Any person or entity engaging in virtual currency business activity involving New York or a New York resident must obtain a BitLicense under 23 NYCRR Part 200, unless a narrow exemption applies. The rule captures five activity categories defined under 200.2(q): receiving or transmitting virtual currency, custody, buying and selling as a customer business, exchange services, and issuing or controlling a virtual currency. Most applicants stall not on the law itself, but on an incomplete BitLicense Application Checklist.
TL;DR:
- Completing every checklist item, including background checks and financial audits, is crucial for a smooth and timely review process.
- Developing a robust coin-listing and cybersecurity policy before application submission greatly reduces delays and review issues.
- Being transparent about business activities, especially in custody and exchange services, helps avoid unneeded regulatory hurdles.
- A comprehensive application should include detailed operational policies, clear organizational structure, and prepared financial projections aligned with stated activities.
- Consulting with regulatory experts early can prevent common pitfalls and ensure compliance aligns with long-term strategic goals.
Table of Contents
- What Triggers BitLicense Requirements: The Five Licensable Activities
- Key Regulatory Requirements: Capital, Bonding, AML, and Cybersecurity
- How to Apply for a BitLicense: Process, Checklist, and Costs
- Conditional BitLicense vs. Limited Purpose Trust Company
- Post-Licensure Obligations: Exams, Reporting, and Enforcement Risk
- Avoiding the Most Common Application Pitfalls
- Why Most BitLicense Guides Miss the Point
- How Murphy’s Law Supports Your BitLicense Application
- Sources
- FAQ
What Triggers BitLicense Requirements: The Five Licensable Activities
New York doesn’t regulate cryptocurrency in the abstract. It regulates specific conduct, and that distinction matters when you’re deciding whether your business model actually needs a license. The New York State Department of Financial Services built its entire framework around five activity buckets spelled out in 23 NYCRR 200.2(q), and if your business touches any one of them with New York customers, you’re in scope.
Receiving or transmitting virtual currency covers most transfer-based business models, though a one-off transfer for a non-financial purpose, like a merchant accepting Bitcoin for a sandwich, generally falls outside the definition. The line gets blurry fast once you start routing funds on behalf of others as a business practice.
Custody or safekeeping is its own trigger, separate from self-custody. If you hold private keys or otherwise control customer assets, you’re providing custodial services regardless of what you call the product. A wallet that only lets users hold their own keys operates differently under the regulation than one where your company can move funds.
Buying and selling virtual currency as a customer business covers exchanges and brokerages that transact with retail or institutional customers, not personal trading.
Exchange services apply to platforms matching buyers and sellers or converting between fiat and virtual currency.
Issuing or controlling a virtual currency sweeps in stablecoin issuers and certain token projects that retain control over supply or redemption.
Common exemptions include:
- Merchants and consumers using virtual currency solely to purchase goods or services
- Software developers who build tools without controlling customer funds
- Miners who validate transactions without providing the other four activities
- Entities already chartered as a New York-regulated bank conducting virtual currency activity within that charter
Cross-border businesses often assume they’re outside DFS’s reach because they’re headquartered elsewhere. That assumption is wrong. If your platform serves New York residents, your location doesn’t matter. The trigger is the customer’s residency, not your headquarters address.
Key Regulatory Requirements: Capital, Bonding, AML, and Cybersecurity
Once you’re inside the scope of BitLicense compliance guidelines, the regulation asks for a specific set of financial and operational commitments. None of them are optional line items you can defer until after approval.
Capitalization isn’t a flat number. DFS assesses adequacy based on your business model, transaction volume, and risk profile. A custodial wallet provider handling institutional assets needs a materially different capital cushion than a small exchange facilitating retail trades. Applicants should expect DFS to scrutinize working capital, liquidity, and the ability to absorb operational losses without threatening customer funds.
Surety bonds and custodial protection come directly out of 23 NYCRR 200.9(a), which requires either a surety bond or a funded trust account sized to protect customers. Minimum bonding commonly starts near $500,000, though DFS sets the actual figure based on your specific business and the risk it presents to New York residents. Businesses holding customer assets in custody typically face higher requirements than those that never touch customer funds directly.
AML and BSA program requirements mirror what federal regulators expect, but DFS layers its own supervision on top. You’ll need a written AML program, a designated compliance officer, customer due diligence procedures, suspicious activity monitoring, and an expectation that you’re registered with FinCEN as a money services business where applicable. DFS doesn’t treat FinCEN registration as a substitute for state compliance. It treats it as a baseline.
Cybersecurity obligations overlap heavily with 23 NYCRR Part 500, the Department’s broader cybersecurity rule for regulated financial entities. Expect to designate a Chief Information Security Officer, maintain a written cybersecurity policy, run annual penetration testing, deploy multifactor authentication, encrypt sensitive data, and certify compliance annually. Incident reporting windows are tight. A material cybersecurity event typically must be reported to DFS within 72 hours of discovery, and failing to catch that clock can turn a manageable incident into an enforcement problem.
Consumer protection requirements include clear disclosures on fees and risks, transaction receipts, a documented complaint-handling process, and trust-accounting practices that keep customer funds segregated from operating capital. Regulators want to see, on paper, that customer money can never quietly become working capital during a cash crunch.
Finally, books and records must be retained for years, not months, and larger or higher-risk licensees should anticipate independent audits as part of ongoing supervision. Building a compliance program that satisfies these expectations from day one is far cheaper than retrofitting one after your first exam.
How to Apply for a BitLicense: Process, Checklist, and Costs
The bitlicense application process runs through the Nationwide Multistate Licensing System, and the biggest predictor of a smooth review isn’t legal argument. It’s document completeness. DFS has said plainly that an application isn’t ready for substantive review until every required item is submitted and appears facially adequate. Here’s how the process typically unfolds.
-
Submit through NMLS. Your application, corporate documents, and supporting exhibits all flow through this system, which DFS uses across multiple license types, not just virtual currency.
-
Assemble the BitLicense Application Checklist categories. These include organizational documents (articles of incorporation, bylaws, org charts), audited or reviewed financial statements, a detailed business plan, AML and cybersecurity policies, biographical information on principals and key personnel, and fingerprint-based background checks for control persons.
-
Clear the completeness gate. DFS reviews your submission first for whether it’s facially adequate, meaning the required pieces exist and look coherent, before anyone dives into substantive analysis. Applications that fail this initial pass sit in limbo rather than moving forward.
-
Enter substantive review. Once DFS accepts the application as complete, examiners dig into your financials, compliance policies, and operational controls in detail. This is where gaps in your AML program or vague coin-listing policies get flagged.
-
Respond to DFS follow-up requests. Expect additional document requests or clarifying questions. How quickly and thoroughly you respond affects your place in the review queue.
Timeline expectations vary widely depending on how prepared you are at submission, but a realistic range spans several months for the completeness phase alone, with substantive review adding more time depending on the complexity of your business model.
Cost buckets break down into three parts: a $5,000 nonrefundable application fee, reimbursement to DFS for investigation costs tied to background checks and examination work, and separate spend on legal counsel or compliance consultants, which often exceeds the application fee itself by a wide margin.
Organize your submission with an exhibit index that maps directly to the checklist, use consistent templates for policies across AML, cybersecurity, and coin-listing documentation, and build sample financial projections that align with your stated business plan rather than generic boilerplate. Start audits, background checks, and fingerprinting early. These take weeks to process and are the easiest items to let slip. Running an internal readiness review before you submit, essentially a dry run of what a DFS examiner would ask, catches gaps while they’re still cheap to fix.
If you’re incorporating a new entity specifically to hold the license, getting the corporate structure right from the start avoids costly amendments mid-application.
Conditional BitLicense vs. Limited Purpose Trust Company
Not every applicant needs the full BitLicense from day one, and not every applicant should default to it. DFS has discretion to grant a conditional license to businesses that don’t yet satisfy every regulatory requirement outright. Factors the superintendent weighs include the scope and nature of your business, your overall risk profile, whether you’re already registered with FinCEN, and any prior experience operating in regulated financial services. A conditional license functions as a tactical bridge, letting a business enter the New York market faster while it builds toward full compliance, but it typically comes with operational conditions attached that can constrain growth until those conditions lift.
The alternative many founders overlook is chartering as a Limited Purpose Trust Company (LPTC). An LPTC carries fiduciary powers a standard BitLicense doesn’t, and it can avoid the need for separate money transmitter licenses in other states depending on your business model. The trade-off is steeper: higher capitalization thresholds and more rigorous board governance expectations. Businesses planning long-term custodial or fiduciary services should model both paths with counsel before committing, since converting from one structure to the other later is far more expensive than choosing correctly up front.
Post-Licensure Obligations: Exams, Reporting, and Enforcement Risk
Getting the license is the beginning of DFS supervision, not the end of it. Examinations focus on financial condition, internal controls, systems resilience, and cybersecurity posture, and DFS doesn’t wait for a crisis to look under the hood.
Recurring obligations include:
- Quarterly financial reports demonstrating continued capital adequacy
- Annual audited financial statements from an independent accounting firm
- Event-driven notices for material changes, such as a change in control, a new coin listing, or a significant cybersecurity incident
- Cybersecurity incident reports filed within the Department’s required window, generally 72 hours of discovery for material events
- Ongoing records retention covering transactions, compliance testing, and governance documentation like board minutes and vendor due diligence files
Enforcement risk is real and escalates by severity. DFS has issued monetary assessments, entered consent orders requiring remediation plans, and in serious cases revoked licenses outright. The gap between a manageable finding and a consent order usually comes down to whether your compliance documentation shows a functioning program or a paper one. If you’re facing a regulatory inquiry, how you respond in the first weeks often shapes the entire outcome.
Avoiding the Most Common Application Pitfalls
Most delays trace back to a handful of recurring mistakes, and nearly all of them are preventable with earlier planning.
Incomplete checklist items remain the single largest cause of stalled applications. Missing a background check, submitting unaudited financials, or leaving gaps in your organizational chart pushes your file back to the completeness queue instead of forward to substantive review.
Weak or missing coin-listing policies have become a bigger problem since DFS tightened its stance. Current guidance requires an NYDFS-approved coin-listing and coin-delisting policy before you can self-certify new coins, along with tailored risk assessments for each asset and documented records of your self-certification decisions. Applicants who treat this as an afterthought often have to rebuild the entire policy mid-review.
Cybersecurity gaps and vague control structures are the other repeat offenders. Examiners want specifics: named roles, tested procedures, and documented incident response plans, not general statements of intent.
Practical readiness steps: appoint a single project lead to own the application, run a mock DFS review internally before submitting, assemble your AML and cybersecurity evidence early, secure reviewed or audited financials well ahead of your target filing date, and start fingerprinting and background checks for principals immediately since they’re often the longest lead-time item.
Pro Tip: Engage regulatory counsel before you draft your coin-listing policy, not after DFS flags it. A policy built with the conditional-license framework in mind from the start often clears review faster than one retrofitted under pressure.
Why Most BitLicense Guides Miss the Point
Most guidance treats the BitLicense as a paperwork exercise: fill out the checklist, pay the fee, wait for approval. That framing undersells what DFS is actually testing. The application process is a stress test of whether your internal controls function in practice, not just on paper, and firms that scrape together compliance documentation just to clear submission tend to struggle the moment an examiner starts asking follow-up questions post-licensure.
The conventional advice to “get your documents together” also understates how much judgment calls matter. Deciding between a conditional license and full BitLicense, or between a BitLicense and an LPTC charter, shapes your operational flexibility for years. Businesses that make that call without modeling long-term capital and governance needs often find themselves boxed in later.
If there’s one priority for a founder starting this process today, it’s this: build your coin-listing policy and cybersecurity program before you touch the application, not during it. DFS’s tightened scrutiny on both areas since late 2023 means they’re no longer boxes to check. They’re the parts of your file examiners read most closely.
— Mark
How Murphy’s Law Supports Your BitLicense Application
Filing a BitLicense application without regulatory counsel is a lot like representing yourself in a case with no precedent to rely on. The requirements are specific, the review is unforgiving of gaps, and the cost of getting it wrong the first time far exceeds the cost of preparing it correctly. Murphy’s Law works directly with New York virtual currency businesses on application review, coin-listing and coin-delisting policy drafting, full compliance program design, and regulatory response when an inquiry or examination finding needs a defense strategy.
Founded by Liam Murphy, Esq., who has litigated matters involving Celsius, Terraform Labs, and BitMEX, the firm brings courtroom experience to compliance work most consultants have never tested under pressure. That matters when your application, your coin-listing policy, or your AML program eventually faces a DFS examiner asking hard questions. If you’re preparing to apply, mid-review, or already facing a regulatory inquiry, schedule a consultation with our compliance team before your next filing deadline.
Sources
- Virtual Currency Business Licensing – NYDFS
- 23 NYCRR 200.2 — Virtual currency business activity definitions (Cornell LII)
FAQ
What are the requirements for obtaining a BitLicense in New York?
Applicants must submit organizational documents, audited financials, a business plan, AML and cybersecurity policies, and background checks through NMLS, then satisfy DFS’s completeness review before substantive examination begins.
What is a BitLicense?
A BitLicense is a New York State authorization under 23 NYCRR Part 200 required for businesses conducting virtual currency activity involving New York residents, covering receiving, custody, exchange, buying/selling, or issuing virtual currency.
What are the current regulations on Bitcoin in the US?
Cryptocurrency regulation in the US is fragmented across federal agencies and individual states; New York is one of the few states with a dedicated licensing regime through DFS, while most other states rely on existing money transmitter frameworks.
Is the US going to regulate bitcoin further?
Federal crypto regulation continues to evolve, but no comprehensive federal licensing framework currently replaces state-level regimes like New York’s BitLicense, meaning state compliance stays essential for the foreseeable future.
How long does the BitLicense application process take?
Timelines vary based on preparation, but incomplete checklist submissions are the most common cause of extended delays, while facially adequate applications move to substantive review faster.