The New York Department of Financial Services (DFS) announced its first ever penalty against a cryptocurrency platform this week, with a whopping $30 million fine assessed against Robinhood Crypto, LLC (RHC) for what it described as “significant failures in the areas of bank secrecy act/anti-money laundering obligations and cybersecurity that resulted in violations of the Department’s Virtual Currency Regulation (23 NYCRR Part 200), Money Transmitter Regulation (3 NYCRR Part 417), Transaction Monitoring Regulation (23 NYCRR Part 504), and Cybersecurity Regulation (23 NYCRR Part 500).

Following DFS’s supervisory examination and enforcement investigation, it found that RHC’s compliance program “did not fully address RHC’s operational risks, and specific policies within the program were not in full compliance with several provisions of the Department’s Cybersecurity and Virtual Currency Regulations.”

In particular, all DFS-regulated entities must certify annually that they have complied with DFS regulations, including its cybersecurity regulations. According to DFS, RHC certified to DFS that it complied with the DFS Cybersecurity Regulations. However, DFS stated in its press release that “[D]espite these weaknesses in its transaction monitoring and cybersecurity programs, RHC improperly certified compliance with the Department’s Transaction Monitoring Regulation and Cybersecurity Regulation. Pursuant to those regulations, companies should only be certifying to DFS if their programs are fully compliant with the applicable regulation. In light of the program’s deficiencies, RHC’s 2019 certifications to the Department attesting to compliance with these Regulations should not have been made and thus violated the law.”

In addition to the monetary penalty, the settlement requires RHC to be overseen by an independent consultant that will perform “a comprehensive evaluation” of RHC’s compliance and remediation efforts in response to the violations identified by DFS.

The discovered deficiencies and subsequent penalty are reminders to DFS-regulated entities that the annual certification to DFS will be scrutinized and enforced.