A crypto exchange licensed in New York cannot simply add a new token to its menu for New York customers. Under the New York State Department of Financial Services (DFS) coin listing policy, every coin a licensed firm offers has to arrive by one of three routes, and each route carries its own paperwork, board votes and notice periods. The same rules decide how a coin is removed.

This explainer walks through those routes, the self-certification standard DFS set in November 2023, the coins that cannot be self-certified for retail customers, and the delisting steps every licensee must have in place.

Who the policy covers

The guidance applies to “VC Entities”: companies holding a virtual currency license under 23 NYCRR Part 200, the BitLicense, and limited purpose trust companies chartered under the New York Banking Law. How those two types of authorization differ is covered in our explainer on BitLicense vs trust charter, and the firms that hold them are listed in our NYDFS BitLicense list.

DFS’s Guidance Regarding Listing of Virtual Currencies, issued November 15, 2023, defines listing broadly: making any virtual currency available in New York or to New Yorkers for any virtual currency business activity. It took effect immediately and entirely replaced DFS’s earlier listing guidance of June 24, 2020. DFS had published a proposed version for comment on September 18, 2023.

Three ways to list a coin

The DFS virtual currency businesses page names three paths:

  1. A specific DFS approval, filed as a material change of business under 23 NYCRR § 200.10.
  2. Self-certification under a coin-listing policy that DFS has approved in writing.
  3. The Greenlist, a short list of coins DFS has already cleared for any licensee.

A firm without an approved coin-listing policy can list only Greenlist coins, unless it gets a coin approved individually as a material change.

The Greenlist

DFS set out the Greenlist in a September 18, 2023 industry letter. Licensees do not need DFS’s prior approval to list a Greenlist coin, but they must notify DFS in advance and have a DFS-approved coin-delisting policy. The virtual currency businesses page puts the notice at least ten days before the coin is offered in New York.

DFS said it would generally consider adding a coin to the Greenlist if the coin or its issuer has a demonstrated, historic record consistent with safety and soundness and customer protection, including broad marketplace adoption, or if the coin is a stablecoin DFS has approved for issuance in New York by a licensee. DFS kept full discretion: it can add or remove a coin, decline to add one, or end the Greenlist process entirely. The current Greenlist coins are kept on our BitLicense list page, which links to the DFS source.

Self-certification: what an approved policy must contain

A licensee that wants to add coins without asking DFS each time needs a coin-listing policy that DFS approves in writing, and DFS will not approve one without an accompanying coin-delisting policy. Firms that had a policy approved under the 2020 guidance had to stop self-certifying until a new one met the 2023 standard. Even after approval, the firm must give DFS written notice before listing each self-certified coin and keep DFS informed of every coin it supports.

The guidance sets minimum contents in three parts.

Governance. The board, or a committee it formally delegates, approves the policy, re-approves it at least annually and votes on each new coin. That governing body must be independent of the staff recommending a listing. Conflicts of interest must be assessed and disclosed to the public, and the firm keeps minutes and every document reviewed for each coin decision. Material changes to the policy need DFS’s prior written approval.

Risk assessment. Each coin is assessed for technical design and technology risk, operational, cybersecurity, market and liquidity, illicit finance, legal, reputational and regulatory risk, including compliance with DFS’s cybersecurity regulation, 23 NYCRR Part 500. Firms must also apply DFS’s guidance on preventing market manipulation and address conflicts of interest and customer protection.

Monitoring. Every listed coin is re-evaluated at least once a year, more often where its risk calls for it, including after material changes such as hard forks, and the firm’s independent testing must cover coin listing and delisting.

Coins that cannot be self-certified for retail

The guidance draws hard lines. A coin designed or substantially used to circumvent laws, or with features built to conceal the identity of a person or entity, cannot be self-certified at all. For activity open to retail customers, a coin also cannot be self-certified, unless it is separately on the Greenlist, if it falls into any of these categories:

  • Stablecoins not on the Greenlist, and coins designed as collateral for them;
  • Exchange coins issued by or for a platform that intermediates between buyers and sellers of virtual currency;
  • Coins on protocols with concentration concerns, for example where one person or entity controls more than 51% of hash power on a proof-of-work network, or comparable concentration on proof-of-stake;
  • Bridged coins circulating on a protocol where the creator did not natively issue them, plus collateral or governance coins for bridge platforms;
  • Coins with circulating supply below 35% of total supply, counting locked or vesting tokens as not circulating.

If a firm cannot determine with reasonable effort that a coin lacks these features, the same bar applies. To list such a coin for retail customers anyway, the firm must ask DFS for approval as a material change, with a full risk assessment and a specific business use case. The retail restriction does not apply to institutional custody or services available only to businesses.

DFS returned to the theme in a January 16, 2025 notice on sentiment-based virtual currencies, often called meme coins. It said such coins, often held by a few insiders and not broadly traded, are generally incompatible with its coin-listing and market-manipulation guidance, and that it would take supervisory and enforcement action where needed.

Delisting: required for every licensee

Every licensee needs a coin-delisting policy approved by DFS, whether or not it self-certifies. DFS required firms to preview drafts by December 8, 2023 and submit final policies by January 31, 2024.

The policy must name who can start a delisting, the approval chain and the triggers, such as new findings from monitoring, a change in law or a DFS directive. The firm must tell DFS of a delisting decision at least ten business days before telling customers, with the rationale and timeline, unless exigent circumstances outside its control require faster action. Customers must get, using all reasonable efforts, at least 30 calendar days’ written notice naming the coin, the timing and how to sell it or move it off the platform where permitted. The firm must also staff up customer support, document every step and track coins held personally by decision-makers to manage conflicts and insider-trading risk.

Why it matters for builders

For a product team integrating crypto for New York users, the practical point is that coin availability is a regulated decision with lead times: ten days’ notice for a Greenlist coin, a board vote and DFS notice for a self-certified coin, and a material-change filing for anything outside those routes. A coin can also be withdrawn on a 30-day customer timeline, or faster in an emergency, so integrations should not assume a supported asset list is permanent.

Sources