Objective

To assess the extent of implementation of the six recommendations included in our initial audit report, Virtual Currency Licensing (Report 2022-S-18).

About the Program

The Department of Financial Services (DFS) is New York State’s financial services regulator, and its head, the Superintendent of Financial Services (Superintendent), is responsible for ensuring the safety and soundness of New York’s financial services industry and promoting the reduction and elimination of fraud, abuse, and unethical conduct with respect to financial institutions licensed to operate in the State. The Superintendent has the authority to conduct investigations, bring enforcement proceedings, levy monetary penalties, and revoke licenses of entities that violate relevant laws and regulations.

DFS supervises and regulates the activities of over 3,200 financial institutions with nearly $10 trillion in assets as of December 31, 2024, including 22 virtual currency licensees with assets totaling more than $404 billion. In June 2015, DFS issued NYCCR Title 23, Part 200 – Virtual Currencies (Part 200). According to Part 200, virtual currency is “any type of digital unit that is used as a medium of exchange or a form of digitally stored value. Virtual currency shall be broadly construed to include digital units of exchange that have a centralized repository or administrator; are decentralized and have no centralized repository or administrator; or may be created or obtained by computing or manufacturing effort.” Part 200 requires businesses to obtain a license (BitLicense) to engage in virtual currency business activities in New York State, except those chartered under New York Banking Law or using virtual currency for investing purposes.

The objective of our initial audit, issued on January 2, 2024, was to determine whether DFS provided adequate oversight of the applications for, and supervision and examination of, virtual currency licensees to ensure compliance with Part 200. The audit covered the period from July 2018 through July 2023. The audit found that DFS was not adequately performing its oversight responsibilities related to the application for and supervision of BitLicenses. Specifically, DFS did not ensure compliance with the Department of Taxation and Finance’s tax obligations and might use outdated anti-money laundering risk assessments to approve licenses. Additionally, DFS BitLicensees were not in compliance with DFS’ cybersecurity regulations, although in some cases they self-certified that they were. We also found, on average, a 3-year gap between biennial examinations to determine licensees’ financial condition and the safety and soundness of their business, and DFS could not demonstrate that it tracked and followed up on issues discovered during the examinations that were completed.

Key Finding

DFS officials made some progress in addressing the issues we identified in our initial report; however, more work needs to be done. Of the initial report’s six recommendations, three were implemented and three were partially implemented.

Key Recommendation

DFS officials are requested, but not required, to provide information about any actions planned to address the unresolved issues discussed in this follow-up within 30 days of the report’s issuance.