August 9, 2022

Volume XII, Number 221

Advertisement
Advertisement

August 08, 2022

Subscribe to Latest Legal News and Analysis

New York DFS Fines Robinhood $30M for “Significant” Cybersecurity Violations

The New York Department of Financial Services (DFS) announced its first ever penalty against a cryptocurrency platform this week, with a whopping $30 million fine assessed against Robinhood Crypto, LLC (RHC) for what it described as “significant failures in the areas of bank secrecy act/anti-money laundering obligations and cybersecurity that resulted in violations of the Department’s Virtual Currency Regulation (23 NYCRR Part 200), Money Transmitter Regulation (3 NYCRR Part 417), Transaction Monitoring Regulation (23 NYCRR Part 504), and Cybersecurity Regulation (23 NYCRR Part 500).

Following DFS’s supervisory examination and enforcement investigation, it found that RHC’s compliance program “did not fully address RHC’s operational risks, and specific policies within the program were not in full compliance with several provisions of the Department’s Cybersecurity and Virtual Currency Regulations.”

In particular, all DFS-regulated entities must certify annually that they have complied with DFS regulations, including its cybersecurity regulations. According to DFS, RHC certified to DFS that it complied with the DFS Cybersecurity Regulations. However, DFS stated in its press release that “[D]espite these weaknesses in its transaction monitoring and cybersecurity programs, RHC improperly certified compliance with the Department’s Transaction Monitoring Regulation and Cybersecurity Regulation. Pursuant to those regulations, companies should only be certifying to DFS if their programs are fully compliant with the applicable regulation. In light of the program’s deficiencies, RHC’s 2019 certifications to the Department attesting to compliance with these Regulations should not have been made and thus violated the law.”

In addition to the monetary penalty, the settlement requires RHC to be overseen by an independent consultant that will perform “a comprehensive evaluation” of RHC’s compliance and remediation efforts in response to the violations identified by DFS.

The discovered deficiencies and subsequent penalty are reminders to DFS-regulated entities that the annual certification to DFS will be scrutinized and enforced.

Copyright © 2022 Robinson & Cole LLP. All rights reserved.National Law Review, Volume XII, Number 216
Advertisement
Advertisement
Advertisement
Advertisement
Advertisement
Advertisement

About this Author

Linn F. Freedman, Robinson Cole Law Firm, Cybersecurity and Litigation Law Attorney, Providence
Partner

Linn Freedman practices in data privacy and security law, cybersecurity, and complex litigation. She provides guidance on data privacy and cybersecurity compliance to a full range of public and private clients across all industries, such as construction, education, health care, insurance, manufacturing, real estate, utilities and critical infrastructure, marine, and charitable organizations. Linn is a member of the firm's Business Litigation Group and chairs its Data Privacy + Cybersecurity Team. She is also a member of the Financial Services Cyber-Compliance Team (CyFi ...

401-709-3353
Advertisement
Advertisement
Advertisement