The New York State Department of Financial Services (NYDFS) recently issued guidance to virtual currency businesses that are (i) licensed under 23 NYCRR Part 200 (the Bitlicense) or (ii) chartered as limited purpose trust companies under the New York Banking Law (virtual currency businesses). The guidance indicates that the NYDFS will, in practice, expect virtual currency businesses to adopt analytics tools incorporating analyses of their customers’ “on-chain” transactions, in light of the risk analysis performed on each customer, to comply with existing customer due diligence, suspicious transaction monitoring, and Office of Foreign Asset Control (OFAC) screening requirements.
The guidance states that “virtual currencies, by their nature, typically enable provenance tracing (i.e., review of previous transfers or “hops” along the public blockchain ledger or “on-chain”). Put differently, the blockchain ledger’s immutability typically allows a historical view of a virtual currency transmission between wallet addresses, providing the opportunity for greater visibility into transaction lineage than is typically found with traditional, fiat funds transfers.” The guidance indicates that virtual currency businesses will need to deploy appropriate data analytics tools to fulfill their anti-money laundering (AML), KYC, suspicious activity reporting, and OFAC sanctions screening requirements.
The NYDFS guidance recommends using analytics tools that collect identifying information (e.g., the wallet’s physical location at the time of a transaction) that can be cross-referenced with often-pseudonymous on-chain data to enhance customer verification. The NYDFS also recommends software that allows virtual currency businesses to perform real-time red flag analysis of client transactions, including identification of transactions (i) processed through mixers or tumblers, (ii) sent to or from darknet markets, or (iii) likely to be undertaken in furtherance of illicit activity, such as ransomware. Finally, the NYDFS reminds companies licensed as virtual currency businesses that they should be able to monitor transactions closely enough to identify virtual currency addresses associated with sanctioned jurisdictions and individuals on OFAC’s Specially Designated Nationals (SDN) List.
The Guidance specifies, at a level of detail not previously articulated, the AML/Bank Secrecy Act (BSA)/OFAC compliance responsibilities of virtual currency businesses. Bitcoin licensees are subject to the AML program requirements set forth at 23 NYCRR 200.15, which generally mirror the requirements applicable to New York State-chartered, non-deposit trust companies. Such trust companies, whether or not specifically chartered to engage in virtual currency businesses, are subject to the same AML/BSA/OFAC compliance responsibilities that apply to New York State-chartered commercial banks. See 3 NYCRR Section 115.1 and Part 116. Going beyond federal requirements, the NYDFS also requires all virtual currency businesses organized as NY non-deposit trust companies, and bitcoin licensees that are also licensed as money transmitters, to provide annual certification (by board resolution or senior officer certification) that they have an AML/BSA/OFAC Transaction Monitoring and Filtering Program compliant with Section 504.3 of the Superintendent’s Regulations, 3 NYCRR Part 504.
Take action now
Virtual currency businesses should consider an audit of their analytics capabilities to determine whether the data automatically collected from customers and in connection with customer transactions provides the requisite information needed to comply with applicable AML, KYC, and OFAC regulatory requirements.
Seek legal counsel
Nixon Peabody’s Banking & Finance team delivers sophisticated advice and counsel to nascent and established institutions, our Export Controls and Economic Sanctions team helps companies comply with regulatory complexities, and our Blockchain and Digital Assets team can further assist you in conducting business in this rapidly changing marketplace.