On March 16, NYDFS entered a consent order resolving an examination of a payment service provider that allows merchants to accept Bitcoin payments from customers in exchange for the equivalent value in local currency credited to the merchant’s bank account. The company is licensed by the NYDFS to engage in virtual currency business activity pursuant to 23 NYCRR Part 200. Licensees under Part 200 are required to, among other things, adhere to federal and state laws mandating effective controls to guard against money laundering and certain other illegal activities.
The NYDFS concluded that the payments service provider, in violation of the Part 200, failed to develop adequate internal policies and controls to maintain compliance with applicable anti-money laundering laws and failed to comply with necessary risk management requirements under applicable OFAC regulations. This follows a previous examination of the payment service provider in 2018, through which the NYDFS found deficiencies in the company’s overall compliance function, including with respect to its anti-money laundering and cybersecurity compliance programs.
Pursuant to the consent order, the payment service provider agreed to pay a $1 million civil monetary penalty and submit an action plan to the NYDFS within 180 days detailing its remediation efforts with respect to the alleged violations.
Putting it into Practice: As the consent order highlights, it is vital for companies whose operations involve virtual currency, including payment service providers, to abide by all applicable regulations. And given the recent volatility in the virtual currency space writ large, being aware of and quickly implementing any and all best practices will best protect companies engaged in virtual currency operations from being the target of similar enforcement proceedings or other negative ramifications. This action should be a warning to companies operating in New York and nationally about the regulatory focus on “repeat offenders” (we discussed this focus in previous blog posts here, here, and here).