Law / United States / 
New York
New York Department of Financial Services Virtual Currency Regulation, Business Continuity and Disaster Recovery
In force since .
A sector security regimes rule binding private bodies.
- Instrument type
- a regulation made under an act
- Obligation class
- Security, Governance, Reporting
As of .
What it requires
- It reaches you if you hold a license from the Superintendent of Financial Services under 23 NYCRR Part 200 (a Licensee), which Part 200 requires of anyone who would engage in Virtual Currency Business Activity involving New York or a New York Resident: receiving Virtual Currency for transmission or transmitting it, storing, holding or maintaining custody or control of it on behalf of others, buying and selling it as a customer business, performing exchange services as a customer business, or controlling, administering or issuing a Virtual Currency (reached by declaring that you are a crypto-asset provider). Persons chartered under the New York Banking Law and approved by the superintendent to engage in that activity are exempt from the licensing requirement, as are merchants and consumers that use Virtual Currency solely to buy or sell goods or services or for investment, and the development and dissemination of software in and of itself is not Virtual Currency Business Activity.
- Establish and maintain a written business continuity and disaster recovery (BCDR) plan reasonably designed to ensure the availability and functionality of your services in the event of an emergency or other disruption to your normal business activities.
- Include in the plan, at a minimum: identification of the documents, data, facilities, infrastructure, personnel and competencies essential to your continued operations; the supervisory personnel responsible for implementing each aspect of the plan; a plan to communicate with essential persons (employees, counterparties, regulatory authorities, data and communication providers, disaster recovery specialists and others essential to recovery) during an emergency or disruption; procedures for maintaining back-up facilities, systems and infrastructure and alternative staffing and other resources so you can recover data and documentation and resume operations as soon as reasonably possible; procedures for backing up or copying essential documents and data with sufficient frequency and storing the information off site; and identification of the third parties necessary to your continued operations.
- Distribute a copy of the plan, and any revisions, to all relevant employees, and maintain copies at one or more accessible off-site locations.
- Provide relevant training to all employees responsible for implementing the plan on their roles and responsibilities.
- Promptly notify the Superintendent of Financial Services of any emergency or other disruption to your operations that may affect your ability to fulfill regulatory obligations or that may have a significant adverse effect on you, your counterparties, or the market.
- Have the plan tested at least annually by qualified, independent internal personnel or a qualified third party, and revise it accordingly.
These lines are LexLint's reading of the law's text, as of .
Who enforces it
Enforcement body
The Superintendent of Financial Services, who may suspend or revoke a license issued under Part 200 for a violation of any provision of Part 200.
What this law does
Section 200.17 of 23 NYCRR Part 200 requires each Licensee to establish and maintain a written business continuity and disaster recovery plan reasonably designed to ensure the availability and functionality of its services in the event of an emergency or other disruption.
The plan must, at a minimum, identify the essential documents, data, facilities, infrastructure, personnel, and competencies, name the supervisory personnel responsible for each aspect, and include a communications plan, back-up and off-site storage procedures, and a list of necessary third parties. A Licensee must distribute a copy of the plan, and any revisions, to all relevant employees and keep copies at one or more accessible off-site locations.
A Licensee must give relevant training on their roles and responsibilities to all employees responsible for implementing the plan. A Licensee must promptly notify the superintendent of any emergency or other disruption to its operations that may affect its ability to fulfill regulatory obligations or that may have a significant adverse effect on the Licensee, its counterparties, or the market.
A qualified independent internal person or a qualified third party must test the plan at least annually, and the plan must be revised accordingly. Section 200.17 took effect on .
When LexLint raises it
When your app profile says your app is a crypto-asset provider.