NYDFS Issues Updated And Stricter Virtual Currency Listing Guidance – New Policy Updates Due For Approval By January 31, 2024 – Financial Services

Executive Summary

Following a two-month public consultation period, on 15 November
2023 the New York State Department of Financial Services (NYDFS)
published its new Virtual Currency Listing Guidance (the
Guidance),¹ in accordance with virtual currency
regulation 23 NYCRR Part 200. The Guidance requires BitLicensed
firms and New York-chartered limited purpose trust companies
engaged in virtual currency business activity (collectively, VC
Entities) to update their existing coin-listing policies and
develop coin-delisting policies that are subject to formal NYDFS
approval by 31 January 2024. VC Entities that fail to develop
NYDFS-approved listing and delisting policies will be ineligible to
self-certify² tokens for listing in the state of New
York. Further, the Guidance raises two new points with wide-ranging
implications for VC Entities:

1. The NYDFS may “at any time and in its sole
   discretion, require VC Entities to delist or otherwise limit New
   Yorkers’ access to coins that are not included on the
   Greenlist³ Accordingly, the Guidance requires
   VC Entities to develop an acceptable coin-delisting policy that
   will enable the VC Entities to quickly discontinue support for
   high-risk coins in a manner that is consistent with safety and
   soundness principles and with the protection of customers and the
   general public.




2. In an effort to introduce additional consumer protection
   requirements, the NYDFS additionally places new
   restrictions on self-certification of coins possessing certain
   features where such coins are made available for purchase by retail
   consumers.⁴ The restriction spans a number of
   common coin features, including any stablecoin that is not already
   included on the Greenlist, exchange coins, coins posing
   centralization and protocol resiliency concerns, bridged coins,
   coins with a limited circulating supply, and coins with
   anonymity-enhancing features.

Together, these two points are likely to pose material business
and operational implications for VC Entities, particularly
exchanges, that serve New York retail customers, limiting their
ability to sell certain popular coins to New York retail customers,
including high-market-cap coins like Tether (USDT), Binance Coin
(BNB), and USD Coin (USDC), which are currently not represented on
the NYDFS Greenlist. Notably, as part of its 18 September 2023
press release that marked the start of the consultation period for
this Guidance, the NYDFS debuted a significantly amended Greenlist,
reducing the number of Greenlisted coins from more than 20 to only
eight.⁵

NYDFS-regulated VC Entities are now under tight timelines to
develop new delisting policies and preview these draft
coin-delisting policies with the NYDFS by 8 December
2023. Further, VC entities will need to review their
existing coin-listing policies to ensure that their policies
incorporate the risk assessment criteria articulated in the updated
Guidance. Where VC Entities serve New York retail customers, they
will also need to assess the impact of the Guidance and the updated
Greenlist on their list of supported coins and update access
requirements for New York retail customers. While VC Entities will
have until 31 January 2024 to
have their updated coin listing and delisting policies formally
approved by the NYDFS, all entities must be aware that the Guidance
is nonetheless effective immediately and entirely supersedes the
prior 2020 NYDFS Guidance Regarding Adoption or Listing of Virtual
Currencies (Prior Guidance).

What the Alert Covers

This Policy Alert (1) provides a detailed overview of the
guidance and (2) details key implications and considerations for
NYDFS-regulated VC Entities.

Detailed Overview

In its 15 November 2023 press release associated with the new
Guidance, the NYDFS noted that the Guidance “bolsters risk
assessment standards for coin-listing policies and tailors enhanced
requirements for retail consumer-facing
businesses.”⁶ Further, the press release notes that
the new requirement for a coin-delisting policy helps ensure that
“in the event a coin must be delisted, it can be done in an
orderly way that protects consumers and minimizes market
disruption.”⁷ While the NYDFS did not reveal a
specific impetus for updates to its coin-listing guidance, the
NYDFS acknowledged that “the market has evolved sufficiently
that the Department found it prudent to further enhance the
requirements of the Prior Guidance.”⁸

This reference to market evolution may be an implicit nod to
both the market frenzy of 2021 and the market contagion that
occurred throughout 2022, precipitated by the May 2022 collapse of
Terra, an algorithmically collateralized stablecoin that
disproportionately impacted less sophisticated retail
investors⁹ and was widely regarded as the tipping point
for the “2022 crypto winter” that continues to plague the
virtual currency industry in 2023. For this reason, perhaps, the
Guidance focuses on preventing harm to retail investors and treats
most stablecoins as coins possessing features that render them
ineligible for self-certification.

The core of the Guidance imposes clear requirements on VC
Entities. Specifically, the Guidance states that no VC
Entity–even those VC Entities that had a previously approved
coin-listing policy under the Prior Guidance–will be
permitted to self-certify any coins until they update their
existing coin-listing policies and receive NYDFS approval on their
coin-delisting policies, consistent with the new standards
established under the Guidance. The Guidance articulates the
minimum attributes required of an effective coin-listing policy,
inclusive of:

• Governance: The establishment of a senior
  Governing Authority¹⁰ at the VC Entity that oversees the
  approval of the coin-listing policy and review and approval (or
  denial) of new coin listings. Governance includes independence and
  avoidance of conflicts of interest by the Governing Authority as
  well as certain recordkeeping requirements around coin listing
  decisions, consistent with the seven-year recordkeeping
  requirements applicable to VC Entities under 23 NYCRR Part
  200.




• Risk Assessment: An assessment by the VC
  Entity of the various technology, operational, cybersecurity,
  market and liquidity, illicit finance, legal, reputational, and
  regulatory risks posed by a given coin prior to a coin-listing
  determination. Embedded in the risk assessment of a coin is the
  need to take into consideration matters of customer protection to
  “ensure that all customers are treated fairly and are afforded
  the full protection of all applicable laws and regulations,
  including protection from unfair, deceptive, or abusive
  practices,”¹¹ including, for instance, evaluating
  new coins against the risk of a rug pull.

In addition to the coin-listing requirements which are generally
viewed as a “point in time” exercise by many VC Entities,
the new Guidance clarifies that VC Entities are expected to
maintain policies and procedures to monitor listed coins and
“ensure that continued listing of the coin remains consistent
with safety and soundness considerations, the protection of
customers and the general public.”¹² These coin
listing policies and procedures should include periodic
re-evaluation of the risks posed by a given coin and control
measures to manage those risks, as well as a coin-delisting policy
governing the delisting process should ongoing monitoring or other
triggers lead to a delisting decision. Further, the Guidance
clarifies that the coin-delisting policy should not be a standalone
document, but rather one that is supported by robust procedures
comprehensively detailing the steps involved in removing support
for a given coin.

The Guidance similarly articulates the minimum attributes
required of an effective coin-delisting policy, inclusive of:

• Effective management governance and oversight,




• A process around coin-delisting, including clear roles and
  responsibilities, the chain of approval, and avoidance of conflicts
  of interest to prevent the risk of market manipulation and insider
  trading, and




• Process execution, including:
  

  • Advance notice to customers (at least 30 days prior to
    delisting),

  
  

  • Customer support for impacted customers (including ensuring
    sufficient resources to respond to customer questions and requests
    for sale of the delisted coin in a timely manner),

  
  

  • Adequate documentation, and

  
  

  • Ongoing monitoring following delisting to identify potential
    risk exposures.

Additionally, the Guidance stipulates that VC Entities ought to
perform an impact analysis of the delisting decision to assess
“second-order impacts a delisting decision might have on the
VC Entity’s internal business operations as well as on any
counterparties and third-party service .”¹³ The
Guidance articulates specific notice period requirements, both to
the NYDFS and consumers, in the event of a delisting decision, with
some carveouts for exigent circumstances.

Moreover, as highlighted above, the Guidance establishes
barriers to self-certification for certain classes of coins and
coins exhibiting specific features if offered to New York retail
customers.

While the coin-listing requirements outlined in the Guidance are
not likely to materially impact existing coin-listing policies,
many of which already incorporated the above governance and risk
assessment criteria, the introduction of a coin-delisting policy
and process requirement, combined with a reduction in Greenlisted
coins and more stringent requirements around self-certification for
VC Entities serving retail users, are likely to

Key Implications and Considerations

Given that the new Guidance is effective as of 15 November 2023,
NYDFS-regulated VC Entities are required to update their existing
policies and processes in short order to meet the timelines
established in the new Guidance. K2 Integrity is reminding all VC
Entities of the following key deadlines and next steps:

• Develop a draft coin-delisting policy and meet with the
  NYDFS on or before 8 December 2023 to obtain NYDFS
  feedback on the draft coin-delisting policy, pursuant to the
  requirements of the NYDFS Guidance.




• Review and revise existing coin-listing policy and
  processes in accordance with the requirements of the
  Guidance to ensure appropriate process governance and coverage of
  risk assessment criteria, including incorporation of continuous
  monitoring to ensure that coin-listing is not treated merely as a
  point-in-time process.




• Submit final coin-delisting policy for NYDFS approval
  on or before 31 January 2024, pursuant to the requirements
  of the NYDFS Guidance, and be prepared to have a process or
  playbook in place to execute the coin-delisting policy
  requirements.




• Assess the business and operational impact of both the
  September 2023 NYDFS Greenlist changes and the new
  self-certification limitations if you serve retail
  customers, including assessing one’s existing
  portfolio of supported coins and determining whether additional
  geofencing and monitoring controls need to be implemented to
  prevent sales to New York retail customers.




• Assess resourcing to ensure sufficient
  staffing to handle new continuous monitoring and customer
  support requirements pursuant to the delisting policy requirements
  raised in the new Guidance.




• Continue to monitor for updates to NYDFS guidance and
  Greenlisted coins, given that NYDFS has communicated that
  the Guidance is not exhaustive and may be updated from time to
  time.

While the new Guidance imposes additional requirements, a key
theme raised throughout is how this Guidance incorporates themes
from prior NYDFS-issued guidance, including the NYDFS’s 2018
“Guidance on Prevention of Market Manipulation and Other
Wrongful Activity,”¹⁴ and its 2022 “Guidance
on Use of Blockchain Analytics.”¹⁵ The Guidance
therefore reiterates that the coin-listing process is one that is
heavily risk-based and requires a holistic risk and control
framework. And while the virtual currency industry as a whole may,
at times, face criticism over a casual approach to governance and
management oversight, the NYDFS continues to raise its expectations
for VC Entities—requiring a carefully considered approach to
coin listing that is deeply rooted in governance and process. VC
Entities will therefore have to work to comply with these new
requirements in short order while assessing the operational and
business impact of these recent changes on their approach to coin
listing and customer support going forward.

Speak to K2 Integrity representatives from the Crypto and Digital Asset Solutions
practice to learn more about how K2 Integrity can
support you and your firm in developing fit-for-purpose coin
listing and delisting policies, as well as help you with the coin
due diligence/risk assessment process itself if you are facing
capacity constraints.

Footnotes

1 NYDFS, “Guidance Regarding Listing of Virtual
Currencies” (15 November 2023), https://www.dfs.ny.gov/industry_guidance/industry_letters/il20231115_listing_virtual_currencies.

2 Self-certification is the term used by the NYDFS to
describe the process whereby VC Entities decide to list a new coin,
pursuant to an NYDFS-approved coin listing policy, and thereby make
this newly listed coin available for approved virtual currency
business activity in the state of New York or to New
Yorkers.

3 NYDFS, “Guidance Regarding Listing of Virtual
Currencies.” The Greenlist refers to a circumscribed list of
coins previously approved by the NYDFS. Unless otherwise advised by
the NYDFS, VC Entities do not require prior approval to list coins
included on the NYDFS Greenlist; however, entities that choose to
list Greenlisted coins are required to (1) provide advance
notification to the NYDFS prior to beginning support; and (2) have
an NYDFS-approved coin-delisting policy. Refer to NYDFS,
“General Framework for Greenlisted Coins“
(18 September 2023), https://www.dfs.ny.gov/industry_guidance/industry_letters/il20230918_gen_framework_greenlisted_coins.

4 The NYDFS defines retail consumers as individuals who
are not subject to any pre-qualification factors such as income or
customer type (e.g., accreditation requirements). The
self-certification restriction on retail consumers does not extend
to VC Entities who offer institutional custody or services that are
only available to business users.

5 NYDFS, “General Framework for Greenlisted
Coins.”

6 NYDFS, “DFS Superintendent Adrienne A. Harris
Adopts New Regulatory Guidance Regarding the Listing of Virtual
Currencies,” Press Release, 15 November 2023, https://www.dfs.ny.gov/reports_and_publications/press_releases/pr202311151.

7 Ibid.

8 NYDFS, “Guidance Regarding Listing of Virtual
Currencies.”

9 Liu, J., Makarov, I., & Schoar, A, “Anatomy of
a Run: The Terra Luna Crash,” National Bureau of Economic
Research (April 2023), DOI: 10.3386/w31160, https://www.nber.org/papers/w31160.

10 NYDFS, “Guidance Regarding Listing of Virtual
Currencies.” The Guidance defines “Governing
Authority” as the VC Entity’s board of directors or
equivalent, such as a committee formally delegated by the board of
directors, that is responsible for ensuring the robustness of the
governance, monitoring, and oversight framework around coin listing
and delisting.

11 NYDFS, “Guidance Regarding Listing of Virtual
Currencies.”

12 Ibid.

13 Ibid.

14 NYDFS, “Guidance on Prevention of Market
Manipulation and Other Wrongful Activity” (7 February 2018),
https://www.dfs.ny.gov/industry_guidance/industry_letters/il20180207_guidance_prevention_market_manipulation_and_other_wrongful_activity.

15 NYDFS, “Guidance on Use of Blockchain
Analytics” (28 April 2022), https://www.dfs.ny.gov/industry_guidance/industry_letters/il20220428_guidance_use_blockchain_analytics.

The content of this article is intended to provide a general
guide to the subject matter. Specialist advice should be sought
about your specific circumstances.