The New York Department of Financial Services (NYDFS) proudly announced an “update on [its] two-year transformational initiative to strengthen NYDFS’ nation-leading virtual currency oversight” on September 18, 2023. Although this milestone was the headline, the announcement also included significant new guidance in a number of key areas impacting virtual currency businesses that operate, or are thinking about operating, in New York. In particular, the new guidance describes NYDFS’ requirements for listing virtual currency tokens by companies in New York, including its expectations of extensive due diligence and compliance. The guidance also addresses requirements for a comprehensive coin delisting process if a coin is taken off platform voluntarily or by the NYDFS’ direction.

I. Why did NYDFS Issue this Announcement and Guidance?

NYDFS is serious when it describes itself as providing “nation-leading” oversight to the virtual currency industry, and it has the receipts to show it. On the federal level, for instance, FinCEN has a registration requirement that applies to virtual currency businesses that are money transmitters, but the registration process is a one-way street that does not involve or require any feedback or approval from FinCEN. New York, through NYDFS, was not only the first state to establish a comprehensive licensing regime specific to virtual currency with its Bitlicense, but no other federal or state regulatory body has taken a more proactive and engaged approach to oversight of virtual currency companies.

With this new guidance, NYDFS is using its administrative processes to document rules and expectations it is already implementing on a daily basis for companies currently under its supervision.

II. Who Does the Guidance Apply To?

The guidance applies to entities (a) licensed under New York’s Virtual Currency Law, 23 NYCRR Part 200, also known as Bitlicenseees, or (b) chartered as a limited purpose trust company under the New York Banking Law (“Virtual Currency Entities”). This includes entities performing exchange services, controlling, administering, or issuing virtual currency, buying and selling virtual currency as a business, and maintaining custody or control of virtual currency on others’ behalf.

III. What Changes Are there to the Greenlisting Process?

In light of events in the crypto market over the last year, NYDFS is implementing its safety and soundness mandate by significantly curtailing its Greenlist, which is a list of tokens it had established in 2020 as being subject to being listed by licensed virtual currency entities in New York with fewer administrative hurdles. With its new guidance, NYDFS has trimmed the Greenlist to what it considers lower risk coins, eliminating tokens of a variety of well-known crypto projects, and leaving only BTC, ETH, and a few stablecoins that are directly overseen by NYDFS. Consistent with the original guidance, virtual currency entities do not have to obtain NYDFS’ prior approval to list Greenlisted coins, unless NYDFS expressly informs them otherwise. As before, virtual currency entities are required to provide NYDFS advance notice prior to supporting a new coin. Now, however, virtual currency entities must also have a NYDFS-approved coin-delisting policy.

While this new Greenlist coin guidance supersedes the old framework and went into effect upon publication (i.e., September 18, 2023), virtual currency entities who have been operating per the former guidance are not required to immediately delist coins that are no longer on the Greenlist. Rather, NYDFS has discretion to require that a coin listed by a particular virtual currency entity be delisted and promises to work with its licensees to delist coins gradually so as to mitigate market disruption.

IV. What New Requirements Apply to the Listing of Coins?

NYDFS requires that virtual currency entities maintain a coin-listing policy, under which the virtual currency entity can self-certify and list a coin without the agency’s prior approval but with prior notice. Per the proposed guidance, a Bitlicensee’s coin-listing policy must include comprehensive procedures that address all steps involved in the review and the approval of coins to ensure its compliance with NYDFS guidance and consumer protection principles. In addition, the policy must also be tailored to the individual virtual currency entity and the specific coin and be integrated into the virtual currency entity’s overall risk and compliance framework (e.g., verify that independent testing includes coin-listing and coin-delisting in its scope as part of annual planning). These requirements were present in the original guidance, but the new guidance prescribes more specific, detailed governance, risk assessment, and monitoring obligations and inserts additional layers of NYDFS scrutiny.

NYDFS’ new guidance codifies its existing expectations by requiring a coin-listing policy to, at a minimum, address the following:

a) Governance measures, including:

i. Designation of either the board of directors or other equivalent “governing authority” with responsibility for approval of a coin-listing policy. The new guidance now requires formal delegation of this approval to such a governing authority and assurance that the governing authority is independent from those who make initial recommendations of whether to list or delist a coin;

ii. Recordkeeping policies ensuring that decisions made by the governing authority regarding the listing and delisting of coins are properly documented and retained. These records must be made readily available for NYDFS’s review at all times;

iii. The continued requirement to obtain prior NYDFS approval for material changes to coin-listing policies; and

iv. Self-reporting to NYDFS if a NYDFS-approved coin listing policy fails to comply with the new guidance.

b) Development of a particularized risk assessment for each listed coin, covering (a) technical design and technology, (b) impact on the operations of the virtual currency entity, (c) IT/cybersecurity, (d) market and liquidity, (e) illicit finance, (f) legal, (g) reputational, (h) regulatory, (i) conflicts of interest, and (j) consumer protection risks. These risk assessments must incorporate NYDFS’ “Guidance on Prevention of Market Manipulation and Other Wrongful Activity,” which requires virtual currency entities to develop policies and procedures for monitoring, detecting, and addressing fraud or other wrongdoing.

c) Monitoring, including a tailored annual reevaluation to identify material changes, controls to manage risks such as cyber security and illicit activity risks, and coin-delisting process. In addition, virtual currency entities must (i) ensure that their coin-listing policies are integrated into their risk and compliance framework and (ii) comply with regulatory reporting obligations, BSA/AML and sanctions-related control requirements, and NYDFS’ “Guidance on Use of Blockchain Analytics.”

V. What Coins Does NYDFS Exclude from the Self-Certification Process?

NYDFS considers a material change in business by now requiring prior approval (not just notice) for listing the following coins:

a) So-called “privacy coins” (referred to as “Anonymity Enhanced Coins” or “AECs” by FinCEN), which are cryptocurrencies that preserve anonymity by obscuring the flow of money across their networks; and

b) Non-Greenlisted stablecoins, exchange coins native to a cryptocurrency exchange, any coin that is the native asset for a protocol where there are concerns related to the protocol’s decentralization or ownership concentration; bridged coins; and coins with circulating supply of less than 35% of total publicly available supply.

VI. What Is the New Requirement Related to Delisting?

All NYDFS Bitlicensees must now have a specific delisting policy and procedure applicable to coins they list in the event the licensee independently decides to delist a coin, or NYDFS directs them to do so. This requirement applies regardless of whether a virtual currency entity maintains a coin-listing policy for self-certification purposes. NYDFS expects a coin-delisting policy to, at a minimum, address:

a) Governance principles consistent with the coin-listing policies guidance, including notification to NYDFS of a decision to delist a coin at least 10 days prior to informing customers;

b) Process and Procedures applicable to a delisting event, including the identification of who has authority to make, review, and approve delisting decisions; ongoing monitoring procedures, including periodic review to consider changes in currently supported coins; and criteria that may prompt a delisting; and

c) Proper Execution, including providing customers with at least 30 days’ prior written notice of a delisting decision; establishing sufficient customer support during delisting, documenting all key details relating to the delisting decision, and conducting an impact analysis.

Virtual currency entities are required to meet with NYDFS by December 8, 2023, to discuss their draft coin-delisting policy and to submit their policy to NYDFS for review and approval by January 31, 2024.

VII. When does the Guidance Go into Effect?

The new guidance is immediately effective, although the proposed guidance relating to coin-listing and coin-delisting policies could be subject to change after the public comment period ending on October 20, 2023.

[View source.]