The State of New York recently passed legislation requiring those transacting in virtual currency to become licensed. The new rules mirror much of what is already in place for many broker-dealers, banks, and other financial institutions. However, there are some important parts of the legislation that may change written policies or require new policies be written and implemented.
While the new rules do not go into effect immediately – there is a 45-day comment period starting on July 23 – we summarize the legislation in anticipation of it being put into place without major changes.
Most poignantly, the New York Virtual Currency Regulation (VCR) requires, with few exceptions, all companies that store, control, buy, sell, transfer, or exchange Bitcoins (or other cryptocurrency) to become licensed with the New York State Department of Financial Services (NYDFS). In order to obtain a license, an application must be completed providing: (1) identifying information about the applicant and its individual and entity affiliates, (2) a background report prepared by an independent investigatory agency, (3) fingerprints, (4) photographs, (5) organization charts, (6) current financial statements, (7) business plans, (8) details of banking arrangements, (10) copies of written VCR policies and procedures, (11) copies of insurance policies, (12) an explanation of the methodology used to calculate the value of the virtual currency into traditional currency and(13) verification from the New York State Department of Taxation and Finance.
Since the DFS has 90 days to approve or deny your application, presumably, the NYDFS will be supplying forms to assist in the application process; if for no other reason, to provide itself the consistency necessary to process the applications it will receive.
Importantly, the non-refundable license fee required under the VCR is $5,000. You may also have to submit other fees to process additional paperwork related to the license, if the NYDFS requires. In other words, if you apply and are rejected for a license, the Department of Financial Services keeps your $5,000. Thus, it will be important that you follow the steps necessary to properly provide all required information with your application. CRC can assist in this regard.
There are capital requirements that must be maintained at all times and each licensee must maintain a surety bond. The capital requirements and the amount of the surety bond have not yet been set by the NYDFS. In addition, if a licensee undergoes a change of control or engages in a merger, the NYDFS must be given prior notice and a written application must be completed providing the detailed information about the new control group identified above. The NYDFS has authority to stop any change in control or merger if the new control group does not pass licensing requirements.
Some important items each licensee must be aware of and implement with its Virtual Currency License are:
1) Designation of a Digital Currency Compliance Officer
2) Maintenance of a Digital Currency compliance policy covering items relating to anti-money laundering, cyber security, privacy, and information security.
3) Books Records policies similar to current securities and banking books and records requirements.
The AML requirements are very similar to current AML requirements from FINRA and the Bank Secrecy Act. However, the VCR’s AML requirements require each licensee’s AML program to maintain a customer identification program. This requirement is antithetical to the nature and spirit of the origins relating to the anonymity of digital currency. However, a robust AML program combined with an even more robust privacy and information program may be a point of differentiation for you with your competitors and could be a way to encourage customers to use your services who desire to maintain their anonymity.
The VCR’s cyber security mandates mirror current regulations such as the Gramm-Leach Bliley Act and the Federal Information Security Act. Every licensee must create and enforce a cyber security written policy and designate a Chief Information Security Officer (CISO). The cyber security program requirements under the VCR include identifying risks, protecting electronic systems, detecting intrusions, recovering and restoring operations and systems. There are also annual reporting and auditing requirements that may necessitate substantial administrative work by the CISO.
The VCR requires each licensee to provide quarterly and annual financial disclosures and reports to the NYDFS. These disclosure and reports are standard types of information, but will add another regulatory requirement to the already heavy regulatory requirements of many broker-dealers, banks, and other financial institutions.
Lastly, there are disclosure requirements and advertising/marketing limitations under the new laws. The disclosure requirements are specific to virtual currency transactions and involve adding language to account applications “in clear, conspicuous and legible writing in the English language and in any other predominant language spoken by the customers of the licensee.” The list of disclosures in the legislation is extensive and will likely lengthen already long account applications. However, it may be a good idea to review your current account applications with a representative from CRC to determine the best was to combine the VCR disclosure requirements with your current regulatory disclosures. The advertising/marketing disclosures merely require each licensee’s advertising to contain the following phrase “Licensed to engage in Virtual Currency Business Activity by the New York State Department of Financial Services.”
There are other parts of the VCR with which entities and individuals who obtain licensure will have to comply. Ultimately, living within the requirements of the law will require careful consideration of the VCR’s provision for new written policies and internal procedures.
Please contact Compliance Risk Concepts if you would like more information about digital currency regulations or are interested in learning more about compliance issues relating to digital currency issues.
