New York State Department of Financial Services Publishes First Crypto Industry Consent Order | BakerHostetler

On August 1, 2022, the New York State Division of Monetary Providers (“DFS” or “Division”) issued a Consent Order, imposing a $30 million positive on Robinhood Crypto, LLC (“Robinhood”), a buying and selling platform that enables clients to commerce in cryptocurrency, for allegedly failing to adjust to New York anti-money laundering (“AML”) and cybersecurity rules. Along with the financial penalty, Robinhood should retain an impartial guide to carry out an 18-month “complete evaluation” to guage Robinhood’s remediation efforts with respect to the recognized compliance deficiencies. The case marks DFS’s first enforcement motion within the cryptocurrency sector.

Key Takeaways

• Licensed digital forex companies in New York ought to be ready for DFS’s annual certification obligations and its security and soundness examinations by being able to reveal how their compliance packages meet the requirements set forth in DFS rules, notably the Digital Foreign money Regulation,[1] the Cash Transmitter Regulation,[2] the Cybersecurity Regulation,[3] and the Transactions Monitoring Regulation.[4]
• DFS security and soundness examinations that determine “severe deficiencies” might immediate DFS to launch an enforcement investigation associated to the recognized deficiencies.
• DFS will intently look at whether or not digital forex companies are allocating satisfactory sources to their compliance packages, notably with regard to the dimensions and tempo of an organization’s development.

DFS’s Regulation of Digital Foreign money Enterprise Exercise

DFS is the first regulator of economic providers in New York State, licensing and overseeing monetary establishments throughout the state. In June 2015, DFS issued Half 200 of the Laws of the Superintendent of Monetary Providers (the “Digital Foreign money Regulation”) beneath the New York Monetary Providers Legislation.[5] To interact in “digital forex enterprise exercise” in New York, DFS requires entities to both apply for a “BitLicense” or for a constitution beneath the New York Banking Legislation – for instance, as a New York state restricted objective belief firm – with authorization to conduct digital forex enterprise actions.

The Digital Foreign money Regulation requires that DFS-regulated digital forex entities set up an efficient AML program.[6] DFS rules equally require licensed cash transmitters to determine, implement, and keep an efficient AML compliance program. Along with the Digital Foreign money Regulation, DFS’s Cybersecurity Regulation[7] requires licensees, together with digital forex companies and cash transmitters, to create and keep a cybersecurity program designed to guard the confidentiality, integrity, and availability of data methods.

DFS’s Investigation into Robinhood

In 2019, DFS permitted Robinhood’s purposes for a digital forex license and a cash transmitter license.[8] In 2020, DFS carried out a security and soundness examination of Robinhood. Based on the Consent Order, following the security and soundness examination, DFS “started an enforcement investigation into the assorted compliance failures recognized by the [e]xamination” and finally discovered that Robinhood failed to totally meet its authorized obligations in two areas: (a) to take care of an efficient Financial institution Secrecy Act and anti-money laundering (“BSA/AML”) program, together with an satisfactory transaction monitoring system, commensurate with its development; and (b) to totally adjust to DFS’s Cybersecurity Regulation.

Based on the Consent Order, amongst different issues, DFS discovered that Robinhood inappropriately relied on its affiliate for administration of Robinhood’s BSA/AML program; didn’t construction the BSA/AML program to permit its chief compliance officer to formally report back to Robinhood’s administrators or its audit or danger committees; didn’t have enough BSA/AML employees with the suitable stage of expertise to assist its BSA/AML compliance program, notably given the dimensions and tempo of Robinhood’s development; didn’t have any automated AML transaction monitoring and case administration system in place on the time of the security and soundness examination, and didn’t well timed transition its guide system to an automatic transaction monitoring system; had a big backlog in processing alerts of doubtless suspicious transactions; and “employed a particularly excessive and arbitrary threshold quantity to generate exception reviews” for crypto-specific transaction monitoring guidelines.

Based on the Consent Order, Robinhood additionally didn’t make use of satisfactory cybersecurity personnel to supervise its compliance with the Cybersecurity Regulation, regardless of the corporate’s “super development.” The Consent Order additional alleges that Robinhood failed to determine enough insurance policies and procedures in quite a lot of areas required by the Cybersecurity Regulation.

Primarily based on these alleged violations, DFS additional discovered that certifications that Robinhood filed testifying to its compliance with every of the Cybersecurity and Transactions Monitoring Laws had been improper. DFS additionally discovered that Robinhood was in violation of the Digital Foreign money Regulation for failure to supply a phone quantity to obtain buyer complaints on its web site.

The Settlement and Consent Order

Robinhood first publicly disclosed the investigation and settlement with DFS a yr in the past in paperwork filed with the Securities and Alternate Fee.[9] Beneath the Consent Order, Robinhood should pay a civil financial penalty of $30 million. The Consent Order additionally requires Robinhood to interact an impartial guide for a time period of 18 months to evaluation, report on, and help Robinhood in its efforts to treatment the compliance deficiencies recognized by DFS.

“We now have made important progress constructing industry-leading authorized, compliance, and cybersecurity packages, and can proceed to prioritize this work to finest serve our clients,” Robinhood’s affiliate basic counsel of litigation and regulatory enforcement, Cheryl Crumpton, stated in a latest assertion.[10] “We stay proud to supply a extra accessible, lower-cost platform to purchase and promote crypto and are excited to proceed to develop our enterprise in a accountable method with new services and products that our clients need.”[11]

Conclusion

The settlement with Robinhood is the primary cryptocurrency-sector enforcement motion by DFS. To keep away from changing into the topic of an identical motion, cryptocurrency companies licensed in New York ought to set up a working relationship with DFS and be ready to reveal their compliance with DFS rules. Because the cryptocurrency {industry} continues to develop, crypto companies ought to take steps to be sure that their compliance packages are rising on the similar tempo as their enterprise. As DFS Superintendent Adrienne A. Harris has acknowledged: “DFS will proceed to analyze and take motion when any licensee violates the regulation or the Division’s rules, that are crucial to defending customers and guaranteeing the security and soundness of the establishments.”[12]

[View source.]