In May 2019, the Financial Crime Enforcement Network (FinCEN) issued a thirty-page comprehensive review of its regulations as pertains to convertible virtual currencies. Previously, in February 2018, FinCEN stated that it expects issuers of initial coin offerings (ICOs) to comply with the Bank Secrecy Act (BSA), including its anti-money laundering (AML) and know your customer (KYC) requirements (see HERE).

In general, entities that are subject to the BSA must: (i) register with FinCEN as a money services business (MSB); (ii) prepare a written AML compliance program that is designed to mitigate risks, including AML risks, and to ensure compliance with all BSA requirements including the filing of suspicious activity reports (SAR) and currency transaction reports; (iii) keep records for certain types of transactions at specific thresholds; and (iv) obtain customer identification information sufficient to comply with the AML program and recordkeeping requirements.

Although the new guidance does not establish any new regulatory requirements, it is the first time these requirements have been published in a single comprehensive source, and serves as a reminder of the emphasis on anti-money laundering by this regulatory.

Money Transmitters/the Business of Convertible Virtual Currencies (CVC)

Whether a business is a money transmitter (MSB) and thus has an obligation to comply with the BSA and its ensuing AML, registration, SAR and other requirements depends on the nature of the financial activity and a facts-and-circumstances analysis. FinCEN takes a substance-over-form approach, determining whether a business is a MSB regardless of the label or title of the business and regardless of other aspects or divisions of a business that may not be under their regulatory purview. The facts-and-circumstances analysis stems around the specific definitions of a MSB and its subparts.

The term “virtual currency” refers to a medium of exchange that can operate like currency but does not have all the attributes of “real” currency, as defined in federal statutes, including legal tender status but is a type of “value that substitutes for currency.” Such virtual currency is considered a convertible virtual currency or CVC.

Virtual currency exchangers and administrators have been subject to the BSA’s money transmitter requirements since 2011 when FinCEN issued a final rule defining a MSB as “a person [defined to include just about any individual, entity or group] wherever located doing business, whether or not on a regular basis or as an organized or licensed business concern, wholly or in substantial part within the United States,” operating directly, or through an agent, agency, branch, or office, who functions as, among other things, a “money transmitter.” “Money transmitter” is defined as a “person that provides money transmission services,” or “any other person engaged in the transfer of funds.” “Money transmission services” are defined as “the acceptance of currency, funds, or other value that substitutes for currency from one person and the transmission of currency, funds, or other value that substitutes for currency to another location or person by any means.”

To avoid doubt in 2013 FinCEN issued specific guidance related to persons administering, exchanging or using virtual currencies that explicitly stated that virtual currency exchangers and administrators are money transmitters that must comply with the BSA. That is, a business that sells ICO coins or tokens, accepts and transmits currency, funds, or value that substitutes for currency or exchanges them for other virtual currency, fiat currency or other value that substitutes for currency, is a money transmitter that is subject to the BSA.

As noted, FinCEN considers substance and not the label applied to a particular virtual currency, especially in this era of constantly changing labels (digital currency, tokens, cryptocurrency, crypto asset, digital asset, etc.). Similarly, as money transmission involves the acceptance and transmission of value that substitutes for currency by any means, transactions denominated in CVC will be subject to FinCEN regulations regardless of whether the CVC is represented by a physical or digital token, whether the type of ledger used to record the transactions is centralized or distributed, or the type of technology utilized for the transmission of value. Likewise, the definition is equally as broad on the business operations, including full and part time, manual or software based, profit and non-profit, etc.

There are some exemptions from the definition of a money transmitter such as persons that only provide network access or physically deliver currency or other monetary instruments. All exemptions are strictly construed.

Note that not all businesses regulated by FinCEN and subject to the BSA must register as a MSB. For example, banks and SEC and CFTC registered entities must comply with the BSA but do not need to register as a MSB with FinCEN (see HERE).

BSA Obligations of Money Transmitters Involving CVC

Entities that accept or transmit CVC are subject to the BSA and must: (i) register with FinCEN as a money services business (MSB) within 180 days of starting to engage in business; (ii) develop, implement and maintain a written AML compliance program that is designed to mitigate risks, including AML risks, and to ensure compliance with all BSA requirements including the filing of suspicious activity reports (SAR) and currency transaction reports; (iii) keep records for certain types of transactions at specific thresholds; and (iv) obtain customer identification information sufficient to comply with the AML program and recordkeeping requirements.

The FinCEN guidance clarifies that the method of obtaining virtual currency (earning, harvesting, mining, creating, auto-generating, purchasing, etc.) is not dispositive as to whether the person is a MSB. Rather, the substance of whether the person is an administrator or exchanger based on the definitions must be applied. Exchangers are subject to the same obligations under FinCEN regulations regardless of whether the exchangers are directly brokering the transactions between two or more persons, or whether the exchangers are parties to the transactions using their own reserves, in either CVC or real currency.

At a minimum an AML program must (i) incorporate policies, procedures and internal controls reasonably designed to assure ongoing compliance (including verifying customer identification, filing reports, creating and retaining records, and responding to law enforcement requests); (ii) designate an individual responsible to assure day-to-day compliance with the program and BSA requirements; (iii) provide training for appropriate personnel, including training in the detection of suspicious transactions; and (iv) provide for independent review to monitor and maintain an adequate program.

An MSB must undergo a risk assessment of its business including the risk that its particular business could be used for money laundering, terrorism financing and financial crimes. A risk assessment includes consideration of the composition of its customer base, the geographies served, and the financial products and services offered. Obviously, as part of examining a customer base, the MSB must “know your customer” (“KYC”).

In addition to AML rules, an MSB must comply with various other related rules including the “Funds Transfer Rule” and “Funds Travel Rule.” Transactions involving CVC generally necessitate compliance with the Funds Travel Rule, which requires that both the transmitter and recipient of funds of $3,000 or more, or the equivalent in CVC, obtain certain regulatory information.

The rules and regulations apply equally to domestic and foreign-located CVC money transmitters doing business in whole or in substantial part within the United States, even if the foreign-located entity has no physical presence in the United States.

The reach of FinCEN for people and entities engaged in CVC money transmission is wide. The FinCEN guidance gives examples of different businesses that would be considered an MSB and subject to the associated rules and regulations.

Initial Cryptocurrency Offerings (ICOs)

Whether an initial coin offering (ICO) is a money transmitter and thus must register as a MSB depends on the facts and circumstances. In the circumstance where an ICO is sold to a distinct set of buyers in exchange for another type of value (fiat currency or other CVC), the ICO seller is a MSB and must register as such. However, where a SAFT, debt instrument, securities token or other equity or debt instrument is sold and a CVC is included, it is not as clear-cut.

Whether a person involved in an ICO through selling an equity stake or a debt instrument to early backers or through hedging a previous investment qualifies as a MSB requires an analysis under FinCEN regulations and rulings. Persons may be exempt from MSB status in two situations. First, FinCEN regulations expressly exempt (i) banks; or (ii) a person registered with, and functionally regulated or examined by, the SEC or CFTC, or a foreign financial agency, from the definition of a MSB. In effect, these entities are required to have AML procedures under FinCEN regulations governing those types of financial entities. Second is whether they fit into another exemption, such as when the acceptance and transmission of value is only integral to the sale of goods or services different from money transmission. Investors in ICOs generally fall within this exemption.

The development of a decentralized app (see discussion below on DApps) financed through an ICO fundraising is outside the definition of money transmission. The developer of a DApp is not a money transmitter merely by creating the app, even if the purpose of the DApp is to issue a CVC or otherwise facilitate financial activities denominated in CVC. However, if the developer of the DApp uses or deploys it to engage in money transmission, then the developer will qualify as a MSB.

Natural Person Providing CVC Money Transmission

FinCEN’s definition of an MSB includes both natural and legal persons engaged as a business in covered activities, whether or not on a regular basis or as an organized business concern. For example, peer-to-peer (P2P) exchangers are typically natural persons (i.e., not an entity) engaged in the business of buying and selling CVCs. P2P exchangers generally advertise and market their services through classified ads, specifically designed platform websites, online forums, other social media, and word of mouth. P2P exchangers facilitate transfers from one type of CVC to a different type of CVC, as well as exchanges between CVC and other types of value such as payment products denominated in real currency. P2P exchangers may provide their services online or may arrange to meet prospective customers in person to purchase or sell CVC. A natural person operating as a P2P exchanger that engages in money transmission services involving real currency or CVCs must comply with BSA regulations as a money transmitter acting as principal. This is so regardless of the regularity or formality of such transactions or the location from which the person is operating. P2P exchangers are required to comply with the BSA obligations that apply to money transmitters, including registering with FinCEN as an MSB and complying with AML program, recordkeeping, and reporting requirements.

CVC Wallets

CVC wallets are interfaces for storing and transferring CVCs. There are different wallet types that vary according to the technology employed, where and how the value is stored, and who controls access to the value. Current examples of different types of CVC wallets that vary by technology employed are mobile wallets, software wallets, and hardware wallets. The regulatory interpretation of the BSA obligations of persons that act as intermediaries between the owner of the value and the value itself is not technology dependent. The regulatory treatment of such intermediaries depends on four criteria: (i) who owns the value; (ii) where the value is stored; (iii) whether the owner interacts directly with the payment system where the CVC runs; and (iv) whether the person acting as intermediary has total independent control over the value.

Hosted wallet providers are account-based money transmitters that receive, store, and transmit CVCs on behalf of their accountholders, generally interacting with them through websites or mobile applications. That is, the money transmitter is the host, the account is the wallet and the accountholder is the wallet owner. Under the four criteria, (i) the account holder is the owner; (ii) the value is stored in the wallet or on the host server; (iii) the owner interacts directly with the host; and (iv) the host has total independent control over the value (although it is contractually obligated to access the value only on instructions from the owner). Hosts must register as a MSB and comply with the BSA.

Unhosted wallets are software hosted on a person’s computer, phone, or other device that allow the person to store and conduct transactions in CVC. Unhosted wallets do not require an additional third party to conduct transactions. As long as a person is using an unhosted wallet on their own behalf, they are not a MSB.

Multiple-signature wallet providers are entities that facilitate the creation of wallets specifically for CVC that, for enhanced security, require more than one private key for the wallet owner(s) to effect transactions. If the multiple-signature wallet provider restricts its role to creating unhosted wallets that require adding a second authorization key to the wallet owner’s private key in order to validate and complete transactions, the provider is not a MSB because it does not accept and transmit value. If the person combines the services of a multiple-signature wallet provider and a hosted wallet provider, that person will then qualify as a money transmitter. Likewise, if the value is represented as an entry in the accounts of the provider, the owner does not interact with the payment system directly, or the provider maintains total independent control of the value, the provider will also qualify as a money transmitter, regardless of the label the person applies to itself or its activities.

CVC ATMs or Kiosks

CVC kiosks (commonly called “CVC automated teller machines (ATMs)” or “CVC vending machines”) are electronic terminals that act as mechanical agencies of the owner-operator, to enable the owner-operator to facilitate the exchange of CVC for currency or other CVC. Most owners or operators of CVC ATMs are MSBs. However, if the ATM only links an account holder with their account at a regulated depository institution solely to verify balances and dispense currency, it would not be a MSB.

Decentralized Apps

Decentralized applications (DApp) is a term that refers to software programs that operate on a P2P network of computers running a blockchain platform designed such that they are not controlled by a single person or group of persons. DApp users must pay a fee for its use which is often paid in CVC. The same regulatory interpretation that applies to mechanical agencies such as CVC kiosks applies to DApps that accept and transmit value, regardless of whether they operate for profit. Accordingly, when DApps perform money transmission, the definition of money transmitter will apply to the DApp, the owners/operators of the DApp, or both.

Anonymous CVC Transaction

Anonymous CVC transactions have added elements to conceal information or prevent the tracing of the CVC through a public ledger. The same analysis applies in this case as to all other money transmission transactions. A money transmitter cannot avoid its regulatory obligations because it chooses to provide money transmission services using anonymity-enhanced CVC. FinCEN provides some specific examples; for instance, (i) a person operating as the administrator of a centralized CVC payment system will become a money transmitter the moment that person issues anonymity enhanced CVC against the receipt of another type of value; (ii) a person that uses anonymity-enhanced CVCs to pay for goods or services on his or her own behalf would not be a money transmitter; (iii) a person that uses anonymity-enhanced CVCs to accept and transmit value from one person to another person or location will be a MSB; and (iv) a person that develops a decentralized CVC payment system will become a money transmitter if that person also engages as a business in the acceptance and transmission of value denominated in the CVC it developed. A mere provider of software used to anonymize money transmission would not be a MSB.

Payment Processing Services Involving CVC Money Transmission

CVC payment processors are financial intermediaries that enable traditional merchants to accept CVC from customers in exchange for goods and services sold. CVC payment processors are MSBs.

CVC Money Transmission Performed by Internet Casinos

Internet casinos are virtual platforms created for betting on the possible outcome of events related to a number of gaming models, but accepting deposits and bets and issuing payouts denominated in CVC. Internet casinos operating with CVC are MSBs.

Business Models Exempt from the Definition of a MSB

Under FinCEN regulations, a person is exempt from money transmitter status if the person only provides the delivery, communication, or network access services used by a money transmitter to support money transmission services. If a CVC trading platform only provides a forum where buyers and sellers of CVC post their bids and offers and the parties themselves settle any matched transactions through an outside venue the trading platform does not qualify as a money transmitter under FinCEN regulations.

Further Reading on DLT/Blockchain and ICOs

For a review of the 2014 case against BTC Trading Corp. for acting as an unlicensed broker-dealer for operating a bitcoin trading platform, see HERE.

For an introduction on distributed ledger technology, including a summary of FINRA’s Report on Distributed Ledger Technology and Implication of Blockchain for the Securities Industry, see HERE.

For a discussion on the Section 21(a) Report on the DAO investigation, statements by the Divisions of Corporation Finance and Enforcement related to the investigative report and the SEC’s Investor Bulletin on ICOs, see HERE.

For a summary of SEC Chief Accountant Wesley R. Bricker’s statements on ICOs and accounting implications, see HERE.

For an update on state-distributed ledger technology and blockchain regulations, see HERE.

For a summary of the SEC and NASAA statements on ICOs and updates on enforcement proceedings as of January 2018, HERE

For a summary of the SEC and CFTC joint statements on cryptocurrencies, including The Wall Street Journal op-ed article and information on the International Organization of Securities Commissions statement and warning on ICOs, see HERE.

For a review of the CFTC’s role and position on cryptocurrencies, see HERE.

For a summary of the SEC and CFTC testimony to the United States Senate Committee on Banking Housing and Urban Affairs hearing on “Virtual Currencies: The Oversight Role of the U.S. Securities and Exchange Commission and the U.S. Commodity Futures Trading Commission,” see HERE.

To learn about SAFTs and the issues with the SAFT investment structure, see HERE.

To learn about the SEC’s position and concerns with crypto-related funds and ETFs, see HERE.

For more information on the SEC’s statements on online trading platforms for cryptocurrencies and more thoughts on the uncertainty and the need for even further guidance in this space, see HERE.

For a discussion of William Hinman’s speech related to ether and bitcoin and guidance in cryptocurrencies in general, see HERE.

For a review of FinCEN’s role in cryptocurrency offerings and money transmitter businesses, see HERE.

For a review of Wyoming’s blockchain legislation, see HERE.

For a review of FINRA’s request for public comment on FinTech in general and blockchain, see HERE.

For my three-part case study on securities tokens, including a discussion of bounty programs and dividend or airdrop offerings, see HERE; HERE and HERE.

For a summary of three recent speeches by SEC Commissioner Hester Peirce, including her views on crypto and blockchain, and the SEC’s denial of a crypto-related fund or ETF, see HERE.

For a review of SEC enforcement-driven guidance on digital asset issuances and trading, see HERE.

For information on the SEC’s FinTech hub, see HERE.

For the SEC’s most recent analysis matrix for digital assets and application of the Howey Test, see HERE.