Lowenstein Crypto advises leading digital asset and cryptocurrency projects, exchanges, and trading firms. Our practice covers regulatory advice, transactions and structuring advice, investigations, and adversarial matters including commercial disputes, bankruptcy, and related litigation. As these markets continue their rapid growth and market participants continue to evolve and mature their businesses, we are providing this weekly digest as a resource that highlights and summarizes a selection of key recent legal regulatory developments.

New York DFS Issues New Cybersecurity Guidance on Risk Assessments for Financial Services Entities

On September 10, the New York Department of Financial Services (NYDFS) issued new cybersecurity guidance clarifying NYDFS’ expectations for how regulated financial services entities (including BitLicense holders) should design, conduct, and update the risk assessments that underpin their cybersecurity programs. The guidance identifies common deficiencies NYDFS has observed during examinations, including incomplete asset inventories, weak or inconsistent risk methodologies, failure to account for emerging threats and concentration risk, insufficient governance and documentation, and a disconnect between risk assessment results and actual cybersecurity controls. To address these gaps, NYDFS outlines best practices across five areas: (1) governance and cross-functional oversight; (2) adoption of a defined, repeatable methodology for identifying, analyzing, and prioritizing cyber risks; (3) comprehensive scoping that covers all assets, third-party and supply chain dependencies, emerging technologies such as AI and quantum computing, and concentration risk from shared infrastructure; (4) thorough documentation and traceability linking identified risks to specific controls, compensating measures, and risk-acceptance decisions; and (5) integration of risk assessments into the broader cybersecurity program, with updates at least annually and whenever material changes in business, technology, or the threat landscape occur. See the press release here and the guidance here.

FinCEN Identifies Nearly $13B Linked to Crypto Scams

On September 3, the U.S. Department of the Treasury’s Financial Crimes Enforcement Network (FinCEN) published a study and an alert to financial institutions in connection with its findings related to the rise in crypto scams operated by overseas scam centers. FinCEN’s analysis identified over 33,900 Bank Secrecy Act reports filed between September 2023 and December 2025, identifying approximately $12.7 billion in financial activity linked to suspected digital asset investment scams. FinCEN found that these scams are largely operated by transnational criminal organizations based in Southeast Asia and involve sophisticated tactics including guarantee marketplaces, professional money launderers, shell companies, money mules, and stablecoin transfers through DeFi protocols to exchanges outside the United States. The alert identifies specific red flags and encourages institutions to participate in voluntary Section 314(b) information sharing to support law enforcement investigations and victim recovery. See the press release here and the alert here. 

Block, Inc. Announces Submission of National Trust Bank Application

On September 8, Block, Inc. announced that it has submitted an application to the Office of the Comptroller of the Currency (OCC) to establish Builders Bank & Trust, N.A. (Builders Bank). Builders Bank seeks to operate as a federally regulated national trust bank under OCC supervision. The application follows the OCC’s August press release that stated that the OCC has been working to encourage de novo chartering, an initiative that has seen over 40 de novo applications in the past 18 months. If approved, Builders Bank’s charter would provide a federal regulatory framework for certain custody activities Block, Inc., already provides. Unlike traditional banks, Builders Bank would not accept deposits or make loans and would instead focus on custody and fiduciary services, including for bitcoin and stablecoins. See the company’s press release here.

Crypto Advocacy Groups Seek Preliminary Injunction Over Illinois Crypto Tax 

On September 8, the Blockchain Association and the Crypto Council for Innovation filed a memorandum of law in support of a preliminary injunction in the Circuit Court of Sangamon County, Illinois, seeking to block enforcement of the Illinois Digital Asset Tax Act (Act) before it takes effect on January 1, 2027. The Act imposes a 0.2 percent tax on the full value of digital assets each time a customer exchanges, transfers, or stores them through a digital-asset broker, even absent any sale, gain, or change in ownership, and subjects brokers to registration, collection, and recordkeeping requirements backed by Class 3 felony penalties. The Blockchain Association and the Crypto Council for Innovation argue that the Act is preempted by the federal Internet Tax Freedom Act because it singles out digital-asset transactions for taxation while leaving analogous transactions in traditional financial assets (cash, gold, stocks, and bonds) untaxed, that it violates the dormant commerce clause by exposing interstate users to double taxation without a credit mechanism and measuring the tax on the full asset value rather than the broker’s in-state fee, and that it is unconstitutionally vague given its circular definitions, unclear sourcing rules, and indeterminate treatment of bundled activities. See the filed memorandum of law in support here.

Australia’s AUSTRAC Removes 45 Crypto and Remittance Registrations

On September 7, the Australian Transaction Reports and Analysis Centre (AUSTRAC) published a notification announcing that during the past year, it has canceled, suspended, or refused to renew registrations for 45 remittance and virtual asset service providers (VASPs). AUSTRAC’s decision to remove the select VASPs from its registrar was based on, in part, whether the VASPs lacked the operational capacity to engage in the regulated activities for which they were registered, were dormant or insolvent, did not notify AUSTRAC of material changes, or otherwise involved significant money laundering or terrorism financing risk. AUSTRAC’s publication also notes that the agency is actively identifying and removing businesses that do not meet its regulatory standards and requirements, sending a message to industry participants to ensure compliance with applicable law, regulations, and rules. See the notification here.