This guide covers whether you need a BitLicense, how your business model changes the analysis, what the New York Department of Financial Services (NYDFS) expects before approval, and how to prepare for supervision. Verify every requirement against current NYDFS sources. This article is not legal advice.
Key Takeaways
- Applicability turns on activity, custody or control, and New York customer links, not just where you are incorporated.
- Handling both digital assets and fiat means assessing the BitLicense and money transmitter regimes separately.
- NYDFS looks for AML, cybersecurity, custody, capital, governance, consumer protection, records and listing controls.
- Strong applications show processes already designed, staffed, documented and producing evidence.
What Is a NY BitLicense and When Is It Required?
What a BitLicense regulates
The BitLicense is the NYDFS authorization for virtual currency business activity under 23 NYCRR Part 200. Unlike a simple registration, it brings licensing, examination, reporting, and continuing supervisory expectations.
Activities that trigger licensing
Under Part 200, covered activity involving New York or a New York resident includes:
- Receiving virtual currency for transmission, or transmitting it
- Storing, holding or controlling virtual currency for others
- Buying and selling virtual currency as a customer business
- Performing exchange services as a customer business
- Controlling, administering or issuing virtual currency
Exchanges, custodians, payment platforms, and stablecoin issuers sit squarely in scope. The key distinction for wallets is control. NYDFS says a developer of self-custody wallet software is not licensed solely for that, while a service holding customers' currency likely is.
New York nexus and customer access
"New York resident" covers anyone who resides, is located, has a place of business, or conducts business in New York. A company incorporated elsewhere can still be caught. Your analysis should cover onboarding, geographic restrictions, geofencing, marketing, and transaction monitoring.
Exemptions and boundary cases
Section 200.3(c) exempts two groups:
- New York Banking Law-chartered entities approved by the Superintendent to conduct virtual currency activity
- Merchants and consumers using virtual currency solely to buy goods or services, or for investment
Software development alone is not licensed activity, but it is not a third exemption either. Read these narrowly. A software or infrastructure provider moves into licensing territory once it takes custody, controls assets, executes transactions, or acts as an intermediary.
BitLicense versus money transmitter licensing
NYDFS states that a BitLicense applicant must separately apply for a money transmitter license where required. The BitLicense does not cover every fiat money transmission activity. The money transmitter analysis turns on whether the fiat activity falls within Banking Law Article 13-B.
A practical perimeter test:
- Who is the customer, and what is the relationship?
- How do fiat and digital assets flow?
- Who controls private keys?
- Which products are supported?
- How do New York users access the service?
- Is any issuance planned?
Platforms that accept dollars, transmit fiat, exchange fiat for crypto, or process withdrawals should evaluate both regimes.
NY BitLicense Requirements: What NYDFS Assesses
NYDFS reviews duties set out in specific Part 200 sections:
- Compliance (200.7)
- Capital (200.8)
- Customer assets (200.9)
- AML (200.15)
- Cybersecurity (200.16)
- Business continuity (200.17)
- Consumer protection (200.19)
Anti-money laundering and BSA controls
Part 200.15 requires a risk-based, board-approved AML programme, with independent testing at least annually. It should cover:
- Customer identification and due diligence
- OFAC and sanctions screening
- Transaction monitoring and suspicious activity escalation
- Qualified compliance staff and training
- Recordkeeping
NYDFS guidance from April 2022 expects blockchain analytics to augment KYC, monitor on-chain activity and screen sanctions exposure. Outsourcing the tool does not outsource responsibility. Enforcement shows the stakes: NYDFS cited Coinbase's 2023 settlement for weak KYC and an alert backlog, with a $50 million penalty plus a $50 million compliance investment.
Cybersecurity, incident response and resilience
Two layers apply. Section 200.16 requires a written cybersecurity programme with a CISO, board reporting and testing.
The broader Part 500 regulation adds further duties:
- Annual certification or acknowledgement of noncompliance by 15 April
- Notice to NYDFS within 72 hours of a reportable event
- Multifactor authentication for anyone accessing information systems from 1 November 2025, subject to exceptions
Policies on paper are not enough. Keep completed access reviews, penetration-test results, remediation records, incident exercises and updated recovery plans.
Custody and customer asset protection
NYDFS's September 2025 custody guidance replaced the 2023 version. It emphasises:
- Customer beneficial ownership
- Separate accounting and wallet or ledger records
- No use of customer virtual currency for the custodian's own purposes
- Prior NYDFS approval for new sub-custody arrangements
Contracts and customer disclosures should state clearly who holds what, especially with third-party custodians.
Capital, financial condition and bonding
There is no universal fixed capital figure. NYDFS sets the amount case by case, weighing assets, liabilities, volume, leverage, liquidity, customer types and products. Section 200.9 separately requires a surety bond or trust account for customer protection.
Governance and control persons
Expect ownership disclosures, background checks and control-person review. Name accountable owners for AML, cybersecurity, complaints, custody, reporting and risk. Generic policy language will not satisfy reviewers.
Consumer protection, listing, records and reporting
- Section 200.19 requires risk, account and transaction disclosures and receipts
- Records are generally kept seven years (200.12)
- Examinations occur at least every two calendar years (200.13)
- Quarterly financials are due within 45 days, plus annual audited statements (200.14)
- Coin listing needs an approved listing policy and a delisting policy; without one, generally only Greenlist coins may be listed
- Stablecoin guidance calls for full reserves and redemption within two business days
How to Apply for a NY BitLicense
Confirm the perimeter and applying entity
Start with a pre-application analysis. Identify which activities need authorisation, whether a money transmitter licence is also needed, which entity applies, and whether a limited-purpose trust charter fits better.
Map these areas before drafting:
- Customers and products
- Jurisdictions and transaction flows
- Custody, vendors and supported assets
Build the operating model and business plan
Cover these elements in the plan:
- Products, target customers and New York exposure
- Revenue model and transaction flows
- Custody, technology and vendors
- Staffing, projections and growth
Tailor policies to real workflows rather than generic templates.
Assemble the package
Applications go through NMLS using the NY Virtual Currency Business Activity License New Application Checklist. Expect:
- Ownership and organisational information
- Control-person materials
- Financial statements and projections
- AML, cybersecurity, consumer protection and business continuity documents
- Custody and technology descriptions
- Asset-listing governance
NYDFS says filings are not reviewed substantively until informationally complete, and missing items are the most common cause of delay. Confirm current fees, forms and fingerprint requirements on the live checklist.
Manage NYDFS review
Expect completeness checks, substantive review, background investigations, requests for information and possible revisions. Build a response team, a version-controlled evidence library and clear ownership of each answer. Keep the business plan, policies, financial model, technology description and customer disclosures consistent.
Prepare for approval and supervision
Approval starts the supervisory relationship. Policies must actually operate, and material changes need prior written approval. A firm can use Fraxtional's director-led fractional compliance leadership, including fractional CCO, BSA Officer, CAMLO, MLRO or CRO support, to build and operationalise a programme before filing. That supports readiness. It does not guarantee approval or replace legal counsel.
BitLicense Costs, Timing and Ongoing Obligations
Application and operating costs
The application fee is $5,000 under 23 NYCRR 200.5, but it is the smallest part of the commitment. Verify the live NYDFS fee schedule and NMLS screens before quoting a total. Other costs include:
- Annual supervisory and regulatory assessments, billed quarterly with a final true-up
- Legal and regulatory advice
- Compliance staff and AML tooling
- Cybersecurity testing and audits
- Capital, bonding and custody infrastructure
Review timeline
NYDFS publishes no fixed processing time. How long review takes depends on factors such as:
- Application complexity
- Custody and stablecoin features
- Number of control persons
- Policy quality
- Volume of information requests
A complete first submission and substantive RFI responses are the factors you control.
Post-approval obligations
- Examinations at least every two calendar years
- Quarterly and annual audited financials
- Part 500 certification by April 15
- Incident reporting and complaint monitoring
- Prior approval for material changes and changes of control
Fraxtional's fractional compliance leadership helps growing firms meet these duties while they decide whether and when to hire a full-time executive.
Alternatives to a BitLicense and a Practical Readiness Plan
Limited-purpose trust charter
NYDFS describes the limited-purpose trust charter as a Banking Law alternative. Applicants submit an organization certificate and Certificate of Merit, and enter a supervisory agreement. It may suit institutional custody or fiduciary models, but it is not an easier or universally better route. The directory lists BitGo, WisdomTree Digital Trust and Bastion Platforms as examples.
Conditional license, partners and excluding New York
A conditional BitLicense carries reasonable conditions and expires two years after issuance unless NYDFS removes conditional status or renews it. It is not a permanent workaround.
A licensed-partner arrangement is not an established safe harbor. If you partner or exclude New York users, define who is responsible for assets, onboarding, execution, geofencing, monitoring and marketing. A contract clause alone may not suffice if the model still serves New Yorkers.
BitLicense readiness checklist
- Define the regulatory perimeter
- Select the entity and authorization path
- Map custody and transaction flows
- Build AML and cybersecurity programs
- Document governance and named owners
- Validate capital and projections
- Prepare customer disclosures
- Test controls
- Organize evidence
- Assign ownership for NYDFS responses
Crypto, fintech, money transmitter, banking and embedded finance leaders can assess whether Fraxtional's fractional compliance leadership offers a sustainable path toward licensing and supervision.
Frequently Asked Questions
What is a NY BitLicense?
It is the NYDFS authorisation for covered virtual currency business activity under 23 NYCRR Part 200. It involves ongoing supervision, not a one-time registration.
What crypto exchange is legal in New York?
Authorisation changes over time. Check the NYDFS virtual currency business directory, then confirm the exchange's current authorisation, products and eligibility directly.
Do I need a crypto licence?
It depends on your activities, custody or control of assets, customers and New York exposure. A BitLicense and a money transmitter licence may need separate assessment.
How much does a BitLicense cost?
The application fee is $5,000. Capital, bonding, compliance staff, AML tools, cybersecurity, audits and assessments add considerably more. Confirm current amounts with NYDFS.
Do I need a money transmitter licence as well?
New York treats virtual currency activity and fiat money transmission as separate questions. Analyse dollar flows, transmission, exchange, withdrawals and third-party providers to decide which authorisations apply.
