Over the last 20 years, commerce, finance, and banking have become increasingly digital. Anti-money laundering (AML) regulators have found themselves catching up with the pace of technological innovation.¹ As AML regulators have promulgated new regulations to address the money laundering risks that technological innovations introduce, an increasing number of companies now qualify as financial institutions subject to AML regulation or have had to structure their products and services to avoid qualifying as financial institutions.

In particular, the Financial Crimes Enforcement Network (FinCEN)—a bureau of the U.S. Department of Treasury responsible for implementing and enforcing federal AML laws—has, over the last decade, clarified the scope of companies that qualify as a type of non-traditional financial institution, called money services businesses (MSBs), a broad category of financial institutions under FinCEN regulations.² As discussed in greater detail below, MSBs include, among others:³

1. money transmitters (e.g., PayPal and other payment facilitators);
2. administrators and exchangers of convertible virtual currencies (CVCs)⁴ (e.g., Bitcoin exchangers);
3. providers and sellers of prepaid access (e.g., retailers or websites selling Amazon gift cards); and
4. dealers in foreign exchange (e.g., Travelex and similar businesses that trade in or facilitate the exchange of foreign currencies).

An MSB must register with FinCEN, implement an AML program, report suspicious and large transactions to FinCEN, and comply with recordkeeping and other requirements. In addition, FinCEN has recently proposed new requirements that would apply to MSBs engaged in or facilitating certain transactions in CVCs; these proposed requirements (discussed below) would expand the regulatory burden of being an MSB even further.

Companies that engage in e-commerce, accept CVCs like Bitcoin as payment for goods or services, or otherwise provide digital finance or banking products should consider their role in payment flows and the payment methods they accept, review their product offerings, and ask the question—am I an MSB? The categories of MSBs that an e-commerce company is most likely to inadvertently become—i.e., money transmitters, providers and sellers of prepaid access, and dealers in foreign exchange—are described below.

Am I a Money Transmitter?

A money transmitter is the broadest category of MSBs under FinCEN regulations. A company that accepts money or its equivalent from one person and transmits it to another person—i.e., provides money transmission services—or that otherwise engages in the transfer of funds is a money transmitter.⁵ Companies like PayPal and Western Union are prototypical examples of money transmitters, but money transmitters also include companies that are administrators and exchangers of CVCs.⁶ Administrators are companies that issue CVCs (i.e., put into circulation) with the authority to redeem those CVCs (i.e., withdraw from circulation), like Ripple (XRP).⁷ Exchangers are companies that exchange CVCs for real currency, funds, or other CVCs, like Coinbase.⁸

E-commerce companies often provide some form of money transmission services or engage in some transfers of funds, and, if they are not providing those services or engaging in those transfers directly, are typically partnering with a money transmitter or other payment processor to do so on their behalf. Companies that do not intend to be MSBs have to rely on an exemption from FinCEN's money transmitter definition if they provide money transmission services or engage in transferring funds. For example, the following types of companies are not money transmitters:

1. Technology Layer Providers—Companies that only provide delivery, communication, or network access services used by a money transmitter to support money transmission services, e.g., software providers to money transmitters;⁹
2. Payment Processors—Companies that only act as payment processors to facilitate the purchase of, or payment of a bill for, a good or service through a clearance and settlement system by agreement with the creditor or seller, e.g., payment facilitators that process transactions between two banks;¹⁰
3. Prepaid Access Providers—Companies that only provide prepaid access, i.e., access to funds (or the value of funds) that have been paid in advance and can be retrieved or transferred at some point in the future through an electronic device or vehicle, e.g., eGift card providers¹¹ (as discussed below, however, a provider of prepaid access may be a distinct type of MSB, even though not a money transmitter); and
4. Providers of Goods/Services—Companies that only accept and transmit funds that are integral to the sale of goods or provision of services, other than money transmission services, e.g., a company that facilitates micro-lending between lenders and entrepreneurs.¹²

A company engaged in e-commerce should understand which of the above exemptions the company is able to rely on in order to avoid categorization as a money transmitter under FinCEN regulations. If a company is a money transmitter, then it generally must register with FinCEN as an MSB and implement an AML program (which should include performing know-your-customer (KYC) checks on customers), file suspicious activity and currency transaction reports with FinCEN, and maintain records in compliance with FinCEN regulations. If a company that is a money transmitter fails to comply with its registration requirements, then the company may be subject to civil and criminal penalties, including the imposition of steep fines and imprisonment.¹³

Am I a Provider or Seller of Prepaid Access?

Even if companies engaged in e-commerce are not money transmitters, they may offer products and services that can only be offered by MSBs under FinCEN regulations. For example, a company may offer online vouchers or sell eGift cards to their customers in an effort to expand their customer base, but that new offering can make the company an MSB, namely a provider of prepaid access or a seller of prepaid access. Generally speaking, a provider of prepaid access is a company with control over the applicable prepaid access program, and a seller of prepaid access is a company that receives funds in exchange for loading prepaid access.¹⁴

If a company is not registered with FinCEN as an MSB, then it must structure its provision or sales of prepaid access (e.g., online vouchers, eGift cards, etc.) in compliance with certain transaction limits. For example:

1. $2k and $1k Limits for Providers of Prepaid Access—If a company controls a prepaid program (and desires to avoid MSB status), the company must limit the amount of prepaid access any one person can purchase to no more than:
   1. $2,000 per day if the prepaid program will be a closed-loop program (e.g., Starbucks eGift cards that can only be used at Starbucks locations); or¹⁵
   2. $1,000 per day if the prepaid program will be an open-loop program (e.g., the eGift cards can be used at Starbucks, Dunkin Donuts, Compass Coffee, etc.).¹⁶
2. $10k Limit for Sellers of Prepaid Access—If a company does not control a prepaid program but sells prepaid access associated with that prepaid program, the company selling that prepaid access must limit its sales to no more than $10,000 in prepaid access to any one person in any one day.¹⁷

If a company can structure its provision of prepaid access in a manner so that either the prepaid program meets the requirements of the $2,000 closed-loop or $1,000 open-loop safe harbor, then the company can avoid being deemed a provider of prepaid access under FinCEN regulations and, thus, avoid categorization as an MSB. Similarly, if a seller of prepaid access takes reasonable steps to ensure that sales are no more than $10,000 in prepaid access to any one person in any one day, the MSB label should not apply. By structuring offerings within these limits, the attendant registration, reporting, and recordkeeping obligations applicable to MSBs should not apply.

Am I a Dealer in Foreign Exchange?

A company may qualify as a dealer in foreign exchange under FinCEN regulations if it accepts large amounts of funds (i.e., more than $1,000) denominated in one foreign currency from a third party in exchange for funds denominated in another currency—for this definition, multiple transactions in any one day are aggregated.¹⁸ While most companies are unlikely to qualify as dealers in foreign exchange, a company with multinational operations should consider whether any payment flows facilitated by the company constitute foreign exchange. This may occur, for example, when a company enables a merchant to sell goods through the company's platform to consumers inside and outside of the United States, holds funds from those consumers on behalf of the merchant, and converts funds denominated in one currency to another currency (e.g., the merchant's local currency) before transmitting those funds to the merchant.

Even if a company does facilitate foreign exchange transactions, it may still avoid meeting FinCEN's definition of a dealer in foreign exchange if the company limits foreign exchange transactions to $1,000 or less per person per day. Alternatively, a company can avoid FinCEN's dealer in foreign exchange definition entirely if it blanketly prohibits foreign exchange transactions, e.g., by ring-fencing its operations so that all transactions in one country remain denominated in that country's currency and are segregated from any transactions outside of that country.

Am I an MSB If I Accept Convertible Virtual Currency for Payment?

An increasing number of companies, including companies that are not MSBs, accept CVCs like Bitcoin as payment for goods and services. These companies may not be issuing CVCs through initial coin offerings (ICOs) (an administrator activity that constitutes money transmission) or transmitting Bitcoin from one person to another (an exchanger activity that constitutes money transmission) but may be interested in engaging with a growing community of CVC users. Interest in accepting CVCs as payment for goods and services is increasingly common because the growing CVC community applauds (and financially rewards) companies that allow users to pay for goods and services using CVCs like Bitcoin.¹⁹ Before a company accepts CVCs as payment for goods or services though, it should carefully consider in what circumstances and how the company will accept CVCs.

While accepting CVCs alone may not make a company an MSB, companies that accept CVCs may be at an increased risk of violating criminal AML laws. In particular, federal AML laws generally prohibit any person from transacting in funds that have been derived from illegal activity if the person knows or is willfully blind to the illegal origin of the funds. CVCs, unfortunately, have become a common means for moving illegally derived funds. The caution urged by AML regulators with regard to CVCs is evident in FinCEN's newly proposed rule.

On December 23, 2020, FinCEN proposed a rule seeking to increase the transparency of CVC transactions. FinCEN would require MSBs to, among other things, record transaction details for any CVC transaction in excess of $3,000 in any 24-hour period when the transaction involves a hosted wallet (i.e., a wallet where the private key is hidden from the wallet holder) and an unhosted wallet (i.e., a wallet where the wallet holder retains the private key).²⁰ While the proposed rule would apply only to MSBs, it suggests FinCEN may be wary of CVCs more generally.

Accordingly, any company considering accepting CVCs as a payment method should consider whether the company would be deemed willfully blind if it turned out that the CVCs it received from users was derived from illegal activity. Some of the critiques raised in comments to FinCEN's proposed rule highlight the complexity (and, at times, impossibility) of ascertaining the identity of unhosted wallet holders.²¹ As substitute cautionary measures (in place of ascertaining identity), a company that decides to accept CVCs should consider, among other things, placing a daily transaction limit on CVC payments, querying the sending party regarding the source of funds, limiting the kinds of CVC wallets from which the company will accept payments, and establishing other internal controls tailored to the transacting parties and the money laundering risk.

Any company engaged in e-commerce or otherwise in providing digital finance or banking products should consider whether it qualifies as an MSB under FinCEN regulations and which exemptions it would be able to rely on (if any) in order to avoid MSB categorization. If the company cannot find exemptions to rely on, then the company generally must register with FinCEN as an MSB, implement an AML program, file suspicious activity and currency transaction reports, and maintain records for five years, or find a new way to structure the company's product and service offering to avoid qualifying as an MSB. Even if a company is not an MSB, consideration should be given to the risk of being deemed willfully blind to illegal sources of funds, particularly if a company accepts CVCs.

[1] See FinCEN Guidance: Application of FinCEN’s Regulations to Certain Business Models Involving Convertible Virtual Currencies, FinCEN FIN-2019-G001 (May 9, 2019) [hereinafter, 2019 guidance], https://www.fincen.gov/sites/default/files/2019-05/FinCEN%20Guidance%20CVC%20FINAL%20508.pdf; FinCEN Guidance: Application of FinCEN’s Regulations to Persons Administering, Exchanging, or Using Virtual Currencies, FinCEN FIN-2013-G001 (Mar. 18, 2013), https://www.fincen.gov/resources/statutes-regulations/guidance/application-fincens-regulations-persons-administering.

[2] See FinCEN, Bank Secrecy Act Regulations: Definitions and Other Regulations Relating to Money Services Businesses, 76 Fed. Reg. 140 (July 21, 2011), https://www.govinfo.gov/content/pkg/FR-2011-07-21/pdf/2011-18309.pdf.

[3] 31 C.F.R. § 1010.100(ff); 2019 guidance, note 1. MSBs do not include banks, companies that are regulated by the Securities and Exchange Commission or the Commodity Futures Trading Commission, or individuals who engage in certain MSB activities on an infrequent basis and not for gain or profit. 31 C.F.R. § 1010.100(ff)(8).

[4] A CVC is a medium of exchange that has an equivalent value as currency or acts as a substitute for currency, such as Bitcoin, Ether, Ripple, etc. See 2019 guidance, note 1.

[5] 31 C.F.R. § 1010.100(ff)(5)(i). These transmissions of money or other value can occur by any means, including through a financial institution, electronic funds transfer network, or informal value transfer system (e.g., a CVC blockchain).

[6] 2019 guidance, note 1.

[7] See 2019 guidance, note 1.

[8] See 2019 guidance, note 1.

[9] 31 C.F.R. § 1010.100(ff)(5)(ii)(A).

[10] 31 C.F.R. § 1010.100(ff)(5)(ii)(B).

[11] 31 C.F.R. §§ 1010.100(ff)(5)(ii)(E) & (ww).

[12] 31 C.F.R. § 1010.100(ff)(5)(ii)(F).

[13] See e.g., 18 U.S.C. §§ 1956, 1957, and 1960; 31 U.S.C. §§ 5321 and 5322.

[14] 31 C.F.R. §§ 1010.100(ff)(4) and (7).

[15] 31 C.F.R. § 1010.100(ff)(4)(iii)(A).

[16] 31 C.F.R. § 1010.100(ff)(4)(iii)(D)(1)(ii). The prepaid program must also prohibit funds or value to be transmitted internationally, transfers between or among users of prepaid access within a prepaid program, and loading additional funds or the value of funds from non-depository sources in order for the company to rely on this exemption from FinCEN’s provider of prepaid access definition in connection with an open-loop program. 31 C.F.R. § 1010.100(ff)(4)(iii)(D)(2).

[17] A company may also become a seller of prepaid access if it does not verify the identities of the recipients of prepaid access in advance, provided, however, that the lack of verification will cause the company to be a seller of prepaid access only if the prepaid access being sold is part of a prepaid program. Certain arrangements will not be deemed prepaid programs under FinCEN regulations (e.g., prepaid programs that comply with FinCEN’s $2,000 closed-loop or $1,000 open-loop safe harbor), and, thus, a seller of prepaid access from those arrangements will not constitute a seller of prepaid access. 31 C.F.R. § 1022.210(d)(1)(iv).

[18] 31 C.F.R. § 1010.100(ff)(1).

[19] Leigh Cuen, You Can Now Shop with Bitcoin on Amazon Using Lightning, CoinDesk (Apr. 22, 2019), https://www.coindesk.com/you-can-now-shop-with-bitcoin-on-amazon-using-lightning; Pete Rizzo, BitPay or Coinbase? Shopify Now Let’s Merchants Choose, CoinDesk (July 15, 2014), https://www.coindesk.com/bitpay-coinbase-shopify.

[20] A customer with a hosted wallet allows the MSB to control the customer’s private key, which is the mechanism through which transactions can be written onto the blockchain, whereas the MSB does not have control over any private key associated with an unhosted wallet. FinCEN, Proposed Rule: Requirements for Certain Transactions Involving Convertible Virtual Currency or Digital Assets, 85 Fed. Reg. No. 247 (Dec. 23, 2020) [hereinafter 2020 proposed rule], https://www.federalregister.gov/documents/2020/12/23/2020-28437/requirements-for-certain-transactions-involving-convertible-virtual-currency-or-digital-assets.

[21] See e.g., Square, Square, Inc.’s Federal Comment Letter Regarding FinCEN’s Proposed Rulemaking on Requirements for Certain Transactions Involving Convertible Virtual Currency or Digital Assets (Jan. 4, 2021), https://squareup.com/us/en/press/fincen-letter.