New York fines crypto trading platform $30 million in first-ever DFS crypto settlement | Shearman & Sterling LLP
On August 2, 2022, the New York State Department of Financial Services (“DFS”) announced that Robinhood Crypto, LLC (“RHC”), a trading platform that allows customers to trade cryptocurrencies, had agreed to pay a $30 million fine to resolve allegations of “significant” lapses in compliance with New York State anti-money laundering and cybersecurity regulations. In addition to the fine, the settlement will also require RHC to hire an independent consultant to evaluate the company’s remedial work and compliance with the DFS regulations. RHC did not admit the allegations in the consent order.
As described in the DFS Consent Order, New York State law requires financial institutions to maintain an effective anti-money laundering (“AML”) program and to develop and implement systems reasonably designed to identify and report suspicious activity and block illegal transactions; and this applies to entities that trade in cryptocurrency. 23 NYCRR § 200.15(b), (d). Pursuant to 3 NYCRR § 417.2, “licensed money transmitters” are required to establish, implement, and maintain effective AML programs that include, among other things: internal policies, procedures, and controls reasonably designed to protect against money laundering, and accurate, complete, and timely reports of suspicious activity. 3 NYCRR § 417.2. Finally, according to DFS, the Transaction Monitoring Regulation requires certain DFS-regulated entities to maintain transaction monitoring and sanction screening programs that are reasonably designed, based on the risk assessment of the entity, to ensure monitoring of the entity’s transactions for potential BSA/AML violations and reporting of suspicious activity and to prevent transactions prohibited by the US Treasury Department’s Office of Financial Assets Control. 23 NYCRR § 504.3(a), (b).
The DFS charges against RHC stem from a 2020 regulatory investigation and subsequent investigation that allegedly led DFS to find “significant deficiencies” in the trading platform’s Crypto AML program, such as inadequate staffing, insufficient resources, and a manual transaction monitoring system ill-suited to the rapid growing size of the trading platform’s crypto business. Specifically, DFS claimed that RHC’s crypto business “did not have sufficient BSA/AML staff” with appropriate skill levels to support the company’s AML program, as evidenced by its alleged “significant backlog in . . . assessing potentially suspicious transactions.” DFS also found that the trading platform used a manual transaction monitoring system that was allegedly not sophisticated enough to support the trading platform’s high transaction volume, with the company averaging “106,000 transactions daily” as of September 30, 2019. DFS stated that similar deficiencies existed with respect to the trading platform’s cybersecurity program, such as a lack of dedicated internal employees and a lack of coverage of the company’s various operations, among other things. However, DFS noted in its consent order that RHC had already taken some corrective steps since the conclusion of its investigation in 2020.
This is the DFS’s first settlement with an entity operating in the cryptocurrency market and suggests, along with other recent resolutions, that regulators are keen to take “first-time” enforcement action in this area. As the regulatory landscape surrounding cryptocurrency continues to materialize and tighten, companies that trade in cryptocurrency should closely monitor settlements like these and assess their own compliance programs accordingly.
[View source.]
