# NYDFS

> NYDFS (New York State Department of Financial Services): The most privacy-restrictive US regulator, state or federal. Region: Americas. Restricts anonymity: Anonymity-enhancing assets or unattributed transfers are barred outright, or barred for regulated firms.

Part of the Soda Labs Privacy Hub regulation map, which reads the instruments
themselves rather than summarising the summaries: https://www.sodalabs.xyz/privacy-hub/regulation

## Key facts

- Entry type: Regulator or standard-setter
- Region: Americas
- Subject: The most privacy-restrictive US regulator, state or federal
- Authority: New York State Department of Financial Services
- Stance on on-chain confidentiality: Restricts anonymity. Anonymity-enhancing assets or unattributed transfers are barred outright, or barred for regulated firms.
- Tags: BitLicense, blockchain analytics, self-certification bar, Greenlist
- Canonical page: https://www.sodalabs.xyz/privacy-hub/regulation/reg-nydfs

## What it actually says

Where federal policy has softened around non-custodial software, New York has not moved at all. Its licensees must run blockchain analytics across onboarding, monitoring and sanctions screening, tracing the flow of funds through the chain and treating anything processed through a mixer as a monitored typology. The listing guidance is the most explicit anti-anonymity language from any US regulator: a coin cannot be self-certified if it has features designed to facilitate obfuscation or concealment of identity. The framework was extended to all New York banking organisations in 2025. To its credit the guidance is honest about its own limits, conceding that analytics may not identify underlying owners without off-chain verification.

## The instruments that matter

- **Guidance on the use of blockchain analytics, 28 April 2022**: licensees must trace the flow of funds through the blockchain, and it names virtual currency processed through a mixer or tumbler as a monitored typology
- **Listing guidance, 15 November 2023**: a coin cannot be self-certified if it is designed or substantially used to circumvent laws, or has features designed to facilitate the obfuscation or concealment of the identity of an individual or entity
- **Extended to banking organizations, 17 September 2025**: the analytics framework now applies to all New York banking organizations
- **A candid limitation**: the guidance concedes analytics may not identify underlying owners absent further off-chain verification

## Sources

- [Guidance on blockchain analytics](https://www.dfs.ny.gov/industry_guidance/industry_letters/il20220428_guidance_use_blockchain_analytics)
- [Guidance on listing virtual currencies](https://www.dfs.ny.gov/industry_guidance/industry_letters/il20231115_listing_virtual_currencies)

## Related entries

- [FinCEN](https://www.sodalabs.xyz/privacy-hub/regulation/reg-fincen): Bank Secrecy Act · the deepest US constraint
- [GENIUS Act](https://www.sodalabs.xyz/privacy-hub/regulation/reg-genius-act): Stablecoins · censorability as a licensing precondition
- [IRS broker reporting](https://www.sodalabs.xyz/privacy-hub/regulation/reg-irs-broker-reporting): Tax · live at the custodial perimeter, dead beyond it
- [The third-party doctrine](https://www.sodalabs.xyz/privacy-hub/regulation/reg-third-party-doctrine): Why chain analysis needs no warrant
- [OFAC and Van Loon](https://www.sodalabs.xyz/privacy-hub/regulation/reg-ofac): Sanctions · where the law found a limit
- [US Treasury and the Working Group](https://www.sodalabs.xyz/privacy-hub/regulation/reg-us-treasury-pwg): The first federal endorsement of privacy technology