March 10, 2020 

Guidance to Department of Financial Services (“DFS”) Regulated Institutions Engaged in Virtual Currency Business Activity and Request for Assurance Relating to Operational and Financial Risk Arising from the Outbreak of the Novel Coronavirus (COVID-19)

To:  The Chief Executive Officers or the Equivalents of New York State Regulated Institutions Engaged in Virtual Currency Business Activity

The New York State Department of Financial Services (DFS) is issuing this guidance and request for assurance to ensure your institutions have preparedness plans in place to address operational and financial risk posed by the outbreak of a novel coronavirus known as “COVID-19.”

COVID-19 has already had adverse economic effects domestically and globally.  It is critical that each regulated entity establish plans to address how it will manage the effects of the outbreak and assess disruptions and other risks to its services and operations.

To that end, DFS requires that each regulated institution submit a response to DFS describing the institution’s plan of preparedness to manage the risk of disruption to its services and operations.  Responses are to be provided to DFS as soon as possible and in no event later than thirty (30) days from the date of this letter.  Please submit your responses to the following designated email address: [email protected].

An institution’s preparedness plan should be sufficiently flexible to effectively address a range of possible effects that could result from an outbreak of COVID-19, and reflect the institution’s size, complexity and activities.  The institution’s plan, at a minimum, should include the following:

1. Preventative measures tailored to the institution’s specific profile and operations to mitigate the risk of operational disruption, which should include identifying the impact on customers, and counterparts;
2. A documented strategy addressing the impact of the outbreak in stages, so that the entity’s efforts can be appropriately scaled, consistent with the effects of a particular stage of the outbreak;
3. Assessment of all facilities, systems, policies and procedures necessary to continue critical operations and services if members of the staff are unavailable for longer periods or are working off-site, including the effectiveness and security of remote access;
4. An assessment of potential increased risk of cyber-attacks and fraud due to an outbreak;
5. Employee protection strategies, critical to sustaining an adequate workforce during the outbreak, including employee awareness and steps that employees can take to reduce the likelihood of contracting COVID-19;[1]
6. Assessment of the preparedness of critical third-party service providers and suppliers;
7. Development of a communication plan to effectively communicate with customers, counterparties and the public, and to deliver important news and instructions to employees, along with establishing forums for questions to be asked and addressed;
8. Testing the plan to ensure its policies, processes and procedures are effective; and
9. Governance and oversight of the plan, including identifying the critical members of a response team, to ensure ongoing review and updates to the plan, including the tracking of relevant information from government sources and the institution’s own monitoring program.

In addition, from a financial perspective, regulated entities may be impacted by COVID-19 in a variety of ways.  For example, they may be exposed, as a result of the virus’s impact on consumers, counterparties, and vendors, to declining revenues, stock market declines and interest rate changes, supply chain and service disruptions, and decreases in the value of assets and investments.  It is critical that your risk management programs include a plan to assess and monitor the financial risk that may arise from COVID-19.  Such a plan, at a minimum, should include the following assessments:

1. Assessment of the valuation of assets and investments that may be, or have been, impacted by COVID-19;
2. Assessment of the overall impact of COVID-19 on the earnings, profits, capital, and liquidity of your institutions; and
3. Assessment of reasonable and prudent steps to assist those adversely impacted by COVID-19.  See DFS Guidance to New York State Regulated Banks, Credit Unions and Licensed Lenders Regarding Support for Businesses Impacted by the Novel Coronavirus.

DFS would underscore, in particular, the risk to Virtual Currency businesses of increased instances of hacking, cybersecurity threats, and similar events, as bad actors attempt to take advantage of a COVID-19 outbreak, and the possible resulting need for heightened security measures, such as enhanced triggers for fraudulent trading or withdrawal behavior.  We would also underscore the possibility of custody risk for Virtual Currency, such as the possible need for special arrangements to move Virtual Currency from “cold” to “hot” wallets during times when employees may not all be working from their usual locations.  We would also remind you that your institutions may have obligations to notify DFS if positive net worth falls below a certain threshold above the minimum required capitalization.

The boards of directors or the equivalents of your institutions are responsible for ensuring that an appropriate plan is in place, and that sufficient resources are allocated to implement such plan.  The senior management is responsible for ensuring that effective policies, processes and procedures are in place to execute the plan and for communicating the plan throughout the institutions to ensure consistency in approach so that employees understand their roles and responsibilities.

The Federal Financial Institutions Examination Council (FFIEC) has issued an update to the Interagency Statement on Pandemic Planning -- Guidance for Minimizing a Pandemic’s Potential Adverse Effects, FIL-6-2008.

If you have any questions this letter or would like to discuss with DFS any matters related to the impact of COVID-19 on your company, please contact your regular point of contact at DFS, or Evelyn Castillo at [email protected].

Sincerely,

Matthew Homer
Executive Deputy Superintendent – Research and Innovation