The New York Department of Financial Services has issued sweeping new guidance aimed at preventing cryptocurrency custodians from commingling customer funds with their own assets, delivering a clear regulatory response to the spectacular collapses that shook the digital asset industry throughout 2022.
TL;DR
- NYDFS published guidance on January 23, 2023, requiring virtual currency custodians to segregate customer assets from proprietary holdings
- Both equitable and beneficial interests in custodied crypto must remain with the customer, not the custodian or exchange
- Custodians are explicitly prohibited from lending, selling, or pledging customer assets without explicit client direction
- The guidance builds on existing Rule 200.9 requirements but adds new clarity around segregation standards
- Sub-custodian arrangements are permitted but subject to NYDFS approval and due diligence requirements
Post-FTX Regulatory Reckoning
The guidance, published as an Industry Letter on January 23, arrives in the wake of multiple high-profile cryptocurrency bankruptcies, most notably the collapse of FTX in November 2022 and the Genesis bankruptcy filing just days before the letter was issued. The timing signals that New York regulators are determined to close loopholes that allowed custodial platforms to treat customer funds as their own.
Under the new framework, Virtual Currency Entities — defined as any entity conducting virtual currency business involving at least one New York resident — must maintain clear separation between customer holdings and corporate assets. The guidance specifies three acceptable structures for segregation: individual customer-by-customer wallets, internal ledger accounts, or omnibus accounts where multiple customers’ holdings are pooled but still tracked separately.
What the Rules Actually Require
The NYDFS guidance does not create entirely new regulations. Instead, it clarifies and reinforces existing provisions under Title 23, Chapter 1, Part 200, Rule 200.9, which already mandated that custodial entities maintain adequate bonds or trust accounts, hold virtual currency of the same type and quantity owed to customers, and refrain from lending or selling customer assets absent explicit direction.
However, the new guidance adds significant detail about what proper segregation looks like in practice. Custodial VCEs must implement detailed policies and procedures regarding the separation of customer and proprietary assets. The guidance raises a notable question about whether custodians can contribute their own excess cryptocurrency into commingled customer accounts to bolster protections — a gray area that the NYDFS appears to address with caution.
Restrictions on Asset Usage
Perhaps the most consequential element of the guidance is its explicit limitation on how custodians can interact with customer assets. Virtual currency held in custody may only be used for the limited purpose of safekeeping and custody, deliberately avoiding the creation of a debtor-creditor relationship between the platform and its users. Customers’ cryptocurrency cannot be sold, lent, or pledged as collateral for loans to the custodial entity or any third party unless the customer specifically directs such actions.
This provision takes direct aim at the practices that contributed to the downfall of several major cryptocurrency platforms in 2022, where customer funds were allegedly used to finance proprietary trading, venture investments, and loans to affiliated entities without customer knowledge or consent.
Disclosure and Sub-Custody Requirements
The guidance also tightens disclosure requirements under Rule 200.19, which already mandated extensive disclosure of material risks, general terms and conditions, and transactional details. The new clarification requires that disclosures make it unmistakably clear that the parties intend to enter into a custodial relationship — not a lending arrangement or any other type of financial relationship that could put customer assets at risk.
For custodians utilizing sub-custodians, the NYDFS requires prior regulatory approval and comprehensive due diligence on specified factors. This requirement addresses a common criticism of the cryptocurrency custody ecosystem, where opaque sub-custody arrangements have sometimes left customers uncertain about who actually controls their assets.
Why This Matters
The NYDFS guidance represents one of the most detailed regulatory responses to the 2022 crypto industry crisis, and its implications extend well beyond New York. As home to the BitLicense regime — widely considered the most stringent cryptocurrency regulatory framework in the United States — New York’s approach often sets the tone for other states and federal regulators.
With Bitcoin trading at approximately $22,934 and Ethereum at $1,628 on the day the guidance was published, the cryptocurrency market was showing signs of recovery from its 2022 lows. But regulators clearly intend to ensure that the next phase of market growth occurs within a framework that prioritizes customer asset protection over platform flexibility. For the broader blockchain industry, the message is unambiguous: if you hold customer funds, those funds belong to customers — and New York regulators plan to enforce that principle with increasing rigor.
Disclaimer: This article is for informational purposes only and does not constitute financial or legal advice. Readers should consult qualified professionals for guidance on regulatory compliance and cryptocurrency investments.
FTX commingled customer funds and NYDFS response was 2 months later. should have been day one regulation
prohibiting lending and pledging of customer assets without direction is literally the bare minimum. wild this wasnt already the rule
sub-custodian arrangements need NYDFS approval too. this actually has teeth unlike most crypto guidance
sub-custodian approval requirement is what separates this from typical guidance. most regulators just say keep it separate and look away
the sub custodian approval is what makes this enforceable. most guidance says keep it separate but never audits. NYDFS actually checks and fines. that is the difference between guidance and regulation
Tomasz K. prohibiting lending of customer assets was the bare minimum in 2023. the fact that coinbase was doing it with institutional clients until the SEC cracked down shows how normalized commingling had become
NYDFS requiring explicit client direction for every asset movement is how traditional custody has worked since the 1930s. crypto needed 14 years to rediscover basic fiduciary law
NY is the only state that took real action after 2022. the rest are still writing discussion papers
Angela Torres NY is the only state that took real action is both a compliment and an indictment. one state out of fifty doing basic consumer protection in crypto says everything about the regulatory gap
NY acted fast because they already had the BitLicense framework. other states had to build from scratch while NY just added custody rules to existing infrastructure
the guidance drops january 23 but the real test is how many custodians actually changed their sub custodian agreements. compliance on paper vs compliance in practice
custody_skeptic compliance on paper vs practice is the right question. sub-custodian agreements changed but nobody audits the actual operational separation between hot wallets
2 months after FTX to publish formal custody rules. that is fast for government. NY had the BitLicense infrastructure ready to build on. other states are still drafting discussion papers 3 years later
indira NY had bitlicense since 2015 so the infrastructure was there. but other states being 3 years behind with nothing is just embarrassing at this point
the fact that prohibiting lending of customer assets needed to be written down 2 months after FTX is damning. this wasnt a loophole, it was an absence of basic rules
Anders H. two months after FTX to write down dont commingle customer funds. the fact this wasnt already rule zero is the damning part
Anders H. two months sounds fast but the bitlicense framework existed since 2015. they literally just had to amend existing language. other states starting from zero are years behind
bitlicense_victim_ starting from zero is exactly right. colorado tried to copy the bitlicense framework and it took 2 years just to get the draft out. NY had a 5 year head start
NYDFS actually enforces and fines. thats what separates this from SEC guidance which is basically a strongly worded letter
the sub-custodian approval requirement is what gives this teeth. every other regulator says keep it separate and then never checks. NYDFS actually sends examiners
NYDFS sending examiners is the difference. SEC writes a letter, NYDFS shows up at your office. guess which one actually changes behavior
Reggie O. SEC sends a letter vs NYDFS shows up is exactly right. the bitlicense gets mocked but its the only framework with actual enforcement teeth in the US
Reggie O. NYDFS shows up at your office vs SEC sends a letter. guess which one makes exchanges actually change their behavior
segregation rules sound obvious until you remember FTX was using customer funds for Alameda trades. NYDFS is 3 years late but at least it is something
Danelle K. the guidance is January 2023 not today. NYDFS sat on this while BlockFi and Celsius were already dead. regulators only act after the damage is done
prohibiting lending of customer assets without explicit direction should have been the baseline from day one. the fact that it took multiple billion dollar collapses to write this down tells you everything about how captured regulators were