The NYDFS ordered BitFlyer USA to pay a $1.2 million penalty after finding "multiple deficiencies" in its cybersecurity program.