On Nov. 15, 2023, the New York Department of Financial Services (NYDFS) issued new standards for virtual currency (coin) listings and delistings. These new regulations apply to Bitlicensees and limited-purpose trust companies and include business model considerations for virtual currency entities (VCEs), updated risk assessment expectations for VCEs, new advance notification requirements, and updated definitions.
The following editorial was written by guest authors Wyatt Noble and Michael Handelsman for Kelman.Law
VCE Coin-Listing Policies
Under the latest guidance VCEs with prior approvals for coin-listing policies must receive NYDFS approval for both their coin-listing and coin-delisting policies before self-certifying any coins. Once NYDFS approves both policies, VCEs may self-certify coins for New York-based activities. However, without NYDFS-approved listing policies, VCEs will almost always be restricted to listing coins on the NYDFS Greenlist, barring specific NYDFS approvals. Additionally, the NYDFS retains discretionary authority to require VCEs to delist coins or restrict access for New Yorkers to non-Greenlist coins.
Coin-Listing Governance Requirements
VCEs are required to have their board of directors or equivalent governing authority actively involved in the oversight of coin-listings. This includes annual approvals of the coin-listing policy, decision-making on new coin listings, and ensuring independence from those proposing coin listings or delistings. They must also manage and disclose any conflicts of interest, maintain compliant recordkeeping accessible for NYDFS review, and promptly notify NYDFS of any non-compliance or material changes to their coin-listing policy.
Further, the governing authority must annually reassess the coin-listing policy to ensure ongoing risk mitigation and maintain its independence from the initial recommendation process for listing or delisting coins. The NYDFS hopes this enhanced governance framework will bolster risk management and maintain high standards of regulatory compliance amongst VCEs that comply.
Coin-Listing Risk Assessment Requirements
In response to requests for greater clarity of risk assessment expectations, the NYDFS highlighted several specific risks VCEs must assess. These risks include: technical design and technology, operational, cybersecurity, market and liquidity, illicit finance, legal, reputational, and regulatory. The final guidance requires VCEs to consider other factors to identify and mitigate risks specific to each coin and its uses, and where applicable, to incorporate NYDFS guidance on the prevention of market manipulation and other wrongful activities.
Specifically, VCEs must also identify and mitigate risks stemming from conflicts of interest by having policies and procedures that mitigate any such conflicts from impacting decisions, recommendations, and assessments made for each coin under review. When VCEs identify potential conflicts of interest relating to coin-listing decisions, they must clearly disclose those potential conflicts to the public. Additionally, VCEs are broadly charged with ensuring that all customers are treated fairly and are afforded the full protection of all applicable laws and regulations, including protection from unfair, deceptive, or abusive practices.
Limits of VCE Self-Certification
The new guidance contains strict requirements for VCEs self-certifying coins. First, coins used to circumvent laws or conceal identities are ineligible for self-certification. Restrictions also apply to non-Greenlist stablecoins, exchange coins, and coins on protocols with decentralization concerns or significant concentration risks. Additionally, VCEs are prohibited from self-certifying bridged coins and those with less than 35% circulating supply. VCEs must request NYDFS approval for listing such coins and must include a comprehensive risk assessment and specified business use case.
VCE Coin Monitoring
VCEs must have robust monitoring policies for self-certified coins. These policies must ensure that self-certified coins align with safety, customer protection, and compliance standards, which include annual re-evaluations, risk management controls, and a clear coin-delisting policy. Additionally, VCEs are expected to adhere to the NYDFS’s guidance on blockchain analytics and comply with Bank Secrecy Act and anti-money laundering and sanctions-related controls.
VCE Coin Delisting Requirements
The new guidance also clarified the NYDFS’s expectations concerning coin delistings by VCEs. VCEs must be prepared to discontinue support for coins that present elevated risks and do so in a manner consistent with safety and soundness principles and with the protection of customers and the public.
Coin-delisting policies must be comprehensive, reflecting the VCE’s business model, operations, customer base, operational geographies, service providers, and the characteristics of the coins, however, limited exceptions may apply subject to NYDFS approval. Additionally, VCEs were required to meet with the NYDFS by December 8, 2023, to discuss draft coin-delisting policies. While the deadline for those initial meetings passed, final policies are not due until Jan. 31, 2024.
Within overall coin delisting requirements, there are two subcategories of minimum requirements for VCEs and their policies, governance and policy.
Delisting Governance Requirements
As to governance, VCEs must obtain approval from their governing authority for their coin-delisting policies, conduct annual reviews for effective risk management, and maintain independence from those recommending coin listings or delistings. VCEs must also keep accurate records available for NYDFS review and need to inform the NYDFS in writing at least ten business days before delisting a coin. Further, when VCEs notify the NYFDS they will be delisting a coin, VCEs must detail their rationale for doing so and provide a timeline. Additionally, VCEs cannot make significant changes to their coin-delisting policies without obtaining written approval from the NYDFS.
Delisting Policy Requirements
Under the new guidance, coin-delisting policies must contain comprehensive outlines of the delisting process, including criteria thresholds prompting delisting and integrating with the VCE’s monitoring procedures. VCEs are directed to regularly review and update these procedures, taking into account potential triggers for updates such as new findings, legal or regulatory changes, or directives from the NYDFS. VCEs must establish roles and responsibilities for each type of trigger event to provide clear instructions for stakeholders depending on the circumstances.
Key elements related to executing a delisting event include providing at least 30 days’ advance notice to customers (unless otherwise directed by NYDFS), answering customer questions and assisting with the sale of their impacted coins, documenting all aspects of the delisting decision, conducting ongoing monitoring for safety and soundness, and assessing the impact on the VCE’s operations, counterparties, and service providers.
What You Should Do
Fill out our contact form here to set up a free 30-minute consultation, and read up on whether you need a crypto lawyer.
What do you think about New York offering new virtual currency guidance? Share your thoughts and opinions about this subject in the comments section below.