Crypto Law Profile
New York DFS rule requiring a license or approved banking-law charter for covered virtual currency business activity involving New York or New York residents, with compliance, capital, custody, AML, cybersecurity, reporting, and consumer-disclosure obligations.
BitLicense is the common name for 23 NYCRR Part 200, New York’s virtual currency business regulation administered by the New York State Department of Financial Services (DFS). As of June 3, 2026, Part 200 remains in force. The New York State Register notice identifies the rule as the “Regulation of the Conduct of Virtual Currency Businesses,” filed on June 10, 2015 and effective June 24, 2015.
DFS describes the rule as a virtual currency regulation issued under the New York Financial Services Law. Covered businesses generally apply either for a BitLicense or for a New York Banking Law charter that has been approved to conduct virtual currency business activity. The framework is therefore both a licensing regime and an ongoing supervisory framework for covered activity connected to New York.
Part 200 is organized around “virtual currency business activity” involving New York or a New York resident. The covered categories include receiving or transmitting virtual currency, holding custody or control for others, buying and selling virtual currency as a customer business, performing exchange services as a customer business, and controlling, administering, or issuing a virtual currency.
Section 200.3 provides that no person may engage in covered virtual currency business activity without a license unless an exemption or approved charter pathway applies. The regulation also gives DFS application, examination, suspension, revocation, and supervisory powers over licensees.
Part 200 requires licensees to maintain capital in a form and amount determined by DFS, maintain customer-protection arrangements such as a bond or trust account, and hold the same type and amount of virtual currency owed to customers when acting as custodian. It also requires written compliance policies, a designated compliance officer, anti-money-laundering controls, customer identification, suspicious-activity monitoring, cybersecurity policies, a chief information security officer, testing, and recordkeeping.
The rule requires business and transaction records, quarterly financial statements, audited annual financial statements, and DFS access for examinations. It also contains consumer-protection provisions, including risk disclosures addressing matters such as legal tender status, government backing, FDIC or SIPC coverage, transaction irreversibility, price volatility, fraud risk, cyber risk, fees, receipts, complaint handling, and anti-fraud policies.
The BitLicense is most relevant to exchanges, custodians, hosted-wallet businesses, payment or transmission intermediaries, and issuers or administrators that fall within the rule’s definition of virtual currency business activity. It is not framed as a general license for consumers, miners, or software developers. Its practical reach comes from the rule’s connection to New York or New York residents, making it a state-level regime with implications for national and international crypto firms serving New York users.
The State Register notice described a transitional period requiring persons already engaged in covered virtual currency business activity to apply within 45 days after the rule’s effective date. Since adoption, DFS has supplemented Part 200 with supervisory guidance. For example, DFS issued updated coin-listing guidance on November 15, 2023 for virtual currency business entities licensed under Part 200 or chartered as limited purpose trust companies, with the guidance taking effect immediately and superseding prior guidance.
This profile is for legal-reference and editorial research purposes only. It does not provide legal, tax, investment, trading, or compliance advice.
Persons may not engage in virtual currency business activity involving New York or a New York resident without a DFS license, unless an exemption or approved banking-law charter applies.
VCBA includes transmission, custody or control, customer buying and selling, exchange services, and controlling, administering, or issuing a virtual currency.
Licensees must maintain DFS-approved capital, customer-protection arrangements, and one-to-one virtual currency holdings for custodial obligations.
Part 200 requires written compliance policies, AML controls, customer identification, suspicious-activity monitoring, cybersecurity policies, a CISO, and periodic testing.
Licensees must keep business and transaction records, submit financial reports, and permit DFS examinations and special investigations.
Licensees must provide material risk, transaction, fee, receipt, complaint, and anti-fraud disclosures to customers as applicable under the rule.
DFS previously published a revised proposed rulemaking for Part 200 in the New York State Register.
DFS filed Notice of Adoption DFS-29-14-00015-A for the addition of Part 200 to Title 23 NYCRR.
The BitLicense regulation took effect as Part 200 of Title 23 NYCRR.
DFS requested comments on a conditional licensing framework for new entrants working with authorized VC entities.
DFS issued immediate-effect coin-listing and delisting guidance for licensed or chartered VC entities.
Consumers, Custodians, Exchanges, Token issuers, Wallet providers
Virtual currency
Regulatory adoption rather than statute enactment. The enacted-date field is left blank; the timeline records the June 10, 2015 Notice of Adoption filing and June 24, 2015 effective date.
