Test New Fintech Without License

Section 1. The financial services law is amended by adding a new article 7 to read as follows:

ARTICLE 7

REGULATORY SANDBOX PROGRAM Section 701. Definitions.

702. Reports; studies.

703. Program purpose.

704. Application process and requirements.

705. Consultation with applicable agencies; admission authority;

scope; insurance products; investment management.

706. Consumer protection.

707. Exit requirements.

708. Extensions.

709. Auditing by third party depository or custodian services.

710. Recordkeeping and reporting requirements.

711. Records; disclosure; evidentiary effect.

712. Reporting requirements; monitoring; enforcement; agree-

ments.

§ 701. Definitions. For purposes of this article, the following terms shall have the following meanings:

EXPLANATION--Matter in italics (underscored) is new; matter in brackets

[ ] is old law to be omitted.

LBD03966-01-9

A. 2213 2

(a) "Securities investor protection corporation" means a federally mandated, non-profit, member-funded, United States corporation created under the Securities Investor Protection Act of 1970 and mandates membership of most United States registered broker-dealers.

(b) "Applicable agency" means a department or agency of this state established by law to regulate certain types of business activity in this state and persons engaged in such business, including the issuance of licenses or other types of authorization, that the attorney general and state comptroller determines would otherwise regulate a sandbox participant if the person were not a regulatory sandbox participant.

(c) "Consumer" means a person that purchases or otherwise enters into a transaction or agreement to receive a financial technology product or service that is being tested by a sandbox participant.

(d) "Financial products or services" means a product or service that requires licensure by the applicable agency or a product or service that includes a business model, delivery mechanism or element that may otherwise require a license or other authorization to act as a financial institution or enterprise or other entity that is regulated by the applicable agency.

(e) "Financial technology products or services" means a financial product or service with the use or incorporation of new or emerging technology or the reimagination of uses for existing technology to address a problem, provide a benefit or otherwise offer a product, service, business model or delivery mechanism that is not known by the attorney general to have a comparable widespread offering in this state. Such term shall include, but shall not be limited to, cryptocurrency business activity.

(f) "Cryptocurrency" means a digital currency which uses encryption techniques to regulate the generation of currency units and verify the transfer of funds, operating independently from a central bank.

(g) "Cryptocurrency business activity" means the conduct of any of the following types of activities involving New York or a New York resident:

(1) receiving cryptocurrency for transmission or transmitting cryptocurrency, except where the transaction is undertaken for non-financial purposes and does not involve the transfer of more than a nominal amount of cryptocurrency;

(2) storing, holding, or maintaining custody or control of cryptocurrency on behalf of others;

(3) buying and selling cryptocurrency as a customer business;

(4) performing exchange services of cryptocurrency as a customer business; or

(5) controlling, administering, or issuing a cryptocurrency.

(h) "Regulatory sandbox" means the program established by this article that allows a person to temporarily test financial technology products or services on a limited basis without otherwise being licensed or authorized to act under the laws of this state.

(i) "Sandbox participant" means a person whose application to participate in the regulatory sandbox is approved pursuant to this article.

(j) "Test" means to provide activity and services as allowed by this article.

§ 702. Reports; studies. (a) The attorney general and state comptroller shall publish annually a written report describing the results of the regulatory sandbox established pursuant to this article and the results of their studies conducted pursuant to subdivision (b) of this section.

A. 2213 3

(b) The attorney general and state comptroller shall study long term solutions to issues that arise from financial technology products or services, including, but not limited to:

(1) the use of third party depository and custodian services as auditors of financial technology products and services; and

(2) the use of the securities investor protection corporation to insure all financial technology products and services account holder's assets.

§ 703. Program purpose. The attorney general and state comptroller shall establish a regulatory sandbox in consultation with applicable agencies of this state to enable a person to obtain limited access to the market in this state to test financial technology products and services without obtaining a license or other authorization that otherwise may be required by law and without having to pay any fees associated with such license or authorization.

§ 704. Application process and requirements. (a) Any person may apply to enter the regulatory sandbox to test financial technology products or services.

(b) The attorney general and state comptroller shall create a joint office or coordinated process and shall accept and review each application for entry into the regulatory sandbox on a rolling basis.

(c) An application shall demonstrate that the applicant both:

(1) is an entity or individual that is subject to the jurisdiction of the attorney general and state comptroller through incorporation, residency, presence, agreement, or otherwise; and

(2) has established a location, whether physical or virtual, that is adequately accessible to the attorney general and state comptroller from which testing will be developed and performed and where all required records, documents and data will be maintained.

(d) Any person, corporation, partnership or other entity that already possesses a license or other authorization under state laws that regulate financial technology products or services shall file an application with the attorney general and state comptroller to test financial technology products or services within the regulatory sandbox.

(e) Applications shall contain sufficient information to demonstrate that an applicant has an adequate understanding of the financial technology product or service and a sufficient plan to test, monitor and assess the financial technology product or service while ensuring consumers are protected from a test's failure.

(f) Applicants shall contain the information required by a form developed and made publicly available by the attorney general and state comptroller. The information required by the form shall include, but shall not be limited to:

(1) relevant personal and contact information for the applicant, including full legal names, addresses, telephone numbers, e-mail addresses, website addresses and any other information that the attorney general and state comptroller deems necessary;

(2) disclosure of any criminal convictions of the applicant or key personnel, if any;

(3) a description of the financial technology products or services desired to be tested, including statements regarding all of the following:

(A) how a financial technology product or service is subject to regulation outside of the regulatory sandbox;

(B) how the financial technology product or service would benefit consumers;

A. 2213 4

(C) how the financial technology product or service is different from other products or services available in this state;

(D) what risks will confront consumers that use or purchase the financial technology product or service;

(E) how entering the regulatory sandbox would enable a successful test of the financial technology product or service;

(F) a description of the proposed testing plan, including estimated time periods for market entry, market exit and the pursuit of necessary licensure or authorization; and

(G) how the applicant will wind down the test and protect consumers if the test fails.

(g) A person shall file a separate application for each financial technology product or service sought to be tested.

(h) After the information required by subdivision (f) of this section is submitted, the attorney general and state comptroller may seek additional information that is deemed necessary. Not later than ninety days after an application is initially submitted, the attorney general and state comptroller shall notify the applicant as to whether the applicant is approved for entry into the regulatory sandbox. The attorney general and state comptroller and an applicant may mutually agree to extend the time period for the attorney general and state comptroller to determine whether an application is approved for entry into the regulatory sandbox.

(i) The attorney general and state comptroller may deny applicants at their discretion and such a denial shall not be an appealable agency action.

§ 705. Consultation with applicable agencies; admission authority; scope; insurance products; investment management. (a) (1) The attorney general and state comptroller shall consult with an applicable state agency before admitting a person into the regulatory sandbox. This consultation may include seeking information about:

(A) whether the applicable agency previously has either (i) issued a license or other authorization to the applicant, or (ii) investigated, sanctioned or pursued legal action against the applicant; and

(B) whether the applicant could obtain a license or other authorization from an applicable agency after exiting the regulatory sandbox.

(2) Notwithstanding paragraph one of this subdivision, the attorney general and state comptroller have the sole authority to make the final decision of whether to admit a person into the regulatory sandbox.

(b) If the attorney general and state comptroller approves an application for entry into the regulatory sandbox, the applicant is deemed a sandbox participant and both of the following shall apply:

(1) the sandbox participant has twenty-four months after the date of approval to test the cryptocurrency business activity described in the sandbox participant's application; and

(2) the attorney general and state comptroller shall issue the sandbox participant a registration number.

(c) Financial technology products or services that are provided within the regulatory sandbox are subject to the following restrictions:

(1) except as provided in subdivision (d) of this section, not more than ten thousand consumers may transact through or enter into an agreement to use the financial technology products or services;

(2) except as provided in subdivision (d) of this section, for a sandbox participant testing products or services as a money transmitter, individual transactions per consumer may not exceed ten thousand dollars and aggregate transactions per consumer may not exceed two million

A. 2213 5

dollars over the course of the twenty-four months of the regulatory sandbox period;

(3) for sandbox participants testing products or services as a financing agency as defined in subdivision nine of section three hundred one of the personal property law, all of the following apply:

(A) section three hundred two of the personal property law;

(B) section three hundred three of the personal property law;

(C) section three hundred six of the personal property law;

(D) section three hundred eight of the personal property law; and

(E) section 9-601 of the uniform commercial code; and

(4) for sandbox participants testing products or services that provide investment management that is regulated each sandbox participant shall:

(A) make, maintain and preserve books and records in accordance with the requirements imposed on federal covered advisers under 17 CFR 275.204-2. The sandbox participant shall file with the state comptroller and the attorney general's office a copy of any notices or written undertakings required to be filed by federal covered advisers with the securities and exchange commission under 17 CFR 275.204-2; and

(B) comply with all requirements imposed on federal covered advisers under 17 CFR Part 275 with respect to:

(i) dishonest and unethical practices;

(ii) information required to be furnished to clients;

(iii) custody of client funds or securities; and

(iv) disclosure of financial and disciplinary information to clients.

(d) If a sandbox participant demonstrates adequate financial capitalization, risk management process and management oversight they may request the attorney general and state comptroller to allow either or both of the following: