Building (and Dismantling) On-Chain Custody: Lessons From Vast Bank's 2021 Crypto Play

In late 2021, Vast Bank, a regional bank operating throughout Northeast Oklahoma, launched a digital asset custody service for its customers. Helmed at the time by CEO Brad Scrivner, the bank allowed its customers to buy and sell digital assets right beside their traditional checking accounts. It was a bold move for a small bank, and it piqued the interest of the OCC, which subsequently led to the roll back of the service. In this fireside chat, hear from Scrivner, now the Tulsa Market President at First Fidelity Bank, about his time at Vast Bank deploying the custody solution, and what that experience taught him about integration, operational risk and the regulatory landscape as it relates to integrating crypto into TradFi.

Transcription: 
Transcripts are generated using a combination of speech recognition software and human transcribers, and may contain errors. Please check the corresponding audio for the authoritative record. 

Penny Crosman (00:14):
Good afternoon. I'm Penny Crosman, executive editor of technology at American Banker. From about 2020 to 2023, we had kind of a regulatory glasnost in the realm of banks doing something with digital assets, cryptocurrency custody, stablecoin payments, and things of that nature. This opened a door for many banks to start thinking about and building services. JPMorgan Chase, for instance, launched Onyx, which is a division for blockchain-based products. ¹ They began providing banking services to crypto exchanges like Coinbase and Gemini. ² Several banks started working with a company called NYDIG that had partnerships with core providers like Fiserv to let banks allow their customers to buy and sell Bitcoin through their bank accounts. ³ One of the banks that was part of this movement was Vast Bank in Tulsa, Oklahoma, which partnered with Coinbase and SAP. ⁴ We're going to hear from our next speaker about how it all happened and how they built that out.

(01:21):
But as our next speaker, Brad Scrivner, will explain, that window of opportunity was slammed shut after the FTX collapse, and the regulators told all of these banks to shut down their crypto activities. Brad Scrivner, in 2021 and during a lot of that period, was CEO of Vast Bank. He was a pioneer in offering crypto services to customers. He was also part of the group that had their crypto services shut down in the wake of FTX. We are really grateful to Brad for coming here and sharing his experiences because these are not particularly happy memories. Today, Brad is Tulsa market president at First Fidelity Bank, but today he's not officially representing Vast Bank or First Fidelity Bank. He's just sharing his own recollections of his experience so that others can get a sense of what that was like and what some of the considerations are for offering crypto services. Thank you, Brad, very much for joining us.

Brad Scrivner (02:40):
Thanks, Penny. It's great to be here.

Penny Crosman (02:43):
For you, I think this started with a core conversion in 2017. Can you tell a little bit about how you made that decision to do a core upgrade and what you were hoping that would do for you?

Brad Scrivner (02:58):
I became the president and CEO in 2012 of what was Valley National Bank. At the time, we ended up rebranding to Vast Bank. As we got into 2015 and 2016, we were able to really start building the team after a merger that we had done with another family-owned bank. We asked, "What is it that we think in terms of serving customers? What does that look like?" We wanted things like single sources of truth. We wanted the ability to have omnichannel onboarding of customers, being able to have that single view of them so that whether it was online or in a branch, we would be able to onboard them and serve them in the best way that we could. We wanted open banking.

(04:01):
We felt that was important and that it would help customers more moving forward. We wanted modern native cloud, modern connectivity, APIs, and all of that type of stuff. All of those things were in the back of our heads in terms of what it looks like to serve the customer and take care of their needs. As we went through, we evaluated the core technologies everybody would be familiar with, as well as some what I would call modern cores. Ultimately, we decided to go ahead and do an SAP conversion on that. That started in 2018, and we were going to transition over time. We decided on SAP and I believe it was probably June of 2018 when we started that.

Penny Crosman (05:14):
So SAP basically was able to fulfill all those different things that you wanted. That was part of your decision.

Brad Scrivner (05:22):
That was part of the decision. Obviously, there are lessons learned and we'll get to those, but that was part of the decision and the timeframe.

Penny Crosman (05:34):
What got you interested in offering crypto services? Were you seeing customers pull their money out and go to Coinbase or Kraken? Were you aware of your customers investing in or buying digital assets?

Brad Scrivner (05:56):

The core conversion and the SAP platform opened up some capabilities for us. In December of 2018, going into 2019, we started our first Fintech partnership, which allowed us to open accounts online on a national basis and completely onboard that customer in five to 10 minutes. Then in July of 2020, the OCC came out with Brian Brooks' announcement. It was interpretive letter 1170, which clarified that national banks could custody digital assets. ⁵ Knowing what I described regarding our core conversion and the Fintech partnership we had, I called our chairman and said, "Hey, we have the ability with this platform to be able to serve customers in this space." If you recall, there were a lot of trust issues with customers.

(07:23):
When I say customers, I'm broadly talking about people that had invested in digital assets. There were customers out there that had forgotten their passwords and had lost millions or tens of millions of dollars in digital assets held in private wallets. You had typical estate planning issues in terms of transfer of those assets. Not to mention, they had "wrench attacks," where someone aware that you have digital assets knocks you over the head and tries to get your passwords to steal those things. These are all spaces where banks have traditionally been able to operate to serve customers.

(08:28):
There was a huge need. Knowing our core conversion process and the limitations other cores had, compared to what we had available on SAP, we said, "Look, we've got the internal capabilities, we've got this marketplace out here that is not being served, and custody is a traditional space that banks have done well." That's how we got involved.

Penny Crosman (09:10):
So you felt customers were looking for a more trusted, more secure place to put their assets?

Brad Scrivner (09:16):
Typical banking type of things. There were other services that would come off of that. You had folks that had a lot of net worth tied up in digital assets. We anticipated—and the regulators have now made this available in terms of Fannie and Freddie looking at digital assets as part of your personal statement—that helping people start monetizing that could be an opportunity for lending. Using digital assets as collateral is a typical custody space. Banks are used to volatile assets; we have lent into oil and gas and other volatile industries.

(10:22):
If you were able to start doing it using smart contracts and perfecting on those, all of that was in mind. We felt we would have a head start because of the decisions we had made back in 2016, 2017, and 2018 to go down this more modern core path.

Penny Crosman (10:56):
How did you choose Coinbase as a crypto exchange partner?

Brad Scrivner (11:02):
That was an introduction from one of our Fintech partners. They were planning to offer crypto services as part of their offering. Once that July 2020 Brian Brooks letter came out, I contacted them and said, "We think we have the ability to work with you and potentially Coinbase to do that." Coinbase was obviously very large and had a broad offering of digital assets.

Penny Crosman (11:51):
Once you decided to do this and your board gave you their blessing, how much work was involved to make all this happen? I think you developed a new app for Vast customers to buy and sell crypto. How much work was it to get the proper integrations with Coinbase and SAP?

Brad Scrivner (12:19):
If anybody on my team is listening, they did Yeoman's work. Having API connectivity and doing all of the real-time processing—getting pricing, making investment decisions on how assets are bought, sold, and settled—there was a lot that went into that. We developed a mobile app that gave you the ability to seamlessly open your bank account and your Coinbase account with a single onboarding. The seamlessness was such that you could be at the gas station, sell your crypto assets, and then swipe your debit card to pay for your gas at the pump.

(13:44):
That is the level of integration we brought together, and it worked very well. It was a mobile app that could do complete onboarding and funding. Anybody doing national digital banking knows that fraud and synthetic ID are issues you have to work through, and we experienced those. But in terms of the way it functioned, it was a single app, whereas moving money back and forth between a Coinbase account and a bank account used to take several days.

Penny Crosman (14:36):
I could see how that would take a lot of integration to get that to work in real time, and that does seem pioneering. Did you have any concern about the volatility of cryptocurrency and the fact that one day it could be down by 20% or more, causing customers to blame you?

Brad Scrivner (15:05):
I'll say no to that last part. That was naive on our part in terms of customers blaming us for that. But everything we were doing was focused on serving customers. Custody is nothing more than a digital safe deposit box. Any banker familiar with safe deposit boxes knows that we don't know what's in them. We know that for some reason you value whatever is put in there, whether it's a watch or a birthday card. It's not the bank's job to determine what is valuable to you. Our job was to make sure you had a safe place to do what you wanted to do with your assets.

(16:10):
If part of that was converting from USD to a digital asset, it was nothing more than safekeeping of your asset. That's how we viewed it.

Penny Crosman (16:31):
How did customers react? How was adoption and usage when you rolled this out?

Brad Scrivner (16:37):
Setting aside the synthetic IDs and fraudsters that tried to game the system, we had customers open accounts from all 50 states. We had tens of thousands of customers. Now, did we hit our projections? No, we didn't. Some of the capabilities we wanted to roll out became more difficult based upon the regulatory environment and the non-objection letters that came out. In addition, we chose to launch with a retail offering because of our Fintech relationship. The fact is, our bank was not really a national retail digital player.

(17:44):
That was one of the reasons we decided to go with a Fintech partnership that had more expertise there. Our intention was to really focus on the custody space for institutions because that's more of a B2B offering where we felt we had better expertise. Getting a banker eyeball-to-eyeball with a client and providing the technology is a well-known play. The retail launch was to plant the flag as the first national bank to bring forward that seamless offering between the bank and a Coinbase account.

Penny Crosman (18:38):
You mentioned synthetic IDs. Do you think rolling this out publicly attracted fraudsters? Did you have to put extra measures in place to detect and deter them?

Brad Scrivner (19:02):
Yes, all of the above. Fraudsters are very creative; they try to find every single loophole. If you offer account-to-account transfers, they are there probing for every weakness. These are real threats banks have to deal with. Since that wasn't within our traditional realm of expertise, those were lessons learned. We beefed up our staff. We had an amazing chief risk officer who did some fantastic things. We brought in consultants to help. We continued to upgrade, protect, and learn things that banks do all the time.

Penny Crosman (20:10):
How did you decide which cryptocurrencies you were going to offer through the app?

Brad Scrivner (20:17):
At the time, Gary Gensler was the SEC chairman. He had made statements regarding digital assets and whether they were securities or not. Certainly, there was a legal test—the Howey test and perhaps the Reves test. When we looked at it, we had our Fintech partner asking about particular crypto assets and customers asking us things. We would look at whether Coinbase offered them. Then we would talk to our legal team for an initial review to see, at a high level, if it passed those broad tests as to whether it was a security or not. We did not want to get involved with securities laws.

Penny Crosman (21:39):
What was your relationship and what were your conversations like with regulators throughout this process?

Brad Scrivner (21:58):
I think we had a very good relationship with our regulators. Since 2012, we were always transparent. We proved we would do the right things from a community banking standpoint. We were transparent with them starting in 2015, 2016, and 2017 as our strategy was developing regarding the core migration, core modernization, Fintech partnerships, and the digital asset components. I would describe the regulatory environment as supportive. I think there was a recognition that our strategy was higher risk, but we were talking about real threats to banks that many boards and bankers weren't discussing.

(23:19):
We were making decisions about what we thought the future of banking looked like. Then you had the interpretive letter come out in 2020 with Brian Brooks. I think there was support there. "Non-objection" is perhaps the better language to use with a regulator. But I also want to say that regulators have a very difficult job with this broad mandate for safety and soundness. How do you do that well in an innovative environment where your exam manuals and procedures don't cover these new things, and there isn't a lot of experience as to what the full risk is?

(24:41):
This is going to be a never-ending thing. With AI and new stablecoins, innovation is difficult for regulators to handle.

(25:08):
Then, in 2021 and 2022, you started to see things happening. In the second half of 2022, Silvergate popped up. In early 2023, you had Signature Bank and Silicon Valley Bank.

Penny Crosman (25:48):
Signature Bank in New York.

Brad Scrivner (25:50):
You had Signature Bank and all those things popping up. As you went into 2023, you had net interest margin compression impacting traditional bank business across the board. Now you have uncertainty at the OCC related to these things. They are looking at liquidity issues, bank runs, and decreasing margins. Those three big names that failed had common components: they were tech-forward and digital asset friendly. It's probably natural that regulators started projecting some of those fears onto other banks involved in similar things.

(27:03):
Because your margins are decreasing and you are tech-forward in digital assets, there is a potential for liquidity issues and bank runs. Within the context of a difficult regulator job regarding safety and soundness, that is a fair way to describe what happened. Maybe those of us that were pioneers got shot. I don't know how else to say it.

Penny Crosman (27:54):
It's interesting that you show empathy for the regulators. It does seem like there was an industry-wide shutdown. Some bankers told me their projects were put on ice; some said regulators told them, "No, you're not doing this anymore." The FDIC sent "pause" letters to some banks. ⁶ It seems everyone was told behind the scenes to stop. I'm sure that was painful after putting so much time and effort into these projects. What do you feel you've learned?

Brad Scrivner (28:53):
The board and executive team always recognize that there's a regulatory component to risk. But even if you have a low-probability event that is an existential threat from a regulatory perspective—safety and soundness is very broad—you have to recognize that. All of those external factors I described came together and impacted us in an existential way. That's one thing. I described a bunch of our strategic initiatives. It's one thing to have a list of five strategic initiatives, but the things I described were big.

(30:11):
Focusing in a smaller way to begin with on one big initiative might be better. If we had just done the core migration project and ignored other things for several years, that was a big enough project on its own. You have to look back at the film. Regarding the core banking decision, back in 2016 to 2018, the big three core providers have done a lot to try and open up their cores. For commoditized technology, like calculating interest on an account, using a technology provider for those aspects would have been our decision knowing what I know today. Then for those areas where you can add value, look at the ability to do the API connectivity and real-time processing.

(31:29):
From a resource perspective, we took a "build it as you go" approach, paying for things out of earnings and capitalization. We felt that if we were successful raising capital, it would lead to less dilution for the owners. Having excess capital makes a lot of sense with regulators because that is a strong mitigant.

(32:47):
Having capital upfront and getting the right people on board early helps you avoid mistakes. It may be more expensive getting those assets upfront, but it becomes less expensive because they have the experience. I also think software development is a specific category within the OCC. Given the big projects we were doing that involved software development, that put us in a different category with regulators. To the extent we were going to develop anything, doing it in a smaller way as enhancements to a modern core would be the way. Hopefully, this hasn't become a therapy session.

Penny Crosman (34:16):
The other side is that you were trying to get a first-mover advantage and stay relevant. A lot of banks feel pressure to do something as more people invest in cryptocurrency and go elsewhere. One estimate was that two or three trillion in deposits would leave banks for crypto exchanges. There is an existential threat of not staying relevant if you don't offer what people want. Now we are entering a new phase where regulators are again opening the door to banks doing more with crypto. Some Fed governors have suggested banks should have the right to do these things. You have the Lummis-Gillibrand bill, which would address stablecoins. ⁷ In a recent survey, 4% of our readers said they are already offering or piloting digital wallets or custody, 11% plan to within 12 months, and 31% are in discussion. Do you have advice for them?

Brad Scrivner (36:33):
I firmly believe that every bank has its story. When you go through strategic planning, you have your internal capabilities, your perception of customer needs, your value prop, and your monetization plan. As you go through that process, your SWOT analysis becomes your answer. Perhaps it needs to be a more frequent planning process during times of uncertainty where you address those opportunities and threats in a very real way with your board and executive team.

(37:34):
Innovation, rapid change, changes in technology, customer preferences, and regulatory environments are just standard fare. If you are waiting for an environment where you can get to some status quo, that's not a realistic view of how the world operates today. Everybody has a unique value proposition or way they want to serve their customers. Focus on those things, and do it in small chunks where you can prove success in a faster way. Be aware of external threats, include them in your strategic analysis, and go for it.

(38:52):
Customers want to be served. Bankers are good people who want to serve their communities and protect their customers. Have the conversations and go for it.

Penny Crosman (39:12):
Brad Scrivner, you've been very honest and I really appreciate you sharing these recollections. It's valuable for people starting fresh to hear from someone who's been through the whole process. Thank you for joining us today.

Brad Scrivner (39:38):
Thanks, Penny. I appreciate it.