The CRPTO Act is intended to increase transparency and consumer protections, and reduce conflicts of interest, through heightened disclosures and penalties.

On May 5, 2023, New York Attorney General (NYAG) Letitia James introduced a bill that, if passed, would increase New York’s oversight of digital assets market activity.[1] The Crypto Regulation, Protection, Transparency and Oversight Act (the CRPTO Act, or the Bill) would provide the NYAG’s office with greater enforcement powers to police the digital asset industry. It would also expand the New York Department of Financial Services’ (NYDFS’s) authority to regulate individuals and businesses engaging in digital asset transactions. The CRPTO Act comes on the heels of several high-profile enforcement actions by the NYAG against digital asset businesses.

The CRPTO Act creates five classifications for commercial actors engaged in the sale, trade, and promotion of digital assets:

1. Digital Asset Issuers (Issuers) create, issue, or offer to issue a digital asset to the public that “is directly or indirectly for speculation[,] investment purposes or for use as a currency, medium of exchange, a form of digitally stored value, a unit of account or any combination thereof and not for consumption by the offeree or purchaser.”
2. Digital Asset Brokers (Brokers) effect transactions in digital assets on behalf of others.
3. Digital Asset Marketplaces (Marketplaces) are providers of, or substantial participants in (or any system that provides), a marketplace or facilities for connecting purchasers and sellers of digital assets.
4. Digital Asset Investment Advisers (Investment Advisers) engage in the business of advising members of the public, either directly or through publications or writing, on the value of digital assets and the advisability of investing in digital assets.[2]
5. Digital Asset Influencers (Influencers) are those that widely encourage investment in a digital asset while not purporting to offer the digital asset for sale, receive compensation of any sort, or own (or expect to own) such digital asset, unless such ownership (or expected ownership) amounts to less than $25,000 in value.[3]

Jurisdiction

The CRPTO Act applies to persons or entities engaged in digital asset activities from or within New York State. The scope of jurisdiction for the CRPTO Act should therefore be contrasted with the BitLicense under Title 200 of the state’s Regulations of the Superintendent of Financial Services (23 N.Y.C.R.R. § 200 Virtual Currencies), which states that “no person shall engage in any virtual currency business activity without a license obtained from [the NYDFS].” Virtual currency business activity is defined in the BitLicense regulation as the conduct of certain digital asset activities[4] “involving New York or a New York resident.”

Obligations and Restrictions for Commercial Actors

If the Bill is enacted, “it shall be illegal and prohibited for any person or affiliate to act as more than one” of the first four categories listed above (Issuer, Broker, Marketplace, or Investment Adviser). There is nothing in the CRPTO Act prohibiting an entity from acting in one capacity while also affiliating with an entity acting in another capacity. The prohibition appears to be on a single entity acting in multiple capacities, with potential conflicts of interest.

The prohibition on functioning in multiple capacities may be a significant challenge to the business models of digital asset firms currently in operation, but it does not apply to banks[5] if the bank is not primarily a digital asset Issuer, Broker, or Investment Adviser. A bank, however, may not act as a digital asset Issuer, Broker, or Investment Adviser if it is also acting as a digital asset Marketplace. Finally, a bank acting as a digital asset Broker may not transact in any digital asset it has issued.

The definition of Marketplaces, as it captures “any system that provides…a marketplace or facilities for bringing together purchasers and sellers of digital assets,” may encompass decentralized finance (DeFi) exchanges.

General Obligations

The CRPTO Act introduces a number of registration, reporting, disclosure, custody, and audit requirements that vary depending on how a commercial actor is classified.

• Issuers, Brokers, Marketplaces, and Investment Advisers must file a registration statement with the New York State Department of Law “prior to engaging in business within or from New York.”
• Issuers, Brokers, Marketplaces, and Investment Advisers cannot act as, employ, or use the services of any proprietary trading agent,[6] and such entities must publicly post a certification of compliance to this prohibition. Banks are exempt from this requirement, subject to the conditions noted above.
• Issuers, Brokers, Marketplaces, and Investment Advisers must maintain an anti-money laundering program in accordance with applicable state and federal laws and regulations, as well as a know-your-customer program that is defined by “reasonable diligence in regard to the opening and maintenance of every account.”
• Brokers must obtain and maintain physical possession or control of all digital assets that are held by the Broker for customers, with access to such accounts restricted to authorized persons only.
• Investment Advisers may not take physical possession or control of a customer’s digital assets, and a Marketplace may do so only to execute a specific transaction.
• Brokers may not “borrow, lend, rehypothecate, or in any way encumber” any customer’s digital assets.
• Issuers may not issue any note or other debt instrument that offers interest or similar expected payment and is payable on demand (or otherwise has the features of a demand deposit), except if issued as a note or debt instrument to a lender in a commercial transaction.
• Brokers may not transact for their own account or effect cross-transactions.
• Issuers, Brokers, Marketplaces, and Investment Advisers must undergo annual independent audits of their financial statements and must make those audited financial statements publicly available.
• Brokers must disclose to their customers the source of any fees received prior to effecting a transaction on behalf of a customer, and Marketplaces must disclose in a public schedule all sources of fees related to facilitating digital asset transactions.
• Brokers may not recommend or refer any person to any digital asset investment adviser or digital asset issuer if the Broker receives any economic benefit for doing so, potential or actual, directly or indirectly.
• Issuers, Brokers, Marketplaces, and Investment Advisers must create, implement, and maintain an effective cybersecurity program that satisfies the requirements of applicable state and federal data privacy and cybersecurity laws and regulations.
• Brokers must maintain net capital that meets the standards for brokers and dealers under the Securities and Exchange Act of 1934 and any applicable New York State laws, rules, and regulations.
• Issuers must publish and distribute a prospectus for any digital asset issued, containing a description of its business, financial condition, results of operations, risk factors, conflicts of interest, management identities, and financial statement schedules.
• Brokers and Marketplaces that effect an off-chain transaction must publicly publish (and permanently store in a location available to the public) the price and volume of the transaction within 10 seconds of such transaction, without identifying the parties to the transaction.
• Investment Advisers cannot operate if insolvent.

Anti-Fraud

• Issuers, Brokers, Marketplaces, and Investment Advisers must observe high standards of commercial honor and just and equitable principles of trade in the conduct of their business.
• No one may make unreasonable prospective promises or representations about a digital asset in connection with an offer or sale.
• No one may make an untrue statement, or omit a material fact to make a statement not misleading, in connection with an offer or sale of a digital asset.
• No one may engage in wash trading, prearranged trading, market manipulation, or insider trading, whether directly or indirectly.
• Brokers and Marketplaces must establish, maintain, and enforce written policies and supervisory systems reasonably designed to prevent market manipulation, wash trading, prearranged trading, insider trading, or any other fraudulent trading.
• Brokers, Marketplaces, and Investment Advisers may not refer to a digital asset as a stablecoin, or suggest a digital asset is similar to a stablecoin, unless that digital asset maintains a 1:1 ratio between the digital asset and the US dollar at all times.
• Influencers must file a registration statement disclosing a raft of information (including ownership interest, compensation, and conflicts of interest) with the Department of Law 10 days prior to any digital asset promotion, unless they are promoting their own digital asset. The information must be updated at least annually.

Treatment of Unauthorized Digital Asset Transfers

Perhaps the most significant aspect of the CRPTO Act is its treatment of unauthorized transfers of digital assets. Unauthorized transfers are defined as:

1. any transaction effected without the customer’s actual authorization, including when the password or private key has been used, so long as the customer receives no benefit; or
2. any transaction effected with the customer’s authorization due to fraudulent inducement by a third party, including by an Issuer, Broker, Marketplace, or Investment Adviser.

Under the CRPTO Act, Brokers and Investment Advisers would be required to provide disclosures to customers detailing the customers’ liability for an unauthorized trade as well as the means of contacting the Broker or Investment Adviser’s agent to report an unauthorized trade. Without this disclosure, customers could not be liable for unauthorized trades. Furthermore, Brokers and Investment Advisers, in disputes over the authorization of a sale or transfer, would bear the burden of proof to demonstrate that an unauthorized transfer was actually authorized.

Customers would be able to limit their liability by reporting an unauthorized transfer to their Broker or Investment Adviser. The earlier a customer notifies its Broker or Investment Adviser of an unauthorized transfer, the more liability may be limited.

Crucially, if a customer’s liability were limited, the Broker or Investment Adviser would be required to reimburse the customer for the balance of its loss.

Enforcement and Penalties

The CRPTO Act would grant the NYAG enforcement authority over the provisions of the Bill “through any means available,” and the NYAG would also be authorized to promulgate rules and regulations relating to the Act. Violations of the CRPTO Act could lead to civil penalties as high as $10,000 per violation by a person, and $100,000 per violation by a business.

The NYDFS would continue to supervise persons or businesses that register to transact in digital assets with the Department of Law under the NYDFS’s BitLicense regime. However, the CRPTO Act, if enacted into law, would codify the NYDFS’s BitLicense regulation. It would also expand the NYDFS’s authority under 23 N.Y.C.R.R. § 200.13 (Examinations) to permit the NYDFS to examine not only BitLicensees, but also those entities filing a digital asset registration statement with the Department of Law. Entities “shall permit and assist” the NYDFS to conduct an examination “as if such digital asset [Issuer, Broker, Marketplace, or Investment Adviser] were a licensee under [the NYDFS BitLicense regulation].”

Tax Code Update

The CRPTO Act would update the New York tax code so that any business operating in the state would be required to report to the state Department of Taxation and Finance the receipt of any digital asset as payment for any goods or services of over $5,000 from any person in New York, including details as to the payer.

Securities or Commodities?

The CRPTO Act does not take a clear stance on whether digital assets are considered securities or commodities for purposes of New York law.

Takeaways

If passed, the CRPTO Act would mark a significant step in New York’s regulation of the sale and trade of digital assets. The CRPTO Act seeks to prevent the alleged conflicts of interest, self-dealing, and fraud at the heart of several recent high-profile digital asset market collapses and enforcement actions against digital asset businesses. Supporters have praised the Bill as having the potential to bring much-needed transparency and accountability to the sector. Critics, however, maintain that the CRPTO Act would effectively extend New York’s broadly empowering anti-fraud law (the Martin Act) to encompass digital assets. As such, the Bill may further drive market participants to consider other jurisdictions with less onerous licensing, operating, and enforcement regimes.

Finally, while federal legislation related to digital assets remains in the discussion stages, it is possible that state legislation such as the CRPTO Act will not be completely preempted by federal law. Bills such as this one could therefore have lasting implications.

The NYAG may submit the Bill to the New York State Senate and Assembly in the coming weeks (the current legislative session ends on June 8, 2023). The Bill, however, must be introduced by a Senator or an Assembly member, and the CRPTO Act does not yet appear to have a sponsor.

Latham & Watkins will continue to monitor and report on the CRPTO Act’s legislative progress.

This post was prepared with the assistance of Sam Taylor.

Endnotes

[1] The CRPTO Act defines “digital asset” as any type of digital unit, whether labeled as a cryptocurrency, coin, token, virtual currency, or otherwise that can be used as a medium of exchange, a form of digitally stored value, or a unit of account. Exempt from the Act are digital units used solely within gaming platforms that have no market or application outside such gaming platform and cannot be exchanged for fiat currency; customer affinity or rewards programs; as part of prepaid cards; in sports wagering and mobile sports wagering; and that provide an equity interest in a business.

[2] The CRPTO Act enumerates multiple exemptions to this category, including “(a) a lawyer, accountant, engineer, or teacher whose performance of digital asset investment adviser services is solely incidental to the practice of this profession; (b) a digital asset broker whose performance of digital asset investment adviser services is solely incidental to the conduct of his or her business as a digital asset broker and who receives no special compensation for them; (c) a publisher of any bona fide newspaper or news magazine of general distribution; (d) a person who sold, during the preceding twelve-month period, digital asset investment advisory services to fewer than six persons residing in this state; or (e) a person who is registered under section 203 of the Investment Advisers Act of 1940, 15 U.S.C. § 80b et seq., but only to the extent that such person acts in such capacity.”

[3] Newspaper or magazine publishers of general distribution are exempted from this definition.

[4] Activities in scope for BitLicense registration include:

• receiving virtual currency for transmission or transmitting virtual currency, except where the transaction is undertaken for non-financial purposes and does not involve the transfer of more than a nominal amount of virtual currency;
• storing, holding, or maintaining custody or control of virtual currency on behalf of others;
• buying and selling virtual currency as a customer business;
• performing exchange services as a customer business; or
• controlling, administering, or issuing a virtual currency.

[5] Defined in New York General Business Law § 359-e as a state or national bank, trust company or savings institution incorporated under the laws and subject to the examination, supervision and control of any state or of the United States or of any insular possession thereof.

[6] Defined as any person who engages in the business of offering, buying, or selling digital assets for the benefit of the account of a digital asset Issuer, Broker, Marketplace, or Investment Adviser.