New York State Proposes "BitLicenses" and Comprehensive Rules for Virtual Currency Firms

Introduction

On July 17, 2014, the New York State Department of Financial Services (NYDFS) released its long-awaited proposed regulations governing virtual currency firms operating in New York or doing business with New York residents. This makes New York the first state to propose a regulatory framework specifically for virtual currencies. The proposed regulations were published in the New York State Register's July 23, 2014 edition, kicking off a 45-day public comment period. Building on our prior discussions of virtual currencies (here, here, and here), this Advisory aims to provide an overview of both the proposed regulatory framework and key implications for virtual currency firms operating in New York.

Background

The most well known virtual currency is Bitcoin, although others, such as Litecoin and Peercoin, operate in a similar fashion. Bitcoin was first introduced by an individual, or group of individuals, using the pseudonym "Satoshi Nakamoto." Bitcoin operates through a decentralized network of computers utilizing complex mathematical algorithms to create a lottery system by which bitcoins are "mined." After bitcoins are mined, they are accounted for in the "Blockchain," which is a large distributed database that reflects every Bitcoin transaction.

Virtual currencies have made a big splash in the news over the last year or so, with several events serving to accelerate a movement toward regulation. In March 2013, the U.S. Treasury Department's Financial Crimes Enforcement Network (FinCEN) issued guidance on the application of the Bank Secrecy Act to virtual currencies, concluding that "exchangers" (those engaged in converting virtual currencies into traditional non-digital or other digital currencies) and "administrators" (those with the power to issue and withdraw virtual currencies) are subject to its regulation, while "users" (who simply obtain and use virtual currencies to purchase goods or services) are not.

In February 2014, Mt. Gox, the then leading Bitcoin exchange responsible for more than 70% of all Bitcoin exchange volume, filed for bankruptcy protection in Japan. In the following month, Mt. Gox filed for Chapter 15 bankruptcy in the United States. The striking collapse of Mt. Gox furthered the call for regulation of virtual currency exchanges.

In the midst of these developments, NYDFS has been engaged in a consultative process on virtual currencies. In August 2013, NYDFS announced that it was launching an inquiry into appropriate regulatory guidelines to apply to virtual currencies. Then, in late January 2014, NYDFS held public hearings to gather information and discuss a potential "BitLicense" regulatory framework. Benjamin M. Lawsky, the Superintendent of Financial Services for the State of New York, emphasized the need to create a stable marketplace for virtual currency firms, through the implementation of regulations that foster both consumer protection and innovation, while rooting out illicit activity, such as money laundering. The recently proposed NYDFS regulations are intended to reflect these principles.

Overview of Proposed Regulations

The NYDFS proposed regulations define "virtual currency" as "any type of digital unit that is used as a medium of exchange or a form of digitally stored value or that is incorporated into payment system technology." The regulations would require BitLicenses for firms engaged in the following virtual currency businesses: receiving or transmitting virtual currency on behalf of consumers; securing, storing, or maintaining custody or control of virtual currency on behalf of customers; performing retail conversion services; buying and selling virtual currency as a customer business (as distinct from personal use); or controlling, administering, or issuing a virtual currency. A license is not required for merchants or consumers that utilize virtual currency solely for the purchase or sale of goods or services, or for firms chartered under the New York Banking Law to conduct exchange services that are approved by NYDFS to engage in virtual currency business activity.

Under the proposed rules, BitLicense holders would be required to comply with standards that are intended to prevent money laundering, ensure consumer protection, and bolster cyber security. Thus, among other things, BitLicense holders would need to:

Anti-Money Laundering

• Maintain a detailed record of each transaction that includes the parties' identities and physical addresses, the value and dates of the transaction, the method of payment used, and a description of the transaction.
• Verify customers' identities when opening customer accounts and check them against the U.S. Treasury Department's Office of Foreign Asset Control's Specially Designated Nationals list. Enhanced diligence would be required for accounts involving foreign entities, and accounts on behalf of foreign shell entities would be prohibited.
• Notify NYDFS of any transactions that might signify illegal or criminal activity and when an individual engages in transactions that exceed US$10,000 in a single day.

Consumer Protection

• To the extent a Licensee stores virtual currency on behalf of a third party, the Licensee would have to hold virtual currency of the same type and amount as that which is owed or obligated to a third party.
• Maintain a bond or trust account (in U.S. dollars) for the benefit of its customers in a form and amount acceptable to NYDFS.
• Provide customers with a receipt for each transaction with information about the firm's name and address, specifics of the transaction, and statements about the Licensee's liability for non-delivery and refund policy.
• Disclose to consumers the material risks associated with virtual currencies, in writing, both in English "and in any other predominant language spoken by the customers of the Licensee."

Cyber Security

• Designate a qualified employee to serve as a Chief Information Security Officer responsible for implementing a cyber security program to identify cyber risks, protect systems from unauthorized access, detect data breaches, and respond to system breaches and unauthorized use.
• Conduct system penetration testing at least annually and vulnerability assessments at least quarterly.

Capital Requirements

• Maintain at all times such amount of capital as NYDFS determines. The proposed rules do not set forth any specific minimum levels of capital or methods for computing required capital. Rather, the proposal would permit NYDFS to determine the required amount of capital on a case-by-case basis, after considering such factors as the Licensee's assets and liabilities, the amount of leverage used by the firm, the liquidity position of the firm, and extent to which additional financial protection is provided for customers.

Financial Reporting and Audit

• Submit quarterly and annual financial statements to NYDFS. Annual statements are to be audited and submitted with an opinion of an independent certified public accountant and an evaluation by the accountant of the firm's accounting procedures and internal controls.

The proposed regulations also require BitLicense holders to comply with record keeping and other practice standards, as well as oversight procedures that allow NYDFS to conduct examinations of BitLicense holders.

The proposed regulations raise a number of important questions, including:

• Does the BitLicense framework strike the appropriate balance between protecting consumers and rooting out illegal activity, without stifling innovation?
• Will the regulations lead to an increase or decrease in virtual currency firm activity in New York?
• Will other states and/or the federal government be prompted to implement virtual currency regulations?

Conclusion

NYDFS's proposed regulations may have a significant impact on virtual currency regulations in the United States. Businesses transacting in virtual currency should take note that during the 45-day comment period, they have the opportunity to provide feedback and request clarification or amendments to the proposed regulations. Following the comment period, the regulations will be subject to review and revision based on the public's feedback before they are finalized. The comment period is an important opportunity for virtual currency firms to provide input on these significant new regulations.