New York Set a 90-Day Path for Banks’ Crypto Plans

The New York State Department of Financial Services issued final guidance on December 15, 2022 that turned its prior-approval expectation for banks’ virtual-currency activities into a detailed supervisory process. Covered institutions were told to inform the department at least 90 days before they intended to begin a new or significantly different activity and to supply enough information for a safety-and-soundness review.

The guidance applied to New York-regulated banking organizations and to branches and agencies of foreign banking organizations licensed by the department. It took effect on December 15. Institutions already conducting a virtual-currency-related activity without having notified DFS were instructed to contact their departmental representative promptly.

The action mattered because it gave banks a concrete route for presenting crypto proposals while making clear that entry into the sector remained conditional and activity-specific. It was not an authorization for any particular bank or product, and it did not establish that a proposed activity was legally permissible.

A broad definition of crypto activity

DFS’s scope extended beyond buying and selling tokens. The industry letter listed wallet services, lending secured by virtual currency, facilitating customers’ exchange or trading activity, stablecoin-related services and traditional banking conducted through technology that created different risks. Its example of the last category was underwriting a loan, debt instrument or equity offering partly or entirely on a public blockchain.

Using a third party did not necessarily move an activity outside supervision. If a contractor helped perform a new or significantly different virtual-currency service, the bank was expected to consult DFS in advance. Approval for one activity would not provide general consent for other crypto services, nor would one institution’s approval authorize another institution to copy it.

The 90-day period was a minimum advance-notice point, not a promised decision deadline. After notification, DFS said it would determine whether approval was required, identify the necessary materials and establish an expected review timeline. The guidance therefore created a starting line for review rather than a guaranteed 90-day approval.

What banks had to show

The department organized its review around six categories: business plan; risk management; corporate governance and oversight; consumer protection; financials; and legal and regulatory analysis. The accompanying checklist asked for operating models, technology architecture, flows of fiat and virtual currency, third-party dependencies, customer agreements, disclosures and marketing materials.

Risk submissions were expected to address operational, credit, market, capital, liquidity, cybersecurity, fraud, technology, third-party, legal, compliance, reputational and strategic risks. Governance materials were to explain board or senior-management approval, oversight responsibilities, risk limits and escalation processes. Financial submissions were to describe expected effects on capital and liquidity.

That level of detail placed crypto proposals inside ordinary prudential disciplines while recognizing risks particular to wallets, blockchains and token markets. The guidance also focused on who controlled funds at each stage, how records would be reconciled and how customers could seek redress. In institutional terms, the message was that a bank could not treat a crypto partnership as a simple vendor add-on.

What the guidance did not decide

DFS expressly said the document did not interpret existing law, declare which activities were legally permissible or limit other laws and regulations. The final guidance could also be supplemented as markets and supervisory experience evolved.

Contemporaneous Reuters and Axios reports described the measure as a clearer route for banks seeking to offer crypto services, but neither report identified a bank receiving approval on December 15. No Bitcoin, Ether, bank-share, trading-volume or deposit-flow reaction is attributed here: the cited records provide no instrument-specific measurement window capable of isolating the guidance’s market effect. The verified event was the adoption of a supervisory framework, not evidence of immediate bank adoption or customer demand.