Crypto Firms Get Until May 2027 to Combat Influencer Fraud

The guidance builds on a 2015 ban on misleading crypto advertising and, for the first time, spells out what compliance looks like in practice. The timing is not subtle. In June, the U.S. Federal Trade Commission reported that Americans lost $3.5 billion to imposter scams in 2025, with about $1 billion of that coming from scammers posing as businesses and banks. Social media alone accounted for more than $2.1 billion. Crypto, where fake exchange representatives and spoofed brands have drained accounts for years, is an obvious target.

Influencers and impostors now land on the firm’s desk

NYDFS expects firms to back up their advertising claims and to clearly name the regulated entity behind every ad. It also wants a documented process for creating, reviewing, and approving marketing. That process has to include:

• Due diligence on third parties, including influencers and outside marketing partners
• Monitoring for misuse of the firm’s brand
• An annual review of marketing policies
• Third-party checks

Crypto marketing leans heavily on outside partners, and this guidance pushes responsibility for those partners back onto the licensed firm. In practice, every claim must be defensible, every ad attributed, and every influencer vetted before a single post goes live. That takes staff time and money, which makes compliance an ongoing operating cost rather than a one-off checkbox.

No new prohibition, but a clock and a track record

The guidance does not create a new rule. The underlying regulation, 23 NYCRR § 200.18, has barred misleading representations in covered advertising since 2015. What changes is visibility and accountability. The annual reviews and DFS compliance checks will show how seriously the regulator intends to apply these expectations, and the first real test comes after the May 2027 deadline passes.

New York has shown it will back its rules with penalties. In 2023, NYDFS imposed a $50 million penalty on Coinbase over deficiencies in its compliance program, along with additional remediation obligations. That enforcement history signals New York will use teeth if firms drag their feet. VCEs have roughly six months between issuance and the deadline, and those that treat this as a paperwork exercise rather than an operational change risk becoming the next enforcement case.

Hashlytics Take

Holding firms responsible for the influencers they pay is the easy part, since that relationship is a contract the firm controls. Holding them responsible for impostors is harder, because a fake account using a licensed exchange’s name is not something the exchange hired. The guidance’s brand-misuse monitoring requirement is where the real compliance burden sits, and it is also the part regulators will find hardest to measure. Expect the first enforcement conversations after May 2027 to focus less on what firms promised and more on what evidence they kept showing they were watching.