Thread by @JBSDC

So, another day, another piece of draft legislation on crypto. This one is from NY Attorney General Letitia James and represents an effort to create a regulatory framework for crypto in NY state.

Let’s dive into what the bill actually does. Thread.
ag.ny.gov/press-release/…

First, New York already has a registration regime of sorts for digital assets, the BitLicense introduced in 2015. It’s been a mixed bag: it’s been very hard/time-consuming to get approved, so many companies have simply opted to not do business in NY. 2 dfs.ny.gov/virtual_curren…

How the new legislation interacts with the BitLicense regime isn’t clear - the legislation doesn’t appear to mention it. Presumably this bill won’t pass without some discussion of how this either complements or replaces the BitLicense though. 3

As with all legislative analysis, we start with the definitions. And this bill is chock-a-block full of them, including a definition for DAOs.

Any organization “operated through rules encoded as computer programs” is pretty expansive. Are forum guilds DAOs under this? Maybe. 4

The definition of “digital asset” is also extremely broad: any “type of digital unit, whether labeled as a cryptocurrency, coin, token, virtual currency, or otherwise” counts, regardless of whether it’s centrally managed or decentralized. 5

This definition is so broad that the legislation has to exclude a bunch of things from the definition one by one, from gaming tokens and customer rewards plans to prepaid credit cards.

With a definition this broad, some digital assets will likely get accidentally captured. 6

The bill the defines some additional categories: digital asset broker (folks that effect transactions in digital assets), digital asset investment advisers (who advise, but excluding lawyers and journalists among others), and…

Digital
Asset
Influencer. 7

So here’s the first place where the legislation does something really novel - influencers are common in social media but not in much of traditional finance. NY AG James appears to think social media influencers are so predominant in crypto that they need regulation. 8

According to the legislation, if you “widely” promote, publish, or circulate any notice where you encourage investment in a digital asset where you own, expect it own, or are paid more than $25,000, you’re a digital asset influencer. This doesn’t apply to “bona fide newspapers” 9

This will, I’m sure, draw the most news coverage and a lot of debating about whether this is violative of the first amendment. Anything surrounding increased disclosure of speech is going to be controversial. But this is also probably the least important part of this bill. 10

Continuing on, there are definitions for both “digital asset exchange” and “off-chain transaction.”

In what will become a trend, the bill basically assumes that crypto exchanges are analogous to stock exchanges (and will be pushing crypto to conform to stock exchange rules). 11

In terms of off-chain transaction, the definition is pretty decent - “a transaction that is confirmed or stored outside a public blockchain network.” The writers of this bill did enough research they grasped difference between private and public blockchain. This is good. 13

Of course, immediately after that, there’s a section on physical custody that reveals a major problem with the bill and the drafters understanding of crypto: physical possession is defined as being identical to physical possession for securities. 14

This is a big problem because the place where crypto is MOST different from
tradfi is on physical possession/control. No one ever takes possession of their securities, they’re basically just held at a national clearinghouse like DTCC forever. 15 ecfr.gov/current/title-…

In crypto, you can take custody of the assets (and there are no clearinghouses for crypto). This is where the equities model just doesn’t work and even the SEC staff have been flummoxed on how to deal with control and custody for years. This will be an issue with the bill. 16

The bill’s final definition is “unauthorized digital asset transfer,” and is defined as fraudulent transactions and transactions the customer didn’t authorize where he didn’t receive a benefit.

Strange thing to define right? Well that’s a signal this will be important later. 17

Ok, with the definitions out of the way, we get to the “substantive regulatory provisions” portion of the bill. Though initially it’s less regulations than prohibitions on a bunch of things. 18

First, no company can be a digital asset broker and exchange, and not can you be an issuer and an investment adviser, or any combination of those four topics. 19

Many exchanges are currently also brokers, issuers, or advisers, so this would mean they have to break themselves up to operate in NY. This is probably the part of the bill that will have the biggest impact if passed.
20

Brokers, exchanges, advisers, etc are also forbidden from proprietary trading, and they can’t operate until they post publicly a “certificate of compliance” with this bill. 21

This is the part of the bill that seems least functional: it has no phase-in period! The bill takes effect 30 days after passage but exchanges can’t operate unless they are fully in compliance AND the bill demands crypto exchanges do self-intestinal surgery to be compliant. 22

Next, exchanges/brokers/etc have to have independently audited financials within 105 days after the end of fiscal year and quarterly statements within 17 days of quarter, and make them publicly accessible. What qualifies as an independent audit is unspecified. 23

Then there’s a requirement that brokers and advisers have KYC/AML programs.

Ah, but this is interesting - why aren’t exchanges required to have KYC/AML? 24

Two ways to look at this strange omission. The positive version is that the NY AG’s office understands that some exchanges (especially DeFi) May struggle to comply with the letter of AML rules, and this is them being flexible. 25

The negative version is that NY AG expects no one can access an exchange except via a broker or investment adviser, and by having them do KYC/AML, there’s no need for redundancy.

Is the NY AG understanding of crypto or just trying to fix it into the equities box? Unknown. 26

Anyway, the info that advisers and brokers need are kept vague: they need to have info necessary to “effectively service the customer’s account” and to comply with federal and state law among other things. 27

Now, we reach problem of custody & control. Brokers are required to maintain control of customer assets (and they can’t rehypothecate them!) and exchanges can only take possession to make a trade.

But how can a broker keep custody of a digital asset while the exchange has it? 28

In the securities world, this is it a problem because (as discussed) everything lives at DTCC forever. But with crypto assets can and do physically change hands.

This is a very knotty problem to solve - at least if you require the broker and exchange to be different firms. 29

I expect this provision to get a lot of discussion during the legislative process in Albany, and it’s probably the place the industry’s for the most educating to do. You can’t perfectly map securities laws onto crypto, and custody/control is exhibit A. 30

Crypto issuers aren’t allowed to issue demand deposits to investors - I think this is designed to make clear crypto firms can’t act as banks (demand deposits are a banking concept) or to prevent early investors from dumping on retail. Seems fair. 31

As an aside, this is one provision I can’t quite figure out what the motivation was for including it. Oh, and NY AG staff: the actual CFR cite for demand deposits is 12 CFR 204.2(b). It’s here for everyone else: ecfr.gov/current/title-…

Next, stablecoins - no broker/exchange/etc may “refer” to a digital asset as a stablecoin that isn’t backed at least 1:1 by US currency “Level 1 liquid assets.”

This isn’t a ban on other kinds of stablecoins, they just can’t be called stablecoins. And that’s it for stables. 32

Cross transactions aka wash trades are prohibited, brokers must disclose the sources of fees, and brokers can’t refer any customer to a client where the broker benefits directly or indirectly.

The legislation is clearly very focused on preventing conflicts of interest. 33

Next, we come to another controversial section: brokers and exchanges are prohibited from doing business with any other brokers or exchanges that aren’t in “substantial compliance” with this section of the bill. That’s a big deal. 34

Does this mean an exchange in NY can’t do business with a non-NY exchange that isn’t following NY law? Also, what qualifies as substantial compliance. The answers to these questions will dictate whether this is a workable regulatory regime or another BitLicense. 35

There is a lot of disclarity here. There’s a weird formatting issue that may mean this section only requires firms to abide by the stated KYC/AML requirements. But there’s a need for greater specificity here. 36

The bill also seems to suggest that there are limits on engaging with unhosted and hosted wallets due to KYC/AML. The bill does allows for incoming transfers from unhosted wallets without full KYC/AML at least. 37

In more positive news, the bill specified that exchanges must publicly disclose their listing standards and then abide by them. This requirement is similar to MiCA’s regime which asks issuers to provide a white paper and then just requires them to follow that white paper. 38

That said, it appears the bill is requiring exchanges to make public disclosure of the “source code” for every digital asset they list. Government mandated source code disclosures are often controversial, but given the code-sharing ethos of crypto it may not be insurmountable. 39

Brokers will have to maintain net capital standards used in the securities world (100 to 250k of net capital at least), and advisers cannot take physical control of customer digital assets. 40

Again, the custody/control dilemma is the biggest technical challenge with this bill. The bill wants brokers to have custody of digital assets while advisers “direct” the assets use, but the fact of actual delivery keeps making that inept. 41

Also: you can’t operate if you’re insolvent.

That this has to be specified is a reminder that this bill was clearly prompted by the events of 2022. 42

In more positive news, the information disclosure requirements for issuers is pretty reasonable, though it’s not an exclusive list and could spin out of control. They do have to furnish info about recent sales (presumably this is an effort to identify past rug pullers). 43

…oh and if you already have issued a token, you have to comply with these disclosures within 90 days of the bill’s effective date (120 days after passage).

Wait, who would issue the prospectus for Bitcoin with all this information? #Satoshi 44

Interestingly, the bill requires that any off-chain transaction be disclosed to the public within TEN SECONDS of the transaction occurring, and that the parties identities not be disclosed. That may make some rollups non-economic. 45

The next section is on anti-fraud and market manipulation, and it’s largely vanilla provisions. I do like the requirement that issuers/brokers/etc must “observe high standards of commercial honor,” which feels like a term of art in NY state legislative draftsmanship. 45

That said, exchanges and brokers are also required to have written policies to prevent anti-wash trade, market manipulation, and insider trading. This is fine for centralized exchanges, but this provision and the bill generally seems to ignore the unique issues of DeFi. 46

Much of the bill seems to view crypto as a world of CeFi exchanges only. But you can’t regulate crypto without figuring out what to do about DeFi, either by actually crafting rules for it or saying, as in Europe, you’ll deal with it later. Just ignoring DeFi isn’t an option. 47

Now we come to the section on unauthorized digital asset transfers, and sure enough, this section is a bit wild.

Basically, if a customer’s assets suffer an unauthorized transfer, the CUSTOMER must notify their broker/adviser within two days to avoid “liability.” 48

While I don’t know for certain, what I think this section is designed to do is solve the question of “who pays” when an unauthorized transfer of digital assets happens. And that’s a laudable goal. 49

The problem is the text is confused here. For instance, the bill says a customer must report an unauthorized transfer within 60 days to “avoid liability for subsequent transfers.” But why would a customer have any liability for transfers they no longer control? 50

This is an area where the NY AG is clearly trying to accomplish something, but the bill text doesn’t clearly illuminate what that is. Edits to this section are absolutely needed just as a legislative drafting matter. 51

Next we have a section on registration. This is vanilla except, yes, registration will be required for digital asset influencers. And they will have to disclose a a lot of information, including their wallet address , criminal background, and educational background. 52

Someone asked why the NY AG would be involved in drafting a bill. And I answered that the NY AG is quite unique in the office’s power and reach. But they also draft legislation based on enforcement their activity. And it seems they’re seeing real injuries from influencers. 53

Anyway, this section is going to be the subject of countless tweets, podcasts, and thinkpieces. The fact that infielders have to pay fees to register is itself going to raise questions about whether this is a violation of the First Amendment on its face. 54

Two more points on this section:
First, we have the first mention of DAOs in along time on a banal section on service of process, saying they can be served like anyone else - this is likely due to the issues with serving the Ooki DAO last year. 55

Second, there’s a whole two subsections of the bill just missing. What happened to subsections 11 & 12 (lines 20-26)? Usually you don’t see such evidence that something got cut from a bill’s drafting process. 56

Two final provisions to note on the bill. For some reason, the bill makes clear that the Attorney General, and not the NY Department of Financial Services, will have the power to issue rules and regulations under this law. That’s very different than usual/will provoke DFS. 57

Finally, there’s a new tax provision requiring any business operating in NY state to report the receipt of any digital asset that was payment for goods or services and in excess of $5,000 if the money came from someone else in NY. And if so, the payer’s identity must be given. 58

This thread has gotten long so I’ll start a new one with takeaways. 59.