Bitpay, a bitcoin service provider, has agreed to settle the New York Financial Services Department for failing to comply with anti-money laundering legislation and cybersecurity regulations.
Bitpay Is Licenced By The New York Department Of Financial Services
In 2018, Bitpay had earlier secured its Virtual Currency License from the New York Department of Financial Services (NYDFS). Hence, Bitpay is allowed to conduct business with firms and consumers in New York. They are expected to abide to the Federal and New York rules and regulations so as to maintain effective control, and protect against money laundering and other illegal actions.
Before Bitpay was granted Licence by the Department of Financial Services (DFS) in 2018, DFS conducted a comprehensive review of BitPay’s application, including the company’s anti-money laundering, anti-fraud, capitalization, consumer protection, and cybersecurity policies. However, as part of the regulator’s duties, Bitpay is subject to ongoing supervision by DFS.
The New York State Department of Financial Services (NYDFS) Conducted Full Scope Investigations of Bitpay
The Department of Financial Services (DFS) conducted its first full-scope investigation of Bitpay as part of it’s regulatory obligations. The first investigation covered the period of July 2018 through December 2018. The DFS discovered deficiencies in Bitpay’s entire compliance function after the investigation. Hence, the regulatory body urged Bitpay to improve in its Anti-money Laundering Laws (AML) and Cybersecurity programs in order to achieve compliance with the applicable regulatory requirements.
In addition, The DFS conducted a second investigation on Bitpay covering the years between January 1, 2019, and December 31, 2021. Hence, after conducting this second full-scope examination of BitPay in 2022 (the “Second Examination”), the Department found that while improvements had been made to address the issues found during the First Examination, BitPay’s AML program and its cybersecurity program still needed to be improved in order to be in compliance with the relevant regulatory requirements.
BitPay violated the following sections of the Virtual Currency Regulation:
(1) 23 NYCRR 200.15(c), which requires Licensees to create a system of internal controls, policies, and procedures to ensure compliance with applicable AML laws, rules, and regulations, as well as to create independent testing to ensure such compliance; and
(2) 23 NYCRR 200.15(i), which requires Licensees to create risk-based policies, procedures, and practices designed to ensure compliance.
The discovered flaws in BitPay’s AML supervision show that:
- BitPay did not set up the necessary internal controls, policies, and processes as required by 23 NYCRR 200.15(c)(1).
- BitPay did not conduct adequate independent testing of its transaction monitoring system to guarantee that it functioned as planned.
- BitPay’s first screening procedure was unable to recognize several names from the most recent penalty listing.
- BitPay also failed to develop an OFAC quality assurance mechanism, particularly with regard to alert dispositions.
BitPay violated the following sections of the Cybersecurity Regulation:
(1) 23 NYCRR 500.04, which mandates that Covered Entities formally name “a qualified individual responsible for overseeing and implementing the covered entity’s cybersecurity program and enforcing its cybersecurity policy” (a “Chief Information Security Officer” or “CISO”), who must submit an annual written report to the Covered Entity’s board of directors on the Covered Entity’s cybersecurity program.
(2) Covered Entities must regularly undertake a Risk Assessment of their Information Systems in accordance with 23 NYCRR 500.09(a), which must be adequate to guide the development of the cybersecurity program.
The discovered flaws in BitPay’s Cybersecurity supervision show that:
- BitPay only performed one risk assessment, dubbed the “2021 Risk 7 Assessment,” in March 2021, years after receiving its original license from the Department on July 10, 2018.
- BitPay violated Part 500.04(a) by delaying the official designation of a CISO until May 2022.
- In contravention of Part 500.04(b), no one, much less a duly appointed CISO, was submitting an annual written report to BitPay’s board of directors on its cybersecurity program and the significant cybersecurity threats it faces.
Hence, In order to rectify this breach, the regulatory authority mandated that BitPay complete a risk assessment of its company’s information system on a regular basis.
Bitpay Was Charged For Historical Shortcomings in Their Regulatory Programs, a Lesson For Compliance Officers
In a statement made by Stephen Pair, the CEO of BitPay, to Blockworks. “BitPay has fully cooperated with the NYSDFS and is pleased to have resolved this matter. The settlement concerned historical shortcomings in BitPay’s regulatory programs identified in a 2018 and 2021 examination conducted by NYDFS.”
This is an interesting case study for Crypto Compliance Officers. There’s a need for proper record keeping and adherence to laid down compliance policies and regulations.
Bitpay’s Settlement With New York Financial Services Department (NYFSD)
Bitpay was ordered by the New York Financial Services Department (NYFSD) to pay a total civil monetary penalty of $1,000,000 as part of the agreement to resolve the issues identified without further litigation.
Bitpay shall not seek or make any claim for a tax credit or deduction. With respect to any amount of the civil monetary penalty paid in accordance with this consent order, whether paid directly or indirectly, with regard to any U.S. federal, state, or municipal taxes. Also, the company must not, directly or indirectly, seek or accept any indemnity or reimbursement with respect to the payment of the penalty amount, including, but not limited to, any payment made in reliance upon any insurance policy.
The New York Financial Services Department appreciated BitPay’s assistance during the investigation. It also applauded BitPay’s continued initiatives to address the issues raised in this Consent Order. As one example, BitPay has committed considerable financial and other resources to improving its AML and cybersecurity operations, including through adjustments to its rules, procedures, systems, and governance structures.
Among other things, Bitpay has proved its commitment to remediation, and it is scheduled to provide a detailed action plan to the Department of Financial Services by September 16th, 2023.
Conclusion
As a Web3 start-up or cryptocurrency exchange, it is vital to follow regulatory bodies’ laws and regulations in order to avoid sanctions or penalties. In addition, you need a Crypto Compliance Officer that understands these rules and regulations to assist you manage your Crypto Compliance Department.
Cybersecurity is part of compliance and should not be taken for granted. Ensure you have a CISO designated for proper risk assessments and reporting.
If you are worried about how to go about ensuring you are compliant and avoid regulatory pitfalls, consult with us at A&D Forensics. Our Compliance as a Service, CaaS solution is robust enough to ensure that your cryptocurrency exchange and Web 3 Start-up is compliant from bottom up.
Contributor: Loveth Odije
