New York's virtual-currency regime, 23 NYCRR Part 200 — the BitLicense, and the limited-purpose trust charter alternative the Department of Financial Services prefers for larger operations — has regulated virtual-currency business activity in the state since 2015, and its November 2023 amendments made governance concrete: licensees must adopt coin-listing and delisting policies tailored to their business, submit them to the Department, and certify them on the Department's cycle, while the Department's 2023 custody guidance set expectations for how client assets are segregated and controlled. A decade in, New York remains the state where crypto compliance is a standing program rather than an onboarding event.
3G Times publishes information, not legal advice. Licensing strategy under New York banking law belongs with counsel and, frankly, with the Department itself, whose application dialogue shapes outcomes.
What activity requires the license?
Part 200 reaches virtual-currency business activity involving New York or New Yorkers: receiving, transmitting, storing, and exchanging virtual currency; controlling, administering, or issuing it; and performing exchange services as a customer business — with exclusions for miners, software developers who do not control customer funds, and merchants accepting crypto as payment. The definitional work is factual: "controlling" on behalf of another is custody regardless of the marketing vocabulary, and multi-signature or MPC arrangements where the licensee holds key shares are custody to the extent the arrangement confers control. The perimeter question fintechs most often mis-grade is their own: a wallet feature in a broader app is still virtual-currency business activity in New York when New Yorkers can use it.
What did the 2023 listing amendments change?
The earlier regime treated coin listings through individually approved lists and guidance letters; the amendments converted listing into a governance duty. Each licensee drafts a listing and delisting policy proportionate to its business — covering the coin's characteristics, technology, market, and risk factors — adopts it through corporate governance, files it with the Department, and certifies adherence on a recurring cycle. The structural effect is supervisory leverage: DFS can compare the policy against the practice, and the certification makes divergence a misstatement rather than a mere finding. For compliance teams, the listing file became a living document — due diligence per coin, board minutes, the certification calendar — and delisting discipline (the plan for winding down a coin holders use) became as material as the decision to add one.
| Program element | Part 200 expectation | Where programs fall short |
|---|---|---|
| Coin-listing policy | Tailored, adopted, filed, certified | Template policies copied across entities |
| Listing due diligence | Technology, market, legal risk analysis per coin | Whitepaper summaries without legal analysis |
| Delisting plan | Holder impact, timeline, communications | No plan until the crisis forces one |
| Custody controls | Segregation, key governance, books and records | Key ceremony documented once, never re-run |
| Certification cycle | Recurring attestations to DFS | Calendar owned by no one |
Insurance rounds out the custody story: coverage for warm and cold inventories, key ceremonies, and third-party sub-custody failures is underwritten against the same control documentation the Department reads — the insurance file and the examination file are, in mature programs, the same file with different cover letters.
What does the custody guidance expect?
The Department's 2023 custody guidance spoke to the structures licensees use to hold client virtual currency: clear segregation of client assets from proprietary assets, sub-custody arrangements disclosed and governed, and — the load-bearing theme — control analysis that survives the marketing. Cold storage, multi-signature schemes, and qualified custodian arrangements all answer the same questions differently: who can move the asset unilaterally, what happens in the custodian's insolvency, and what the client contract actually promises. The guidance's supervisory posture is that custody is a banking activity wearing new assets, and licensees whose answers would not survive a trust-examination read receive one.
Trust charter or BitLicense — how do serious operators choose?
The two doors lead to the same supervisor with different depth. The BitLicense is faster and lighter: a license under Part 200 with capital, compliance, and reporting obligations, suited to narrower business lines. The limited-purpose trust charter is heavier — full fiduciary framing, capital and governance at banking grade — and it is what large custody and exchange operations have chosen, in New York and elsewhere, because counterparties and bank partners read fiduciary custody as the credible form. The choice is also a statement about duration: licensees operating national programs on a state license eventually confront the federal banking agencies' expectations on their bank partners, and the charter answers questions the license leaves open.
What does this mean in practice?
- Run listing governance like a product launch. The policy, the diligence file, and the board record should be contemporaneous with the listing, not reconstructed at certification time.
- Re-run custody control analysis annually. Key ceremonies, sub-custodian chains, and insurance terms drift; the certification cycle is the natural audit point.
- Map New York exposure deliberately. IP geofencing is imperfect; the honest perimeter decision — serve New York under license or exclude it — belongs in writing with its rationale.
- Treat DFS dialogue as part of the compliance program. The Department's supervisory engagement is unusually direct; the contact log is an asset in every subsequent application and exam.
The BitLicense's tenth year finds it neither the bottleneck its critics predicted nor the afterthought its alternatives promised. It is a state banking regime that happened to be first, and its daily currency — listing policies, custody control, certification calendars — is what "regulating crypto like finance" looks like on a Tuesday.
The compliance staffing math explains the charter-versus-license tension in practice: certification cycles, custody re-reviews, and Department dialogue consume a standing team that smaller licensees often underestimate at application stage. The honest budget question before filing is not the application cost but the permanent program the license purchases — and the firms that answer it honestly are the ones whose renewals read as routine.
How does the federal picture change the New York calculus?
Directionally, toward more New York-shaped programs: whatever the federal posture on digital assets in a given quarter, the custody-control and listing-governance disciplines the Department requires are the same disciplines national counterparties and bank partners demand. Firms building to Part 200 keep finding their file doubles as the institutional-grade diligence package everywhere else.
Frequently asked questions
Can a fintech serve New Yorkers on a federal or other-state license?
Not for virtual-currency business activity: Part 200 claims the activity for New York regardless of where the licensee sits, and money-transmitter licenses do not substitute. The choice is authorization under New York's regime or documented exclusion of New York customers.
Does the listing policy apply to coins already listed?
The amendments were written to cover the portfolio going forward, and certifying adherence implies the policy governs existing holdings too — which is why mature programs run a remediation pass on legacy listings against the new policy rather than grandfathering by silence.
Holder communications during delisting deserve legal review like any market-facing statement: the wind-down notice tells holders what they can still do, by when, and what happens to unclaimed assets — each sentence a promise the Department may later read against the certified policy.
What happens after a delisting decision?
The filed policy governs: holder notice, transition window, disposition of unclaimed assets. The examination question is whether the delisting followed the certified policy — divergence there converts a business decision into a supervisory finding.
For more context, read Event Contracts After Kalshi: How the CFTC's Predictive-Market Perimeter Was Redrawn.
For more context, read utah ai policy act sb 149.
For more context, read psd3 payments services directive proposal.