New York Crypto Regulations: Complete 2026 Guide

Overview: The Strictest Crypto Regime in the United States

New York remains the most demanding state licensing environment for cryptocurrency businesses in the country. Since the New York State Department of Financial Services (NYDFS) adopted 23 NYCRR Part 200 — the “BitLicense” regulation — effective August 8, 2015, no company may engage in “virtual currency business activity” involving New York or a New York Resident without either a BitLicense or a New York limited purpose trust company charter.

Key regulators:

• NYDFS — primary licensing and supervisory authority, acting under N.Y. Fin. Serv. Law § 104 and N.Y. Banking Law. Its Virtual Currency Unit conducts examinations, issues guidance, and brings consent-order enforcement.
• New York Attorney General (NYAG) — wields the Martin Act, N.Y. Gen. Bus. Law art. 23-A (§§ 352–359), one of the broadest anti-fraud statutes in the nation, plus Exec. Law § 63(12) for persistent fraud and illegality.
• NYS Department of Taxation and Finance — state income, franchise, and sales tax treatment.
• NYS Department of Environmental Conservation (DEC) — air permits relevant to proof-of-work mining.

General posture: strict. New York is not hostile to crypto — it charters digital asset trust companies and maintains a published token “Greenlist” — but it treats virtual currency intermediaries as regulated financial institutions with full prudential, AML, cybersecurity, and consumer-protection obligations. The practical consequence is a two-tier market: well-capitalized licensees, and everyone else geofencing New York.

Does This Apply to You?

Under 23 NYCRR § 200.2(q), virtual currency business activity means any of the following when it involves New York or a New York Resident:

1. Receiving virtual currency for transmission, or transmitting virtual currency;
2. Storing, holding, or maintaining custody or control of virtual currency on behalf of others;
3. Buying and selling virtual currency as a customer business;
4. Performing exchange services as a customer business;
5. Controlling, administering, or issuing a virtual currency.

Note the geographic trigger is disjunctive — a company headquartered in Texas with New York customers is squarely covered.

Excluded or exempt (23 NYCRR §§ 200.2, 200.3(c)):

• Entities chartered under N.Y. Banking Law and approved by the Superintendent to conduct virtual currency business (the trust company path).
• Merchants and consumers using virtual currency solely to buy or sell goods and services, or for investment purposes.
• Development and dissemination of software as such (the regulation targets custody and transmission, not publication of code).
• Digital units used solely within online gaming platforms or customer affinity/rewards programs with no market value outside the issuer.

Non-custodial software providers, miners mining for their own account, and pure protocol developers generally sit outside Part 200 — but structure matters, and self-custody claims that mask effective control have not fared well.

Money Transmitter Licensing

New York’s traditional money transmitter license (MTL) arises under N.Y. Banking Law art. XIII-B, §§ 640–652 and 3 NYCRR Part 406. This is separate from the BitLicense. A firm handling both fiat and virtual currency — a typical exchange with USD on-ramps — ordinarily needs both a BitLicense and an Article XIII-B MTL, or a trust charter that subsumes both.

Application Process (23 NYCRR § 200.4)

• Filing: Submitted through NMLS, which NYDFS adopted for virtual currency applicants (transition completed 2020–2021).
• Application fee: $5,000, non-refundable, per 23 NYCRR § 200.5.
• Required disclosures: organizational chart; ownership and control persons; audited financials; written AML, cybersecurity, BCP, and consumer-protection policies; background reports and fingerprints for principals, directors, and 10%+ beneficial owners; banking relationships; business plan and projections.
• Timeline: The regulation contemplates a 90-day review after an application is deemed complete. In practice, 12 to 24 months is the realistic range, driven by rounds of supplemental information requests.
• Conditional BitLicense: A framework announced in June 2020 allows an applicant to operate in partnership with an existing licensee while building toward a full license — useful for early-stage firms.

Ongoing Obligations

• Capital (§ 200.8): Set by the Superintendent case-by-case based on assets, liabilities, and risk profile; permissible investments must back custodied assets.
• Custody (§ 200.9): A licensee must hold the same type and amount of virtual currency it owes customers and may not sell, transfer, pledge, hypothecate, or lend customer assets absent direction.
• Surety bond or trust account (§ 200.9(a)) in an amount acceptable to the Superintendent.
• AML program (§ 200.15): Risk assessment, transaction monitoring, SAR filing, and travel-rule compliance layered atop federal BSA/FinCEN MSB obligations.
• Cybersecurity (§ 200.16 and 23 NYCRR Part 500): Part 500 was substantially amended effective November 1, 2023, with phased compliance dates running through November 1, 2025 — adding MFA requirements, annual independent penetration testing, governance escalation to boards, and 72-hour incident reporting.
• Assessments (23 NYCRR Part 102): Since 2022, licensees fund their share of NYDFS supervisory costs, authorized by amendments to Fin. Serv. Law § 206.
• Prior approval (§§ 200.10–200.11): Material changes to the business and changes of control require NYDFS approval before closing.

Securities Regulation

New York’s blue sky statute is the Martin Act. Two features make it uniquely potent: the NYAG need not prove scienter (intent to defraud) or reliance to establish a violation, and the statute carries both civil and criminal authority. New York does not apply the federal Howey test as a strict limit — the Martin Act’s definition of “security” and “commodity” under GBL § 352 is broader than the federal definition and expressly reaches commodities, which lets the NYAG pursue tokens the SEC might treat as non-securities.

• Dealer/broker registration: GBL § 359-e requires dealers, brokers, and salespersons selling securities within New York to register (Form 99 / M-11 filings with the Investor Protection Bureau), subject to exemptions.
• Offering filings: GBL § 352-e requires filing for certain offerings; federal covered securities under NSMIA receive notice-filing treatment.
• Token classification: The NYAG has repeatedly alleged that trading platforms operating in New York without registration violate the Martin Act regardless of whether the assets are securities or commodities — a theory with no federal analogue.

Practical takeaway: satisfying SEC exemptions (Reg D, Reg A+, Reg S) does not resolve New York exposure. Martin Act analysis is a separate workstream.

Banking & Custody

New York offers a genuine advantage here. Under N.Y. Banking Law § 102-a and Article III, NYDFS charters limited purpose trust companies authorized to conduct virtual currency business. Chartered digital asset trust companies have included Gemini Trust Company, Paxos Trust Company, itBit, Coinbase Custody Trust Company, BitGo New York Trust, NYDIG Trust, Fidelity Digital Asset Services, and Zero Hash Trust.

Why firms choose the trust charter: it confers fiduciary custody powers, satisfies the “qualified custodian” analysis for investment advisers, and eliminates the need for a separate BitLicense and money transmitter license. The tradeoff is bank-grade capital, board governance, and examination intensity.

Custody guidance to know:

• Guidance on Custodial Structures for Customer Protection in the Event of Insolvency (January 23, 2023) — requires segregation of customer virtual currency from corporate assets, clear disclosure of whether a custodial relationship creates a bankruptcy-remote interest, and no commingling of sub-custodied assets.
• Stablecoin Guidance (June 8, 2022) — USD-backed stablecoins issued by NYDFS-regulated entities must be fully backed by reserves in cash and short-dated Treasuries, redeemable at par within two business days, and subject to monthly attestation by an independent CPA under AICPA standards.
• Greenlist / coin-listing policy — originally issued June 2020 and materially tightened by guidance in 2023, requiring each licensee to maintain board-approved coin-listing and delisting policies with self-certification.

Tax Treatment

New York issued its principal guidance in TSB-M-14(5)C, TSB-M-14(7)I, TSB-M-14(17)S (December 5, 2014), adopting the federal framework of IRS Notice 2014-21.

• Income tax: Convertible virtual currency is intangible property, not currency. New York personal income tax (Tax Law art. 22) starts from federal AGI, so capital gains flow through automatically. Top marginal state rate is 10.9%, plus New York City resident tax up to 3.876% — among the highest combined burdens in the country for crypto gains. Corporate taxpayers are subject to the Article 9-A franchise tax.
• Sales tax: The transfer of convertible virtual currency itself is not subject to sales tax, because intangible property is outside the tax base. However, using crypto to buy taxable goods or services is a barter transaction — sales tax is due on the fair market value in U.S. dollars at the time of the transaction, and the seller must record it.
• Mining: Under TSB-M-14(17)S, mining is not a taxable service, and mining receipts are not subject to sales tax. Purchases of mining hardware and electricity are generally taxable unless a manufacturing or production exemption applies — a fact-specific and frequently contested position.
• Proof-of-work moratorium: Chapter 519 of the Laws of 2022 (adding ECL § 19-0331), signed November 22, 2022, imposed a two-year moratorium on new and renewed air permits for carbon-fuel-powered PoW mining at electric generating facilities. It has since lapsed by its terms, but DEC permitting scrutiny of mining operations persists, and renewal legislation has been reintroduced in subsequent sessions. Verify current status before siting a facility.

Enforcement Trends

New York produces more crypto enforcement volume than any other state. Recurring themes:

• AML and compliance-program failures. The Coinbase consent order (January 2023) imposed a $50 million penalty plus a $50 million mandated compliance investment for transaction-monitoring and KYC backlogs. Robinhood Crypto (August 2022) paid $30 million on AML and cybersecurity findings.
• Unregistered platform operation. The NYAG’s Martin Act suits against exchanges — including the KuCoin action resolved in December 2023 (~$22 million and exit from New York) — establish that trading platforms serving New Yorkers without registration face liability whether the assets are securities or commodities.
• Misrepresentation of reserves. The Tether/Bitfinex settlement (February 2021, $18.5 million plus a New York trading ban and reserve reporting) remains the template.
• Lending and yield products. The NYAG’s October 2023 action against Genesis, Digital Currency Group, and Gemini over the Gemini Earn program produced multi-billion-dollar restitution commitments in 2024. NYDFS separately ordered Paxos in February 2023 to stop minting BUSD.
• Retail fraud and affinity schemes. The Investor Protection Bureau has pursued Ponzi-style operations targeting immigrant communities, and the NYAG has repeatedly proposed comprehensive legislation (the CRPTO Act, first introduced May 2023) that would codify broader registration and conflict-of-interest bans.

Compliance Checklist for New York

1. Scope the trigger. Map whether any of the five § 200.2(q) activities touch New York or a New York Resident. Document the analysis.
2. Choose the pathway. BitLicense, conditional BitLicense with a licensed partner, or limited purpose trust charter. Confirm whether an Article XIII-B money transmitter license is also required for fiat legs.
3. Geofence in the interim. If unlicensed, implement IP and KYC-based New York exclusion with documented controls — and test it. Ineffective geofencing is itself an enforcement fact pattern.
4. Build the four written programs before applying: AML/BSA (§ 200.15), cybersecurity (§ 200.16 and Part 500), business continuity (§ 200.17), and consumer protection/complaints (§§ 200.19–200.20).
5. Adopt a board-approved coin-listing and delisting policy consistent with NYDFS Greenlist guidance; self-certify as required.
6. Segregate customer assets per § 200.9 and the January 2023 insolvency guidance; document custodial versus debtor-creditor status in customer agreements.
7. Verify Part 500 phase-in compliance — MFA, annual penetration testing, board reporting, and 72-hour incident notification.
8. Run a separate Martin Act analysis. Federal exemption is not New York exemption. Assess GBL § 359-e dealer registration.
9. Calendar recurring filings: quarterly financial statements (§ 200.13), annual audited financials, annual AML and cybersecurity certifications, and Part 102 assessments.
10. Obtain prior approval for material business changes (§ 200.10) and changes of control (§ 200.11) before signing, not after.
11. Confirm state tax positions: barter treatment for crypto-accepting merchants, sourcing for Article 9-A, and any manufacturing exemption claimed on mining equipment or power.

Bottom Line

New York is expensive and slow to enter, but the BitLicense and trust charter carry real market value — institutional counterparties and investment advisers treat NYDFS supervision as a quality signal. The decision is rarely “can we comply?” and almost always “does New York revenue justify a multi-year, seven-figure licensing and compliance build?” For custodians, stablecoin issuers, and institutional platforms, the answer is usually yes. For early-stage protocols and non-custodial software, the better answer is often a well-documented exemption analysis and disciplined geofencing.

---

This content is for informational purposes only and does not constitute legal advice. Consult with a qualified US attorney for guidance specific to your situation.