InfoBytes Blog
Filter
Subscribe to our InfoBytes Blog weekly newsletter and other publications for news affecting the financial services industry.
DFPI concludes MTA licensure not required for direct purchase and sale of cryptocurrency
Recently, the California Department of Financial Protection and Innovation (DFPI) released a new opinion letter covering aspects of the California Money Transmission Act (MTA) related to the purchase and sale of virtual currency. The redacted opinion letter examines whether a Company that offers customers the opportunities to deposit fiat currency to a Company account and then draw down that balance to purchase virtual currency from the company requires MTA licensure. The Company explained that virtual currency is purchased from a third party and is transferred to the customer’s Company-issued virtual currency wallet where it can then be stored, transferred to an external wallet, or sold for fiat currency. When a customer later wants to sell the purchased virtual currency for fiat currency, the transaction occurs in a similar fashion. The Company stated that “virtual currency sales to customers are from the Company’s own inventory,” and that for purposes of the opinion, DFPI “assumes these sales occur independently of the Company’s own transactions with third parties.”
DFPI concluded that because the Company’s activities are limited to directly purchasing and selling cryptocurrency to customers, it does not require an MTA license because it does “not involve the sale or issuance of stored value or receiving money for transmission.” Specifically, DFPI stated that because the “customer’s fiat currency balance in the Company account does not meet the definition of stored value” and because “funds in that account can only be used for virtual currency purchases from the Company or transferred out to the customer’s external bank account,” the closed loop stored value “does not constitute issuance of stored value that is regulated under the MTA.” DFPI reminded the Company that its determination is limited to the presented facts and that any change could lead to different conclusions.
OFAC sanctions facilitators of Russian sanctions evasion
On April 20, the U.S. Treasury Department’s Office of Foreign Assets Control (OFAC) announced sanctions pursuant to Executive Order 14024 against several entities and numerous individuals for attempting to evade sanctions imposed by the U.S. and its international partners on Russia. Included in the designations are a Russian commercial bank, a global network comprised of more than 40 individuals and entities led by a previously designated Russian oligarch (“including organizations whose primary mission is to facilitate sanctions evasion for Russian entities”), and several companies operating in Russia’s virtual currency mining industry. According to OFAC, this is the first time a virtual currency mining company has been sanctioned. In coordination with OFAC’s sanctions, the Department of State took further action by imposing visa restrictions on 635 Russian nationals and three Russian Federation officials for their involvement in human rights abuses, as well as 17 individuals responsible for undermining democracy in Belarus.
As a result of the sanctions, all property and interests in property belonging to the sanctioned entities in the U.S. are blocked and must be reported to OFAC. Additionally, “any entities that are owned, directly or indirectly, 50 percent or more by one or more blocked persons are also blocked.” OFAC noted that U.S. persons are prohibited from participating in transactions with the sanctioned persons unless authorized by a general or specific license.
On the same day, OFAC issued new frequently asked question guidance clarifying obligations for credit card operators with regard to payment cards issued by sanctioned Russian financial institutions. OFAC also published two Russia-related general licenses: (i) General License 28 authorizes certain transactions involving a public joint stock company that are “ultimately destined for or originating from Afghanistan”; and (ii) General License 29 authorizes the wind down of transactions involving the same public joint stock company.
Find continuing InfoBytes coverage on the U.S. sanctions response to Russia’s invasion of Ukraine here.
NYDFS to collect assessment fees from licensed virtual currency businesses
On April 9, the New York governor signed S. 8008-C, which enacts the state’s 2023 fiscal year budget and requires, among other things, NYDFS to start charging a new assessment fee to all virtual currency businesses licensed in New York in order to cover the costs associated with their oversight and “defray operating expenses.” Specifically, Section 206 is amended to read: “The expenses of every examination of the affairs of any person regulated pursuant to this chapter that engages in virtual currency business activity shall be borne and paid by the regulated person so examined, but the superintendent, with the approval of the comptroller, may in the superintendent’s discretion for good cause shown remit such charges.” The amendments do not specify a specific assessment amount, however regulated companies engaged in virtual currency business activity “shall be assessed by the superintendent for the operating expenses of the department that are solely attributable to regulating such persons in such proportions as the superintendent shall deem just and reasonable.”
NYDFS Superintendent Adrienne A. Harris issued a press release the same day praising the budget adoption as it now allows the Department to collect supervisory costs from licensed virtual currency businesses as it does for banking and insurance companies. Noting that “New York was the first to start licensing and supervising virtual currency companies,” Harris said that the “new authority will empower the Department to build staff with the capacity and expertise to best regulate and support this rapidly growing industry.”
Virginia allows banks to provide virtual currency custody services
On April 11, the Virginia governor signed HB 263, which permits banks in the Commonwealth to provide customers with virtual currency custody services “so long as the bank has adequate protocols in place to effectively manage risks and comply with applicable laws.” Before offering virtual currency custody services, banks must conduct a self-assessment process to carefully examine the risks involved in offering such services, which includes: (i) “implement[ing] effective risk management systems and controls to measure, monitor, and control relevant risks associated with custody of digital assets such as virtual currency”; (ii) confirming adequate insurance coverage for such services; and (iii) maintaining a service provider oversight program to address risks to service provider relationships as a result of engaging in virtual currency custody services. Banks may provide virtual currency custody services in either a fiduciary or non-fiduciary capacity. If a bank provides such services in a nonfiduciary capacity, the bank will “act as a bailee, taking possession of the customer’s asset for safekeeping while legal title remains with the customer” (i.e. “the customer retains direct control over the keys associated with their virtual currency”). Should a bank provide services in a fiduciary capacity, it must “require customers to transfer their virtual currencies to the control of the bank by creating new private keys to be held by the bank.” The bank will have “authority to manage virtual currency assets as it would any other type of asset held in such capacity.” HB 263 takes effect July 1.
OFAC prohibits new investment in Russia and blocks Russia’s largest bank, executive order foreshadows more Russian export bans
On April 6, OFAC announced that President Biden issued a new E.O., Prohibiting New Investment in and Certain Services to the Russian Federation in Response to Continued Russian Federation Aggression, which bans “all new investment in the Russian Federation by U.S. persons, wherever located, as well as the exportation, reexportation, sale, or supply, directly or indirectly, from the U.S., or by a U.S. person, wherever located, of any category of services as may be determined by the Secretary of the Treasury, in consultation with the Secretary of State, to any person located in the Russian Federation.” According to OFAC, the prohibitions come after recently issued E.O. 14066 and 14068 that prohibit certain imports and exports involving Russia, and are consistent with commitments made by the G7 leaders to ensure that their citizens are not underwriting Putin’s war.
OFAC also announced full blocking sanctions, pursuant to Executive Order (E.O.) 14025, on Sberbank, Russia’s largest state-owned bank and Alfa-Bank, Russia’s largest private bank, in addition to targeting family members of President Vladimir Putin and Foreign Minster Sergey Lavrov, as well as Russian Security Council members who are complicit in the war against Ukraine.
Earlier this week, OFAC also announced sanctions, in collaboration with the DOJ, FBI, Drug Enforcement Administration, Internal Revenue Service Criminal Investigation, and Homeland Security Investigations, against the world’s largest and most prominent darknet market. According to OFAC, the designation was enhanced by international collaboration with the German Federal Criminal Police, who seized the designated entity’s servers in Germany and $25 million worth of bitcoin. Additionally, OFAC identified more than 100 virtual currency addresses connected to the entity’s operations that have been used to conduct illicit transactions. OFAC also noted that Treasury will publish an updated National Strategy to Combat Illicit Finance, which will highlight planned Treasury efforts to continue to combat the virtual currency misuse. As a result of the sanctions, all property and interests in property belonging to the sanctioned entities in the U.S. are blocked and must be reported to OFAC. Additionally, “any entities that are owned, directly or indirectly, 50 percent or more by one or more blocked persons are also blocked.” OFAC noted that U.S. persons are prohibited from participating in transactions with the sanctioned persons, which includes “the making of any contribution or provision of funds, goods, or services by, to, or for the benefit of any blocked person or the receipt of any contribution or provision of funds, goods or services from any such person.”
Additionally, OFAC issued several Russia-related general licenses: (i) General License 8B authorizes certain “transactions related to energy” through June 24; (ii) General License 9B authorizes “transactions related to dealings in certain debt or equity”; (iii) General License 10B authorizes “certain transactions related to derivative contract”; (iv) General License 21 authorizes “the wind down of Sberbank CIB USA, Inc”; (v) General License 22 authorizes “the wind down of transactions involving public joint stock company Sberbank of Russia”; and (vi) General License 23 authorizes the wind down of transactions involving joint stock company Alfa-Bank.”
Find continuing InfoBytes coverage on the U.S. sanctions response to Russia’s invasion of Ukraine here.
Idaho defines legal status of digital assets
On March 28, the Idaho governor signed HB 583, amending the Idaho commercial code’s definition and classification of digital assets. The bill classifies digital assets as intangible personal property and general intangibles under the bill. However, the bill makes a distinction between digital securities and virtual currency—both are classified as intangible personal property, but while digital securities qualify as investment property, virtual currency is not considered a security. With respect to the purchase and sale of digital assets, the bill states that digital assets “may be purchased and sold in the same manner and subject to the same laws of this state as other personal property,” and notes that an “action based on a claim of a property right, right to performance, or right of payment may not be asserted against a qualified purchaser.” The bill also addresses provisions related to perfection by possession or control, and specifies that a “person that acquires an interest in and obtains control of a virtual currency without notice of any adverse claim takes the interest in the virtual currency and in any right to payment evidenced by the virtual currency free of any adverse claim.” The bill is effective July 1.
CFPB handled nearly 1 million consumer complaints in 2021
On March 31, the CFPB published its Consumer Response Annual Report for 2021, providing an overview of consumer complaints received by the agency between January 1 and December 31, 2021. According to the report, the Bureau handled approximately 994,000 consumer complaints last year. Among other trends, the agency found that complaints about credit or consumer reporting continue to increase, accounting for more than 70 percent of all complaints received last year. Debt collection complaints are also increasing, accounting for more than 10 percent of all complaints. Consumers also reported difficulties with financial institutions failing to adequately address consumer complaints, giving consumers the runaround, and described issues with reaching companies to raise concerns about digital assets, mobile wallets, and buy-now-pay-later credit. The Bureau noted that during the second year of the Covid-19 pandemic, complaint data showed that the volume of complaints from consumers struggling to pay their mortgages is increasing as borrower protections have expired. While complaints related to vehicle loans have also increased, the Bureau reported that student loan complaints remain lower than pre-Covid levels due to the implementation of temporary relief programs. The top products and services—representing approximately 94 percent of all complaints—were credit or consumer reporting, debt collection, credit cards, checking or savings accounts, and mortgages. The Bureau also received complaints related to money transfers and virtual currency; vehicle finance; prepaid cards; student, personal, and payday loans; credit repair; and title loans.
OFAC sanctions Russians, issues guidance on sanctions evasion through virtual currency, general licenses, and FAQs
On March 11, the U.S. Department of the Treasury’s Office of Foreign Assets Control issued guidance, in line with the G7 leaders' statement, to guard against possible attempts to use virtual currency to evade U.S. sanctions imposed on Russia. According to OFAC, the public guidance “further cut[s] off avenues for potential sanctions evasion by Russia” and “continues to make clear that Treasury’s expansive sanctions actions against Russia require all U.S. persons to comply with OFAC regulations, regardless of whether a transaction is denominated in traditional fiat currency or virtual currency.
Additionally, OFAC announced sanctions against Russian and Kremlin elites, and Russia’s political and national security leaders who have supported Russia’s invasion of Ukraine. As a result of the sanctions, all property and interests in property belonging to the sanctioned individuals and entities that are in the U.S. or in the possession or control of U.S. persons, and “any entities that are owned, directly or indirectly, 50 percent or more” by the targeted individuals and/or entities are blocked and must be reported to OFAC. The sanctions complement an Executive Order (E.O) issued by President Biden that imposes new import and export restrictions on Russia, including the export of U.S. banknotes to Russia. Among other things, this E.O. prohibits the importation into the U.S. of certain products of Russian Federation origin. Additionally, the E.O. bans the exportation, reexportation, sale, or supply, directly or indirectly, from the U.S., or by a U.S. person, wherever located, of U.S. dollar-denominated banknotes to the Russian government or to any person located in the Russian Federation.
OFAC also issued Russia-related General License 17 to authorize the import of existing purchases of prohibited products that are under pre-existing contract until March 25, 2022, and General License 18 and General License 19 to authorize certain activities regarding U.S. dollar-denominated banknotes as they pertain to personal remittances and U.S. persons, respectively. OFAC also issued Ukraine-related General License 23, “Blocking Property of Certain Persons and Prohibiting Certain Transactions With Respect to Continued Russian Efforts to Undermine the Sovereignty and Territorial Integrity of Ukraine,” “to authorize certain transactions that are ordinarily incident and necessary to nongovernmental organizations’ activities in the so-called Donetsk People’s Republic (DNR) or Luhansk People’s Republic (LNR) regions of Ukraine, including activities related to humanitarian projects to meet basic human needs, democracy building, education, non-commercial developments projects, and environmental and natural resource protection,” and published new Frequently Asked Questions and amended one Frequently Asked Question regarding Russia sanctions.
Find continuing InfoBytes coverage on the U.S. sanctions response to Russia’s invasion of Ukraine here.
DFPI reminds financial institutions of their sanctions compliance obligations
On March 4, the California Department of Financial Protection and Innovation (DFPI) issued guidance, in light of the evolving situation in Ukraine, to remind financial institutions of their sanctions compliance obligations under state and federal law. Licensees are reminded that they are prohibited from participating in financial transactions with individuals and entities listed on the SDN List, and encouraged to review specific, more limited sanctions that have been placed on several Russian entities. This information can be found on OFAC's website.
Additionally, licensees are strongly encouraged to immediately ensure their systems, programs, and processes comply with OFAC regulations, and review and monitor all transactions (particularly trade finance transactions and funds transfers) to identify and block transactions subject to sanctions. Licensees should also follow OFAC directions related to blocked funds.
DFPI further warned that Russia’s invasion of Ukraine increases the risk that listed individuals and entities will attempt to evade sanctions by using virtual currency transfers, and encouraged licensees to review OFAC Guidance to protect against these risks. Licensees engaged in transactions involving virtual currencies are instructed to implement policies, procedures, and processes to protect against the unique risks posed by virtual currencies and should “consider virtual currency-specific control measures including sanctions lists, geographic screening, and any other measures appropriate to the licensee’s specific risk profile.”
Additionally, DFPI cautioned that the “Russian invasion significantly elevates the cyber risk for the U.S. financial sector,” and licensees are instructed to take measures to mitigate cybersecurity threats, including adopting core cybersecurity hygiene measures, eliminating any non-essential networking protocols, ensuring procedures are able to address a ransomware attack, and reevaluating “plans to maintain essential services, protect critical data, and preserve customer confidence considering the realistic threat of extended outages.” Licensees are encouraged to track alerts from the Cybersecurity and Infrastructure Security Agency.
Licensees conducting business in Ukraine and/or Russia should also “take increased measures to monitor, inspect, and isolate traffic from Ukrainian or Russian offices and service providers,” and “segregate networks for Ukrainian or Russian offices from the global network.”
NYDFS also recently issued similar guidance for New York state regulated entities on its cybersecurity and virtual currency regulations in response to the Russian invasion and recently imposed sanctions. (Covered by a Buckley Special Alert.)
FinCEN warns financial institutions about Russian sanctions evasion
On March 7, FinCEN issued an alert advising financial institutions to be vigilant against potential attempts to evade sanctions levied against Russian individuals, banks, and other entities in response to the situation in Ukraine. FinCEN provided several examples of red flag indicators that could help identify attempted sanctions evasions, including actions by state actors and oligarchs, and reminded financial institutions of their Bank Secrecy Act (BSA) reporting obligations.
The alert stressed that all financial institutions, including those with visibility into convertible virtual currency (CVC) flows identify and promptly report associated suspicious activity, and conduct appropriate, risk-based customer due diligence or enhanced due diligence as required. This includes CVC exchangers and administrators within or outside of Russia (which are generally considered to be money services businesses under the BSA) that retain at least some access to the international financial system. FinCEN noted that “[w]hile large scale sanctions evasion using [CVC] by a government such as the Russian Federation is not necessarily practicable, CVC exchangers and administrators and other financial institutions may observe attempted or completed transactions tied to CVC wallets or other CVC activity associated with sanctioned Russian, Belarusian, and other affiliated persons.”
Financial institutions are instructed to specifically watch for (i) transactions initiated from IP addresses located in Russia, Belarus, FATF-identified jurisdictions with anti-money laundering/countering the financing of terrorism/counter-proliferation deficiencies, or other sanctioned jurisdictions; (ii) transactions connected to CVC addresses listed on OFAC’s Specially Designated Nationals and Blocked Persons List; and (iii) customers’ use of a CVC exchanger or foreign-located money service businesses in high-risk jurisdictions, including those with inadequate “know-your-customer” or customer due diligence measures. FinCEN also warned financial institutions of the dangers posed by Russian-related ransomware campaigns and encouraged financial institutions to refer to FinCEN and OFAC resources to help detect, prevent, and report potential suspicious activity.
Find continuing InfoBytes coverage on the U.S. sanctions response to Russia’s invasion of Ukraine here.