Skip links
Bitpay Agrees To Settle New York's Financial Services Department

BITPAY Agrees To Settle New York’s Financial Services Department

Bitpay, a bitcoin service provider, has agreed to settle the New York Financial Services Department for failing to comply with anti-money laundering legislation and cybersecurity regulations.

Bitpay Is Licenced By The New York Department Of Financial Services

In 2018, Bitpay had earlier secured its Virtual Currency License from the New York Department of Financial Services (NYDFS). Hence, Bitpay is allowed to conduct business with firms and consumers in New York. They are expected to abide to the Federal and New York rules and regulations so as to maintain effective control, and protect against money laundering and other illegal actions.

Before Bitpay was granted Licence by the Department of Financial Services (DFS) in 2018, DFS conducted a comprehensive review of BitPay’s application, including the company’s anti-money laundering, anti-fraud, capitalization, consumer protection, and cybersecurity policies. However, as part of the regulator’s duties, Bitpay is subject to ongoing supervision by DFS.

 The New York State Department of Financial Services (NYDFS) Conducted Full Scope Investigations of Bitpay

The Department of Financial Services (DFS) conducted its first full-scope investigation of Bitpay as part of it’s regulatory obligations. The first investigation covered the period of July 2018 through December 2018. The DFS discovered deficiencies in Bitpay’s entire compliance function after the investigation. Hence, the regulatory body urged Bitpay to improve in its Anti-money Laundering Laws (AML) and Cybersecurity programs in order to achieve compliance with the applicable regulatory requirements.

In addition, The DFS conducted a second investigation on Bitpay covering the years between January 1, 2019, and December 31, 2021. Hence, after conducting this second full-scope examination of BitPay in 2022 (the “Second Examination”), the Department found that while improvements had been made to address the issues found during the First Examination, BitPay’s AML program and its cybersecurity program still needed to be improved in order to be in compliance with the relevant regulatory requirements.

BitPay violated the following sections of the Virtual Currency Regulation:

 (1) 23 NYCRR 200.15(c), which requires Licensees to create a system of internal controls, policies, and procedures to ensure compliance with applicable AML laws, rules, and regulations, as well as to create independent testing to ensure such compliance; and
(2) 23 NYCRR 200.15(i), which requires Licensees to create risk-based policies, procedures, and practices designed to ensure compliance. 

The discovered flaws in BitPay’s AML supervision show that:

  1. BitPay did not set up the necessary internal controls, policies, and processes as required by 23 NYCRR 200.15(c)(1).
  2. BitPay did not conduct adequate independent testing of its transaction monitoring system to guarantee that it functioned as planned.
  3. BitPay’s first screening procedure was unable to recognize several names from the most recent penalty listing.
  4. BitPay also failed to develop an OFAC quality assurance mechanism, particularly with regard to alert dispositions.

BitPay violated the following sections of the Cybersecurity Regulation:

(1) 23 NYCRR 500.04, which mandates that Covered Entities formally name “a qualified individual responsible for overseeing and implementing the covered entity’s cybersecurity program and enforcing its cybersecurity policy” (a “Chief Information Security Officer” or “CISO”), who must submit an annual written report to the Covered Entity’s board of directors on the Covered Entity’s cybersecurity program.

(2) Covered Entities must regularly undertake a Risk Assessment of their Information Systems in accordance with 23 NYCRR 500.09(a), which must be adequate to guide the development of the cybersecurity program.

The discovered flaws in BitPay’s Cybersecurity supervision show that:

  1. BitPay only performed one risk assessment, dubbed the “2021 Risk 7 Assessment,” in March 2021, years after receiving its original license from the Department on July 10, 2018.
  2. BitPay violated Part 500.04(a) by delaying the official designation of a CISO until May 2022.
  3. In contravention of Part 500.04(b), no one, much less a duly appointed CISO, was submitting an annual written report to BitPay’s board of directors on its cybersecurity program and the significant cybersecurity threats it faces.

Hence, In order to rectify this breach, the regulatory authority mandated that BitPay complete a risk assessment of its company’s information system on a regular basis.

Bitpay Was Charged For Historical Shortcomings in Their Regulatory Programs, a Lesson For Compliance Officers

In a statement made by Stephen Pair, the CEO of BitPay, to Blockworks. “BitPay has fully cooperated with the NYSDFS and is pleased to have resolved this matter. The settlement concerned historical shortcomings in BitPay’s regulatory programs identified in a 2018 and 2021 examination conducted by NYDFS.”

This is an interesting case study for Crypto Compliance Officers. There’s a need for proper record keeping and adherence to laid down compliance policies and regulations.

Bitpay’s Settlement With New York Financial Services Department (NYFSD)

Bitpay was ordered by the New York Financial Services Department (NYFSD) to pay a total civil monetary penalty of $1,000,000 as part of the agreement to resolve the issues identified without further litigation.

Bitpay shall not seek or make any claim for a tax credit or deduction. With respect to any amount of the civil monetary penalty paid in accordance with this consent order, whether paid directly or indirectly, with regard to any U.S. federal, state, or municipal taxes. Also, the company must not, directly or indirectly, seek or accept any indemnity or reimbursement with respect to the payment of the penalty amount, including, but not limited to, any payment made in reliance upon any insurance policy.

The New York Financial Services Department appreciated BitPay’s assistance during the investigation. It also applauded BitPay’s continued initiatives to address the issues raised in this Consent Order. As one example, BitPay has committed considerable financial and other resources to improving its AML and cybersecurity operations, including through adjustments to its rules, procedures, systems, and governance structures.

Among other things, Bitpay has proved its commitment to remediation, and it is scheduled to provide a detailed action plan to the Department of Financial Services by September 16th, 2023.


As a Web3 start-up or cryptocurrency exchange, it is vital to follow regulatory bodies’ laws and regulations in order to avoid sanctions or penalties. In addition, you need a Crypto Compliance Officer that understands these rules and regulations to assist you manage your Crypto Compliance Department.

Cybersecurity is part of compliance and should not be taken for granted. Ensure you have a CISO designated for proper risk assessments and reporting.

If you are worried about how to go about ensuring you are compliant and avoid regulatory pitfalls, consult with us at A&D Forensics. Our Compliance as a Service, CaaS solution is robust enough to ensure that your cryptocurrency exchange and Web 3 Start-up is compliant from bottom up.

Contributor: Loveth Odije

This website uses cookies to improve your web experience.
On-Site Certified Cryptocurrency Investigator (CCI) Training

Learn how cryptocurrency related transactions, crimes are tracked, traced and prosecuted.

Certified Cryptocurrency Investigator Virtual Training

Learn how cryptocurrency related transactions, crimes are tracked, traced and prosecuted.


Learn how compliance could be a competitive advantage to your exchanges with all your AML, CTF, KYC and OFAC requirements.

By becoming an early bird for each cohort or leveraging our partner firms, you can obtain up to a 25% discount, contact us for more details.

Smart Contract Audit

To speak to us regarding Smart Contract Audit, please fill the form below. We will make every attempt to respond to you as soon as possible

Call Direct: +2348036180089 | +2349095503040

Get in touch

To speak with us as regards our services, to make comments and ask questions, please fill the form below. We will reply as soon as possible.

Call Direct: +2348036180089 | +2349095503040


Chioma Onyekelu is a highly skilled and accomplished professional in the field of cryptocurrency and blockchain technology. She is a Certified Cryptocurrency Investigator and Crypto Compliance Specialist, as well as a Blockchain Forensic Specialist and a teacher. She is also a public speaker and her teachings include consultations and practical solutions for African Start-ups on the best and most cost-effective way to build with compliance in mind. With a wealth of knowledge and experience in these cutting-edge technologies, she is well-equipped to navigate the complex landscape of cryptocurrency-related crimes.

In her current role as a Blockchain Forensic Specialist at A&D Forensics, Chioma is responsible for tracing and investigating cryptocurrency-related crimes, as well as training law enforcement agents and compliance officers on the latest developments and best practices in the field. In addition, she is currently pursuing a Master's degree in Blockchain and Digital Currencies at the University of Nicosia in Cyprus, further solidifying her expertise and understanding of the technology.

Chioma's dedication and passion for the field is evident in her work, and she is committed to staying at the forefront of developments in cryptocurrency and blockchain technology to provide the best possible service to her clients. Her exceptional skills in educating and consulting make her a valuable asset to the industry and an authority in the field of Blockchain and Crypto Compliance.


Adedeji is a Forensic Investigation Practitioner and CertifiedBlockchain/Cryptocurrency Forensic
Investigator (CFE, CCI, CCFI & Reactor Certified) with more than Fifteen years of experience across few banks within the Nigeria Financial Sector and educator in Corporate workplace settings, Deji is uniquely qualified and involved in forensics analysis of Financial Infractions, Cryptocurrency crimes and designing plans that works for Government, Regulators, Law enforcement.

He was appointed by SEC Nigeria as Member Virtual Asset and Fintech Regulatory framework drafting Committee, He is a member of Global Digital Finance’s KYC/AML working group in France and a member of the Industry led Thinktank that worked on and came out with FATF cryptocurrency Travel rule InterMessaging Standard for Virtual Assets (IVMS101) to help combat money laundering and terrorism financing using cryptocurrencies around the globe.

His law enforcement training efforts on new money and cybercrime have seen him train many law enforcement agents in various countries i.e Nigeria Police, Nigeria Army CyberWarfare command, Zambia Financial Intelligence Unit, Zambia Central Bank and more.
He is Chainalysis Sole Africa Investigative Partner helping law enforcement investigate criminal organizations using cryptocurrency to conceal illiccit activities across Africa, he is also a training Partner for Blockchain Intelligence Group based out of Canada.

Cryptocurrency Investigation Training

Learn how cryptocurrency related transactions, crimes are tracked,
traced and prosecuted.