SR 25-4 Ends Prior Fed Control Over Bank Crypto Moves

The Fed is turning a page in crypto regulation. By canceling two major directives imposed on banks since 2022 and 2023, the American institution is reshuffling the cards of crypto supervision. Its new line, embodied by letter SR 25-4, abandons the prior reporting requirement in favor of autonomous risk management. This is a discreet but strategic repositioning in a context where regulatory pressure is intensifying and where the fault lines between financial innovation and institutional control are becoming increasingly visible.

A regulatory change of course

The U.S. Federal Reserve officially canceled on April 24, 2025, the supervisory letters SR 22-6 and SR 23-8, two key documents that until now governed how banks had to manage their crypto-related activities.

These directives required financial institutions to notify the Fed of any present or future involvement in crypto-related activities. Indeed, this prior notification requirement is now lifted.

The new direction is now embodied by supervisory letter SR 25-4. This letter :

• Replaces the previous directives SR 22-6 and SR 23-8 ;
• Removes the obligation to notify any crypto activity in advance ;
• Strengthens requirements for internal risk management ;
• Specifies that banks must operate in a “safe and sound” manner ;
• Demands compliance with applicable laws and regulations.

This change marks a turning point in the Fed’s supervision of cryptos, which moves away from a prior validation logic to an approach focused on internal governance and the accountability of financial institutions.

A new interpretation of risk

Beyond the removal of prior notification requirements, letter SR 25-4 introduces a strategic redirection in risk management. The preferred approach no longer relies on centralized supervision of each crypto project by the Fed, but on greater delegation to banks’ internal control systems.

These institutions are now responsible for demonstrating that they understand the risks associated with cryptos and that they have the appropriate means to mitigate them.

Under this new framework, the Fed no longer engages in systematic prior monitoring. Instead, it specifies that banks must perform continuous self-assessment, taking into account the “operational, legal, liquidity, and reputational risks” specific to these technologies. This refocusing on internal governance implies a significant attitude change in the relationship between financial institutions and their supervisor.

This regulatory realignment raises questions about how banks will adapt their practices and the stability of the framework in the medium term. While this approach is perceived by some as a form of easing, it also shifts more responsibility to financial institutions. In a still evolving legal environment and where Congress’s crypto initiatives struggle to progress, this evolution could mark a step toward more technical and less political supervision, but also stricter autonomous compliance. The coming months will determine whether this new framework can achieve the balance between innovation and security that American regulators seek.