Section 200.1, “Introduction,” sets forth the statutory authority for the rule.

Section 200.2, “Definitions,” defines terms used throughout the proposed regulation. Most significantly this Section defines “virtual currency” and “virtual currency business activity” and specifies conduct that is not covered by the proposed regulation.

Section 200.3, “License,” prohibits any Person from engaging in virtual currency business activity without a license.

Section 200.4, “Application,” sets forth the information to be included in a prospective licensee’s application and provides for the granting of a conditional license, in certain circumstances.

Section 200.5, “Application fees,” requires applicants to pay an application fee of $5000.00 to the Department of Financial Services (the “Department”) and provides that licensees may need to pay fees for the processing of additional applications related to the license.

Section 200.6, “Action by superintendent,” provides for the superintendent to approve or deny an application and, if approved, to suspend or revoke a license on specified grounds after a hearing.

Section 200.7, “Compliance,” requires licensees to comply with all applicable federal and state law, designate a compliance officer, and maintain and enforce various written compliance policies.

Section 200.8, “Capital requirements,” requires that licensees maintain minimum amounts of capital as determined by the superintendent based on a number of factors.

Section 200.9, “Custody and protection of customer assets,” requires licensees to establish a bond or trust account for the benefit of their customers, requires licensees to hold virtual currency in the same type and amount as any virtual currency owed by the licensee, and prohibits licensees from encumbering customer assets.

Section 200.10, “Material change to business,” requires licensees to seek prior approval by written application to introduce a new, or materially change an existing, product or service.

Section 200.11, “Change of control; mergers and acquisitions,” requires licensees to seek prior approval by written application before executing a change of control or merger or acquisition.

Section 200.12, “Books and records,” requires licensees to maintain certain records pertaining to each transaction and make such records available to the Department upon request.

Section 200.13, “Examinations,” requires licensees to permit the superintendent to examine the licensee, including the licensee’s books and records, at least once every two years and to make special investigations as deemed necessary by the superintendent.

Section 200.14, “Reports and financial disclosures,” requires licensees to file quarterly financial statements and audited annual financial statements, to make special reports upon request, and to notify the Department upon discovery of any breach of law or upon a proposed change to the methodology used to calculate the value of virtual currency in fiat currency.

Section 200.15, “Anti-money laundering program,” requires licensees to establish and implement an anti-money laundering program, which includes customer identification and transaction monitoring, to maintain records, and to make reports as required by applicable federal anti-money laundering law.

Section 200.16, “Cyber security program,” requires licensees to design a cyber security program and written policy, designate a chief information security officer, make reports, and conduct audits.

Section 200.17, “Business continuity and disaster recovery,” requires licensees to establish and maintain a written business continuity and disaster recovery plan to address disruptions to normal business operations.

Section 200.18, “Advertising and marketing,” requires licensees to display a legend regarding its licensure by the Department, maintain all advertising and marketing materials, comply with all applicable federal and state disclosure requirements, and not make any false or misleading representations or omissions.

Section 200.19, “Consumer protection,” requires licensees to disclose material risks and terms and conditions to customers and to establish an anti-fraud policy.

Section 200.20, “Complaints,” requires licensees to disclose the licensee’s and the Department’s contact information and other information pertaining to the resolution of complaints.

Section 200.21, “Transitional period,” requires Persons already engaged in virtual currency business activity to apply for a license with the Department within 45 days of the effective date of the regulation.

Section 200.22, “Severability,” states that in the event a specific provision of the regulation is adjudged invalid, such judgment will not impair the validity of the remainder of the regulation.

A Revised Regulatory Impact Statement, Regulatory Flexibility Analysis, Rural Area Flexibility Analysis and Job Impact Statement is not required because the revisions to the proposed regulation do not change the conclusions set forth in the previously published Regulatory Impact Statement, Regulatory Flexibility Analysis, Rural Area Flexibility Analysis and Job Impact Statement.

The New York State Department of Financial Services (the “Department”) received over 3000 comments on proposed rule 23 NYCRR 200 from virtual currency businesses, other financial services businesses, merchants, retailers, researchers, academics, policy centers, governmental agencies, and private individuals. Many commenters addressed more than one provision of the proposed regulation, and several requested specific changes. Every comment has been processed and considered by the Department, as reflected in the full text of the Assessment of Public Comment, which is available at www.dfs.ny.gov. This summary is intended to provide an overview of the categories of comments received by the Department and the changes the Department has made to the proposed regulation in response to those comments.

Many comments requested clarification over who is, and is not, required to obtain a virtual currency license. Several of those commenters requested that the Department specify that certain activities, such as software development, non-financial uses of virtual currency technology, and investment in virtual currency, and certain programs, such as gift cards and customer loyalty programs, are exempt from the regulation. The Department has revised the definitions of virtual currency and virtual currency business activity accordingly to exclude certain activities and programs. In particular, the Department has clarified that virtual currency business activity does not include transactions that are undertaken for non-financial purposes and that do not involve the transfer of more than a nominal amount of virtual currency, and that virtual currency does not include digital units used in gift cards. The Department has also revised the regulation to clarify that the development and dissemination of software in and of itself does not constitute virtual currency business activity. (Section 200.2)

The Department also received many comments requesting an on-ramp or more flexible set of licensing requirements for small and start-up businesses. The Department has addressed those comments by providing that the superintendent may grant a conditional license to conduct virtual currency business activity. The Department set forth in the revised proposed regulation a list of factors that the superintendent may consider in determining whether to issue or renew a conditional license. (Section 200.4)

Commenters also requested that the Department set forth the fee that applicants will be required to pay for a virtual currency license. The revised proposed regulation sets the fee at $5000.00. (Section 200.5)

Another large source of comment related to the capital requirements set forth in the proposed regulation. The Department considered those comments and revised the requirements to allow licensees to hold capital in the form of cash, virtual currency, and high quality, highly liquid, investment-grade assets in a proportion that is acceptable to the superintendent. (Section 200.8)

Some commenters expressed concern that requiring the superintendent’s approval prior to permitting changes in control could limit start-up firms’ ability to attract investors and raise capital. To address that concern, the Department revised the regulation to provide licensees with the ability to apply for a determination that a given party will not be considered a control party by the Department, based on several factors relating to the party’s ability to manage or exercise control over the licensee. (Section 200.11)

Several commenters also requested that the Department reduce the burden associated with the proposed regulation’s recordkeeping requirements. In response, the Department revised the proposed regulation to reduce the recordkeeping requirement from ten years to seven years (Section 200.12) and require that licensees maintain, only to the extent practicable, specific identifying information regarding parties to the transaction that are not customers or accountholders of the licensee. (Sections 200.12 and 200.15)

The Department also received comments requesting that the regulations include more detail in certain areas, including the addition of specific formulas for setting capital requirements and further technical specifications with respect to cyber security. The Department has considered those comments but has concluded that the factors and principles set forth in the proposed regulation provide the appropriate level of specificity.

While a number of commenters expressed support for the proposed regulation, others rejected the regulation in its entirety, stating that virtual currency should be regulated under existing money transmission law or not at all. The Department has extensively considered the need to regulate virtual currency business activity and the appropriate way to do so, and it has concluded that a new regulation under the Financial Services Law is necessary to protect New York consumers and users of virtual currency-related services.

Similarly, some commenters called for the Department to heighten the proposed regulations and add to it new requirements, while others contested the need for regulatory requirements relating to money laundering, cyber security, and recordkeeping, among other specific provisions. The Department has considered both sets of comments and has determined that the proposed regulation adequately addresses the risks associated with virtual currency business activity.