How to Get a BitLicense: New York's Crypto Licensing Guide

New York's BitLicense is widely regarded as the most rigorous cryptocurrency licensing requirement in the United States. Since its introduction by the New York Department of Financial Services in 2015 — the first dedicated cryptocurrency business license in any U.S. state — it has become both a model for crypto regulation and a significant compliance undertaking for any cryptocurrency business that wants to serve New York customers.

If your crypto business has New York users or plans to, the BitLicense question is not optional. This guide covers what the BitLicense requires, what the application process looks like, how long it takes, and what you need to have in place before you apply.

What Is the BitLicense?

The BitLicense is a virtual currency business activity license issued by the New York Department of Financial Services. It was established under 23 NYCRR 200 — the DFS's virtual currency regulation — and is required for any person or entity engaged in virtual currency business activity involving New York or New York residents.

The BitLicense exists separately from and in addition to New York's standard money transmitter license. A crypto business engaged in both fiat money transmission and virtual currency business activity in New York may need both licenses.

Who Needs a BitLicense?

The BitLicense is required for any business that engages in the following activities involving New York or New York residents: receiving virtual currency for transmission or transmitting virtual currency, storing, holding, or maintaining custody or control of virtual currency on behalf of others, buying and selling virtual currency as a customer business, performing exchange services as a customer business, and controlling, administering, or issuing a virtual currency.

The DFS has clarified that the geographic scope is broad — if your business serves New York residents, the BitLicense applies even if your business is not physically located in New York.

Limited Purpose Trust Company as an Alternative

New York also offers a Limited Purpose Trust Company charter as an alternative to the BitLicense for certain crypto business models — particularly custodians and exchanges that want the additional regulatory framework and perceived credibility of a bank charter. This path involves a full bank charter application and is significantly more demanding and capital-intensive.

BitLicense Application Requirements

The BitLicense application is one of the most comprehensive licensing applications in financial services. It covers the following major areas.

Business Description and Organizational Documents

Detailed description of your business model, products and services, and all virtual currency activities. Corporate formation documents including articles of incorporation, operating agreement, and bylaws. Ownership structure with a complete organizational chart showing all parent entities, subsidiaries, and affiliates.

Principal Information

For all principals — defined broadly to include officers, directors, and owners of 10 percent or more — the application requires full personal information, residential and business address history for the past 10 years, personal financial statements, disclosure of all regulatory actions, criminal history, bankruptcy filings, and civil litigation history, and fingerprints for background investigation.

Financial Information

Audited financial statements for the past two years. A detailed pro forma financial projection covering at least two years. Evidence of minimum capital requirements — the DFS has discretion over capital requirements and sets them based on the specific business model and risk profile.

Compliance Program Documentation

This section is where the BitLicense most distinguishes itself from standard money transmitter applications. The DFS requires comprehensive compliance program documentation including a complete BSA/AML compliance program, an AML risk assessment specific to your virtual currency activities, KYC and CDD procedures covering both individual and business customers, OFAC and sanctions screening program documentation, transaction monitoring program documentation, SAR filing procedures, and a Consumer Protection policy covering disclosure requirements and complaint handling.

Cybersecurity Program

The DFS requires documentation of your cybersecurity program — covering security policies and procedures, access controls, encryption standards, vulnerability assessment processes, incident response procedures, and business continuity and disaster recovery plans. The cybersecurity requirements for the BitLicense are among the most comprehensive of any U.S. financial license.

Consumer Protection Policy

Documentation of how you disclose fees and terms to customers, how you handle customer complaints, how you ensure fair treatment of customers, and what protections you provide for customer virtual currency holdings.

Business Continuity Plan

A documented plan for maintaining operations and protecting customer assets in the event of significant disruption — covering scenarios including technology failures, key personnel loss, and market disruptions.

The BitLicense Application Process

Pre-Application Preparation

Before submitting a BitLicense application, most businesses engage in substantial preparation — typically 6 to 12 months of building out compliance programs, technology infrastructure, financial documentation, and organizational documentation before the application is ready to submit. The quality of your preparation directly affects how smoothly the review process goes.

Submission

BitLicense applications are submitted through the DFS's online licensing portal. The DFS conducts an initial completeness review — applications that are missing required information are returned as incomplete and must be resubmitted. A complete, well-organized application package helps avoid this delay.

DFS Review and Investigation

Once accepted as complete, the DFS conducts a thorough review including background investigations of all principals, review of all compliance documentation, assessment of your technology and cybersecurity programs, and potentially interviews with key personnel.

Deficiency Letters

During the review, the DFS typically issues one or more deficiency letters requesting additional information or clarification. Responding promptly and completely to deficiency letters is critical to keeping your timeline on track.

Approval, Conditional Approval, or Denial

The DFS issues its determination after completing its review. Approvals may be conditional — subject to specific requirements your business must meet before or after receiving the license.

BitLicense Timeline

The BitLicense process has historically been long. Early applications in 2015 and 2016 took several years to process. The DFS has worked to streamline the process, but realistic timelines for BitLicense applications remain 18 to 36 months for most applicants.

Businesses with more straightforward models, cleaner principal backgrounds, and more comprehensive application packages tend to move faster. Novel business models, complex ownership structures, and incomplete applications extend timelines significantly.

Operating in New York While the BitLicense Application Is Pending

Businesses that have submitted a BitLicense application and are operating under the DFS's informal no-action position for pending applicants may be able to continue operating while their application is reviewed. This position is subject to change and should be confirmed with qualified counsel before relying on it.

Frequently Asked Questions

Can a crypto company use a sponsor bank arrangement instead of getting a BitLicense?

No. The BitLicense requirement applies based on the virtual currency business activity being conducted — not on how the business is structured. A crypto company engaged in virtual currency business activity with New York residents needs a BitLicense regardless of its sponsor bank arrangement.

Is the BitLicense required for crypto companies that do not have a physical presence in New York?

Yes. The BitLicense requirement applies to any business engaged in virtual currency business activity involving New York or New York residents — regardless of where the business is physically located. If you have New York users, you need a BitLicense.

What happens if you operate without a BitLicense?

Operating without a required BitLicense in New York is a violation of New York law and DFS regulations. The DFS has taken enforcement action against unlicensed virtual currency businesses including cease and desist orders and civil money penalties. The DFS actively monitors for unlicensed activity in the virtual currency space.

How ComplyOne Helps

ComplyOne works with cryptocurrency businesses to prepare comprehensive BitLicense applications, build the compliance programs and cybersecurity documentation the DFS requires, and navigate the BitLicense review process — through advisory services, compliance technology, or both. Learn more about AML crypto compliance.

Talk to the ComplyOne team to get started.

The information in this article is for general educational purposes and does not constitute legal or regulatory advice. BitLicense requirements are subject to change through DFS regulation and guidance. Consult qualified legal counsel with DFS experience before making licensing decisions.