NY Regulator Warns Against the Commingling of User Funds Following FTX’s Downfall

In a continuous effort to improve the security of user funds in crypto exchanges, New York’s Chief Financial Regulator drafted guidance on Monday, January 23rd. The Guidance on Custodial Structures for Customer Protection in the Event of Insolvency (Guidance) stipulates that companies involved with crypto funds must separate users’ assets (crypto assets) from company funds - an issue underscored by FTX’s failures to do so which resulted in significant losses to clients. 

On November 11th, 2022, FTX and its 130 subsidiary companies declared bankruptcy under Chapter 11 in the U.S. Bankruptcy Court.  While the money involved in the fall of FTX is significant,  the fallout has underscored the need to correct weak governance practices and poor financial reporting to ensure history doesn’t repeat itself. Due to these shortcomings, FTX and CEO Sam Bankman-Fried (SBF) have been accused of fraud, mismanagement, and other wrongdoings. Regulatory attention has also been drawn to FTX as a failure of this magnitude hasn't been seen since Enron in the early 2000s. 

The ripple effects of FTX’s crash are already manifesting. Genesis, which filed for Chapter 11 bankruptcy on 19th January 2023, has an estimated liability of around $5.1 billion. It owes Gemini, its single largest creditor, nearly $769 million through its Gemini Earn program. BlockFi, a prominent crypto exchange, also filed for bankruptcy on November 28th, 2022. Its liabilities are estimated to be around $1 to $10 billion.

Regulators are intervening to ensure the proper functioning of the crypto companies in light of FTX’s contagion effect. The recent advisory is the latest crypto-related guidance released by the New York State Department of Financial Services (NYDFS), which saw the cryptocurrency market contract by around $1.3 trillion by the end of 2022. 

The launch of a new set of guidelines comes at a time when regulators are once again calling out the lack of consumer protection in the cryptocurrency market and provides regulators additional powers to ensure consumer protection in case any company files for solvency moving forward. 

Post the FTX fallout, crypto asset standards are under scrutiny by central banks, regulators, and international organizations. The U.S. Senators and members of the European Parliament are pressuring their respective organizations to regulate crypto under existing guidelines. This Guidance will further increase consumer protection as it addresses key fund management issues by crypto organizations. Due to the inherent cross-border nature, governance, management, and policy enforcement around crypto assets can be particularly difficult. Several virtual asset service providers – wallets, exchanges, and issuers – conduct their business from offshore jurisdictions, although they offer their services around the world. Without a unified global strategy, companies prefer tax or regulation-friendly jurisdictions and continue to serve customers in other locations. 

Who Does the Guidance Apply To?

The Guidance applies to organizations that the NYDFS has authorized or permitted to retain, temporarily store, manage, or custody digital assets on behalf of its clients. 

"As stewards of others’ assets, virtual currency entities ('VCE') that act as custodians ('VCE Custodians') play an important role in the financial system and, therefore, a comprehensive and safe regulatory framework is vital to protecting customers and preserving trust," NYDFS explained.

This Guidance is intended to offer greater clarity regarding standards and practices that will help ensure that VCE Custodians provide a high level of customer protection with respect to asset custody under the BitLicense and limited purpose trust company framework

BitLicense Eligibility And Limited Purpose Trust Companies

A thorough and secure compliance framework is essential to protect customers and maintain trust in the crypto ecosystem. The Guidance reinforces the need for industry best practices and standards, which have been a top priority for NYDFS since 2015. It was only in 2015 that the Bitlicense regime was introduced for the first time to ensure consumer protection in relation to asset custody.

The BitLicense is a license issued by the New York State Department of Financial Services (NYDFS) that is required for any company that wants to engage in virtual currency business activity in New York. The BitLicense applies to a wide range of virtual currency-related activities, including buying and selling virtual currency, transmitting virtual currency, and operating a virtual currency exchange.

Companies that are eligible to apply for a BitLicense include:

• Virtual currency exchanges
• Virtual currency transmitters
• Virtual currency custodians
• Virtual currency issuers
• Virtual currency miners
• Virtual currency ATMs

On the other hand, a Limited Purpose Trust Company (LPTC) is a type of trust company that is chartered and regulated by the NYDFS. LPTCs are typically established to provide trust and custodial services for specific types of assets, such as digital assets.

Companies that are eligible to apply for an LPTC charter include:

• Virtual currency exchanges
• Virtual currency custodians
• Virtual currency wallets
• Virtual currency trust companies
  

Bear in mind that BitLicense and LPTC are two different types of licenses that are issued by the NYDFS and that different types of companies may be eligible for each license. 

The Mechanics of BitLicense

The BitLicense is issued by the NYDFS under the regulation of its Part 200 Virtual Currencies. This regulation was established in 2015 to provide a regulatory framework for virtual currency companies operating in New York State.

The BitLicense is distinct from the Money Transmitters License, which is issued by the New York State Department of Financial Services under the regulation of the New York State Banking Law. The Money Transmitters License is generally required for businesses that engage in money transmission, which includes the transfer of money or monetary value, such as virtual currency. 

Businesses that engage in virtual currency-related activities in New York State, such as buying and selling virtual currency, transmitting virtual currency, and operating a virtual currency exchange, are generally required to apply for a BitLicense. There is a possibility, depending on the company's business model, that New York may require a virtual currency business to obtain both a Money Transmitter License and a BitLicense.

BitLicense is intended to protect consumers and ensure the integrity of the virtual currency markets by requiring companies to meet certain standards for financial reporting, cybersecurity, and anti-money laundering (AML) compliance.

Key Takeaways from the Guidance

The guidance aims to make it more complex and difficult for businesses operating in cryptocurrencies to misuse consumer funds. The key takeaways are as follows:

Segregation of and Separate Accounting for Customer Virtual Currency

The guidance emphasizes the importance of segregation and separate accounting for customer virtual currency. This means that virtual currency custodians should maintain separate accounts for each customer and should not commingle customer virtual currency with their own funds. This is to ensure that customer funds are protected and can be easily accounted for in case of any issues.

The guidance also emphasizes the use of on-chain omnibus wallets. Omnibus accounts have stricter requirements because they involve the aggregation of multiple customers' virtual currencies in a single account. This can make it more difficult to track and account for individual customer funds, which is why the NYDFS has stricter requirements for omnibus accounts.

The stricter requirements for omnibus accounts include:

• Enhanced due diligence procedures, including KYC and AML
• Regular audits and annual reports to NYDFS
• Additional protections for segregation of funds and accounting
• Regular testing of systems and controls to ensure compliance with NYDFS regulations
  
  

VCE Custodian’s Limited Interest in and Use of Customer Virtual Currency

The guidance on custodial structures for customer protection in the event of insolvency is issued by the NYDFS to emphasize sound custody and disclosure practices to better protect customers in the event of an insolvency or similar proceeding. The guidance focuses on safeguarding customers' assets and interests in virtual currencies, which have grown substantially in recent years, and the demand for virtual currency custody services across both retail and institutional customer segments.

The guidance highlights the importance of:

1. Segregation of and separate accounting for customer virtual currency, which means that virtual currency custodians should maintain separate accounts for each customer and should not commingle customer virtual currency with their own funds.
2. VCE Custodian's limited interest in and use of customer virtual currency, which means that VCEs that act as custodians should not make use of customers' virtual currency for their own gain.
3. Sub-custody arrangements, which means that VCEs should clearly disclose the manner in which they handle sub-custody arrangements and their role in them.
4. Customer disclosure, which means that VCEs should clearly and prominently disclose the manner in which they segregate and account for customer virtual currency.
   
   

The guidance also specifies that VCE Custodians should maintain appropriate records and maintain a clear internal audit trail to identify customers' virtual currency if they choose to hold customer virtual currency in an omnibus account. VCE Custodian’s limited interest in and use of customer virtual currency implies that VCEs that act as custodians should not make use of customers' virtual currency for their own gain. They should not use it for their own benefit but it should be held in the trust of the customer.

The guidance is intended to offer greater clarity regarding standards and practices that, in the Department's view, will help to ensure that VCE Custodians are providing a high level of customer protection with respect to asset custody under the BitLicense and limited purpose trust company frameworks. 

The VCEs limited interest also points to a critical debtor-creditor relationship. As seen previously in the FTX case, SBF was able to leverage the funds of customers for his personal use and it didn’t even trigger the radar of investigation agencies as well as company employees and auditors. It is estimated that Sam Bankman-Fried used nearly a billion dollars from user funds without their consent or knowledge.

Sub-Custody Arrangements:

Sub-custody arrangements refer to situations where a VCE Custodian relies on another entity, known as a sub-custodian, to hold and custody of the virtual currencies of their customers. This can happen for various reasons such as cost efficiency, geographic location, and expertise.

In the state of New York, the regulation that allows for sub-custody arrangements is the 23 NYCRR Part 200, also known as the BitLicense regulation. This regulation is issued by the NYDFS and provides a comprehensive framework for virtual currency businesses operating in the state of New York. It requires VCEs that act as custodians to comply with certain requirements, including proper segregation of customer assets and maintaining accurate records, when engaging in sub-custody arrangements.

An example of a sub-custody arrangement is in digital assets, which refers to a third-party digital asset custody service that helps client firms, such as banks, exchanges, and other financial institutions, to provide digital asset services to their customers. The sub-custodian interfaces with the client firm, which in turn interfaces with its customers. The main advantage of digital asset sub-custody is that it allows institutions to provide customers with secure and integrated access to the digital asset market without having to build the underlying infrastructure from scratch. Additionally, it allows client firms to bring a digital asset offering to market quickly without distracting from their core business. 

Customer Disclosure

The NYDFS has established regulations for consumer protection when it comes to virtual currency transactions. These regulations include disclosure of material risks associated with virtual currency, such as the fact that it is not legal tender and not backed by the government, as well as the potential for irreversible transactions and cyber attacks. 

It also requires that licensees disclose general terms and conditions related to virtual currency accounts, such as a customer's liability for unauthorized transactions and their rights to receive account statements and valuations. 

Additionally, prior to each virtual currency transaction, licensees must furnish customers with a written disclosure containing the terms and conditions of the transaction. These regulations aim to ensure that customers are fully informed of the potential risks and responsibilities associated with virtual currency transactions.

This can be directly associated with the FTX fallout as the trading exchange was in direct violation of the guidelines. Not only did the organization misuse funds but it also obscured the nature of transactions from the customers. Additional violations include poor corporate governance, weak internal financial controls, misappropriation of customer funds, and the comingling of funds between Alameda and FTX.

Conclusion

The NYDFS is taking a strong stance on consumer protection by releasing new guidance on the segregation of customers' crypto assets from those of the companies. This move comes in response to the alleged commingling of funds at collapsed crypto exchange FTX and its affiliated trading firm Alameda Research, which resulted in significant losses for clients. The NYDFS is also mandating that state-regulated companies disclose to customers how they account for their digital currency. This new guidance highlights the importance of transparency and proper management of customer assets in the crypto industry and serves as a reminder for companies to prioritize consumer protection in their operations.

The latest guidance is a reiteration of the existing framework, but now more than ever consumer protection has taken the spotlight amidst leading crypto companies filing for bankruptcy including FTX, BlockFi, Voyager Digital, and Genesis.