BitLicense: It’s not just for New Yorkers

This post originally appeared on the Engine.is blog.

We’ve one month to go until the grace period ends and the BitLicense—New York’s new digital currency regulations—comes into full effect. What’s a BitLicense? The short of it is don’t get caught engaging in virtual currency business activity with a New York resident or visitor without one after August 8th!

If that sentence reads like a bad civics PSA or a Jaden Smith tweet, don’t worry – you’re not alone. The BitLicense is a confusing new regulation, but this is the top line: it can apply to your business even if you are not located in New York and even in some situations where you may not think you are offering digital currency transmission. So, in the spirit of not ending up on the wrong side of a prosecution, here are 8 things everyone involved with a digital currency business should know:

• Whether or not you run your business from New York has nothing to do with whether you need a BitLicense. The BitLicense isn’t interested in where you are; it cares about where your customers are. So if you have a New York resident using your website or app, or you have a California resident traveling in New York City using your product, you may need a license. That’s true even if you have no way of knowing that the user is in NY. There’s a federal law, the Bank Secrecy Act, that makes it a felony to operate a money services business in a state where you don’t have a license, and there is no “knowledge” requirement to that law. Take a customer who’s in New York but spoofing their IP to appear like they are from elsewhere? You could be violating a federal law—and facing prison time—without even knowing it.

• You probably need a BitLicense if you do any of the following as a business: transmit digital currency; store, hold, or maintain custody or control of digital currency for another; buy or sell digital currency as a consumer business; or control, administer, or issue a digital currency. Therefore, asking whether you need a license is a process that involves asking whether any of these words—like transmit, store, or control—is an apt metaphor for something specific you do in your business. Holding the private keys to a customer’s bitcoin is the easier fact-pattern: “storing” and “holding” both sound like obvious metaphors for that technical activity. Maintaining and updating an app that helps a user store her own keys? That’s harder and you’d probably want to at least talk to a lawyer or seek clarification from DFS.

• No one really knows what “administrating, issuing, or controlling” means in the context of bitcoin or other cryptocurrencies; if you think you might be doing these things maybe you should ask. The definition of a virtual currency business in this section of the regulation is tricky. It makes some sense in the world of centralized digital currencies, where the centralized company or entity creating the currency can decide when toissue new units of currency and how tocontrol or administer their allocation. The section doesn’t make any sense in the world of decentralized currency like Bitcoin. Bitcoin has no definite “issuer,” “administrator,” or “controller.” People mine new bitcoins (“issuing?”), yes. Others write software that miners run (“administering?”). Others run nodes that help the P2P network communicate (“controlling?!”). Are any of these activities covered? Probably not: Benjamin Lawsky, the outgoing Superintendent of the DFS, repeatedly said that miners and software designers will not need a license. Trouble is, the law is the text of the regulation, not the speeches given by its author. That text is vague, so, again, the best advice is to ask a lawyer and get clarification from DFS regarding your particular facts and circumstances. Maybe we need an abbreviation for that answer. Let’s call it A(sk) L(awyer); S(eek) C(larification). AL;SC.

• Awesome new tools, like multi-sig, may not be excluded from licensing.Cryptocurrencies can do pretty neat tricks, like dividing control over some amount of currency between two or more people. People in a bitcoin multi-sig transaction, for example, can effectively vote to decide where the money moves. It all happens with cryptographic keys that are linked to cryptocurrency addresses. So, if you run a business that only holds one key to some amount of bitcoin, and your customers hold the other keys, do you need a license? What if you could never even spend those bitcoins on your own, or lose them, or get hacked and have them stolen? Your business certainly isn’t like the traditional banks or money transmitters we talked about above—the technology limits your losses and makes you less risky!—but do you still “maintain custody or control,” as per the regulation? We’d like to think that the answer is no, because these tools are amazing innovations that provide security and limit consumer risk rather than create it. The safe answer: AL;SC.

• Nominal, non-financial uses are excluded but what that means isn’t crystal clear. The bitlicense has an exemption for companies that are transmitting “nominal” amounts for “non-financial uses.” This is seemingly aimed at exempting so called Bitcoin 2.0 or Blockchain companies that want to use cryptocurrency ledgers to record non-financial metadata—i.e. a document notary service or an identity validation tool. This may be where colored coins, app coins, or sidechain businesses could fit. But “nominal” isn’t defined, and neither is “non-financial,” so the prudent next steps for your blockchain business? AL;SC.

• Software development is excluded as long as that’s all you’re doing. If you are writing an app that lets people check the price of Bitcoin, you’re home-free because of this exemption. But what if you write software for mining clients, and you also mine for fun? Or what if you write a mobile wallet app that stores users’ keys on their device? Or what if you are a core contributor to the protocol?! Are you really just writing software, and will DFS agree with that self-portrait? Sadly, and First Amendment problems aside, you should probably AL;SC.

• You can ask for a conditional license but there’s no clear guidelines for when it will or will not be granted, or how much easier it will be to get. If this is all starting to sound hard and expensive, take note: the BitLicense can be tailored to be lighter-touch and cheaper at the discretion of the Superintendent. This is called a “conditional license.” Unfortunately, however, there’s no obvious way to qualify for a conditional license. Some commenters in the drafting process asked for a formal threshold, something like “all companies under two-years old, and dealing with less than $5 Million in obligations annually can get conditional license.” Those thresholds didn’t make it into the final draft however, so if you want a conditional license . . . sorry . . . AL;SC.

• If you need a license and get one, you’ll have to do some hard work keeping records, filing reports, and asking permission to make new products. Unlike normal money transmission licenses, a BitLicense comes with some special obligations. You’ll need to keep specifically formatted records of all your customer’s activities. You’ll need to file reports about transactions to New York in situations where you didn’t already have to file them with federal regulators like the Department of Treasury. You’ll need to ask permission if you make “material” changes to your apps or products, and if you decide to release any new products. The specifics requirements are far too complicated to learn in a blog post, you’ll need to AL;SC, a lot.

So what do you now know for sure with regard to the BitLicense? AL;SC! Ask a lawyer and seek clarification from the DFS. We can say this for sure: the BitLicense just drummed up a whole bunch of new business for the legal profession. We also know that it will be harder to operate a legal digital currency business than it will be to operate a traditional money transmission business—don’t forget those additional recordkeeping requirements and change-of-business requirements. These are some unfortunate new realities, and they make it hard to believe that this new law is really the pro-innovation regulation some politicians hoped or said it would be. Whatever it is, it’s here and the grace period ends in one month, so don’t be caught off guard. And if you’re bothered by all this, consider supporting organizations that are working with the state to improve regulations.