FIN §3505: (a) (1) Except as provided for under paragraph (2), a covered exchange, prior to listing or offering a digital financial asset that the covered exchange can exchange on behalf of a resident, shall cer

(a) (1) Except as provided for under paragraph (2), a covered exchange, prior to listing or offering a digital financial asset that the covered exchange can exchange on behalf of a resident, shall certify on a form provided by the department that the covered exchange has done the following: (A) Identified the likelihood that the digital financial asset would be deemed a security by federal or California regulators. (B) Provided, in writing, full and fair disclosure of all material facts relating to conflicts of interest that are associated with the covered exchange and the digital financial asset. (C) Conducted a comprehensive risk assessment designed to ensure consumers are adequately protected from cybersecurity risk, risk of malfeasance, including theft, risks related to code or protocol defects, or market-related risks, including price manipulation and fraud. (D) Established policies and procedures to reevaluate the appropriateness of the continued listing or offering of the digital financial asset, including an evaluation of whether material changes have occurred. (E) Established policies and procedures to cease listing or offering the digital financial asset, including notification to affected consumers and counterparties. (2) Certification by a covered exchange shall not be required for any digital financial asset approved for listing on or before January 1, 2023, by the New York Department of Financial Services pursuant to Part 200 of Title 23 of the New York Code of Rules and Regulations. (3) The department, after a finding that a covered exchange has listed or offered a digital financial asset without appropriate certification or after a finding that material misrepresentations were made in the certification process, shall require the covered exchange to cease offering or listing the digital financial asset and may assess the civil penalty of up to twenty thousand dollars ($20,000) per day the violation has occurred. (b) (1) A covered exchange shall make every effort to execute a resident’s request to exchange a digital financial asset that the covered exchange receives fully and promptly. (2) (A) A covered exchange shall use reasonable diligence to ensure that the outcome to the resident is as favorable as possible under prevailing market conditions. Compliance with this paragraph shall be determined by factors, including, but not limited to, all of the following: (i) The character of the market for the digital financial asset, including price and volatility. (ii) The size and type of transaction. (iii) The number of markets checked. (iv) Accessibility of appropriate pricing. (B) At least once every six months, a covered exchange shall review aggregated trading records of residents against benchmarks to determine execution quality, shall investigate the causes of any variance, and shall promptly take action to remedy issues identified in that review. (3) In a transaction for or with a resident, the covered exchange shall not interject a third party between the covered exchange and the best market for the digital financial asset in a manner inconsistent with this subdivision. (4) If a covered exchange cannot execute directly with a market and employs other means in order to ensure an execution advantageous to the resident, the burden of showing the acceptable circumstances for doing so is on the covered exchange. (c) For purposes of this section: (1) “Conflict of interest” means an interest that might incline a covered exchange or a natural person who is an associated person of a covered exchange to make a recommendation that is not disinterested. (2) “Covered exchange” means a covered person that exchanges or holds itself out as being able to exchange a digital financial asset for a resident. (d) Failure of a particular policy or procedure adopted under this section to meet its goals in a particular instance is not a ground for liability of the licensee if the policy or procedure was created, implemented, and monitored properly. Repeated failures of a policy or procedure are evidence that the policy or procedure was not created or implemented properly.