Careers

Diversity

With 18 offices, from New York to Los Angeles and Seattle to Orlando, we live and work in communities all over the U.S., collaborating across locations, disciplines and even borders. Our experienced, highly ranked lawyers serve businesses wherever they are and wherever they want to go.

Offices

About Us

Pages

Professionals

Thought leadership: blogs, podcasts, videos, publications, events and news

Insights

Practices & Industries

Pro Bono

Am Law 100 firm with practices in Business, Digital Assets and Data Management, Intellectual Property, Labor & Employment, Litigation and Tax.

Home | BakerHostetler

Sabrina Shadi Shares Wage and Hour Issue to Watch in 2026 for <em>Law360</em> Article

Blockchain Monitor

Blockchain Monitor - Planet earth in outer space with network connection and sunlight.

Weekly Blockchain Monitor – December 15, 2025

Jennifer Mitchell, Will Chuchawat Named as 2025 Leaders of Influence: Thriving in Their 40s

Navigating the New Patchwork of Foreign-Influence Laws (<em>Law360</em>)

<h5>Key Takeaways</h5>
<ul>
 	<li style="list-style-type: none;">
<ul>
 	<li>New York is allocating more resources and devoting more attention to the cryptocurrency industry, which will likely result in increased regulatory oversight, potential new rulemaking, significant sanctions for compliance violations, and an increase in its speed of reviewing BitLicense applications.</li>
</ul>
</li>
</ul>
<ul>
 	<li style="list-style-type: none;">
<ul>
 	<li>A recent consent order where bitFlyer USA’s failure to comply with cybersecurity requirements under New York’s Virtual Currency and Cybersecurity Regulations resulted in a $1.2 million penalty underscores this increasing focus and the potential consequences of noncompliance for licensees.</li>
</ul>
</li>
</ul>
<ul>
 	<li style="list-style-type: none;">
<ul>
 	<li>Cybersecurity compliance is a fundamental compliance task with which the DFS expects every licensee, including BitLicense holders, to comply without exception.</li>
</ul>
</li>
</ul>
On May 1, 2023, the New York State Department of Financial Services (DFS or Department) issued a <a href="https://www.dfs.ny.gov/system/files/documents/2023/05/ea20230502_bitflyer_usa_inc.pdf">consent order</a> (Consent Order), imposing a $1.2 million fine on bitFlyer USA, a cryptocurrency trading platform and custodial wallet service provider.&nbsp; The Consent Order described various alleged failures by bitFlyer USA to establish and maintain an effective cybersecurity program, as required by the DFS’s Virtual Currency and Cybersecurity Regulations.<a title="" href="#_ftn1" name="_ftnref1">[1]</a>&nbsp; This marks the third DFS consent order involving a crypto market actor.&nbsp; While the previous two focused on alleged anti-money laundering failures,<a title="" href="#_ftn2" name="_ftnref2">[2]</a> the bitFlyer USA consent order is significant because it focused exclusively on cybersecurity violations, which remain a DFS priority.
<h5>BitLicense Cybersecurity Requirements</h5>
DFS is the primary regulator of financial services in New York State, including licensing and overseeing financial institutions within the state.&nbsp; In 2014, DFS proposed rules and regulations requiring businesses engaged in certain cryptocurrency activities in the state to apply for a “BitLicense” through DFS (23 NYCRR Part 200, the “Virtual Currency Regulation”).<a title="" href="#_ftn3" name="_ftnref3">[3]</a>&nbsp; In response to concerns from businesses subject to the BitLicense requirement, DFS subsequently revised its practices with respect to BitLicense applications in 2020.<a title="" href="#_ftn4" name="_ftnref4">[4]</a>&nbsp; New York State’s Cybersecurity Regulation, 23 NYCRR 500, became effective in 2017.

Businesses seeking to obtain a BitLicense from DFS must undergo an application process that includes a comprehensive review of the applicant’s business, compliance program, personnel, security measures, and accounting.<a title="" href="#_ftn5" name="_ftnref5">[5]</a>&nbsp; Among other requirements, under New York’s Virtual Currency and Cybersecurity Regulations, BitLicense licensees are required to establish and maintain cybersecurity programs that are designed to protect the confidentiality, integrity, and availability of their information systems, as well as any nonpublic information contained within those systems.<a title="" href="#_ftn6" name="_ftnref6">[6]</a>&nbsp; The Cybersecurity Regulations require entities like bitFlyer USA to “conduct periodic risk assessment[s] as necessary to address changes to [its] information systems, [nonpublic information], or business operations.”<a title="" href="#_ftn7" name="_ftnref7">[7]</a> &nbsp;Under the Virtual Currency Regulation, BitLicense holders are required to establish and maintain “an effective cybersecurity program to ensure the availability and functionality of the licensee’s electronic systems and to protect those systems and any sensitive data stored on those systems from unauthorized access, use, or tampering.”<a title="" href="#_ftn8" name="_ftnref8">[8]</a>
<h5>DFS’s Examination and Findings Regarding bitFlyer USA</h5>
bitFlyer USA was granted a BitLicense on November 27, 2017.&nbsp; DFS conducted examinations of bitFlyer USA in 2018 and 2020.&nbsp; Over the course of its examination period, DFS found that bitFlyer “failed to meet its regulatory obligations both by failing to fully comply with the Department’s Cybersecurity Regulation and by failing to establish and maintain an effective cybersecurity program via the implementation of written policies, as required by the Virtual Currency Regulation.”&nbsp; The Consent Order cited the following specific compliance deficiencies during the time period of the DFS examinations:
<ul>
 	<li style="list-style-type: none;">
<ul>
 	<li>Failure to perform periodic assessments of internal and external cybersecurity risks and threats, and improper reliance on an information technology audit in place of a cybersecurity risk assessment; and</li>
</ul>
</li>
</ul>
<ul>
 	<li style="list-style-type: none;">
<ul>
 	<li>Failure to implement a cybersecurity program designed “to protect its electronic systems, and the information stored on those systems from unauthorized access, use, or other malicious acts” because its written cybersecurity policy was not approved by its board of directors or tailored to its organizational structure and associated risks.</li>
</ul>
</li>
</ul>
According to the Consent Order, during the course of the DFS investigation, bitFlyer USA performed a comprehensive review of its current compliance programs with respect to the Virtual Currency and Cybersecurity Regulations.&nbsp; Based on this review, bitFlyer USA presented a remediation plan designed to bring bitFlyer USA into compliance by December 31, 2023.&nbsp; DFS approved the remediation plan, which requires quarterly progress reports to DFS.&nbsp; Notably, the $1.2 million penalty credits bitFlyer USA for its cooperation and remediation efforts, indicating DFS could have levied an even larger civil penalty for these violations.
<h5>New York’s Increased Focus on Cryptocurrency Businesses</h5>
Recent events indicate cryptocurrency businesses operating in New York State should take steps to prepare for increased oversight, and potentially new laws or regulations governing their activities.&nbsp; On April 25, in testimony before the New York State Senate Standing Committee on Banks, Virtual Currency Chief Peter Marton said DFS is increasing the resources allocated to regulation and oversight of the cryptocurrency industry,<a title="" href="#_ftn9" name="_ftnref9">[9]</a> including strengthening its licensing program, increasing staff, and implementing new technology, with the goal of protecting both cryptocurrency businesses and their customers.<a title="" href="#_ftn10" name="_ftnref10">[10]</a>&nbsp; The increased staff is also expected to increase the speed at which BitLicense applications are reviewed.&nbsp; Virtual Currency Chief Marton testified that DFS has approved only four licenses in the past 15 months and that the BitLicense queue “remains high,” and that since his appointment in January 2022, more than 40 examiner-trainees have been added to the virtual currency unit.&nbsp; He further testified that the “most important consumer protection is often not one written in the black and white letter of the law, but to have a nimble regulator who understands the space and has the flexibility and agility to respond to industry developments as they arise.”

Additionally, on May 5, the New York Attorney General independently <a href="https://ag.ny.gov/press-release/2023/attorney-general-james-proposes-nation-leading-regulations-cryptocurrency">announced</a> new proposed legislation that would increase oversight of the cryptocurrency industry, provide the Attorney General with broader enforcement authority, and codify the DFS’s authority to license participants in the industry.<a title="" href="#_ftn11" name="_ftnref11">[11]</a> &nbsp;The Crypto Regulation, Protection, Transparency, and Oversight Act (CRPTO Act) “seeks to protect New York investors by bringing regulations and oversight that are applied to other financial services to the cryptocurrency industry” as well as address other issues unique to the industry. &nbsp;Among other things, the CRPTO Act would seek to (1) stop conflicts of interest by placing certain prohibitions on specific industry players such as marketplaces, issuers, and brokers; (2) require public reporting of financial statements by cryptocurrency companies; and (3) bolster investor protections by enacting “know-your-customer” provisions and “banning the use of the term ‘stablecoin’” unless a digital asset is backed 1:1 with U.S. currency or other high-quality assets as defined by federal regulations.&nbsp; Through the bill, the Attorney General’s Office also seeks discretion to enforce cryptocurrency firms’ violations, including the power to issue subpoenas, impose civil penalties, and shutter those businesses that engage in fraud and illegality.&nbsp; In particular, the proposed penalties for violations under the bill are $10,000 per violation per individual and $100,000 per violation per firm as well as restitution, damages, and penalties.&nbsp; Given all this, the proposed CRPTO Act further demonstrates the increased focus on regulating cryptocurrency activities in the New York State.
<h5>Conclusion</h5>
As New York regulators work to strengthen and proactively evolve virtual currency regulation, digital asset businesses operating in New York should ensure that their cybersecurity programs comply with the requirements of New York’s Virtual Currency and Cybersecurity Regulations or risk facing substantial penalties.&nbsp; BitLicense licensees and applicants should establish an ongoing working relationship with DFS and focus on the continuous improvement of their compliance programs, especially as new risks and regulatory priorities arise in the fast-paced cryptocurrency market.&nbsp; Additionally, as New York lawmakers consider new proposed laws and regulations, cryptocurrency market actors should understand the implications for their businesses and consider taking proactive steps to engage with lawmakers to educate them on potential unintended consequences of proposed regulation and prepare for new requirements.

The BakerHostetler White Collar, Investigations, and Securities Enforcement and Litigation; Blockchain Technologies and Digital Assets; Federal Policy; and International Trade – Export Controls and Economic Sanctions teams are composed of dozens of experienced individuals, including attorneys who have served in the Department of Justice, the SEC, and Congress.&nbsp; Our attorneys include former U.S. attorneys, branch chiefs, and unit chiefs as well as partners who have served in the SEC’s Division of Enforcement and the SEC’s Office of the General Counsel, and attorneys with extensive experience across all sectors of the blockchain and cryptocurrency markets, including investigations, BSA/AML/CFT and sanctions compliance, tax, privacy, transactions, intellectual property, media and technology design, federal legislation, congressional oversight, investigations, and public policy.&nbsp; Please feel free to contact any of our experienced professionals if you have questions about this alert.
<div>

<hr>

<div id="ftn1">

<a title="" href="#_ftnref1" name="_ftn1">[1]</a> <a href="https://www.dfs.ny.gov/system/files/documents/2023/05/ea20230502_bitflyer_usa_inc.pdf">https://www.dfs.ny.gov/system/files/documents/2023/05/ea20230502_bitflyer_usa_inc.pdf</a>

</div>
<div id="ftn2">

<a title="" href="#_ftnref2" name="_ftn2">[2]</a> The first such consent order was published on August 1, 2022, between DFS and a large consumer trading platform. BakerHostetler, New York State Department of Financial Services Publishes First Crypto Industry Consent Order (Aug. 11, 2022), https://www.bakerlaw.com/alerts/new-york-department-of-financial-services-publishes-first-crypto-industry-consent-order. &nbsp;The second consent order was published on January 4, 2023, between DFS and a crypto exchange. &nbsp;BakerHostetler, US Crypto Exchange Consents to $100M DFS Settlement for AML Compliance Failures (Jan. 12, 2023), https://www.bakerlaw.com/alerts/us-crypto-exchange-consents-100m-dfs-settlement-aml-compliance-failures.

</div>
<div id="ftn3">

<a title="" href="#_ftnref3" name="_ftn3">[3]</a> BakerHostetler, The Empire Strikes Back: New York Proposes Rules for Virtual Currency (Aug. 7, 2014), https://www.bakerlaw.com/alerts/the-empire-state-strikes-back-new-york-proposes-rules-for-virtual-currency

</div>
<div id="ftn4">

<a title="" href="#_ftnref4" name="_ftn4">[4]</a> <a href="https://www.dfs.ny.gov/industry_guidance/industry_letters/il20200624_notice_vc_busact_lic_app_procedure">https://www.dfs.ny.gov/industry_guidance/industry_letters/il20200624_notice_vc_busact_lic_app_procedure</a>

</div>
<div id="ftn5">

<a title="" href="#_ftnref5" name="_ftn5">[5]</a> Public Hearing to Educate Legislators and the Public on Cryptocurrency, Discuss Regulation of FinTech Companies, and Discuss FinTech Licensing Legislation, S.1450 (N.Y. April 25, 2023) (testimony of Deputy Superintendent Peter Marton), available at <a href="https://www.youtube.com/watch?v=Jlq1IPrzAuQ">https://www.youtube.com/watch?v=Jlq1IPrzAuQ</a>

</div>
<div id="ftn6">

<a title="" href="#_ftnref6" name="_ftn6">[6]</a> Consent Order, In the matter of bitFlyer USA Inc. (May 1, 2023), <a href="https://www.dfs.ny.gov/system/files/documents/2023/05/ea20230502_bitflyer_usa_inc.pdf">https://www.dfs.ny.gov/system/files/documents/2023/05/ea20230502_bitflyer_usa_inc.pdf </a>

</div>
<div id="ftn7">

<a title="" href="#_ftnref7" name="_ftn7">[7]</a> Consent Order, supra note 6; see 23 NYCRR 500.09(a).

</div>
<div id="ftn8">

<a title="" href="#_ftnref8" name="_ftn8">[8]</a> Consent Order, supra note 6; see 23 NYCRR 200.16.

</div>
<div id="ftn9">

<a title="" href="#_ftnref9" name="_ftn9">[9]</a> <em>Public Hearing to Educate Legislators and the Public on Cryptocurrency, Discuss Regulation of FinTech Companies, and Discuss FinTech Licensing Legislation</em>, S.1450 (N.Y. April 25, 2023) (testimony of Deputy Superintendent Peter Marton), available at <a href="https://www.youtube.com/watch?v=Jlq1IPrzAuQ">https://www.youtube.com/watch?v=Jlq1IPrzAuQ</a>

</div>
<div id="ftn10">

<a title="" href="#_ftnref10" name="_ftn10">[10]</a> <em>Public Hearing to Educate Legislators and the Public on Cryptocurrency, Discuss Regulation of FinTech Companies, and Discuss FinTech Licensing Legislation</em>, S.1450 (N.Y. April 25, 2023) (testimony of Deputy Superintendent Peter Marton), available at <a href="https://www.youtube.com/watch?v=Jlq1IPrzAuQ">https://www.youtube.com/watch?v=Jlq1IPrzAuQ</a>

</div>
<div id="ftn11">

<a title="" href="#_ftnref11" name="_ftn11">[11]</a> N.Y. Attorney General, Press Release, <em>Attorney General James Proposes Nation-Leading Regulations on Cryptocurrency Industry</em> (May 5, 2023),<em> available at</em> https://ag.ny.gov/press-release/2023/attorney-general-james-proposes-nation-leading-regulations-cryptocurrency

</div>
</div>

NYS DFS Focuses on Cybersecurity Violations and Increasing Crypto Resources

Featured Insights