NYDFS Superintendent Issues Guidance on Virtual Currency Activities

New York State Department of Financial Services ("NYDFS") Superintendent Adrienne A. Harris issued guidance to New York regulated banking entities planning to engage in virtual currency-related activities.

In an industry letter to all New York regulated banking organizations, as well as branches and agencies of foreign banking organizations licensed in New York (collectively, "Covered Institutions"), NYDFS said that it must approve any virtual currency-related activity, including any activity performed by a third-party service provider. NYDFS said that (i) its approval must be sought a minimum of 90 days before the commencement of any virtual currency-related activity, and (ii) each Covered Institution already engaged in virtual currency activity should notify its NYDFS point of contact.

Covered Institutions seeking approval must submit a written submission that will allow NYDFS to assess the "safety and soundness" of the proposed activity. The written submission to NYDS must include:

• Comprehensive Business Plan. The business plan should include, among other things, (i) the legal entity or entities engaging in the proposed activity; (ii) disclosure and explanation of any engagement of third-party service providers; (iii) a description of the "planned operating model and key technology architecture"; (iv) the targeted customer base and related fees for the service; (v) financial projections; and (vi) a "formal project plan" that defines staffing roles and project requirements and deliverables.

• Risk Management. A detailed description of the Covered Institution's company-wide "risk-management framework" that addresses: (i) operational risk, (ii) credit risk, (iii) market risk, (iv) capital risk, (v) liquidity risk, (vi) cybersecurity and fraud risk, (vii) technology risk, (viii) third-party service provider risk, (ix) legal and compliance risk, (x) reputational risk and (xi) strategic risk.

• Corporate Governance and Oversight. A description of the corporate governance framework for the activity.

• Consumer Protection. An analysis of the activity's impact on customer safety including (i) the Covered Institution's policies and procedures relating to customer protection; and (ii) samples of customer contracts.

• Financials. A description of the proposed activity's anticipated impact on the Covered Institution's capital and liquidity.

• Legal and Regulatory Analysis. An analysis of the laws and regulations relevant to the proposed activity.

Ms. Harris said that the guidance was "critical" to protect consumers and that it provided clear regulatory expectations for those Covered Institutions that may engage in virtual currency-related activities.