The New York State Department of Financial Services
(DFS) recently became the first state regulator to
propose a regulatory framework for the bitcoin virtual currency
industry. DFS posted its Regulation of the Conduct of Virtual
Currency Business on its website, as well as on the social
media websites Reddit and Twitter, forums utilized by many bitcoin
stakeholders. Given New York#39;s historical role as a
clearinghouse for financial and currency transactions, DFS#39;s
broad regulatory purview as New York#39;s main financial
regulator, and the high-profile initiatives and enforcement actions
this new regulator has pursued since opening its doors in October
2011, it is no surprise that DFS is at the forefront in attempting
to regulate bitcoin.1
At the core of DFS#39;s proposed regulation is a licensing
requirementthe BitLicensefor virtual
currency firms operating in New York. Under DFS#39;s proposal,
firms subject to the licensing requirement must comply with rules
regarding consumer protections, capital requirements, anti-money
laundering, and cyber security. Notably, DFS#39;s proposed rules
are designed for virtual currency businesses. As stated in its
official Notice of Proposed Rule Making, the purpose of DFS#39;s
proposal is to protect New York consumers and users and
to ensure the safety and soundness of businesses
providing virtual currency products and services in New
Virtual Currency Developments in the Past Year
Since our November 2013 article regarding bitcoin and
DFS,3 significant developments have occurred in the
nascent virtual currency industry. In January 2014, for example,
federal prosecutors in New York seized almost 30,000 bitcoins,
worth approximately $28 million at the time, from the servers of
Silk Road, an online black market site.4 Transactions on
Silk Road are alleged to have occurred entirely in the virtual
currency, which allows users to remain anonymous. A few days later,
a prominent bitcoin advocate, Charlie Shrem, was indicted by a
federal grand jury in New York on charges of running a
bitcoin-laundering scheme through Silk
Road.5 In February 2014, Japan#39;s Mt. Gox, once the
largest bitcoin exchange, announced that its network systems had
been hacked, resulting in the loss of approximately 850,000 of its
customers#39; bitcoins, and about 100,000 of its own, which had a
combined value of about $500 million.6 In March 2014,
the Internal Revenue Service pronounced that for US federal tax
purposes, virtual currency is treated as property, not
currency.7 Because this ruling has significant
implications for when and how a taxpayer should report any gain or
loss on transactions involving virtual currency, some commentators
have suggested that it could reduce the volume of virtual currency
business. And in April 2014, the Chinese government ordered
commercial banks and payment firms to shut down all bitcoin trading
While these reports, and the recent volatility of bitcoin#39;s
price, suggest that the bitcoin market is incurring some growing
pains, there are other signs that it has begun to mature and
stabilize. In May 2014, a pair of prominent bitcoin investors
disclosed in a regulatory filing their intent to list a bitcoin
exchange-traded fund on the Nasdaq stock exchange.9 In
June 2014, the State of California repealed a state law prohibiting
commerce using anything but US currency.10 California
businesses may now accept virtual currencies as a form of payment.
In July 2014, the European Banking Authority warned banks that they
should not buy, hold, or sell virtual currencies until regulators
develop adequate safeguards.11 Significantly, a handful
of major retailers have recently announced that they would take
bitcoin as a form of payment, and real estate deals in excess of a
million dollars have reportedly been completed solely with the
These developments have shaped the marketplace within which
bitcoin firms operate. For virtual currency businesses, however,
DFS#39;s regulatory action may have the greatest impact.
Scope of the Licensing Requirement. The
centerpiece of DFS#39;s proposed bitcoin regulations is the
BitLicense, an idea which DFS introduced in November
2013.13 In order to engage in virtual currency
business activity involving New York, a firm would be
required to obtain a license from DFS.14 A BitLicense
would be required to:
- receive or transmit virtual currency on behalf of
- secure, store, or maintain custody or control of such virtual
currency on behalf of customers;
- perform retail conversion services;
- buy and sell virtual currency as a customer business; and
- control, administer, or issue virtual
DFS#39;s proposed regulation would exempt three types of
entities from the licensing requirement: (1) merchants and
consumers, (2) virtual currency miners, and (3) firms
approved under New York law to conduct exchange services and to
engage in virtual currency business activity.16
The BitLicense Application. To obtain a
BitLicense, a firm must submit an application and an application
fee to DFS.17 The application must include, among other
- for each principal director, officer, shareholder, and
beneficiary, detailed biographical information, a background
report, and a complete set of fingerprints;
- a detailed business plan;
- current and projected financial statements; and
- an explanation of the methodologies used to calculate the
value of Virtual Currency in Fiat Currency, that is, currency
issued and designated by a government as legal
DFS must approve or deny each application within 90 days of
filing a complete application.19 Once issued, the
BitLicense remains effective until surrendered by the licensee or
revoked or suspended by DFS.20 DFS may revoke or suspend
a BitLicense, for example, for a violation of any provision of the
A firm with a BitLicense must obtain DFS#39;s prior approval
before taking any action that may result in a material change to an
existing product or service or that may result in a change of
control of the licensed firm or its assets.22
Compliance, Capital, and Examination Requirements
DFS#39;s proposed bitcoin regulations set out detailed
requirements for compliance, capital, books and records, and
Compliance Requirements. To ensure compliance
with all applicable federal and state laws, rules, and regulations,
a virtual currency firm will be required to designate a compliance
officer and to maintain written compliance policies reviewed and
approved by its governing body.23 The firm#39;s
compliance policies must include policies regarding antifraud,
anti-money laundering, cyber security, data privacy, and
Capital Requirements. DFS#39;s proposed
regulations require virtual currency firms to maintain capital in
levels sufficient to maintain the firm#39;s financial
stability.24 DFS will determine a licensee#39;s capital
requirements based on a variety of factors, such as the volume of
the firm#39;s virtual currency business, the amount of leverage
used by the firm, and the firm#39;s liquidity position.
Furthermore, the proposed rules restrict a firm#39;s investment of
retained earnings to certain types of low-risk investments, such as
US government securities, with maturities of up to one year.
Books and Records. For at least ten years, each
firm must keep books and records, including information regarding
each and every transaction, bank statements, minutes of board
meetings, compliance records, including customer identification
documents, and documentation of consumer complaints.25
At DFS#39;s request, each licensed firm must provide immediate
access to all of its facilities and records.
Reporting Requirements and Regular
Examinations. Each virtual currency firm must submit
quarterly and audited annual financial statements to
DFS.26 Notably, each licensee must notify DFS in writing
of any proposed change to the methodology used by the firm to
calculate the value of virtual currency in fiat currency. Whenever
DFS deems necessary, and at least every two years, DFS shall
examine a virtual currency firm#39;s financial condition, safety
and soundness, management policies, compliance with laws and
regulations, and any activities outside of New York State affecting
the firm#39;s New York business.27
DFS#39;s proposed regulatory framework requires virtual
currency firms to establish and maintain an anti-money-laundering
program (AML).28 The firm#39;s governing
body must review and approve a written AML policy, and the firm
must designate an individual as responsible for overseeing and
enforcing the firm#39;s AML program. At a minimum, a
licensee#39;s AML program will include internal policies and
procedures and ongoing training for appropriate personnel to ensure
compliance with AML laws. As part of its AML program, each firm
must keep detailed records for each transaction involving virtual
currency, including the identity of the parties involved and the
precise time of the transaction.
Customer Verification. When opening a new
account for a customer, the firm must verify the customer#39;s
identity and check it against lists maintained by the US Treasury
Department#39;s Office of Foreign Asset Control. For any
transaction involving more than $3,000, the licensed firm must
require verification of the identity of the account holder
initiating the transaction. Additional factors, such as high-risk
customers, high-volume accounts, or accounts on which a suspicious
activity report has been filed, may require enhanced due diligence.
Enhanced due diligence is mandatory for accounts involving foreign
entities, and accounts with foreign shell entities are
Reporting of Suspected Fraud and Illicit
Activity. Firms must monitor transactions for activity
that might signify money laundering, tax evasion, or any illegal or
criminal activity. The firm must immediately notify DFS upon
detection of a suspicious transaction, including any transaction,
or series of transactions, exceeding $10,000 by a person in a
Cyber Security Requirements
Under DFS#39;s proposed regulations, licensed firms will also
be required to implement a cyber security program.29
Among other things, the firm#39;s cyber security program must
address information security, systems and network security,
customer data privacy, and business continuity and recovery
planning. The proposed rules specifically require the
cyber-security program to provide for various audit
functions, including an annual assessment of the
vulnerability of its systems; audit trail systems, which allow for
the complete and accurate reconstruction of all transactions; and
source code reviews by independent third parties. To oversee and
enforce its cyber-security program on a day-to-day basis, each firm
must designate a Chief Information Security Officer.
Business Continuity and Disaster Recovery Plan.
In case a cyber event occurs which disrupts the firm#39;s normal
business activities, each licensed firm must have in place a
disaster recovery plan to ensure the continuity of services during
an emergency. Among other things, the firm#39;s business
continuity plan must identify data, facilities, and personnel
essential to the continued operations of the firm#39;s
business as well as procedures for maintaining backup facilities
and systems to enable the recovery of data and resumption of
operations. Each firm must maintain a copy of its business
continuity plan at an off-site location.
DFS#39;s proposed bitcoin regulations also provide protections
for customer assets.
Consumer Assets. For the protection of the
firm#39;s customers, a licensed firm must maintain a bond or trust
account in US dollars in a form and amount acceptable to
DFS.30 The firm must also hold virtual currency of
the same type and amount, which it owes to each customer.
DFS#39;s proposed regulations prohibit firms from using or
encumbering assets held by the firm on behalf of an account
Consumer Disclosures. Licensed firms must
disclose to customers general terms and conditions for doing
business with the firm, including the customer#39;s right to
monthly account statements, as well as all material risks
associated with the firm#39;s products, services, and activities
and with virtual currency in general.31 In disclosing
material risks, DFS#39;s proposed rules require the firm to state
that virtual currency is not legal tender, that
transactions in virtual currency are generally
irreversible, that virtual currency#39;s value derives from
the continued willingness of market participants to exchange
Fiat Currency for Virtual Currency, and that the nature
of Virtual Currency may lead to an increased risk of fraud or cyber
attack. A licensed firm must also disclose details specific
to each transaction, including the amount of the transaction and
any fees charged to the customer.
Consumer Complaint Policies. DFS#39;s proposed
regulations require virtual currency firms to establish written
policies and procedures pertaining to the resolution of customer
complaints.32 In addition to disclosing the firm#39;s
mailing address, email address, and telephone number for receiving
complaints, the firm must also provide notice that consumers can
contact DFS regarding complaints. Once a transaction is complete, a
licensed firm must provide a detailed receipt to its
Advertising and Marketing. In any advertising
materials, virtual currency firms must include a legend showing
that the firm is licensed by DFS.34 Licensees must
maintain records of all advertising and marketing materials for
examination by DFS.
The initial 45-day window for public comment on DFS#39;s
proposed BitLicense regulatory framework opened on July 23, 2014,
the official publication date of DFS#39;s notice of
rulemaking. Members of the virtual currency industry
immediately requested additional time to consider and respond to
DFS#39;s BitLicense proposal since it is the first of its kind and
may serve as a model for other jurisdictions. Some commentators,
for example, have argued that the proposed rules are too onerous
for small businesses. Instead, they recommend either relaxing
the reporting burdens or exempting small virtual currency firms
In response, DFS has extended the comment period by an
additional 45 days. Comments are now due on October 21, 2014.
As it currently stands, the proposed regulations require any
existing firm that would be subject to the licensing requirement to
apply for a BitLicense within 45 days of the effective date of the
proposed DFS regulations.
We will continue to monitor developments with DFS#39;s proposed
bitcoin regulations, along with DFS initiatives generally.
1 For a general discussion of the creation of DFS and its
powers, please see our December 2011 Jones Day Commentary,
The Department of Financial Services: New York#39;s Newest
Financial Regulator (
a discussion of DFS#39;s regulatory and enforcement activities in
the first year following its inception, please see our May 2013
Jones Day Commentary, The New York State Department
of Financial Services at the One-Year Mark: A New Aggressive
Regulator WorthFollowing (
For a discussion of DFS#39;s regulatory and enforcement activities
in the second year following its inception, please see our May 2014
Jones Day Commentary, The New York State Department
of Financial Services#39; Recent Enforcement Efforts (
2 Notice of Proposed Rulemaking on the Regulation of
the Conduct of Virtual Currency Businesses, New York State
Department of Financial Services, 36 NY Reg. 14 (July. 23, 2014).
3 NY Regulators Turn Their Attention to
Bitcoin, Law 360, Nov. 18, 2013 (http://www.law360.com/articles/488882).
4 Silk Road Forfeits $28 Million of Bitcoins,
The Wall Street Journal, Jan. 16, 2014 (http://online.wsj.com/news/articles/SB10001424052702304603704579325132563396104).
5 Bitcoin Entrepreneur Pleads Not-Guilty to
Money-Laundering, The Wall Street Journal, Apr. 29,
Two Charged in Alleged Bitcoin-Laundering Scheme,
The Wall Street Journal, Jan. 27, 2014 (http://online.wsj.com/news/articles/SB10001424052702303553204579346711725068816).
6 Almost Half a Billion of Bitcoins Vanishes,
The Wall Street Journal, Feb. 28, 2014 (http://online.wsj.com/news/articles/SB10001424052702303801304579410010379087576).
Mt. Gox has since found about 200,000 of the missing Bitcoins in an
old-format wallet. Mt. Gox Says It Found Missing
Bitcoin Worth About $116 Million, The New York
Times, March 21, 2014 (http://dealbook.nytimes.com/2014/03/21/mt-gox-says-it-has-found-200000-bitcoins-worth-about-114-million/).
Mt. Gox declared bankruptcy in Japan in February and in the United
States in March. Mt. Gox US Bankruptcy Approved to Help
Bitcoin Hunt, Bloomberg, June 17, 2014 (http://www.bloomberg.com/news/print/2014-06-17/mt-gox-u-s-bankruptcy-approved-to-help-bitcoin-hunt.html);
Mt. Gox Head Believes No More Bitcoins Will be Found,
The Wall Street Journal, June 29, 2014 (http://online.wsj.com/articles/mt-gox-head-believes-no-more-bitcoin-will-be-found-1403850830).
7 IRS Virtual Currency Guidance, Notice 2014-21,
Mar. 25, 2014 (http://www.irs.gov/uac/Newsroom/IRS-Virtual-Currency-Guidance).
8 China Central Bank Warns Banks on Bitcoin,
The Wall Street Journal, May 7, 2014 (http://online.wsj.com/news/articles/SB10001424052702304655304579547251552490962).
9 Winklevoss Twins to List Bitcoin Fund on
Nasdaq, The New York Times, May 8, 2014 (http://dealbook.nytimes.com/2014/05/08/winklevoss-twins-to-list-bitcoin-fund-on-nasdaq/).
In February 2014, the Winklevoss brothers launched the Winklevoss
Index, which is one of several indices that price bitcoin.
Winklevoss Twins Plan Bitcoin Index, Fortune,
Feb. 19, 2014 (http://fortune.com/2014/07/22/on-winklevoss-bitcoin-index-its-open-season-for-developers/).
10 California Assembly Bill No. 129 (2014);
California Governor Signs Bill to Bring Bitcoin and Other
Currency into Fold, Reuters, June 28, 2014 (
11 Bitcoin Faces Regulatory Backlash as EU Tells
Banks to Stay Away, Bloomberg, July 4, 2014 (http://www.bloomberg.com/news/2014-07-04/bitcoin-faces-regulatory-backlash-as-eu-tells-banks-to-stay-away.html).
12 Expedia and Dell have joined Overstock.com, The
Chicago Sun-Times, and Dish Network as retailers which now
accept bitcoin. Expedia Starts Accepting Bitcoin for Hotel
Bookings, The Wall Street Journal, June 11, 2014 (http://blogs.wsj.com/moneybeat/2014/06/11/expedia-starts-accepting-bitcoin-for-hotel-bookings/);
Dell Begins Accepting Bitcoin, The New York
Times, July 18, 2014 (http://dealbook.nytimes.com/2014/07/18/dell-begins-accepting-bitcoin/);
Lake Tahoe Property Sells for $1.6 million in
BitcoinsTransaction Is Just One of a Handful to Use the
Virtual Currency, The Wall Street Journal, Aug. 8,
Recently, other investors used bitcoin to purchase a Stradivarius
violin valued in the low millions. Musical Gold:
Can three ambitious siblings turn old violins into a new investment
strategy? The New Yorker,July 28, 2014 (http://www.newyorker.com/magazine/2014/07/28/musical-gold).
13 Press Release, DFS, Nov. 14, 2013, (http://www.dfs.ny.gov/about/press2013/virtual-currency-131114.pdf).
14 NY State Dep#39;t of Financial Services Regulation
of the Conduct of Virtual Currency Businesses, § 200.3(a)
(proposed July 23, 2014) (http://www.dfs.ny.gov/about/press2014/pr1407171-vc.pdf).
15 Proposed Regulation, §§
16 In March 2014, DFS began accepting applications to
operate virtual currency exchanges, which explains the exemption
for previously approved firms. Order, DFS, Mar. 11, 2014 (http://www.dfs.ny.gov/about/po_vc_03112014.pdf).
While DFS#39;s framework expressly exempts merchants, consumers,
and previously approved firms from the licensing requirement, the
proposed regulations do not identify virtual currency miners by
name. Instead, DFS noted in its July 17, 2014 press release that
the activity of controlling, administering, or issuing a
virtual currency … does not refer to virtual currency
miners. Since some early commenters on DFS#39;s proposal
contend that DFS should exempt miners from the licensing
requirement, it appears that DFS may need to clarify this issue
before finalizing its regulation. See Proposed Regulation,
§ 200.3(c); Press Release, DFS, July 17, 2014(http://www.dfs.ny.gov/about/press2014/pr1407171.html).
For an explanation of how virtual currency is created, or
mined, please see ourcommentary, NY Regulators
Turn Their Attention to Bitcoin, Law 360, Nov. 18,
17 Proposed Regulation, § 200.4(a).
18 Proposed Regulation, § 200.4(a)(1) (14);
19 Proposed Regulation, § 200.6(b).
20 Proposed Regulation, § 200.6(b).
21 Proposed Regulation, § 200.6(c).
22 Proposed Regulation, § 200.11(a) and
23 Proposed Regulation, § 200.7(a)
24 Proposed Regulation, § 200.8.
25 Proposed Regulation, § 200.12.
26 Proposed Regulation, § 200.14.
27 Proposed Regulation, § 200.13(a)(1)
28 Proposed Regulation, § 200.15.
29 Proposed Regulation, §§ 200.16,
30 Proposed Regulation, § 200.9.
31 Proposed Regulation, § 200.19.
32 Proposed Regulation, § 200.20(a).
33 Proposed Regulation, § 200.19(e)(1)
34 Proposed Regulation, § 200.18.
The content of this article is intended to provide a
general guide to the subject matter. Specialist advice should be
sought about your specific circumstances.