New York imposed a $30 million penalty on Robinhood Crypto

New York’s Department of Financial Services announced on August 2, 2022 that Robinhood Crypto, LLC had agreed to pay a $30 million civil penalty for compliance failures spanning anti-money-laundering controls, transaction monitoring, cybersecurity and consumer protection. The settlement also required the company to retain an independent consultant to evaluate its compliance programs and remediation.

The announcement converted a previously disclosed settlement in principle into a final regulatory action. It mattered beyond the size of the penalty: Robinhood Crypto was licensed by New York as both a virtual-currency business and a money transmitter, placing it inside one of the United States’ most developed state supervisory regimes for digital-asset companies.

What the regulator found

The consent order says DFS conducted a safety-and-soundness examination in 2020 covering January 24 through September 30, 2019. A subsequent enforcement investigation found violations of New York’s virtual-currency, money-transmitter, transaction-monitoring and cybersecurity regulations. Robinhood Crypto agreed to resolve the matter without further proceedings.

According to DFS, the company lacked sufficient personnel with appropriate skills for its Bank Secrecy Act and anti-money-laundering program. Robinhood Crypto relied on personnel and systems at affiliated companies, but the regulator found that those arrangements did not adequately address the risks of the licensed crypto business. DFS also said the company continued relying on manual transaction monitoring during 2019 and 2020 while enterprise alert volume increased by more than 500%.

The order records 4,378 unprocessed alerts as of October 26, 2020. It also says Robinhood Crypto used a $250,000 cumulative six-month threshold for its two crypto-specific monitoring rules during the examination period. DFS found that threshold unacceptably high for the transaction volume involved and reported that only two suspicious-activity reports resulted from crypto-specific monitoring alerts during that examination window. These are regulator findings for specified historical periods, not measurements of Robinhood Crypto’s systems on August 2, 2022.

Certifications and consumer protection

DFS found that Robinhood Crypto improperly certified compliance for calendar year 2019 even though its transaction-monitoring and cybersecurity programs did not satisfy the applicable regulations. The order also identified inadequate cybersecurity staffing, incomplete risk assessment and incident-response procedures, and insufficient board-level oversight.

A separate consumer-protection violation concerned the absence of a distinct, dedicated telephone number on the company’s website for customer complaints. DFS further found that Robinhood Crypto had not promptly disclosed certain regulatory investigations involving affiliates, contrary to its supervisory agreement.

The settlement required payment of $30 million within ten days of its August 1, 2022 effective date. The company could not claim a tax deduction for the penalty or obtain reimbursement through insurance. It also had thirty days to enter a new engagement with the independent consultant, which would report to DFS and review compliance with four sets of New York regulations.

Why the action mattered

The order demonstrated that obtaining a state virtual-currency license was not the end of regulatory scrutiny. Staffing, transaction-monitoring design, cybersecurity governance, complaint handling and certifications could all become enforceable obligations as a platform expanded. That institutional lesson was especially important for consumer-facing crypto companies whose rapid growth had outpaced their compliance infrastructure.

In a contemporaneous response reported by Reuters, Robinhood said the settlement in principle had been disclosed previously and was now final. The company also said it had made significant progress in its legal, compliance and cybersecurity programs. Those were company claims on August 2, 2022; the independent consultant’s future work was intended to assess remediation.

Later-record note

A Robinhood quarterly report accepted by the SEC on August 3, 2022 confirmed that the company and DFS had reached a settlement providing for the $30 million penalty and an independent compliance consultant. That filing corroborates the event-day record but does not establish the consultant’s eventual conclusions or the long-term effectiveness of remediation.