New York Office of the Attorney General Publishes Report on Virtual Currency Platforms and Their Potential Risks

September 27, 2018

This Alert reviews the New York State Office of the Attorney General’s (the “OAG”) Virtual Markets Integrity Initiative Report (the “Report”), which was published on September 18, 2018.[1] The publication of the OAG’s 42-page Report brings to a close its six-month fact-finding inquiry of several virtual currency platforms.[2] The OAG sent out detailed letters and questionnaires to a number of virtual currency platforms seeking information from the platforms across a wide-range of issues, including trading operations, fees charged to customers, the existence of robust policies and procedures, and the use of risk controls.

The OAG’s purpose in conducting this inquiry was to inform investors and consumers of the risks they face when considering whether to trade on virtual currency platforms. The OAG is charged with enforcing laws that protect investors and consumers from unfair and deceptive practices and that safeguard the integrity of financial markets. To that end, the OAG “compil[ed] and analyz[ed] the responses, compar[ed] [those responses] to the platforms’ publicly available disclosures,” and gave the platforms opportunities to confirm the OAG’s analysis in advance of the Report’s publication.[3]

The Report focuses on three main concerns. First, the OAG highlighted that virtual currency platforms may not sufficiently disclose or take measures to mitigate potential conflicts of interest. Second, the OAG opined that virtual currency platforms currently do not take sufficient efforts to impede market manipulation and protect market integrity. And third, the OAG expressed its view that virtual currency platforms may not have adequate safeguards for the protection of customer funds.

We believe that the virtual currency industry (i.e., investors, consumers, platforms and other stakeholders) should view the Report as a best practices or best standards document, upon which virtual currency platforms may be measured in terms of their riskiness and viability.

Please contact Gibson Dunn’s Digital Currencies and Blockchain Technology Team if you have any questions regarding the Report or any of the information discussed in this Alert.

I. The Virtual Currency Markets and New York’s Oversight Authority

In order to have a better understanding of the potential impact of the Report, a primer on virtual currency markets generally and the State of New York’s oversight of virtual currency platforms is appropriate.

a. Primer on Virtual Currency Markets

The virtual currency markets have only been in existence for roughly ten years. While these virtual or digital units of currency have no intrinsic value and are generally traded outside of the purview of direct government controls, the market’s popularity and trading volumes have catapulted it to a total market capitalization of approximately USD 218 billion as of September 27, 2018.[4] One market analyst has estimated the existence of approximately 2,001 different virtual currencies, which are traded on platforms or “exchanges” around the globe.[5]

The most popular virtual currency, Bitcoin, currently has a market capitalization of approximately USD 113 billion and a price of USD 6,523.[6] There are several other virtual currencies—including ether, XRP, EOS, litecoin, and bitcoin cash—that are also widely traded.

Investors and consumers generally access the virtual currency markets through trading platforms, most of which are unregistered and/or not subject to comprehensive governmental oversight in a manner similar to registered exchanges in other financial markets such as securities, commodities, and derivatives markets. There are approximately 100 different virtual currency trading platforms in the world; not all are open to U.S. persons.[7]

In the United States, government supervision over virtual currency markets continues to evolve at both the federal and state levels. At the federal level, several federal regulators—including the Commodity Futures Trading Commission (“CFTC”) and the Securities and Exchange Commission (“SEC”)—have all begun to bring virtual currency trading more squarely under governmental supervision and control, either through defining their authority in federal court cases,[8] issuing regulatory guidance or consumer advisories,[9] or bringing enforcement actions against fraudsters and market participants and trading platforms, which violate existing laws.[10]

In addition, states have enacted legislation or adopted regulations requiring virtual currency platforms to become licensed before offering trading access to their residents. Some of these states, including New York, have also taken a more aggressive posture in warning consumers about fraudsters and platform operators that prey on their investor and consumer residents.[11]

b. The State of New York’s Oversight of Virtual Currency Platforms

New York has been a leader in establishing regulatory oversight over virtual currency markets in two important respects. First, in 2014, New York—through its Department of Financial Services (“NYDFS”)—issued a comprehensive regulatory framework requiring virtual currency platforms and operators to secure a special business license called a “BitLicense” when engaging in virtual currency activities, and for those platforms and operators to establish consumer protections, anti-money laundering compliance, and cybersecurity guidelines.[12] NYDFS has also granted limited purpose trust charters under New York banking law to virtual currency companies and has issued specific virtual currency product approvals.[13] NYDFS has awarded eight BitLicenses, and it has granted two virtual currency limited-purpose trust company charters.[14]

Second, New York has issued detailed guidance focusing on fraud detection and prevention.[15] NYDFS’s guidance mandates that virtual currency licensees and chartered entities implement measures designed to effectively detect, prevent, and respond to fraud, attempted fraud, and similar wrongdoing in the trading of virtual currencies. Many industry observers have viewed this guidance as amplifying and strengthening the monitoring requirements that already exist in New York’s regulations applying to BitLicensees.

The OAG’s recent inquiry and its publication of the Report thus build on a developed framework of state regulation.

II. The Report and Its Three Key Areas of Concern

The Report covers the following broad topics:

(a) The jurisdiction in which virtual currency platforms operate;

(b) The platforms’ acceptance of currencies (i.e., fiat and/or virtual);

(c) Fees charged and disclosures of fee structures to customers;

(d) The robustness of a platform’s trading policies and procedures;

(e) How the platforms manage various types of conflicts of interest;

(f) How the platforms safeguard customer funds through the establishment of security processes and procedures, the role of insurance, and the use of independent audits; and

(g) The platforms’ processes around providing access to customers’ funds, as well as how the platforms handle trading suspensions and outages.

We have produced the following chart that summarizes the OAG’s assessment of, and key findings from analyzing, the questionnaire responses received with respect to each of the topics above. The Report also offered recommendations to assist virtual currency investors and consumers (i.e., platform customers) in making educated choices when deciding whether to invest or trade on a particular virtual currency platform.

Topical Area	Assessment	Recommendations
Jurisdiction	Knowing where a platform is incorporated and headquartered is important because the platform’s domicile impacts which laws apply to any rights and remedies an investor or consumer may have in the event of a dispute, loss, theft or insolvency. Participating platforms claimed to limit trading access to authorized customers from particular locations; however, many of these platforms do not have effective know-your-customer (“KYC”) programs or actively monitor customers’ IP addresses in order ensure the identity and location of particular customers.	Customers should know the jurisdictions from which their virtual currency trading platforms are located and headquartered. Platforms need to significantly enhance and improve their KYC programs and to develop effective IP monitoring systems in order to properly monitor and limit the platforms’ trading systems to authorized customers.
Acceptance of Currency	To obtain virtual currency initially, customers must find a platform that accepts fiat currency (i.e., government-backed currency). It is important to know which trading platforms accept fiat currency; the acceptance of fiat currency demonstrates that the platform has a relationship with a regulated bank.	Customers should be mindful of whether a virtual currency platform has a formal banking relationship in place. The existence of such a relationship may offer customers a useful indicator for evaluating that a particular platform is a legitimate business concern.
Fees and Fee Disclosures	Most virtual currency trading platforms charge fees per transaction. However, many virtual currency platforms’ fees may differ based on the price of the virtual asset that is bought or sold, the volume of trades executed by the customer, the order type chosen, or the timing of an order submission. Some platforms offer significant discounts to high-volume trading customers. This discounting is known as a “maker-taker” fee model. Additionally, some platforms charge fees for withdrawals and deposits of customer fiat and virtual currencies.	Customers should understand which actions will trigger fees, the size of those fees, and whether the platform will charge hidden fees. To that end, the OAG recommends that customers should review and understand a platform’s complete fee schedule before the customer begins trading. Fee transparency is absolutely essential and customers should understand when a particular platform offers high-volume customer discounts.
Trading Policies	The Report drew several comparisons between virtual currency markets and the policies and market structure seen in securities trading. The OAG observed that, similar to securities platforms, the virtual currency platforms that participated in the inquiry do provide special features to professional traders. The OAG also noted that these platforms allow automated and algorithmic trading but few if any have robust policies in place to address such trading. The OAG noted that, while all of the participating platforms expressed a commitment to stamp out abusive trading practices, few had actual policies in place to define, detect, prevent, or penalize suspicious trading or market manipulation. The OAG noted that only a couple of platforms that responded to the questionnaire allow margin trading, whereby customers were allowed to borrow funds to trade a virtual asset.	Since monitoring trading activity on a platform is critical to the integrity of the entire market, the OAG recommended that virtual currency platforms develop robust policies around automated and algorithmic trading, provide more transparency around the special trading features and order types offered to professional traders, improve customer onboarding procedures and implement serious market surveillance capabilities akin to those in securities trading venues in order to detect and punish suspicious trading activity.
Conflicts of Interest	The OAG noted that virtual currency platforms may have conflicts in terms of: (1) the standards applied when considering whether to list virtual assets; (2) compensation that they receive for listing particularly virtual assets; (3) the lack of consistent industry policies and procedures regarding platform employee trading; and (4) the ability of a platform to trade on its venue in a proprietary capacity.	The OAG recommended that virtual currency platforms disclose payments and other compensation that they receive for listing a particular virtual currency. The OAG noted that, while the measures taken to monitor or prevent employee trading on platforms differed, virtual currency platforms should generally make their policies around employee trading more transparent to customers. Although proprietary trading certainly occurs in other markets, the OAG cautioned that customers should be aware that: (1) a platform could be trading on its own account on its own venue on an undisclosed basis; (2) high levels of proprietary trading may raise serious questions about the true available liquidity on a platform; and (3) the platforms may be trading with informational advantages.
Safeguarding Customer Funds	The OAG noted that, although safeguarding customer funds is of paramount importance, the virtual currency platforms that submitted responses did not consistently employ measures to ensure the security of those funds in the platforms’ custody The OAG also noted that industry standards have not yet developed around insurance for virtual currency platforms (i.e., what assets should be insured, against what risks, and at what price). The OAG noted that, although a number of the platforms reported that they have retained outside firms to conduct independent audits, the industry lacked common auditing standards.	The OAG recommended that virtual currency platforms require two-factor identification by default to ensure that customer’s data is secure. The OAG also recommended that platforms make better use of “cold storage” (i.e., a security practice wherein private keys to virtual currency are kept off of the internet). Finally, the OAG recommended that platforms regularly conduct “penetration testing” in order to identify security holes in a platform’s information technology and data security infrastructure. The OAG recommended that customers should demand more information from trading platforms about how those platforms insure risks related to the virtual or fiat currency held within their custody. The OAG recommended that the industry come together to develop common auditing standards for virtual currency platforms.
Access to Customer Funds During Suspensions/Outages	The OAG noted that platforms often fail to detail their procedures for transferring virtual currency from customer accounts to private wallets, or for processing fiat currency withdrawals both under normal market conditions and during a suspension or outage. The platforms that participated in the inquiry had differing policies. The OAG further noted that platforms do not have adequate policies or procedures for suspending trading or delaying pending trades, and the handling of open orders during and immediately following suspension and/or platform outage.	The OAG recommended that customers should familiarize themselves with how pending trades and currency withdrawals are treated under normal market conditions and during a trading suspension or outage.
Disclosure of Historical Outages	The OAG noted that while most platforms notify customers of any trading suspensions or outages, few of the platforms provide full disclosure of past outages or suspensions, and the reasons for those events.	The OAG suggested that customers examine whether a platform provides a history of prior outages and trading interruptions because by doing so it helps customers evaluate historical stability, reliability, and transparency of a venue.

After conducting the general assessment described above, the OAG highlighted its three principal areas of concern:

Virtual Currency Platforms Do Not Disclose or Take Measures to Mitigate Potential Conflicts of Interest. Virtual currency platforms may operate with several conflicts of interest, including: (1) operating several lines of business that would be restricted or carefully regulated if those platforms were exchanges in traditionally regulated markets; (2) receiving fees and other incentives to list particular virtual currencies; (3) having insufficient policies and procedures for limiting access to platforms employees to trade alongside of customers; and (4) engaging in proprietary trading alongside customers when platforms have access to nonpublic information.
Virtual Currency Platforms Do Not Take Serious Efforts to Impede Market Manipulation and Protect Market Integrity. The Report opined that many virtual currency platforms are susceptible to manipulative and fraudulent trading activity. Such platforms lack robust real-time and historical market surveillance capabilities like those found in the securities and commodities and derivatives markets.
Customer Fund Safeguards on Platforms are Limited and Often Illusory. The Report also flagged that virtual currency markets may lack consistent and transparent approaches to ensure the protection of customer funds. While many virtual currency platforms use independent auditors to conduct reviews of the platforms’ holdings, and some platforms have insurance, the scope and sufficiency of the audits and insurance do not provide adequate protections to customers for losses of their virtual or fiat currency.

The OAG reiterated that New York’s virtual currency regulations address many of these concerns and the topics identified in its assessment. The OAG reminded BitLicense registrants that they should be adhering to these requirements already.

III. Conclusion

Although the Report was directed at New York investors and consumers, its assessment principles and recommendations may also establish more generally applicable industry standards. Indeed, platforms operating outside of New York can use the OAG’s assessment and recommendations to enhance and improve their existing operations.

The Report noted that the OAG has made referrals to NYDFS to initiate investigatory proceedings against three platforms that appear to engage in a virtual currency business in New York. The Report may also influence other states and the federal government to consider developing regulations or guidance based on the OAG’s assessment and recommendations.

[1] See Office of the New York State Attorney General, Virtual Markets Integrity Initiative Report, Sept. 18, 2018, available at https://ag.ny.gov/sites/default/files/vmii_report.pdf.

[2] See Office of the New York State Attorney General, Press Release, A.G. Schneiderman Launches Inquiry Into Cryptocurrency “Exchanges”, Apr. 17, 2018, available at https://ag.ny.gov/press-release/ag-schneiderman-launches-inquiry-cryptocurrency-exchanges.

[3] Report, p.2.

[4] See CoinMarketCap, Sept 27, 2018, available at https://coinmarketcap.com/all/views/all/.

[5] See Report p.2 (“there are more than 1,800 different virtual currencies. . . .”); see also CoinMarketCap, Sept. 27, 2018, available at https://coinmarketcap.com/all/views/all/.

[6] See CoinMarketCap, Sept. 27, 2018, available at https://coinmarketcap.com/all/views/all/.

[7] The website CoinMarketCap estimates that there are 14,252 different “markets” for trading cryptocurrencies. See id. The definition of “markets” also includes offline commercial areas or arenas for trading.

[8] Through administrative decisions issued in 2015, the CFTC set forth its interpretation that virtual currencies (which include cryptocurrencies like Bitcoin) are commodities under the Commodity Exchange Act. See In the Matter of: Coinflip, Inc., d/b/a Derivabit, and Francisco Riordan, CFTC Docket No. 15-29, available here.

[9] See, e.g., CFTC Advisory, Customer Advisory: Use Caution When Buying Digital Coins or Tokens, July 16, 2018, available at https://www.cftc.gov/sites/default/files/2018-07/customeradvisory_tokens0718.pdf.

[10] See, e.g., CFTC v. Kantor et al., Civ. Act. No. CV182247, Apr. 17, 2018, available at https://www.cftc.
gov/sites/default/files/2018-04/enfbluebitbancorder041718.pdf.

[11] Georgia, Illinois, Kansas, Massachusetts, Tennessee, Texas and Washington have established streamlined application processes for financial technology firm applicants to obtain money transmitter licenses.

[12] See 23 NYCRR Part 200 (Virtual currencies) (2018).

[13] See https://www.dfs.ny.gov/banking/virtualcurrency.htm.

[14] See id.

[15] See NYSDFS, Guidance on Prevention of Market Manipulation and Other Wrongful Activity, Feb. 7, 2018, available at https://www.dfs.ny.gov/legal/industry/il180207.pdf.

Gibson Dunn’s lawyers are available to assist in addressing any questions you may have regarding these developments. Please contact any member of the Gibson Dunn team, the Gibson Dunn lawyer with whom you usually work in the firm’s Financial Institutions practice group, or the authors:

Arthur S. Long – New York (+1 212-351-2426, along@gibsondunn.com)
Jeffrey L. Steiner – Washington, D.C. (+1 202-887-3632, jsteiner@gibsondunn.com)
Carl E. Kennedy – New York (+1 212-351-3951, ckennedy@gibsondunn.com)

Attorney Advertising: The enclosed materials have been prepared for general informational purposes only and are not intended as legal advice.