CHAPTER
1. General Provisions
3101.
This division shall be known and may be cited as the Uniform Regulation of Virtual Currency Businesses Act. 3102.
(a) For the purposes of this division:(1) “Applicant” means a person that applies for a license under this division.
(2) “Bank” means a federally chartered or state-chartered depository institution or holder of a charter granted by the Office of the Comptroller of the Currency to a person engaged in the business of banking other than deposit-taking. The term does not include either of the following:
(A) An industrial loan company, state-chartered trust company, or a limited-purpose trust company, unless incorporated as a bank or the department has authorized the company to engage in virtual currency business
activity.
(B) A trust company or limited-purpose trust company chartered by a state with which this state does not have a reciprocity agreement governing trust-company activities.
(3) “Control” means both of the following:
(A) When used in reference to a transaction or relationship involving virtual currency, power to execute unilaterally or prevent indefinitely a virtual currency transaction.
(B) When used in reference to a person, the direct or indirect power to direct the management, operations, or policies of the person through legal or beneficial ownership of voting power in the person or under a contract, arrangement, or understanding.
(4) “Department” means the Department of
Business Oversight.
(5) “Exchange,” when used as a verb, means to assume control of virtual currency from, or on behalf of, a resident, at least momentarily, to sell, trade, or convert either of the following:
(A) Virtual currency for legal tender, bank credit, or one or more forms of virtual currency.
(B) Legal tender or bank credit for one or more forms of virtual currency.
(6) “Executive officer” means an individual who is a director, officer, manager, managing member, partner, or trustee of a person that is not an individual.
(7) “Insolvent” means any of the following:
(A) Having generally ceased to pay debts in the
ordinary course of business other than as a result of a bona fide dispute.
(B) Being unable to pay debts as they become due.
(C) Being insolvent within the meaning of federal bankruptcy law.
(8) “Legal tender” means a medium of exchange or unit of value, including the coin or paper money of the United States, issued by the United States or by another government.
(9) “Licensee” means a person licensed under this division.
(10) “Person” means an individual, partnership, estate, business or nonprofit entity, or other legal entity. The term does not include a public corporation, government, or governmental subdivision, agency, or instrumentality.
(11) “Reciprocity agreement” means an arrangement between the department and the appropriate licensing agency of another state which permits a licensee operating under a license granted by the other state to engage in virtual currency business activity with or on behalf of a resident.
(12) “Record” means information that is inscribed on a tangible medium or that is stored in an electronic or other medium and is retrievable in perceivable form.
(13) “Registrant” means a person that has registered with this state under Section 3207 to conduct virtual currency business activity.
(14) “Registration” means the ability under Section 3207 to conduct virtual currency business activity.
(15) [Reserved.]
(16) (A) “Resident” means any of the following:
(i) A person who is domiciled in this state.
(ii) A person who is physically located in this state for more than 183 days of the previous 365 days.
(iii) A person who has a place of business in this state.
(B) “Resident” includes a legal representative of a person that satisfies subparagraph (A).
(17) “Responsible individual” means an individual who has managerial authority with respect to a licensee’s or registrant’s virtual currency business activity with, or on behalf of, a resident.
(18) “Sign” means, with present intent to authenticate or adopt a record, either of the following:
(A) To execute or adopt a tangible symbol.
(B) To attach to, or logically associate with, the record an electronic symbol, sound, or process.
(19) “State” means a state of the United States, the District of Columbia, Puerto Rico, the United States Virgin Islands, or any territory or insular possession subject to the jurisdiction of the United States.
(20) “Store,” except in the phrase “store of value,” means to maintain control of virtual currency on behalf of a resident by a person other than the resident. “Storage” and “storing” have corresponding meanings.
(21) “Transfer” means to assume control of virtual currency from, or on behalf of, a resident and any of the following:
(A) To credit the virtual currency to the account of another person.
(B) To move the virtual currency from one account of a resident to another account of the same resident.
(C) To relinquish control of virtual currency to another person.
(22) “United States dollar equivalent of virtual currency” means the equivalent value of a particular virtual currency in United States dollars shown on a virtual currency exchange based in the United States for a particular date or period specified in this division.
(23) “Virtual currency” means a digital representation of value that is used as a medium of exchange, unit of account, or store of value, and that is not legal tender, whether or not denominated in legal tender. “Virtual currency” does not include either of the following:
(A) A transaction in which a merchant grants, as part of an affinity or rewards program, value that cannot be taken from or exchanged with the merchant for legal tender, bank credit, or virtual currency.
(B) A digital representation of value issued by or on behalf of a publisher and used solely within an online game, game platform, or family of games sold by the same publisher or offered on the same game platform.
(24) “Virtual currency administration” means issuing virtual currency with the authority to redeem the currency for legal
tender, bank credit, or other virtual currency.
(25) “Virtual currency business activity” means any of the following:
(A) Exchanging, transferring, or storing virtual currency or engaging in virtual currency administration, whether directly or through an agreement with a virtual currency control services vendor.
(B) Holding electronic precious metals or electronic certificates representing interests in precious metals on behalf of another person or issuing shares or electronic certificates representing interests in precious metals.
(C) Exchanging one or more digital representations of value used within one or more online games, game platforms, or family of games for either of the following:
(i) Virtual currency offered by or on behalf of the same publisher from which the original digital representation of value was received.
(ii) Legal tender or bank credit outside the online game, game platform, or family of games offered by or on behalf of the same publisher from which the original digital representation of value was received.
(26) “Virtual currency control services vendor” means a person that has control of virtual currency solely under an agreement with a person that, on behalf of another person, assumes control of virtual currency.
(b) Other definitions applicable to this division are found in Section 8702 of the Commercial Code.
3103.
(a) Except as otherwise provided in subdivision (b) or (c), this division governs the virtual currency business activity of a person, wherever located, who engages in or holds itself out as engaging in the activity with, or on behalf of, a resident.(b) This division does not apply to the exchange, transfer, or storage of virtual currency or to virtual currency administration to the extent the Electronic Fund Transfer Act of 1978 (15 U.S.C. Secs. 1693 through 1693r), the Securities Exchange Act of 1934 (15 U.S.C. Secs. 78a through 78oo), the Commodities Exchange Act of 1936 (7 U.S.C. Secs. 1 through 27f), or the Corporate Securities Law of 1968 (Division 1 (commencing with Section 25000) of Title 4 of the Corporations Code) govern the
activity. This division does not apply to activity by any of the following:
(1) The United States, a state, political subdivision of a state, agency, or instrumentality of federal, state, or local government, or a foreign government or a subdivision, department, agency, or instrumentality of a foreign government.
(2) A bank, including a trust company that is incorporated as a bank.
(3) A person engaged in money transmission that holds a license under the Money Transmission Act (Division 1.2 (commencing with Section 2000)), is authorized by the department to engage in virtual currency business activity, and complies with Chapter 2 (commencing with Section 3201), Chapter 3 (commencing with Section 3301), Chapter 5 (commencing with Section 3501), and Chapter 6 (commencing with Section 3601).
(4) A person whose participation in a payment system is limited to providing processing, clearing, or performing settlement services solely for transactions between or among persons that are exempt from the licensing or registration requirements of this division.
(5) A person engaged in the business of dealing in foreign exchange to the extent the person’s activity meets the definition in Section 1010.605(f)(1)(iv) of Title 31 of the Code of Federal Regulations.
(6) A person that is any of the following:
(A) A person that contributes only connectivity software or computing power to a decentralized virtual currency or to a protocol governing transfer of the digital representation of value.
(B) A person that provides only data storage or security services for a business engaged in virtual currency business activity and does not otherwise engage in virtual currency business activity on behalf of another person.
(C) A person that provides only to a person otherwise exempt from this division virtual currency as one or more enterprise solutions used solely among each other and that has no agreement or relationship with a resident that is an end-user of virtual currency.
(7) A person using virtual currency, including creating, investing, buying or selling, or obtaining virtual currency as payment for the purchase or sale of goods or services, solely on the person’s own behalf for personal, family, or household purposes or for academic purposes.
(8) A person whose virtual currency business
activity with, or on behalf of, residents is reasonably expected to be valued, in the aggregate, on an annual basis at five thousand dollars ($5,000) or less, measured by the United States dollar equivalent of virtual currency.
(9) An attorney to the extent of providing escrow services to a resident.
(10) A title insurance company to the extent of providing escrow services to a resident.
(11) A securities intermediary, as defined in Section 8102 of the Commercial Code, or a commodity intermediary, as defined in Section 9102 of Commercial Code, that does not engage in the ordinary course of business in virtual currency business activity with, or on behalf of, a resident, in addition to maintaining securities accounts or commodities accounts and is regulated as a securities intermediary or commodity intermediary under
federal law, law of this state other than this division, or law of another state, and affords a resident protections comparable to those set forth in Chapter 7 (commencing with Section 8701) of Division 8 of the Commercial Code.
(12) A secured creditor under Division 9 (commencing with Section 9101) of the Commercial Code or a creditor with a judicial lien, or lien arising by operation of law, on collateral that is virtual currency, if the virtual currency business activity of the creditor is limited to enforcement of the security interest in compliance with Division 9 (commencing with Section 9101) of the Commercial Code or lien in compliance with the law applicable to the lien.
(13) A virtual currency control services vendor.
(14) A person that does not receive compensation from a resident for providing virtual
currency products or services or for conducting virtual currency business activity, or that is engaged in testing products or services with the person’s own funds.
(c) The department may determine that a person or class of persons, given facts particular to the person or class, are exempt from this division, whether the person or class is covered by requirements imposed under federal law on a money-service business.
3104.
Unless displaced by the particular provisions of this division, the principles of law and equity supplement its provisions. 3201.
A person shall not engage in virtual currency business activity, or hold itself out as being able to engage in virtual currency business activity, with or on behalf of a resident unless the person is one of the following:(a) Licensed in this state by the department under Section 3202.
(b) Licensed in another state to conduct virtual currency business activity by a state with which this state has a reciprocity agreement and has qualified under Section 3203.
(c) Registered with the department and operating in compliance with Section 3207.
(d) Exempt from licensure or
registration under this division by subdivision (b) or (c) of Section 3103.
3202.
(a) Except as otherwise provided in Section 3203, an application for a license under this division shall satisfy all of the following:(1) Be in a form and medium prescribed by the department.
(2) Except as otherwise provided in subdivision (b), provide the following information relevant to the applicant’s proposed virtual currency business activity:
(A) The legal name of the applicant, each current or proposed business United States Postal Service address of the applicant, and any fictitious or trade name the applicant uses or plans to use in conducting its virtual currency business activity with or on behalf of a
resident.
(B) The legal name, any former or fictitious name, and the residential and business United States Postal Service address of each executive officer and responsible individual of the applicant, and each person that has control of the applicant.
(C) A description of the current and former business of the applicant for the five years before the application is submitted, or if the business has operated for less than five years, for the time the business has operated, including its products and services, associated internet website addresses and social media pages, principal place of business, projected user base, and specific marketing targets.
(D) The name, United States Postal Service address, and telephone number of a person that manages each server the applicant expects to use in conducting its virtual
currency business activity with, or on behalf of, a resident and a copy of any agreement with that person.
(E) A list of all of the following:
(i) Each money service or money transmitter license the applicant holds in another state.
(ii) The date the license expires.
(iii) Any license revocation, license suspension, or other disciplinary action taken against the licensee in another state and any license applications rejected by another state.
(F) A list of any criminal conviction, deferred prosecution agreement, and pending criminal proceeding in any jurisdiction against all of the following:
(i) The applicant.
(ii) Each executive officer of the applicant.
(iii) Each responsible individual of the applicant.
(iv) Each person that has control over the applicant.
(v) Each person over which the applicant has control.
(G) A list of any litigation, arbitration, or administrative proceeding in any jurisdiction in which the applicant, or an executive officer or a responsible individual of the applicant has been a party for the five years before the application is submitted, determined to be material in accordance with generally accepted accounting principles and, to the extent the applicant would be required to disclose the litigation, arbitration, or administrative proceeding in the applicant’s audited
financial statements, reports to equity owners, and similar statements or reports.
(H) A list of any bankruptcy or receivership proceeding in any jurisdiction for the 10 years before the application is submitted in which any of the following was a debtor:
(i) The applicant.
(ii) Each executive officer of the applicant.
(iii) Each responsible individual of the applicant.
(iv) Each person that has control over the applicant.
(v) Each person over which the applicant has control.
(I) The name and United States Postal Service address of each bank in which the
applicant plans to deposit funds obtained by its virtual currency business activity.
(J) The source of funds and credit to be used by the applicant to conduct virtual currency business activity with, or on behalf of, a resident and documentation demonstrating that the applicant has the net worth and reserves required by Section 3204.
(K) The United States Postal Service address and electronic mail address to which communications from the department may be sent.
(L) The name, United States Postal Service address, and electronic mail address of the registered agent of the applicant in this state.
(M) A copy of the certificate, or a detailed summary acceptable to the department, of coverage for each liability, casualty, business-interruption or
cyber-security insurance policy maintained by the applicant for itself, an executive officer, a responsible individual, or the applicant’s users.
(N) If applicable, the date on which, and the state where, the applicant is formed and a copy of a current certificate of good standing issued by that state.
(O) If a person has control of the applicant and the person’s equity interests are publicly traded in the United States, a copy of the audited financial statement of the person for the most recent fiscal year or most recent report of the person filed under Section 13 of the Securities Exchange Act of 1934 (15 U.S.C. Sec. 78m).
(P) If a person has control of the applicant and the person’s equity interests are publicly traded outside the United States, a copy of the audited financial statement of the person for the most
recent fiscal year of the person or a copy of the most recent documentation similar to that required in subparagraph (O) filed with the foreign regulator in the domicile of the person.
(Q) If the applicant is a partnership or a member-managed limited liability company, the names and United States Postal Service addresses of general partners or members.
(R) If the applicant is required to register with the Financial Crimes Enforcement Network of the United States Department of the Treasury as a money service business, evidence of the registration.
(S) A set of fingerprints for each executive officer and responsible individual of the applicant.
(T) If available, for each executive officer and responsible individual of the applicant, for the five years
before the application is submitted, employment history and history of any investigation of the individual or legal proceeding to which the individual was a party.
(U) The plans through which the applicant will meet its obligations under Chapter 6 (commencing with Section 3601).
(V) Other information the department reasonably requires by rule.
(3) The application be accompanied by a nonrefundable fee in the amount determined by the department to cover the reasonable costs of regulation.
(b) For good cause, the department may waive a requirement of subdivision (a) or permit the applicant to submit other information instead of the required information.
(c) An application for a license under
this section is not complete until the department receives all information required by this division and completes its investigation under subdivision (d).
(d) (1) On receipt of a completed application, the department shall investigate all of the following:
(A) The financial condition and responsibility of the applicant.
(B) The relevant financial and business experience, character, and general fitness of the applicant.
(C) The competence, experience, character, and general fitness of each executive officer, each responsible individual, and any person that has control of the applicant.
(2) At the option the department, it may investigate the business premises of an
applicant.
(e) Not later than 30 days after an application is complete, the department shall send the applicant notice of its decision to approve, conditionally approve, or deny the application. If the department does not send the applicant notice of its decision within 31 days of completion of the application, the application is deemed denied. If the department does not receive notice from the applicant that the applicant accepts conditions specified by the department within 31 days following the department’s notice of the conditions, the application is deemed denied.
(f) A license takes effect on the later of the following:
(1) The date on which the department issues the license.
(2) The date the licensee provides the security required by Section
3204.
(g) An applicant shall pay the reasonable costs of the department’s investigation under this section.
3203.
(a) A person licensed by another state to engage in virtual currency business activity in that state may engage in virtual currency business activity with or on behalf of a resident to the same extent as a licensee if all of the following are true:(1) The department determines that the state in which the person is licensed has in force laws regulating virtual currency business activity which are substantially similar to, or more protective of rights of users than, this division.
(2) At least 30 days before the person commences virtual currency business activity with, or on behalf of, a resident, the person submits to the department all of the following:
(A) A notice containing a statement that the person will rely on reciprocal licensing, a copy of the license to conduct virtual currency business activity issued by the other state, and certification of license history from the agency responsible for issuing the license to conduct virtual currency business activity in the other state.
(B) A nonrefundable reciprocal license fee in the amount specified by the department, not to exceed the reasonable costs of regulation.
(C) Documentation demonstrating that the applicant complies with the security and net worth reserve requirements of Section 3204.
(D) A certification signed by an executive officer of the applicant affirming that the applicant will conduct its virtual currency business activity with, or on
behalf of, a resident in compliance with this division.
(3) Subject to subdivision (b), the department does not deny the application not later than 15 days after receipt of the items submitted under paragraph (2).
(4) Subject to subdivision (b), the applicant does not commence virtual currency business activity with, or on behalf of, a resident until at least 31 days after complying with paragraph (2).
(b) For good cause, the department may modify a period in this section.
3204.
(a) Before a license is issued under this division:(1) An applicant shall deposit with the department funds or investment property, a letter of credit, a surety bond, or other security satisfactory to the department that secures the applicant’s faithful performance of its duties under this division and is in an amount the department specifies based on the nature and extent of risks in the applicant’s virtual currency business model.
(2) The department shall not require a surety bond as security under this division unless a surety bond is generally available in the state at a commercially reasonable cost.
(3) Security deposited under this section shall be payable to this state for the benefit of a claim against the licensee on account of the licensee’s virtual currency business activity with, or on behalf of, a resident.
(4) Security deposited under this section shall cover claims for the period the department specifies by rule and for an additional period the department specifies after the licensee ceases to engage in virtual currency business activity with or on behalf of a resident.
(5) For good cause, the department may require the licensee to increase the amount of security deposited under this section, and the licensee shall deposit the additional security not later than 15 days after the licensee receives notice in a record of the required increase.
(6) For good cause, the department may permit a
licensee to substitute or deposit an alternate form of security satisfactory to the department if the licensee at all times complies with this section.
(7) A claimant does not have a direct right to recover against security deposited under this section.
(8) Only the department may recover against the security, and the department may retain the recovery for no longer than five years and may process claims and distribute recoveries to claimants in accordance with rules adopted by the department under the Money Transmission Act (Division 1.2 (commencing with Section 2000)).
(b) In addition to the security required under subdivision (a), a licensee and a registrant, at the time of the application for a license under this act or filing of registration, shall submit to the department evidence of and maintain a minimum net
worth of twenty-five thousand dollars ($25,000) and sufficient unencumbered reserves for winding down the licensee’s or registrant’s operations, as agreed to by the department considering the nature and size of expected virtual currency business activity with, or on behalf of, residents.
(c) A licensee or registrant may include in its calculation of net worth virtual currency, measured by the average value of the virtual currency in United States dollar equivalent over the prior six months, other than the virtual currency over which it has control for a resident entitled to the protections of Chapter 7 (commencing with Section 8701) of Division 8 of the Commercial Code.
(d) For good cause, the department may require a licensee or registrant to increase the net worth or reserves required under this section. The licensee or registrant shall submit to the department evidence that it
has the additional net worth or reserves not later than 15 days after the licensee or registrant receives notice in a record of the required increase.
3205.
(a) Absent good cause, the department shall issue a license to an applicant if the applicant complies with this chapter and pays the costs of the investigation under subdivision (g) of Section 3202 and the initial licensee fee under paragraph (3) of subdivision (a) of Section 3202 in an amount specified by the department.(b) An applicant may appeal a denial of its application under Section 3202 or 3203, under the Administrative Procedure Act, as defined in Section 11370 of the Government Code, not later than 30 days after the department notifies the applicant of the denial or the application is deemed denied.
3206.
(a) Subject to subdivision (g), not later than 15 days before the anniversary date of issuance of its license under this division, a licensee may apply for renewal of the license by paying a renewal fee determined by the department, not to exceed the reasonable costs of regulation, and submitting to the department a renewal report under subdivision (b).(b) A renewal report required by subdivision (a) shall be submitted in a form and medium prescribed by the department. The report shall contain all of the following:
(1) Either a copy of the licensee’s most recent reviewed annual financial statement, if the licensee’s virtual currency business activity in this state was ____
dollars ($____) or less for the fiscal year ending before the anniversary date of issuance of its license under this division, or audited annual financial statement if the licensee’s virtual currency business activity in this state amounted to more than ____ dollars ($____) for the fiscal year ending before the anniversary date.
(2) If a person other than an individual has control of the licensee, a copy either of the following:
(A) The person’s most recent reviewed annual financial statement if the person’s gross revenue was ____ dollars ($____) or less in the previous fiscal year, measured as of the anniversary date of issuance of its license under this division.
(B) The person’s most recent audited consolidated annual financial statement if the person’s gross revenue was more than ____ dollars ($____) in the
previous fiscal year, measured as of the anniversary date of issuance of its license under this division.
(3) A description of any of the following:
(A) Material change in the financial condition of the licensee.
(B) Material litigation involving the licensee or an executive officer, or responsible individual of the licensee.
(C) License suspension or revocation proceeding commenced, or other action taken, involving a license to conduct virtual currency business activity issued by another state on which reciprocal licensing is based.
(D) Federal or state investigation involving the licensee.
(E) Data security breach involving
the licensee.
(4) Information or records required by Section 3305 that the licensee has not reported to the department.
(5) The number of virtual currency business activity transactions with, or on behalf of, residents for the period since, subject to subdivision (g), the later of the date the license was issued or the date the last renewal report was submitted.
(6) (A) The amount of United States dollar equivalent of virtual currency in the control of the licensee at, subject to subdivision (g), the end of the last month that ends not later than 30 days before the date of the renewal report.
(B) The total number of residents for whom the licensee had control of United States dollar equivalent of virtual currency on that date.
(7) Evidence that the licensee continues to satisfy Section 3502.
(8) Evidence that the licensee continues to satisfy Section 3204.
(9) A list of each location where the licensee operates its virtual currency business activity.
(10) The name, United States Postal Service address, and telephone number of each person that manages a server used by the licensee in conducting its virtual currency business activity with or on behalf of a resident.
(c) If a licensee does not timely comply with subdivision (a), the department may use enforcement measures provided under Chapter 4 (commencing with Section 3401). Notice or hearing is not required for a suspension or revocation of a license under this
division for failure to pay a renewal fee or file a renewal report.
(d) If the department suspends or revokes a license under this division for noncompliance with subdivision (a), the department may end the suspension or rescind the revocation and notify the licensee of the action if, subject to subdivision (g), not later than 20 days after the license was suspended or revoked, the licensee files a renewal report and pays a renewal fee and pays any penalty assessed under Section 3404.
(e) The department shall give prompt notice to a licensee of the lifting of a suspension or rescission of a revocation after the licensee complies with subdivision (d).
(f) Suspension or revocation of a license under this section does not invalidate a transfer or exchange of virtual currency for, or on behalf of, a resident made during
the suspension or revocation and does not insulate the licensee from liability under this division.
(g) For good cause, the department may extend a period under this section.
(h) The department shall review the renewal of a license issued under Section 3203 to ensure that the state that issued the original license has not suspended, revoked, or limited the license.
(i) A licensee that does not comply with this section shall cease operations with, or on behalf of, a resident on or before the anniversary date of issuance of its license under this division.
(j) A licensee shall pay the reasonable and necessary costs of the department’s investigation under this section.
3207.
(a) A person whose volume of virtual currency business activity in United States dollar equivalent of virtual currency will not exceed thirty-five thousand dollars ($35,000) annually may engage in virtual currency business activity with, or on behalf of, a resident under a registration without first obtaining a license under this division if the person does all of the following:(1) Files with the department a notice in the form and medium prescribed by the department of its intention to engage in virtual currency business activity with, or on behalf of, a resident.
(2) Provides the information for an investigation under Section 3202.
(3) States the anticipated virtual currency business activity for its next fiscal quarter.
(4) Pays the department a registration fee in an amount determined by the department, not to exceed the reasonable costs of regulation.
(5) If required to register with the Financial Crimes Enforcement Network of the United States Department of the Treasury as a money service business, provides the department evidence of the registration.
(6) Provides evidence that the person has policies and procedures to comply with the Bank Secrecy Act (31 U.S.C. Sec. 5311 et seq.) and other applicable laws.
(7) Describes the source of funds and credit to be used by the person to conduct virtual currency business
activity with, or on behalf of, a resident and provides evidence of, and agrees to maintain, the minimum net worth and reserves required by Section 3204 and sufficient unencumbered reserves for winding down operations.
(8) Provides the department with evidence that the person has in place policies and procedures to comply with Chapter 3 (commencing with Section 3301), Chapter 5 (commencing with Section 3501), and Chapter 6 (commencing with Section 3601) and other provisions of this division designated by the department.
(9) Provides the department with a copy of its most recent financial statement, whether reviewed or audited.
(b) Before the virtual currency business activity of a registrant with, or on behalf of, residents exceeds thirty-five thousand dollars ($35,000) annually in United States dollar equivalent of
virtual currency, the registrant shall file an application for a license under this division and may continue to operate after the activity exceeds thirty-five thousand dollars ($35,000) annually while its application for license is pending.
(c) For good cause, the department may suspend or revoke a registration without a prior hearing or opportunity to be heard.
(d) A registrant shall cease all virtual currency business activity with, or on behalf of, residents in the event of any of the following:
(1) If the department denies the registrant’s application for a license under this division, one day after the registrant receives notice in a record that the department has denied the application.
(2) If the department suspends or revokes the registration,
one day after the department sends notice of the suspension or revocation to the registrant in a record by a means reasonably selected for the notice to be received by the recipient in one day, to the address provided for receiving communications from the department.
(3) If the virtual currency business activity of the registrant with, or on behalf of, residents exceeds thirty-five thousand dollars ($35,000) annually in United States dollar equivalent of virtual currency and the registrant has not filed an application for a license under this division.
(4) On the second anniversary date of the registration.
3208.
A license or registration under this division is not transferable or assignable. 3209.
The department may adopt rules to implement this division and issue guidance as appropriate. 3301.
(a) The department may conduct an annual examination of a licensee or registrant. For good cause, the department may conduct an additional examination. The department may examine a licensee or registrant without prior notice to the licensee or registrant.(b) A licensee or registrant shall pay the reasonable and necessary costs of an examination under this section.
(c) Information obtained during an examination under this chapter may be disclosed only as provided in Section 3304.
3302.
(a) A licensee or registrant shall maintain, for all virtual currency business activity with, or on behalf of, a resident five years after the date of the activity, a record of all of the following:(1) Each transaction of the licensee or registrant with, or on behalf of, the resident or for the licensee’s or registrant’s account in this state, including:
(A) The identity of the resident.
(B) The form of the transaction.
(C) The amount, date, and payment instructions given by the resident.
(D) The account number, name, and United States Postal Service address of the resident, and, to the extent feasible, other parties to the transaction.
(2) The aggregate number of transactions and aggregate value of transactions by the licensee or registrant with, or on behalf of, the resident and for the licensee’s or registrant’s account in this state, expressed in United States dollar equivalent of virtual currency for the previous 12 calendar months.
(3) Each transaction in which the licensee or registrant exchanges one form of virtual currency for legal tender or another form of virtual currency with, or on behalf of, the resident.
(4) A general ledger posted at least monthly that lists all assets, liabilities, capital, income, and expenses of the licensee or registrant.
(5) Each business-call report the licensee or registrant is required to create or provide to the department.
(6) Bank statements and bank reconciliation records for the licensee or registrant and the name, account number, and United States Postal Service address of each bank the licensee or registrant uses in the conduct of its virtual currency business activity with, or on behalf of, the resident.
(7) A report of any dispute with the resident.
(8) A report of any virtual currency business activity transaction with, or on behalf of, a resident that the licensee or registrant was unable to complete.
(b) A licensee or registrant shall maintain records required by subdivision (a) in a form that
enables the department to determine whether the licensee or registrant is in compliance with this division, any court order, and the law of this state other than this division.
(c) If a licensee or registrant maintains records outside this state that pertain to transactions with, or on behalf of, a resident, the licensee or registrant shall make the records available to the department not later than three days after request, or, on a determination of good cause by the department, at a later time.
(d) All records maintained by a licensee or registrant are subject to inspection by the department.
3303.
(a) Subject to Section 3304 and law of this state other than this division concerning privacy, consumer financial privacy, data protection, privilege, and confidentiality, the department may cooperate, coordinate, jointly examine, consult, and share records and other information with the appropriate regulatory agency of another state, a self-regulatory organization, federal or state regulator of banking or nondepository providers, or a regulator of a jurisdiction outside the United States, concerning the affairs and conduct of a licensee or registrant in this state.(b) The department shall do all of the following:
(1) Establish or participate in, with another state that enacts a
law substantially similar to this division, a central depository for filings required by law of this state other than this division.
(2) Cooperate in developing and implementing uniform forms for applications and renewal reports and the conduct of joint administrative proceedings and civil actions.
(3) Formulate joint rules, forms, statements of policy, and guidance and interpretative opinions and releases.
(4) Develop common systems and procedures.
(c) The department shall not establish or participate in a central commercial depository that contains nonpublic personally identifiable information which does not comply with Section 502(e)(5) or (8) of the Gramm-Leach-Bliley Act (15 U.S.C. Sec. 6802(e)(5) or (8)) or with the Federal Right to Financial
Privacy Act of 1978 (18 U.S.C. Sec. 3401 et seq.).
(d) In deciding whether and how to cooperate, coordinate, jointly examine, consult, or share records and other information under subdivision (a), the department shall consider maximizing effectiveness and uniformity of regulation, examination, implementation, and enforcement for the benefit of residents and licensees and registrants and minimizing burdens on licensees and registrants without adversely affecting protection for residents.
3304.
(a) Except as otherwise provided in subdivision (b) or (c), information not contained in a report otherwise available to the public or reports obtained by the department from an applicant, licensee, or registrant, information contained in or related to an examination, investigation, or operating or condition report prepared by, on behalf of, or for the use of the department, and other financial and operating information, is not subject to disclosure under the California Public Records Act (Chapter 3.5 (commencing with Section 6250) of Division 7 of Title 1 of the Government Code). If the department determines the information or records are confidential under the open records law of a reciprocal-licensing state, the information or records may not be disclosed.(b) A trade secret of an applicant, a licensee, or a registrant is confidential and is not subject to disclosure under the California Public Records Act (Chapter 3.5 (commencing with Section 6250) of Division 7 of Title 1 of the Government Code). If the department determines a trade secret is confidential under the open records law of a reciprocal-licensing state, the trade secret shall not be disclosed.
(c) Subdivision (a) does not prohibit disclosure of the following:
(1) General information about a licensee’s or registrant’s virtual currency business activity with, or on behalf of, a resident.
(2) A list of persons licensed or registered under this division.
(3) Aggregated financial data
concerning licensees or registrants in this state.
3305.
(a) Each licensee and registrant shall file with the department a report of the following, as may be applicable:(1) A material change in information in the application for a license under this division or a registration or the most recent renewal report of the licensee under this division or for the registrant.
(2) A material change in the licensee’s or registrant’s business for the conduct of its virtual currency business activity with, or on behalf of, a resident.
(3) A change of an executive officer, responsible individual, or person in control of the licensee or registrant.
(b) Absent good cause, a report required by subdivision (a) shall be filed not later than 15 days after the change.
3306.
(a) For purposes of this section, “proposed person to be in control” means the person that would control a licensee or registrant after a proposed transaction that would result in a change in control of the licensee or registrant.(b) The following rules apply in determining whether a person has control over a licensee or registrant:
(1) There is a rebuttable presumption of control if the person’s voting power in the licensee or registrant constitutes or will constitute at least 25 percent of the total voting power of the licensee or registrant.
(2) There is a rebuttable presumption of control if the person’s voting
power in another person constitutes or will constitute at least 10 percent of the total voting power of the other person and the other person’s voting power in the licensee or registrant constitutes at least 25 percent of the total voting power of the licensee or registrant.
(3) There is no presumption of control solely because an individual is an executive officer of the licensee or registrant.
(c) At least 30 days before a proposed change in control of a licensee or registrant, the proposed person to be in control shall submit to the department in a record all of the following:
(1) An application in a form and medium prescribed by the department.
(2) The information and records that Section 3202 would require if the proposed person to be in control
already had control of the licensee.
(3) A license application under Section 3202 by the proposed person to be in control.
(4) In the case of a registrant, the information that Section 3207 would require if the proposed person to be in control already had control of the registrant.
(5) In the case of a registration, a registration under Section 3207 by the proposed person to be in control.
(d) The department, in accordance with Section 3202, shall approve, approve with conditions, or deny an application for a change in control of a licensee or registrant. The department, in a record, shall send notice of its decision to the licensee or registrant and the person that would be in control if the department had approved the change in control. If the
department denies the application, the licensee or registrant shall abandon the proposed change in control or cease virtual currency business activity with or on behalf of residents.
(e) If the department applies a condition to approval of a change in control of a licensee or registrant and the department does not receive notice of the applicant’s acceptance of the condition specified by the department not later than 31 days after the department sends notice of the condition, the application is deemed denied. If the application is deemed denied, the licensee or registrant shall abandon the proposed change in control or cease virtual currency business activity with, or on behalf of, residents.
(f) Submission in good faith of records required by subdivision (c) relieves the proposed person to be in control from any obligation imposed by this section other than subdivisions (d), (e),
and (h) until the department has acted on the application.
(g) The department may revoke or modify a determination under subdivision (d), after notice and opportunity to be heard, if, in its judgment, revocation or modification is consistent with this division.
(h) If a change in control of a licensee or registrant requires approval of an agency of this state or another state with which this state has a reciprocity agreement and the action of the other agency conflicts with that of the department, the department shall confer with the other agency. If the proposed change in control cannot be completed because the conflict cannot be resolved, the licensee or registrant shall abandon the change in control or cease virtual currency business activity with, or on behalf of, residents.
3307.
(a) At least 30 days before a proposed merger or consolidation of a licensee or registrant with another person, the licensee or registrant shall submit all of the following to the department in a record:(1) An application in a form and medium prescribed by the department.
(2) The plan of merger or consolidation in accordance with subdivision (e).
(3) In the case of a licensee, the information required by Section 3202 concerning the person that would be the surviving entity in the proposed merger or consolidation.
(4) In the case of a registrant, the
information required by Section 3207 concerning the person that would be the surviving entity in the proposed merger or consolidation.
(b) If a proposed merger or consolidation would change the control of a licensee or registrant, the licensee or registrant shall comply with Section 3306 and this section.
(c) The department, in accordance with Section 3202, shall approve, conditionally approve, or deny an application for approval of a merger or consolidation of a licensee or registrant. The department, in a record, shall send notice of its decision to the licensee or registrant and the person that would be the surviving entity. If the department denies the application, the licensee or registrant shall abandon the merger or consolidation or cease virtual currency business activity with, or on behalf of, residents.
(d) The department may revoke or modify a determination under subdivision (c), after notice and opportunity to be heard, if, in its judgment, revocation or modification is consistent with this division.
(e) A plan of merger or consolidation of a licensee or a registrant with another person shall do all of the following:
(1) Describe the effect of the proposed transaction on the licensee’s or registrant’s conduct of virtual currency business activity with, or on behalf of, residents.
(2) Identify each person to be merged or consolidated and the person that would be the surviving entity.
(3) Describe the terms and conditions of the merger or consolidation and the mode of carrying it into effect.
(f) If a merger or consolidation of a licensee or registrant and another person requires approval of an agency of this state or another state with which this state has a reciprocity agreement and the action of the other agency conflicts with that of the department, the department shall confer with the other agency. If the proposed merger or consolidation cannot be completed because the conflict cannot be resolved, the licensee or registrant shall abandon the merger or consolidation or cease virtual currency business activity with, or on behalf of, residents.
(g) The department may condition approval of an application under subdivision (a). If the department does not receive notice from the parties that the parties accept the department’s condition not later than 31 days after the department sends notice in a record of the condition, the application is deemed denied. If the application
is deemed denied, the licensee or registrant shall abandon the merger or consolidation or cease virtual currency business activity with, or on behalf of, residents.
(h) If a licensee or registrant acquires substantially all the assets of a person, whether or not the person’s license was approved by or registration was filed with the department, the transaction is subject to this section.
(i) Submission in good faith of the records required by subdivision (e) relieves the proposed surviving entity from any obligation imposed by this section, other than subdivisions (c), (f), and (g), until the department has acted on the application.
3401.
For the purpose of this chapter, “enforcement measure” means an action to:(1) Suspend or revoke a license or a registration under this division.
(2) Order a person to cease and desist from doing virtual currency business activity with, or on behalf of, a resident.
(3) Request the court to appoint a receiver for the assets of a person doing virtual currency business activity with, or on behalf of, a resident.
(4) Request the court to issue temporary, preliminary, or permanent injunctive relief against a person doing virtual currency business activity with, or on behalf of,
a resident.
(5) Assess a penalty under Section 3404.
(6) Recover on the security under Section 3204 and initiate a plan to distribute the proceeds for the benefit of a resident injured by a violation of this division, or law of this state other than this division, which applies to virtual currency business activity with, or on behalf of, a resident.
(7) Impose necessary or appropriate conditions on the conduct of virtual currency business activity with, or on behalf of, a resident.
3402.
(a) The department may take an enforcement measure against a licensee, registrant, or person that is neither a licensee nor registrant but is engaging in virtual currency business activity with, or on behalf of, a resident in any of the following instances:(1) The licensee, registrant, or person materially violates this division, a rule adopted or order issued under this division, or law of this state other than this division which applies to virtual currency business activity of the violator with, or on behalf of, a resident.
(2) The licensee, registrant, or person does not cooperate substantially with an examination or investigation by the department, fails to pay a fee, or
fails to submit a report or documentation.
(3) The licensee, registrant, or person, in the conduct of its virtual currency business activity with, or on behalf, of a resident, engages in any of the following:
(A) An unsafe or unsound act or practice.
(B) An unfair or deceptive act or practice.
(C) Fraud or intentional misrepresentation.
(D) Another dishonest act.
(E) Misappropriation of legal tender, virtual currency, or other value held by a fiduciary.
(4) An agency of the United States or another state takes an action against the licensee, registrant, or
person, which would constitute an enforcement measure if the department had taken the action.
(5) The licensee, registrant, or person is convicted of a crime related to its virtual currency business activity with, or on behalf of, a resident or involving fraud or felonious activity that, as determined by the department, makes the licensee, registrant, or person unsuitable to engage in virtual currency business activity.
(6) Any of the following occurs:
(A) The licensee, registrant, or person becomes insolvent.
(B) The licensee, registrant, or person makes a general assignment for the benefit of its creditors.
(C) The licensee, registrant, or person becomes the debtor, alleged debtor,
respondent, or person in a similar capacity in a case or other proceeding under any bankruptcy, reorganization, arrangement, readjustment, insolvency, receivership, dissolution, liquidation, or similar law, and does not obtain from the court, within a reasonable time, confirmation of a plan or dismissal of the case or proceeding.
(D) The licensee, registrant, or person applies for, or permits the appointment of, a receiver, trustee, or other agent of a court for itself or for a substantial part of its assets.
(7) The licensee, registrant, or person makes a material misrepresentation to the department.
(b) On application and for good cause, the department may extend the due date for filing a document or report under paragraph (2) of subdivision (a) or waive to the extent warranted by circumstances, such as a bona fide
error notwithstanding reasonable procedures designed to prevent error, an enforcement measure under subdivision (a), if the department determines that the waiver will not adversely affect the likelihood of compliance with this division.
(c) In an enforcement action related to operating without a license under this division or registration in this state, it is a defense to the action that the person has in effect a customer identification program reasonably designed to identify whether a customer is a resident, which failed to identify the particular customer as a resident.
(d) A proceeding under this division is subject to the Administrative Procedure Act, as defined in Section 11370 of the Government Code.
3403.
(a) Except as otherwise provided in subdivision (b), the department may take an enforcement measure only after notice and opportunity for a hearing appropriate in the circumstances.(b) The department may take an enforcement measure other than the imposition of a civil penalty under Section 3404:
(1) Without notice if the circumstances require action before notice can be given;
(2) After notice and without a prior hearing if the circumstances require action before a hearing can be held; or
(3) After notice and without a hearing if the person conducting
virtual currency business activity with, or on behalf of, a resident does not timely request a hearing.
(c) If the department takes action under paragraph (1) or (2) of subdivision (b), the person subject to the enforcement measure has the right to an expedited postaction hearing by the department unless the person has waived the hearing.
3404.
(a) If a person other than a licensee or registrant engages in virtual currency business activity with, or on behalf of, a resident in violation of this division, the department may assess a civil penalty against the person in an amount not to exceed fifty thousand dollars ($50,000) for each day of violation.(b) If a licensee or registrant materially violates a provision of this division, the department may assess a civil penalty in an amount not to exceed ten thousand dollars ($10,000) for each day of violation.
(c) A civil penalty under this section continues to accrue until the earlier of the date the violation ceases or a date specified by the
department.
3405.
(a) Revocation of a license under this division is effective against a licensee one day after the department sends notice in a record of the revocation to the licensee, by a means reasonably selected for the notice to be received by the recipient in one day, to the address provided for receiving communications from the department.(b) Suspension of a license under this division, suspension of a registration, or an order to cease and desist, is effective against a licensee, registrant, or other person one day after the department sends notice in a record of the suspension or order to the licensee, registrant, or other person, by a means reasonably selected for the notice to be received by the recipient in one day, to the address provided for
receiving communications from the department or, if no address is provided, to the recipient’s last known address. A suspension or order to cease and desist remains in effect until the earliest of the following:
(1) Entry of an order by the department under the Administrative Procedure Act, as defined in Section 11370 of the Government Code.
(2) Entry of a court order setting aside or limiting the suspension or order to cease and desist.
(3) A date specified by the department.
(c) If, without reason to know of the department’s notice sent under subdivision (a) or (b), a licensee, registrant, or other person does not comply in accordance with the notice until the notice is actually received at the address provided, the department may consider the delay
in compliance in imposing a sanction for the failure.
3406.
The department may enter into a consent order with a person regarding an enforcement measure. The order may provide that it does not constitute an admission of fact by a party.3407.
(a) Except as otherwise provided in this section, a person does not have a right of action for violation of this division.(b) The department may bring an action for restitution on behalf of a resident if the department proves economic injury due to a violation of this division.
(c) This section does not preclude an action by a resident to enforce rights under Chapter 7 (commencing with Section 8701) of Division 8 of the Commercial Code or law of this state other than this division.
CHAPTER
5. Disclosures and Protections
3501.
(a) A licensee or registrant shall provide to a resident who uses the licensee’s or registrant’s products or service the disclosures required by subdivision (b) and any additional disclosure the department by rule determines reasonably necessary for the protection of residents. The department shall determine by rule the time and form required for disclosure. A disclosure required by this section shall be made separately from any other information provided by the licensee or registrant and in a clear and conspicuous manner in a record the resident may keep. A licensee or registrant may propose for the department’s approval alternate disclosures as more appropriate for its virtual currency business activity with, or on behalf of, residents.(b) Before establishing a relationship with a resident, a licensee or registrant shall disclose, to the extent applicable to the virtual currency business activity the licensee or registrant will undertake with the resident all of the following:
(1) A schedule of fees and charges the licensee or registrant may assess, the manner by which fees and charges will be calculated if they are not set in advance and disclosed, and the timing of the fees and charges.
(2) Whether the product or service provided by the licensee or registrant is covered by either of the following:
(A) A form of insurance or is otherwise guaranteed against loss by an agency of the United States:
(i) Up to the full United States dollar equivalent of virtual currency
placed under the control of, or purchased from, the licensee or registrant as of the date of the placement or purchase, including the maximum amount provided by insurance under the Federal Deposit Insurance Corporation or otherwise available from the Securities Investor Protection Corporation.
(ii) If not provided at the full United States dollar equivalent of virtual currency placed under the control of or purchased from the licensee or registrant, the maximum amount of coverage for each resident expressed in the United States dollar equivalent of the virtual currency.
(B) Private insurance against theft or loss, including cybertheft or theft by other means.
(3) The irrevocability of a transfer or exchange and any exception to irrevocability.
(4) A
description of all of the following:
(A) Liability for an unauthorized, mistaken, or accidental transfer or exchange.
(B) The resident’s responsibility to provide notice to the licensee or registrant of the transfer or exchange.
(C) The basis for any recovery by the resident from the licensee or registrant.
(D) General error-resolution rights applicable to the transfer or exchange.
(E) The method for the resident to update the resident’s contact information with the licensee or registrant.
(5) That the date or time when the transfer or exchange is made and the resident’s account is debited may differ from the date or time
when the resident initiates the instruction to make the transfer or exchange.
(6) Whether the resident has a right to stop a preauthorized payment or revoke authorization for a transfer and the procedure to initiate a stop-payment order or revoke authorization for a subsequent transfer.
(7) The resident’s right to receive a receipt, trade ticket, or other evidence of the transfer or exchange.
(8) The resident’s right to at least 30 days’ prior notice of a change in the licensee’s or registrant’s fee schedule, other terms and conditions of operating its virtual currency business activity with the resident and the policies applicable to the resident’s account.
(9) That virtual currency is not legal tender.
(c) Except as otherwise provided in subdivision (d), at the conclusion of a virtual currency transaction with, or on behalf of, a resident, a licensee or registrant shall provide the resident a confirmation in a record which contains all of the following:
(1) The name and contact information of the licensee or registrant, including information the resident may need to ask a question or file a complaint.
(2) The type, value, date, precise time, and amount of the transaction.
(3) The fee charged for the transaction, including any charge for conversion of virtual currency to legal tender, bank credit, or other virtual currency.
(d) If a licensee or registrant discloses that it will provide a daily
confirmation in the initial disclosure under subdivision (c), the licensee or registrant may elect to provide a single, daily confirmation for all transactions with or on behalf of a resident on that day instead of a per transaction confirmation.
3502.
The Uniform Supplemental Commercial Law for the Uniform Regulation of Virtual Currency Businesses Act (Chapter 7 (commencing with Section 8701) of Division 8 of the Commercial Code) further govern property interests and entitlements to virtual currency.
CHAPTER
6. Policies and Procedures
3601.
(a) An applicant, before submitting an application, and registrant, before registering, shall create and, during licensure or registration, maintain in a record, policies and procedures for all of the following:(1) An information security program and an operational security program.
(2) A business continuity program.
(3) A disaster recovery program.
(4) An antifraud program.
(5) An antimoney laundering program.
(6) A
program to prevent funding of terrorist activity.
(7) A program designed to ensure compliance with this division, law of this state other than this division, and federal law, which are relevant to the virtual currency business activity contemplated by the licensee or registrant with, or on behalf of, residents and to assist the licensee or registrant in achieving the purposes of law of this state other than this division and federal law if violation of that law has a remedy under this division.
(b) Each policy required by subdivision (a) shall be in a record and designed to be adequate for a licensee’s or registrant’s contemplated virtual currency business activity with, or on behalf of, residents, considering the circumstances of all participants and the safe operation of the activity. Each policy and implementing procedure shall be compatible with other policies and the
procedures implementing them and not conflict with policies or procedures applicable to the licensee or registrant under law of this state other than this division. A policy and implementing procedure may be one in existence in the licensee’s or registrant’s virtual currency business activity with, or on behalf of, residents.
(c) A licensee’s or registrant’s policy for detecting fraud shall include:
(1) Identification and assessment of the material risks of its virtual currency business activity related to fraud.
(2) Protection against any material risk related to fraud identified by the department or the licensee or registrant.
(3) Periodic evaluation and revision of the antifraud procedure.
(d) A licensee’s or registrant’s policy for preventing money laundering and financing of terrorist activity shall include all of the following:
(1) Identification and assessment of the material risks of its virtual currency business activity related to money laundering and financing of terrorist activity.
(2) Procedures, in accordance with federal law or guidance published by federal agencies responsible for enforcing federal law, pertaining to money laundering and financing of terrorist activity.
(3) Filing reports under the Bank Secrecy Act (31 U.S.C. Sec. 5311 et seq.) or Part X of Title 31 of the Code of Federal Regulations, and other federal or state law pertaining to the prevention or detection of money laundering or financing of terrorist activity.
(e) A licensee’s or registrant’s information-security and operational-security policy shall include reasonable and appropriate administrative, physical, and technical safeguards to protect the confidentiality, integrity, and availability of any nonpublic personal information or virtual currency it receives, maintains, or transmits.
(f) A licensee or registrant is not required to file with the department a copy of a report it makes to a federal authority unless the department specifically requires filing.
(g) A licensee’s or registrant’s protection policy under subdivision (e) for residents shall include all of the following:
(1) Any action or system of records required to comply with this division and law of this state other than this division applicable to
the licensee or registrant with respect to virtual currency business activity with, or on behalf of, a resident
(2) A procedure for resolving disputes between the licensee or registrant and a resident.
(3) A procedure for a resident to report an unauthorized, mistaken, or accidental virtual currency business activity transaction.
(4) A procedure for a resident to file a complaint with the licensee or registrant and for the resolution of the complaint in a fair and timely manner with notice to the resident as soon as reasonably practical of the resolution and the reasons for the resolution.
(h) After the policies and procedures required under this section are created and approved by the department and the licensee or registrant, the licensee or
registrant shall engage a responsible individual with adequate authority and experience to monitor each policy and procedure, publicize it as appropriate, recommend changes as desirable, and enforce it.
(i) A licensee or registrant may request advice from the department as to compliance with this section and, with the department’s approval, outsource functions, other than compliance, required under this section.
(j) Failure of a particular policy or procedure adopted under this section to meet its goals in a particular instance is not a ground for liability of the licensee or registrant if the policy or procedure was created, implemented, and monitored properly. Repeated failures of a policy or procedure are evidence that the policy or procedure was not created or implemented properly.
(k) Policies and procedures
adopted under this section shall be disclosed separately from other disclosures made available to a resident, in a clear and conspicuous manner and in the medium through which the resident contacted the licensee or registrant.
3602.
(a) An applicant, before submitting its application, and a registrant, before registering, shall establish and maintain in a record a policy or procedure designed to ensure compliance with this division, and law of this state other than this division, if the other law is relevant to the virtual currency business activity contemplated by the licensee or registrant or the scope of this division or this division could assist in the purpose of the other law because violation of the other law has a remedy under this division.(b) A policy or procedure under subdivision (a) shall be compatible, and not conflict, with requirements applicable to a licensee or registrant under law of this state other than this division and under federal law and may be
a policy or procedure in existence for the licensee’s or registrant’s virtual currency business activity with, or on behalf of, a resident.
(c) After the policies and procedures required under this section are created by the licensee or registrant and approved by the department, the licensee or registrant shall engage a responsible individual with adequate authority and experience to monitor each policy or procedure, publicize it as appropriate, recommend changes as desirable, and enforce it.
(d) A licensee or registrant may request advice from the department as to compliance with this section and, with the department’s approval, outsource functions, other than compliance, required under this section.
(e) Failure of a particular policy or procedure adopted under this section to meet its goals in a particular instance
is not a ground for liability of the licensee or registrant if the policy or procedure was created, implemented, and monitored properly. Repeated failures of a policy or procedure are evidence that the policy or procedure was not created or implemented properly.