NYDFS: BitLicense and the New York Trust Charter — Two Doors Into US Crypto

Two Doors, Not a Licence and Its Alternative

New York's crypto regime is usually reduced to one word: BitLicense. The shorthand is expensive. There are two doors into the state, chartered under different statutes and carrying different legal capacity. BitLicense is 23 NYCRR Part 200, in force since 24 June 2015 under the Financial Services Law. The limited purpose trust company is a banking charter under Banking Law Article III: §100 confers fiduciary powers, §§4001 et seq. govern incorporation, and §102-a permits the LLC form — hence "…Trust Company, LLC" in the name of almost every New York crypto trust, whose Certificate of Merit and organisation certificate go directly to DFS rather than through NMLS.

The dividing line is not where it is usually drawn. 200.3(d) bars a BitLicensee from exercising fiduciary powers under §100 Banking Law, while 200.9 is devoted precisely to custody: BitLicense grants custody without fiduciary status. The trust charter grants fiduciary status and removes the need for a separate money transmitter licence under Banking Law Article 13-B, without which a BitLicensee cannot run a fiat leg at all.

The territorial reach is the broadest in the United States. A licence is required for five categories of Virtual Currency Business Activity under 200.2: receiving VC for transmission and transmitting it; custody for others; buying and selling VC as a customer business; exchange services; and controlling, administering or issuing a virtual currency. The trigger is a nexus with a "New York Resident" — "any Person that resides, is located, has a place of business, or is conducting business in New York" — wording that catches a B2B counterparty exactly as it catches a retail client.

The exemptions are narrow. Under 200.3(c) they cover persons chartered under the Banking Law and approved by the superintendent, plus merchants and consumers using VC to buy goods and services or for investment; DFS adds mining, software development, advisory work and donations, and the definition of virtual currency excludes gaming tokens, loyalty credits and prepaid cards. Nor does state licensing displace federal registration: FinCEN MSB registration does not satisfy the BitLicense requirement (FIN-2019-G001).

The DFS register lists 39 entries as of August 2026: 26 live BitLicenses (fifteen alongside an MTL) and 13 trust charters — 2.3 licences a year over eleven years, though the pace has shifted: two in 2024, four in 2025, two in eight months of 2026 (Mastercard, Zap Solutions) plus a charter for Circle Internet Trust Company, LLC in July. Running two entities is the norm: Coinbase, PayPal, NYDIG, MoonPay and Circle each hold a licence and a charter in separate group companies.

Three Regimes Side by Side: BitLicense, NY Trust, OCC Charter

The comparison only makes sense with the federal option in it: since December 2025 the OCC national trust charter is a genuine third door.

Greenlist: Eight Coins and the Regulator's Right to Abolish the List

A New York operator does not own its product line. Greenlist is the set of coins a licensee may list without individual approval; as of August 2026 it holds eight — BTC, ETH, GUSD, GYEN, ZUSD, RLUSD, USDW and GOLD. Prior notice to DFS (the regulator's page states ten days) plus an approved delisting policy is all that is required.

The composition says more than the rules. Six of the eight are stablecoins from entities DFS itself supervises: GUSD from Gemini Trust, GYEN and ZUSD from GMO-Z.com Trust, RLUSD from Standard Custody & Trust, USDW and GOLD from WisdomTree Digital Trust. Greenlist is not a quality rating of the asset; it is a list of issuers the regulator already watches. Hence the elegant detail that XRP was dropped in 2023 while Ripple's stablecoin sits on the list.

The contraction came in September 2023, when the General Framework replaced self-certification and dozens of coins fell out, XRP, BCH and DOGE among them (Greenberg Traurig). Inclusion requires either a "demonstrated, historic record consistent with safety and soundness" or status as a stablecoin already approved by DFS for New York issuance — and the same document reserves the regulator's right to remove any coin or discontinue Greenlist entirely.

Beyond Greenlist sits the final guidance of 15 November 2023. Self-certification requires a board-approved coin-listing policy, re-approved annually, assessing every coin across eight risk categories from technical design to illicit finance. Five categories are closed to retail absent separate DFS approval: non-greenlisted stablecoins, exchange-issued coins, protocols with control concentration above 51%, bridged coins, and coins with circulating supply below 35% of total. A delisting policy is mandatory for anyone listing anything at all, with at least 30 days' customer notice; the filing deadline passed on 31 January 2024.

The Supervisory Layer: Cybersecurity, Transaction Monitoring, Custody

The real weight of the regime sits not in the licence but in the obligations stacked on top of it, and that layer changed every year.

23 NYCRR Part 500 phased in by tranches and only reached full effect on 1 November 2025.

A Class A Company (New York revenue from $20m plus either over 2,000 employees or over $1bn in global revenue) adds privileged access management and an independent audit. In 2026 a supervisory layer settled on top: two industry letters dated 21 May on the heightened threat environment and frontier AI model risk. Separately, 200.17 requires a business continuity plan.

Transaction monitoring is subtler than most summaries suggest. 3 NYCRR Part 504, with its annual April certification of a Transaction Monitoring and Filtering Program, is addressed to "Regulated Institutions", and 504.2 defines those as banks and trust companies under the Banking Law plus check cashers and money transmitters licensed under it. A pure BitLicensee is licensed under the Financial Services Law and formally falls outside: its obligation comes from 23 NYCRR 200.15 — annual risk assessment, independent testing, board-approved policies, OFAC screening, and 24-hour notice to DFS of VC-to-VC transactions above $10,000 in a day by one person. Two operators with identical shopfronts carry different obligations depending on whether they hold an MTL.

Custody was rewritten separately from the licence. The guidance of 30 September 2025 requires full segregation of client assets from those of the custodian and its affiliates, on-chain and in the internal ledger. Two structures are permitted: separate wallets in the client's name, or an omnibus holding client assets only, titled "F/B/O", with a full internal record of beneficial interests. Client assets may not be used for the custodian's own purposes, pledged, lent against, or turned into a debtor-creditor relationship. Sub-custody is now a material change requiring prior DFS approval: the sub-custodian must be DFS-licensed or supervised under a "substantially similar" regime, and the agreement must carry the F/B/O title, segregation and a ban on collateral use.

Two layers rarely make the summaries. The customer service guidance of 30 May 2024 binds BitLicensees and trust companies alike: live human representatives, AI-use disclosure with escalation to a human, quarterly complaint reporting from 1 November 2024. And the guidance of 17 September 2025 extended blockchain-analytics expectations to ordinary New York banks serving crypto-active clients: the perimeter widens through demands on banking partners, not new licences.

Finally, the money. Since 2022 DFS has levied an annual assessment under FSL §206 and 23 NYCRR Part 102: half of supervisory hours by New York transaction volume, half by average custodied client assets, the rest split evenly; five invoices a year (Crowell). That, not the filing fee, is the true cost of the status.

Enforcement: $226.5m and One Recurring Plot

The public enforcement record is compact and monotonous. Robinhood Crypto, 2 August 2022, $30m — the first DFS crypto action: understaffed compliance, an un-upgraded monitoring system, false compliance certifications. Coinbase, 4 January 2023, $100m — $50m penalty plus $50m into compliance, against a backlog of over 100,000 unreviewed alerts. Genesis Global Trading, January 2024, $8m — the first forfeiture of a BitLicense under a consent order. Block, 10 April 2025, $40m — BSA/AML failures and an unresolved 2019–2020 alert backlog. Paxos Trust Company, 7 August 2025, $48.5m — $26.5m penalty plus at least $22m into compliance over the Binance partnership, through which $1.6bn of illicit transactions passed in 2017–2022.

The aggregate depends on method: $226.5m including compliance-investment commitments, $154.5m in pure penalties. The plot repeats in three of the five: the product scaled, monitoring did not, alerts piled up.

There has been exactly one public denial in eleven years — Bittrex, 10 April 2019: BSA/AML/OFAC deficiencies, capital shortfalls, weak controls over token launches; roughly 35,000 New York customers out of 1.67m globally, 60 days to wind down. The statistic misleads: filtering happens pre-application and through withdrawals, and the fee's non-refundability (200.5) discourages premature filing.

Read that severity alongside the State Comptroller's audit 2024-22S18 for July 2018 to July 2023: 22 active licensees as of October 2022 holding over $175bn in assets across 21 of them; an application-processing manual not finalised until June 2022, seven years after Part 200 took effect; an average three-year gap between mandatory biennial examinations. The "strictest regime in the US" reputation rests on entry hurdles and penalty size more than supervisory density — at least until the unit grew from roughly 18 to more than 60 staff in 2022–2023.

Adrienne Harris stepped down on 18 October 2025; Kaitlin Asrow is acting superintendent. As of 13 August 2026 the DFS press release feed shows no crypto-specific enforcement while licensing has accelerated — with the caveat that DFS does not publicise every consent order.

Federalisation 2025–2026: the OCC, the GENIUS Act and the Calendar to 2028

The dominant story of the past eighteen months is not a tightening of the state regime but a competing federal channel. On 12 December 2025 the OCC granted five conditional approvals: de novo charters for Circle and Ripple vehicles, conversions of state trust companies for BitGo, Fidelity Digital Assets and Paxos. Before that, only Anchorage Digital held a federal crypto charter, from January 2021.

The outflow shows in the register: Paxos and Fidelity Digital Assets converted into federal trust banks on 12 December 2025 and no longer appear on the DFS list. Coinbase received preliminary conditional approval on 2 April 2026 requiring $60m Tier 1 and committing it to migrate custody out of Coinbase Custody Trust Company, LLC over three years; the ICBA is pressing the OCC to withdraw it. The weight of the state record shows in the Paxos N.A. conditions: alongside $15m Tier 1, the OCC wrote in an obligation to spend $7.25m in 2026 and $8.5m in 2027 remediating the failures found in the NYDFS consent order. Going federal does not erase the state file.

The traffic runs both ways. Circle, having secured OCC conditional approval in December 2025, took a New York charter as well in July 2026; Ripple keeps its state perimeter through Standard Custody & Trust; Fidelity and Paxos converted outright (Steptoe). The charter drains state trusts unevenly, and part of the field is building a dual perimeter.

The engine is the GENIUS Act, effective 18 July 2025. Two tiers: stablecoin issuers above $10bn move to federal supervision, those below may stay at state level as a "state qualified payment stablecoin issuer" — but only if Treasury certifies the state regime as "substantially similar". Treasury's NPRM of 3 April 2026 introducing 31 CFR Part 1521 (comments closed 2 June 2026) splits requirements into uniform ones — reserves, BSA/AML, disclosures, where the state must match the federal standard exactly — and state-calibrated ones covering capital, governance and risk management, where a different answer works if the outcome is "at least as robust".

New York's answer is proposed 23 NYCRR Part 202, published 9 June 2026, creating the status of Authorized Payment Stablecoin Issuer for trust companies and charter applicants. Reserves sit with external institutions; above $25bn in circulation, at least 0.5% of reserves, capped at $500m, must sit in insured deposits; reporting is monthly, certified by CEO and CFO and attested by a registered audit firm; redemption runs within two business days. Capital is CET1 calibrated to the risk profile, failure two consecutive quarters triggers mandatory liquidation, and cybersecurity must meet Class A standards regardless of size. Where it conflicts with existing supervisory agreements the Part controls, while state authority over custody (GENIUS §10) and insolvency (§11) survives — see King & Spalding.

The GENIUS Act therefore caps New York in both directions. To win Treasury certification the state cannot be stricter than the federal standard, and the $10bn ceiling means any successful state issuer must move to the OCC as it grows: the state regime is by design an incubator, not an endpoint. New York will hold ground where GENIUS left it authority — custody and insolvency — while building an external perimeter in parallel: on 2 June 2026 DFS signed a memorandum with the EBA on cross-border stablecoin activity.

Fiduciary Status and Account Structure at a New York Custodian

The only question that truly matters when choosing a New York custodian is whether it holds fiduciary status: under 200.3(d) a BitLicensee cannot. Where the structure involves a trust, succession, discretionary management or a "qualified custodian" requirement, the counterparty must be a trust company — state or federal.

Protection is therefore defined by the legal entity, not the logo. Coinbase, Inc. with a BitLicense and Coinbase Custody Trust Company, LLC with a trust charter are different regimes; PayPal, NYDIG, MoonPay and Circle are built the same way. The question is literal: which entity signed, and what is its status on the DFS register.

Next comes the account structure under the 30 September 2025 guidance: segregated wallets in the client's name or an "F/B/O" omnibus; whether sub-custody exists and whether DFS approved it as a material change; who the sub-custodian is and under what supervision. Written disclosure must be acknowledged before the first transaction — its absence is a marker of process immaturity. The ban on using client assets is absolute, so any yield overlay warrants scrutiny; the broader logic sits in the note on crypto for private wealth.

Three items belong on a monitoring list. Charter migration: Coinbase's custody move and the completed exits of Paxos and Fidelity mean a change of regulator, of insolvency regime and possibly of documentation. The asset menu: an eight-coin Greenlist, everything else through an approved listing policy. And regulatory status is not service availability: holding a BitLicense does not mean a product is open to New Yorkers.

The Fork at the Start and the Real Cost of Entry

The fork is set before the first line of code. Custody, stablecoin issuance and fiduciary services point straight to a trust charter. Exchange, brokerage and on-ramp point to a BitLicense plus a separate Article 13-B MTL for the fiat leg. Moving from licence to charter is not an upgrade but a new entity under a different procedure.

The $5,000 fee is noise. The real cost is the Certificate of Merit with three-year pro formas, a wind-down analysis and a resolution plan; the investigation fee; fidelity insurance from $1m; a surety bond benchmarked at $500,000 and up; capital that 200.8 leaves to the superintendent's discretion; and a standing assessment. The 90 days in 200.6 run from an application the superintendent deems complete: the controllable variable is package quality, and DFS states plainly that applications not ready for substantive review will not get expert review. No aggregated public data on actual timelines exists.

Four lessons from the enforcement record. Compliance must lead growth: three of the five largest consent orders run on the same failure of monitoring to scale. Third-party diligence is a documented process in its own right — Paxos paid $48.5m for a partner. A false compliance certification is a standalone violation, and the Acknowledgment of Noncompliance exists precisely so it can be used instead. Customer service is compliance, not marketing: Robinhood's missing complaints line made it into the consent order.

Two decisions are taken up front. If the goal is a stablecoin, build cybersecurity to Class A from day one, since Part 202 demands that level regardless of size. And if infrastructure is rented, read the landlord's status as carefully as your own: Fireblocks has held a New York trust charter since 2024, Zerohash holds two BitLicenses, and the Custodia saga shows charter status and infrastructure access are different things.