Compliance First: Why the Path to a De Novo Trust Charter Runs Through Your Compliance Program

The national trust bank charter has become one of the most sought-after licenses in financial services. Digital asset custodians, payments firms, wealth platforms and established fintechs are all in line at the Office of the Comptroller of the Currency (OCC), drawn by a federal charter, a single national regulator and the credibility that comes with both.

The OCC has made clear that it is open to these applications, and it has approved a wave of new trust charters. Its approach to approvals also makes clear what it expects in return. Charter approvals typically come with conditions, including a requirement that the bank operate a program for compliance with the Bank Secrecy Act, OFAC sanctions and other applicable laws, and the OCC reviews the bank’s key executives, including its chief compliance officer and BSA officer, before it opens.

The message for every applicant is the same. Compliance is not a workstream to finish after the business plan is written. It is the lens through which the regulator reads everything else.

Why compliance carries so much weight

A de novo trust bank asks the OCC to approve an institution that does not yet exist. There is no exam history, no audit trail and no record of how management handles a hard call. The regulator has only the application, the people behind it and the plans they describe. In practice, the OCC reads the compliance program as a proxy for management quality. A thin or generic program signals that leadership has not yet thought through how the bank will operate. A program built around the bank’s actual risks signals the opposite.

Four features of the trust charter raise the stakes further:

• The business is fiduciary by design. A national trust bank’s activities center on fiduciary services such as custody, trust administration and asset management. Fiduciary duties under 12 CFR Part 9 bring their own compliance requirements, from account acceptance and investment review to conflicts of interest and recordkeeping.
• Most national trust banks are uninsured. Without FDIC insurance behind client relationships, the OCC looks harder at governance, controls and the bank’s ability to protect client assets.
• The models are new. Many applicants custody digital assets, process payments or serve fintech platforms. The OCC must be satisfied that risk management keeps pace with products it has less history supervising.
• The bank depends on others. Applicants often rely on a parent company, affiliates and technology vendors for core functions. The regulator will judge the program the bank actually depends on, wherever it sits.

Financial crime is front and center

Of all the compliance areas in an application, financial crime draws the closest scrutiny. A national trust bank is a “bank” under the Bank Secrecy Act. It needs a full BSA/AML program, a sanctions compliance program and the systems to support both from the first day it opens.

The business models now seeking trust charters sit squarely in higher-risk territory. Digital asset custody, cross-border payments, stablecoin reserves and platform banking all create money laundering and sanctions exposures that a traditional trust company rarely faced. The OCC expects applicants to show they understand those exposures in detail, not just list the regulations that apply.

Reliance on affiliates is a design decision, and it should be made early. Many applicants are new subsidiaries that could draw on a parent or sister company for compliance, risk management and financial crime services. Decide which functions the bank will own and which it will rely on others to perform, and document how the bank will oversee them. If the bank will use an affiliate’s monitoring systems, investigators or sanctions screening, those functions are part of the application, and the OCC will expect them to meet the same standards as the bank’s own.

A compliance-first approach to the application

The applicants who move through the process most smoothly treat compliance as a design input from the start. In our experience, that comes down to six principles.

1. Start with the risk assessment. Before writing a single policy, map the products, customers, geographies, delivery channels and counterparties the bank will have. That assessment should drive the business plan, the staffing plan and the control design. Regulators can tell when it was written afterward to justify decisions already made.
2. Build the program for this bank, not a generic one. Policies borrowed from a parent company or a template rarely fit a fiduciary institution with a narrow, novel business. The OCC wants to see controls tied to the specific risks the risk assessment identified.
3. Hire leadership early and give it authority. The BSA officer and chief compliance officer are central to the OCC’s view of management. Name qualified people before filing where possible, show they have relevant experience, and show they will have the independence, resources and board access to do the job.
4. Be clear about reliance on affiliates and vendors. Document which functions the parent, affiliates or third parties will perform, under what agreements, with what oversight and with what exit plan. Where those arrangements need strengthening, say so and show how it will happen.
5. Show the technology works. Transaction monitoring, sanctions screening, blockchain analytics and case management should be selected, tuned and tested against the bank’s expected activity. Describe how data flows between systems and who owns it.
6. Plan for year one, not just approval day. Conditional approvals typically require OCC sign-off on significant changes to the operating plan during the bank’s first three years. Build the testing, independent review, board reporting and staffing plans that will keep the program meeting expectations once the bank is open.

Engage with the OCC early, and keep engaging

The pre-filing meeting is an opportunity to test the business model and the compliance approach before the formal application, and to learn what examiners will focus on. It should be the start of a conversation, not a one-time event.

That ongoing engagement should include regular updates on the compliance and financial crime programs and on the progress toward making them OCC ready. Useful updates cover key hires and open roles, policies and procedures completed, systems selected, implemented and tested, the status of the risk assessment, and any changes in the services the bank will rely on from affiliates or vendors. Gaps reported early, with a credible plan to close them, build far more confidence than gaps the OCC discovers on its own.

This matters even for the fastest-moving fintechs. An OCC-ready compliance program takes time to build: hiring experienced compliance and BSA leadership, tailoring policies to a fiduciary business, and tuning monitoring and screening systems against real activity all take months. The OCC will want to see that progress is being made throughout, including before conditional approval. An applicant that goes quiet while the application is under review leaves the regulator to wonder whether the work is getting done.

Common mistakes we see

• Treating compliance as a filing exhibit. A policy binder attached to the application is not a program. The OCC looks for evidence the program will operate.
• Underestimating fiduciary compliance. Founders from payments or crypto backgrounds often focus on BSA/AML and overlook the Part 9 requirements that define a trust bank.
• Assuming an existing program will fit. A program built for a money transmitter, a broker-dealer or an overseas entity was designed for different rules and a different regulator. It needs to be tailored to a US fiduciary bank, not just relabeled.
• Leaving key hires until after approval. An application with an unnamed or under-resourced BSA officer invites doubts about commitment and capacity.
• Ignoring dependencies outside the bank’s control. A plan that depends on direct access to a Federal Reserve master account should show how the bank will operate without one. Reserve Banks have broad discretion over access for uninsured institutions, decisions can take a long time, and the Fed is still reworking its framework. Compliance plans should account for each realistic path.

Where to go from here

A trust charter application succeeds or fails on the regulator’s confidence that the bank will operate safely, soundly and in compliance with the law. For a de novo institution, the compliance program is where that confidence is earned or lost. Building it first, building it for the bank’s real risks and being clear about what the bank depends on is the surest path from pre-filing to opening day.

This article is the first in a Reynolds Advisory series on building and running compliance programs for de novo trust banks. Upcoming articles will cover charter alternatives, each phase of the application, BSA/AML and fiduciary compliance, reliance on affiliates and third parties, the first year of operations, and the GENIUS Act.

Reynolds Advisory helps applicants design, document and stand up compliance programs that hold up to regulatory review. To discuss your application, contact us.

← All insights