BitLicense requirements: what NYDFS actually assesses

Firms tend to approach the BitLicense as a form. Long, demanding, expensive — but fundamentally a document to be completed and submitted.

NYDFS approaches it as an examination. The application is the vehicle; what is being assessed is whether a functioning compliance, cybersecurity, and custody program already exists inside your business. Firms that build the program in order to answer the questions do considerably better than firms that answer the questions and promise to build the program.

The framework sits at 23 NYCRR Part 200, effective June 2015 and supplemented since by substantial NYDFS guidance on custody, coin listing, stablecoin issuance, and the use of blockchain analytics.

What is a BitLicense?

A BitLicense is the license the New York State Department of Financial Services (NYDFS) requires before a business can conduct virtual currency business activity involving New York or a New York resident. NYDFS first proposed the framework in 2014 and finalized it in 2015, making it the first comprehensive state licensing regime built specifically for crypto businesses. It remains one of the most demanding.

Two things set it apart from an ordinary state license. It is a full supervisory regime, not a registration: licensees are examined, need prior approval for material changes, and must run AML, cybersecurity, and custody programs to NYDFS's specific standards. And it applies based on whom you serve, not where you are located.

Who needs one

Virtual currency business activity involving New York or a New York resident generally triggers the requirement. That covers receiving or transmitting virtual currency, storing or controlling it on behalf of others, buying and selling as a customer business, exchanging virtual currency, and issuing or administering it.

Two exclusions matter: merchants using virtual currency solely to buy or sell goods and services for their own account, and entities chartered under New York Banking Law.

The territorial reach catches people out. "Involving New York or a New York resident" is broad. A firm with no New York office, no New York entity, and no intention of targeting the state can still fall inside the perimeter through its customer base. Geofencing is a decision requiring genuine technical implementation, not a terms-of-service clause.

Exemptions and what falls outside

Part 200 carves out more than the two exclusions most summaries mention. The categories worth knowing:

• Chartered New York banking organizations approved by the superintendent to engage in virtual currency business activity.
• Merchants and consumers using virtual currency solely to buy or sell goods or services, or for investment purposes.
• Software development on its own. Developing and disseminating software, in and of itself, is not virtual currency business activity. Writing wallet or protocol code is different from operating a service that controls customer assets.
• Digital units that are not "virtual currency" under the rule, including in-game currency with no market or use outside the gaming platform, customer rewards points that cannot be converted into fiat or virtual currency, and digital units used as part of prepaid cards.

BitLicense and money transmitter licensing are separate

This is the most common structural misunderstanding, and it is expensive because it surfaces mid-process.

New York regulates virtual currency business activity under Part 200 and fiat money transmission under the Banking Law. They are distinct regimes with distinct applications. A platform that lets customers deposit dollars, exchange them for virtual currency, and withdraw either may need both authorisations.

New York has also not adopted the CSBS Money Transmission Modernization Act. Firms that built their multi-state licensing plan around MTMA-harmonised requirements will find New York's capital, net worth, and permissible-investment standards diverge. Section 651 of the Banking Law requires money transmitters to maintain permissible investments equal to their outstanding transmission liabilities — an ongoing obligation, not a one-time threshold.

The six pillars NYDFS assesses

Part 200 and the guidance built on it define what a licensee's program must contain. Treat these as the structure of the work rather than as application sections.

1. Anti-money laundering

A full BSA/AML program: written policies calibrated to your actual risk, a designated compliance officer, customer identification and risk-based due diligence, ongoing transaction monitoring, suspicious activity reporting, OFAC sanctions screening, training, and independent testing.

What distinguishes this from a generic AML program is that NYDFS expects blockchain analytics to be integrated into it. The department has issued explicit guidance on using on-chain analysis for AML and sanctions purposes. A program that monitors fiat rails and treats on-chain activity as out of scope will not survive review.

Practically, this means a named analytics provider, documented risk-scoring methodology, defined thresholds and escalation paths, and evidence that alerts are worked and dispositioned by people who understand them.

2. Cybersecurity

A written cybersecurity program, covered in detail below. New York's expectations here are among the most specific in US financial regulation — and they come from two regulations at once, which is where firms get caught.

3. Custody and consumer protection

How customer assets are held, segregated, and protected — including in insolvency. Covered below.

4. Capital and financial condition

NYDFS sets capital requirements based on the licensee's specific business model, risk profile, and activity. There is no universal figure (covered in detail below). Expect audited financials, detailed projections, and a demonstrated ability to fund the compliance program you are proposing.

5. Governance and control persons

Background investigation of principals, officers, directors, and control persons. Fingerprinting, personal financial disclosure, and a review of the actual governance structure — who has authority, who oversees compliance, and whether the compliance function has independence and access.

6. Disclosure, reporting, and recordkeeping

Consumer disclosures, complaint handling, transaction records, quarterly and annual reporting, and prior approval requirements for material changes to your business, control, or product set.

Cybersecurity: two regulations, not one

This is consistently where otherwise-credible applications thin out, and there is a specific structural reason.

A BitLicensee is subject to both the virtual-currency-specific cybersecurity requirements at 23 NYCRR § 200.16 and, as a Covered Entity, the general Cybersecurity Regulation at 23 NYCRR Part 500. The two contain substantially similar requirements, which is exactly what makes the trap effective.

A New York State Comptroller follow-up audit found licensees not in compliance with the department's cybersecurity regulations even where they had self-certified compliance — which tells you how closely this is now scrutinised. Note also that BitLicensees are examined at least once every two calendar years, so a gap does not sit undiscovered indefinitely.

A program that will hold up includes:

• A written program with a named owner — a CISO or equivalent with defined authority
• A current risk assessment that actually drives control selection rather than sitting alongside it
• Access controls with least privilege, documented reviews, and multi-factor authentication
• Penetration testing and vulnerability assessment on a defined cycle, with remediation tracked to closure
• An incident response plan that has been exercised, with the exercise documented
• Third-party and vendor risk management, including custody and infrastructure providers
• Audit trails sufficient to reconstruct material events
• Business continuity and disaster recovery, tested rather than drafted
• Annual certification under Part 500 — which means someone signs their name to it, and which does not by itself discharge § 200.16

Custody and consumer protection

NYDFS has issued updated guidance for virtual currency entities providing custody services, reflecting the growth of sub-custodial arrangements and heightened attention to what happens to customer assets in insolvency.

Core expectations:

• Segregation. Customer virtual currency held separately from the licensee's own, on-chain and in the books and records
• No unauthorised use. Customer assets not lent, pledged, rehypothecated, or otherwise used without explicit authorisation
• Clear legal characterisation. Disclosure of how customer entitlements are structured and how they would be treated if the licensee failed
• Sub-custodian oversight. Where custody is delegated, documented diligence and ongoing monitoring of the sub-custodian
• Key management. Generation, storage, quorum structure, and recovery — with the same rigour a custodian bank would apply
• Reconciliation. Regular reconciliation of customer entitlements against on-chain holdings

Capital and net worth requirements

This is the question applicants ask most, and the honest answer frustrates people: Part 200 sets no fixed net worth or capital number. Under 23 NYCRR § 200.8, NYDFS sets each licensee's capital requirement individually.

The factors the department weighs include:

• The composition of your assets, including the size, liquidity, risk, and price volatility of each asset type
• The composition of your liabilities
• Your actual and expected volume of virtual currency business activity
• Your leverage and liquidity position
• Whether you are already licensed or regulated by NYDFS and in good standing
• The customer protection already provided through a surety bond or trust account
• The types of customers you serve and the products and services you offer

Capital must be held in cash, virtual currency, or high-quality, highly liquid, investment-grade assets, in proportions NYDFS accepts. Separately, § 200.9 requires a surety bond or trust account in US dollars for the benefit of customers, again in a form and amount NYDFS sets.

Coin listing and delisting

NYDFS maintains a framework governing which virtual currencies licensees may support, including a greenlist of coins pre-approved for specified uses, and requires licensees to maintain their own coin-listing and coin-delisting policies.

The department has also issued specific requirements for US dollar-backed stablecoin issuance, covering reserve composition, redeemability, and attestation.

What this means operationally: adding an asset is a governed decision requiring documented analysis, defined approval, and in some cases prior notice or approval. Delisting needs an equivalent process, including customer notification and orderly wind-down. Firms accustomed to listing assets on a product manager's judgement need to rebuild that process before applying.

The BitLicense application, step by step

The application asks for a great deal, and every item becomes something an examiner can question. The typical sequence:

1. Confirm the perimeter. Which of your activities trigger Part 200, whether a money transmitter license is also needed, and which entity applies.
2. Open a dialogue with NYDFS. Many applicants meet with the department before filing to walk through the business model. It surfaces structural concerns early, when they are cheap to fix.
3. Assemble the package. Part 200 calls for, among other things: ownership and organizational structure; biographical information, background reports, fingerprints, and photographs for directors, principal officers, principal stockholders, and principal beneficiaries; current financial statements and projections; a description of the current and proposed business; banking arrangements; and the written policies and procedures the program will run on.
4. Pay the application fee. $5,000, not refunded if the application is denied or withdrawn.
5. Work through the deficiency cycles. NYDFS reviews, issues questions, and reviews your answers. This is where most of the elapsed time goes.
6. Approval, full or conditional. NYDFS can grant a full license or a conditional license (see alternatives below).
7. Ongoing supervision. Examinations at least once every two calendar years, quarterly financial statements, annual audited financials, and prior approval for material changes to the business.

Timeline, deficiency cycles, and cost

Reviews commonly run beyond a year. The mechanic driving that is the deficiency letter: NYDFS reviews, identifies gaps, and issues a request. You respond. They review again. Each cycle adds weeks or months.

Two variables sit within your control:

• Initial completeness. Every gap in the first submission becomes a deficiency item. Applications assembled to answer questions rather than describe an operating program generate long first deficiency letters.
• Response quality and speed. Substantive responses that resolve the underlying issue close items. Responses that restate the original position generate follow-ups.

On cost, the $5,000 application fee is the smallest line in the budget. NYDFS implemented a virtual currency assessments rule at 23 NYCRR 102, shifting the cost of supervision and examination onto licensees through direct assessments. Add the ongoing compliance program, cybersecurity testing, independent AML testing, analytics tooling, and audit — the licence is the beginning of the cost, not the end of it.

Alternatives to a full BitLicense

There are four realistic alternatives, and they suit very different businesses.

The conditional BitLicense

Under 23 NYCRR § 200.4(c), NYDFS may grant a conditional license to an applicant that does not yet satisfy every requirement of Part 200. A conditional license expires two years after issuance unless NYDFS renews it or removes the conditional status, and it can carry specific conditions and closer examination. It is a path for firms that are credible but not yet complete, not a lighter standard: the conditions are real, and NYDFS can suspend or revoke a conditional license.

The limited purpose trust charter

A limited purpose trust company charter under New York Banking Law. Several significant virtual currency businesses operate this way.

The trust charter suits firms whose core business is custody, or who want fiduciary standing for institutional clients. It is a materially heavier lift. The decision belongs at the start of the process, because the two paths diverge early.

Operating through a licensed partner

Some firms serve New York customers through a partnership with an existing BitLicensee or trust company, which holds the regulatory relationship. This can be faster, but the partner will impose its own compliance requirements on you, and the arrangement has to reflect who actually controls customer assets. If you are the one with control, the partnership does not move the obligation.

Not serving New York

Excluding New York residents is a legitimate choice. It has to be real: geofencing, onboarding controls, and monitoring that actually keep New York customers out, not a line in the terms of service.

Finding the list of BitLicense holders

NYDFS publishes a list of its regulated virtual currency entities, covering both BitLicensees and limited purpose trust companies, on its website at dfs.ny.gov. It is the authoritative source; third-party lists go stale as licenses are granted, conditions are lifted, and firms exit.

It is useful for more than curiosity. Check it to confirm that an exchange, custodian, or counterparty you plan to rely on actually holds the authority it claims. And it shows which business models NYDFS has already approved, a helpful reference point when framing your own application.

How to approach it

The firms that get through in reasonable time do the same things:

1. Settle the perimeter first. Which authorisations, which entity, which jurisdictions, which activities.
2. Build the program before drafting the application. The application should describe something that exists.
3. Staff compliance genuinely. A named compliance officer with real authority, real access, and enough seniority to say no.
4. Generate operating evidence. Run the program long enough to produce completed reviews, worked alerts, and a tested incident response.
5. Have someone independent read the file before submission, specifically looking for what an examiner would question.
6. Resource the deficiency response. The people who can answer substantively need to be available, not mid-fundraise.

The department's framework is demanding by design, and it is unlikely to loosen. Firms that treat that as a barrier tend to struggle. Firms that treat the resulting program as an asset — one that makes every subsequent state application, institutional counterparty review, and allocator diligence easier — get more out of the same spend.

This page is general information about regulatory frameworks, not legal advice, and does not create an attorney-client relationship. Licensing requirements, thresholds, and agency guidance change frequently and vary by state. Verify current requirements against the relevant regulator, NMLS, and qualified counsel before relying on anything here.