On March 10, the New York State Department of Financial Services (DFS) issued guidance and a request for assurance to financial institutions engaged in virtual currency business activity in New York. The request requires regulated virtual currency businesses to prepare and submit a plan of preparedness to manage the risk of disruption to services and operations caused by the novel coronavirus known as “COVID-19”.
The DFS requested that preparedness plans be submitted to the DFS as soon as possible and no later than April 9, 2020. Plans must be submitted to the DFS via a designated email address available at: virtualcurrency.covid19@dfs.ny.gov. The DFS also provided a list of the minimum information that each plan should include:
- Preventative measures tailored to the institution’s specific profile and operations to mitigate the risk of operational disruption, which should include identifying the impact on customers and counterparts;
- A documented strategy addressing the impact of the outbreak in stages, so that the entity’s efforts can be appropriately scaled, consistent with the effects of a particular stage of the outbreak;
- Assessment of all facilities, systems, policies and procedures necessary to continue critical operations and services if members of the staff are unavailable for longer periods or are working off-site, including the effectiveness and security of remote access;
- An assessment of potential increased risk of cyberattacks and fraud due to an outbreak;
- Employee protection strategies, critical to sustaining an adequate workforce during the outbreak, including employee awareness and steps that employees can take to reduce the likelihood of contracting COVID-19;
- Assessment of the preparedness of critical third-party service providers and suppliers;
- Development of a communication plan to effectively communicate with customers, counterparties, and the public, and to deliver important news and instructions to employees, along with establishing forums for questions to be asked and addressed;
- Testing the plan to ensure its policies, processes, and procedures are effective; and
- Governance and oversight of the plan, including identifying the critical members of a response team, to ensure ongoing review and updates to the plan, including the tracking of relevant information from government sources and the institution’s own monitoring program.
Plans should also include a financial risk assessment that addresses the potential impact of COVID-19 on the financial aspects of the virtual currency business, including how the business will monitor their financial risk. Importantly, plans should also consider any third-party relationships that could be impacted by COVID-19. The financial risk assessments must include, at a minimum:
- Assessment of the valuation of assets and investments that may be, or have been, impacted by COVID-19;
- Assessment of the overall impact of COVID-19 on the earnings, profits, capital, and liquidity of your institutions; and
- Assessment of reasonable and prudent steps to assist those adversely impacted by COVID-19. See DFS Guidance to New York State Regulated Banks, Credit Unions and Licensed Lenders Regarding Support for Businesses Impacted by the Novel Coronavirus.
We encourage any New York virtual currency businesses that have questions or concerns regarding their COVID-19 preparedness to contact experienced counsel. Impacted businesses may also contact the DFS directly by using the contact information provided in the notice letter available here.