State Regulation of Cryptocurrency and Digital Asset Exchanges

New York was the first state to establish a comprehensive regulatory framework for cryptocurrency and digital asset businesses through the BitLicense regulation, adopted by the Department of Financial Services (DFS) in 2015. The BitLicense requires any business engaged in virtual currency business activity involving New York or its residents to obtain a license from DFS, meet capital requirements, maintain compliance programs, and submit to regular examinations. While some industry participants criticized the BitLicense as overly burdensome, it established New York as a leader in cryptocurrency regulation and provided a template for other states and countries.

The rapid evolution of the cryptocurrency industry has created new regulatory challenges. The emergence of decentralized finance (DeFi) protocols, non-fungible tokens (NFTs), stablecoins, and decentralized autonomous organizations (DAOs) has tested the boundaries of existing regulatory frameworks. The collapse of several major exchanges and lending platforms, resulting in billions of dollars in consumer losses, has underscored the need for effective regulatory oversight. At the federal level, jurisdictional disputes between the SEC and CFTC over the classification of digital assets have created regulatory uncertainty, making state-level enforcement even more critical.

New York's regulatory authority over cryptocurrency businesses derives from multiple sources. The Financial Services Law authorizes DFS to supervise and regulate the activities of virtual currency businesses operating in or serving residents of the state. The BitLicense regulation implements this authority by establishing licensing requirements, consumer protection obligations, and supervisory standards. Companies that engage in virtual currency business activity, defined to include receiving, storing, transmitting, exchanging, or controlling virtual currency on behalf of others, must obtain a BitLicense or operate under a limited-purpose trust company charter.

The Martin Act, New York's blue sky law, provides the Attorney General with broad antifraud powers that extend to securities and commodities transactions. The question of whether specific digital assets constitute securities under state law parallels the federal analysis under the Howey test but is not identical to it. The Martin Act does not require proof of scienter (intent to defraud), making it a more powerful enforcement tool than federal securities law in certain respects. The opinion analyzes the application of the Martin Act to various categories of digital assets, including utility tokens, governance tokens, and stablecoins, concluding that many digital assets meet the definition of securities or investment contracts under state law.

The interplay between state and federal regulation raises preemption concerns. The National Securities Markets Improvement Act (NSMIA) preempts state registration requirements for "covered securities," but does not preempt state antifraud enforcement. The opinion concludes that New York retains authority to bring antifraud actions against cryptocurrency businesses under the Martin Act even when the assets at issue may also be subject to federal securities regulation. Similarly, state money transmission laws apply to cryptocurrency businesses that transmit virtual currency on behalf of customers, and federal banking regulation does not preempt these state-level requirements.

New York possesses comprehensive regulatory authority over cryptocurrency and digital asset businesses that serve New York residents. This authority encompasses licensing and supervision through DFS, antifraud enforcement under the Martin Act, and consumer protection actions under the Executive Law. The state should enhance enforcement against unlicensed exchanges, fraudulent offerings, and deceptive practices in the cryptocurrency market, while working with federal regulators to ensure coordinated and consistent oversight of the digital asset ecosystem.

This opinion puts cryptocurrency businesses on notice that operating without a BitLicense while serving New York customers constitutes a violation of state law. Companies that issue digital tokens should conduct a securities law analysis under both federal and state frameworks, as state enforcement may proceed even where federal jurisdiction is contested. Consumer protection attorneys should be aware of the Martin Act's broad reach and the Attorney General's willingness to pursue enforcement actions in the digital asset space. Investors who have suffered losses in cryptocurrency transactions should consider state-law remedies in addition to federal securities claims.