Fintech Focus: Virtual Currency Update: NYDFS Issues Key New Guidance As It Marks Two Year Milestone

I. Why did NYDFS Issue this Announcement and Guidance?

NYDFS is serious when it describes itself as providing “nation-leading” oversight to the virtual currency industry, and it has the receipts to show it. On the federal level, for instance, FinCEN has a registration requirement that applies to virtual currency businesses that are money transmitters, but the registration process is a one-way street that does not involve or require any feedback or approval from FinCEN. New York, through NYDFS, was not only the first state to establish a comprehensive licensing regime specific to virtual currency with its Bitlicense, but no other federal or state regulatory body has taken a more proactive and engaged approach to oversight of virtual currency companies.

With this new guidance, NYDFS is using its administrative processes to document rules and expectations it is already implementing on a daily basis for companies currently under its supervision.

II. Who Does the Guidance Apply To?

The guidance applies to entities (a) licensed under New York’s Virtual Currency Law, 23 NYCRR Part 200, also known as Bitlicenseees, or (b) chartered as a limited purpose trust company under the New York Banking Law (“Virtual Currency Entities”). This includes entities performing exchange services, controlling, administering, or issuing virtual currency, buying and selling virtual currency as a business, and maintaining custody or control of virtual currency on others’ behalf.

III. What Changes Are there to the Greenlisting Process?

In light of events in the crypto market over the last year, NYDFS is implementing its safety and soundness mandate by significantly curtailing its Greenlist, which is a list of tokens it had established in 2020 as being subject to being listed by licensed virtual currency entities in New York with fewer administrative hurdles. With its new guidance, NYDFS has trimmed the Greenlist to what it considers lower risk coins, eliminating tokens of a variety of well-known crypto projects, and leaving only BTC, ETH, and a few stablecoins that are directly overseen by NYDFS. Consistent with the original guidance, virtual currency entities do not have to obtain NYDFS’ prior approval to list Greenlisted coins, unless NYDFS expressly informs them otherwise. As before, virtual currency entities are required to provide NYDFS advance notice prior to supporting a new coin. Now, however, virtual currency entities must also have a NYDFS-approved coin-delisting policy. 

While this new Greenlist coin guidance supersedes the old framework, Virtual Currency Entities who have been operating per the former guidance are not required to immediately de-list coins which are no longer on the Greenlist.

IV. What New Requirements Apply to the Listing of Coins?
 
NYDFS requires that virtual currency entities maintain a coin-listing policy, under which the virtual currency entity can self-certify and list a coin without the agency’s prior approval but with prior written notice. Per the final guidance, a Bitlicensee’s coin-listing policy must include comprehensive procedures that address all steps involved in the review and the approval of coins to ensure its compliance with NYDFS guidance and consumer protection principles. In addition, the policy must also be tailored to the individual virtual currency entity and the specific coin and be integrated into the virtual currency entity’s overall risk and compliance framework (e.g., verify that independent testing includes coin-listing and coin-delisting in its scope as part of annual planning). These requirements were present in the original guidance, but the new guidance prescribes more specific, detailed governance, risk assessment, and monitoring obligations and inserts additional layers of NYDFS scrutiny.

NYDFS’ new guidance codifies its existing expectations by requiring a coin-listing policy to, at a minimum, address the following: 

 a) Governance measures, including: 

i. Designation of either the board of directors or other equivalent “governing authority” with responsibility for approval of a coin-listing policy. The new guidance now requires formal delegation of this approval to such a governing authority and assurance that the governing authority is independent from those who make initial recommendations of whether to list or delist a coin;

ii. Recordkeeping policies ensuring that decisions made by the governing authority regarding the listing and delisting of coins are properly documented and retained. These records must be made readily available for NYDFS’s review at all times; 

iii. The continued requirement to obtain prior NYDFS approval for material changes to coin-listing policies; and

iv. Self-reporting to NYDFS if a NYDFS-approved coin listing policy fails to comply with the new guidance.

b) Development of a particularized risk assessment for each listed coin, covering (a) technical design and technology, (b) impact on the operations of the virtual currency entity, (c) IT/cybersecurity, (d) market and liquidity, (e) illicit finance, (f) legal, (g) reputational, (h) regulatory, (i) conflicts of interest, and (j) consumer protection risks. These risk assessments must incorporate NYDFS’ “Guidance on Prevention of Market Manipulation and Other Wrongful Activity,” which requires virtual currency entities to develop policies and procedures for monitoring, detecting, and addressing fraud or other wrongdoing. 

c) Monitoring, including a tailored annual reevaluation to identify material changes, controls to manage risks such as cyber security and illicit activity risks, and coin-delisting process. In addition, virtual currency entities must (i) ensure that their coin-listing policies are integrated into their risk and compliance framework and (ii) comply with regulatory reporting obligations, BSA/AML and sanctions-related control requirements, and NYDFS’ “Guidance on Use of Blockchain Analytics.” 

In the final form of the guidance, NYDFS stated that it will not approve a coin listing policy without an accompanying de-listing policy. Further, Virtual Currency Entities with coin-listing policies previously approved by NYDFS per the Original Guidance cannot self-certify until they establish coin-listing policies in compliance with the final guidance and obtain NYDFS’ approval.

V. What Coins Does NYDFS Exclude from the Self-Certification Process?

NYDFS requires prior approval (not just notice) for listing the following coins to retail customers, which it considers a material change in business:

a) So-called “privacy coins” (referred to as “Anonymity Enhanced Coins” or “AECs” by FinCEN), which are cryptocurrencies that preserve anonymity by obscuring the flow of money across their networks; and

b) Non-Greenlisted stablecoins, exchange coins native to a cryptocurrency exchange, any coin that is the native asset for a protocol where there are concerns related to the protocol’s decentralization or ownership concentration; bridged coins; and coins with circulating supply of less than 35% of total publicly available supply.

In its final guidance, NYDFS clarified that the above exclusions from self-certification “do not apply to institutional custody or services only available to businesses.”

VI. What Is the New Requirement Related to Delisting?

All NYDFS Bitlicensees must now have a specific delisting policy and procedure applicable to coins they list in the event the licensee independently decides to delist a coin, or NYDFS directs them to do so. This requirement applies regardless of whether a virtual currency entity maintains a coin-listing policy for self-certification purposes. NYDFS expects a coin-delisting policy to, at a minimum, address:

a) Governance principles consistent with the coin-listing policies guidance, including notification to NYDFS of a decision to delist a coin at least 10 business days prior to informing customers. However, the final guidance provides for an exception from the notice requirement due to exigent circumstances, in which case the Virtual Currency Entity would only be required to notify NYDFS prior to delisting the coin.

b) Process and Procedures applicable to a delisting event, including the identification of who has authority to make, review, and approve delisting decisions (“Governing Authority Members”); ongoing monitoring procedures, including periodic review to consider changes in currently supported coins; and criteria that may prompt a delisting. The final form of the guidance also added an information barrier requirement to guard against potential conflicts of interest, market manipulation or insider trading.

c) Proper Execution, including using reasonable efforts to provide customers with at least 30 days’ prior written notice of a delisting decision (absent exigent circumstances which may allow for shorter notice); establishing sufficient customer support during delisting, documenting all key details relating to the delisting decision, and conducting an impact analysis. 

A Virtual Currency Entity is required to obtain NYDFS guidance in the event it believes that the above de-listing policy requirements do not apply to its business model. Virtual Currency Entities must meet with DFS by December 8, 2023, to discuss their draft coin-delisting policy and to submit their policy to DFS for review and approval by January 31, 2024.

VII. When does the Guidance Go into Effect?

The new guidance went into effect immediately upon its proposal on September 18, 2023, and with publication of its final form on November 15, 2023.

*This alert was updated on November 30th, 2023.