New York CRPTO Bill Would Prohibit Many Digital Asset Activities and Impose Sweeping Market Structure Changes

On May 5, 2023, New York Attorney General Letitia James released a bill for consideration by the New York State Legislature that would implement comprehensive and far-reaching regulation of digital asset activities in the state.

If enacted as currently drafted, the Crypto Regulation, Protection, Transparency, and Oversight Act (the CRPTO Act) would, among other things, amend the New York General Business Law to (i) establish registration requirements for a number of categories of digital asset market participants; (ii) impose significant market structure reforms, effectively prohibiting the direct market access paradigm common in the digital asset industry; (iii) impose listing standards and disclosure requirements; (iv) target conflicts of interest, including in the context of digital asset “influencers”; and (v) expand and solidify the New York Attorney General’s (NYAG’s) enforcement tool kit with respect to digital asset markets. As currently drafted, the CRPTO Act would require significant changes to existing business models for digital asset market participants to continue offering services in New York.

Given that the 2023 New York State legislative session is scheduled to end on June 8, 2023, it is relatively unlikely the bill will be taken up and enacted in its current form in the remaining weeks of the current legislative session. With that said, the CRPTO Act comes in the context of ongoing congressional focus on digital asset regulation and — in the eyes of many — will be viewed as further evidence of the need for coherent federal legislative or regulatory action. Absent such measures at the federal level, any New York legislative action may herald further fragmentary, state-by-state action with respect to digital asset regulation, just as the existing New York BitLicense regime has seen similar licensing regimes adopted or proposed in other states, such as Louisiana, Florida, and Illinois. 

New Registration Requirements

Circumventing the ongoing uncertainty over whether digital assets fall within existing definitions of a “security” or “commodity,” the CRPTO Act would broadly define a “digital asset” as “any type of digital unit, whether labeled as a cryptocurrency, coin, token, virtual currency, or otherwise, that can be used as a medium of exchange, a form of digitally stored value, or a unit of account” and whether decentralized or maintained through a centralized repository. Notably, the CRPTO Act would provide a number of exclusions from this definition, including for certain digital assets within online gaming platforms, certain digital assets in connection with customer affinity and rewards programs, and digital assets providing an equity interest in a business.

The CRPTO Act would also define and impose registration requirements on digital asset market participants in the following capacities:¹

• Digital asset brokers, defined to mean any person engaged in the business of effecting transactions in digital assets for the account of others, whether the digital asset broker receives a benefit directly or indirectly.
• Digital asset investment advisers, defined to mean any person who, for compensation, engages in the business of advising members of the public, either directly or through publications or writings, as to the value of digital assets or as to the advisability of investing in digital assets. The definition itself would deem digital asset investment advisers to owe a fiduciary duty to their advisees.
• Digital asset issuers, defined to mean a person who creates or issues or offers to issue a digital asset that is or will be available to the public and is directly or indirectly “for speculation investment purposes” [sic] or for use as a currency, medium of exchange, a form of digitally stored value, a unit of account, or any combination thereof and not for consumption by the offeree or purchaser.
• Digital asset marketplaces, defined to mean any person that provides, or substantively participates in, or any system that provides, a marketplace or facilities for bringing together purchasers and sellers of digital assets or for otherwise performing, with respect to digital assets, the functions commonly performed by a stock exchange as that term is generally understood with respect to stocks.

Notable implications of these proposed registration requirements for existing digital asset market participants include:

• There is a carve-out from digital asset investment adviser status for investment advisers registered with the SEC pursuant to the Investment Advisers Act of 1940, but not for those exempt or excluded from such registration. Accordingly, venture capital and other private investment managers operating in the digital asset space (as defined for purposes of the CRPTO Act) would need to either register in New York as digital asset investment advisers or register with the SEC as investment advisers to continue operating in New York.
• Existing centralized digital asset exchanges would fall within both the digital asset broker and digital asset marketplace definitions, an issue we discuss further below.
• Although there is clear tension in applying a definition that refers to any person in the decentralized finance space, the reference in the definition of a digital asset marketplace to any system that provides a marketplace or facilities would potentially impose a New York registration requirement on even decentralized exchanges and marketplaces. 

Market Structure Provisions Would Prohibit Current Exchange Business Models in New York

The CRPTO Act also would make it illegal for any person or affiliate to act simultaneously as more than one of a digital asset issuer, a digital asset broker, a digital asset marketplace, or a digital asset investment adviser.² By mandating strict segregation of these different market capacities, the CRPTO Act would necessarily prohibit the “direct access model” that is common among centralized digital asset exchanges where users maintain accounts directly with the relevant exchange on which they trade rather than through a separate brokerage firm. This would render it unlawful for many centralized digital asset exchanges to operate in New York under their current business models.

Significantly, the current draft of this prohibition refers to any person or affiliate acting in one or more of the foregoing capacities. Accordingly, this would preclude common ownership within the same corporate group of a digital asset issuer, a digital asset broker, a digital asset marketplace, or a digital asset investment adviser — even if operated through separate legal entities.

Listing Standards and Disclosure Requirements

The CRPTO Act would impose a number of specific disclosure requirements and listing standard requirements on in-scope digital asset market participants. For example, every digital asset issuer, digital asset broker, digital asset marketplace, and digital asset investment adviser would be required to (i) publicly post a certification of compliance with all requirements of the CRPTO Act and (ii) post and make publicly accessible independently audited financial statements and quarterly financial statements.

Digital asset marketplaces would be required to adopt and publish listing standards for digital assets they list.³ A digital asset marketplace would be permitted to list only digital assets that conform to its listing standards. Significantly, a digital asset marketplace would be obligated to “verify” that a digital asset’s software code is “consistent with the issuer’s disclosure and contains security properties in compliance with applicable state and federal laws and regulations.”

The CRPTO Act would also require every digital asset issuer who issues a digital asset to publish and distribute a prospectus prior to issuance covering certain prescribed material information about the issuer and the digital asset.⁴ Subject to a grandfathering clause, digital asset brokers, digital asset investment advisers, and digital asset marketplaces would be prohibited from supporting a particular digital asset unless they provide customers with the information required in the prospectus and direct such customers to the digital asset issuer’s most recent financial statements.⁵

Proprietary Trading and Market-Making Prohibition

The CRPTO Act would make it illegal for any digital asset issuer, digital asset broker, digital asset marketplace, digital asset investment adviser, or affiliate thereof to act as, employ, or otherwise use the services of any “proprietary trading agent.”⁶ As a result, the CRPTO Act would prohibit both captive proprietary trading activities on the part of an in-scope digital asset market participant and prohibit the retention of external proprietary trading services such as market makers.

Custody

Undoubtedly in response to recent high-profile collapses of centralized digital asset exchanges, the CRPTO Act would provide that a digital asset marketplace shall only take physical possession or control of a customer’s digital assets for the purpose of effecting a specific transaction.⁷

Custody would be focused on brokers, with every digital asset broker obligated to promptly obtain and maintain physical possession or control of all fully paid digital assets carried by the broker for the accounts of customers. Digital asset brokers would also be prohibited from borrowing, lending, rehypothecating, or in any way encumbering digital assets from any customer.⁸ Digital asset investment advisers, on the other hand, would be prohibited from taking or maintaining physical possession or control of any investor’s digital assets.⁹

While the CRPTO Act would define “physical possession or control” to incorporate by reference the meaning of such concept under the SEC’s broker-dealer Customer Protection Rule,¹⁰ the CRPTO Act definition would also expressly provide that “physical possession or control” includes “holding private keys necessary to transfer a customer’s digital assets.” There is obvious uncertainty in terms of how these two aspects of the CRPTO Act definition of “physical possession or control” are intended to interact. In particular, we note that the SEC has expressed significant doubts about how a broker-dealer may sufficiently demonstrate for Customer Protection Rule purposes that it has exclusive possession of a relevant private key.¹¹ As a result, the CRPTO Act seems to be recognizing a custody model — holding private keys — that may not necessarily be viewed by the SEC as compliant under the SEC definition of “physical possession and custody” that the CRPTO Act purports to adopt by reference.

Crypto Influencers

The CRPTO Act contains provisions specifically directed at the conflicts of interest inherent in the promotion of digital assets through “influencers,” a phenomenon that has already seen enforcement action at the federal level by the SEC. In particular, the CRPTO Act would make it illegal for any digital asset influencer to engage in “promoting”¹² without (i) disclosing their ownership interest or compensation in respect of the relevant digital asset and (ii) filing a registration statement, referred to as a “digital asset influencer statement,” with the New York Department of Law.¹³ This digital asset influencer statement would contain disclosures such as the influencer’s business, educational, and criminal background, wallet address and social media accounts, and disclosure of conflicts of interest involving current or past holdings. 

Unauthorized Transfers

The CRPTO Act also contains measures intended to limit customer liability for unauthorized digital asset transactions. For example, a customer’s liability for an unauthorized digital asset transfer would be capped at the lesser of $50 and the value of the transfer if the customer notifies their digital asset broker or digital asset investment adviser within two business days of learning of the unauthorized digital asset transfer.¹⁴ Distinct caps on customer liability would apply where the customer provides notification after two business days. Where these caps apply, the digital asset broker or digital asset investment adviser would be liable to their customer for the balance of the loss.¹⁵

Notably, an “unauthorized digital asset transfer” would be broadly defined to mean any transaction involving a digital asset that is either (i) effected without the customer’s actual authorization, including when the password or private key has been used to effect the transfer but so long as the customer derives no benefit; or (ii) effected with the customer’s authorization due to fraudulent inducement by a third party.

NYDFS Jurisdiction

The CRPTO Act contains a number of provisions confirming and expanding the jurisdiction of the New York State Department of Financial Services (NYDFS) with respect to digital asset market participants. For example, the CRPTO Act would amend the New York Financial Services Law to confer the NYDFS with the power to supervise and examine every digital asset broker, digital asset marketplace, digital asset investment adviser, and digital asset issuer that files a digital asset statement with the New York Department of Law. The CRPTO Act would mandate the NYAG and NYDFS to cooperate, coordinate, and assist one another in carrying out their respective responsibilities for the protection of investors and consumers in digital assets. Curiously, the CRPTO Act does not clearly address the existence of the NYDFS BitLicense regime (which was promulgated under the New York Financial Services Law rather than the New York General Business Law), and it is unclear how the proposed registration regime and regulatory requirements of the CRPTO Act are intended to interact with and apply to existing BitLicense holders.

Enforcement Authority and Market Conduct Prohibitions

Beyond the registration regime and regulatory requirements outlined above, the CRPTO Act contains a number of anti-fraud, anti-manipulation, and other market misconduct prohibitions and related measures intended to solidify the enforcement authority of the NYAG with respect to digital asset markets. For example, the CRPTO Act would prohibit cross-transactions, wash trading, prearranged trading, market manipulation, and insider trading in digital assets and require every digital asset issuer, digital asset broker, digital asset marketplace, and digital asset investment adviser to observe high standards of commercial honor and just and equitable principles of trade in the conduct of its business.

The CRPTO Act would confer the NYAG with authority to investigate and enforce any violation of its provisions. Upon a showing of a violation of the CRPTO Act’s provisions, the courts would be empowered to impose civil penalties not to exceed the greater of (i) $10,000 per violation for a natural person or $100,000 per violation for any other person and (ii) the gross amount of pecuniary gain to such defendant or the loss sustained by any other person as a result of the violation. Such penalties would be subject to review every two years and subject to adjustment based on inflation.

Key Takeaways

The CRPTO Act would have far-reaching implications and warrants close scrutiny for existing digital asset market participants operating within or from New York. Beyond simply imposing additional registration requirements to operate in the State of New York, the CRPTO Act would likely make it impossible for many existing digital asset market participants to continue operating their existing business models in New York by prohibiting participants from simultaneously acting in different capacities (e.g., as marketplaces and brokers). The CRPTO Act would also impose a range of disclosure and compliance obligations on digital asset market participants and would expand and solidify the oversight and enforcement authority of the NYAG and NYDFS. 

We will continue to monitor the evolution of the proposed CRPTO Act in the New York legislative process and related legislative and regulatory efforts. 

^[1] Each of the foregoing digital asset market participants would be required to file a registration statement — referred to as a “digital asset statement” — with the New York Department of Law prior to engaging in business within or from the State of New York.
^[2] Proposed NYGBL § 359-o(1).
^[3] Proposed NYGBL § 359-o(18).
^[4] Proposed NYGBL § 359-o(22).
^[5] Proposed NYGBL § 359-o(23).
^[6] Proposed NYGBL § 359-o(2). Proposed NYGBL § 359-n would define a “proprietary trading agent” as any person who engages in the business of offering, buying, or selling digital assets for the benefit of the account of a digital asset issuer, digital asset broker, digital asset marketplace, or digital investment adviser.
^[7] Proposed NYGBL § 359-o(8).
^[8] Proposed NYGBL § 359-o(7).
^[9] Proposed NYGBL § 359-o(20).
^[10] Proposed NYGBL § 359-n.
^[11] See, e.g., SEC.gov | Joint Staff Statement on Broker-Dealer Custody of Digital Asset Securities.
^[12] Proposed NYGBL § 359-n(12) would define “promoting” broadly to encompass any communication which, though not purporting to offer a digital asset for sale, encourages investment in such digital asset.
^[13] Proposed NYGBL § 359-q(2).
^[14] Proposed NYGBL § 359-p(8)(c).
^[15] Proposed NYGBL § 359-p(8)(e).