Demand for virtual currency services, including custody services, has soared in the past several years.  Like their counterparts in traditional finance, these custodians are stewards of retail and institutional customer funds and serve an important and valuable function.  However, as evidenced by a number of headline-grabbing failures during the lingering crypto winter, inadequate disclosures and poor custodial practices can seriously harm retail and institutional customers alike.  For many virtual currency customers, this recognition – in an industry built on the pillars of trust and transparency – was realized too late.  Recent disclosures emerging from notable bankruptcies involving crypto companies have led to allegations of fraud and mismanagement in connection with custodial services.  These allegations strike at the very core of the custodial relationship, and have had repercussions throughout the crypto industry.

Seemingly in direct response to these developments, on January 23, 2023, the New York Department of Financial Services (“NYDFS”) issued industry guidance to Virtual Currency Entities (“VCEs”) who act as custodians (“VCE Custodians”).  Entitled “Guidance on Custodial Structures for Customer Protection in the Event of Insolvency” (the “Guidance”), the Department emphasized the “paramount importance of equitable and beneficial interests always remaining with the customer” and reminded covered institutions of their obligations in connection with “sound custody and disclosure practices in the event of an insolvency” or similar proceeding.

The Guidance comes on the heels of developments in two high-profile insolvency proceedings: (1) the FTX proceedings, where, among others, the SEC has alleged co-founder Samuel Bankman-Fried concealed the diversion of FTX customer funds to the co-founder’s private crypto hedge fund, and (2) the Celsius proceedings, where the chief judge for the United States Bankruptcy Court for the Southern District of New York issued a decision holding that Celsius’ Terms of Use made clear that customer deposits into Earn Accounts became Celsius’ property at the time of deposit, such that the digital assets now constitute property of the debtors’ bankruptcy estate.  In Celsius, customers argued that the deposits in the Earn Accounts were held by Celsius as a custodian, but the court found that the plain language of the Terms of Use made clear that ownership interest had passed to the debtors.

The Guidance applies to entities licensed under 23 NYCRR Part 200 (“BitLicensees”) and limited purposes trust companies that engage in virtual currency business activities as further described in our January 9^th, 2023 article discussing NYDFS’s guidance increasing its regulatory scope.^[1]

As per the Guidance, NYDFS outlines several fronts on how VCE Custodians can provide a “high level of customer protection with respect to asset custody” under the BitLicense requirements.

Outlined below is the framework NYDFS highlighted in the Guidance:

1. Segregation of and Separate Accounting for Customer Virtual Currency

The Guidance stated, in order to maintain appropriate books and records, VCE Custodians must separately account for and segregate customer virtual currency from the corporate assets of the VCE Custodian and its affiliated entities, both on-chain and on the VCE Custodian’s internal ledger accounts, clearly disclosing the manner of segregation and accounting for customer virtual currency. VCE custodians must also refrain from commingling customer virtual currency with any non-customer virtual currency.  This stands in contrast to FTX, which as alleged in the SEC’s complaint against Bankman-Fried and as testified by the current CEO John Ray’s testimony before the House Financial Services Committee in December 2022, comingled customer assets with non-customer assets.

NYDFS specifies that customer virtual currency should be maintained in either (i) separate on-chain wallets and internal ledger accounts for each customer under that customer’s name or (ii) one or more omnibus on-chain wallets and internal ledger accounts that contain only virtual currency of customers held under the VCE Custodian’s name as agent or trustee for the benefit of those customers. If the latter, according to NYDFS, VCE Custodians should maintain appropriate records and an explicit internal audit trail to protect the customer’s “beneficial interest,” along with documented policies and procedures evidencing such protections.

NYDFS highlighted that VCE Custodians should be able to reconcile the virtual currency entity’s internal records and on-chain activity upon request from NYDFS.

2. VCE Custodian’s Limited Interest in and Use of Customer Virtual Currency

According to the Guidance, VCE Custodians should only take possession of assets for the limited purpose of custody and safekeeping services and should not thereby establish a debtor-creditor relationship. To preserve customers’ equitable and beneficial interest in the virtual currency, the Guidance advises a VCE Custodian to treat customer virtual currency as belonging “solely to customesr” and refrain from employing it for its use by securing or guaranteeing an obligation against the virtual currency or acquiring general discretion beyond the terms expressly described in the customer agreement (whether that be for marketing, investing, or other spend).

3. Sub-Custody Arrangements

Sub-custody arrangements with third parties must be consistent with NYDFS Guidance. The NYDFS noted that establishing such an arrangement is considered a material change to a VCE business and requires NYDFS approval before implementation, with the agency looking at such things as whether a risk assessment was performed by the VCE Custodian, the proposed service agreement(s) between the parties, and any updated VCE Custodian policies and controls relating to the proposed arrangement.

4. Customer Disclosure

Consistent with the Guidance, VCE Custodians should provide clear disclosure to each customer, in writing, of the general terms and conditions associated with its products, services, and activities, as well as obtain acknowledgment of such disclosure prior to transacting with the customer.  Such customer agreement, according to the Guidance, should make clear the custodial arrangement, as opposed to the debtor-creditor relationship. For instance, the Guidance states such disclosure should clearly outline how the entity segregates and accounts for customer virtual currency, the details of the customers’ property interest in the custodied assets, and the VCE Custodian’s permitted uses of customer virtual currency, including any limitations or exceptions.

Conclusion

While NYDFS issued this reminder in view of recent bankruptcies and high-profile collapses in the crypto industry, particularly where cryptoassets deposited by customers were allegedly mishandled and commingled, the Guidance and related BitLicense rules are continually applicable to covered institutions.

As stated in the Guidance, the intent is to “offer greater clarity regarding standards and practices that, in the Department’s view, will help to ensure that VCE Custodians are providing a high level of customer protection with respect to asset custody under the BitLicense and limited purpose trust company frameworks.”  It remains to be seen whether this Guidance will have the intended effect of providing enhanced consumer protection, or whether it will need to be coupled with additional measures to ensure custodial accounts are not mishandled.

FOOTNOTES

^[1] For example, such virtual currency business activities include:

1. receiving virtual currency for transmission or transmitting virtual currency, except where the transaction is undertaken for non-financial purposes and does not involve the transfer of more than a nominal amount of virtual currency;

2. storing, holding, or maintaining custody or control of virtual currency on behalf of others (i.e., custody services);

3. buying and selling virtual currency as a customer business;

4. performing exchange services as a customer business; or

5. controlling, administering, or issuing a virtual currency.