21 Jul New York’s BitLicense regulations catch Bitcoin businesses everywhere

Last week, the New York State Department of Financial Services published draft regulations relating to the conduct of business involving virtual currency – the first substantive detailed virtual currency regulations to be issued by any jurisdiction.

The man behind the proposals is 44 year old Superintendent of Financial Services, Benjamin Lawsky, who was described by Business Insider as “The Wall Street Regulator Who Pissed Off The Fed, The Treasury, And The Entire City Of London”. He regulates around 4,400 financial services business with total assets of around $6.2 trillion.

The 40-page draft BitLicence regulations focus heavily on consumer protection, anti-money laundering and cyber security. In a supporting press release, Lawsky said “We have sought to strike an appropriate balance that helps protect consumers and root out illegal activity – without stifling beneficial innovation.” Opinions on whether the balance is right is being hotly debated on social media and in the press.

According to the Wall Street Journal, Cameron Winklevoss welcomed the regulations saying he was pleased Lawsky had “embraced bitcoin and digital assets” and looked forward to “New York State becoming the hub of this exciting new technology.”

Nick Spanos, co-founder of the New York City Bitcoin Center told CNN that he welcomed regulation but said younger entrepreneurs in his circles think the rules are too costly and will crush them.”

In an impassioned blog post, founder of Coinapult and SatoshiDice, Erik Vorhees described Lawsky’s proposals as “anachronistic legislation” that will “… toss (Bitcoin) into the same unethical regulatory mess that currently governs the legacy banking system.”

Meanwhile, leading virtual currency researcher and acedemic, Jerry Brito, wrote that the proposed regulations were “a step in the right direction” and “not out of the ordinary”.

Lawsky proposes a new body of technology-specific regulation. Interviewed on CNBC he said “(the regulatory framework) covers basically anyone operating in a significant commercial way in the Bitcoin space”, suggesting only large players would be affected. However, as drafted, the definition of virtual currency business activity is wide and will catch exchanges (including those exchanging from one virtual currency to another), payment processors, hosted and non-hosted wallets, custodians, market makers, traders, tipping apps, investment management services and altcoin developers. Only miners, merchants and consumers using Bitcoin to buy and sell goods and services, and New York banks are spared. Seemingly, even non-financial currencies such as Namecoin and Ether could be caught as will escrow and notarial services.

The regulations will apply not only to virtual currency businesses in New York State but also to anyone anywhere in the world engaged in virtual currency business activity involving New York or involving someone who resides in New York or is located there or has a place of business or is conducting business there regardless of where she or he is at the time. And that doesn’t just mean clients. It applies equally to payees, recipients and counterparties. Even if a virtual currency business outside New York decides not to do business involving New York or with New Yorkers, it will nevertheless need to know the identity of all parties to a transaction in order to be aware of any New York connection.

Which takes us to one of the anti money laundering requirements. Licensed businesses will need to know the identity of all parties to a virtual currency transaction – something that is practically impossible today, effectively removing the privacy cryptocurrencies afford.

Other anti money laundering provisions include enhanced due diligence requirements for accounts involving foreign entities. So a French exchanger who transacts business involving New York and obtains a BitLicence is required to perform enhanced due diligence checks on his clients in France, Germany, Switzerland, South Africa – indeed for all his clients who aren’t American.

Licensed businesses must maintain 100% virtual currency reserves and also maintain a bond or trust account in dollars. Capital requirements will be imposed but no figures have yet been published on the amount of capital and bonds required.

Other consumer protection measures include disclosing to consumers a list of prescribed potential risks with virtual currencies.

According to Lawsky “there is a big cyber security potential issue in this industry” and to counter it even the smallest virtual currency business will need to maintain an exhaustive cyber security program including employing cyber security personnel, risk assessment, detection and protection systems, response and recovery measures as well as annual penetration testing and quarterly vulnerability assessments.

Quarterly and annual financial reports will need to be filed and records kept for 10 years and there will be official inspections at least every two years.

Licensed businesses need to employ a qualified compliance officer, qualified anti-money laundering compliance personnel, and a qualified Chief Information Security Officer.

The regulations will apply equally to virtual currency businesses of all sizes. Anyone engaging in virtual currency business activity who is not licensed will be breaking New York State law as will operators of mixing services.

The draft regulations will be open for public comment for 45 days from 23 July 2014 and only feedback filed officially in New York will be taken into account. The NYDFS will then review and revise the regulations before finalising them.

Existing virtual currency businesses will have 45 days from when the regulations become effective to file their applications. Under transitional arrangements they will be permitted to continue operating unless their application is denied. Applications will need to include detailed policies and procedures, plans, projections and financial reports together with financial information and independent background reports on key personnel and shareholders. Their fingerprints and those of all employees must be submitted to both the State and FBI.

On CNBC, Lawsky called it “a great day for the virtual currency industry”. Whether or not that is the case will become evident over the next months and years.

Meanwhile, I will be reporting on developments, going into the detail of these proposals and exploring the differences between the New York and European proposals on here my blog and in future episodes of EpicenterBitcoin