NYDFS BitLicense Requirements: Cybersecurity and Custody

By Owen Thurm Published November 6, 2026 6 min read

Quick answer. BitLicensees must run a cybersecurity program under 23 NYCRR 200.16: a board-approved policy, a CISO reporting yearly, annual pentests, quarterly vulnerability assessments and tamper-protected audit trails. Part 500, DFS's cybersecurity regulation, adds overlapping duties.

Watch: NYDFS BitLicense Requirements: Cybersecurity and Custody 1:55

Video transcript

BitLicense holders answer to two cybersecurity rulebooks. Part 200 sets the core program, and Part 500 layers overlapping duties on top.

Section 200.16 requires a board-approved policy, a qualified CISO reporting yearly, annual pentests, quarterly vulnerability assessments, and tamper-protected audit trails.

Part 500 covers the same ground with different detail. Part 200 audit trails rebuild all transactions, Part 500 only material ones, and Part 500 adds incident notice within 72 hours.

Both rules bite. DFS's 30 million dollar penalty on Robinhood Crypto in 2022 cited Part 200 and Part 500.

Part 500's small-firm exemption lists only Part 500 sections. Part 200's matching duties have no exemption of their own, so ask counsel how both apply.

Custody rules add more. Section 200.9 requires a bond or trust account, matching virtual currency, and no lending of customer assets. 2025 guidance expects segregation, onchain reconciliation, and prior approval for sub-custodians.

Testing reaches listings too. DFS expects a risk assessment of every system tied to each coin, with listing and delisting in independent testing scope.

DFS can deny applications whose gaps survive a third deficiency letter. Prepare your policy and board minute, pentest results, audit trail design, a tested BCDR plan, and wallet architecture.

Guardian maps each provision to the control and evidence that meet it, while your counsel owns the legal reading. Read the full article, or talk to Guardian.

New York's BitLicense rule, 23 NYCRR Part 200, has been in force since June 24, 2015. Its cybersecurity and custody sections still read as adopted.

The layer around them has moved. DFS amended its cybersecurity regulation, Part 500, effective November 1, 2023, and replaced its custody guidance on September 30, 2025.

This article explains the technical and security side of 23 NYCRR Part 200 and Part 500. It is not legal advice; confirm how it applies to you with counsel.

The Part 200 Cybersecurity Section

Section 200.16 is the core. Each licensee "shall establish and maintain an effective cyber security program" that identifies, protects, detects, responds and recovers.

Policy, 200.16(b): written, covering 13 areas, approved by the board at least annually.
CISO, 200.16(c): a qualified employee who oversees the program and enforces the policy.
Report, 200.16(d): prepared by the CISO, presented to the board and submitted to DFS at least annually.
Application security, 200.16(f): written standards for every application, reviewed by the CISO at least annually.
People, 200.16(g): adequate security staff, regular training, and key staff kept current on threats.

One policy area has no Part 500 counterpart: "monitoring and implementing changes to core protocols not directly controlled by the Licensee". We read it as chain upgrades and hard forks. Give each chain an owner.

Section 200.17 adds a business continuity and disaster recovery (BCDR) plan. It "shall be tested at least annually" by qualified, independent internal staff or a qualified third party.

How Part 500 Layers On

Part 500 covers anyone operating under a license, charter or similar authorization under New York's Banking Law, Insurance Law or Financial Services Law.

DFS issued Part 200 under the Financial Services Law. Its $30 million penalty on Robinhood Crypto in August 2022 cited both regulations.

The duties overlap, with different detail:

Duty	Part 200	Part 500
Policy	200.16(b): board approves at least annually	500.3: senior officer or board approves annually
CISO report	200.16(d): to the board and DFS, annually	500.4(b): to the board, at least annually
Pentesting	200.16(e)(1): at least annually	500.5(a)(1): annually, from inside and outside
Vulnerabilities	200.16(e)(1): assessment at least quarterly	500.5(a)(2): scans at a risk-based frequency
Audit trail	200.16(e)(2): reconstruct all transactions	500.6: reconstruct material transactions
Continuity	200.17: BCDR plan tested annually	500.16: IR and BCDR plans tested annually
Vendors	200.16(b)(11): a policy area	500.11: vendor policies and contract guidelines
Notice to DFS	200.17(d): prompt notice of disruptions	500.17(a): incidents within 72 hours

Every April 15, a covered entity certifies that it materially complied with Part 500, or acknowledges where it did not. The highest-ranking executive and the CISO sign.

The small-firm exemption

Section 500.19(a) exempts a covered entity with any one of:

Fewer than 20 employees and independent contractors, including affiliates.
Under $7.5 million in gross annual revenue in each of the last three fiscal years.
Under $15 million in year-end total assets, including affiliates.

The exemption covers listed Part 500 sections, including the CISO (500.4), pentesting (500.5), audit trails (500.6) and IR and BCDR plans (500.16).

Part 200's matching duties sit in 200.16 and 200.17, which contain no exemption of their own. Ask counsel how the two apply to a small licensee.

Custody and Protection of Assets

Section 200.9 sets three rules:

A surety bond or trust account in US dollars for customers. A trust account must sit with a Qualified Custodian.
Virtual currency "of the same type and amount" as owed to each customer.
No lending, pledging or other use of customer assets. Only a sale, transfer or assignment the customer directs is allowed.

DFS's September 30, 2025 industry letter adds detail for BitLicensees and limited purpose trust companies that custody virtual currency.

Segregation. Custodians are expected to separate customer assets from corporate assets, onchain and in internal ledgers.
Omnibus wallets should hold only customer assets, with records showing each customer's interest.
Reconciliation. Custodians should be ready "at all times" to show DFS that their books reconcile to onchain activity.
Sub-custody. DFS treats any new sub-custody arrangement as a material change that needs its prior approval.

For that approval, DFS expects at least the custodian's risk assessment, the proposed service agreement and updated procedures. Applicants can seek it during the application.

DFS also expects the sub-custodian to be licensed or chartered by DFS, or supervised at home in a way DFS deems substantially similar.

For key storage and signing controls, see our guide to crypto custody.

Testing and Audits

Section 200.16(e)(1) reads: each licensee "shall conduct penetration testing of its electronic systems, at least annually, and vulnerability assessment of those systems, at least quarterly."

The audit trail rule, 200.16(e)(2), asks for systems that:

Reconstruct all financial transactions and accounting, completely and accurately.
Protect audit trail data, and hardware, from alteration or tampering.
Log system events, including every system administrator function.

Section 200.12 keeps records for seven years, in original form or native file format. The cautious reading puts wallet movements in scope: tie each onchain transfer to its ledger entry and approval.

DFS examines each licensee at least once every two calendar years (200.13). For scoping the test, see our Part 500 pentest guide.

Coin listing reviews

DFS's November 15, 2023 listing guidance says a firm "must assess the risk to the confidentiality, integrity, and availability of all systems relating to each coin and its supporting blockchain."

It adds that independent testing should include coin listing and delisting in its scope.

Evidence to Prepare

An application must include "all written policies and procedures required by, or related to," Part 200. The applicant must show it will comply upon licensing (200.4).

DFS reviews an application in substance only once every checklist item is in and adequate on its face. If gaps in one set of requirements, such as cybersecurity, survive a third deficiency letter, DFS may deny it.

Governance and testing

The cybersecurity policy across all 13 areas, and the board minute approving it.
The CISO's designation, and the outline of the annual report.
The latest pentest report and quarterly vulnerability results, with fixes and retests.
Audit trail design: how a transaction is rebuilt, and how logs resist tampering.
The BCDR plan and its latest test, including restoring the ability to sign.

Custody and Part 500

Wallet architecture: hot and cold balances, key storage, signing approvals and recovery.
A sample reconciliation of ledger balances to onchain addresses.
For each sub-custodian: the risk assessment, draft agreement and updated procedures.
A coin risk assessment for every asset you plan to list.
The Part 500 risk assessment (see our template), asset inventory and 500.11 vendor policy.

After licensing, a material change needs DFS's prior written approval (200.10).

How Guardian Helps

Guardian's regulatory compliance work maps your activities to the licenses that reach them, including a BitLicense. Your counsel owns the legal reading.

It lists each provision with the control and evidence that meet it, and writes an application's technical sections from the system as built.

Guardian's pentests cover web apps, APIs, cloud and SDKs. Its OpSec audit reviews where keys live, who holds each share and what a quorum requires.

Frequently Asked Questions

Does NYDFS Part 500 apply to BitLicensees?

Part 500 covers entities operating under a license or similar authorization under New York's Banking Law, Insurance Law or Financial Services Law. DFS issued Part 200 under the Financial Services Law, and its 2022 Robinhood Crypto penalty cited both regulations.

How often must a BitLicensee run penetration tests?

At least annually, with vulnerability assessments at least quarterly, under 23 NYCRR 200.16(e)(1). Section 500.5 of Part 500 separately requires an annual pentest from inside and outside the system boundaries.

Does the Part 500 small-firm exemption cover Part 200?

Section 500.19(a) lists only Part 500 sections, such as 500.4, 500.5 and 500.16. Sections 200.16 and 200.17 contain no exemption of their own. Ask counsel how both apply to a small licensee.

Can a BitLicensee use a sub-custodian?

DFS's September 30, 2025 guidance allows it after due diligence, with DFS's prior approval as a material change. DFS expects the sub-custodian to be DFS-licensed or chartered, or supervised at home under rules DFS deems substantially similar.

Sources

Build your BitLicense evidence file with Guardian

Guardian maps your controls to Part 200 and Part 500, tests them, and writes the technical sections from the system as built.

Talk to Guardian Explore regulatory compliance