This series of publications on Virtual Asset Service Providers (VASPs) is an expansive endeavor aimed at demystifying the complex regulatory environment that governs VASPs in the United States. Our insights on the crypto, digital assets, virtual currency ecosystem in the context of financial regulation will continue in this series on VASPs.
By dissecting the framework into manageable sections—ranging from federal and state regulations, licensing, and registration criteria to specific restrictions and governance requirements—these publications seek to illuminate the intricate legal landscape that VASPs would need to navigate. It is a multifaceted landscape. First, the series aims to educate and inform stakeholders, including service providers, investors, and the legal community, about the nuances of compliance within the digital asset space. This is crucial in a field that is rapidly evolving and where regulatory clarity is essential for fostering innovation and ensuring legal conformity. Second, the series addresses the need for a consolidated resource that explains regulatory actions, offering insights into how regulations are shaped by concerns over market integrity, consumer protection, and the prevention of financial crimes. The series hopes to enable readers to grasp the regulatory landscape’s breadth and depth without being overwhelmed, thereby facilitating a deeper understanding of the U.S. VASP framework’s dynamic goals and mechanisms. We also invite you to learn more about our Crypto, Virtual Assets and Blockchain practice and get to know some of the terms in this new series of publications in our Tech Terms glossary.
Overview of Federal Regulation of VASPs
The United States, through federal laws and federal regulations, regulates VASPs operating in the country as well as VASPs providing virtual asset services from offshore to United States persons.
A. Relevant Federal Laws and Regulations + Regulatory Authorities
Several federal laws provide authority for federal regulators to regulate VASPs, however, no single federal regulator oversees VASPs. A VASP’s specific services would determine which laws and regulations apply to the VASP. A detailed regulatory summary is not included below because that would basically require a summary of all U.S. banking, securities, and commodities regulation, but below is a broad outline.
B. VASPs as Financial Institutions
If a VASP exchanges digital assets for fiat or other digital currencies, it is a “financial institution” subject to the Bank Secrecy Act [BSA] and the Financial Crimes Enforcement Network [FinCEN]. BSA gives power to the U.S. Department of Treasury to enforce rules pertinent to financial institutions and financial records. FinCEN regulates VASPs via money service business rules and guidance available to the public. [1] The Office of the Comptroller of the Currency [OCC] and other banking regulators have issued guidance regarding VASP services.
C. VASPs dealing in Securities
Under the Securities Act of 1933 and the Securities Exchange Act of 1934, the U.S. Securities and Exchange Commission [SEC] has the authority to regulate securities and brokers, exchanges, and certain other securities market participants. Securities can include certain types of virtual assets because they satisfy the elements of an “investment contract” outlined by the U.S. Supreme Court in the case of SEC v. W.J. Howey Co.
All the elements must be met for a transaction to qualify as a security. The elements are:
An investment of money: This refers to the initial monetary contribution made by the investor.
In a common enterprise: This means that the investment is pooled with other investors or invested in a project.
With the expectation of profit: The investor anticipates making a return on its investment.
To be derived from the efforts of others: The profit is expected to come primarily from the work of others, not from the investor’s own efforts.
If a VASP involves transactions in digital assets that are securities, it could be considered a broker-dealer subject to regulation of the SEC and the Financial Industry Regulatory Authority [FINRA]. Additionally, if the VASP assists the issuance of assets that are securities, it could be deemed an underwriter subject to further SEC regulation. If it exchanges assets that are securities, it may be considered an unregistered securities exchange. If it advises its customers what securities to buy or sell, it could be considered an investment adviser requiring registration or an exemption under U.S. or State law.
D. VASPs dealing in Commodities
If a VASP creates swap contracts in digital assets, it could be deemed a swap dealer subject to the U.S. Commodity Futures Trading Commission’s [CFTC] regulations and/or a futures commission merchant or commodity pool operator required to register with the National Futures Association [NFA] under the Commodity Exchange Act [CEA]. If the VASP exchanges assets that are commodities, it may be subject to CFTC exchange regulations. If the VASP advises its customers what commodities to buy or sell, it could be considered a commodity trading adviser subject to CFTC jurisdiction.
E. Taxation of VASPs
The Internal Revenue Service [IRS] treats virtual assets as property, for U.S. federal tax purposes, the sale of which can result in taxable income. VASPs, as brokers for customers, may be required to report taxable transactions to their customers as well as to the IRS, thereby imposing obligations on those VASPs under federal tax laws. Individual State tax laws would also apply to VASPs operating in, or having customers in, those states.
F. Additional Proposed Federal vs. State Laws
Bills have been introduced in the U.S. Congress to centralize regulation, but no such laws have yet been passed. Each of the 50 states has the authority to regulate VASP activities within its jurisdiction. This discussion will highlight New York, but each of the other states may consider and adopt its own regulatory regime in areas in which federal law does not take precedence.
G. Penalties for Breach of Regulatory Requirements
The U.S. Department of Justice Market Integrity and Major Frauds Unit focuses on the prosecution of complex securities, commodities, cryptocurrency, and other financial fraud and market manipulation cases.[2] Penalties for breaching these laws and regulations can be severe. For instance, BINANCE, a cryptocurrency exchange, agreed to a total financial penalty of $4,316,126,163 following its CEO pleading guilty last month to a charge of violating federal money laundering rules and other related charges. Some of the charges included violations of the Bank Secrecy Act (BSA) and FinCEN’s implementing regulations. Other penalties can include administrative penalties, suspension or revocation of licenses, undertakings to retain independent compliance consultants and, for individuals, imprisonment.
New York’s Regulation of VASPs
New York State regulates VASPs either operating in its jurisdiction or providing virtual asset services from offshore to persons in the state.
A. New York State Department of Financial Services
The New York State Department of Financial Services [DFS] is the regulatory authority pertaining to VASPs operating in the state or providing virtual asset services to persons in the state. DFS regulates VASPs under Chapter 23 of the New York Codes, Rules, and Regulations [NYCRR] Part 200. Chapter 23 is also known as the “BitLicense” Regulation.[3]
Entities that wish to conduct business as VASPs must either apply for the BitLicense on application to DFS or for a charter under the New York Banking Law (for example, as a New York State limited purpose trust company or New York State bank) with approval to conduct virtual currency business.[4] The DFS places analogous requirements on New York State limited purpose trust companies that engage in virtual currency business activity.[5]
B. VASP Regulations Apply to Entities Conducting Virtual Currency Business Activity in New York State
23 NYCRR 200.2(q) defines “Virtual Currency Business Activity” as the conduct of any one of the following types of activities involving New York or a New York Resident
(1) receiving Virtual Currency for Transmission or Transmitting Virtual Currency, except where the transaction is undertaken for non-financial purposes and does not involve the transfer of more
than a nominal amount of Virtual Currency;
(2) storing, holding, or maintaining custody or control of Virtual Currency on behalf of others;
(3) buying and selling Virtual Currency as a customer business;
(4) performing Exchange Services as a customer business; or
(5) controlling, administering or issuing a Virtual Currency.”
C. Penalties
DFS has the authority to impose penalties as deemed appropriate under the law. Penalties may include monetary sanctions or the requirement that an entity retain an independent consultant for performing evaluations of the entity’s compliance with DFS regulations.[6] DFS may also suspend or revoke an entity’s license to perform virtual currency business activity in New York State “on any ground on which the superintendent might refuse to issue an original license or for failure of the Licensee to pay a judgment relating to the Licensee’s Virtual Currency Business Activity. DFS imposed a $50 million penalty on Coinbase, a publicly traded cryptocurrency trading exchange based in the United States, for letting customers open accounts without conducting sufficient background checks in violation of anti-money-laundering laws. The settlement also requires Coinbase to invest $50 million to bolster its compliance program.
Principal Criteria for a VASP to be Licensed/Registered
A. Criteria for a Federal VASP license/registration
Although the United States Federal Government has no framework for specifically licensing or registering VASPs, there are numerous licensing and regulatory regimes a VASP may encounter in providing services to U.S. persons.
All money service businesses [MSBs], which may include some VASPs, must register with the U.S. Department of Treasury (except for a person that is an MSB solely because that person serves as an agent of another MSB). Registration of an MSB is the responsibility of the owner or controlling person of the MSB.[7] Registration must be renewed every two years. A copy of the filed registration form and other supporting documentation must be retained at a location in the United States for a period of five years.
Prudential Regulators like the OCC, Federal Reserve Board [FRB], and Federal Deposit Insurance Corporation [FDIC] grant licenses for national banks, bank holding companies, and depository institutions. These licenses allow for services like qualified custody, payment and settlement, and banking. A VASP with such functions may need licenses from prudential regulators.
VASPs engaged in securities businesses must be appropriately registered with the SEC or FINRA to offer or trade in virtual assets as securities. VASPs engaged with commodities or swap activities must have appropriate registrations or exemptions from the CFTC or NFA.
B. Criteria for a New York VASP Licensee
i. General Licensee Requirements
In general, a licensee must:
- Hold virtual currency in a manner that protects customer assets.
- Maintain comprehensive books and records for at least 7 years.
- Properly disclose the material terms and conditions associated with their products and services, including custody services.
- Refrain from making any false, misleading, or deceptive representations or omissions in their marketing materials.
- Establish anti-money laundering and cybersecurity programs.
- This includes the implementation of a Know Your Customer [KYC] program and the appointment of a Chief Information Security Officer. In the event of fraudulent transactions, hacks, or data breaches, license holders are obligated to report such incidents to DFS. Additionally, they are expected to have Business Continuity and Disaster Recovery plans in place.
- Maintain a surety bond or trust account in US dollars as a measure to safeguard customer assets and funds. The amount to be maintained in this account is determined by the DFS superintendent.
- Disclose changes in business models, services, products, control of company, mergers, or partnerships to the DFS superintendent.
ii. Personnel Requirements
- The licensee must designate qualified individuals responsible for coordinating and monitoring compliance.
- Each licensee must have an anti-money laundering program in which qualified individuals are designated for monitoring day-to-day compliance.
- There must be a designated Chief Information Security Officer responsible for overseeing the cybersecurity program of the licensee.
- The licensee’s business continuity and disaster recovery plan must identify supervisory personnel responsible for implementation.
iii. Financial Resources Requirements
23 NYCRR 200.8 (Capital Requirements) states that each Licensee must maintain sufficient capital to ensure their financial integrity and ongoing operations. The superintendent determines the amount and form of this capital based on an assessment of the specific risks applicable to each Licensee based on its products and services, its customer base and level of activity and risk
The capital required to be maintained must be held in the form of cash, virtual currency, or high-quality, highly liquid, investment-grade assets, in proportions acceptable to the superintendent.
Restrictions Related to Regulated VASPs
i. Federal
VASPs which deal with virtual assets as securities must follow Securities and Exchange Commission and Financial Regulatory Authority rules on offering and trading of those virtual assets,[8] depending on whether public, limited or private offerings of the securities are conducted, the form of registration, the level of disclosure requirements and restrictions to customers that meet certain qualifications will be imposed. For certain service providers, like brokers or advisers, representatives will be required to meet examination and other qualifications.
VASPs which deal with virtual assets as commodities must follow Commodity Futures Trading Commission rules under the Commodity Exchange Act (CEA).[9] Anyone who trades futures with the public or gives advice about futures trading must be registered with the National Futures Association (NFA).[10]
If a VASPs clients are certain types of entities, the VASP would need to utilize eligible custodians for those entities under federal requirements. If the VASP were to have clients that are retirement plants, there are extensive prohibited transaction rules under the Employee Retirement Income Security Act (ERISA).
ii. State Law
Each U.S. State has its own securities laws as well as laws governing registration of securities brokers and dealers and investment advisers. So far, state laws have not addressed limiting investors who may acquire digital assets.
B. Restrictions on a regulated VASP advertising a specific VA or any services it offers
i. Federal
In the U.S., the regulation of cryptocurrency advertising may be the responsibility of the SEC, to the extent that digital assets are securities, and the Federal Trade Commission [FTC], which is in charge of preventing false or misleading advertising practices generally.
Advertisers must adhere to the guidelines set by these agencies to maintain transparency and prevent deceptive marketing tactics. Due to the stringent advertising rules, many platforms opt to outright ban cryptocurrency advertising for simplicity. Conversely, some platforms, such as Reddit, initially permitted it, only to later retract their decision and remove accounts linked to cryptocurrency advertising.
ii. New York
In New York, advertising and marketing requirements focus on disclosures the licensee must include, such as name, license status, a legend about being licensed by DFS, customers risks, and terms and conditions of securities and service offerings. There are prohibitions on making false, misleading or deceptive representations and recordkeeping requirements, but there are no specific prohibitions or limitations on advertising particular virtual currency assets or services, if the disclosures and consumer protection requirements are followed.
Under U.S. federal law, the type of VA determines what restrictions apply. If a VA is considered a security, SEC restrictions apply. If the VA is considered a commodity, CFTC restrictions apply.
The state’s requirements specifically applicable to VASPs focus more on the disclosure, consumer protection, risk management, solvency, etc. practices of the licensed provider. State securities laws govern requirements for VA offerings themselves.
D. Restrictions in terms of providing margin financing or engaging in proprietary trading
i. Federal
Providers in the United States are subject to numerous trading restrictions, the exact nature of which depends on the activity and the applicable regulatory regime. Banks have capital requirements and proprietary trading restrictions since the 2008 financial crisis. Broker-dealers are subject to FINRA conduct rules and SEC standards; investment advisors must maintain codes of ethics. With respect to trading, each regulatory statute or regime has anti-fraud and manipulation rules. Although rules do not exist separately for VASPs, to the extent they fall under the rules for banking, securities, or commodity market participants, they are subject to particularly understood duties to customers, ranging from know your customer (KYC) rules to fiduciary duties for trustees and investment advisers, to prohibited transaction restrictions for pension fund fiduciaries.
Permissible margin is determined under Federal Reserve regulations, together with capital requirements for particular actors.
Proposals to Introduce Any New Laws or Regulations with Respect to Crypto-Related Activities
New York Attorney General has proposed legislation to tighten regulations on the cryptocurrency industry to protect investors, consumers, and the broader economy.[11] The suggested legislation aims to enhance transparency, eradicate conflicts of interest, and implement practical measures for investor protection. It would necessitate cryptocurrency exchanges undergo independent public audits and prohibit individuals from owning identical entities, such as brokerages and tokens, to prevent conflicts of interest. Like banks under the federal Electronic Fund Transfer Act, crypto platforms would be obligated to compensate customers who fall victim to fraud.
There are bills before the New York State legislature that would create new criminal offenses, including for token fraud, rug pulls, private key fraud, and fraudulent failure to disclose interests in virtual tokens.[12]
Another filed bill in New York includes one that would create a moratorium on cryptocurrency mining centers.[13]
****
[1] https://www.fincen.gov/sites/default/files/2019-05/FinCEN%20Guidance%20CVC%20FINAL%20508.pdf
[2] https://www.justice.gov/criminal/criminal-fraud/market-integrity-and-major-frauds-unit#:~:text=Share,fraud%20and%20market%20manipulation%20cases.
[3] https://www.dfs.ny.gov/industry_guidance/industry_letters/il20230123_guidance_custodial_structures
[4] https://www.nysenate.gov/legislation/laws/BNK; https://www.dfs.ny.gov/virtual_currency_businesses
[5]https://www.dfs.ny.gov/reports_and_publications/press_releases/pr202301231#:~:text=New%20York%E2%80%99s%20virtual%20currency%20regulation%20requires%20entities%20to%2C,deceptive%20representations%20or%20omissions%20in%20their%20marketing%20materials.
[6] https://www.dfs.ny.gov/reports_and_publications/press_releases/pr202208021
[7] https://www.fincen.gov/money-services-business-msb-registration
[8] https://www.sec.gov/education/capitalraising/building-blocks/offering-types
[9] https://www.cftc.gov/LawRegulation/CommodityExchangeAct/index.htm
[10] https://www.investor.gov/introduction-investing/investing-basics/investment-products/commodities
[11] https://ag.ny.gov/press-release/2023/attorney-general-james-proposes-nation-leading-regulations-cryptocurrency
[12] https://www.nysenate.gov/legislation/bills/2021/S8839
[13] https://www.nysenate.gov/legislation/bills/2021/S6486