InfoBytes Blog
Filter
Subscribe to our InfoBytes Blog weekly newsletter and other publications for news affecting the financial services industry.
NYDFS to host first-ever virtual currency techsprint
On October 15, NYDFS, in collaboration with the Conference of State Bank Supervisors and the Alliance for Innovative Regulation, announced that a first-of-its-kind techsprint focusing on virtual currency will take place early 2021. The techsprint will bring together regulators, fintech and virtual currency industry stakeholders, and experts to collaborate on regulatory compliance solutions. Possible solutions may include “process improvements to a functional prototype of a reporting mechanism,” such as Digital Regulatory Reporting (DRR), which will “give regulators instant access to data provided by firms under their supervision.” Based on the takeaways from the techsprint, NYDFS intends to “develop a set of common standards and an open source technical framework for DRR” that may be adopted by NYDFS and other regulatory agencies. As part of the collaboration, future techsprints will also be developed that focus on other types of nonbank entities subject to financial regulation.
Issuer pays $5 million penalty for unregistered digital offering
On October 21, the SEC announced the U.S. District Court for the Southern District of New York entered a final judgment against a tech company issuer that raised approximately $100 million through an unregistered initial coin offering. As previously covered by InfoBytes, the SEC filed an action alleging the issuer failed to provide required disclosures to investors and did not register the offer or sale of its digital tokens with the SEC, as required by Section 5 of the Securities Act of 1933 (the Act). The SEC argued that the issuer marketed the digital tokens as an investment opportunity and told investors that they could earn future profits from the issuer’s efforts to create, develop, and support a digital “ecosystem.”
The court granted summary judgment in favor of the SEC at the end of September, concluding, among other things, that the issuer violated Section 5 of the Act when it conducted an unregistered offering of securities that did not qualify for any exemption from registration requirements. The final judgment (i) requires the issuer to pay $5 million in a civil penalty; (ii) permanently enjoins the issuer from violating Section 5 of the Act; and (iii) requires the issuer, for a period of three years, to provide notice to the SEC before engaging in any “issuance, offer, sale or transfer” of specified assets.
OFAC sanctions Russian cybercriminals for $16.8 million crypto scam
On September 16, the U.S. Treasury Department’s Office of Foreign Assets Control (OFAC) sanctioned two Russian nationals who were allegedly involved in phishing campaigns targeting virtual asset service providers in 2017 and 2018, resulting in losses of at least $16.8 million. Specifically, the Russian nationals spoofed web domains of legitimate virtual currency exchanges to steal customers’ login information and gain access to their real accounts. According to OFAC, they used a “variety of methods to exfiltrate their ill-gotten virtual currency” and subsequently laundered the money to a personal account, attempting to “conceal the nature and source of the funds by transferring them in a layered and sophisticated manner through multiple accounts and multiple virtual currency blockchains.” OFAC designated the individuals pursuant to Executive Order 13694, which targets “malicious cyber-enabled activities, including those related to the significant misappropriation of funds or personal identifiers for private financial gain.”
OFAC emphasized that anti-money laundering and countering the financing of terrorism regimes “pose a critical chokepoint in countering and deterring” this type of cybercriminal activity. As a result, all property and interests in property belonging to the designated individuals subject to U.S. jurisdiction are blocked, and “U.S. persons generally are prohibited from dealing with them.”
California DBO opinion letters cover activities exempt from MTA licensing
The California Department of Business Oversight (CDBO) released several opinion letters issued throughout the summer covering virtual currency and agent of payee rules under the California Money Transmission Act (MTA). Highlights from the redacted letters include:
- Cryptocurrency - Escrow Accounts and Exchanges. The redacted opinion letter states that the CDBO has not yet determined whether cryptocurrencies are a form of money that triggers the application of the MTA and therefore, a business model that operates brokerage accounts using cryptocurrency exchanges would not need to be licensed and supervised under the MTA. As for a business model that the letter describes as a third-party repurchase transaction related to borrowing and lending cryptocurrency, the CDBO reminds the company that the activity may still be subject to California Escrow Law.
- Agent of Payee Exemption - Payment Processing Service. The redacted opinion letter concludes that the company’s payment processing services—which use mobile applications or card readers to capture customer information through merchants, and the payment funds flow first from the customer to the company, and then from the company to the merchant—“fall within the definition of ‘money transmission’ but are exempt from the MTA to the extent [the company], acting as the [m]erchant’s agent, receives money from [c]ustomers, via the relevant card company, as payment for goods or services.”
- Online Foreign Currency Exchange Service. The redacted opinion letter concludes the company’s online foreign currency exchange service is not subject to licensure under the MTA, because the service does not “involve ‘payment instruments’ or ‘stored value’” and there is no indication that the company would “receive money for transmission,” as customers would use the service to purchase foreign currency “like other online retail purchases.”
- Exemption for Operator of Payment System. The redacted opinion letter notes that California governmental entities are exempt from the MTA, and a company that provides payment processing services to facilitate the transfer from a California Department of Correction detainee’s cash at a detention facility to that detention facility’s bank account, is exempt from the MTA because it is processing payments between or among persons exempt from the MTA.
- MTA - Agent of Payee. The redacted opinion letter states that the company’s transactions by an agent of a merchant to collect funds from the merchant’s customer for payment of goods and services are exempt from the requirements of the MTA. The company is acting as an agent of the payee when a company is receiving money as an agent of a merchant pursuant to a preexisting written contract, and delivery of the money to the company satisfies the customer’s obligation to the merchant for a good or service provided by the merchant.
- Sending Instructions Not Money Transmission. The redacted opinion letter states that the company’s actions do not constitute money transmission under the MTA because “[the company] never ‘receives money for transmission.’” The company only “receives instructions from consumers and merchants to transmit money to each other and forwards these instructions for processing by their respective banks on the ACH network.” Because the banks are “solely responsible for payment and settlement in accordance with these instructions” the company’s payment system does not require an MTA license.
OCC: Banks may hold cryptocurrency for customers
On July 22, the OCC issued an interpretive letter concluding that national banks and federal savings associations (collectively, “banks”) may hold cryptocurrency on behalf of customers so long as they effectively manage the risks and comply with applicable law. Specifically, the letter responds to a bank’s proposal to offer cryptocurrency custody services to its customers as part of its standard custody business. The OCC notes that “there is a growing demand for safe places, such as banks, to hold unique cryptographic keys associated with cryptocurrencies.” The letter emphasizes that the OCC “generally has not prohibited banks from providing custody services for any particular type of asset,” and providing cryptocurrency custody services “falls within [] longstanding authorities to engage in safekeeping and custody activities.”
The OCC notes that while the custody services will not “entail any physical possession of the cryptocurrency,” OCC regulations authorize banks to provide through electronic means any activities that they are otherwise authorized to perform. Thus, because banks may perform custody services for physical assets, they are “likewise permitted to provide those same services via electronic means (i.e., custody of cryptocurrency).” Additionally, a bank with trust powers has the authority to hold cryptocurrencies in a fiduciary capacity, in the same way they manage other assets they hold as fiduciaries.
The OCC reminds banks that they should develop and implement sound risk management practices, and specifically notes that “custody activities should include dual controls, segregation of duties and accounting controls.” Moreover, banks should “conduct a legal analysis to ensure the activities are conducted consistent with all applicable law,” noting that “[d]ifferent cryptocurrencies may also be subject to different OCC regulations and guidance outside of the custody context, as well as non-OCC regulations.”
FinCEN warns of virtual currency social media scam
On July 16, the Financial Crimes Enforcement Network (FinCEN) issued an alert warning financial institutions about a scam using social media accounts to solicit fraudulent payments denominated in convertible virtual currency (CVC). According to FinCEN, high-profile social media accounts were compromised and used to solicit payments to CVC accounts, with claims that any CVC sent would be “doubled and returned to the sender.” The alert reminds financial institutions to report suspicious transactions involving this type of activity as soon as possible, and that “[a]ny data or information that helps identify the activity as suspicious can be included as an indicator” on their Suspicious Activity Report (SAR) form. The alert notes several indicators to assist financial institutions in identifying activity related to the scam, including (i) communications soliciting payments with misspellings; (ii) social media posts soliciting donations from unverified accounts; and (iii) multiple accounts communicating the same message soliciting funds for an unknown purpose.
Louisiana requires licensing for virtual currency businesses
On June 13, the Louisiana governor signed HB 701, which provides for the licensing and regulation of virtual currency businesses in the state. Subject to certain exceptions, the bill establishes licensing and registration requirements, and, among other things, (i) authorizes reciprocity of licensure with other states; (ii) specifies that licensee applications must be submitted through the Nationwide Multi-State Licensing System; (iii) adds provisions related to licensee examinations; (iv) outlines licensee surety bond requirements “based on the nature and extent of risks in the applicant’s virtual currency business model”; (v) provides the state’s office of financial institutions with enforcement authority; and (vi) prohibits licensees from engaging in unfair, deceptive, or fraudulent practices. The act is effective August 1.
SEC issues $18.5 million civil penalty for unregistered digital token offering
On June 26, the SEC announced a settlement with two offshore entities, resolving allegations that the entities violated federal securities laws by raising more than $1.7 billion in unregistered digital token offerings. As previously covered by InfoBytes, in October 2019, the SEC obtained a temporary restraining order, halting the offerings. According to the SEC, the entities violated Sections 5(a) and 5(c) of the Securities Act by failing to register its offers and sales of securities with the SEC. Prior to the restraining order, the entities had sold approximately 2.9 million digital tokens worldwide, including more than 1 billion tokens to 39 U.S. purchasers. The settlement requires the entities to return more than $1.2 billion to investors in “ill-gotten gains” from the token offerings. Additionally, the parent company is required to pay an $18.5 million civil penalty and give proactive notice to the SEC before participating in any digital asset issuances for the next three years. The entities entered into the settlement without admitting or denying the allegations in the SEC’s complaint.
NYDFS launches virtual currency initiatives
On June 24, NYDFS launched several virtual currency initiatives, including a Memorandum of Understanding with the State University of New York to launch a virtual currency program, a proposed conditional licensing framework, final guidance concerning a licensee’s ability to self-certify the use of new coins, and additional resources intended to help virtual currency market participants. Among other things, NYDFS requested comments on the proposed framework, which will allow an entity to apply for a conditional license when partnering with an existing NYDFS-authorized entity to engage in virtual currency business activity during the term of the conditional license. NYDFS seeks comments on, among other things, the types of operational, staffing, and other support the existing licensed entity should provide to the conditional licensee until it is able to obtain a full NYDFS virtual currency license of its own. Comments on the proposed framework are due August 10.
NYDFS also announced final guidance regarding licensees’ ability to self-certify the use of new coins. As previously covered by InfoBytes, last December NYDFS issued proposed guidance regarding coin adoption or listing options for virtual currency licensees. The final guidance provides a framework for entities to create firm-specific policies for the adoption or listing of new coins through self-certification, without NYDFS’s prior approval, and establishes that NYDFS will maintain a list of coins approved for use, and their permitted uses, available for adoption and use by licensees more generally.
Finally, NYDFS released additional resources, including a notice of NYDFS practices designed to create “a more transparent and timely process” for evaluating virtual currency license applications, as well as new virtual currency-related Frequently Asked Questions that will be updated on an ongoing basis.
CFTC approves final interpretative guidance on “actual delivery” in virtual currency transactions
On March 24, the CFTC approved final interpretive guidance concerning the term “actual delivery” in the context of retail virtual currency transactions. As previously covered by InfoBytes, the CFTC reaffirmed its belief that virtual currencies are commodities, and thus certain transactions involving these types of currencies are subject to CFTC oversight. In order to demonstrate the “actual delivery” of virtual currency in connection with retail commodity transactions, the final interpretive guidance sets forth two primary factors that market participants must demonstrate:
- A customer has (i) the ability to secure “possession and control of the entire quantity of the commodity, whether it was purchased on margin, by using leverage, or any other financing arrangement”; and (ii) “the ability to use the entire quantity of the commodity freely in commerce (away from any particular execution venue) no later than 28 days from the date of the transaction and at all times thereafter”; and
- “The offeror and counterparty seller (including any of their respective affiliates or other persons acting in concert with the offeror or counterparty seller on a similar basis) do not retain any interest in, legal right, or control over any of the commodity purchased on margin, leverage, or other financing arrangement at the expiration of 28 days from the date of the transaction.”
CFTC Chairman Heath P. Tarbert stated that he anticipates a 90-day period before the CFTC begins initiating enforcement actions related to the final interpretive guidance that may not have been plainly evident in prior guidance, enforcement actions, and case law.