On July 23, 2014, the New York State Department of Financial Services published its proposed framework for the regulation of virtual currency businesses doing business in New York. The proposed “BitLicense” regulations would create a comprehensive regulatory regime over virtual currency businesses including anti-money laundering compliance, cyber security regulations, and various consumer protection safeguards that are commonly seen in the regulation of other state-regulated financial institutions and money services businesses. Once the rules are finalized, New York would become the first state to specifically regulate virtual currency businesses. A copy of the Department of Financial Services press release can be read here.
Although the regulation of virtual currency presents real challenges for federal and state regulators because of the nature of the virtual currency industry itself, these challenges are only unique to the extent that regulators have never previously attempted to regulate virtual currencies by name. However, regulators do have a great deal of experience regulating transactions of all shapes and sizes, and it appears that they will rely on that experience in regulating virtual currency transactions. (Our previous report on FinCEN’s attempt to clarify when virtual currency activity constitutes money transmission can be read here.) Further, the risks associated with virtual currency from both a crime prevention and consumer protection standpoint are nearly identical to those commonly associated with more traditional MSB, consumer finance, credit card, and bank transactions. Thus, as the federal and state governments begin the process of regulating the virtual currency industry, it comes as no surprise that regulators are focusing on how virtual currency is used – as opposed to the virtual or digital nature of the thing itself – and will apply requirements commonly seen in the regulation of routine transactions in fiat currencies.
What is a “Virtual Currency” and what activities are regulated.
The proposed regulations broadly define “Virtual Currency” as follows:
Virtual Currency means any type of digital unit that is used as a medium of exchange or form of digitally stored value or that is incorporated into payment system technology. Virtual Currency shall be broadly construed to include digital units of exchange that (i) have a centralized repository or administrator; (ii) are decentralized and have no centralized repository or administrator; (iii) may be created or obtained by computing or manufacturing effort. Virtual Currency shall not be construed to include digital units that are used solely within online gaming platforms with no market or application outside of those gaming platforms, nor shall Virtual Currency be construed to include digital units that are used exclusively as part of a customer affinity or rewards program, and can be applied solely as payment for purchases with the issuer and/or other designated merchants, but cannot be converted into, or redeemed for, Fiat Currency.
See Proposed Rules at § 200.2(m). The proposed rules can be read in their entirety here.
New York’s proposed BitLicense would be required for any person engaging in “Virtual Currency Business Activity.” Such activity has been defined as follows:
Virtual Currency Business Activity means conduct of any one of the following types of activities involving New York or a New York Resident:
(1) receiving Virtual Currency for transmission or transmitting the same;
(2) securing, storing, holding, or maintaining custody or control of Virtual Currency on behalf of others;
(3) buying and selling Virtual Currency as a customer business;
(4) performing retail conversion services, including the conversion or exchange of Fiat Currency or other value into Virtual Currency, the conversion or exchange of Virtual Currency into Fiat Currency or other value, or the conversion or exchange of one form of Virtual Currency into another form of Virtual Currency; or
(5) controlling, administering, or issuing a Virtual Currency.
See Proposed Rules at § 200.2(n). However, merchants and consumers that utilize Virtual Currency solely for the purchase or sale of goods or services and those persons chartered under the New York Banking Law to conduct exchange services and approved to engage in Virtual Currency Business Activity need not require a license.
Anti-Money Laundering Program
The proposed regulations require that each proposed licensee establish and maintain an Anti-Money Laundering Compliance Program. The regulations focus on three main areas: 1) adequate recordkeeping of Virtual Currency Transactions; 2) verification of customer account holders utilizing a licensee’s services; and 3) the reporting of suspected fraud and illicit activity. Regarding recordkeeping, the regulations provide that licensee maintain the following information for all transactions involving “the payment, receipt, exchange or conversion, purchase, sale, transfer, or transmission of Virtual Currency”: 1) the identity and physical address of the parties involved; 2) the amount or value of the transaction; 3) the method of payment; 4) the date(s) on which the transaction was initiated and completed; and 5) a description of the transaction.
Further, as part of its AML program, each licensee must also “to the extent reasonable and practicable,” verify the customer’s identity and maintain a customer identification program. The regulations provide that such identification includes the customer’s name, physical address, and other identifying information including a check of the customer against the Specially Designated Nationals (“SDNs”) list maintained by the Office of Foreign Asset Control (“OFAC”) of the U.S. Department of the Treasury. The regulations also provide that licensees which maintain accounts for non-US Persons must establish enhanced due diligence procedures to protect against money laundering, including assessing the nature of the foreign business and the AML requirements and regimes of the foreign jurisdiction in which the foreign entity operates. Towards that end, the regulations also prohibit the maintenance of accounts for foreign shell entities.
In addition, the proposed regulations would also implement the equivalent of state level Currency Transaction Reports (“CTRs”) and Suspicious Activity Reports (“SARs”) filing obligations on virtual currency businesses. The proposed regulations provide that licensees are required to report to the Department all transactions or series of transactions in the aggregate amount of $10,000 in one day, by one person. The proposed regulations provide that, in addition to SAR filing obligations under federal law, virtual currency businesses would be required to immediately report suspicious transactions which might signal money laundering, tax evasion, or other illegal or criminal activity.
Cyber Security Requirements
The proposed regulations require that each virtual currency business maintain a cyber-security program designed to perform the following: 1) identify internal and external cyber risks; 2) protect the Licensee’s electronic systems from unauthorized access, use, and other malicious acts; 3) detect system intrusions, data breaches, and unauthorized access; and 4) respond to and recover from cyber security breaches and restore the system to normal operation. The proposed regulations also require that each virtual currency business designate a Chief Information Security Officer responsible for overseeing and implementing the Licensee’s cyber security program.
Consumer Protection Regulations
The proposed regulations present a broad array of consumer protection regulations. First, similar to other money services businesses, virtual currency businesses will be required to maintain minimum capital requirements in order to be granted and maintain a BitLicense. Although the precise capital/net worth requirements are not detailed, the regulations address a variety of factors, including anticipated volume of business, total assets versus total liabilities of a licensee, and whether the licensee is already licensed under the Financial Services, Banking or Insurance Laws of New York. The proposed regulations will also require that virtual currency businesses maintain a bond.
Second, the proposed regulations require that each virtual currency business must hold Virtual Currency of the same type and amount as any Virtual Currency owed or obligated to a third party. Towards that end, the selling, transferring, assigning, lending, pledging, or otherwise encumbering assets and Virtual Currency stored by a virtual currency business on behalf of another is strictly prohibited.
Third, the proposed regulations require that the virtual currency business provide “clear and concise disclosures” to its consumers about potential risks associated with Virtual Currency including that: 1) virtual currency is not a legal tender, not backed by the government, and accounts are not FDIC insured; 2) legislative and regulatory changes may affect the use, transfer, exchange, and value of Virtual Currency; 3) transactions in Virtual Currency are generally irreversible, therefore losses due to fraud or accidental transfer may not be recoverable; 4) the price of Virtual Currency vis-à-vis Fiat Currency is volatile and may result in significant losses or tax liabilities over short periods of time; and 5)the nature of Virtual Currency may lead to an increased risk of cyber-attacks.
Fourth, the proposed regulations require that each virtual currency business establish and maintain written complaint resolution policies and procedures. The proposed regulations further provide that virtual currency businesses must provide notice to customers, “in a clear and conspicuous manner,” that customers can bring complaints to the State Department of Financial Services’ attention for further review and investigation.
Finally, the proposed regulations require that virtual currency businesses provide its customers with a detailed receipt at the time of the transaction containing: 1) the licensee’s name and contact information; 2)the type, value, data, and precise time of the transaction; 3) the fee charged; 4) the exchange rate; 5) a statement of the refund policy; and 6) if applicable, a statement of the liability of the Licensee for non-delivery or delayed delivery.
Analysis and Conclusion
New York’s proposed BitLicense regime is the first in what will almost definitely be a growing trend of states attempting to regulate the growing area of virtual currency. While the regulations on their face appear vast, a majority of the requirements that New York seeks to impose on virtual currency businesses have been imposed for decades on money services businesses such as money transmitters, dealers of foreign exchange, check cashers, and payday lenders. However, the nature of virtual currency and the lack of “brick and mortar” institutions engaging in the virtual currency business raise unique challenges for federal regulators seeking to curtail money laundering and state regulators seeking to protect residents from unfair, deceptive, and unscrupulous business practices.
In accordance with the New York Administrative Procedures Act, the proposed rules are currently subject to a 45-day public comment period which began once the proposed regulations were published. At the close of the public comment period, the Department of Financial Services will review the public’s commentary and possibly revise the proposed regulations based on this feedback prior to finalization.