The past year has seen a flurry of crypto-related activities by the federal financial regulators, including the issuance of reports, guidance, joint statements, and interpretive letters. For example, in November 2021, the President’s Working Group on Financial Markets, along with the Federal Deposit Insurance Corporation (FDIC) and the Office of the Comptroller of the Currency (OCC), released a long-awaited Report on Stablecoins, recommending comprehensive federal legislation for stablecoins. In December 2021, the federal banking agencies released a statement announcing the establishment of “crypto-asset policy sprints,” to generate coordinated guidance from the agencies. And in March 2022, President Biden signed an Executive Order calling on federal agencies to take a unified approach to regulating and overseeing digital assets. But while the industry still awaits comprehensive federal regulation, the New York Department of Financial Services (DFS) has moved forward with guidance for virtual currency business entities licensed under 23 NYCRR Part 200 or chartered as limited purpose trust companies under the New York Banking Law (VCEs). This marks the first clear guidance from a U.S. regulator, state or federal, on expectations regarding transaction monitoring and the use of blockchain analytics for the virtual currency industry.
The guidance encourages VCEs to adopt blockchain analytics tools as a best practice to detect, prevent, and manage suspicious activities in the virtual currency industry. Virtual currency activities can involve different sources, destinations, and funds flow types than are found in more traditional, fiat-currency contexts. These characteristics trigger compliance challenges with regard to anti-money laundering (AML) and economic sanctions issues. Due to these challenges, the DFS emphasizes the importance of blockchain analytics to VCEs in addressing, among other issues, AML and sanctions requirements.
Superintendent Adrienne A. Harris noted that, “Blockchain analytics tools provide companies with an efficient, data-driven way to conduct customer due diligence, transaction monitoring, and sanctions screening, among other things, which are all critical elements of our virtual currency regulation . . . . We expect regulated entities to utilize best practices to uphold the safety and soundness of the virtual currency market and to protect consumers.”
While a VCE may outsource its compliance obligations to third-party service providers, the VCE ultimately remains responsible for compliance. A VCE must have clearly documented policies, processes, and procedures with regard to how blockchain analytics tools are integrated into its control framework, consistent with its risk profile.
The guidance emphasizes a risk-based approach to compliance. Specifically, a VCE’s risk mitigation strategy must take into account the VCE’s business profile, the types of virtual currencies involved, and their particular characteristics. While blockchain analytics tools may assist a VCE with compliance, the tools may have limited effectiveness depending on the virtual currencies used.
In particular, the guidance sets out the following expectations for VCEs:
The DFS noted that it aims to maintain a robust regulatory regime, while remaining a favorable jurisdiction for VCEs. The guidance was informed by conversations between the DFS and stakeholders, and the DFS stated its intent to continue engaging with industry, other regulators, and experts in the field. This echoes the language of recent government-wide issuances, which require a risk-based approach to compliance and increased virtual currency regulation, but in the context of a cautious welcome to industry players. In October 2021, the Office of Foreign Assets Control released sanctions compliance guidance for the virtual currency industry. The Financial Crimes Enforcement Network has issued multiple releases on combating risks in the virtual currency space. Issuing guidelines, advisories, and the like represents an implicit acceptance of the industry and its associated risks, while setting standards for best practices. A few weeks ago, the FDIC announced that FDIC-supervised institutions must notify the FDIC if engaging in crypto asset activities. The release emphasized that crypto activities pose risks, but also that the FDIC supports safe and sound innovation. Similarly, in January 2021, the OCC considered the permissibility of national banks and federal savings association acting as nodes on independent node verification networks and engaging in related stablecoin activities. The OCC concluded that these financial institutions could use new technologies to conduct bank-permissible functions. However, shortly thereafter, under the Biden administration, the OCC issued a purported clarification that such activity was permissible only once a financial institution has demonstrated, to its supervisory office’s satisfaction, that the financial institution has adequate controls in place for such activity.
More robust federal regulation of the virtual currency industry is undoubtedly forthcoming, and it is possible that other states may follow the DFS’s lead as well. VCEs should engage with the DFS, and other applicable regulators, to ensure a role in the development of future guidance and regulations. VCEs must also take steps to implement the guidance and should carefully review and update existing policies and procedures as needed.
 The guidance is not intended to limit the scope or applicability of any law or regulation.