On Feb. 7, 2018, the New York State Department of Financial Services (“NYDFS”) issued new guidance reminding all virtual currency business entities licensed under 23 NYCRR Part 200 or chartered as limited purpose trust companies under the New York Banking Law (collectively, “VC Entities”) to implement measures designed to effectively detect, prevent and respond to fraud, attempted fraud and similar wrongdoing, and be vigilant against efforts at market manipulation (“Guidance”).[1] The Guidance applies to all VC Entities, including those that also hold a New York money transmitter license.

The Guidance was issued in response to what the NYDFS believes to be a growing threat of fraud and market manipulation involving cryptocurrency markets. These activities, which may be conducted by the personnel or customers of a VC Entity, may involve activities such as the wrongful manipulation of the price of virtual currency and the abuse of inside information regarding a VC Entity’s plans to expand (or curtail) its services. Such activities threaten consumers and also endanger the safety and stability of all financial service institutions.

The Guidance reminds VC Entities to thoroughly evaluate operations to determine whether certain measures may be required to combat wrongdoing. Specifically, the Guidance directs VC Entities to develop and implement a “written policy that:

  1. Identifies and assesses the full range of fraud-related and similar risk areas, including, as applicable, market manipulation;
  2. Provides effective procedures and controls to protect against identified risks;
  3. Allocates responsibility for monitoring risks; and
  4. Provides for periodic evaluation and revision of the procedures, controls and monitoring mechanisms in order to ensure continuing effectiveness, including continuing compliance with all applicable laws and regulations.”[2]

In addition, the Guidance requires VC Entities to initiate an investigation immediately following the discovery of any suspected or actual wrongdoing and submit a comprehensive report to the NYDFS stating all pertinent details discovered. As soon as practicable thereafter, VC Entities must also submit to the NYDFS an additional report of any material developments related to the initial reported events along with (1) a statement of the actions taken or proposed to be taken with respect to such developments and (2) a statement of changes, if any, in the VC Entity’s operations that have been put in place or are planned in order to avoid repetition of similar events. A VC Entity must maintain records of each incident of wrongdoing.