New York State Adopts "BitLicenses" and Comprehensive Rules for Virtual Currency Firms

Introduction

On June 3, 2015, the New York State Department of Financial Services (NYDFS) released final regulations governing virtual currency firms operating in New York or doing business with New York residents. This Advisory summarizes the new regulations and their implications for virtual currency firms.¹

Background

In January 2014, NYDFS held public hearings to gather information and discuss a potential "BitLicense" regulatory framework. Benjamin M. Lawsky, the Superintendent of Financial Services for the State of New York, emphasized the need to create a stable marketplace for virtual currency firms, through the implementation of regulations that foster both consumer protection and innovation, while rooting out illicit activity, such as money laundering. To that end, NYDFS released proposed regulations in July 2014, and released a revised proposal in February 2015.

Overview of Final Regulations

The NYDFS's final regulations define "virtual currency" as "any type of digital unit that is used as a medium of exchange or a form of digitally stored value." The regulations require BitLicenses for firms engaged in the following virtual currency businesses that involve New York or a resident of New York:

• Receiving or transmitting virtual currency for others, except where the transaction is not for financial purposes and involves only a nominal amount;
• Storing, holding, or maintaining custody or control of virtual currency on behalf of others;
• Performing the service of converting or exchanging virtual currencies for fiat currencies, or for other virtual currencies;
• Buying and selling virtual currency as a customer business; or
• Controlling, administering, or issuing a virtual currency (although the development and dissemination of software in and of itself would not require a license).

On the other hand, a license is not required for:

• Merchants or consumers that utilize virtual currency solely for the purchase or sale of goods or services;
• Merchants or consumers that use virtual currency solely for investment purposes; or
• Firms chartered under the New York Banking Law, including as money transmitters, that are approved by NYDFS to engage in virtual currency business activity.²

A virtual currency firm that is already in operation will have 45 days from the effective date of the regulations to apply for a license. Such an applicant will be permitted to continue operations while its application is pending. However, it must immediately cease operating in, or doing business with residents of New York, if its application is denied. For small and start-up firms, conditional licenses may be granted under terms deemed appropriate by the NYDFS.

Under the final rules, BitLicense holders will have to comply with standards that are intended to prevent money laundering, ensure consumer protection, and bolster cyber security. Among other things, a BitLicense holder will be required to provide the following controls:

Anti-Money Laundering

• Establish, maintain, and enforce an anti-money laundering program based on an annual (or more frequent) assessment of the legal, compliance, financial, and reputational risks associated with its activities, services, customers, counterparties, and geographic location.
• Maintain a detailed record of each transaction that includes the identity and physical address of the customer, and to the extent practicable, any other party to the transaction, the value and dates of the transaction, the method of payment used, and a description of the transaction.
• Verify customers' identities when opening customer accounts and check them against the US Treasury Department's Office of Foreign Asset Control's Specially Designated Nationals list. Enhanced diligence is required for certain accounts with higher risk profiles, such as high-volume accounts or accounts where a Suspicious Activity Report has been filed. Enhanced due diligence is required for accounts of non-US persons, and must take into account the risks associated with such accounts, including the nature of the non-US business, the type and purpose of the activity, and the anti-money laundering and supervisory regime of the non-US jurisdiction. Accounts on behalf of foreign shell entities are prohibited.
• Notify NYDFS of any transactions that might signify illegal or criminal activity and when a person engages in virtual currency-to-virtual currency transactions that exceed US$10,000 in a single day, unless the transactions are subject to suspicious activity or currency transaction reporting requirements under federal law.

Consumer Protection

• To the extent a Licensee stores, holds, or maintains virtual currency on behalf of a third party, the Licensee must hold virtual currency of the same type and amount as that which is owed or obligated to the third party.
• Maintain a surety bond or trust account (in US dollars) for the benefit of its customers in a form and amount acceptable to NYDFS.
• Provide customers with a receipt for each transaction with information about the firm's name and address, specifics of the transaction, and statements about the Licensee's liability for non-delivery and refund policy.
• Disclose to consumers the material risks associated with virtual currencies, in writing, both in English "and in any other predominant language spoken by the customers of the Licensee."

Cyber Security

• Maintain an effective cyber security program to ensure the availability and functionality of its electronic systems and to protect its systems and any sensitive data from unauthorized access, use, or tampering.
• Designate a qualified employee to serve as a Chief Information Security Officer responsible for implementing the cyber security program.
• Implement an audit program that includes system penetration testing at least annually, and vulnerability assessments at least quarterly.

Capital Requirements

• Maintain at all times such amount of capital as NYDFS determines. The rules do not set forth any specific minimum levels of capital or methods for computing required capital. Rather, they permit NYDFS to determine the required amount of capital on a case-by-case basis, after considering such factors as the Licensee's assets and liabilities, the amount of leverage used by the firm, the liquidity position of the firm, the extent to which additional financial protection is provided for customers, and the nature of its customers, products, and services.

Financial Reporting and Audit

• Submit quarterly and annual financial statements to NYDFS. Annual statements are to be audited and submitted with an opinion and attestation by an independent certified public accountant as to the firm's internal control structure.
• Comply with record keeping and other practice standards, as well as oversight procedures that allow NYDFS to conduct examinations of BitLicense holders.

Prior Regulatory Approval of Changes to Products and Services

• Obtain prior regulatory approval of material changes to existing products, services, or activities, as well as new products, services, or activities that "may raise safety and soundness or operational concerns" or that "may raise a legal or regulatory issue about the permissibility of the product, service, or activity."

Conclusion

Based on the final rules, firms such as virtual currency brokers and exchanges will be able to assess whether they will be required to obtain a BitLicense. As a practical matter, most virtual currency businesses will need a BitLicense because one is required in order to do business with a resident of New York. Such companies may wish to consider whether it is more advantageous to obtain a BitLicense or to apply for registration in some other capacity, such as a money transmitter. In either case, firms that may be affected should become familiar with the standards that apply to such companies and prepare for the application process. Firms should also familiarize themselves with the significance of becoming a licensed party under the BitLicense regime, which is a robust prudential supervisory framework that in various ways mirrors a commercial bank regulatory one. Obtaining a license will be the beginning of an ongoing supervisory relationship with NYDFS that will involve continuous negotiation of appropriate capital levels, application for changes in product offerings, incorporation of review and approval time into material business development, and M&A transaction plans, etc.

The final regulations represent a significant milestone in the history of virtual currencies. The implications extend not only to virtual currency brokers, but to businesses that accept virtual currencies as payment for goods and services, and to individual users of virtual currencies. Oversight by a state regulator may allow virtual currencies to gain broader acceptance by businesses and retail users. Nonetheless, several issues facing the industry remain:

• Will the requirements for regulatory pre-approval of changes to products and services stifle innovation?
• How will virtual currency regulation evolve in California, where legislation is currently being considered, and in other states? Will competing models of regulation evolve at the state and federal levels?
• Will other state authorities require holders of a New York BitLicense to also obtain some form of authorization in their states? Alternatively, could some form of reciprocal recognition of licenses evolve among the states?
• Will the new regulations encourage or discourage the establishment of virtual currency businesses in New York, in other states, or in the United States more generally?
• If the new regulations discourage virtual currency businesses in New York, how might research and development into alternative uses of virtual currencies and blockchain technologies be affected?

NYDFS's intent is clear with respect to consumer protection, anti-money laundering policy, cyber security and the prevention of criminal activity in the world of virtual currencies. Whether its efforts to provide safety and security in these markets will stifle innovation or foster commerce remains to be seen as much will be left to the effective administration of the supervisory regime and the pending legislation in other jurisdictions.