Enter to open, tab to navigate, enter to select
NYDFS Issues Final Guidance on Listing and Delisting of Virtual Currencies
Practical Law Legal Update w-041-4471 (Approx. 8 pages)
NYDFS Issues Final Guidance on Listing and Delisting of Virtual Currencies
by Practical Law Finance
| Published on 20 Nov 2023 • USA (National/Federal) |
The New York Department of Financial Services (NYDFS) issued final guidance to virtual currency entities (VCEs), including state BitLicensees and limited purpose trust companies, on policies related to the listing and delisting of virtual currencies.
On November 15, 2023, the New York Department of Financial Services (NYDFS) issued final guidance on policies related to the listing and delisting of virtual currencies in response to feedback received during the public comment period on its September 18, 2023 proposed guidance (see Legal Update, NYDFS Issues Updated Guidance on Listing and Delisting of Virtual Currencies). The final guidance supersedes its prior guidance and heightens state standards for coin listing and coin delisting.
The final guidance applies to virtual currency entities (VCEs), which include:
- BitLicensees, which are entities licensed under NYDFS virtual currency regulation 23 NYCRR Part 200, issued under the New York Financial Services Law.
- Entities chartered as limited purpose trust companies under the New York Banking Law.
The final guidance incorporates:
- Business model considerations. Feedback on the proposal indicated that the risk associated with VCs is partly dependent on the specific nature of a VCE's business activities. The final guidance includes risk-based considerations, such as enhanced protections for retail consumers, which would make VC that exhibit certain characteristics impermissible for self-certification for any VC business activity involving retail consumers.
- Risk-assessment expectations. Feedback on the proposal indicated a need for greater clarity of the risk-assessment expectations for VCEs to reduce regulatory uncertainty and ensure compliance. The final guidance maintains high risk-assessment standards while adding tailored risk-assessment expectations to account for a VCE's specific VC business activities.
- Advance notification requirements. Feedback on the proposal indicated that in certain cases the advance notification requirements for coin delisting may not be feasible and could result in unintended consumer harm. The final guidance provides limited exceptions to advance notification requirements based on exigent circumstances.
- Updated definitions. The final guidance includes certain updated defined terms.
Feedback on the proposed guidance was received from VCEs, industry groups, advisory firms, and the general public. In addition, NYDFS conducted direct outreach with VCEs to introduce the proposed requirements and identify areas that could benefit from greater clarity.
The following sections explain various aspects of the final guidance.
VCE Coin-Listing Policies
The final guidance provides that VCEs that had a previously approved coin-listing policy under the prior guidance are not permitted to self-certify any coins until they submit to and receive approval from NYDFS for coin-listing policies and coin-delisting policies that meet the standards of the final guidance. The NYDFS will not approve a coin-listing policy absent an accompanying coin-delisting policy.
Following NYDFS approval of a VCE's coin-listing policy, the VCE may proceed with self-certification of coins, making such coins available for approved VC business activity in New York or to New Yorkers.
VCEs without NYDFS-approved coin-listing policies may only list coins that are included on the NYDFS Greenlist, unless a VCE has otherwise been approved by NYDFS to list a coin as a material change to business under New York Financial Services Law, 23 NYCRR § 200.10. NYDFS may, at any time and in its sole discretion, require VCEs to delist or otherwise limit New Yorkers’ access to coins that are not included on the Greenlist.
The final guidance provides that a coin-listing policy must, at a minimum, include and be based on the following:
VCE Coin-Listing Governance Requirements
The VCE must ensure that:
- Its board of directors or equivalent governing authority approves the coin listing, reviews, and determines whether to re-approve the coin-listing policy at least annually, reviews and makes decisions to approve or disapprove each new coin, and is independent from those responsible for making the initial recommendations whether to list or delist a coin.
- Any conflicts of interest in connection with the review and decision-making process have been assessed, addressed, and disclosed to the public.
- It keeps records consistent with applicable recordkeeping requirements and makes them available for NYDFS review at all times.
- It informs NYDFS immediately in writing if, at any time after NYDFS approves its coin-listing policy, the VCE's coin-listing policy ceases to comply with the requirements of the updated guidance.
- It does not make material changes or revisions to its coin-listing policy without the prior written approval of NYDFS.
The final guidance incorporates the following additional governance requirements for VCEs:
- Its governing authority, at least annually, reviews and determines whether to re-approve the coin-listing policy to ensure that it continues to properly identify, assess, and mitigate risks.
- Its governing authority is independent from those responsible for making the initial recommendations on whether to list or delist a coin.
VCE Coin-Listing Risk-Assessment Requirements
The VCE must perform a comprehensive risk assessment designed to ensure that any coin and the uses for which it is being considered for listing with the VCE comply with NYDFS VC regulation (see Practice Note, Virtual Currency Business Regulation (NY State)) and with the safety and soundness of the VCE. The risks to be assessed include:
- Technical design and technology.
- Operational.
- Cybersecurity.
- Market and liquidity.
- Illicit finance.
- Legal.
- Reputational.
- Regulatory.
The final guidance requires VCEs to consider other factors to identify and mitigate the risks involved in each coin and its uses, and to incorporate the NYDFS Guidance on Prevention of Market Manipulation and Other Wrongful Activity, where applicable. Other factors VCEs are asked to identify and mitigate against include:
- Conflicts of interest. A VCE must have in place effective policies and procedures to mitigate any conflicts of interest from impacting the decisions, recommendations, and assessments made for each coin under review. In addition, a VCE must ensure that all potential conflicts of interest relating to coin-listing decisions are clearly disclosed to the public.
- Customer protection. A VCE must ensure that all customers are treated fairly and are afforded the full protection of all applicable laws and regulations, including protection from unfair, deceptive, or abusive practices.
VCE Self-Certification Limitations
A coin designed or substantially used to circumvent laws and regulations, or that has features designed to obfuscate or conceal the identity of an individual or entity, cannot be self-certified. Additionally, coins not included on the Greenlist that have the following features, or where it cannot be determined whether the coin has any of the following features, cannot be self-certified for VC business activity available to retail consumers:
- Stablecoins. A VCE cannot self-certify any stablecoin that is not included on the Greenlist. This restriction extends to any coin designed to serve as collateral for a stablecoin not included on the Greenlist.
- Exchange coins. A VCE cannot self-certify any coin that is issued by or on behalf of any online platform operated by an entity acting as an intermediary between purchasers and sellers of VC, such as a VC exchange.
- Protocol resiliency. A VCE cannot self-certify any coin that is the native asset for a blockchain protocol (protocol) where there are concerns related to the protocol’s decentralization, such where a single entity or individual that controls more than 51% of the hash power for a protocol with a proof-of-work (or similar) consensus mechanism or similar levels of susceptibility of concentration risk for a protocol with proof-of-stake (or similar) consensus mechanism. This restriction extends to all coins issued on protocols that meet the above thresholds.
- Bridged coins. A VCE cannot self-certify any coin that circulates on a protocol in which it is not natively issued by the coin’s creator or issuer. This restriction extends to any coin designed to serve as collateral or governance for an application that enables the transfer of coins across different protocols, such as coin bridge platforms.
- Circulating supply. A VCE cannot self-certify any coin in which the circulating supply, which is the number of a VC that are publicly available for purchase in the marketplace and are not subject to lock-up or similar vesting periods, is less than 35% of its total supply, which is the total number of coins, including any of the VC that is locked or held in reserve and is not publicly available in the marketplace.
A VCE must submit a written request for approval as a material change to business under New York Financial Services Law, 23 NYCRR § 200.10, to NYDFS to list a coin with any of the above characteristics. The request must include a risk assessment for the coin that meets the standards described within the final guidance and must specify a particular business use case for listing the coin. In reviewing any such request, NYDFS will consider whether effective controls are in place to address:
- Safety and soundness concerns.
- Consumer protection issues.
VCE Coin Monitoring
The VCE must have in place policies and procedures for monitoring a self-certified coin to ensure that its continued listing remains consistent with safety and soundness considerations, protection of customers and the public, and all requirements of the final guidance. The final guidance clarifies that these policies and procedures must include, but are not limited to:
- Periodic re-evaluation of the coin by those responsible for approval or disapproval recommendations related to coin listing, including whether material changes have occurred. The re-evaluation frequency must be not less than annual.
- Adoption, documentation, and implementation of control measures to manage risks associated with the coin, including but not limited to those risks involving cybersecurity and illicit activity.
- A coin-delisting policy that includes a process that can be readily implemented if the ongoing monitoring of a coin (or another reason) results in a delisting decision.
The final guidance provides that VCEs are expected to meet the expectations of the NYDFS’s Guidance on Use of Blockchain Analytics and other Bank Secrecy Act and anti-money laundering (BSA/AML) and sanctions-related control requirements. VCEs must also verify that their coin-listing policies are appropriately integrated into their overall risk and compliance framework.
VCE Coin Delisting Requirements
The final guidance clarifies the NYDFS’s expectations with respect to coin-delistings. In the event a listed coin is identified as presenting newly elevated risk, whether through a VCE's monitoring process, a NYDFS-identified weakness or vulnerability, or otherwise, VCEs must be able to discontinue support of that coin in a manner that is consistent with safety and soundness principles and with the protection of customers and the public. All VCEs must meet with NYDFS by December 8, 2023 to preview their draft coin-delisting policy. Final coin-delisting policies must be submitted to NYDFS for approval by January 31, 2024.
The determination to delist a coin should occur only if the VCE concludes that the coin’s delisting is consistent with the final guidance, NYDFS VC regulation, and the safety and soundness of the VCE. Coin-delisting policies must include procedures that comprehensively address the steps involved in removing support for a coin and must be tailored to the VCE’s:
- Specific business model.
- Operations.
- Customers and counterparties.
- Geographies of operations.
- Service providers.
- Use, purpose, and specific features of coins being considered.
According to the final guidance, there may be very limited exceptions where all delisting requirements may be inapplicable with a particular business model. In those instances, the VCE may come to NYDFS to tailor how the de-listing policy final guidance applies to it.
A coin-delisting policy should, at a minimum, contain and be based on the following attributes:
VCE Delisting Governance Requirements
The final guidance provides that when a VCE ceases support for a coin, it must do so in an orderly manner. VCEs must ensure that:
- Its governing authority approves the coin-delisting policy to ensure the robustness of the governance, monitoring, and oversight framework.
- Its governing authority, at least annually, reviews and determines whether to re-approve the coin-delisting policy to ensure it continues to properly identify, assess, and mitigate risks.
- Its governing authority is independent from those responsible for making the initial recommendations whether to list or delist a coin.
- The VCE keeps records consistent with applicable recordkeeping requirements and makes them readily available for NYDFS review.
- The VCE informs NYDFS in writing of any decision to delist a coin following such a determination at least 10 business days prior to informing its customers. The notification to NYDFS of a delisting decision must include the rationale and all elements of the proposed delisting timeline, unless exigent circumstances exist outside the VCE’s control requiring more immediate action.
- The VCE does not make any material changes or revisions to its coin-delisting policy without the prior written approval of NYDFS.
VCE Delisting Policy Requirements
Coin-delisting policies must:
- Detail the process that underpins a delisting event.
- Establish thresholds on criteria that may prompt a delisting.
- Incorporate the VCE's ongoing monitoring procedures.
- Be reviewed and updated periodically.
- Include the types of events that may cause requiring delisting, such as:
- new findings resulting from re-evaluation or ongoing monitoring of a listed coin;
- changes in the legal or regulatory environment; or
- receiving a directive from NYDFS to delist a coin.
The VCE must establish roles and responsibilities in connection with each type of event to provide clear instructions for the VCE's stakeholders depending on the specific facts and circumstances.
The elements related to executing a delisting event that must be addressed in a coin-delisting policy include:
- Advance notice. VCE customers must be provided with at least 30 days prior written notice of any coin delisting using commercially reasonable methods, unless the VCE is directed otherwise by NYDFS.
- Customer support. Following the communication of a coin-delisting decision, a VCE must provide customer support to answer questions and assist customers with selling the impacted coin or otherwise transferring it off the VCE's platform.
- Documentation. VCEs must document all key details of any coin-delisting decision.
- Ongoing monitoring. VCEs must dedicate resources to monitoring the safety and soundness of a delisting, including the necessary expertise to detect issues with the financial health of the business, cybersecurity vulnerabilities, illicit finance risk, or any technological or other challenges that would affect the customer experience.
- Impact analysis. VCEs must consider the impact a delisting decision might have on the VCE’s internal business operations, counterparties, and third-party service providers.
VCE Coin Delisting Process
Once the decision to delist a coin is reached, a VCE must communicate with its customers regarding the delisting in advance of acting to cease support of the coin. VCEs must provide customers with at least 30 days prior written notice of:
- The specific coin or coins that are being delisted.
- The rationale supporting the decision to delist.
- The timing of the delisting.
- The steps that impacted customers may take to sell or transfer the affected coin or coins.