InfoBytes Blog
Filter
Subscribe to our InfoBytes Blog weekly newsletter and other publications for news affecting the financial services industry.
NY DFS Advises Banks On New Cybersecurity Examination Process
On December 10, NY DFS Superintendent Benjamin Lawsky issued a bulletin to all New York state-chartered or licensed banking institutions regarding an updated IT examination process. Effective immediately, cybersecurity examinations will be included within the overall IT examination process. The DFS cybersecurity examinations will incorporate a number of new topics, including: (i) corporate governance; (ii) protections against intrusion, such as multi-factor or adaptive authentication, along with server and database configuration; (iii) information security testing and monitoring; and (iv) cybersecurity insurance coverage, along with other third-party protections. Ultimately, the new examination process will assess a bank’s cybersecurity protections, in addition to how it manages potential cyber risks and handles a cybersecurity attack.
New York Announces New Regulations of Abusive Third-Party Debt Collection Practices
On December 3, New York Governor Cuomo announced that the DFS finalized regulations to help end abusive debt collection practices. The new regulations will (i) require debt collectors and debt buyers to provide enhanced disclosures regarding the debt; (ii) protect consumers who may have debts where the statute of limitations has expired; (iii) require that the debt collector substantiate that the debt is actually owed; (iv) ensure that consumers receive written confirmation of settlement agreements; and (v) allow consumers to communicate with debt collectors via personal email. The new regulations will take effect on March 3, 2015, with the exception of Sections 1.2(b) and 1.4, which will take effect August 30, 2015. Section 1.2(b) refers to disclosure requirements and 1.4 refers to substantiation of debts.
NY DFS Takes Action Against Foreign Bank Regarding Transactions with Sanctioned Countries
On November 18, the New York DFS announced a consent order with a foreign bank for allegedly misleading regulators regarding its transactions with sanctioned countries, most notably Iran, Sudan, and Myanmar. According to the press release and consent order, from approximately 2007 through 2008, the bank convinced a consulting firm to “water down” reports submitted to regulators on its transactions. Specifically, the bank pressured the consulting firm to alter an historic transaction review (HTR) report to exclude key information, such as: (i) the English translation of the bank’s wire transfer instructions, which included a statement that the bank conducted business with “’enemy countries’ of the U.S.;” (ii) a majority of the consultant’s description of the bank’s wire transfer activities; and (iii) information “concerning [the bank’s] potential misuse of OFAC screening software” in connection with its wire transfer activities. The DFS ordered the bank to pay $315 million in penalties, in addition to the $250 million the DFS ordered the bank to pay June 2013 in connection with its sanctioned transactions.
New York Announces Four Institutions Agree to Use DFS Database To Prevent Online Payday Lending
On November 13, Governor Cuomo announced that four additional financial institutions have agreed to use a database created by the State’s Department of Financial Services to “help identify and stop illegal, online payday lending in New York.” The database includes a list of companies that the DFS has identified and taken action against for making illegal internet payday loans to people in New York. The total number of institutions using the database now stands at five.
New Bitcoin Firms May Get Transitional License in New York
On November 2, New York Superintendent Lawsky delivered remarks at the Money 20/20 Conference on the state’s virtual currency and Bitcoin regulation. In October, Lawsky publicly stated that, as a result of the comments received on New York’s proposed BitLicense framework, there would be important changes made to the July 17 proposal. This week, on behalf of the NYDFS, Lawsky announced that additional changes are being considered to address “concern about the compliance costs of regulation on new or fledging virtual currency enterprises.” Specifically, Lawsky introduced the concept of a Transitional BitLicense, which would allow certain small, money transmitting startups to begin operating without huge compliance costs. Lawsky noted four main factors the NYDFS would consider when deciding whether or not to grant a Transitional BitLicense: (i) the nature and scope of the business and the associated risks for consumers; (ii) projected transactional and business volume; (iii) registration status as a Money Services Business with FinCEN; and (iv) previously established mitigating risk controls.
New York Sanctions Bank For Alleged Failure To Comply With Prior AML Settlement
On August 19, the New York DFS announced a consent order with a British bank to resolve claims that the bank and its U.S. subsidiary failed to remediate AML compliance deficiencies as required by a prior settlement with the DFS that required the bank to, among other things, implement a transaction monitoring program. The DFS states that the compliance monitor appointed as part of the prior agreement determined that the procedures adopted by the bank to detect high-risk transactions contained errors and other problems that prevented the bank from identifying high-risk transactions for further review. The DFS asserts that the bank failed to detect these problems because of a lack of adequate testing both before and after implementation of the monitoring system. The DFS also claims the bank failed to properly audit its monitoring system. Under the latest consent order, the bank must: (i) suspend its dollar clearing operations for high-risk retail business clients of the bank’s Hong Kong subsidiary; (ii) obtain prior DFS approval to open a U.S. Dollar demand deposit account for any customer who does not already have such an account with the U.S. entity; and (iii) pay a $300 million penalty. The bank also must implement additional compliance enhancements, including enhanced due diligence and know-your customer requirements.
New York Announces Latest Action Against A Bank Consulting Firm
On August 18, the New York DFS announced an settlement with a bank consulting firm to resolve allegations related to certain services it performed for a bank charged last year with sanctions violations. The consulting firm allegedly altered an historical transaction review (HTR) report submitted to regulators regarding wire transfers that the bank completed on behalf of sanctioned countries and entities. At the bank’s request, the firm allegedly removed from the original HTR report key information and warning language concerning the bank’s transactions. Specifically, the DFS alleges that the firm: (i) removed the English translation of the bank’s wire stripping instructions; (ii) removed a regulatory term to describe the wire-stripping instructions and a discussion of the activities; and (iii) deleted “several forensic questions” that the firm identified as necessary for consideration in connection with the HTR report. The agreement prohibits the firm from doing business with any DFS-regulated institution for two years and requires the firm to: (i) pay a $25 million penalty; and (ii) implement certain reforms to address the conflicts of interest within the consulting industry.
New York Extends Comment Period For BitLicense Proposal
This week, the New York DFS announced the extension of the comment period on its proposal to create a regulatory licensing framework for virtual currency companies, including a so-called BitLicense. Given the “significant amount of public interest in and commentary on” the proposal, the DFS doubled the length of the comment period from 45 to 90 days. Comments are now due by October 21, 2014. Further information about the proposal and related issues is available here.
New York Virtual Currency Proposal Could Capture Bank Products, Card Rewards Programs
On July 17, the New York Department of Financial Services (NYDFS) proposed a rule intended to govern the virtual currency marketplace. The proposed rule is extremely broad and as currently drafted would appear to capture products provided by traditional brick and mortar banks and other regulated financial institutions. For example, as proposed, the rule could regulate:
- Reward programs, "thank you" offers, or digital coupons that offer cash back or statement credits;
- Generated numbers that access cash;
- Prepaid access and other cards that will allow customers to receive cash, including those customarily exempt such as government funded transfers;
- P2P transfers; and
- Wallet providers where the customer can access cash.
If left unaddressed, these apparent unintended consequences could create a confusing regulatory environment for certain bank and card products. It is also noteworthy that the rule does not provide any customary exclusions for chartered entities, raising substantial preemption questions.
Businesses engaging in activities covered by the proposed rule would be required to apply for a license from the NYDFS within 45 days of the effective date of the regulation. The proposed rule also sets out comprehensive compliance obligations involving consumer protection, cybersecurity, anti-money laundering, and anti-fraud, and the rule would subject licensed institutions to examination by the NYDFS. Failure to obtain a license could result in disciplinary action by the NYDFS.
The comment period on the proposed rule ends on September 6, 2014.
* * *
Our Digital Commerce & Payments Practice group is experienced in regulatory matters arising at the intersection of digital payments, financial institutions, and technology providers, and is uniquely positioned to assist virtual currency and related companies whose business brings them into contact with the CFPB and/or the NYDFS.
Please contact one of the attorneys listed below if you would like to discuss the scope of the obligations set forth in the NYDFS proposed rule.
- Manley Williams, (202) 349-8060
Digital Insights & Trends: Will NY's BitLicense Stifle an Industry (or Just Relocate it)?
The New York Department of Financial Services riveted the attention of the virtual currency world (and just about everyone else involved with digital financial services), with its July 17 proposal to issue licenses for Virtual Currency Business Activities. The so-called BitLicense proposal features broad coverage; open ended capital and bonding requirements; personal investigation of founders, investors and even employees; and prior regulatory approval of new products and activities.
These and other aspects of BitLicensing beg the question: will licensing protect the public and investors? Or just drive Bitcoin participants out? (If they leave, they may find roadblocks elsewhere; days before New York’s announcement, France’s Ministry for the Economy and Finance, for example, proposed regulating Bitcoin.) Opportunistic locales for virtual currency operators are already being identified, such as the Isle of Man, a self-governing British Crown Dependency, whose Financial Supervision Commission says it is “not the appropriate time” to introduce a regulatory regime, while warning there is no consumer protection in the digital currency market. Think about this: Tiny Delaware is a corporate legal haven, Switzerland created an international bank haven, and a virtual currency haven may be next. Regulatory exercises like New York’s could advance that option.
Founders of virtual currency startups (as well as other more traditional emerging payment businesses generally) aren’t keen to disclose personal financial information and fingerprints, and aspects of the NY bitlicensing rule such as the requirement to keep consumer complaints on file for 10 years, and limitations on permissible investments for licensees’ retained earnings have created a torrent of online backlash. BitLicensees could not introduce new products or materially change their activities without approval of the NY superintendent of financial services, with no timeline for approval. Prior approval of business activities in this fast-paced industry troubles high-tech innovators, who worry that their products aren’t well understood. The anticipated cost of the NY BitLicense, regulatory compliance programs, and required audit and reporting are also perceived as dampers on a fledgling industry.
Despite new regulatory proposals, the virtual currency industry is gaining ground, as evidenced by groups including the North American Bitcoin Conference (NABC), UK Digital Currency Association, Bitcoin France Bureau, Bitcoin Association of Australia, Australian Digital Currency Commerce Association and the newly formed Chamber of Digital Commerce. First stop is lobbying in Washington, with demands for “smart regulation,” followed by media outreach by the industry’s public affairs people.
Virtual currencies will eventually be regulated, because AML and worldwide counter-terrorism priorities demand it, but I’m not sure BitLicenses will prevent Mt. Gox-like meltdowns. We represent clients in many financial services industries, and despite elaborate licensing rules, investors lose money, providers lose traction, and things go wrong occasionally. Requirements for managing electronic data and transaction risk didn’t prevent breaches at Target or Neiman Marcus, despite their robust (and expensive) systems. Outsized regulatory reporting requirements increase costs, which startups are keen to control. Moreover, realigning limited regulatory resources toward virtual currency regulation could mean less oversight of other, also important controls, with unhappy consequences. New York is trying to strike the right balance between creating a regulatory structure to aid in the legitimacy of the new medium while not stifling its growth or pushing it to friendlier regulatory environments. However, is it too much too soon?