New York BitLicense: Virtual Currency Business Licensing and Compliance Guide | RGYS · mtl8.com
For businesses planning virtual-currency activity in or involving New York residents, this guide explains the boundaries among a BitLicense, a New York limited-purpose trust charter, New York money-transmitter licensing, and FinCEN MSB registration. It covers application preparation, governance, capital, customer protection, AML, cybersecurity, custody, reporting, and M&A or exit planning. It is grounded in NYDFS and regulatory materials and does not treat state licenses as a nationwide license or promise an approval outcome or timeline.
What a BitLicense Is: New York Virtual-Currency Activity Authorization
A BitLicense is New York State authorization for virtual-currency business activity under the Financial Services Law framework, principally 23 NYCRR Part 200. A person or entity conducting covered activity involving New York or New York residents generally must obtain authorization before beginning. A New York bank or limited-purpose trust company approved under the Banking Law may use the charter pathway instead of obtaining a BitLicense.[1][3]
A BitLicense is neither a federal license nor a nationwide digital-asset authorization. It does not automatically authorize regulated money transmission in other states, nor replace federal FinCEN BSA/MSB duties, New York fiat money-transmitter licensing, or other required approvals.[1][15]
Licensing Triggers: Five Activity Types and New York Nexus
The regulation identifies five activity types involving New York or a New York resident: receiving virtual currency for transmission or transmitting it for others; storing, holding, or maintaining custody or control for others; buying and selling as a customer business; providing exchange services as a customer business; and controlling, administering, or issuing virtual currency. Substance and control matter more than product labels or the absence of a New York office.[1][2][3]
The regulation and NYDFS FAQ describe boundary cases: personal investment, a consumer's or merchant's use solely to buy or sell goods or services, purely technical software development itself, mining itself, and merely accepting donations generally do not independently constitute a covered activity. Later custody, transmission for customers, commercial sales, or wallet operations require separate analysis. The transmission exception is limited, including by non-financial purpose and nominal-amount conditions; it is not a blanket exemption for all non-custodial or on-chain services.[1][2]
State-by-State Variation and Nationwide Expansion Boundaries
U.S. nonbank financial regulation operates at both federal and state levels. New York's BitLicense does not extend to other states. Before interstate expansion, assess each state's money-transmission laws, virtual-currency rules, exemptions, and supervisory interpretations. The same product may be classified differently or carry different filing, capital, and security requirements across states; New York authorization does not establish compliance elsewhere.[1][15]
NMLS can serve as a filing and license-management system for participating states and may allow reuse of portions of company and individual records, but it does not combine state licenses into a nationwide license. A New York application still requires New York-specific materials under the NY Virtual Currency Business Activity License Checklist, and each other state must be checked separately.[1]
FinCEN MSB Registration and State Licenses: Parallel, Not Interchangeable
FinCEN's virtual-currency interpretive guidance states that a user who obtains convertible virtual currency to purchase goods or services is generally not an MSB. A business administrator or exchanger that accepts and transmits convertible virtual currency, or buys or sells it, may be a money transmitter/MSB under the federal BSA unless a limitation or exemption applies. Analyze the person's role, acceptance and transmission of value, and the applicable statutory limitations.[15]
Federal MSB registration and New York BitLicense or MTL requirements are separate questions. FinCEN registration does not determine or replace state licensing, and state authorization does not automatically complete federal registration or AML duties. Document separate federal and state applicability conclusions and filing calendars.[1][15]
Applicant Entity, Corporate Structure, and NMLS Setup
The application should be filed by the legal entity that will actually conduct the proposed virtual-currency business, and should align with customer contracts, bank accounts, wallets, personnel, vendors, and financial statements. The regulation requires the exact legal name, organizational form, jurisdiction of formation, affiliate list, and relationship chart. The ownership structure, shared services, brands, and asset ownership should be clear and verifiable.[4]
NYDFS uses NMLS to manage BitLicenses. Establish the company record and complete the New York new-application checklist, including MU1, relevant MU2 filings, and jurisdiction-specific information. A company with an NMLS record for other states still must provide New York-specific information. NMLS is the filing and license-management platform, not the regulatory approval itself.[1][4]
Review of Controllers, Principal Owners, and Key Persons
Part 200 requires detailed background information for the applicant and, as applicable, its directors, principal officers, principal stockholders, and principal beneficiaries, along with personal-history and qualification information, acceptable independent background reports, and applicable fingerprint and authorization materials. Fingerprints may also be required for employees with access to customer funds. The filing must describe management levels, duties, and reporting lines.[4]
Transaction documents should identify direct and indirect controllers, voting rights, options, director-nomination rights, veto rights, and acting-in-concert arrangements. New York's rule provides a control presumption where a person directly or indirectly owns, controls, or holds power to vote 10% or more of voting stock of the licensee or a relevant upstream entity; the overall control analysis also considers actual ability to influence management and policies.[8]
Governance, Compliance Leadership, and Control Functions
The application must show management structure, principal officers, authority lines, and allocation of duties. A licensee should be able to demonstrate effective board or equivalent oversight of risk, approval of the written AML policy, and appropriate personnel, authority, and resources for compliance and cybersecurity. Proposed officers should match the organization chart and actual operating model.[4][9][11]
Part 200 requires qualified individual(s) responsible for day-to-day AML operations and a designated CISO to oversee the cybersecurity program. Staffing should reflect the business's scale and risk, with clear escalation and independent review among compliance, AML, cybersecurity, finance, operations, and audit. The presence of a single outside consultant does not automatically satisfy regulatory duties.[9][10]
Capital Requirements, Permitted Assets, and Financial Planning
Part 200 does not establish one fixed minimum capital figure for every BitLicense applicant. NYDFS determines the ongoing amount and form based on the risks of each licensee and may consider asset composition and volatility, liabilities, activity volume, liquidity, leverage, customer-protection arrangements, customer types, and products.[5]
Required capital must be held in cash, virtual currency, or high-quality, highly liquid, investment-grade assets in proportions acceptable to NYDFS. Applicants should document funding sources, opening capital, operating cash burn, stress scenarios, projected balance sheets, and loss-absorption capacity. Capital is distinct from the customer-protection bond or trust account under §200.9.[5][6]
Security, Customer-Asset Custody, and Insolvency Protection
A licensee must maintain a U.S.-dollar surety bond or trust account for the benefit of customers, in a form and amount acceptable to NYDFS; a trust account must be held with a qualified custodian. NYDFS's FAQ says the general minimum is $500,000, but the amount can increase based on the business model. This protection is distinct from capital and is not a universal ceiling or a determination that the amount will be sufficient in every case.[1][6]
When holding customer virtual currency, the licensee must hold the same type and amount it owes and may not sell, lend, pledge, encumber, or use customer assets for its own purposes. NYDFS's current 2025 guidance emphasizes segregation and separate accounting both on-chain and on internal ledgers, customer-only omnibus records where used, reconciliation, preservation of beneficial customer interests, written disclosures, and prior approval for new third-party subcustody arrangements.[6][17]
Business Plan, Product Design, and Risk Framework
The application must describe current, historical, and proposed business; products and services; websites; jurisdictions; primary markets; projected customer base; marketing targets; New York operations; and banking arrangements. Map customer journeys, transaction and asset flows, whether the company receives customer funds, key control, custody, and third-party services to the relevant license activities and controls.[4]
The business plan should also include supportable revenue and expense projections, sources of capital, material risks and controls, customer disclosures, complaint handling, continuity arrangements, and an exit plan. NYDFS may request additional information if the proposal is incomplete; later product additions or material changes to risk or customer scope may require prior approval.[4][7]
BSA/AML, Customer Identification, and Transaction Monitoring
Part 200 requires an initial risk assessment covering legal, compliance, financial, reputational, customer, counterparty, service, and geographic risks, followed by a written AML program approved by the board or equivalent governing body. Reassess at least annually and when risks change. The program must include internal controls, qualified day-to-day responsible personnel, ongoing training, and independent testing at least annually, with a written report submitted to NYDFS as required.[10]
The program must also implement customer identification and verification, recordkeeping, OFAC screening, risk-based enhanced due diligence, transaction monitoring, applicable federal SAR and record-reporting duties, controls for restricted or impermissible transactions, and anti-evasion rules. The regulation contains specific virtual-currency thresholds and deadlines; apply them together with federal reporting rules and the particular transaction rather than presenting one threshold as universal to every product.[10][15]
Cybersecurity, Third Parties, and Business Continuity
Part 200 requires an effective cybersecurity program and written policy reviewed by the governing body, covering identification, protection, detection, response, and recovery. It requires a designated CISO, at least annual reporting by the CISO to the governing body on system availability, integrity, risks, and remediation, annual penetration testing, and at least quarterly vulnerability assessments, among other controls.[11]
NYDFS's Cybersecurity Resource Center describes Part 500 as the regulator's cybersecurity rule for covered financial-services entities, with applicability and tiered requirements determined under that regulation. Applicants should assess how Part 200 and Part 500 apply and address access control, data protection, secure development, vendor risk, incident response, recovery, and regulatory notices. A policy document without evidence of operation is not a complete control environment.[11][12]
Core Application Materials and Evidence Management
The required application materials include entity and affiliate information, ownership and management structure, key-person backgrounds and independent investigations, personal financial information, applicant financial statements and next-year projections, business description, banking arrangements, written policies, litigation and regulatory matters, New York tax-compliance verification, applicable insurance materials, and the virtual-currency valuation methodology. NYDFS may request information beyond the checklist.[4]
Organize evidence into governance and personnel, products and systems, capital and finance, banking and payments, customer assets, AML and sanctions, cybersecurity, consumer disclosures, outsourcing, incident response, and reporting. Assign an owner, version, date, source of facts, and application cross-reference to each document. Avoid inconsistent statements about volumes, customers, controllers, or asset flows.[1][4]
Filing, Completeness Review, Supplemental Requests, and Regulator Engagement
File the BitLicense application through NMLS using the NY Virtual Currency Business Activity License New Application Checklist. NYDFS says substantive review begins only after all required information, documents, and fees are received and the materials appear adequate in organization, clarity, detail, and tailoring to the business. Missing items are identified as a major cause of delay, and an insufficient application may be denied for insufficiency.[1]
During review, NYDFS may request explanations and supporting documents beyond the checklist. Control versions of each RFI response, answer every request, and cross-check exhibits. A pre-application meeting may be recommended where NYDFS staff consider it useful; it is not an automatic step or approval promise. Assess any business, ownership, or technology change for a filing update or prior approval requirement.[1][7]
Application Fees, Ongoing Assessments, and Review Timing
NYDFS's current fee schedule lists a $5,000 BitLicense application fee.[13] After licensing, entities are also assessed for regulatory supervision and examination. New York's fiscal year runs April 1 through March 31; NYDFS allocates assessments using operating costs, supervisory hours, custody, and transaction volume, with estimated quarterly billing and a later true-up. There is no single annual charge that applies to every licensee.[14]
NYDFS does not promise one standard review period for an initial BitLicense application; its application page says completion times vary and missing materials cause delays. The 120-day period in Part 200 applies only to complete change-of-control or merger/acquisition applications and may be extended for good cause; it must not be represented as the initial-license timeline.[1][8]
Banking Partners, Fiat Rails, and Treasury Operations
Part 200 requires disclosure of banking arrangements. NYDFS will assess how fiat enters and exits, who holds the accounts, whether customer funds are separated from corporate funds, settlement and reconciliation controls, and alternatives if a bank or payment partner is disrupted. Opening and maintaining a bank account remains subject to the bank's own risk appetite and due diligence; a BitLicense does not guarantee banking access.[4]
If the product includes U.S.-dollar receipt, payment, or transfer, separately assess New York and other state money-transmission licensing. Payment-processing outsourcing, customer funds passing through company accounts, third-party disbursement, or settlement can affect the regulatory analysis. Federal MSB status, state licenses, bank due diligence, and NYDFS approval of a particular product are distinct.[1][15]
Ongoing Supervision, Reporting, Records, and Examinations
Part 200 generally requires quarterly financial statements within 45 days after each fiscal quarter and audited annual statements with an independent accountant's opinion or attestation concerning internal controls. Licensees must also promptly report specified criminal or insolvency proceedings and violations, and provide special reports requested by NYDFS. Use current forms and supervisory instructions.[9]
Licensees must maintain complete books, transaction and customer records, internal controls, and audit trails, and remain subject to NYDFS examinations and supervision. Maintain an annual compliance calendar covering capital and security, customer-asset reconciliation, complaints, independent AML testing, Part 500 controls, vendor reviews, and remediation; assess new business and changes against prior-approval requirements.[6][9][10][11]
New Coins, Product Expansion, and Material-Change Approval
Before introducing a new product, service, or activity, or materially changing an existing one, a licensee must obtain NYDFS prior written approval. Materiality may arise from legal or regulatory questions, safety-and-soundness or operational risks, or a change that makes the activity materially different from the one described in the application. Submit a written plan describing operations, compliance policies, business-wide impact, and other requested information.[7]
Coin listing has specific regulatory paths: obtain approval for a particular coin, use a coin on the NYDFS Greenlist, or first obtain written approval of both listing and delisting policies and then self-certify under those policies. A licensee may not self-certify before written policy approval. NYDFS may still limit activity or require delisting, including for a Greenlisted or self-certified coin.[1][16]
Sale, Equity Acquisition, Change of Control, and Asset Transactions
Do not close first and seek approval later: any action that may result in a change of control of a licensee requires prior written NYDFS approval. The rule presumes control where a person directly or indirectly owns, controls, or holds 10% or more of relevant voting stock. Before the transaction, the proposed acquirer must apply and provide information about itself and, as applicable, its directors, principal officers, principal stockholders, and beneficiaries. The regulatory decision period is 120 days from a complete application and may be extended for good cause.[8]
A merger or acquisition of all or a substantial part of a licensee's assets also requires prior written approval and a plan identifying the parties, surviving or acquiring entity, terms, and implementation. A share sale, purchase of a licensed company, business line, or customer assets does not automatically transfer the BitLicense. Counsel should analyze minority holdings, asset scope, and control rights and make regulatory approval, escrow closing, and customer-transition arrangements express transaction conditions.[8]
Business Sale, Cessation, and Orderly Exit
Before a sale, distinguish a change-of-control transaction, merger, sale of all or a substantial part of assets, contract migration, and simple service termination; different structures may trigger §200.11, §200.10, or other regulatory notices and approvals. Do not assume that a license or approval scope carries over merely because the buyer is licensed, the firms share a group, or the brand remains the same.[7][8]
When ending New York business, develop with counsel and NYDFS an orderly sequence for returning or migrating customer assets, resolving open transactions and complaints, preserving records, ending vendor and bank relationships, handling personnel, and surrendering authorization. Do not close the entity or wallets while customer assets, regulatory orders, or continuing duties remain unresolved; the exit plan must protect customers and satisfy applicable conditions.[1][6][9]
Multistate Digital-Asset Boundaries and License-Stack Controls
Digital-asset activity can implicate virtual-currency custody or trading authorization, fiat money-transmission licensing, federal MSB registration, and banking, securities, commodities, or consumer-protection laws. Similar labels do not mean identical permission: a traditional state MTL and a BitLicense may overlap in a particular funds flow but are not substitutes. NYDFS specifically states that a BitLicense applicant must separately apply for a New York money-transmission license where required.[1][15]
For interstate expansion, maintain a living assessment of state rules, customer location, transmission recipients, wallet control, token functionality, and product versions. State approaches to virtual currency, money transmission, exemptions, and approvals vary. Use geofencing, transaction blocks, state-by-state applications, and legal sign-off before launch where needed. Do not market an MSB registration, BitLicense, or MTL as a nationwide digital-asset passport.[1][15]