NYDFS Extends Blockchain Tracing Guidance to Banks

Client Alert

On September 17, 2025, the New York Department of Financial Services (the “NYDFS”) issued guidance to all New York Banking Organizations (“2025 Guidance”) recommending that they consider leveraging blockchain analytics tools to enhance their compliance programs and risk frameworks if they are engaged in, or contemplating engaging in, virtual currency-related activity (“VCRA”).¹ This 2025 Guidance marks a significant expansion, as it now applies NYDFS blockchain analytics expectations to all New York Banking Organizations,² not just BitLicense holders and limited purpose trust companies (together, “VCEs”). This reflects the regulator’s recognition of banks’ increasing involvement in and exposure to VCRA.

The 2022 Guidance Now Applies to Banks

By requiring banks also to consider the 2022 NYDFS Guidance on Use of Blockchain Analytics (the “2022 Guidance”) through the 2025 Guidance, NYDFS is doubling down on its position that blockchain analytics are a useful risk-identification and risk-mitigation tool, given the public, immutable, and pseudonymous nature of blockchain transactions. The 2022 Guidance stressed the critical role of blockchain analytics in establishing effective compliance policies and procedures, particularly for customer due diligence, transaction monitoring, and sanctions screening.

The 2022 Guidance outlines expectations for VCEs to ensure their compliance programs address requirements under New York Banking Law, New York Financial Services Law, federal BSA/AML, and OFAC regulations. NYDFS expects institutions to leverage blockchain analytics tools for customer wallet screening, source of funds verification, holistic monitoring for illicit or sanctioned activity, counterparty risk assessment, and ongoing evaluation of customer activity against expected thresholds. These tools are particularly valuable given the unique features of virtual currencies, such as peer-to-peer transfers and pseudonymous wallets, which differ from traditional fiat transactions.

Accordingly, the 2022 Guidance sets out specific expectations and requirements in the virtual currency context around:

• augmenting Know Your Customer (“KYC”)-related controls;
• conducting transaction monitoring of on-chain activity; and
• conducting sanctions screening of on-chain activity.

Augmenting KYC-related controls

For KYC purposes, VCEs are required to gather and maintain information about their customers and understand and effectively address the risks they present. The 2022 Guidance notes tools that link on-chain data with customer-provided information, such as identifying wallet addresses on exchanges, can help identify institutional and high-risk wallet addresses (e.g., darknet). However, these tools may not always reveal the ultimate beneficial owners without additional off-chain verification. VCEs are expected to have processes and procedures to assess counterparty risk for virtual currency transfers, such as using risk scores or rankings that represent risk of the counterparty derived from on-chain transaction data supplemented with other factors such as the strength of a counterparty’s AML program.

Transaction monitoring of on-chain activity

VCEs must also have in place appropriate controls to monitor and detect unusual activity, tailored to their risk profile. This includes processes and procedures for transaction tracing or and tracing fund flows through the blockchain for each supported virtual currency. VCEs are expected to have appropriately tailored transaction monitoring against applicable typologies and red flags of criminal and illicit activities, identify deviations from a customer’s profile, and address other applicable risk considerations. Potential risk factors include but are not limited to:

• exposure to high-risk jurisdictions,
• use of a mixer or tumbler,³
• darknet market involvement,
• association with scams/ ransomware, or
• other illicit activities relevant to the VCE’s business model. VCEs must document case management and escalation procedures, with clear roles and responsibilities.

Sanctions screening of on-chain activity

The 2022 Guidance also highlights the need for risk-based policies and procedures to identify transactions involving virtual currency addresses or other identifying information linked to sanctioned individuals, entities, or jurisdictions.⁴ OFAC recommends using transaction monitoring software to detect such activity, including identifying originators, beneficiaries, exchanges, and other transactional data associated with sanctions lists.

Interpretation and Implementation

• Given the rapid growth of traditional banking institutions’ interest and activity in these areas, as reported by NYDFS, this 2025 Guidance is or may become relevant to most banks in New York, including branches of foreign banks.
• The non-exhaustive list of activities the NYDFS considers VCRAs is expansive and raises questions around its scope and coverage. Such a broad definitional statement may encompass activities that may not have been considered virtual currency-related to date, such as:
  • offering omnibus fiat accounts to virtual currency businesses and reserve accounts to hold assets that back stablecoins, in addition to custodial accounts holding virtual currency.
  • trading in tokenized real-world assets (e.g., US Treasuries, MMFs, or FX deposits) or utilizing them as margin for derivatives transactions;
  • participating in or facilitating a debt or equity security purchase that is denominated in US dollars (fiat) and settles in US Dollars (fiat) but is tokenized at some point in the transaction.
• Prior approval to engage in VCRA is still required for NYDFS-regulated entities.⁵ This differs from the federal regulators’ guidance, which revokes any pre-approval or supervisory non-objection requirements for permitted crypto-asset custody services, including holding reserve deposits for stablecoins, using distributed ledger and stablecoins to facilitate payment activities, and custodying crypto assets.⁶ Federally chartered banking organizations and other entities not subject to such a prior approval requirement have an advantage in an innovative market that values time-to-market.
• When read in conjunction with the Administration’s Executive Order (“EO”) entitled, “Guaranteeing Fair Banking for All Americans,”⁷ the 2025 Guidance could be interpreted as imposing additional burdens on banks who choose to bank or partner with virtual currency businesses. Even though this EO is directed towards federal banking agencies, New York-chartered banks are affected given the FDIC and the Federal Reserve serve as backup regulators to state-chartered banks. New York Banking Organizations could find themselves in a dilemma between incurring the costs associated with blockchain tracing by offering certain services to virtual currency business or facing potential criticism by their federal regulator for declining to offer such services.
• The 2022 Guidance, with its expanded coverage through the 2025 Guidance, remains instructive on NYDFS’ areas of focus (i.e., BSA/AML and OFAC compliance) and approach, including concrete and specific examples of controls and risks to weigh and integrate into processes and frameworks. This refreshed 2025 Guidance underscores the importance of regular risk assessments and adapting compliance frameworks to evolving business models, customer types, and market entrants with applicability beyond NYDFS regulated institutions.

1. VCRA includes “all “virtual currency business activity,” as that term is defined in 23 NYCRR § 200.2(q), as well as the direct or indirect offering or performance of any other product, service, or activity involving virtual currency that may raise safety and soundness concerns for the bank or that may expose New York customers of the bank or other users of the product or service to risk of harm. For example, NYDFS considers the following types of activities, among others, to be virtual currency-related activities: offering digital wallet services to customers, whether the services are in fact provided by the bank or by a third party with which the bank has contracted; lending activities collateralized by virtual currency assets; activities in which a bank facilitates its own customers’ participation in virtual currency exchange or trading, including by carrying fiat currency on behalf of customers (e.g., in an omnibus account); services related to stablecoins, including providing stablecoin reserve services for stablecoin issuers; engaging in traditional banking activities involving virtual currency through the use of new technology that exposes the bank to different types of risk (e.g., underwriting a loan, debt product, or equity offering effected partially or entirely on a public blockchain). Industry Letter Regarding Prior Approval for Covered Institutions’ Virtual Currency-Related Activity, N.Y. State Dep’t of Fin. Services (Dec. 15 2022), https://www.dfs.ny.gov/system/files/documents/2025/04/il20221215_prior_approval_rev.pdf.

2. Banking organization means “all banks, trust companies, private bankers, savings banks, safe deposit companies, savings and loan associations, credit unions and investment companies.” New York Banking Law § 2.11.

3. A mixer or tumbler is a tool that obscures a transaction trail, typically through exchanging one asset for another, or pooling assets together and redistributing.

4. See Office of Foreign Asset Control, Sanctions Guidance for the Virtual Currency Industry (Oct. 2021), https://ofac.treasury.gov/media/913571/download?inline

5. Industry Letter Regarding Prior Approval for Covered Institutions’ Virtual Currency-Related Activity, N.Y. State Dep’t of Fin. Services (Dec. 15, 2022), https://www.dfs.ny.gov/system/files/documents/2025/04/il20221215_prior_approval_rev.pdf.

6. OCC Interpretive Letter 1183; FDIC’s FIL-7-2025; FRB Press Release dated April 24, 2025; Also discussed in Chapman’s alerts of March and May 2025, https://www.chapman.com/publication-office-of-the-comptroller-of-the-currency-issues-new-guidance-reestablishing-regulatory-roadmap-for-crypto-assets-activities; https://www.chapman.com/publication-bank-prudential-regulators-now-in-alignment-after-federal-reserve-rescission-of-past-crypto-related-guidance.

7. https://www.whitehouse.gov/presidential-actions/2025/08/guaranteeing-fair-banking-for-all-americans/. 

Relevant Documents