On April 28, 2022, the New York State Department of Financial Services (DFS) released Guidelines on the Use of Blockchain Analytics for Virtual Currency Businesses licensed under 23 NYCRR Part 200 ( also known as BitLicense) or licensed as limited purpose trust companies under New York banking law (collectively, NY Virtual Currency Entities). The DFS Guidelines signal growing regulatory expectations that institutions engaged in virtual currency activities will take advantage of the unique opportunities offered by blockchain analytics to support compliance functions, such as due diligence on customer service, transaction monitoring and sanction screening.
In the guidance, DFS pointed out that while virtual currencies present new compliance challenges (for example, allowing pseudonymous peer-to-peer transfers without regulated intermediaries), they also present new opportunities for control measures, such as Provenance tracing (tracing coin transactions), as blockchain technology typically allows a historical view of the transmission of virtual currency between wallet addresses. In this way, DFS explained, virtual currencies can provide greater visibility into transaction lineage than is typically possible with traditional remittances.
DFS” emphasizes[d] the importance of blockchain analytics” in accordance with Anti-Money Laundering (AML) requirements under 23 NYCRR §200.15, and through a range of compliance controls related to the Bank Secrecy Act /AML and sanctions. He covered three areas in detail:
- Improved know-your-customer controls. DFS reiterated that, as part of their know-your-customer responsibilities, New York virtual currency entities must obtain and maintain information regarding customers and potential customers and understand and effectively address the risks they present. DFS cited as particularly useful blockchain analytics products that allow entities to obtain identifying information directly tied to pseudonymous on-chain data, especially in combination with “off-chain” and customer-provided information. These products can typically identify wallet addresses associated with institutions, as well as known high-risk wallet addresses, such as dark web markets, DFS noted. However, they may not be able to identify underlying owners, including ultimate beneficial owners, and may have limited attribution ability. DFS noted that NY virtual currency entities must have policies, processes and procedures to assess counterparty exposure in virtual currency funds transfers.
- Perform transaction monitoring of on-chain activity. DFS also emphasized that New York virtual currency entities should have policies, processes, and procedures to track transaction activity for each type of virtual currency they support, including inbound and outgoing on the blockchain. DFS noted that it is important for New York virtual currency entities to document “appropriately tailored transaction monitoring coverage against applicable typologies and red flags, identify deviations from the expected activity of a client and to address other risk considerations, as appropriate”. Relevant typologies include assessing whether a virtual currency is substantially exposed to a high-risk or sanctioned jurisdiction, is transacted through a “mixer” or “tumbler”, is sent to or from dark web markets, is associated with scams or ransomware, or is associated with other illicit activities relevant to the business model of the NY Virtual Currency entity.
The US Treasury Department’s Financial Crimes Enforcement Network (FinCEN) has also warned that virtual currencies can create illicit financial vulnerabilities due to the global nature, distributed structure, limited transparency and speed of currency systems. most widely used virtual. FinCEN has highlighted dark web markets, peer-to-peer exchanges, foreign-based money services businesses, and convertible virtual currency kiosks as posing particular risks.
- Perform a sanctions review of on-chain activity. The DFS also emphasized the importance of risk-based policies, processes and procedures to identify transaction activity involving virtual currency addresses or other identifying information associated with sanctioned individuals, including persons on the list of Specially Designated Nationals and persons stranded or located in sanctioned jurisdictions. . This is consistent with the position taken by the Treasury Department’s Office of Foreign Assets Control, which explained that all companies in the virtual currency industry (including technology companies, exchangers, administrators, miners and wallet providers, as well as more traditional businesses financial institutions that may be exposed to virtual currencies or their service providers) are encouraged to develop, implement and regularly update a tailored sanctions compliance program based on the risks. These should typically include sanctions lists, geo-screening, and other appropriate measures based on the company’s unique risk profile.
In addressing these areas, DFS explained that NY virtual currency entities may use third-party service providers or internally developed blockchain analytics products for additional control measures, either separately or in combination. However, to the extent control functions are outsourced, DFS emphasized that they must have clearly documented policies, processes, and procedures regarding how blockchain analytics activity fits into the framework. overall control of the entity, in accordance with its risk profile.
Generally speaking, DFS pointed out that a New York virtual currency entity’s risk mitigation strategy should consider its business profile to assess risks between types of virtual currencies and take steps to address the characteristics. specific to all relevant virtual currencies. Although the appropriate control measures may vary between NY virtual currency entities, depending on their risk profiles, in all cases the documentation should describe the case management and escalation processes and should clearly delineate the roles and responsibilities across the business and across the compliance function.
Meaning of instructions
The DFS Guidelines highlight the importance of blockchain analysis in the compliance programs of companies operating in the virtual currency space. Although it targets regulated entities in New York, it may signal a broader shift in regulatory expectations beyond the state, where virtual currency companies are expected to use blockchain analytics to support their functions of compliance, and it can serve as a useful guide for the industry more generally.
The guidelines are a positive development in that they signal that regulators may have moved beyond debating the legality of digital asset activities and are now focusing more on supervising such activities to ensure that they are conducted in a safe and sound manner.
Partner Joe Sandman participated in the preparation of this alert.
Download PDF
