Industry Letter

September 17, 2025

TO: All New York Banking Organizations

FROM: Adrienne Harris, Superintendent of Financial Services

RE: Notice on Use of Blockchain Analytics for New York Banking Organizations

On April 28, 2022, the New York State Department of Financial Services (the “Department”) issued to all virtual currency business entities licensed under 23 NYCRR Part 200 or chartered as limited purpose trust companies under the New York Banking Law (collectively, “VC Entities”) an Industry Letter providing Guidance on Use of Blockchain Analytics[1] (the “Analytics Guidance”).  The Department subsequently published guidance (the “VCRA Guidance”) regarding its expectation that all New York banking organizations, as well as all branches and agencies of foreign banking organizations licensed by the Department (together “Covered Institutions”), seek prior approval before engaging in new or significantly different virtual currency-related activity (“VCRA”).[2]  Since then, the Department has seen Covered Institutions experience increasing interest in and exposure to virtual currency via VCRA or through customers, where the blockchain analytics employed by VC Entities can provide Covered Institutions similar actionable intelligence to further mitigate associated risks.

Accordingly, Covered Institutions engaged in, or contemplating engaging in, VCRA should reference the Analytics Guidance and consider leveraging blockchain analytics tools to enhance compliance programs and risk frameworks in a way that accommodates each Covered Institution’s risk appetite and business model. In particular, the Department suggests that Covered Institutions consider the utility of blockchain analytics tools with respect to the following examples:

• Screening wallets of customers who have disclosed or exhibited crypto-related transactions, to assess risk exposure;
• Verifying the source of incoming funds originating from virtual asset service providers (“VASPs”);
• Monitoring the crypto ecosystem holistically, to assess customer (e.g., VASP) exposure to money laundering, sanctions violations, or other predicate crimes;
• Identifying and gauging the risk of third parties (e.g., VASP counterparties) with which a customer has engaged;
• Evaluating expected versus actual activity (e.g., dollar thresholds) of customers engaging in virtual currency activity;
• Utilizing intelligence gained from holistic monitoring to further develop the Covered Institution’s risk assessments and risk appetite;
• Weighing the risks associated with a virtual currency product or service to be offered.

Covered Institutions are advised that this list of examples is not exhaustive; there may be additional instances or considerations that may weigh in favor of blockchain analytics as a useful risk-identification and risk-mitigation tool, and all controls are expected to be tailored to a Covered Institution’s business model, risk appetite, and operations, as appropriate.  It is important to re-assess risk-management frameworks regularly, including in light of changing business models, new customer types, and new market entrants.  Emerging technologies introduce new and evolving threats that require new tools, such as blockchain analytics, with enhanced capabilities to aid risk identification and mitigation.  With increasing virtual currency adoption, Covered Institutions play a critical role in safeguarding the integrity of the financial ecosystem to prevent illicit activities like money laundering, terrorist financing, and sanctions evasion. 

Note:  This Guidance is not intended to limit the scope or applicability of any law or regulation. For further information, please contact your relationship manager or point of contact with the Department.