InfoBytes Blog
Filter
Subscribe to our InfoBytes Blog weekly newsletter and other publications for news affecting the financial services industry.
DFPI: Certain bitcoin ATMs/kiosks not subject to MTA licensure
Recently, California’s Department of Financial Protection and Innovation (DFPI) released a new opinion letter covering aspects of the Money Transmission Act (MTA) related to bitcoin automated teller machines (ATMs) and kiosks. The letter explains that the sale and purchase of bitcoin through ATMs/kiosks in third-party retail locations described by the applicant company are not subject to licensure under the MTA because the sale and purchase of bitcoin from the company’s own inventory through a kiosk does not meet California’s definition of “money transmission.” In each instance, the transaction would only be between the consumer using the ATM/kiosk and the company, the bitcoin would be sent directly to the customer’s virtual currency wallet, and any bitcoin sold would be provided exclusively from the company’s own inventory. DFPI reminded the company that its determination is limited to the activities specified in the letter and does not extend to any other activities that the company may engage in. Moreover, the letter does not relieve the company from any FinCEN, federal, or state regulatory obligations.
NYDFS virtual currency techsprint set for March
On January 21, NYDFS announced the details of its first-of-its-kind techsprint focusing on virtual currency that will open on March 1 and culminate on March 12. As previously covered by InfoBytes, the techsprint is a collaboration with the Conference of State Bank Supervisors and the Alliance for Innovative Regulation, and the objective is “to achieve creative and collaborative prototyping as a step toward smarter regulatory reporting in virtual currency.” NYDFS notes that the virtual format will allow flexibility for the techsprint to include a combination of full-day facilitated exercises and self-paced, team-managed efforts. The teams will work to address one of several problem statements, including (i) “[h]ow can DFS achieve real-time or more frequent access to company financial data from virtual currency licensees and receive early warning signs of financial risks to the companies or their customers?” (i) “[h]ow can DFS obtain real-time transaction data from its licensees and automatically analyze the data to safeguard against illicit financing risks?” and (iii) “[h]ow can DFS use tools such as natural language processing, machine learning, and artificial intelligence to identify risks by processing and analyzing supervisory reports that are submitted by licensees in a wide range of formats?”
OCC conditionally approves conversion of digital bank
On January 13, the OCC announced it has conditionally approved a South Dakota non-depository public trust company’s application to convert to a national trust bank. The digital bank—which offers digital asset and cryptocurrency custody services in certain states—has entered into an operating agreement as an enforceable condition of approval, which specifies capital and liquidity requirements and risk management expectations. By receiving a national trust bank charter, the digital bank will be allowed to expand its digital asset custody services nationally and may perform the functions and “activities of a fiduciary, agency, or custodial nature, in the manner authorized by federal and state law” with oversight being conducted by the OCC. According to the OCC, this approval “demonstrates that the national bank charters provided under the National Bank Act are broad and flexible enough to accommodate evolving approaches to financial services in the 21st century.”
Court vacates mandatory disclosures and 30-day credit linking restriction in Prepaid Accounts Rule
On December 30, the U.S. District Court for the District of Columbia granted a payment company’s motion for summary judgment against the CFPB, vacating two provisions of the agency’s Prepaid Account Rule: (i) the short-form disclosure requirement “to the extent it provides mandatory disclosure clauses”; and (ii) the 30-day credit linking restriction. As previously covered by InfoBytes, the company filed a lawsuit against the Bureau alleging, among other things, that the Bureau’s Prepaid Account Rule exceeds the agency’s statutory authority “because Congress only authorized the Bureau to adopt model, optional disclosure clauses—not mandatory disclosure clauses like the short-form disclosure requirement.” The Bureau countered that it had authority to enforce the mandates under federal regulations, including the Electronic Fund Transfer Act (EFTA), TILA, and Dodd-Frank, arguing that the “EFTA and [Dodd-Frank] authorize the Bureau to issue—or at least do not foreclose it from issuing—rules mandating the form of a disclosure.” The Bureau also claimed that its general rulemaking power under either TILA or Dodd-Frank provides authority for the 30-day credit-linking restriction.
With respect to the mandatory disclosure clauses of the short-form requirement in 12 CFR section 1005.18(b), the court concluded, among other things, that the Bureau acted outside of its statutory authority. The court stated that “Congress underscored the need for flexibility by requiring the Bureau to ‘take account of variations in the services and charges under different electronic fund transfer systems’ and ‘issue alternative model clauses’ for different account terms where appropriate” and it could not “presume—as the Bureau does—that Congress delegated power to the Bureau to issue mandatory disclosure clauses just because Congress did not specifically prohibit them from doing so.”
In striking the mandatory 30-day credit linking restriction under 12 CFR section 1026.61(c)(1)(iii), the court determined that “the Bureau once again reads too much into its general rulemaking authority.” First, the court determined that neither TILA nor Dodd-Frank vest the Bureau with the authority to promulgate substantive regulations on when consumers can access and use credit linked to prepaid accounts. Second, the court deemed the regulatory provision to be a “substantive regulation banning a consumer’s access to and use of credit” under the disguise of a disclosure, and thus invalid.
Congress overrides veto of NDAA with significant BSA/AML provisions
On January 1, the U.S. Senate voted to override President Trump’s veto of the National Defense Authorization Act (NDAA) for Fiscal Year 2021, following a similar vote in the House a few days prior. As previously covered by InfoBytes, the NDAA includes significant changes to the Bank Secrecy Act (BSA) and anti-money laundering (AML) laws under the Anti-Money Laundering Act of 2020, such as:
- Establishing federal disclosure requirements of beneficial ownership information, including a requirement that reporting companies submit, at the time of formation and within a year of any change, their beneficial owner(s) to a “secure, nonpublic database at FinCEN”;
- Expanding the declaration of purpose of the BSA and establishing national examinations and supervision priorities;
- Requiring streamlined, real-time reporting of Suspicious Activity Reports;
- Establishing a Subcommittee on Innovation and Technology within the Bank Secrecy Act Advisory Group to encourage and support technological innovation in the area of AML and countering the financing of terrorism and proliferation (CFT);
- Expanding the definition of financial institution under the BSA to include dealers in antiquities;
- Requiring federal agencies to study the facilitation of money laundering and the financing of terrorism through the trade of works of art; and
- Including digital currency in AML-CFT enforcement by, among other things, expanding the definition of financial institution under the BSA to include businesses engaged in the transmission of “currency, funds or value that substitutes for currency or funds.”
OCC: Banks may use independent node verification networks and stablecoins for payment activities
On January 4, the OCC published an interpretive letter addressing the legal permissibility of certain payment-related activities involving the use of new technologies, including using independent node verification networks (INVN) and related stablecoins to conduct payment activities and other bank-permissible functions. Specifically, the letter clarifies that a national bank or federal savings association “may validate, store, and record payments transactions by serving as a node on an INVN,” and may also “use INVNs and related stablecoins to carry out other permissible payment activities” provided the bank or federal savings association complies with applicable laws and safe, sound, and fair banking practices. Due to the decentralized nature of INVNs—which not only “allows a comparatively large number of nodes to verify transactions in a trusted manner” but also “limits tampering or adding inaccurate information to the database because information is only added to the network after consensus is reached among the nodes validating the information”—the OCC believes that INVNs may enhance payment activities’ efficiency, effectiveness, and stability within the federal banking system. The letter also outlines potential risks associated with INVN-related activities, such as operational and compliance risks and fraud related to the possibility of money laundering and terrorist financing, and warns banks and federal savings associations to expand their programs to ensure compliance with Bank Secrecy Act reporting and recordkeeping requirements and to address cryptocurrency transaction risks.
Representatives question the OCC’s cryptocurrency and stablecoin efforts
On November 10, six members of the U.S. House of Representatives wrote to Acting Comptroller of the Currency Brian Brooks raising concerns about the OCC’s recent unilateral actions to regulate cryptocurrencies. In the letter, the members question the OCC’s regulatory priorities. For example, the members highlight that, through recent actions, such as its advance notice of proposed rulemaking on digital activities (covered by InfoBytes here), the OCC has sought “to serve those ‘already-banked’ with better payments options” while potentially “overlooking opportunities for assisting the unbanked and underbanked to participate in the economy and the banking system.” Additionally, the members note that the OCC’s interpretive decisions, which authorize financial institutions to hold cryptocurrency and stablecoins for customers (covered by InfoBytes here and here), may have “broad implications for the future of banking” and “are best made in collaboration with your fellow regulators and with Congress to ensure we avoid potential harms to institutional safety and soundness and equity and inclusion.” In closing, the members ask the OCC to answer a number of questions, including (i) whether stablecoin reserves will be segregated from calculating the capital requirements of large banks; (ii) what consumer protections the agency will impose on stablecoin providers; and (iii) whether the OCC has collaborated with other federal regulators on their recent decisions.
NYDFS urges regulating social media companies following hacks
On October 14, NYDFS released a report detailing the Department’s investigation into the July 2020 social media hacks of public figures and cryptocurrency firms, concluding that the social media platform lacked adequate cybersecurity protections and recommending increased regulation of large social media companies. The investigation, which was requested by New York Governor Andrew Cuomo, determined, among other things, that (i) the social media hackers obtained log-in credentials from four employees by pretending to be from the company’s IT department; (ii) the hackers stole over $118,000 worth of bitcoin from consumers by tweeting “double your bitcoin” with a link to send bitcoin payments from celebrity accounts and several bitcoin companies; (iii) certain Department-regulated cryptocurrency companies blocked attempted transfers to the hacker’s addresses; and (iv) the social media company lacked adequate cybersecurity protection, including not having “a chief information security officer, adequate access controls and identity management, and adequate security monitoring.” The report recommends that the largest social media companies be designated as “systemically important institutions” subject to an analogue council of the Financial Stability Oversight Council. The report suggests the social media companies should be subject to enhanced regulation, including “stress test[]” scenarios covering cyberattacks and election interference.
NYDFS issues first “conditional Bitlicense”
On October 21, NYDFS announced authorization for a digital payments company to launch a service for U.S. customers to buy, sell, and hold certain NYDFS-approved cryptocurrencies. Under the terms of the “conditional Bitlicense,” the payments company will partner with a New York-chartered trust company responsible for providing cryptocurrency trading and custodial services. According to NYDFS Superintendent Linda Lacewell, this first conditional Bitlicense represents the state regulator’s efforts “to encourage, promote, and assist interested institutions to have a well-regulated way to access the New York virtual currency marketplace in a way that is both timely and protective of New York consumers.” NYDFS first announced the proposed conditional licensing framework in June (covered by InfoBytes here).
Issuer pays $5 million penalty for unregistered digital offering
On October 21, the SEC announced the U.S. District Court for the Southern District of New York entered a final judgment against a tech company issuer that raised approximately $100 million through an unregistered initial coin offering. As previously covered by InfoBytes, the SEC filed an action alleging the issuer failed to provide required disclosures to investors and did not register the offer or sale of its digital tokens with the SEC, as required by Section 5 of the Securities Act of 1933 (the Act). The SEC argued that the issuer marketed the digital tokens as an investment opportunity and told investors that they could earn future profits from the issuer’s efforts to create, develop, and support a digital “ecosystem.”
The court granted summary judgment in favor of the SEC at the end of September, concluding, among other things, that the issuer violated Section 5 of the Act when it conducted an unregistered offering of securities that did not qualify for any exemption from registration requirements. The final judgment (i) requires the issuer to pay $5 million in a civil penalty; (ii) permanently enjoins the issuer from violating Section 5 of the Act; and (iii) requires the issuer, for a period of three years, to provide notice to the SEC before engaging in any “issuance, offer, sale or transfer” of specified assets.