On August 6, BuckleySandler hosted a webinar, Top 10 Things You Need to Know about the New York BitLicense Proposed RuleMichael Zeldin, Special Counsel at BuckleySandler, moderated the panel, which featured presentations by Partner Margo H. K. Tank and Counsel Amy Davine Kim of BuckleySandler’s Digital Commerce and Payments Group.

Overall, our presenters agreed that the regulatory framework proposed by the New York Department of Financial Services (DFS) would establish a different and more difficult standard for the virtual currency industry than for the traditional money transmitter industry. The rigorous data security, consumer protection, and anti-money laundering provisions may unintentionally operate as a high barrier to entry into the virtual currency industry while favoring established companies with experience and resources to handle these issues. Our presenters also offered specific areas of improvement and clarification for organizations to take into account when drafting comments on the proposal.

The following provides a more detailed summary of the discussion:

  1. More Activities Require a License than Traditional Concepts of Money Transmission
  • The DFS’s proposal would define virtual currency as a “digital unit that is used as a medium of exchange or a form of digitally stored value or that is incorporated into payment system technology.” This definition is different those presented by FinCEN in March 2014 and FATF in June 2014 and is not BitCoin specific.
  • Rather than attempting to apply old laws to new technology, New York is proposing to establish a completely independent regulatory system for virtual currency companies. They are intentionally broad.
  • Ms. Kim recommends that companies offering rewards or affinity programs seek clarifications regarding exemptions under the proposal: “The exclusion for affinity and rewards programs must be a welcome relief to banks and other merchants. However, the term is undefined. Companies that offer affinity and rewards programs might want to suggest a definition that is carefully worded to include their program to be absolutely sure they are covered and avoid having to write in to New York to request a letter confirming that their specific program is exempt.”
  1. Comprehensive Application Requirements
  • The proposed rule contains many of the license requirements typically applied to money transmitters, including requirements for detailed background and financial information for those that are 10 percent owners/investors in the business.  It also requires fingerprints for all employees.  Application approvals are made at the discretion of the NYDFS.
  • While the proposed rule is the same standard for money transmitters, it is unclear how this standard will be applied in a new and developing industry.
  1. Cyber Security Requirements are Significant
  • The proposed rule would require licensees to establish and maintain a cybersecurity program to: (i) ensure the availability and functionality of the licensees’ electronic systems; and (ii) protect the systems and any sensitive information held on those systems from tampering. The cybersecurity program would have to be approved annually by the licensee’s board of directors, and must at a minimum address these five core functions of cybersecurity:
    • Identifying risk;
    • Protecting from unauthorized access;
    • Responding to detected events;
    • Reporting violations; and
    • Recovering from violations.
  • The proposal does not contemplate interactions with other applicable existing laws—i.e.  does satisfying one applicable information security law fulfill compliance with the rule in question; is there some sort of safe harbor? Ms. Tank noted that the lack of clarity on this point could be problematic for companies seeking to comply with potentially duplicative, overlapping, or contradictory regulatory requirements.
  1. Advertising & Marketing Requirements May Provide a Challenge in an Electronic Environment
  • Ms. Tank described these requirements as “seemingly limited.” The proposal requires that all advertising materials include name of licensee in a legend, stating the licensee is “licensed to engage in virtual currency business activity by the New York State Department of Financial Services.” However, what does “in a legend” mean? Also, what about requirements for advertising materials as part of mobile applications, texting or push notifications?
  1. Consumer protection requirements may cause implementation problems 
  • “The rule has numerous disclosure requirements at multiple points in the transaction. It will take significant ingenuity to meet and prove that you’ve met these requirements, especially in BitCoin transactions where anonymity is a feature,” said Ms.Tank.
  • The proposed disclosures resemble a number of other consumer protection laws, such as Regulation E and those that impact commodity or security investments.
  • Each licensee shall ensure that all disclosures required in this section are acknowledged as received by customers. The rule does not specify how acknowledgement can be achieved or the timing of the acknowledgement (although one would presume it would be prior to the transaction). The acknowledgment requirement could be problematic with respect to timing and execution of trades – what if the customer doesn’t acknowledge? If the disclosures are provided in paper format, how would acknowledgement be received – by telephone, paper or return?
  • Even more troubling is the proposed rule requires that the disclosures must be in “legible writing” in the English language and in any other predominant language spoken by the customers of the licensee.  The meaning of this proposed rule, as well as how to determine “other predominant language” is unclear. What about joint accounts where the joint account holders speak different languages – how does the licensee know the language to begin with? Terms such as “in writing” and “clear and conspicuous” on a mobile device are left undefined. There is also no mention of compliance with ESIGN consent as required by 101(c) or the New York Electronic Signature and Records Act in connection with providing the written disclosures electronically. Finally, in person and ATM transactions may be tricky as real time disclosures will be needed.
  1. Capital Requirements are Significant
  • The rule creates capital and virtual currency-specific liquidity and bonding requirements that must be met by licensees, which may act as a barrier to entry for those hoping to enter the virtual currency industry in New York.
  • The rule would grant the DFS discretion to establish minimum capital requirements on a company by company basis. Factors for making this determination include:
    • Total assets, and the position, size, liquidity, risk exposure, and price volatility of each type of asset
    • Total liabilities
    • The actual and expected volume of the licensee’s virtual currency business activity;
    • Whether the licensee is already licensed or regulated in New York;
    • The amount of leverage employed by the licensee;
    • The liquidity position of the licensee
    • The financial protection that the licensee provides to customers through its trust account or bond.
  • The factors considered in determining sufficient capital are more significant in the virtual currency space and it is unclear how New York will interpret these factors for new companies.
  1. Anti-Money Laundering Provisions are Expansive
  • The rule would require that covered companies conduct risk assessments, with compliance programs established based on that assessment. In addition, licensed companies must:
    • Maintain records and reports for 10 years rather than the year period required by the BSA.
    • Maintain records of transactions, including theidentities and physical address of the parties involved in transactions (seller and recipient), the value and denomination of the transaction, time stamps, and descriptions of transactions.
    • Notify the DFS within 24 hours of any transactions of more than $10,000 in one day by one person.
  • It is not clear under the proposal if submitting suspicious activity reports (SARs) to the federal government also would fulfill any requirement to file them with New York.
  • Enhanced due diligence in dealings with foreign entities, high risk customers, high-volume accounts, and accounts on which a suspicious activity report has been filed.   Transactions with shell companies prohibited.
  1. Investor Considerations
  • Whether or not this proposed rule goes forward in its current form, in this increasingly regulated sector, investors will need to structure transactions and develop investment vehicles that address the immediate capital needs of a business while meeting regulatory requirements.  Investment in regulatory compliance will be significant and investors should build in compliance costs into the equation.
  • Private equity and venture capitalists have to think through how they structure their investments. 10 percent equity ownership triggers various disclosures, background checks and nonpublic information that investors often are reluctant to share.  Non-controlling investments may offer several options. Investors could consider using debt, warrants, and other types of interest that do not subject the investor to regulatory approval requirements.
  • One of the biggest challenges is the time-to-market issue and the situation in which companies are waiting for regulatory approval while investors sit on the sidelines. The proposed rule does provide some flexibility, in that companies may proceed with business activities while their license application is pending. In this case, the proposed rule differs from the traditional money transmitter model in which regulatory approvals needed for transaction may take as long as six months
  1. Industry and Regulatory Impact
  • “An industry like this still in its infancy developing software protocols may not be able to thrive (let alone reach profitability) in this environment,” said Ms. Kim.  “It may end up solidifying the established players, the ones who can comply may more easily obtain banking relationships, becoming the go-to virtual currency wallet providers or exchangers, for example.  The others that can’t keep up may test their products outside New York until they can meet these requirements or until they are purchased by the bigger players.”
  • While relationships with established players may speed mainstream adoption of virtual currency, innovation and profitability in the industry may be hampered by this rule. Innovators may avoid New York for a while, relocating to different states or even abroad. A uniform approach throughout the U.S. could support industry growth.
  1. Tips for Successful Comment Letters
  • The 45 day comment period for this proposal ends on Saturday, September 6. “Commenting on this is imperative to ensure that this rule, in its final form, is as industry acceptable as possible,” said Mr. Zeldin.
  • BuckleySandler’s top recommendation for anyone considering commenting on the proposal is to ask for clarification of gray areas that have an impact on a specific business model. Commenters also should offer specific suggestions for improvement to enhance the clarity of the proposal and fit your business practices. In addition, potential comments should consider:
    • Providing details as to what compliance means for your business under this proposal. For example, how might this affect or delay new technologies or the way your company does business. Provide qualitative and quantitative support.
    • BuckleySandler is available to assist organizations in drafting comment letters and providing more guidance on this issue.