The Guidance clarifies the regulator’s expectations on safekeeping customer digital assets, and the disclosures that must accompany such arrangements.

On January 23, 2023, the New York Department of Financial Services (NYDFS) published Guidance on Custodial Structures for Customer Protection in the Event of Insolvency (the Guidance). It guides virtual currency entities (VCEs) acting as custodians (VCE Custodians) on how to appropriately custody customer assets and properly disclose such holdings and arrangements. Issued in the wake of numerous connected crypto industry insolvencies that imperiled customer assets and funds due to commingling and rehypothecation, the Guidance instructs VCEs to put customer protection first. The NYDFS emphasized “the paramount importance of equitable and beneficial interest always remaining with the customer.”

The Guidance is addressed to VCE Custodians that are either licensed under New York’s BitLicense regulation (23 NYCRR Part 200) or New York state-chartered limited purpose trust companies (Regulated VCE Custodians), but reads as a broad statement of policy.

BitLicenses

Persons that are not NYDFS- or OCC-chartered banking entities with permission from their supervisors (or that are otherwise exempted merchants/consumers) can conduct virtual currency business activity in the state in two ways. They can either apply for a BitLicense, or pursue a limited purpose trust company charter under the New York Banking Law with approval to conduct such activities. According to the NYDFS, BitLicenses “ensure that New Yorkers have a well-regulated way to access the virtual currency marketplace and that New York remains at the center of technological innovation and forward-looking regulation.”

New York regulation expects BitLicensees (as well as limited purpose trust companies engaged in digital asset activity) to, among other things:

Custody services may include storing, holding, or maintaining custody or control of digital assets on behalf of others. The Guidance gives additional clarity to Regulated VCE Custodians regarding the following practices:

Segregation of and Separate Accounting for Customer Digital Assets

The Guidance expects a VCE Custodian to:

• separately account for and segregate customer digital assets from the custodian’s corporate assets (both on-chain and on internal ledger accounts);
• clearly and prominently disclose how it segregates and accounts for customer digital assets;
• not comingle customer digital assets with any of the custodian’s (or non-customer’s) digital assets;
• maintain customer digital assets in either (i) separate on-chain wallets and internal ledger accounts for each customer, or (ii) one or more omnibus on-chain wallets and internal ledger accounts that contain only digital assets of customers held under the custodian’s name as agent or trustee for the benefit of those customers;
• maintain appropriate records and a clear internal audit trail to identify customer digital assets;
• account for all customer transactions, always keeping each customer’s beneficial interest clear and up-to-date;
• maintain clearly documented policies and procedures regarding the aforementioned safeguards; and
• demonstrate (at the request of NYDFS) reconciliation between the custodian’s books and records and on-chain activity.

Custodian’s Limited Interest in and Use of Customer Digital Assets

The Guidance expects a VCE Custodian to:

• only carry out custody and safekeeping services for digital asset depositors, and not establish a debtor-creditor relationship;
• structure custodial arrangements in a manner that preserves the customer’s equitable and beneficial interest in the customer’s digital assets;
• treat customer digital assets in its possession or control as belonging solely to customers, and not employ such digital assets for any other purpose (e.g., for loans, collateral, credit, working capital, etc.); and
• act upon the instructions of their customers (or authorized representatives) and not acquire general discretion over custodied assets beyond those terms clearly expressed in the applicable customer agreement.

Sub-Custody Arrangements

A VCE Custodian may elect to engage a sub-custody arrangement with a third party to safekeep the customer’s digital assets, with the following conditions:

• The custodian conducts appropriate due diligence before entering the third-party arrangement;
• The arrangement is fully consistent with the Guidance; and
• The NYDFS pre-approves the arrangement, as a material business change, after reviewing the custodian’s risk assessment, proposed service agreement, and updated policies and procedures (reflecting the processes and controls to be implemented around the proposed arrangement).

Customer Disclosure

The Guidance expects a VCE Custodian to:

• clearly disclose to each customer in writing the general terms and conditions associated with its products, services, and activities;
• obtain acknowledgment of receipt of such disclosure prior to entering into any transaction with the customer;
• clarify in any customer agreement the custodial nature of the relationship, rather than stating or implying a debtor-creditor relationship;
• clearly disclose how it segregates and accounts for customer digital assets, the property interest that the customer retains in custodied assets, how the custodian may use custodied assets, and any applicable limitations on the custodian’s use of customer assets;
• clearly disclose any third-party sub-custody arrangements, as well as the terms and material risks of such arrangements; and
• make standard disclosures and customer agreements readily accessible to customers on the custodian’s website.

Takeaways

The NYDFS issued the Guidance just weeks after publishing final guidance to covered banking organizations engaging in (or seeking to engage in) virtual currency-related activity in New York State, in which key review areas are enumerated (see this Latham blog post for more information).

The Guidance appears to be part of the NYDFS’ broader push to clarify expectations for digital assets and to elevate the NYDFS’ status as the preeminent digital asset regulator in the US in the continued absence of a comprehensive federal regulatory scheme.