Correct. The OCC cannot make law but only interprets the laws Congress writes or issues regulations when Congress grants them specific authority to do so. In a way, the OCC coming out and saying it this way is better right now since it implies that any banks that have been doing this were not breaking the law.
Correct
Banks will move slow but I'm already seeing some start to inquire about testing possible custody offerings. You'll see the fintech companies move in first, perhaps getting the new payments charter. There will be lots of push back here. Entrenched national banks, state chartered banks, and state regulators (who are dependent on fees) will view this as a threat. Thankfully the OCC does not appear to care and would rather open up competition. I'd expect to see the OCC move in further by perhaps allowing trading or encouraging the development of bank issued stablecoins.