NYDFS BitLicense — Virtual Currency Business Activity

By Data Engineering 2026-04-30 13 min read 2,492 words

Last reviewed: 2026-07-152,492 words13 min readBy DeFi Intel Research Desk

Executive summary

BitLicense was the first serious US state attempt to license crypto firms as a distinct activity, promulgated by then-NYDFS Superintendent Benjamin Lawsky as 23 NYCRR Part 200 effective June 2015. A decade in, the regime remains the most demanding and most expensive crypto licence anywhere on the planet, with roughly thirty active BitLicenses (32 on the DFS register as of mid-2026, plus 11 limited-purpose trust charters). Under the GENIUS Act framework signed in July 2025, NYDFS retained its state-path role for stablecoin issuance, and the BitLicense plus limited-purpose trust charter combination remains the operating template for most US-facing institutional crypto businesses. Application costs run 150,000 to 1,000,000 dollars, supervision is materially more prescriptive than under any other US state regime, and the licence remains the gold-standard signal of regulatory legitimacy for crypto operators serving US customers.

Statutory architecture

BitLicense is codified at 23 NYCRR Part 200 — a regulation rather than a statute, promulgated by NYDFS under the Superintendent's authority in Article 2 of New York Financial Services Law and Article 13 of New York Banking Law. The regulation defines virtual currency business activity in section 200.2(q) as any of five enumerated activities involving a New York resident or any activity conducted in New York: receiving virtual currency for transmission or transmitting virtual currency, storing or maintaining custody on behalf of others, buying and selling virtual currency as a customer business, performing exchange services as a customer business, or controlling, administering, or issuing a virtual currency. The activity-based definition is deliberately broad and has caught firms that operate physically nowhere near New York — the trigger is contact with a New York counterparty, not physical presence. Section 200.3 sets the licensing requirement, section 200.4 the application content, section 200.5 the application fee (a modest 5,000 dollars at filing), section 200.7 the compliance regime, section 200.8 capital requirements (set case-by-case rather than by formula), section 200.9 custody and protection of customer assets including a hard prohibition on commingling, section 200.10 material change to business, section 200.11 change of control, section 200.12 the books-and-records regime, sections 200.13 through 200.14 examination and financial-reporting authority, sections 200.15 through 200.17 the AML/cybersecurity requirements (the latter cross-referencing 23 NYCRR Part 500), section 200.18 advertising and marketing rules, and section 200.19 consumer protection requirements. NYDFS's coin-listing framework added the Greenlist regime — pre-approved coins that licensees can list without further DFS review — though most listings still require supplemental coin-listing-policy approval. The 2022 supervisory letter introduced a self-certification path for some coin listings under specific conditions. NYDFS's supervisory practice is layered on top of the regulation: examination cycles, attestation requirements, prior-approval requirements for new products, and an active enforcement-and-consent-order pipeline that materially shapes what holding a BitLicense actually requires.

License tiers and categories

BitLicense itself is a single-tier authorisation — there is no Class 1, Class 2, or Class 3 distinction as in MiCA — but it operates in conjunction with a parallel NYDFS regime, the limited-purpose trust company charter under New York Banking Law Article III section 102-a, that many crypto firms hold either alongside or instead of the BitLicense. The trust charter is a bank charter rather than a money-transmitter-style permission, conferring fiduciary status that allows the firm to act as a qualified custodian for institutional clients under the Investment Advisers Act, hold customer fiat in segregated bank accounts, and access the federal payment rails directly. NYDFS's posture has been to prefer the trust charter for institutional custody businesses (Coinbase Custody Trust, Gemini Trust Company, Paxos Trust Company, BitGo New York Trust Company, PayPal Digital) and the BitLicense for retail-facing trading and exchange businesses, though many firms hold both. A third related vehicle is the New York Banking Law section 96 conditional licence — used historically for narrow custody pilots — though it has fallen out of use since 2018. Under the GENIUS Act federal floor, NYDFS-chartered limited-purpose trusts remain a qualifying state path for permitted payment stablecoin issuance, which is why Paxos, Gemini, and Circle's New York affiliates retain or have applied for the trust charter rather than migrating wholesale to the federal OCC track. The BitLicense itself does not directly authorise stablecoin issuance under GENIUS — the trust charter does — though BitLicense holders may distribute and custody compliant PPS.

Capital and operational requirements

Capital requirements under section 200.8 are deliberately not formulaic. The Superintendent sets an amount and a form — typically a surety bond, trust account, or pledged-asset arrangement at a qualifying custodian — calibrated to the projected size and complexity of the licensee's New York-touching business. In practice, capital negotiations with DFS staff have produced commitments running from 1 million dollars at the small-broker end of the spectrum to 25 million dollars or more for the largest exchanges, plus working capital and operational liquidity reserves separately. Custody requirements are materially more prescriptive than under most peer regimes. Section 200.9(a) prohibits any commingling of customer virtual currency with the licensee's own assets. Section 200.9(b) requires that all customer crypto held to the same standard as a fiduciary, with comprehensive insurance against employee fraud and cyber events, and quarterly attestation of holdings. Section 200.15 imposes a comprehensive AML/CFT regime requiring a qualifying BSA officer, an independent BSA/AML audit on a frequency satisfactory to DFS, full OFAC sanctions screening with name-matching against the SDN list updated daily, comprehensive customer due diligence and enhanced due diligence on high-risk customers, and detailed Travel Rule compliance for transfers above 3,000 dollars. Section 200.16 incorporates the 23 NYCRR Part 500 cybersecurity programme — the most demanding state-level cyber regime in the United States, written for banks — including a named CISO reporting to the board, annual penetration testing, comprehensive risk assessments, third-party-risk management, multi-factor authentication on all material systems, and an incident-response programme tested at least annually. Material-change pre-approvals under section 200.10 require DFS clearance for new coins listed (subject to the Greenlist or supplemental coin-listing policy review), new products, new corporate transactions including changes of control, and new senior officers.

Notable licensees

As of mid-2026 the DFS register lists 32 active BitLicenses — 22 stand-alone and 10 held together with a New York money-transmitter licence — plus 11 limited-purpose trust charters. Notable holders include Circle Internet Financial (the first BitLicense, granted September 2015, held with a money-transmitter licence and still active today), Coinbase Inc. (BitLicense plus a separate NYDFS limited-purpose trust charter for Coinbase Custody Trust Company), Gemini Trust Company (operating under the NYDFS limited-purpose trust charter rather than a stand-alone BitLicense, with the trust charter functionally substituting), Bitstamp USA, Robinhood Crypto, Bakkt, bitFlyer USA, Ripple Markets, eToro NY, Paxos Trust Company (NYDFS trust charter rather than BitLicense), Block Inc. (Cash App Bitcoin product), PayPal (both a direct virtual-currency licence and PayPal Digital's 2024 trust charter), and BitGo New York Trust Company (trust charter rather than BitLicense). Notable rejections include Bittrex (whose BitLicense application NYDFS denied in 2019, ordering it to wind down New York operations), Robinhood's earlier BitLicense application that was protracted before its 2019 grant, and Kraken (which withdrew from New York in 2015 rather than apply, though Kraken has since explored a re-entry path). Several firms have surrendered their licences — SoFi Digital Assets and Coinsource among them, and Genesis Global Trading under a 2024 settlement — as strategies moved away from consumer-facing New York activity. The smallness of the active licensee population in the largest financial market on Earth is a regulatory choice rather than an artifact of demand, and is the most informative single fact about BitLicense as a regime.

Enforcement actions to date

NYDFS enforcement under BitLicense has been active and unforgiving. Coinbase Inc. settled for 100 million dollars in January 2023 in a consent order addressing AML programme deficiencies, comprising a 50 million dollar penalty and a 50 million dollar mandatory compliance investment, with continued oversight by an independent monitor. Robinhood Crypto was fined 30 million dollars in August 2022 for cybersecurity, AML, and consumer-protection failures. bitFlyer USA entered a consent order in May 2023 with a 1.2 million dollar penalty for deficiencies in its cybersecurity programme. The Paxos consent order on Binance USD (BUSD) in February 2023 directed Paxos to cease issuing BUSD, leading to the wind-down of the token. Genesis Global Trading agreed in January 2024 to pay an 8 million dollar penalty and surrender its BitLicense over AML and cybersecurity failings identified in examinations. Coin-listing supervision has been a recurring feature: NYDFS's September 2023 overhaul of the Greenlist cut the pre-approved list from more than twenty coins to eight — essentially Bitcoin, Ether, and a handful of NYDFS-approved stablecoins — removing XRP and DOGE among others, and required every licensee to submit a coin-delisting policy for approval by January 2024. Material-change enforcement is a routine feature of supervision: firms have faced consent orders for failing to obtain pre-approval before launching products, listing new coins, or making executive changes.

How to apply

Application materials run to thousands of pages. The substantive filing under section 200.4 comprises a full business plan, a three-year financial projection demonstrating capital adequacy, a detailed AML programme with named BSA officer and independent-audit schedule, a 23 NYCRR Part 500 cybersecurity programme with named CISO and incident-response procedures, a custody architecture document covering wallet segregation and key-management, a disaster-recovery and business-continuity plan, biographical and fingerprint material on every officer, director, and 10 percent or greater shareholder (FBI fingerprint check, Bureau of Alcohol Tobacco and Firearms history, prior-litigation history, source-of-funds inquiry on substantial shareholders), proposed surety-bond or trust-account arrangements, comprehensive policies for compliance, internal audit, conflicts of interest, complaints handling, and consumer protection, and a coin-listing policy aligned with the Greenlist or supplemental review process. The DFS application fee under section 200.5 is 5,000 dollars at filing, but the all-in cost of preparation runs 150,000 dollars at the very low end to 1,000,000 dollars or more for complex multi-product applications. Decision timelines have historically run 18 to 36 months; some applications have lingered three to five years. DFS has moved faster recently for institutional-quality applicants but slower for novel business models. Common rejection reasons include inability to demonstrate bank-grade cybersecurity controls, inadequate capital arrangements, gaps in the AML programme, novel business models that DFS staff are unwilling to clear, and biographical issues affecting senior officers. Ongoing compliance maintenance is materially more expensive than the initial application: 2 to 5 million dollars per year for a mid-tier BitLicense holder, including BSA/AML audits, cybersecurity testing, regulatory reporting, examination response, and prior-approval workflow management.

Comparison to peer frameworks

BitLicense is by significant measure the most demanding state crypto regime in the United States and arguably the most demanding crypto regime anywhere. Against the federal GENIUS Act PPS charter, BitLicense is broader in scope (covering all virtual currency business activity, not just stablecoin issuance) but narrower in geographic reach (single-state versus federal preemption); the two regimes are complementary rather than competing, with most stablecoin issuers preferring the NYDFS trust path over BitLicense for issuance and using BitLicense or the trust charter for related exchange and custody activity. Against MiCA's CASP regime, BitLicense is roughly ten times more expensive, two to three times slower to obtain, and grants only single-state authority versus 27-state passport rights; MiCA is the better deal on cost-benefit for firms that can choose, but BitLicense remains a brand signal that MiCA cannot replicate. Against Texas's Department of Banking money-transmitter regime — Texas is the second most active state for crypto licensing — BitLicense is materially more demanding on capital, cybersecurity, and ongoing supervision; Texas filings run 1 to 5 million dollars all-in versus 150,000 to 1,000,000 for BitLicense, and Texas supervision is materially lighter-touch. Against Wyoming's SPDI charter — the third major US state crypto path — BitLicense covers a broader range of activities but requires materially less crypto-specific banking innovation than Wyoming's framework, which was purpose-built for digital-asset banking. Against Singapore's MAS Major Payment Institution regime, the two are different in posture: MAS supervises through prescriptive ongoing requirements while NYDFS combines prescriptive ongoing requirements with active enforcement; the result is comparable cost but materially different operational feel.

Open questions and pending changes

Three open questions dominate the BitLicense landscape through 2026. First, the relationship between BitLicense and the GENIUS Act federal floor remains in implementation: NYDFS has retained its qualifying-state-path status for stablecoin issuance through the limited-purpose trust charter, but how the federal preemption interacts with BitLicense activity beyond stablecoin issuance — exchange, custody, brokerage — is being worked out through joint OCC-NYDFS guidance expected in mid-2026. Second, NYDFS is under new leadership: Superintendent Adrienne Harris — who drove the 2023 Greenlist overhaul and the department's virtual-currency enforcement wave — departed on 17 October 2025, with Kaitlin Asrow, the executive deputy superintendent who oversaw virtual-currency regulation, named acting superintendent; the direction of coin-listing and Greenlist policy under the new leadership remains to be seen. Third, the long-rumoured fee modernisation — current section 200.5 fees were set in 2015 and have not been updated despite the materially higher supervisory burden — remains pending. Operators should also watch the ongoing dialogue between NYDFS and the OCC over the boundaries of state-versus-federal preemption under GENIUS, the first material-change consent orders under the new federal floor, and the evolving interaction between BitLicense and emerging state-level digital-asset frameworks in Texas, Wyoming, and California.

Watch points

Joint OCC-NYDFS guidance on federal preemption boundaries under GENIUS
Coin-listing and Greenlist policy direction under acting Superintendent Kaitlin Asrow (Adrienne Harris departed October 2025)
Section 200.5 fee modernisation, still pending
First material-change consent orders under federal floor
Interaction with emerging digital-asset frameworks in Texas, Wyoming, California

TL;DR

Decade-old NYDFS regime that remains the most demanding crypto licence on the planet — roughly 30 active grants (32 on the mid-2026 register, plus 11 trust charters), USD 150K-1M to apply, USD 2-5M annual to maintain, but still the gold-standard signal of regulatory legitimacy for US-facing institutional crypto.

Get DeFi Intel research in your inbox

Weekly long-form coverage of papers, incidents, jurisdictions, chains, tokens and the people building them. Free tier covers headlines; Pro adds the analyst-grade breakdowns.

Subscribe (free) DeFi Intel Pro →

Sources

Register counts are from the NYDFS regulated-entities list as of this review; the population changes with new grants and surrenders.