NYDFS REQUIRES COVID-19 PREPAREDNESS PLANS FROM VIRTUAL CURRENCY BUSINESSES
The arrival of Novel Coronavirus (COVID-19) in New York, and the United States more generally, has roiled the U.S. and global economy and significantly affected numerous businesses. In light of these circumstances, the New York Department of Financial Services (NYDFS) released an industry letter on March 10, 2020 (the “VCB Guidance”) to entities engaged in “Virtual Currency Business Activities,” requiring each such regulated institution submit a plan describing the institution’s preparedness to manage the risk of disruptions—financial, services and operations—stemming from the recent outbreak of COVID-19. In addition, the NYDFS Superintendent has issued an order providing temporary relief regarding certain Banking Law notice requirements and extensions regarding certain NYDFS regulatory reporting requirements in this period.
The VCB Guidance, signed by Matthew Homer, the Executive Deputy Superintendent for Research & Innovation, specifies that each virtual currency business (VCB) should provide a detailed preparedness plan to the NYDFS as soon as possible—and by April 9th at the latest.
Examples of the issues highlighted in the VCB Guidance include:
- Operational and Financial Preparedness. Major items for each VCB’s preparedness plan to address include, inter alia, (i) strategies for mitigating operational disruptions and protecting employees, (ii) an evaluation of the outbreak’s impact on employees, facilities and critical third-party service providers, and (iii) various financial assessments. The NYDFS emphasizes that each VCB’s plan should “be sufficiently flexible to effectively address a range of possible effects that could result from an outbreak of COVID-19, and reflect the institution’s size, complexity and activities.”
- Cybersecurity Threats. Furthermore, the VCB Guidance particularly emphasizes that VCBs consider concerns related to increased cybersecurity threats as hackers and other bad actors take advantage of global chaos to target VCBs. For example, the NYDFS urges institutions to consider the need for special arrangements to move virtual currency from “cold” to “hot” wallets during times when employees may not all be working from their usual locations.
- Notification Obligations. The NYDFS also reminds regulated institutions of their obligations to notify DFS if positive net worth falls below the set threshold above the minimum required capitalization.
Board and Senior Management Oversight
The NYDFS also explicitly allocates responsibility to the board of directors (or equivalent body) to institute and allocate resources for a preparedness plan and to senior management to implement policies, processes and procedures to execute such a plan.
Preparedness Plan Requirements
More specifically, each VCB’s plan should address the following items, at a minimum:
- Tailored preventative measures to mitigate the risk of operational disruption, which should include identifying the impact on customers and counterparts;
- A documented strategy addressing the impact of the outbreak in stages, so that the VCB’s efforts can be appropriately scaled, consistent with the effects of a particular stage of the outbreak;
- Assessment of all facilities, systems, policies and procedures necessary to continue critical operations and services if members of the staff are unavailable for longer periods or are working off-site, including the effectiveness and security of remote access;
- An assessment of potential increased risk of cyber-attacks and fraud due to an outbreak;
- Employee protection strategies, critical to sustaining an adequate workforce during the outbreak, including employee awareness and steps that employees can take to reduce the likelihood of contracting COVID-19;
- Assessment of the preparedness of critical third-party service providers and suppliers;
- Development of a communication plan to effectively communicate with customers, counterparties and the public, and to deliver important news and instructions to employees, along with establishing forums for questions to be asked and addressed;
- Testing the plan to ensure its policies, processes and procedures are effective; and
- Governance and oversight of the plan, including identifying the critical members of a response team, to ensure ongoing review and updates to the plan, including the tracking of relevant information from government sources and the institution’s own monitoring program.
In addition to the above, the NYDFS also expects that VCBs consider and evaluate the financial fall-out from the COVID-19 pandemic as world markets contract and consumers adjust their behavior accordingly. Preparedness plans should thus include information assessing:
- The valuation of assets and investments that may be, or have been, impacted by COVID-19;
- The overall impact of COVID-19 on the earnings, profits, capital and liquidity of your institutions; and
- Reasonable and prudent steps to assist those adversely impacted by COVID-19.
Timing and Method of Submission
As noted previously, preparedness plans should be submitted as soon as possible, and by April 9th at the latest, to the following designated email address: firstname.lastname@example.org.
NYDFS Temporary Relief
Separately, the NYDFS Superintendent has issued an order providing temporary relief to regulated institutions, which includes VCBs, regarding the following:
- New York State regulated entities may temporarily relocate any of their authorized places of business, and close any of their branch offices or locations, if adversely affected by the outbreak of COVID-19, without complying with the prior notice or application requirements of the Banking Law or Financial Services Law.
- The regulated entities and individuals must give NYDFS prompt written notice of any such relocation or branch closing, and all activities conducted from any such relocated places of business must remain subject to regulation and supervision of the NYDFS.
- Individuals employed by or working for regulated entities and are conducting licensable activities from their personal residences will remain subject to the full supervision and oversight of such regulated entities.
- Such regulated entities must maintain appropriate safeguards and controls, including but not limited to those related to data protection and cybersecurity, to ensure continued safety and soundness of such regulated entities and persons.
- Participation in a meeting of the board of directors or trustees or of any committee of such board of directors or trustees of a bank or trust company, can be conducted by telephone, video-conferencing or similar electronic means allowing all persons in the meeting to hear each other, and it will constitute an in-person meeting.
The deadline for the following filings, among others, is extended by forty-five (45) days from the original respective due date for regulated entities unable to meet filing deadlines due to the outbreak of COVID-19:
- Certifications of compliance with cybersecurity requirements and transaction monitoring and filtering programs;
- Annual Reports and Comparative Statements of commercial banks, trust companies, stock-form savings banks and stock-form savings and loan associations;
- Annual Reports of licensed lenders, sales finance companies and money transmitters; and
- Quarterly Financial Statements of virtual currency licensees.
The extensions do not include:
- Notices to the Superintendent of a cybersecurity event; and
- Submission of plans to address London Interbank Offered Rate cessation and transition risk pursuant to the Industry Letter dated December 23, 2019, which are due March 23, 2020.
Special thanks to Caitlin Hutchinson Maddox for her contribution to this publication.