On April 28, 2022, the New York State Department of Financial Services (DFS) issued guidance on the use of blockchain analytics for virtual currency businesses licensed under 23 NYCRR part 200 (also known as a BitLicense) or chartered as limited purpose trust companies under the New York Banking Law (collectively, NY Virtual Currency Entities). The DFS guidance signals increasing regulatory expectations that institutions engaged in virtual currency activities will take advantage of the unique opportunities that blockchain analytics offer to support compliance functions, such as customer due diligence, transaction monitoring and sanctions screening.
In the guidance, DFS pointed out that, while virtual currencies present new compliance challenges (for example, by enabling peer-to-peer pseudonymous transfers without regulated intermediaries), they also present new possibilities for control measures, such as provenance tracing (tracking of coin transactions), because blockchain technology typically allows a historical view of virtual currency transmission between wallet addresses. In this way, DFS explained, virtual currencies can offer greater visibility into transaction lineage than is typically possible with traditional funds transfers.
DFS “emphasize[d] the importance of blockchain analytics” in compliance with anti-money laundering (AML) requirements under 23 NYCRR §200.15, and across a range of Bank Secrecy Act/AML and sanctions-related compliance controls. It discussed three areas in detail:
- Augmenting Know-Your-Customer-Related Controls. DFS reiterated that, as part of their know-your-customer responsibilities, NY Virtual Currency Entities must obtain and maintain information regarding customers and potential customers and understand and effectively address the risks that they present. DFS cited as particularly useful blockchain analytics products that allow entities to obtain identifying information that ties directly to pseudonymous on-chain data, particularly in combination with “off-chain” and customer-provided information. These products can typically identify wallet addresses associated with institutions, as well as known high-risk wallet addresses, such as dark web marketplaces, DFS noted. They may not be able to identify underlying owners, however, including ultimate beneficial owners, and may have limited attribution capability. DFS noted that NY Virtual Currency Entities must have policies, processes and procedures to assess counterparty exposure in virtual currency funds transfers.
- Conducting Transaction Monitoring of On-Chain Activity. DFS also emphasized that NY Virtual Currency Entities should have policies, processes and procedures for tracing transaction activity for each type of virtual currency that they support, including inbound and outbound activity on the blockchain. DFS noted that it is important for NY Virtual Currency Entities to document “appropriately tailored transaction monitoring coverage against applicable typologies and red flags, identify deviations from a customer’s expected activity, and address other risk considerations as applicable.” Relevant typologies include assessing whether a virtual currency has substantial exposure to a high-risk or sanctioned jurisdiction, is processed through a “mixer” or “tumbler,” is sent to or from dark web marketplaces, is associated with scams or ransomware, or is associated with other illicit activity relevant to the NY Virtual Currency Entity’s business model.
The U.S. Department of the Treasury’s Financial Crimes Enforcement Network (FinCEN) has similarly cautioned that virtual currencies may create illicit finance vulnerabilities due to the global nature, distributed structure, limited transparency and speed of the most widely used virtual currency systems. FinCEN has highlighted dark web marketplaces, peer-to-peer exchanges, foreign-located money services businesses and convertible virtual currency kiosks as raising particular risks.
- Conducting Sanctions Screening of On-Chain Activity. DFS also emphasized the importance of risk-based policies, processes and procedures to identify transaction activity involving virtual currency addresses or other identifying information associated with persons subject to sanctions, including persons on the List of Specially Designated Nationals and Blocked Persons or located in sanctioned jurisdictions. This is consistent with the position taken by the Department of the Treasury’s Office of Foreign Assets Control, which has explained that all companies in the virtual currency industry, (including technology companies, exchangers, administrators, miners and wallet providers, as well as more traditional financial institutions that may have exposure to virtual currencies or their service providers) are encouraged to develop, implement and routinely update, a tailored, risk-based sanctions compliance program. Those should generally include sanctions lists, geographic screening and other appropriate measures based on the company’s unique risk profile.
In addressing these areas, DFS explained that NY Virtual Currency Entities can use third-party service providers or internally developed blockchain analytics products for additional control measures, separately or in combination. However, to the extent control functions are outsourced, DFS emphasized that they must have clearly documented policies, processes and procedures regarding how the blockchain analytics activity integrates into the entity’s overall control framework, consistent with its risk profile.
Broadly, DFS emphasized that an NY Virtual Currency Entity’s risk mitigation strategy must take account its business profile to assess risk across virtual currency types and take steps to address the specific characteristics of any relevant virtual currencies. While appropriate control measures may vary between NY Virtual Currency Entities, depending on their risk profiles, in all cases documentation must describe case management and escalation processes and must clearly delineate roles and responsibilities across the business and the compliance function.
Significance of the Guidance
The DFS guidance highlights the importance of blockchain analytics in compliance programs by businesses operating in the virtual currency space. Although it is targeted at New York-regulated entities, it may signal a broader shift in regulatory expectations beyond the state, where virtual currency businesses are expected to employ blockchain analytics to support their compliance functions, and it may serve as a useful guide for the industry more generally.
The guidance is a positive development in that it signals that regulators may have moved beyond debating the legal permissibility of digital assets activities and are now more keenly focused on the supervision of these activities to ensure they are conducted in a safe and sound manner.
Associate Joe Sandman assisted in the preparation of this alert.