United States — New York (US-NY)

Licensing, Authorisation & Market Access

New York's market-access architecture is dual and demanding. Non-bank money transmission requires an NYDFS Money Transmitter Licence under Banking Law Article 13-B (§§640-652-b) and Superintendent's Regulations Parts 406/416/417/300, administered via NMLS with UAAR authorized-agent reporting. New York has not adopted the CSBS Money Transmission Modernization Act and maintains its own stricter capital and compliance standards, which materially raises entry cost relative to states that have harmonised. Layered on top, virtual currency business activity requires a separate BitLicense under 23 NYCRR 200.2(q) or a New York limited purpose trust charter; a trust company may transmit money without a separate MTL and exercise fiduciary powers a BitLicensee cannot, making the trust-charter route strategically preferred for fiduciary-grade custody. A firm conducting both transmission and VC activity must therefore hold two separate authorisations or a trust charter — fiat and crypto licences are filed separately.

The bank versus non-bank PSP boundary is fixed in statute. Banking Law §641 exempts banks, trust companies, savings banks, S&Ls, national banking associations, Federal Reserve Banks, and state and federal credit unions from the money transmitter licensing requirement. This exemption is the structural rationale for the 2025-26 wave of OCC national-trust conversions by NY VC firms seeking to bypass state MTL and access Fed rails — a non-bank PI/EMI that secures bank-equivalent status escapes the state transmitter gate entirely.

Outlook

The W1a standing position is established as a high-bar but high-value credential. The strategic question carried forward is the migration path between non-bank state licensure and bank-equivalent charters, which threads directly into the settlement-access dynamics tracked under W12.

Conduct, Safeguarding & Promotions

Safeguarding for NY non-bank transmitters rests on Banking Law §651, which requires every licensee at all times to maintain permissible investments with a market value at least equal to the aggregate of all outstanding payment instruments and traveler's checks. This is a strict ongoing 100%-liability cover, not a one-time threshold, and is distinct from bank FDIC or deposit protection. Alongside the cover, NY MTL applicants must post a surety bond of at least $500,000 in NMLS, submit a §651 permissible-investment affidavit, undergo an independent BSA/AML programme review, and appoint a qualified CCO with at least three years relevant experience; change-in-control approval applies under §652-a. This onboarding and conduct burden shapes both the cost and the timeline of NY market entry for non-bank PIs and EMIs.

The live conduct development for this module is custody. NYDFS guidance issued September 30 2025 expects VC custodians to segregate and separately account for customer virtual currency on-chain and on internal ledgers, disclose terms in writing with customer acknowledgment before the first transaction, and structure the relationship as custodial rather than debtor-creditor. This guidance superseded the January 2023 guidance and added sub-custodian direction. It should be read as a current-but-recent framework rather than a long-standing rule, having been issued roughly nine months before baseline collection.

Outlook

Reported NYDFS 2026 priorities include stricter cybersecurity requirements and regulating BNPL providers, which would extend the conduct surface for non-bank providers. The custodial-not-debtor-creditor framing is the consequential recent shift and warrants continued tracking against any sub-custodian elaboration.

Stablecoins & Digital Money

New York was the first US state with stablecoin reserve and attestation rules. NYDFS requires USD-backed stablecoins issued under DFS supervision to be fully backed so reserve market value at least equals the nominal value of outstanding units at each business day's end, with DFS-approved 1:1 par redemption policies and monthly plus annual CPA attestations under AICPA standards delivered within 30 days. At issuance DFS regulated issuers of three of the six largest centralized dollar-backed stablecoins, making NY the de facto US stablecoin reserve baseline pre-GENIUS. Coin range is disciplined by the November 2023 listing guidance: a VC Entity cannot self-certify any stablecoin not on the Greenlist, nor any coin designed to serve as collateral for an off-Greenlist stablecoin, with the Greenlist narrowed to Bitcoin, Ethereum and six approved stablecoins.

This state regime is now overlaid by the federal GENIUS Act, signed into law July 18 2025, establishing the first US federal payment-stablecoin framework. Some NY-regulated issuers — Paxos, Circle, Ripple — have applied for OCC national trust charters. However the Act permits state-chartered issuers with $10bn or less in issuance to remain under state supervision where the state framework is certified substantially similar, so any shift to federal oversight is not automatic or universal. The state-versus-federal supervision choice is now a strategic decision for NY issuers, not a forced conversion. This claim was de-overstated in interpretation, with the original framing that OCC charters convert or replace NYDFS oversight corrected and held below Confirmed.

Outlook

Implementation of the GENIUS Act state-framework certification will determine, through 2026, whether NY-supervised issuers (at or below $10bn) remain under NYDFS or migrate to federal supervision. This is the defining forward question for the module and is tracked in the regulatory horizon.

Operational Resilience & Critical Infrastructure

The operational-resilience backbone for all NY payments firms, bank and non-bank, is 23 NYCRR Part 500 (effective March 1 2017). It requires covered entities — including money transmitters and virtual currency businesses, foreign banks licensed in NY, and mortgage companies — to maintain a documented cybersecurity programme, a CISO, MFA, asset inventories, incident-response and BCDR planning, and annual dual-signature compliance certification under §500.17(b). Functionally it is NY's analogue to DORA and PS21-3.

The Second Amendment (effective November 1 2023) added operational-resilience and BCDR scope, heightened Class A Company requirements, ransomware and extortion-payment notice obligations including a 24-hour ransom-payment notice, and CISO-plus-CEO material-compliance certification. The final phased requirements — universal MFA and written information-system asset-inventory procedures — took effect November 1 2025, with a limited MFA exemption for smaller covered entities. This was a recent, binding compliance step taken during the trailing window before baseline collection.

Outlook

With the final phase-in now in force, the W3 baseline is fully established. Forward attention should track NYDFS's reported 2026 cybersecurity priorities, which may tighten requirements further across the covered population that spans both bank PSPs and non-bank transmitters and VC businesses.

Correspondent Banking, Settlement & Access

The analytical spine of this module is the bank versus non-bank access asymmetry. Master Accounts are deposit accounts at a regional Federal Reserve Bank serving as the settlement account for every Fed payment service — Fedwire, FedNow, FedACH — and the 2022 Account Access Guidelines created a three-tier review with Tier 3 institutions facing the greatest scrutiny. NY limited purpose trust companies and BitLicensees cannot directly access Fed rails on the state charter alone, which is the structural rationale for the OCC national-trust conversions tracked across W2 and W13. Settlement access is the chokepoint for non-bank PSP scaling.

Two movements are testing that asymmetry. In March 2026 the Federal Reserve Bank of Kansas City approved a limited 'skinny' master account for Kraken Financial enabling direct Fedwire settlement but without discount-window access, overdraft privileges or interest on reserves — the first nonbank 'skinny' master account and a precedent-setting shift. Separately, the Fed proposed limited 'Payment Accounts' (Fedwire/FedNow but not FedACH, no credit or interest, $1 billion closing-balance cap) and encouraged Reserve Banks to pause Tier 3 access decisions pending policy development, with Ripple, Anchorage and Wise among pursuers.

Outlook

Settlement access is shifting toward limited nonbank connectivity. A codified Payment Account would reshape access for NY trust-charter and crypto firms, with the Tier 3 pause a near-term planning signal; the proposal is tracked in the regulatory horizon at 2026-H2.

Commercial Intelligence (M&A, Investment & Product)

This module renders discrete commercial events. On May 27 2026 NYDFS granted Mastercard Transaction Services (US) LLC a BitLicense; Mastercard separately pursued a near-$2 billion acquisition of NY-BitLicensed Zero Hash, a rumoured deal whose value is not publicly disclosed and which would require NYDFS change-of-control approval. In a confirmed transaction, Mastercard signed a definitive agreement to acquire enterprise stablecoin infrastructure provider BVNK for up to $1.8 billion in March 2026, and granted a Principal Membership to stablecoin card issuer Rain.

On the charter side, on December 12 2025 the OCC conditionally approved five digital-asset firms — Circle, Ripple, Paxos, BitGo and Fidelity Digital Assets — for national trust bank charters, with Paxos, BitGo and Fidelity's NY state charters converting to national ones. This charter-migration wave is the structural payments event driving the 2025-26 settlement-access shift. On funding, VC investment in stablecoin-related companies exceeded $1.5 billion in 2025 (up from under $50 million in 2019), flowing to firms such as Tempo and MeshConnect, with Paxos a $2.5 billion VC-backed issuer minting stablecoins for PayPal and Fiserv.

Outlook

Commercial consolidation into NY-supervised stablecoin and crypto-payments infrastructure is accelerating. The Zero Hash bid remains rumoured pending NYDFS change-of-control approval, and the funding trend signals capital concentration in the segment NY regulates most heavily — both carried forward as live commercial-intelligence threads.

Scheme & Network Compliance

New York layers a state surcharge-conduct overlay over the federal scheme and PCI architecture. GBL §518 (amended, effective February 11 2024) requires surcharging merchants to post the highest credit-card-inclusive price, or use dual cash/credit pricing, and bars surcharges above the processor's actual pass-through cost. It is enforced by the NY Attorney General and local governments with DCP assistance, with penalties up to $500 per violation. This sits above federal Durbin and Regulation II and PCI DSS, directly shaping acquirer and merchant POS pricing configuration in NY.

Outlook

The §518 surcharge regime is baselined and stable. The cross-cutting operational detail of how processors implement compliant surcharging is carried in the W8 merchant-acquiring module, where it intersects with onboarding and POS configuration cost.

Payment Corridor Dynamics

The federal disclosure floor for NY corridor providers is the CFPB Remittance Transfer Rule (Regulation E Subpart B, implementing Dodd-Frank §1073 and EFTA §919). It requires providers to give senders pre-payment disclosure and receipts of FX rate, fees and amount received plus error-resolution rights, overriding UCC 4A where inconsistent. NY corridor providers face both state Article 13-B licensing and this federal remittance layer; money transmitters more broadly contend with 49 state frameworks plus the federal floor. There is no NY-specific sub-national instant retail rail — instant rails are federal FedNow and RTP — so the instant-rail vector resolves by structure to the federal layer.

An emerging corridor channel is scheme-rail stablecoin settlement. Mastercard is rolling out stablecoin settlement across multiple blockchains with initial deployments in the US and Latin America, signalling stablecoin rails as an emerging corridor settlement channel for NY-regulated entities. This signal carries a verify-before-publish flag: the cited source is stale and the current state is a June 2026 expansion across additional blockchains, so confidence is held at Assessed pending re-anchoring to the more recent announcement.

Outlook

The federal remittance floor is durable. The live variable is whether scheme-operated stablecoin settlement matures into a material corridor channel for NY-supervised entities, which should be re-anchored to the current June 2026 expansion before any forward claim is published.

Industry Structure & Commercial

New York is a top-tier US payments and digital-asset hub. NYDFS supervises over 3,200 financial institutions with nearly $10 trillion in assets as of December 31 2024, including 22 virtual currency licensees with assets totaling more than $404 billion per a state audit; other sources report around 32 VCEs (BitLicensees plus trust charters) as of 2026, with fewer than 50 BitLicenses issued since 2015. This count discrepancy is unreconciled and reflects different counting methodologies or snapshot dates, so confidence is held at High rather than Confirmed. The concentrated, high-bar VC field shapes the competitive landscape for entrants.

The NY MTL is one of the 'Big 3' MTLs alongside California and Texas, difficult to obtain but among the most valued in the US. Major crypto firms — Bitfinex, Kraken, Paxful — departed NY when the BitLicense was instituted in 2015, shaping a concentrated high-bar market; recent BitLicensees include Galaxy (May 2026) and Anchorage (late 2024). The high bar is itself a competitive moat for incumbents.

Outlook

Market structure is consolidating, with the VCE count discrepancy carried as an open data gap. Structural M&A trends feeding this consolidation are analysed here, while discrete announced deals are carried in W13.

Legal & Litigation

NYDFS is an aggressive payments and crypto enforcer. Under Superintendent Harris it levied over $177 million in penalties against virtual currency companies as of May 2024 and issued at least eleven cybersecurity consent orders since 2022. Landmark actions include Coinbase ($100M total, $50M penalty), Gemini ($37M penalty plus $40M consumer recovery), Genesis Global Trading ($8M), Robinhood Crypto ($30M) and Paxos ($26.5M re BUSD). The penalty record is a material compliance-cost and reputational consideration for NY VC operators.

On settlement-access litigation, courts have upheld Federal Reserve Bank discretion over access: the Tenth Circuit upheld the master-account denial in Custodia Bank v. Federal Reserve Board, and the Second Circuit upheld the New York Fed's account termination in Banco San Juan Internacional over BSA/AML concerns. This judicial confirmation of Fed discretion is the legal backdrop to the 2025-26 nonbank settlement-access wave and constrains NY trust-charter firms' Fed-rail ambitions.

Outlook

Enforcement intensity is a standing feature of operating in NY. The master-account precedents bridge directly into W12, where the practical contours of nonbank settlement access are being tested through new account structures.

Merchant Acquiring & Risk

GBL §518 (effective February 11 2024) reshapes NY merchant acquiring at the point of sale. It requires surcharging merchants to make POS and point-of-entry disclosures with no add-on convenience fees and either always list the highest credit-inclusive price or use a card-price-first dual-pricing system. Surcharges must pass through equal to the processor's charge with no merchant profit, with $500-per-violation civil penalties. Processors began modifying systems for compliant surcharging, making these system changes a direct operational cost feeding into NY acquirer and merchant onboarding.

This module's standing position rests on T3-heavy sources for the §518 operational detail, even though §518 itself is T1-anchored elsewhere, so module confidence is Assessed. Merchant-acquiring operations and US state-level divergence are flagged WPM under-index vectors.

Outlook

The acquiring picture is established but under-evidenced on operational detail relative to the dominant digital-asset coverage. Strengthening primary-source anchoring on processor-level compliance configuration is the priority for the next cycle.

Product Innovation & Market Development

New York's product-innovation surface is digital-asset-led and supervised rather than sandbox-led. The VOLT initiative added 60-plus experts, NYDFS issued eight pieces of VC guidance covering coin-listing and Greenlist, custody, customer service and banking-organization VC approvals, and Covered Institutions must seek prior approval at least 90 days before commencing new or significantly different VC activity. This prior-approval supervision provides regulatory certainty but lengthens product time-to-market; the 90-day gate is a concrete planning constraint, and NY favours this model over open regulatory sandboxes.

The live product example is on-chain settlement under NY supervision. Mastercard's US money transfer subsidiary, MTS US, was granted a NYDFS BitLicense allowing it to support settlement using stablecoins and tokenized deposits. A major scheme building on-chain settlement under NY supervision validates the BitLicense as a product-innovation channel for tokenized-deposit settlement.

Outlook

The supervised-build-out model is the standing characterisation of NY product innovation. The MTS US BitLicense (granted May 27 2026) cross-references the commercial event carried in W13 and illustrates how the prior-approval surface accommodates scheme-led on-chain settlement products.

Consumer Protection & APP Fraud

New York's VC consumer-protection conduct is defined by two recent measures. NYDFS guidance requires VCEs to maintain monitored phone and electronic-text channels, resolve complaints timely and fairly, provide quarterly complaint tabulations (by channel, topic and average resolution time) from Q3 2024, make documents available to DFS from November 1 2024, and retain records at least seven years under 23 NYCRR 200.12. Separately, the September 30 2025 guidance updates expectations for sound custody and disclosure so that beneficial interest in custodied virtual currency always remains with customers in the event of insolvency, superseding the January 2023 guidance.

There is no NY mandatory APP-fraud reimbursement regime equivalent to the UK PSR scheme; redress runs via DCP and the Attorney General, the CFPB remittance rule, and DFS channels.

Outlook

The consumer-protection module is tightening through complaint-reporting and insolvency-custody safeguards, both recent. The absence of a NY APP-fraud reimbursement mandate is a structural distinction from the UK and is carried as an under-evidenced vector to monitor.

AML/CFT & Financial Crime

This module carries the Sentinel feed only; no original WPM illicit-finance analysis is performed here, and the intelligence is attributed to Sentinel.gi. Per the Sentinel feed, NYDFS found significant AML and cybersecurity programme failings at Genesis Global Trading, settling for $8 million for compliance failures that left the company vulnerable to illicit activity, reflecting NY's active payments-context AML supervision; transaction-monitoring is NY's most frequent crypto violation category. The federal layer is the Bank Secrecy Act, the primary US AML law, under which remittance providers including banks and MSBs must identify, assess and implement BSA controls — forming the federal AML layer over NY-licensed transmitters and VC entities.

Any original illicit-finance, sanctions-evasion or financial-crime analysis of NY VC platforms is a cross-reference to the Financial Intelligence Monitor, not a WPM conclusion.

Outlook

The payments-context AML signal — state VC transaction-monitoring enforcement over a federal BSA layer — is baselined via Sentinel. Original analysis remains routed to FIM, and the bank-versus-non-bank supervision overlay is the structural feature to track.