Law / United States / 
New York
New York Department of Financial Services Virtual Currency Regulation, Cyber Security Program
In force since .
A sector security regimes rule binding private bodies.
- Instrument type
- a regulation made under an act
- Obligation class
- Security, Governance
As of .
What it requires
- It reaches you if you hold a license from the Superintendent of Financial Services under 23 NYCRR Part 200 (a Licensee), which Part 200 requires of anyone who would engage in Virtual Currency Business Activity involving New York or a New York Resident: receiving Virtual Currency for transmission or transmitting it, storing, holding or maintaining custody or control of it on behalf of others, buying and selling it as a customer business, performing exchange services as a customer business, or controlling, administering or issuing a Virtual Currency (reached by declaring that you are a crypto-asset provider). Persons chartered under the New York Banking Law and approved by the superintendent to engage in that activity are exempt from the licensing requirement, as are merchants and consumers that use Virtual Currency solely to buy or sell goods or services or for investment, and the development and dissemination of software in and of itself is not Virtual Currency Business Activity.
- Establish and maintain an effective cyber security program to ensure the availability and functionality of your electronic systems and to protect those systems and any sensitive data stored on them from unauthorized access, use, or tampering.
- Design the program to perform five core functions: identify internal and external cyber risks (at a minimum, the information stored on your systems, its sensitivity, and how and by whom it may be accessed); protect your electronic systems and the information on them through defensive infrastructure, policies and procedures; detect systems intrusions, data breaches, unauthorized access, malware and other Cyber Security Events; respond to detected events to mitigate negative effects; and recover from them and restore normal operations and services.
- Implement a written cyber security policy setting out your policies and procedures for protecting your electronic systems and the customer and counterparty data stored on them, reviewed and approved by your board of directors or equivalent governing body at least annually.
- Address in the policy: information security; data governance and classification; access controls; business continuity and disaster recovery planning and resources; capacity and performance planning; systems operations and availability concerns; systems and network security; systems and application development and quality assurance; physical security and environmental controls; customer data privacy; vendor and third-party service provider management; monitoring and implementing changes to core protocols not directly controlled by you, as applicable; and incident response.
- Designate a qualified employee as your Chief Information Security Officer (CISO), responsible for overseeing and implementing the cyber security program and enforcing the cyber security policy.
- Submit to the Department of Financial Services, at least annually, a report prepared by the CISO and presented to your board of directors or equivalent governing body, assessing the availability, functionality and integrity of your electronic systems, identifying relevant cyber risks, assessing the cyber security program, and proposing steps for the redress of any inadequacies identified.
- Conduct penetration testing of your electronic systems at least annually and vulnerability assessment of those systems at least quarterly.
- Maintain audit trail systems that track and maintain data allowing the complete and accurate reconstruction of all financial transactions and accounting, protect the integrity of that data and of the hardware from alteration or tampering, log system events (at a minimum, access to and alterations of the audit trail systems and all system administrator functions), and keep the audit trail records under the recordkeeping requirements of Part 200.
- Keep written procedures, guidelines and standards reasonably designed to ensure the security of all applications you use, and have the CISO review, assess and update them at least annually.
- Employ cyber security personnel adequate to manage your cyber security risks and perform the five core functions, provide and require them to attend regular cyber security update and training sessions, and require key cyber security personnel to stay abreast of changing threats and countermeasures.
These lines are LexLint's reading of the law's text, as of .
Who enforces it
Enforcement body
The Superintendent of Financial Services, who may suspend or revoke a license issued under Part 200 for a violation of any provision of Part 200.
What this law does
Section 200.16 of 23 NYCRR Part 200 requires each Licensee to establish and maintain an effective cyber security program to ensure the availability and functionality of its electronic systems and to protect those systems and the sensitive data on them from unauthorized access, use, or tampering.
The program must be designed to perform five core cyber security functions: identifying internal and external cyber risks, protecting the electronic systems, detecting Cyber Security Events, responding to them, and recovering from them. A Licensee must implement a written cyber security policy that its board of directors or equivalent governing body reviews and approves at least annually.
The cyber security policy must address thirteen areas, from information security and data governance to vendor management and incident response. A Licensee must designate a qualified employee as its Chief Information Security Officer, responsible for overseeing and implementing the cyber security program and enforcing the cyber security policy.
A Licensee must submit to the Department of Financial Services, at least annually, a report prepared by its Chief Information Security Officer and presented to its board of directors or equivalent governing body. A Licensee must conduct penetration testing of its electronic systems at least annually and vulnerability assessment of those systems at least quarterly.
A Licensee must maintain audit trail systems that track and maintain data allowing the complete and accurate reconstruction of all financial transactions and accounting. A Licensee must keep written procedures, guidelines, and standards reasonably designed to ensure the security of all applications it uses, and its Chief Information Security Officer must review, assess, and update them at least annually.
A Licensee must employ cyber security personnel adequate to manage its cyber security risks, require them to attend regular update and training sessions, and require key personnel to stay abreast of changing threats and countermeasures. Section 200.2 defines a Licensee as a Person duly licensed by the superintendent under Part 200.
Section 200.2 defines Virtual Currency Business Activity as conduct involving New York or a New York Resident of any one of five types, including storing or holding Virtual Currency for others, buying and selling it as a customer business, and performing exchange services as a customer business. Section 200.2 provides that the development and dissemination of software in and of itself does not constitute Virtual Currency Business Activity.
Section 200.3 prohibits any Person from engaging in Virtual Currency Business Activity without a license obtained from the superintendent. Section 200.3 exempts from the licensing requirement Persons chartered under the New York Banking Law and approved by the superintendent to engage in Virtual Currency Business Activity, and merchants and consumers that use Virtual Currency solely for the purchase or sale of goods or services or for investment purposes.
The superintendent may suspend or revoke a license issued under Part 200 for a violation of any provision of Part 200. Section 200.16 took effect on .
When LexLint raises it
When your app profile says your app is a crypto-asset provider.