It’s official. New York published the final BitLicense in its state register, which launched a 45-day period for businesses to submit a completed application for a License to Engage in Virtual Currency Business Activity. As the August 8th deadline approaches, employees might find themselves scratching their heads at how to fill out key portions of the application.
While most of the application provides understandable instruction and guidance, the devil lies in the details. For instance, applicants must provide a set of fingerprints “for all individuals . . . who have access to any customer funds, whether denominated in fiat currency or virtual currency.” This seems simple enough until one considers the implementation of certain popular security measures. What if customers’ private keys are stored on a server that is physically accessible but not digitally accessible? Or, more metaphysically, does holding one of multiple private keys to a multi-sig account qualify as “access” to virtual currency?
The answers may not be so clear-cut, especially in the multi-sig context, which is bound to come up as more New York businesses incorporate the technology.
Some of the requirements remind businesses they will have to hire staff or incur certain expenses. For instance, applicants have to identify a compliance officer responsible for monitoring daily compliance. Applicants will also have to obtain a surety bond or trust account commensurate with the risks of the business. However, remember the regulation requires all trust accounts must be with a “Qualified Custodian.” Such a custodian includes banking entities in the State of New York “subject to the prior approval of the superintendent.” To date, no banking entities in New York have been approved by the superintendent specifically for the purposes of this regulation, although they may have approval to operate under New York Banking Law. It remains unclear if these entities must specifically be approved to hold trust accounts for virtual currency companies.
In any case, the digital currency industry has had a notoriously difficult time obtaining relationships with banks. Even if a bank were to be properly designated as a Qualified Custodian, there is no guarantee an applicant could successfully obtain a trust account from that bank. The end result is all applicants at this stage may have to obtain a surety bond.
Other requirements will test the limits of memory (or prognostication) for certain owners of the applying company. For example, the application requires all directors, the principal officer, principal stockholder, and principal beneficiary to recall 15 years of employment and residential history. It also requires 2 years of audited financials from entities that directly or indirectly own a 10% equity interest in the applicant. If these financials show exhibited losses, the owner must explain them and provide an expected date on which profitability will exist or return.
An investment company owning any amount in the applicant also has to provide audited financials, but the application instructions give a way out – an investment company can provide a statement explaining why the financials are unavailable.
While the application may come across as burdensome, applicants may take the exceptional level of detail in the instructions as a grace. For the most part, the level of detail is a guiding light to potential BitLicense applicants, many of whom may have never before filled out a regulatory license.