The New York State Department of Financial Services (NYDFS) recently issued its final BitLicense regulations with respect to Bitcoin and other virtual currencies. The new regulations require the licensing of, and establish minimum standards of conduct for, any person who engages in a virtual currency business activity involving New York or a New York resident.^[1]

The regulations impact a wide spectrum of potential businesses, although they exclude merchants and consumers who use virtual currencies in connection with transactions for goods or services, persons chartered under the New York Banking Law and approved to engage in a virtual currency business activity, and persons who engage in the mere "development and dissemination of software in and of itself."^[2] Although not specified in the regulations, public statements by NYDFS officials have indicated that operators of hardware relating to network infrastructure (e.g., miners or node operators) are not required to register based on such activities alone.

This release marks the third and final revision of the regulations, which initially were proposed in July 2014. The final regulations are the first formal attempt by any state or federal regulator in the United States to expressly regulate the virtual currency business, although several other states are contemplating regulatory activities and the Conference of State Bank Supervisors proposed a model framework for such regulation.^[3]

In general, the new regulations require all persons engaging in a virtual currency business to apply and obtain a BitLicense, and to maintain certain minimum standards and programs to help ensure customer protection, cyber-security and anti-money laundering compliance. Financial intermediaries that already are regulated by NYDFS under the New York Banking Law (e.g., money transmitters and banking institutions) are not required to obtain a BitLicense if they are approved by NYDFS under their existing regulation to conduct virtual currency business activity.^[4]

Firms potentially covered by the new regulations are required to apply and receive a BitLicense prior to commencing operations. Existing firms must apply for a BitLicense within 45 days after the effective date of the regulations. The effective date has not yet been determined.

Specific Requirements

Under the new regulations, persons engaging in a virtual currency business should be mindful of the following:

• Applicability. The regulations are designed to apply only to persons that are acting as financial intermediaries. Software developers, virtual currency miners and other innovators are not required to obtain a BitLicense unless their activities fall under the definition of virtual currency business activity, which is broadly defined and includes:

  According to departing NYDFS Superintendent Benjamin Lawsky, the regulations are intended to extend only to firms that are holding onto customer funds,^[5] although a strict reading of the regulations permits a broader scope. Specifically, unless exempted, any firm that engages in virtual currency business activity is required to obtain a BitLicense.

  It remains unclear to what extent duplicative regulatory requirements will be mitigated, although Superintendent Lawsky has expressed concern with the need to prevent an undue burden on financial institutions and virtual currency firms.^[6]

  • receiving or transmitting currency, except where the transaction is undertaken for non-financial purposes and does not involve the transfer of more than a nominal amount;

  • storing, holding, or maintaining custody or control of virtual currency on behalf of others;

  • buying and selling virtual currency as a customer business;

  • performing exchange services as a customer business; or

  • controlling, administering or issuing a virtual currency.

• Exemptions. Two types of entities are formally exempted from the requirement to obtain a BitLicense:

  Although not clarified in the final BitLicense proposal, NYDFS is expected to require entities chartered and regulated under the New York Banking Law to satisfy substantive requirements of the BitLicense as a part of the approval process to engage in virtual currency business activity.^[7]

  • any entity that is chartered under the New York Banking Law and is approved by the superintendent; and

  • merchants and consumers that utilize virtual currency solely for the purchase or sale of goods or services or for investment purposes.

• Virtual Currencies. What constitutes a virtual currency under the new regulations is extremely broad and includes any type of digital unit that is utilized as a medium of exchange or as a form of digitally stored value. However, virtual currencies do not include certain digital units that are used solely with online gaming platforms or as a part of a customer affinity or rewards program (with some restrictions), or that are used as part of prepaid cards.

• New Business. If a firm with a BitLicense proposes to materially amend its business to offer a new product or service, or engage in a new activity, it must obtain pre-approval by the NYDFS. This provision in the final regulations is a change from earlier versions where NYDFS pre-approval for a broader spectrum of changes was proposed. Specifically, according to Superintendent Lawsky, in remarks heralding the release of the final regulations, virtual currency firms will not need to continually receive approval for standard software or applications updates. Moreover, firms will not need prior approval from the NYDFS for every new round of venture capital funding.^[8]

• Anti-Money Laundering. In addition to any applicable federal requirements, including those required by the USA PATRIOT Act of 2001 and the Bank Secrecy Act of 1970^[9], each holder of a BitLicense must comply with additional New York State anti-money laundering (AML) requirements, such as:

  BitLicensees that are now required to file suspicious activity reports (SARs) with federal regulators, such as the Financial Crimes Enforcement Network (FinCEN) will not have to file the same report with New York State regulators. However, BitLicense holders that are not subject to reporting requirements under federal law must file SARs with the NYDFS.

  Additionally, each virtual currency firm must:

  • conducting an initial risk assessment of its activities or services followed by additional risk assessments on an annual basis;

  • maintaining an internal control system to ensure compliance with AML; and

  • providing for independent testing for compliance with the AML program.

  • designate an individual or individuals to be responsible for day-to-day compliance with the AML program;

  • draft and implement written AML procedures;

  • provide training for personnel to ensure they understand the new requirements and can sufficiently report and maintain records in accordance with the law; and

  • record and maintain pertinent information in connection with the payment, receipt, exchange, conversion, purchase, sale, transfer or transmission of virtual currency.

• Cyber-security. BitLicensees also are required to establish and maintain a cyber-security program. Specifically, firms must:

  These express requirements related to cyber-security include among the first express requirements — beyond best practice guidelines — imposed on broker-type intermediaries in financial services businesses. NYDFS Superintendent Lawsky has publicly stated that the cyber-security requirements in the BitLicense are a precursor to more robust requirements for other financial entities regulated by the NYDFS.^[10]

  • implement a written cyber-security policy that details their policies and procedures for protection of its systems and sensitive data stored on those systems;

  • conduct penetration testing of its electronic systems, at least annually, and vulnerability assessment of those systems, at least quarterly; and

  • appoint a chief compliance officer responsible for overseeing and implementing this program.

• Minimum Capital. BitLicensees must maintain sufficient capital in such amounts that are acceptable to the NYDFS. There is no set minimum. In establishing a minimum amount for a firm, the NYDFS may consider:

  Each licensee also is required to submit to the NYDFS quarterly financial statements within 45 days following the close of the licensee's fiscal quarter. Lastly, licensees must submit audited annual financial statements certified by a public accountant

  • the licensee's total assets and liabilities;

  • actual and expected volume of the licensee's business activity;

  • whether the licensee is already licensed or regulated by the superintendent under other laws;

  • amount of leverage employed by the licensee;

  • liquidity position of the licensee;

  • financial protection that the licensee provides its customers through its trust account or bond;

  • types of entities to be serviced by the licensee; and

  • the types of products or services to be offered by the licensee.

• Customer Protection. BitLicensees are subject to disclosure requirements for consumer protection. Such firms are required to:

  • disclose all material risks associated with its products, services and activities;

  • disclose all relevant terms and conditions associated with its products, services and activities when opening an account for a new customer; and

  • prior to each transaction, disclose the terms and conditions of the transaction.

• Recordkeeping. BitLicensees must comply with strict books and record requirements. For example, each licensee is required to preserve all of its books and records in their original or native file format for a period of at least seven years.

Application. To apply for a BitLicense, applicants must fill out a form prescribed by the superintendent, in writing and under oath, and submit an application fee of $5,000.

Applications for a BitLicense require extensive information about the applicant and its principals. Among the required information is a description of the firm's proposed business activities, all relevant written policies and procedures, fingerprints and a third-party-prepared background report on each principal. Fingerprints and a photograph also will be required for each employee who may have access to customer funds. Applications also must include organization charts of the firm and its management structure, a current firm financial statement, and verification from the New York State Department of Taxation and Finance that the applicant is compliant with New York state tax obligations.

Licenses may be perpetual, or for a two-year conditional period. All BitLicenses may be suspended or revoked upon a showing of good cause. Good cause exists when a licensed firm has defaulted, is likely to default on its financial obligations, or engages in unlawful, dishonest, wrongful, or inequitable conduct or practices that may cause harm to the public.

However, for a two-year conditional license, the NYDFS retains the sole discretion to renew a conditional license for an additional length of time, or to remove the conditional status. Unless removed or renewed by the NYDFS, the license will expire two years after its issuance.

Summary Description of Bitcoin

Bitcoin is a type of virtual currency or digital asset that is based upon a peer-to-peer, decentralized, computer-generated, math-based and cryptographic protocol. Bitcoins may, among other things, be used to buy and sell goods or services, or as a unit of account. Bitcoins may be converted to fiat currency, such as US dollars or other national currencies based on then-current exchange rates.^[11]

Virtual currencies, such as Bitcoin, also provide a powerful financial tool for the transmission of money in both large and small quantities, in a domestic or international setting, for limited fees and with near real-time confirmation. Despite certain media representations to the contrary, the protocol and computer network that underlie Bitcoin (the Bitcoin Network) do not provide users with complete anonymity; rather, all Bitcoin transactions are recorded on the Bitcoin Network's public leger (known as the Blockchain), which is fully transparent. Bitcoin users are identified on the Blockchain by one or more pseudonyms in the form of "digital addresses," of which a user may have many. Using existing technology and statistical analysis of the Blockchain, it is possible to track activity on the Bitcoin Network, thereby limiting the anonymity of Bitcoin users.

To date, Bitcoin is the most prominent virtual currency with the largest user and merchant base and market capitalization. The technical features of Bitcoin that contributed to its relatively rapid adoption include:

• the Bitcoin Network's open-source, decentralized nature and the capacity to quickly fix vulnerabilities or defects in the Bitcoin Network protocol through software updates;

• the Bitcoin Network's cryptographically founded proof-of-work system that crowdsources security and transaction verification to eliminate counterfeiting and prevent users from trying to repeatedly spend the same bitcoins (i.e., the "double spend" solution); and

• Bitcoin's capacity to facilitate domestic and international transactions of any amount with minimal (or zero) transaction fees and near real-time transaction confirmation.

There are more than 600 other virtual currencies being used today, many of which are based on protocols similar to, or derived from, Bitcoin. However, these "alt-coins" have achieved only a fraction of the market capitalization of Bitcoin in part due to Bitcoin's status as a first mover in the virtual currency space and the rapid, widespread adoption of Bitcoin due to its technological nature and minimal upfront costs. Only approximately 20 alt-coins achieve daily trading volume of at least 0.1 percent of that experienced by Bitcoin on virtual currency exchange markets, and only about 14 have at least 0.1 percent of the market capitalization of Bitcoin.^[12]

Although the license proposed under New York's new regulations is commonly referred to as the "BitLicense," its requirements apply to all types of virtual currency (other than certain online gaming platform credits, and credits under certain customer affinity or rewards programs). Furthermore, although Bitcoin and alt-coins are typically referred to as virtual currencies, the technology underlying their operation can be used to transmit information or non-currency forms of value. The BitLicense is intended to exempt non-financial uses of virtual currency (i.e., instances where the transmission of the virtual currency is for a non-financial purpose and involves only a nominal amount of the virtual currency).

Regulation Prior to Implementation of the BitLicense

Prior to implementation of the BitLicense, the virtual currency industry has been minimally regulated. Various federal governmental authorities appear to have jurisdiction over certain uses of the Bitcoin Network or businesses operating in the Bitcoin economy.^[13] With this authority, federal regulators have primarily focused to date on investor protection relating to fraud and the application of the Bank Secrecy Act and USA PATRIOT Act to virtual currency businesses.^[14]

Notwithstanding federal regulatory authority, no current framework pre-empts state regulation of virtual currency business activity.^[15] On the contrary, many virtual currency business activities are viewed as analogous to, or within the construct of money transmission, which is regulated by the vast majority of states. However, New York is the first state to initiate a comprehensive virtual currency state regulatory framework. Going forward, other states may also create their own virtual currency framework, although it is likely that New York's new regime (along with the Conference of State Bank Supervisors proposal) will serve as a model. This — particularly if regulations differ from state to state — could impose substantial hardships on this burgeoning industry.

Prior to the BitLicense, state regulators typically focused on choke points (i.e., where Bitcoins are exchanged for fiat currency) and investment schemes.^[16]  The BitLicense has expanded the focus of regulators to encompass not just the choke points, but all activity of financial intermediaries, including trading, exchanging and short or long-term storing of bitcoins through the use of custodial Bitcoin wallets.

Looking Forward

Critics argue the new regulations will stifle innovation, particularly for start-up firms.^[17] NYDFS Superintendent Lawsky recognized this concern, but responded by stating these regulations are necessary to protect consumers and to root out illegal activity^.[18] It is too early to tell whether the procedures in place for licensees will discourage firms from engaging as virtual currency intermediaries or firewalling their virtual currency business activities from potential New York customers.

Importantly, nothing in the new NYDFS provisions regulates virtual currencies themselves.

_{[1] New York State Department of Financial Services New York Codes, Rules, and Regulations. Part 200, Virtual Currencies, June 3, 2015.}

_{[2] NYDFS, supra note 1, at Section 200.2(q).}

_{[3] Conference of State Bank Supervisors, Draft Model Regulatory Framework here (last retrieved June 24, 2015).}

_{[4] NYDFS, supra note 1, at Section 200.3(c)(1).}

_{[5] Superintendent Lawsky's Remarks at the BITS Emerging Payments Forum, June 3, 2015.}

_{[6] Id.}

_{[7] Remarks of Benjamin M. Lawsky, Superintendent of Financial Services for the State of New York, on the Regulation of Virtual Currencies at the New America Foundation in Washington, DC, February 11, 2014.}

_{[8] The regulations are intended to regulate passive investors. However, firms may be required to seek approval from the NYDFS for changes in control (e.g., the NYDFS defines control as 10 percent ownership). NYDFS, supra note 1, at Section 200.11(a)(2).}

_{[9] See Uniting and Strengthening America by Providing Appropriate Tools Required to Intercept and Obstruct Terrorism Act of 2001 (USA PATRIOT Act), Pub. L. No. 107-56, 115 Stat. 272 (2001) and The Financial Recordkeeping and Reporting of Currency and Foreign Transactions Act of 1970 (Bank Secrecy Act), 31 U.S.C. §§ 5311-5330 (1970).}

_{[10] Excerpts from Superintendent Lawsky's Remarks at Benjamin N. Cardozo School of Law, October 14, 2014.}

_{[11] Katten Muchin Rosenman LLP, "Bitcoin: Current US Regulatory Developments," November 26, 2013.}

_{[12] Coinmarketcap.com.}

_{[13] The US Commodity Futures Trading Commission (CFTC) expressly indicated jurisdiction over futures and swaps contracts relating to Bitcoin. See "Testimony of Chairman Timothy Massad Before the U.S. Senate Committee on Agriculture, Nutrition & Forestry," December 10, 2014; see also Mark Wetjen, Wall Street Journal, "Bringing Commodities Regulation to Bitcoin," November 3, 2014. Moreover, the CFTC is currently considering the registration of LedgerX as a derivatives clearing organization and swap execution facility. See CFTC Press Release, "CFTC Extends Period for Public Comment on Related Applications Submitted by LedgerX, LLC for Registration as a Derivatives Clearing Organization and Swap Execution Facility," February 4, 2015.}

_{[14] FinCEN, which has been among the most active regulatory participants, oversees the application of the Bank Secrecy Act and USA PATRIOT Act to companies in the Bitcoin economy. See US Department of the Treasury, Financial Crimes Enforcement Network; see also The Financial Recordkeeping and Reporting of Currency and Foreign Transactions Act of 1970 (Bank Secrecy Act), 31 U.S.C. §§ 5311-5330 (1970); see also Uniting and Strengthening America by Providing Appropriate Tools Required to Intercept and Obstruct Terrorism Act of 2001 (USA PATRIOT Act), Pub. L. No. 107-56, 115 Stat. 272 (2001).}  

_{[15] Pursuant to Section 2(a)(1)(A) of the Commodity Exchange Act, the CFTC has exclusive jurisdiction "with respect to accounts, agreements … and transactions involving swaps or contracts of sale of a commodity for future delivery … traded or executed on a contract market … or a swap execution facility pursuant to section 7b-3 of this title." The Commodity Exchange Act, 7 U.S.C. §§ 2(a)(1)(A) (1936). Therefore, it would appear LedgerX, and other firms under jurisdiction of the CFTC, may only be subject to the CFTC regulation and would not need to obtain a BitLicense. However, it is not clear that NYDFS concurs with this interpretation. In addition, potentially to the extent that LedgerX offers intermediate services to futures commission merchants (FCMs), these FCMs may, too, be in a similar regulatory situation as LedgerX.}

_{[16] State regulation of Bitcoin is principally derived from states' authority to regulate and license money transmitters. Each state independently determines the definition of money transmission; what Bitcoin-related activities constitute money transmission and what regulatory and licensing framework exists for money transmitters. For example, Texas held that Bitcoins are property, not currency, but that third-party exchanges and other businesses interacting with money may still require money transmission licenses. See Texas Department of Banking, Supervisory Memorandum, "Regulatory Treatment of Virtual Currencies Under the Texas Money Services Act," April 3, 2014. On the other end, Florida only issued a consumer alert regarding Bitcoin. See Press Release, "State Financial Regulators Warn Floridians About Bitcoin," March 21, 2014.}   

_{[17] Coin Center, "New York BitLicense Falls Short," June 3, 2015.}

_{[18] Superintendent Lawsky's Remarks at the BITS Emerging Payments Forum, June 3, 2015.}