NYDFS

Subscribe to NYDFS

Demand for virtual currency services, including custody services, has soared in the past several years.  Like their counterparts in traditional finance, these custodians are stewards of retail and institutional customer funds and serve an important and valuable function.  However, as evidenced by a number of headline-grabbing failures during the lingering crypto winter, inadequate disclosures and poor custodial practices can seriously harm retail and institutional customers alike.  For many virtual currency customers, this recognition – in an industry built on the pillars of trust and transparency – was realized too late.  Recent disclosures emerging from notable bankruptcies involving crypto companies have led to allegations of fraud and mismanagement in connection with custodial services.  These allegations strike at the very core of the custodial relationship, and have had repercussions throughout the crypto industry.

Seemingly in direct response to these developments, on January 23, 2023, the New York Department of Financial Services (“NYDFS”) issued industry guidance to Virtual Currency Entities (“VCEs”) who act as custodians (“VCE Custodians”).  Entitled “Guidance on Custodial Structures for Customer Protection in the Event of Insolvency” (the “Guidance”), the Department emphasized the “paramount importance of equitable and beneficial interests always remaining with the customer” and reminded covered institutions of their obligations in connection with “sound custody and disclosure practices in the event of an insolvency” or similar proceeding.

The Guidance comes on the heels of developments in two high-profile insolvency proceedings: (1) the FTX proceedings, where, among others, the SEC has alleged co-founder Samuel Bankman-Fried concealed the diversion of FTX customer funds to the co-founder’s private crypto hedge fund, and (2) the Celsius proceedings, where the chief judge for the United States Bankruptcy Court for the Southern District of New York issued a decision holding that Celsius’ Terms of Use made clear that customer deposits into Earn Accounts became Celsius’ property at the time of deposit, such that the digital assets now constitute property of the debtors’ bankruptcy estate.  In Celsius, customers argued that the deposits in the Earn Accounts were held by Celsius as a custodian, but the court found that the plain language of the Terms of Use made clear that ownership interest had passed to the debtors.

At a time when states are jockeying for position to become digital asset and cryptocurrency hubs and we’ve witnessed turmoil and regulatory uncertainty within the cryptoasset industry, the New York Department of Financial Services (“NYDFS”) on December 15, 2022 released its final Guidance (the “Guidance”) to banking organizations seeking to engage in “new or significantly different” virtual currency-related activities. As stated in the Guidance, “virtual currency-related activity” includes all “virtual currency business activity,” as defined under the BitLicense regulation (23 NYCRR § 200.2(q)), as well as “the direct or indirect offering or performance of any other product, service, or activity involving virtual currency that may raise safety and soundness concerns for the Covered Institution or that may expose New York customers of the Covered Institution or other users of the product or service to risk of harm.” At a high level, the Guidance reminds state-regulated banks (“Covered Institutions”) that, as a “matter of safety and soundness,” they must apply for approval before engaging in digital asset-related activities and outlines the types of information the NYDFS deems most relevant in assessing a proposal and the potential risks that such virtual currency-related activities may pose for the institution, consumers and the market in general (note: The Guidance expressly states that it does not interpret existing laws nor take a position on the sorts of activities that may be permissible for Covered Institutions to take).

Notably, the Guidance further increases the scope of NYDFS oversight by expanding the types of virtual currency activity requiring approval: “virtual currency-related activities” must receive approval, whereas previously only “virtual currency business activity” required prior approval from the NYDFS.  In a footnote, the Guidance explains the difference – virtual currency-related activity” essentially means any “virtual currency business activity” as defined under the BitLicense rules, plus certain additional activities that the NYDFS believes might raise “safe and soundness concerns.”

In what is the New York Department of Financial Services’ (NYDFS) first enforcement action against a NYDFS-licensed “virtual currency business,” on August 1, 2022, the agency announced $30 million settlement with cryptocurrency investing platform Robinhood Crypto, LLC (“RHC”).  The settlement addressed  charges stemming from what the NYDFS cited as various deficiencies during 2019-20 of RHC’s Bank Secrecy Act (BSA) and anti-money laundering (AML) program and RHS’ cybersecurity obligations under the agency’s Virtual Currency “BitLicense” regulation (23 NYCRR Part 200) and Cybersecurity Regulation (23 NYCRR Part 500), among other things

NYDFS has been active in crypto regulation for many years. In 2015, New York was the first state to promulgate a comprehensive framework for regulating virtual currency-related businesses. The keystones of the BitLicense regulations are consumer protection, anti-money laundering compliance and cybersecurity rules that are intended to place appropriate “guardrails” around the industry while allowing innovation. In addition, NYDFS’s Cybersecurity Regulation went into effect in March 2017 and generally requires all covered entities, including licensed virtual currency businesses, to establish and maintain a cybersecurity program designed to protect the confidentiality, integrity, and availability of its information systems. Licensed virtual currency companies are subject to the same AML and cybersecurity regulations as traditional financial services companies.

There have been a number of developments swirling around stablecoins in the past month, including, earlier this week, the recent introduction in the U.S. Senate of a bill (the “Responsible Financial Innovation Act”) that would put in place a regulatory framework for digital assets and enact certain requirements and consumer protections surrounding stablecoins. The topic of stablecoins’ utility and risk has been in the headlines and on the minds of both legislators and state and federal financial regulators. In a timely move, the New York Department of Financial Services (NYDFS), released its “Guidance on the Issuance of U.S. Dollar-Backed Stablecoins” meant to set foundational criteria for USD-backed stablecoins issued by DFS-regulated entities on the issues of redeemability, assets reserves and attestations about such reserves. The NYDFS is the first state regulator to release such guidance. With the fate of Congressional action on stablecoins this year uncertain (and equally uncertain whether federal agencies or banking regulators will step in to offer certain guardrails), it will likely be left to the states (and the industry itself) to establish certain baselines that offer consumer protection and stability without harming innovation. Given NYDFS’s experience in the virtual currency space and its prominence, its latest guidance may be influential to other regulators around the country. 

New York State has taken measures this year to modernize its approach to regulation for blockchain-based companies. Even before Assembly Bill A8783B established a government task force to study the effects of blockchain and digital assets on financial markets in the state, in October, the New York State Department of Financial Services (“NYSDFS”) announced that it would allow companies engaged in “virtual currency business activity” (as defined in the New York State “BitLicense” requirements) to utilize the Nationwide Multistate Licensing System and Registry (“NMLS”) to apply for, update, and renew their operating licenses, including BitLicenses. The NMLS was created in 2008 by the Conference of State Bank Supervisors to act as a central licensing repository and has expanded over the past decade from servicing non-bank mortgage companies to including a variety of non-bank firms. The system is intended to allow for enhanced supervision, as license applications and registrations can be managed by a number of governmental agencies through NMLS. In addition to businesses engaged in virtual currency business activity, other nonbank financial institutions currently under the oversight of the NMLS platform include licensed check cashing companies, budget planners, sales finance agencies, money transmitter licensees, and mortgage providers.

On June 14, 2018, the New York State Department of Financial Services (the “DFS”) announced that the agency granted a virtual currency license (or “BitLicense”) to bitcoin wallet and vault provider Xapo, Inc., and authorized the blockchain financial services company Paxos Trust Company LLC to expand their business to offer exchange and custodial services to cryptoassets beyond bitcoin. Days later, the DFS announced that it had approved the BitLicense application of financial services and mobile payment provider Square, Inc. (which already possessed a state money transmitter license and whose Cash App offers a method to trade bitcoin). These developments followed last month’s approval of Gemini Trust Company to provide additional virtual currency products and services (including custodial services and trading of Zcash, Litecoin and Bitcoin Cash). With the latest approval of Square, the DFS has granted a total of nine virtual currency charters or licenses.

Last July, the Uniform Law Commission completed a uniform model state law, known as the Uniform Regulation of Virtual-Currency Businesses Act (“URVCBA” or the “Act”) (Steve Weise participated in the preparation of the Act).  Currently, state regulation in the virtual currency space is carried out under a patchwork of laws that typically do not directly contemplate virtual currency and blockchain technology. Attempting to bring clarity as to which types of entities require state licensure and also to encourage responsible innovation in this emerging area, the URVCBA provides a statutory framework for the regulation of companies engaging in “virtual-currency business activity.”  After carefully defining which activities fall under the Act’s purview, the uniform law requires covered entities to make the typical financial and business disclosures in its application, and also contains numerous user and consumer protections, including certain enforcement powers by the relevant state authority.

The mission of the Uniform Law Commission is to draft state laws on topics where standardized regulation across state lines is practical (e.g., the Uniform Commercial Code (the “UCC”)). Gaining final approval in 2017, the Act has so far been introduced in Connecticut, Hawaii, and Nebraska.