Second Post in a Two-Part Series

Some Answers — Producing Even More Questions

On May 9, 2019, the Financial Crimes Enforcement Network (“FinCEN”) published a comprehensive “interpretive guidance” (the “Guidance”) to “remind” businesses and individuals operating in a subset of the cryptocurrency markets involving “convertible virtual currencies” (“CVCs”) of the potential applicability of the Bank Secrecy Act (“BSA”) to their operations. At the outset, FinCEN explains that “[t]his guidance does not establish any new regulatory expectations or requirements.” Instead, “it consolidates current FinCEN regulations, and related administrative rulings and guidance issued since 2011” and provides illustrations of those regulations, rulings and guidance to common business models involving CVCs.

The principal purposes of the Guidance are threefold: (1) to set forth relevant FinCEN rules and requirements in a single source; (2) to demonstrate how the BSA may and does apply to innovations in the CVC markets occurring since 2011; and (3) to illustrate how these rules and requirements will be applied to future innovations in the CVC markets.

In our first post in this series, posted on the day that FinCEN issued the Guidance, we addressed recent major developments across a spectrum of regulatory, civil, and criminal enforcement cases involving cryptocurrencies, AML and money laundering – courtesy of the combined efforts of FinCEN, the New York Department of Financial Services, and the U.S. Department of Justice.  These enforcement cases underscored the need for more clear rules regarding how the BSA and other statutes can apply to cryptocurrencies.  The Guidance attempts to do just that, with partial success. It presents as a treatise on FinCEN regulation of CVCs, organized to:

• provide definitions of key relevant concepts;
• outline and explain current FinCEN regulations, ruling and guidance;
• summarize the development and content of FinCEN’s money transmission regulations to CVCs and CVC businesses;
• provide illustrations of “FinCEN’s existing regulatory approach to current and emerging business models using patterns of activities involving CVC”; and
• localize resources to further explain applicable FinCEN rules and regulations.

The Guidance, although not exactly offering anything new, still contains a lot to unpack. It provides some significant clarity to application of FinCEN’s rules and regulations to CVC businesses and a thorough resource to address many questions involving FinCEN regulation of CVC. But, at the same time, and somewhat paradoxically, in its comprehensiveness, it reveals how almost limitless possibilities exist for individuals and entities to transact in CVC and how difficult questions of whether those activities will be regulated by FinCEN can be to answer.

What Does the Guidance Apply To?

Although the Guidance sets forth various relevant definitions from the BSA and implementing regulations, two key concepts serve as its foundation – and the foundation of FinCEN’s regulation of cryptocurrency. First, the Guidance implicates only CVCs – defined as “money transmission[s] denominated in value that substitutes for currency.” FinCEN’s asserted authority to regulate CVCs derives from the Final Rule it published in 2011 updating its authority to regulate “money services businesses” (“MSBs”) – persons or entities operating as “money transmitters.” “Money Transmitters,” in turn, are persons “that provide money transmission services” or “any person engaged in the transfer of funds.” And, “Money Transmission Services” involve “the acceptance of currency, funds, or other value that substitutes for currency from one person and the transmission of currency, funds, or other value that substitutes for currency to another location or person by any means.” Thus, the Guidance does not directly implicate types of virtual currency that more closely resemble securities – regulated by the Securities and Exchange Commission (“SEC”) – or commodities – regulated by the Commodity Futures Trading Commission (“CFTC”). Of course, that does not necessarily mean the BSA does not apply to such virtual currencies; it does means you choose your regulator based on the functionality of your virtual currency.

Second, application of the Guidance to a CVC enterprise will depend on the “business model” of the operation. As FinCEN reminds, “[w]hether a person is a money transmitter under FinCEN’s regulations is a matter of facts and circumstances.” As relevant in the context of the Guidance, “‘business model’ refers to the subset of key facts and circumstances relevant to FinCEN’s determination of (a) whether the specific person meets the definition of a particular type of financial institution and (b) what regulatory obligations are associated with the specific activities performed within the business model.” In other words – function is elevated over form; to FinCEN (as with the SEC and CFTC), it doesn’t matter who you are or how you describe your virtual currency or business, it only matters what you do with it. Accordingly, “differences in similar business models may lead to different regulatory applications” or “a person who is engaged in more than that one type of business model at the same time may be subject to more than one type of regulatory obligation or exemption.” For instance, the developer of a CVC platform may be exempt from BSA obligations but also might become subject to the BSA if he or she uses that platform to transmit CVC.

What Are the Relevant Regulations?

Repeatedly, the Guidance makes clear that “whether a person [corporations are legal “people”] qualifies as an MSB subject to BSA regulation depends on the person’s activities and not its formal business status.” Therefore the following factors are not dispositive as to BSA applicability: “whether the person is (a) a natural person or legal entity; (b) is licensed as a business by any state; (c) has employees or other natural persons acting as agents; (d) operates at a brick-and-mortar branch, or through mechanical or software agents or agencies; or (e) is a for profit or nonprofit service.” Instead, a person “qualifies as a money transmitter if that person’s activities include receiving one form of value (currency, funds, prepaid value, value that substitutes for currency – such as CVC, etc.) from one person and transmitting either the same or different form of value to another person or location, by any means.” And this definition holds whether a person operates on only a transactional basis – one-off transactions – or on an account basis – where the transactor is an established customer of the transmitter. Importantly, the Guidance reminds that all centralized exchanges engage in money transmission: “if a person operates a platform that facilitates the conditional exchange of value between two parties – such as the exchange of CVC against currency only when an agreed upon exchange rate and amount is met – such person will be engaged in money transmission every time” the conditions are met and the reciprocal transfer occurs.

Thus, if a person meets this standard and does not fall within a “strictly” interpreted exemption, such as for platform providers, intermediaries between BSA regulated institutions, physical transportation of currency (i.e. armored cars), or providers of prepaid access, he, she or it will be subject to the BSA and will have to meet numerous and significant obligations. Those include developing and maintaining effective anti-money laundering (“AML”) programs; conducting thorough risk assessments; registration with FinCEN; recordkeeping, reporting, and transaction monitoring obligations; and potential compliance with the “Funds Transfer Rule” and “Funds Travel Rule.”

How Does This Work?

The majority of the Guidance is dedicated to illustrating the application of the BSA to various business models involving the transmission of CVC.

Peer-to-Peer (“P2P”) Exchanges

P2P exchanges are decentralized exchanges operated and maintained by software that typically involve natural persons engaged in buying and selling CVCs. P2P could involve transferring one type of CVC for a different type of CVC or exchanging CVC for other types of value (like fiat). Unless a P2P exchanger is “a natural person engaging in such activity on an infrequent basis and not for profit or gain” such person who “engages in money transmission services involving real currency or CVCs must comply with BSA regulations as a money transmitter.”

CVC Wallets

According to FinCEN, “CVC wallets are interfaces for storing and transferring CVCs.” The guidance distinguishes between “hosted wallets” and “unhosted wallets” and provides that the regulatory treatment of either depends on a four-factor test: “(a) who owns the value; (b) where the value is stored; (c) whether the owner interacts directly with the payment system where the CVC runs; and (d) whether the person acting as intermediary has total independent control over the value.”

Hosted wallet providers are “account-based money transmitters that receive, store and transmit CVCs on behalf of their accountholders, generally interacting with them through websites or mobile applications.” Coinbase is an example of a hosted wallet provider where it acts as the host, the “account” is the wallet, and the “account holder” is the wallet owner. In this model, the value of the CVC belongs to the owner, it may be stored in the wallet or represented as an entry in the account of the host, the owner interacts directly with the host, and the host has total independent control over the value. The hosted wallet provider is a money service business that must comply with the BSA.

Unhosted wallets, on the other hand, “are software hosted on a person’s computer, phone or other device that allow the person to store and conduct transactions in CVC.” In these cases, the value is the property of the owner and is stored in a wallet and the owner interacts directly with payment systems and maintains total independent control over the value. “In so far as the person conducting a transaction through the unhosted wallet is doing so to purchase goods or services on the user’s own behalf, they are not a money transmitter.”

The Guidance also addresses multiple-signature wallets – “entities that facilitate the creation of wallets specifically for CVC that, for enhanced security, require more than one private key for the wallet owner(s) to effect transactions.” Application of the BSA to multiple-signature wallets depends on whether the wallet is custodial or non-custodial. If the wallet is unhosted, “the provider is not a money transmitter because it does not accept and transmit value.” If it is hosted, the provider will qualify as a money transmitter.

CVC Kiosks

CVC Kiosks or ATMs facilitate the exchange of CVC by either connecting a user to a separate exchange or to draw upon the user’s CVC in the possession of the owner-operator of the terminal or kiosk. If the owner-operator of a CVC kiosk accepts currency from a user and transmits the equivalent value in CVC, it qualifies as a money transmitter. If, on the other hand, the CVC kiosk links an accountholder with his or her account at a regulated depository institution solely to verify account balances or dispense currency, such kiosks are not considered money transmitters.

Decentralized Applications (“DApps”)

A DApp refers to software operating on a P2P network of computers operating a blockchain platform rather than a single computer. Generally, DApp users pay a fee in order to run a software and that fee is paid in CVC. According to FinCEN, “[t]he same regulatory interpretation that applies to mechanical agencies such as CVC kiosks applies to DApps that accept and transmit value, regardless of whether they operate for profit.” Thus, where the DApp performs money transmission, it will be subject to the BSA.

Anonymity-Enhanced CVC Transactions

Anonymity-Enhanced CVC – privacy coins – are CVCs that hide data about its user. Transactions involving privacy coins are either “(a) denominated in regular types of CVC, but structured to conceal the information otherwise generally available through the CVC’s native distributed public ledger; or (b) denominated in types of CVC specifically engineered to prevent their tracing through distributed public ledgers.” Transmitters of privacy coin are “subject to the same regulatory obligations as wen operating in currency, funds, or non-anonymized CVCs.”

Providers of Anonymizing Services

Similarly, people who accept CVCs and retransmit them in a manner designed to prvent others from tracing the transmission back to its source – “mixers” or “tumblers” – are money transmitters under FinCEN regulations. This is so because, according to FinCEN, anonymizing a CVC is not sufficiently separate from the funds transmission itself. Thus an anonymizer is engaged in the business of offering secure money transmission.

On the other hand, an anonymizing software provider is not a money transmitter because they merely provide the tools for transmitting money and are not involved in the actual money transmission.

What About Exemptions?

The Guidance also discusses certain business models that may fit exemptions from the definition of money transmission.

CVC Trading Platforms and Decentralized Exchanges

Whether or not a trading platform – a website that enables CVC buyers and sellers to find each other – meets the definition of money transmitter depends on its functionality. If a CVC trading platform only provides a forum where buyers and sellers can post their bids and offers and the parties themselves settle any matched transactions outside the platform, the platform will not qualify as a money transmitter. If, however, the platform matches transactions and acts as the CVC exchanger, it is a money transmitter.

Initial Coin Offerings (“ICO”)

An ICO is typically a way to raise funds for a project from early backers through the issuances of CVC. Whether the issuer is a money transmitter is fact-specific. The Guidance addresses only two principal forms of ICOs: (a) an ICO selling CVC to select and closed group of buyers (private pre-sale); and (b) ICOs offering digital debt or equity – future tokens – among a group of investors to finance a future project – a SAFT (Simple Agreement for Future Tokens).

For FinCEN’s purposes, the distinction is in the identity of the buyers and the immediacy of the transaction. In a private pre-sale, the buying group is a select group of preferred buyers and the value may be exchanged instantaneously or at a future date. The CVC and its application or platform may already be operational. In this case, the seller of the CVC is a money transmitter “because at the time of the initial offering the seller is the only person authorized to issue and redeem the new units of CVC.”

For SAFTs, however, how BSA regulations apply will vary because the features and permutations of the SAFT may vary. If the person involved in fundraising activity is a bank, foreign bank, or registered with the SEC of CFTC, it will not be an MSB under FinCEN regulations but will be regulated under other applicable regulations. Second, the issuer may be exempt is “the acceptance and transmission of value is only integral to the sale of goods and services different from money transmission.”

Miners

Miners might also meet the definition of money transmitter. According to the Guidance, if a miner uses mined CVC only to purchase goods and services on its own behalf, it is not an MSB. If, however, the miner engages in money transmission, it will be subject to FinCEN rules and regulations.

Conclusion

As noted, the the seeming breadth of the Guidance parodoxically reveals how almost limitless possibilities exist for individuals and entities to transact in CVC and how difficult the questions of whether those activities will be regulated by FinCEN can be to answer. As always, a hard and critical look at the function of a cryptocurrency and specific actions taken with regard to it will be key in determining how and to what extent the BSA applies.