New York Attorney General Proposes Sweeping Legislation to Regulate Crypto and Digital Assets

On May 5, 2023, New York Attorney General Letitia James announced proposed legislation (available here) to regulate those engaging in a wide variety of digital asset businesses from or within New York. The Crypto Regulation, Protection, Transparency and Oversight (“CRPTO”) Act would impose sweeping new regulatory requirements and dramatically expand the Office of the Attorney General’s enforcement authority. The proposed legislation will be submitted by the Office of the Attorney General to the New York State Senate and Assembly for consideration during the 2023 legislative session.[1]

Proposed Scope

The proposed legislation defines a “digital asset” broadly as “any type of digital unit . . . that can be used as a medium of exchange, a form of digitally stored value, or a unit of account,” although it carves out exceptions for a few specific categories: digital units that are (a) “used solely within gaming platforms,” (b) redeemable “as part of a customer affinity or rewards program,” (c) “used solely as part of prepaid cards,” (d) “used solely in sports wagering and mobile sports wagering,” or (e) “provide an equity interest in a business.”[2]

The proposed legislation generally applies to the following industry participants operating “from or within New York state”: [3]

• “Digital asset brokers,” meaning a “person engaged in the business of effecting transactions in digital assets for the account of others whether the digital asset broker receives a benefit directly or indirectly.”[4]
• “Digital asset investment advisers,” meaning a person “who, for compensation, engages in the business of advising members of the public, either directly or through publications or writings, as to the value of digital assets or as to the advisability of investing in digital assets, including by recommending or curating a portfolio of digital assets accessible by another or by taking discretion over the use of another’s digital asset for any investment purpose.”[5]
• “Digital asset issuers,” meaning a person that “creates or issues” a digital asset, available to the public, that is “not for consumption by the offeree or purchaser.”[6]
• “Digital asset marketplaces,” meaning a person that “provides, substantively participates in, or any system that provides, a marketplace or facilities for bringing together purchasers and sellers of digital assets.”[7]

The proposed legislation would take effect thirty days after enactment.[8]

Prohibition on Engaging in Multiple Types of Digital Asset Businesses

The CRPTO Act would make it illegal for “any person or affiliate” to act as more than one of: (a) a digital asset broker; (b) a digital asset investment adviser; (c) a digital asset issuer; or (d) a digital asset marketplace.[9] The proposed legislation does not specifically limit the scope of “affiliates” covered by the regulation, but the New York Business Corporation Law defines “affiliate as “a person that directly, or indirectly through one or more intermediaries, controls, or is controlled by, or is under common control with, a specified person.”[10]

The proposed legislation only provides for one limited exception to the segregation requirements: banks not “engaged primarily” as a digital asset broker, issuer, or investment advisor. But even those banks would still not be permitted to act as both a digital asset market and a broker, issuer, or adviser; nor would they be permitted to effect transactions in any digital asset they issued.[11]

There is no grandfathering or phase-in time period allowance for companies that currently engage in multiple types of these businesses.

Disclosure and Filing Requirements

The CRPTO Act would impose broad disclosure requirements. Digital asset issuers, brokers, marketplaces, and advisers would all be required to:

• file a registration statement and a yearly renewal statement with the New York Department of Law prior to engaging in business within or from New York;[12]
• publicly post independently audited annual and quarterly financial statements;[13] and
• post a “certificate of compliance” with the Act.[14]

The Act would also require:

• digital asset issuers to publish a prospectus prior to the issuance of any digital asset;[15]
• digital asset marketplaces to adopt and publish listing standards for digital assets, similar to the requirements for national securities exchanges in the securities markets;[16]
• digital asset brokers to disclose to customers “any fees to be received from any source whatsoever,”[17] and digital asset marketplaces to publicly disclose “any fees to be received from any source whatsoever.”[18]

Stablecoins

The CRPTO Act would prohibit digital asset brokers, investment advisers, issuers, and marketplaces from referring to digital assets as “stablecoins” unless they maintained a ratio between (a) “U.S. currency, Level 1 liquid assets,” as defined by Federal Reserve regulations, and (b) “the stated value of the stablecoin,” of at least 1.0.[19]

Custody

The CRPTO Act would impose custody requirements on digital asset brokers similar to the requirements imposed by the SEC on broker-dealers. Digital asset brokers would be required to “promptly obtain and . . . maintain the physical possession of all fully paid digital assets carried by the digital asset broker for the accounts of customers.”[20] Conversely, investment advisers would be prohibited from taking custody of any investor’s digital assets,[21] while marketplaces would only be permitted to take custody of a customer’s digital asset “for the purpose of effecting a specific transaction.”[22]

Conflicts of Interest

The proposal includes several provisions aimed at reducing conflicts of interest. For example, digital asset brokers would be prohibited from recommending or referring any person to an investment adviser or issuer where the broker “receives any potential or actual economic benefit, directly or indirectly.”[23] Every broker would also be prohibited from effecting “transactions for its own account."[24] And “digital asset influencers,” or persons who promote digital assets they own or receive compensation for their promotion, would be required to disclose any such ownership interest or compensation.[25]

Anti-Fraud and Manipulation

The CRPTO Act would impose anti-fraud prohibitions similar to those in certain federal and state securities laws, making it illegal to make or omit untrue statements of material fact in connection with the offer or sale of any digital asset, as well as “wash trading, prearranged trading, market manipulation or insider trading.”[26] Brokers and marketplaces would also be required to establish and enforce written procedures and supervisory systems “reasonably designed to prevent” such unlawful activities.[27] The CRPTO Act’s prohibitions are arguably even broader than those in the federal and state securities laws since the Act would also prohibit “any promise or representation as to the future which is beyond reasonable expectation or unwarranted by existing circumstances.”[28] And, as noted, the Act purports to regulate a wide range of digital assets that are not securities.

Required Programs

The CRPTO Act would require every digital asset issuer, broker, marketplace, and adviser to implement and maintain an “effective cybersecurity program” satisfying the requirements of “applicable state and federal data privacy and cybersecurity laws and regulations.”[29] Similarly, it would require digital asset brokers and investment advisers to maintain an “anti-money laundering program in accordance with applicable state and federal laws and regulations.”[30]

Compliance with Other Laws

The CRPTO Act would also explicitly incorporate state and federal securities and commodities laws.[31] Requirements promulgated by the Department of Financial Services (“DFS”) would also remain applicable, and there is no exemption from the Act for companies that have received a BitLicense from and are currently regulated by DFS.[32] The Act would also expand the authority of the DFS to cover the broader categories of “digital asset” entities.[33]

Enforcement

Finally, the CRPTO Act would empower the Attorney-General to seek civil penalties that shall not exceed the greater of (1) $10,000 per violation by a natural person or $100,000 per violation for any other person or entity, or (2) “the gross amount of any pecuniary gain to such defendant or the loss sustained by any other person or entity as a result of the violation.”[34]

                                                                                                                     *       *       *

The proposed Act is sweeping in scope and, if enacted, would have significant implications for the entire space. If enacted in its current form, the Act would be the most comprehensive cryptocurrency and digital asset legislation in the United States. Among other things, the proposed legislation could impose duplicative but also conflicting requirements on businesses already regulated by the DFS, potentially hampering the development of the industry in New York. Additionally, the proposal’s scope is not clearly defined and appears to extend beyond cryptocurrencies to non-fungible tokens and other blockchain applications. Although the Act is not yet law, and could change substantially as it moves through the legislature, investors and companies involved in this space should carefully evaluate how they would be impacted.

                                                                                                                      *       *       *

[1] Press Release, Attorney General James Proposes Nation-Leading Regulations on Cryptocurrency Industry, Office of the New York State Attorney General (May 5, 2023), https://ag.ny.gov/press-release/2023/attorney-general-james-proposes-nation-leading-regulations-cryptocurrency#:~:text=In%20November%202022%2C%20Attorney%20General,market%20reached%20then%2Drecord%20lows.

[2] § 359-n(4).

[3] § 359-m.

[4] § 359-n(5).

[5] § 359-n(7).

[6] § 359-n(8).

[7] § 359-n(9).

[8] § 5.

[9] § 359-o(1).

[10] N.Y. Bus. Corp. Law § 912(a)(1).

[11] § 359-o(4).

[12] § 359-q(1), (9), (8).

[13] § 359-o(5).

[14] § 359-o(3).

[15] § 359-o(22)–(23).

[16] § 359-o(18).

[17] § 359-(o)(13).

[18] § 359-o(16).

[19] § 359-o(10).

[20] § 359-o(7).

[21] § 359-o(20).

[22] § 359-o(8).

[23] § 359-o(14).

[24] § 359-o(11).

[25] § 359-q(2).

[26] § 359-p(2), (4).

[27] § 359-p(6).

[28] § 359-p(1).

[29] § 359-o(17).

[30] § 359-o(6).

[31] § 359-p(3).

[32] § 359-p(16).

[33] § 2.

[34] § 359-r.