GENIUS Act: New York Payment Stablecoin Proposed Rule

Eligible applicants

Limited purpose trust companies, applicants for limited purpose trust company charters, and other entity types as determined by DFS may apply for approval to issue one or more payment stablecoins.

Non-financial public companies, and their wholly or majority owned subsidiaries or affiliates, would be ineligible to apply, except as permitted under the GENIUS Act.

Applications would need to be submitted in writing using the form and materials required by DFS.

Applications would need to demonstrate financial capacity to meet APSI requirements, acceptable officer and director backgrounds, qualified and reliable leadership and ownership, and readiness to meet DFS stablecoin requirements. DFS would approve applications that satisfy the approval standards, and denied applicants could reapply.

Existing issuers and brands

Existing DFS-approved payment stablecoin issuers need not obtain a second approval to issue the-approved payment stablecoins. However, existing DFS-approved issuers would need to comply with the new requirements within 12 months after the effective date, except for the separate compliance-certification timing. Prior DFS approval would be required before issuing a distinguishable payment stablecoin brand.

Prohibited activities

APSIs would be prohibited from engaging in any activity prohibited by or otherwise inconsistent with the GENIUS Act, including:

• Rehypothecation.
• Tying arrangements.
• Certain marketing practices, including the use of deceptive names and/or claims.
• Misrepresentation of insured status.
• Paying interest or yield to holder of the stablecoin.

Officers and directors

Individuals with specified felony convictions could not serve as officers or directors of APSIs.

Reserve Requirements

Custody

Reserve assets would be required to be maintained with an eligible financial institution other than the APSI, with DFS approval required to hold reserves at an eligible financial institution that is not an insured depository institution.

Segregation by brand

APSIs with more than one distinguishable payment stablecoin brand would be required to maintain separately identifiable reserves and segregated reserve pools unless DFS approves commingling.

Composition and concentration

Reserve assets would be limited to authorized asset types and managed under applicable diversification and concentration expectations.

Insured deposit threshold

APSIs with an outstanding issuance value of $25 billion or more would be required to maintain a specified portion (proposed to be a minimum of 0.5 percent) of reserve assets in insured deposits or insured shares at an insured depository institution.

Reporting and certifications

APSIs would be required to provide DFS with reserve reporting and certification materials, including monthly reserve composition reports for each distinguishable brand, monthly CEO/CFO certifications regarding report accuracy, and registered public accounting firm attestations of management’s assertion of information disclosed in the previous monthly report.

Shortfalls

Reserve deficiencies would trigger:

• Same-day DFS notice.
• Issuance restrictions until compliance is restored.
• Possible compliance plans.
• Liquidation or redemption if a shortfall continues for 15 consecutive business days absent a DFS extension.

Annual attestations

Annual registered public accounting firm attestations would be required for management assertions concerning internal controls, structure, and procedures for compliance with the reserve reporting requirement.

Redemption Requirements

Public disclosure

APSIs would be required to obtain DFS approval for, and publicly disclose, their redemption policy, which at a minimum must include the:

• Timeframe for redeeming payment stablecoins.
• Limits on timely redemption.
• Scenarios for extending the redemption period.
• Instructions for how holders may redeem.
• Minimum number of payment stablecoins to be redeemed provided the number is one or more payment stablecoins.

Timeliness

Payment stablecoin redemption would be required to occur within two business days after the redemption request.

Limitations or extensions

Discretionary limitations on timely redemption may be imposed only by the applicable federal regulator or DFS. DFS could extend timely redemption if it determines that the issuer poses a threat to safety and soundness or financial stability, or if an extension is otherwise in the public interest.

Capital requirements

Capital requirements, including tier 1 capital, would be expected to be commensurate with the level and nature of risks facing the APSI, including off-balance sheet risks, and sufficient to ensure ongoing operations. DFS may establish additional capital thresholds or metrics, including additional types of capital or risk-based capital requirements.

Capital adequacy process

APSIs would need a process for assessing overall capital adequacy and a strategy for sustaining appropriate capital.

Operational backstop

APSIs would be required to maintain an operational backstop of liquid identifiable assets to meet short-term liquidity needs, stabilize operations after a business disruption and continue or resume normal operations.

DFS revisions

DFS may revise an APSI’s capital requirement or operational backstop based on a change to the issuer’s business model or risk profile, or if DFS determines that a change is needed for safety and soundness. DFS would provide written notice of any revision.

Shortfalls

Capital or backstop deficiencies at the end of a quarter would trigger new-issuance restrictions, and after two consecutive deficient quarters, would trigger liquidation of reserve assets, redemption of outstanding stablecoins without fees, and prohibition of new issuance.

BSA/AML/CFT and sanctions compliance

APSIs would be required to comply with applicable Bank Secrecy Act (BSA), anti-money laundering (AML) and combatting the financing of terrorism (CFT) requirements as well as sanctions.

Compliance certifications

An APSI would be required to certify annually that it has implemented BSA/AML/CFT and economic sanctions compliance programs that are reasonably designed to prevent illicit activity.

Failure to timely file a certification may result in revocation of the issuer’s authorization.

Internal controls and information systems

Internal controls and information systems would be required to support effective risk management based on the size and complexity of the APSI and the nature, scope and risk of its activities.

Internal audit system

Internal audit or independent review systems appropriate for the size and complexity of the APSI and the nature, scope and risk of its activities would be required to provide for:

• Independent testing of controls and information systems.
• Verification of published information available to customers.
• Verification of required reserve calculations.
• Verification of regulatory filings.
• Documentation of findings and corrective actions.
• Review of remediation for identified deficiencies.
• Audit committee or board review.

Operational standards

APSIs would need processes addressing operational standards such as interest rate exposure, “prudent asset growth”, processes to evaluate and monitor earnings, liquidity/concentration risk management, and consumer protection compliance.

Cybersecurity requirements

APSIs would be required to comply with DFS cybersecurity requirements applicable to Class A companies, without otherwise available exemptions, and additional requirements designed to produce outcomes at least as stringent and protective as federal standards.

Customer and nonpublic information

Nonpublic information would include information provided by a customer to obtain a financial product or service, transaction-related customer information, and other customer information obtained in connection with financial products or services.

Customer notice

Customer notice would be required when unauthorized access to nonpublic customer information has resulted or will result in misuse, and when affected customers cannot be identified but misuse is reasonably possible.

Notice would be required to be provided as soon as possible and without unreasonable delay.

Examinations

APSIs would be examined at least annually, though DFS may examine APSIs at any time when, in the judgement of DFS it is necessary or advisable.

Supervisory access

When requested, APSIs would be required to provide DFS full and immediate access to personnel; books, records, documents, and other information; and facilities used by the issuer or its affiliates.

Records, reports, audits

APSIs would be required to:

• Maintain records retention policies.
• Provide DFS with periodical or special reports, as required by DFS.

Submit audited financial statements (for APSIs with outstanding issuance values above $50 billion that are not subject to Securities Exchange Act reporting requirements).

Insolvency, custody, and information sharing

Provisions related to insolvency, custody, and information-sharing treatment would align with the relevant GENIUS Act provisions.