New York State Department of Financial Services Proposes Comprehensive Bitcoin Regulations
The New York State Department of Financial Services ("DFS") recently became the first state regulator to propose a regulatory framework for the bitcoin virtual currency industry. DFS posted its "Regulation of the Conduct of Virtual Currency Business" on its website, as well as on the social media websites Reddit and Twitter, forums utilized by many bitcoin stakeholders. Given New York's historical role as a clearinghouse for financial and currency transactions, DFS's broad regulatory purview as New York's main financial regulator, and the high-profile initiatives and enforcement actions this new regulator has pursued since opening its doors in October 2011, it is no surprise that DFS is at the forefront in attempting to regulate bitcoin.
At the core of DFS's proposed regulation is a licensing requirement—the "BitLicense"—for virtual currency firms operating in New York. Under DFS's proposal, firms subject to the licensing requirement must comply with rules regarding consumer protections, capital requirements, anti-money laundering, and cyber security. Notably, DFS's proposed rules are designed for virtual currency businesses. As stated in its official Notice of Proposed Rule Making, the purpose of DFS's proposal is to "protect New York consumers and users" and to "ensure the safety and soundness" of businesses providing virtual currency products and services in New York.
Virtual Currency Developments in the Past Year
Since our November 2013 article regarding bitcoin and DFS, significant developments have occurred in the nascent virtual currency industry. In January 2014, for example, federal prosecutors in New York seized almost 30,000 bitcoins, worth approximately $28 million at the time, from the servers of Silk Road, an online black market site. Transactions on Silk Road are alleged to have occurred entirely in the virtual currency, which allows users to remain anonymous. A few days later, a prominent bitcoin advocate, Charlie Shrem, was indicted by a federal grand jury in New York on charges of running a "bitcoin-laundering scheme" through Silk Road. In February 2014, Japan's Mt. Gox, once the largest bitcoin exchange, announced that its network systems had been hacked, resulting in the loss of approximately 850,000 of its customers' bitcoins, and about 100,000 of its own, which had a combined value of about $500 million. In March 2014, the Internal Revenue Service pronounced that for U.S. federal tax purposes, virtual currency is treated as property, not currency. Because this ruling has significant implications for when and how a taxpayer should report any gain or loss on transactions involving virtual currency, some commentators have suggested that it could reduce the volume of virtual currency business. And in April 2014, the Chinese government ordered commercial banks and payment firms to shut down all bitcoin trading accounts.
While these reports, and the recent volatility of bitcoin's price, suggest that the bitcoin market is incurring some growing pains, there are other signs that it has begun to mature and stabilize. In May 2014, a pair of prominent bitcoin investors disclosed in a regulatory filing their intent to list a bitcoin exchange-traded fund on the Nasdaq stock exchange. In June 2014, the State of California repealed a state law prohibiting commerce using anything but U.S. currency. California businesses may now accept virtual currencies as a form of payment. In July 2014, the European Banking Authority warned banks that they should not buy, hold, or sell virtual currencies until regulators develop adequate safeguards. Significantly, a handful of major retailers have recently announced that they would take bitcoin as a form of payment, and real estate deals in excess of a million dollars have reportedly been completed solely with the virtual currency.
These developments have shaped the marketplace within which bitcoin firms operate. For virtual currency businesses, however, DFS's regulatory action may have the greatest impact.
Scope of the Licensing Requirement. The centerpiece of DFS's proposed bitcoin regulations is the "BitLicense," an idea which DFS introduced in November 2013. In order to engage in "virtual currency business activity" involving New York, a firm would be required to obtain a license from DFS. A BitLicense would be required to:
- receive or transmit virtual currency on behalf of consumers;
- secure, store, or maintain custody or control of such virtual currency on behalf of customers;
- perform retail conversion services;
- buy and sell virtual currency as a customer business; and
- control, administer, or issue virtual currency.
DFS's proposed regulation would exempt three types of entities from the licensing requirement: (1) merchants and consumers, (2) virtual currency "miners," and (3) firms approved under New York law to conduct exchange services and to engage in virtual currency business activity.
The BitLicense Application. To obtain a BitLicense, a firm must submit an application and an application fee to DFS. The application must include, among other things:
- for each principal director, officer, shareholder, and beneficiary, detailed biographical information, a background report, and a complete set of fingerprints;
- a detailed business plan;
- current and projected financial statements; and
- "an explanation of the methodologies used to calculate the value of Virtual Currency in Fiat Currency," that is, currency issued and designated by a government as legal tender.
DFS must approve or deny each application within 90 days of filing a complete application. Once issued, the BitLicense remains effective until surrendered by the licensee or revoked or suspended by DFS. DFS may revoke or suspend a BitLicense, for example, for a violation of any provision of the proposed regulations.
A firm with a BitLicense must obtain DFS's prior approval before taking any action that may result in a material change to an existing product or service or that may result in a change of control of the licensed firm or its assets.
Compliance, Capital, and Examination Requirements
DFS's proposed bitcoin regulations set out detailed requirements for compliance, capital, books and records, and reporting.
Compliance Requirements. To ensure compliance with all applicable federal and state laws, rules, and regulations, a virtual currency firm will be required to designate a compliance officer and to maintain written compliance policies reviewed and approved by its governing body. The firm's compliance policies must include policies regarding antifraud, anti-money laundering, cyber security, data privacy, and information security.
Capital Requirements. DFS's proposed regulations require virtual currency firms to maintain capital in levels sufficient to maintain the firm's financial stability. DFS will determine a licensee's capital requirements based on a variety of factors, such as the volume of the firm's virtual currency business, the amount of leverage used by the firm, and the firm's liquidity position. Furthermore, the proposed rules restrict a firm's investment of retained earnings to certain types of low-risk investments, such as U.S. government securities, with maturities of up to one year.
Books and Records. For at least ten years, each firm must keep books and records, including information regarding each and every transaction, bank statements, minutes of board meetings, compliance records, including customer identification documents, and documentation of consumer complaints. At DFS's request, each licensed firm must provide immediate access to all of its facilities and records.
Reporting Requirements and Regular Examinations. Each virtual currency firm must submit quarterly and audited annual financial statements to DFS. Notably, each licensee must notify DFS in writing of any proposed change to the methodology used by the firm to calculate the value of virtual currency in fiat currency. Whenever DFS deems necessary, and at least every two years, DFS shall examine a virtual currency firm's financial condition, safety and soundness, management policies, compliance with laws and regulations, and any activities outside of New York State affecting the firm's New York business.
DFS's proposed regulatory framework requires virtual currency firms to establish and maintain an anti-money-laundering program ("AML"). The firm's governing body must review and approve a written AML policy, and the firm must designate an individual as responsible for overseeing and enforcing the firm's AML program. At a minimum, a licensee's AML program will include internal policies and procedures and ongoing training for appropriate personnel to ensure compliance with AML laws. As part of its AML program, each firm must keep detailed records for each transaction involving virtual currency, including the identity of the parties involved and the precise time of the transaction.
Customer Verification. When opening a new account for a customer, the firm must verify the customer's identity and check it against lists maintained by the U.S. Treasury Department's Office of Foreign Asset Control. For any transaction involving more than $3,000, the licensed firm must require verification of the identity of the account holder initiating the transaction. Additional factors, such as high-risk customers, high-volume accounts, or accounts on which a suspicious activity report has been filed, may require enhanced due diligence. Enhanced due diligence is mandatory for accounts involving foreign entities, and accounts with foreign shell entities are prohibited.
Reporting of Suspected Fraud and Illicit Activity. Firms must monitor transactions for activity that might signify money laundering, tax evasion, or any illegal or criminal activity. The firm must immediately notify DFS upon detection of a suspicious transaction, including any transaction, or series of transactions, exceeding $10,000 by a person in a day.
Cyber Security Requirements
Under DFS's proposed regulations, licensed firms will also be required to implement a cyber security program. Among other things, the firm's cyber security program must address information security, systems and network security, customer data privacy, and business continuity and recovery planning. The proposed rules specifically require the cyber-security program to provide for various "audit functions," including an annual assessment of the vulnerability of its systems; audit trail systems, which allow for the complete and accurate reconstruction of all transactions; and source code reviews by independent third parties. To oversee and enforce its cyber-security program on a day-to-day basis, each firm must designate a Chief Information Security Officer.
Business Continuity and Disaster Recovery Plan. In case a cyber event occurs which disrupts the firm's normal business activities, each licensed firm must have in place a disaster recovery plan to ensure the continuity of services during an emergency. Among other things, the firm's business continuity plan must identify data, facilities, and personnel "essential to the continued operations" of the firm's business as well as procedures for maintaining backup facilities and systems to enable the recovery of data and resumption of operations. Each firm must maintain a copy of its business continuity plan at an off-site location.
DFS's proposed bitcoin regulations also provide protections for customer assets.
Consumer Assets. For the protection of the firm's customers, a licensed firm must maintain a bond or trust account in U.S. dollars in a form and amount acceptable to DFS. The firm must also hold virtual currency "of the same type and amount," which it owes to each customer. DFS's proposed regulations prohibit firms from using or encumbering assets held by the firm on behalf of an account holder.
Consumer Disclosures. Licensed firms must disclose to customers general terms and conditions for doing business with the firm, including the customer's right to monthly account statements, as well as all material risks associated with the firm's products, services, and activities and with virtual currency in general. In disclosing material risks, DFS's proposed rules require the firm to state that virtual currency "is not legal tender," that transactions in virtual currency are "generally irreversible," that virtual currency's value derives from "the continued willingness of market participants to exchange Fiat Currency for Virtual Currency," and that "the nature of Virtual Currency may lead to an increased risk of fraud or cyber attack." A licensed firm must also disclose details specific to each transaction, including the amount of the transaction and any fees charged to the customer.
Consumer Complaint Policies. DFS's proposed regulations require virtual currency firms to establish written policies and procedures pertaining to the resolution of customer complaints. In addition to disclosing the firm's mailing address, email address, and telephone number for receiving complaints, the firm must also provide notice that consumers can contact DFS regarding complaints. Once a transaction is complete, a licensed firm must provide a detailed receipt to its customers.
Advertising and Marketing. In any advertising materials, virtual currency firms must include a legend showing that the firm is licensed by DFS. Licensees must maintain records of all advertising and marketing materials for examination by DFS.
The initial 45-day window for public comment on DFS's proposed BitLicense regulatory framework opened on July 23, 2014, the official publication date of DFS's notice of rulemaking. Members of the virtual currency industry immediately requested additional time to consider and respond to DFS's BitLicense proposal since it is the first of its kind and may serve as a model for other jurisdictions. Some commentators, for example, have argued that the proposed rules are too onerous for small businesses. Instead, they recommend either relaxing the reporting burdens or exempting small virtual currency firms altogether.
In response, DFS has extended the comment period by an additional 45 days. Comments are now due on October 21, 2014. As it currently stands, the proposed regulations require any existing firm that would be subject to the licensing requirement to apply for a BitLicense within 45 days of the effective date of the proposed DFS regulations.
We will continue to monitor developments with DFS's proposed bitcoin regulations, along with DFS initiatives generally.
For further information, please contact your principal Firm representative or one of the lawyers listed below. General email messages may be sent using our "Contact Us" form, which can be found at www.jonesday.com.
Robert W. Gaffey
Harold K. Gordon
Henry Klehm III
Howard F. Sidman
Jayant W. Tambe
Paul Bartholomew Green
Jones Day publications should not be construed as legal advice on any specific facts or circumstances. The contents are intended for general information purposes only and may not be quoted or referred to in any other publication or proceeding without the prior written consent of the Firm, to be given or withheld at our discretion. To request reprint permission for any of our publications, please use our "Contact Us" form, which can be found on our web site at www.jonesday.com. The mailing of this publication is not intended to create, and receipt of it does not constitute, an attorney-client relationship. The views set forth herein are the personal views of the authors and do not necessarily reflect those of the Firm.
 For a general discussion of the creation of DFS and its powers, please see our December 2011 Jones Day Commentary, "The Department of Financial Services: New York's Newest Financial Regulator" (https://www.jonesday.com/department_of_financial_services/). For a discussion of DFS's regulatory and enforcement activities in the first year following its inception, please see our May 2013 Jones Day Commentary, "The New York State Department of Financial Services at the One-Year Mark: A New Aggressive Regulator Worth Following" (https://www.jonesday.com/the-new-york-state-department-of-financial-services-at-the-one-year-mark-a-new-aggressive-regulator-worth-following-05-10-2013/). For a discussion of DFS's regulatory and enforcement activities in the second year following its inception, please see our May 2014 Jones Day Commentary, "The New York State Department of Financial Services' Recent Enforcement Efforts" (https://www.jonesday.com/the-new-york-state-department-of-financial-services-recent-enforcement-efforts-05-14-2014/).
 Notice of Proposed Rulemaking on the Regulation of the Conduct of Virtual Currency Businesses, New York State Department of Financial Services, 36 N.Y. Reg. 14 (July. 23, 2014). (http://www.dfs.ny.gov/about/press2014/pr1407171-vc.pdf.)
 "NY Regulators Turn Their Attention to Bitcoin," Law 360, Nov. 18, 2013 (http://www.law360.com/articles/488882).
 "Silk Road Forfeits $28 Million of Bitcoins," The Wall Street Journal, Jan. 16, 2014 (http://online.wsj.com/news/articles/SB10001424052702304603704579325132563396104).
 "Bitcoin Entrepreneur Pleads Not-Guilty to Money-Laundering," The Wall Street Journal, Apr. 29, 2014 (http://online.wsj.com/news/articles/SB10001424052702304163604579532191256477378); "Two Charged in Alleged Bitcoin-Laundering Scheme," The Wall Street Journal, Jan. 27, 2014 (http://online.wsj.com/news/articles/SB10001424052702303553204579346711725068816).
 "Almost Half a Billion of Bitcoins Vanishes," The Wall Street Journal, Feb. 28, 2014 (http://online.wsj.com/news/articles/SB10001424052702303801304579410010379087576). Mt. Gox has since found about 200,000 of the missing Bitcoins in an old-format wallet. "Mt. Gox Says It Found Missing Bitcoin Worth About $116 Million, "The New York Times, March 21, 2014 (http://dealbook.nytimes.com/2014/03/21/mt-gox-says-it-has-found-200000-bitcoins-worth-about-114-million/). Mt. Gox declared bankruptcy in Japan in February and in the United States in March. "Mt. Gox U.S. Bankruptcy Approved to Help Bitcoin Hunt," Bloomberg, June 17, 2014 (http://www.bloomberg.com/news/print/2014-06-17/mt-gox-u-s-bankruptcy-approved-to-help-bitcoin-hunt.html); "Mt. Gox Head Believes No More Bitcoins Will be Found," The Wall Street Journal, June 29, 2014 (http://online.wsj.com/articles/mt-gox-head-believes-no-more-bitcoin-will-be-found-1403850830).
 IRS Virtual Currency Guidance, Notice 2014-21, Mar. 25, 2014 (http://www.irs.gov/uac/Newsroom/IRS-Virtual-Currency-Guidance).
 "China Central Bank Warns Banks on Bitcoin," The Wall Street Journal, May 7, 2014 (http://online.wsj.com/news/articles/SB10001424052702304655304579547251552490962).
 "Winklevoss Twins to List Bitcoin Fund on Nasdaq," The New York Times, May 8, 2014 (http://dealbook.nytimes.com/2014/05/08/winklevoss-twins-to-list-bitcoin-fund-on-nasdaq/). In February 2014, the Winklevoss brothers launched the Winklevoss Index, which is one of several indices that price bitcoin. "Winklevoss Twins Plan Bitcoin Index," Fortune, Feb. 19, 2014 (http://fortune.com/2014/07/22/on-winklevoss-bitcoin-index-its-open-season-for-developers/).
 California Assembly Bill No. 129 (2014); "California Governor Signs Bill to Bring Bitcoin and Other Currency into Fold," Reuters, June 28, 2014 (http://www.reuters.com/article/2014/06/29/us-usa-california-bitcoin-idUSKBN0F402T20140629 ).
 "Bitcoin Faces Regulatory Backlash as EU Tells Banks to Stay Away," Bloomberg, July 4, 2014 (http://www.bloomberg.com/news/2014-07-04/bitcoin-faces-regulatory-backlash-as-eu-tells-banks-to-stay-away.html).
 Expedia and Dell have joined Overstock.com, The Chicago Sun-Times, and Dish Network as retailers which now accept bitcoin. "Expedia Starts Accepting Bitcoin for Hotel Bookings," The Wall Street Journal, June 11, 2014 (http://blogs.wsj.com/moneybeat/2014/06/11/expedia-starts-accepting-bitcoin-for-hotel-bookings/); "Dell Begins Accepting Bitcoin," The New York Times, July 18, 2014 (http://dealbook.nytimes.com/2014/07/18/dell-begins-accepting-bitcoin/); "Lake Tahoe Property Sells for $1.6 million in Bitcoins—Transaction Is Just One of a Handful to Use the Virtual Currency," The Wall Street Journal, Aug. 8, 2014 (http://online.wsj.com/articles/lake-tahoe-property-sells-for-1-6-million-in-bitcoins-1407534997). Recently, other investors used bitcoin to purchase a Stradivarius violin valued "in the low millions." "Musical Gold: Can three ambitious siblings turn old violins into a new investment strategy?" The New Yorker, July 28, 2014 (http://www.newyorker.com/magazine/2014/07/28/musical-gold).
 Press Release, DFS, Nov. 14, 2013, (http://www.dfs.ny.gov/about/press2013/virtual-currency-131114.pdf).
 N.Y. State Dep't of Financial Services Regulation of the Conduct of Virtual Currency Businesses, § 200.3(a) (proposed July 23, 2014) (http://www.dfs.ny.gov/about/press2014/pr1407171-vc.pdf).
 Proposed Regulation, §§ 200.2(n).
 In March 2014, DFS began accepting applications to operate virtual currency exchanges, which explains the exemption for previously approved firms. Order, DFS, Mar. 11, 2014 (http://www.dfs.ny.gov/about/po_vc_03112014.pdf). While DFS's framework expressly exempts merchants, consumers, and previously approved firms from the licensing requirement, the proposed regulations do not identify virtual currency miners by name. Instead, DFS noted in its July 17, 2014 press release that the activity of "controlling, administering, or issuing a virtual currency … does not refer to virtual currency miners." Since some early commenters on DFS's proposal contend that DFS should exempt miners from the licensing requirement, it appears that DFS may need to clarify this issue before finalizing its regulation. See Proposed Regulation, § 200.3(c); Press Release, DFS, July 17, 2014 (http://www.dfs.ny.gov/about/press2014/pr1407171.html). For an explanation of how virtual currency is created, or "mined," please see our commentary, "NY Regulators Turn Their Attention to Bitcoin," Law 360, Nov. 18, 2013 (http://www.law360.com/articles/488882).
 Proposed Regulation, § 200.4(a).
 Proposed Regulation, § 200.4(a)(1) – (14); 200.2(d).
 Proposed Regulation, § 200.6(b).
 Proposed Regulation, § 200.6(b).
 Proposed Regulation, § 200.6(c).
 Proposed Regulation, § 200.11(a) and (b).
 Proposed Regulation, § 200.7(a) – (c).
 Proposed Regulation, § 200.8.
 Proposed Regulation, § 200.12.
 Proposed Regulation, § 200.14.
 Proposed Regulation, § 200.13(a)(1) – (5).
 Proposed Regulation, § 200.15.
 Proposed Regulation, §§ 200.16, 200.17.
 Proposed Regulation, § 200.9.
 Proposed Regulation, § 200.19.
 Proposed Regulation, § 200.20(a).
 Proposed Regulation, § 200.19(e)(1) – (6).
 Proposed Regulation, § 200.18.