The Situation: For the first time, the New York State Department of Financial Services ("NYDFS") publicly announced that it had denied a cryptocurrency exchange's applications for virtual currency and money transmission licenses, basing its decision in large part on what it believed were systemic deficiencies in the applicant's compliance program.
The Result: The NYDFS's letter signals a willingness to work with license applicants through their individual facts and circumstances, and provides a potential roadmap for other cryptocurrency-related license applicants to consider when developing their compliance programs. It also demonstrates how difficult it can be for applicants to comply with New York's strict requirements.
Looking Ahead: Cryptocurrency-related businesses should use the NYDFS's letter to evaluate their compliance and control systems both generally – because other regulators may view the NYDFS's conclusions as persuasive – and certainly before submitting license applications in New York.
On April 10, 2019, the NYDFS took the unusual step of publicly announcing that it had denied the applications for virtual currency and money transmission licenses submitted by a cryptocurrency exchange (the "Applicant"). Under New York's BitLicense Regulation, entities engaged in "Virtual Currency Business Activity," which includes performing exchange services, are required to obtain a license. A license is also required under New York's money transmitter law to engage in the business of "receiving money for transmission or transmitting the same." The Applicant, a Washington State-based cryptocurrency exchange that is currently registered with the Financial Crimes Enforcement Network as a money services business ("MSB"), applied for both licenses. Subsequently, the Applicant has been operating in New York under a regulatory safe harbor while the NYDFS evaluated the Applicant's applications and assessed whether its business operations complied with New York law.
In its letter denying the two applications, the NYDFS said that the Applicant did not show during the NYDFS's pre-licensure examinations that it will conduct its activities "honestly, fairly, equitably, carefully and efficiently" due to deficiencies in the following areas:
Inadequate Bank Secrecy Act/Anti-Money Laundering (collectively, "AML") and Office of Foreign Assets Control ("OFAC") Compliance Programs. Among other things, the NYDFS identified deficient internal controls regarding the Applicant's monitoring and reporting of suspicious transactions, as required by OFAC regulations. According to the NYDFS, the Applicant's AML and OFAC compliance programs were insufficient to "comprehensively assess the risks associated with its cryptocurrency activities, products offered… its customer base or geographies of operation." Moreover, the NYDFS concluded that the various shortcomings in the Applicant's AML and OFAC compliance programs raised concerns about both the qualifications and effectiveness of the Applicant's Chief Compliance Officer and the robustness of its employee training programs. The NYDFS also found that an independent audit report issued to the Applicant early this year did not sufficiently evaluate the "overall integrity and effectiveness" of the Applicant's AML and OFAC compliance programs. Based on a sampling of customer transactions, the NYDFS also stated that the Applicant did not comply with certain customer due diligence requirements, and particularly noted that NYDFS examiners found instances where customer names, dates of birth and tax identification numbers were missing.
Insufficient Due Diligence in Launching Tokens or Products. Based on a sampling of fifteen tokens available on the Applicant's exchange, the NYDFS concluded that its examiners were unable to determine compliance with the Applicant's written policies and procedures for reviewing and launching tokens and products on the exchange. In this regard, the NYDFS identified situations in which token applicants either did not complete or file applications but were still allowed to trade on the Applicant's exchange.
Inadequate Capital. According to the NYDFS, the Applicant did not commit to adhere to the NYDFS's capital requirements. The BitLicense Regulation provides that licensees are required to maintain a level of capital, as determined by the NYDFS, "to ensure the financial integrity of the Licensee and its ongoing operations" based on that licensee's particular risk assessment.
The NYDFS ordered the Applicant to cease operating in New York and doing business with New York residents as of April 11, 2019. The NYDFS also ordered the Applicant to submit a plan by April 24, 2019, describing how it intends to wind down its business in New York, including transferring customer positions and ensuring the safe custody of customer assets, by June 9, 2019.
In response, the Applicant said that it "fully disputes" the NYDFS's findings and identified what it believes are inaccuracies in them. It also outlined a number of facts that it believes provide key context to the review process. For instance, it said the NYDFS restricted the cryptocurrency that the Applicant could offer to New York residents to ten coins, even though other BitLicense holders are offering other coins in New York. It also pointed out that the capital requirements exceed those required by any other state and noted that the NYDFS rejected the Applicant's offer to provide a bond to cover the entire capitalization of New York customers. A young company that had four employees only two years ago, the Applicant acknowledged that it "is on a journey to improving and maturing our compliance function," and committed to continuously improving its compliance program and seeking feedback "to be the corporate citizens we have set out and committed to be."
Three Key Takeaways:
- This is the first time that the NYDFS publicly announced a denial letter, indicating that it considered the issues presented particularly noteworthy. The detailed description of the compliance issues that the NYDFS identified provides a potential roadmap for other cryptocurrency-related license applicants to consider when developing their compliance programs. The Applicant's response also highlights the challenges that companies face in meeting the strict compliance requirements that New York has established for virtual currency businesses to operate there.
- The NYDFS recognized the "innovative and evolving" nature of the virtual currency sector and how it "worked steadily with [the Applicant] to address continued deficiencies and to assist [the Applicant] in developing appropriate controls and compliance programs commensurate with the evolving nature of the sector." Although the Applicant disputes how reasonable the NYDFS was in the process, the NYDFS has signaled that it is willing to engage with applicants about their individual facts and circumstances and that it recognizes that compliance programs may need to be uniquely tailored to cryptocurrency exchangers versus other MSBs.
- The NYDFS decision highlights the importance of applicants using "available technologies" and "automated processes" rather than relying on "manual processes" in transaction monitoring and sanctions compliance programs. While there is no substitute for the exercise of good judgment in the legal and compliance functions, the NYDFS decision signals that failure to use available technologies to flag risks may be deemed automatically deficient.