Digital asset activities of licensed institutions must be approved and will be assessed for potential safety and soundness risks.

On December 15, 2022, the New York State Department of Financial Services (NYDFS) issued final guidance to covered institutions engaging in (or seeking to engage in) virtual currency-related activity (the Guidance). Such covered institutions are New York “banking organizations” — New York-chartered banks, trust companies, private bankers, savings banks, safe deposit companies, savings and loan associations, credit unions, and Article XII investment companies — and NYDFS-licensed branches and agencies of non-US banks.

The Guidance reminds covered institutions that their virtual currency activities are exempt from the New York BitLicense regime only if the institutions obtain NYDFS approval for them. The Guidance instructs covered institutions to seek such approval at least 90 days before engaging in new or significantly different virtual currency-related business activity, including if any portion of those activities involve a third party. The Guidance reflects the NYDFS’ concerns with the potential risks of virtual currency-related business activity on institutions, consumers, and the wider financial markets.

Virtual currency business activity includes:

• receiving virtual currency for transmission or transmitting virtual currency (except when the transaction is undertaken for non-financial purposes and does not involve the transfer of more than a nominal amount of virtual currency);
• storing, holding, or maintaining custody or control of virtual currency on behalf of others;
• buying and selling virtual currency as a customer business;
• performing exchange services as a customer business; and
• controlling, administering, or issuing a virtual currency.

In addition, NYDFS considers the following activities to be virtual currency-related activities also requiring prior approval:

• Offering digital wallet services to customers, whether the services are in fact provided by the covered institution or by a third party with which the covered institution has contracted
• Lending activities collateralized by virtual currency assets
• Activities in which a covered institution facilitates its own customers’ participation in virtual currency exchange or trading, including by carrying fiat currency on behalf of customers (e.g., in an omnibus account)
• Services related to stablecoins, including providing stablecoin reserve services for stablecoin issuers
• Engaging in traditional banking activities involving virtual currency through the use of new technology that exposes the covered institution to different types of risk (e.g., underwriting a loan, debt product, or equity offering effected partially or entirely on a public blockchain)

NYDFS Superintendent Adrienne A. Harris stated that the Guidance “is critical to ensuring that consumers’ hard-earned money is protected, that New York regulated banking organizations remain resilient and competitive, and that the expectations are clear for those that wish to submit proposals for virtual currency-related activity.”

Key Review Areas

Information sharing is critical to NYDFS’ review of any proposal for virtual currency-related activity, and covered institutions should prepare a written submission that includes the following information:

• Business Plan: A comprehensive description of the proposed activity, including any contemplated phases and milestones; business rationale; costs and revenue targets; target customer base and expected fees to be charged; roles and responsibilities; relation to the institution’s strategic initiatives and enterprise-wide risk management framework; and alignment with the institution’s legal and compliance framework.
• Risk Management: A thorough account of the covered institution’s enterprise-wide risk-management framework to identify, measure, monitor, and control all risks arising from or related to the proposed virtual currency-related activity, in line with board-approved risk appetite. Submissions should include information regarding operational risk; credit risk; market risk; capital risk; liquidity risk; cybersecurity and fraud risk; technology risk; third-party service provider risk; legal and compliance risk; financial crimes and sanctions risk; reputational risk; and strategic risk.
• Corporate Governance and Oversight: A description of the corporate governance framework, including the internal product development and approval by the board or senior management; an explanation of the board and senior management’s adequate understanding and knowledge of the risks associated with the proposed activity; allocation of roles and responsibilities, as well as resources to manage associated risks; an explanation of the integration of risks in the institution’s risk appetite framework, including limits and thresholds, and an escalation process; and clear lines of responsibility for monitoring and adhering to policies and procedures.
• Consumer Protection: An analysis of how much the proposed virtual currency-related activity will impact customers and other users; policies and procedures relating to customer protection; and sample agreements applicable to customers and other users, including all relevant terms and conditions, disclosures, acknowledgements, and marketing materials. This requirement aims to ensure the protection of a covered institution’s customers from unfair, deceptive, or abusive practices.
• Financials: An explanation of the expected impacts of the proposed activity on the institution’s capital and liquidity.
• Legal and Regulatory Analysis: A thorough analysis of all relevant laws and regulations; the permissibility of the proposed activity; and key legal risks and mitigants.

The Guidance also includes a detailed checklist of relevant documents and information related to the six review areas noted above that a covered institution should consider providing to NYDFS in its written submission.

New York Leads the Pack in Crypto Oversight

Currently, only the NYDFS has a state licensing regime specifically focused on virtual currency business activity, but several other states appear to be following its lead. Louisiana recently issued proposed regulations to implement a similar regime, which should be finalized and implemented by summer 2023. California’s legislature enacted a law that would create a similar licensing scheme to New York’s, but that bill was vetoed by Governor Gavin Newsom.

On a separate but related note, Harris was appointed to serve as the state banking representative on the Financial Stability Oversight Council (FSOC). FSOC brings together the various heads of the federal agencies overseeing financial institutions, as well as five non-voting members in an advisory capacity. It is tasked with facilitating regulatory coordination and managing risk in the US financial system. State bank supervisors noted Harris’ background and experience at both the federal and state levels as an asset to FSOC “as it manages emerging risk.” FSOC itself has been actively involved in overseeing the digital asset industry. In October 2022, issued a Report on Digital Asset Financial Stability Risks and Regulation pursuant to President Biden’s March 9, 2022, Executive Order on Ensuring Responsible Development of Digital Assets (see this Latham blog post for more information). Most recently, in its 2022 Annual Report, FSOC issued (or reiterated) the following recommendations for the regulation of the digital asset markets:

• Congress should pass legislation that provides for explicit rulemaking authority for federal financial regulators over the spot market for cryptoassets that are not securities.
• Member agencies should continue to coordinate and drive legislation addressing the (i) risks posed by stablecoins; (ii) regulatory authority to have visibility into and supervise the activities of all of the affiliates and subsidiaries of crypto-asset entities; and (iii) appropriate service provider regulation.
• Member agencies should assess the impact of potential vertical integration by crypto-asset firms.
• Member agencies should continue to build capacities related to data and the analysis, monitoring, supervision, and regulation of crypto-asset activities.

The Guidance is effective immediately and is subject to further updates as the NYDFS sees fit. Covered institutions that are involved in virtual currency activity but have not received appropriate approvals are advised by the Guidance to contact the NYDFS without delay.