The New York State Department of Financial Services (“NYDFS”), the New York state regulator for the financial services and insurance industries, recently proposed a framework for regulating virtual currency activities involving New York State (the “Proposed Rules”).1 The Proposed Rules require any business that engages in a “Virtual Currency Business Activity” to become licensed by the NYDFS (a “VC Licensee”) and require a VC Licensee, among other things, to adopt consumer protection, anti-money laundering (“AML”) and cybersecurity policies, procedures and requirements. The Proposed Rules were published in the New York State Register on July 23, 2014 and provide for a 45-day public comment period. Unless the NYDFS extends the comment period, comments on the Proposed Rules must be submitted to the NYDFS by or on Sept. 8, 2014.2 The final rules will be reissued by the NYDFS following its review of the public comments.
Virtual currency is generally understood to be a type of digital money or asset, a medium of exchange of value, a unit of account or a store of value that functions without the involvement of any governmental or central authority. The rules governing the creation, ownership and transfer of decentralized virtual currency are decided upon by its collective users. Its transfer is near-instantaneous, incurs minimal transaction costs and requires no intermediary. Although various federal and state regulators have officially acknowledged the existence of virtual currencies, only a few have addressed how they may be regulated.3 Only the NYDFS has issued a proposal relating specifically to the establishment of a separate framework for regulating virtual currencies. This Alert includes notable observations about and a summary of key aspects of this first-of-its-kind proposal.
- NYDFS, Notice of Proposed Rulemaking on the Regulation of the Conduct of Virtual Currency Businesses, 36 N.Y. Reg. 14 (July 23, 2014). Full text of the Proposed Rules is available here.
- Forty-five days after July 23, 2014 is Sept. 6, 2014, which is a Saturday. But guidance from the New York Department of State provides, “When [the due date] falls on a Saturday, Sunday or legal holiday, the action that is due or the time span that expires does so on the close of business of the next succeeding work day.”
- In March 2013, the U.S. Department of Treasury’s Financial Crimes Enforcement Network (“FinCEN”), the federal agency charged with administering U.S. anti-money laundering regulations, issued guidance categorizing virtual currency administrators and exchangers as money services businesses. The FinCEN guidance defines an exchanger as “a person engaged as a business in the exchange of virtual currency for real currency, funds or other virtual currency” and an administrator as “a person engaged as a business in issuing (putting into circulation) a virtual currency and who has the authority to redeem (to withdraw from circulation) such virtual currency.” Users of virtual currency were not directly affected by this guidance. See FIN-2013-G001, A pplication o f FinCE N’ s Regulati ons t o P ersons Administering, Exchanging, or Using Virtual Currencies (March 18, 2013). In March 2014, the U.S. Department of Treasury’s Internal Revenue Service (“IRS”) issued a notice describing how existing general tax principles apply to transactions using virtual currency. The notice provides that virtual currency is treated as property for
U.S. federal tax purposes. See IR-2014-36, IRS Virtual Currency Guidance: Virtual Currency is Treated as Property for U.S. Federal Tax Purposes; General Rules for Property Transactions Apply (March 25, 2014).
Definition of “Virtual Currency”
As proposed, the NYDFS broadly defines “Virtual Currency” as “any type of digital unit that is used as a medium of exchange or a form of digitally stored value or that is incorporated into payment system technology.” This definition could be construed to include current stored value and prepaid programs, or any digital representation of fiat currency.
While we do not believe that the inclusion of stored value and prepaid programs denominated in fiat currency are the types of products that the Proposed Rules were intended to cover, the broad definition of Virtual Currency may inadvertently capture certain products covered under other regulatory schemes. The NYDFS superintendent should declare exactly which virtual currencies meet the definition and/or provide clear exclusions for stored value and prepaid products denominated in fiat currency.
Definition of “Virtual Currency Business Activity”
The Proposed Rules apply to anyone “maintaining custody or control of Virtual Currency on behalf of others” and provide no exception for the maintenance of Virtual Currency that is incidental to an entity’s business model. We note that there is no de minimis exception to this definition. This definition also applies to a class of people and entities that is broader than that which is currently regulated by FinCEN, potentially covering digital wallet providers, digital currency security providers, and mining pool operators. Although the NYDFS press release announcing the Proposed Rules suggests that the Proposed Rules do not cover mining or the personal use of Virtual Currency, neither exemption is expressly clear in the Proposed Rules.
Holding Virtual Currency
Prior to the issuance of the Proposed Rules, there were concerns within the industry about how the NYDFS would require participants to secure or back Virtual Currency being held on behalf of their customers. To the extent a VC Licensee holds, maintains or controls Virtual Currency on behalf of another person, the Proposed Rules require the VC Licensee to hold Virtual Currency of the same type and amount as that which is owed or obligated to such other person. This is a positive development since there were concerns that the NYDFS would require participants to secure or back virtual currency with fiat currency. In addition, no selling, lending, pledging or encumbering of customer assets is permissible.
Holding Fiat Currency
While the Proposed Rules broadly and generally prohibit the VC Licensee from encumbering assets maintained on behalf of another person, the Proposed Rules do not expressly contemplate holding fiat currency on behalf of customers. In order not to run afoul of other provisions of the New York Banking Law (“NYBL”), such as New York’s money transmission law, the final rule should permit VC Licensees to hold fiat currency to the extent holding such currency is integral to the Virtual Currency Business Activity. Otherwise, business models that contemplate the holding and maintenance of fiat currency for the future purchase of virtual currency on behalf of customers may require a license under the Proposed Rules and a New York money transmission license.
Exchange Services Exemption
The Proposed Rules exclude entities “chartered under the NYBL to conduct exchange services” from the licensing requirements. It is not clear which state-chartered (or -licensed) entities would fall within this exemption.
The Uniform Money Services Act, as well as the money transmitter laws of some states, include an express exemption for registered broker-dealers. The Proposed Rules do not.
Unlicensed Agents Not Permitted
In contrast to the money transmitter licensing framework, VC Licensees would be prohibited from acting through unlicensed agents.
Approval of Application
The Proposed Rules include a direction that the NYDFS superintendent act on an application within 90 days from when the filing is deemed complete. We note that other licensing statutes in New York have similar provisions, but even with such provisions, the licensing process could take longer than expected. Applicants should not necessarily expect action within 90 days of initially submitting an application.
Notifications for Material Changes
A VC Licensee must obtain prior written approval before making material changes to existing products, services or activities. Depending on how long it takes for the NYDFS to review and approve material changes, this provision could have the effect of stifling innovation in a very nascent industry.
Restriction on Retained Earnings
VC Licensees are only permitted to invest retained earnings and profits in certain permissible investments (generally, CDs, MMFs and government securities). This type of restriction is not typical in other regulatory licensing schemes.
The Proposed Rules impose AML compliance requirements that are broader than those required by the Bank Secrecy Act (“BSA”) and its implementing regulations. In particular, the Proposed Rules impose more stringent recordkeeping and customer identification requirements that may not be practical or technologically feasible. The Proposed Rules may require VC Licensees to file a separate suspicious activity report (“SAR”) with the NYDFS for any SAR also filed with FinCEN. In addition, VC Licensees that are not required to file a SAR with FinCEN may be required to file a SAR with NYDFS, in a form to be prescribed by the superintendent. Further, the Proposed Rules prohibit a VC Licensee from engaging in, facilitating or knowingly allowing Virtual Currency transactions that will obfuscate the identity of an individual or counterparty. This prohibition may implicitly prohibit VC Licensees from dealing in virtual currencies that have an aggregator, mixer or tumbler functionality built into their protocols.4
The following requirements may raise compliance concerns, and participants should consider whether to propose clarifications and/or modifications:
- Reporting. Where a VC Licensee is involved in transactions aggregating more than $10,000 by one person in one day, the VC Licensee must notify the NYDFS superintendent within 24 hours. It is unclear how this information will be communicated to the NYDFS superintendent. Participants should consider the feasibility of complying with this provision as proposed.
- See Financial Action Task Force, Virtual Currencies— Key Definitions and Potential AML/CFT Risks (June 2014).
- Affiliates. The Proposed Rules permit the NYDFS to examine any affiliate of a VC Licensee.
Certain participants may not be accustomed to such regulatory oversight.
- Customer Compensation. Customers of a VC Licensee that are victims of fraud are entitled to claim compensation from any trust account, bond or insurance policy maintained by the VC Licensee.
Persons currently engaged in a Virtual Currency Business Activity must apply for a license within 45 days of the effective date of the final regulation to avoid being deemed to be conducting unlicensed Virtual Currency Business Activity in New York. Despite this transitional period, virtual currency businesses should carefully examine their current business model to ensure that it does not involve money transmission — an activity that currently requires a license under the NYBL.
The Proposed Rules define “Virtual Currency” as “any type of digital unit that is used as a medium of
exchange or a form of digitally stored value or that is incorporated into payment system technology.” The NYDFS intends for the definition to be broadly construed to include digital units that are centralized or decentralized, or that may be created or obtained by computing or manufacturing effort. The definition expressly excludes digital units that are: (1) used solely within online gaming platforms with no market or application outside of those gaming platforms; or (2) used exclusively as part of a customer affinity or rewards program that can be applied solely as payment for purchases with the issuer and/or other designated merchants but cannot be converted into or redeemed for fiat currency.
“Virtual Currency Business Activity”
The Proposed Rules define “Virtual Currency Business Activity” as the conduct of any one of the following types of activities involving New York or any individual or entity that resides, is located, has a place of business, or is conducting business in New York:
- Receiving Virtual Currency for transmission or transmitting the same;
- Securing, storing, holding or maintaining custody or control of Virtual Currency on behalf of others;
- Buying and selling Virtual Currency as a customer business;
- Performing retail conversion services, including the conversion or exchange of fiat currency or other value into Virtual Currency, the conversion or exchange of Virtual Currency into fiat currency or other value, or the conversion or exchange of one form of Virtual Currency into another form of Virtual Currency; or
- Controlling, administering or issuing a Virtual Currency.
The NYDFS press release accompanying the Proposed Rules suggests that the definition of Virtual Currency Business Activity would not include Virtual Currency mining or buying and selling Virtual Currency for personal use. But these exclusions are not expressly included in the Proposed Rules.
Licensing Requirements and Exemptions
The Proposed Rules require a person to obtain a license to engage in any Virtual Currency Business Activity. The Proposed Rules would also require agents of a VC Licensee to obtain a license under the Proposed Rules to engage in any Virtual Currency Business Activity. Requiring agents of a VC Licensee to also obtain licenses is a departure from other regulatory frameworks, like money transmission, in which agents of a money transmitter licensee do not need to obtain a money transmission license to engage in money transmission activity on behalf of the licensee.
The Proposed Rules expressly exempt: (1) persons chartered under the NYBL who conduct “exchange services” and are approved by the superintendent to engage in Virtual Currency Business Activity; and
(2)mechtsadserswoseVirtal Crency ley r teprcaser salef sr series. Wth resecttote fistexmt, itis cear wtherthe NDFSinens toemt lcened meytramiters whichy eaein foeincrencyexchesevicesasart ftheirey trasissnbsies)r thertyefinstittnlcensedr chatered erthe NYL tatreeies arovaltoalsoeae inVrtul CrrecyBusiessctiiy.
Safeguarding Customer Assets
The Proposed Rules impose the following requirements on VC Licensees for purposes of safeguarding customer assets:
- Surety Bond/Trust Account Required. VC Licensees are required to maintain a surety bond or trust account for the benefit of their customers in a form and amount acceptable to the superintendent.
- Virtual Currency Required to Back Virtual Currency Held on Behalf of Customers. Where a VC Licensee maintains Virtual Currency on behalf of another person, the VC Licensee is required to maintain Virtual Currency in the same type and amount that is owed or obligated to the other person.
- Prohibition on Encumbering Assets Held on Behalf of Customers. VC Licensees are prohibited from using or encumbering assets, including Virtual Currency, maintained on behalf of another person.
Under the Proposed Rules, VC Licensees are required to maintain sufficient capital, as determined by the superintendent. In determining the required amount of capital, the superintendent will consider a variety of factors, including the VC Licensee’s assets and liabilities, the actual and expected volume of the Virtual Currency Business Activity, whether the VC Licensee is currently subject to supervisory regimes, the VC Licensee’s leverage and liquidity, and the amount of the VC Licensee’s surety bond or trust account.
The VC Licensee is only permitted to invest retained earnings and profits in enumerated high-quality, investment-grade permissible investments with maturities of up to one year. These permissible investments are certificates of deposits, money market funds, state or municipal bonds, and securities issued by the U.S. government or an agency of the U.S. government.
Compliance Requirements Generally
Under the Proposed Rules, a VC Licensee must designate a compliance officer responsible for coordinating and monitoring compliance with the final virtual currency rules and all other applicable federal and state laws, rules and regulations. VC Licensees must also maintain and implement written compliance policies, including policies related to anti-fraud, AML, cybersecurity, privacy and information security.
Anti-Money Laundering Program Requirements
The Proposed Rules require that each VC Licensee establish and maintain a written AML program to ensure ongoing compliance with applicable legal requirements.
AML Program. The AML program must be approved by the VC Licensee’s board of directors (or equivalent governing body) based upon an initial risk assessment of the legal, compliance, financial and reputational risks associated with the specific activities, services, customers, counterparties and geographic location of the VC Licensee’s business. At a minimum, the AML program must:
- Establish internal controls, policies and procedures designed to ensure ongoing compliance with all applicable AML laws, rules and regulations;
- Conduct annual independent testing (internally or by a qualified third party) for compliance with, and to establish the effectiveness of, the AML program, the findings of which must be summarized and submitted to the superintendent (the NYDFS currently requires this of other licensees, such as money transmitters);
- Designate qualified individual(s) responsible for coordinating and monitoring day-to-day compliance with the VC Licensee’s AML program. In other licensing frameworks, the NYDFS has required the designated AML compliance officer to have at least three years of experience running an AML program, but it is unclear whether the NYDFS will impose a similar requirement for VC Licensees; and
- Provide ongoing training for appropriate personnel to ensure they have a fulsome understanding of AML requirements and are able to identify transactions required to be reported and maintain records required to be kept.
Customer Identification Program. Each VC Licensee must “to the extent reasonable and practicable” maintain a customer identification program (“CIP”) which requires, among other things:
- Verification of the identity of a customer at account opening, including verifying the customer’s name, physical address and other identifying information, checking whether the customer is on the Specially Designated Nationals list maintained by the U.S. Department of Treasury’s Office of Foreign Assets Control, and conducting enhanced due diligence for high-risk customers, high- volume accounts or accounts on which a SAR has been filed;
- Establishment of enhanced due diligence policies, procedures and controls to protect against money laundering for accounts maintained for non-U.S. persons and non-U.S. VC Licensees;
- Prohibition on the maintenance of relationships of any type with entities that do not have a physical presence in any country (i.e., foreign shell entities); and
- Verification of the identity of accountholders prior to initiating any transaction having a value greater than $3,000.
Several of these CIP requirements exceed the requirements imposed on money services businesses under the BSA and its implementing regulations.5 The NYDFS appears to also draw from AML regulations and guidance applicable to depository institutions, by requiring VC Licensees to treat customers as accountholders, conduct enhanced due diligence and prohibit the establishment of customer relationships with foreign shell entities.
Reporting and Transaction Monitoring. Each VC Licensee must report to the superintendent any transaction, or series of transactions, of Virtual Currency in an aggregate value exceeding $10,000 in one day by any single person. Accordingly, it appears that the NYDFS is proposing to regulate virtual currencies as if they were fiat currencies; there is no current federal requirement to report virtual currency transactions that exceed $10,000 on currency transaction reports.6 Additionally, each VC Licensee that is not federally regulated must immediately report to the superintendent any suspicious activity that may signify money laundering, tax evasion or other illegal or criminal activities. Each VC Licensee is also required to have appropriate policies and procedures in place to block or reject transactions that violate federal or state laws, rules or regulations. Further, no VC Licensee may facilitate or knowingly allow the transfer of virtual currencies that has the effect of obfuscating the identity of the party involved.
Recordkeeping. Under the recordkeeping requirement, VC Licensees must maintain records of certain information for each virtual currency transaction, including the identities and physical addresses of the parties involved, the value of the transaction, the type of virtual currencies involved, the method of payment, the dates on which the transaction was initiated and completed, and a description of the transaction. These records must be maintained for at least 10 years. Unlike FinCEN, the NYDFS does not provide a $3,000 recordkeeping de minimis exception for certain transactions. Additionally, records collected under the BSA and its implementing regulations are only required to be kept for five years.
Cybersecurity Program Requirements
Under the Proposed Rules, VC Licensees are required to implement a written cybersecurity policy and to maintain an effective cybersecurity program. The cybersecurity program must be designed to: (1) identify cyber-risks, including what information is stored on the VC Licensee’s systems and who may access such information; (2) protect its systems from unauthorized access; (3) detect unauthorized access; (4) respond to cybersecurity events to mitigate negative effects; and (5) recover from cybersecurity events. VC Licensees must designate a chief information security officer who must, among other functions, prepare and submit reports to the VC Licensee’s board. VC Licensees must employ competent cybersecurity personnel. The cybersecurity program must be audited both internally and by an independent third party.
- See 31 C.F.R. Part 1022.
- See Remarks from Under Secreta ry o f T errorism and Financial In tell ig ence David S . C ohen on “Addressing the Illi cit Financia l Ris ks of Vi rt ual
C urrency” (March 18, 2014) (stating “[v]endors processing cash transactions are required to report transactions involving more than $10,000 in
cash to FinCEN, while those processing virtual currency transactions are not”).
Business Continuity and Disaster Recovery Requirements
VC Licensees must establish and maintain written business continuity and disaster recovery plans reasonably designed to ensure availability and functionality of a VC Licensee’s services in the event of an emergency or other disruption to normal business activities.
Advertising and Marketing Requirements
In all New York advertisements, a VC Licensee must include a disclosure explaining that the VC Licensee is licensed by the NYDFS. The VC Licensee must maintain records of all advertising and marketing materials, for examination by the superintendent.
Consumer Protection Disclosure and Receipt Requirements
Each VC Licensee must ensure that the following consumer disclosures are “acknowledged as received by customers”:
- Terms and Conditions. The Proposed Rules require the VC Licensee’s terms and conditions with its customer to include certain terms in addition to customary terms, including the following: (1) the customer’s liability for unauthorized Virtual Currency transactions; (2) the customer’s right to stop payment; (3) VC Licensee’s liability to the customer under any applicable law; and (4) the customer’s right to receive receipts and periodic statements.
- Material Risks. The Proposed Rules prescribe specific consumer disclosures describing material risks associated with Virtual Currency. When the VC Licensee establishes a relationship with a customer and prior to conducting its first transaction for the customer, the VC Licensee must disclose material risks associated with its products and services as well as general risks associated with Virtual Currency, including the following: (1) Virtual Currency is not legal tender;
(2) changes in state, federal and international law may affect the value and use of Virtual Currency; (3) Virtual Currency transactions are generally irreversible, and losses due to fraud or mistake may not be recoverable; (4) a Virtual Currency transaction may occur on a “block chain,” which may take place after the customer initiates the transaction; (5) a Virtual Currency may lose all of its value if the market for a particular virtual currency disappears; (6) persons who currently accept a Virtual Currency as payment may not continue to do so in the future; (7) volatility in the exchange rate of Virtual Currency could lead to significant loss or tax liability in a short period of time; (8) the nature of Virtual Currency may lead to increased risk of fraud or cyberattack; (9) technological difficulties of the VC Licensee may prevent access to the customer’s Virtual Currency; and (10) the VC Licensee’s bond of trust account may not be sufficient to cover customer losses.
- Pre-Transaction Disclosures and Receipt. The VC Licensee must provide a disclosure to the customer prior to executing each transaction. The Proposed Rules enumerate certain elements of this disclosure. The VC Licensee must also provide a receipt for each transaction. The Proposed Rules also enumerate specific elements of the receipt.
Prevention of Fraud
The Proposed Rules state that customers of a VC Licensee that are victims of fraud shall be entitled to claim compensation from any trust account, surety bond or insurance policy maintained by the VC
Licensee. The VC Licensee must also take reasonable steps to detect and prevent fraud, including by establishing and maintaining an anti-fraud policy.
Recordkeeping, Examination and Reporting Requirements
- Recordkeeping. Under the Proposed Rules, VC Licensees must maintain books and records for a period of 10 years. The recordkeeping requirement applies to various records including transaction information, the general ledger, minutes, compliance documents and any records the superintendent may require. VC Licensees must provide the NYDFS, upon request, immediate access to all books and records. VC Licensees must maintain records for at least five years after any Virtual Currency has been deemed abandoned under New York’s Abandoned Property Law.
- Examinations. Each VC Licensee is subject to examination by the NYDFS whenever the superintendent deems an examination necessary or advisable, but not less than once every two years. The superintendent may make special investigations deemed necessary to determine whether the VC Licensee has violated applicable law. The superintendent also has the authority to examine any affiliate of the VC Licensee for purposes of determining the financial condition of the licensee or its safety and soundness.
- Reporting. The VC Licensee must submit quarterly financial statements, including financial projections and strategic business plans, a list of all off-balance sheet items, and a list of permissible investments. The VC Licensee must also submit audited annual financial statements.
Persons currently engaged in a Virtual Currency Business Activity must apply for a license within 45 days of the effective date of the final regulation. Persons failing to do so would be deemed to be conducting an unlicensed Virtual Currency Business Activity in New York.