuers connected to federally insured credit unions. NCUA’s 2026 proposals contemplate entities seeking NCUA approval in connection with investments by federally insured credit unions and establish proposed operational and risk-management standards for NCUA-licensed issuers.
This is not the same as a credit union simply allowing a member to purchase a stablecoin through an outside provider. Issuance implicates a dedicated statutory regime involving reserves, redemption, supervision, Bank Secrecy Act treatment, and other issuer-specific requirements. Credit unions considering an issuer-related structure should treat it as a specialized regulatory project, not as an extension of a general digital-asset vendor relationship.
A Better Internal Classification Framework
Before management asks for approval of any digital-asset initiative, the proposal should be placed into a defined category. At minimum, the institution should distinguish:
(1) member access to a third-party provider;
(2) custody or control of digital assets;
(3) use of DLT for an otherwise traditional credit-union function;
(4) investment or CUSO activity;
(5) stablecoin issuance or participation in an issuer structure; and
(6) ordinary banking or account services provided to a digital-asset business.
Each category should trigger its own authority analysis, compliance review, vendor review, and board-level risk discussion. The value of this approach is that it prevents a broad “crypto policy” from substituting for the specific legal analysis the activity actually requires.
In Part 3, Digital Assets and Credit Union BSA/AML Compliance: The Risk Exists Even Without a Crypto Product, we will examine why digital-asset activity can create compliance exposure even when a credit union does not directly offer a crypto product. If you missed it, read Part 1: Digital Assets and Credit Unions: Why This Is Now a Legal and Governance Issue.
Legal Sources & References
Primary and regulator sources used for this draft:
• NCUA FAQs About Share Insurance
• NCUA, Financial Technology and Digital Assets
• GENIUS Act, Pub. L. No. 119-27
Editorial note: This blog reflects publicly available federal law and NCUA materials reviewed through September 11, 2026. State-chartered credit unions require additional state-law analysis, and proposed rules or pending legislation should be checked again immediately before publication.
