Morrison Foerster is an international law firm with lawyers practicing throughout the United States, Asia, and Europe. Click to discover more.

mofo_share_image.jpg

Morrison Foerster

favicon.ico

favicon-16x16.png

favicon-32x32.png

apple-touch-icon.png

MoFo Favicons

Terms / Notices

Cookies

Privacy Policy

Attorney Advertising

Secure Login

Alumni

  Facebook

MoFo Facebook

  Linkedin

MoFo LinkedIN

Twitter

MoFo Twitter

YouTube

MoFo Youtube

Morrison Foerster - Footer

You have not solved the recaptcha challenge yet or session expired, try again.

Disclaimer

Unsolicited e-mails and information sent to Morrison & Foerster will not be considered confidential, may be disclosed to others pursuant to our <a href="https://www.mofo.com/about/privacy-policy.html">Privacy Policy</a>, may not receive a response, and do not create an attorney-client relationship with Morrison & Foerster. If you are not already a client of Morrison & Foerster, do not include any confidential information in this message. Also, please note that our attorneys do not seek to practice law in any jurisdiction in which they are not properly authorized to do so.

Feedback

mofo-logo-2022.svg

People

Capabilities

Resources

About

Culture

Offices

Careers

Stay Connected

On May 9, 2019, the Financial Crimes Enforcement Network (“FinCEN”) issued a guidance, Application of FinCEN’s Regulations to Certain Business Models Involving Convertible Virtual Currencies (CVC) (“Guidance”), together with an Advisory on Illicit Activity Involving Convertible Currency(“Advisory”).

FinCEN Issues Convertible Virtual Currency Guidance and Advisory

About Morrison Forester

people-default-header-desktop.jpg

people-default-header-mobile.jpg

Default Meta Data

On May 9, 2019, the Financial Crimes Enforcement Network (“FinCEN”) issued a guidance, <a target="_blank" href="https://www.fincen.gov/news/news-releases/new-fincen-guidance-affirms-its-longstanding-regulatory-framework-virtual">Application of FinCEN’s Regulations to Certain Business Models Involving Convertible Virtual Currencies (CVC)</a> (“Guidance”), together with an <a target="_blank" href="https://www.fincen.gov/news/news-releases/new-fincen-guidance-affirms-its-longstanding-regulatory-framework-virtual">Advisory on Illicit Activity Involving Convertible Currency</a>(“Advisory”). The Guidance largely summarizes FinCEN’s existing regulatory framework regarding the application of the Bank Secrecy Act (“BSA”) to virtual currency activities. FinCEN applies that framework to a number of specific business models involving convertible virtual currency (“CVC”),<a class="anchor" id="_ftnref1" name="_ftnref1" href="#_ftn1">[1]</a> including to CVC wallets and to “the issues most frequently raised by industry, law enforcement, and other regulatory bodies within this evolving financial environment.” The Advisory warns financial institutions of the use by criminals and other bad actors of CVC schemes involving darknet marketplaces, P2P exchangers, foreign-located MSBs, and CVC kiosks. It also lists so-called “red flags” that may be associated with each typology. These red flags can assist in the detection and reporting of suspicious CVC activity by entities subject to the BSA.FinCEN Guidance The <a target="_blank" href="https://www.fincen.gov/sites/default/files/2019-05/FinCEN%20Guidance%20CVC%20FINAL%20508.pdf">Guidance </a>consolidates FinCEN’s existing regulatory framework with respect to businesses engaged in the transmission of virtual currency and their obligations under the BSA. Under the BSA, money services businesses (“MSBs”), including persons providing money transmission services (a “money transmitter”),<a class="anchor" id="_ftnref2" name="_ftnref2" href="#_ftn2">[2]</a> are required to maintain an anti-money laundering (“AML”) program that includes: (1) policies, procedures, and internal controls; (2) a designated individual responsible for day-to-day compliance with the program; (3) training of appropriate personnel, including regarding the detection of suspicious transactions; and (4) a risk-based independent review function.<a class="anchor" id="_ftnref3" name="_ftnref3" href="#_ftn3">[3]</a>FinCEN regulations define the term “money transmission services” to mean “the acceptance of currency, funds, or other value that substitutes for currency to another location or person by any means.”<a class="anchor" id="_ftnref4" name="_ftnref4" href="#_ftn4">[4]</a>  FinCEN clarified in 2013 that this definition does not differentiate between CVC and real currencies.<a class="anchor" id="_ftnref5" name="_ftnref5" href="#_ftn5">[5]</a> Thus, persons accepting and transferring CVC are generally deemed money services businesses under the BSA, unless an exemption applies. FinCEN’s 2013 VC Guidance clarified that, unlike administrators and exchangers of CVC, mere users of CVC are generally not considered money transmitters.<a class="anchor" id="_ftnref6" name="_ftnref6" href="#_ftn6">[6]</a>The Guidance explains how FinCEN applies its existing regulatory framework to seven categories of business models<a class="anchor" id="_ftnref7" name="_ftnref7" href="#_ftn7">[7]</a> involving the transmission of CVC (so-called CVC business models):<ul class="li-margin"><li>P2P exchanges</li><li>CVC wallets</li><li>CVC kiosks</li><li>Decentralized applications (“DApps”)</li><li>Anonymity-enhanced CVC transactions</li><li>Payment processing services</li><li>Internet casinos </li></ul>The Guidance confirms that, under the existing FinCEN regulatory framework, these businesses may be considered money transmitters if they receive and transfer CVC. It illustrates the extent to which existing principles can be applied to emerging business models involving CVC.The Guidance confirms that natural persons operating as P2P exchangers who engage in money transmission services involving either real currency or CVC must comply with the BSA as money transmitters, although a natural person engaging in this activity on an infrequent basis and not for profit is exempt from the scope of money transmission. With respect to payment processors, the Guidance notes that CVC payment processors fall within the definition of money transmitter, and are not eligible for the payment processor exemption because such businesses do not operate through clearing and settlement systems that only admit BSA-regulated financial institutions.<a class="anchor" id="_ftnref8" name="_ftnref8" href="#_ftn8">[8]</a>In the case of service providers that accept and retransmit CVCs in a manner designed to prevent others from tracing the original source of the transmission (commonly referred to as “mixers” or “tumblers”), the Guidance refers to a 2007 administrative ruling concerning a company that provided an analogous anonymizing financial product to consumers making online purchases. In that 2007 ruling, FinCEN concluded that the so-called “integral exception” would not apply to such a business model.<a class="anchor" id="_ftnref9" name="_ftnref9" href="#_ftn9">[9]</a> As confirmed by the Guidance, in order to be covered by the integral exception, “the person’s business must be different from money transmission itself, and the money transmission must be necessary for the business to operate.” Applying this reasoning to anonymizing CVC service providers, the Guidance affirms that a person who provides anonymizing services by accepting and transmitting value in a way to conceal the identity of the transmittor is a money transmitter under FinCEN regulations.The Guidance also illustrates how existing frameworks may not be applicable to CVC business models.  For example, a 2007 FinCEN guidance<a class="anchor" id="_ftnref10" name="_ftnref10" href="#_ftn10">[10]</a> providing that private ATMs do not meet the definition of a money transmitter in certain specific circumstances does not apply to the owner/operator of a CVC kiosk. Unlike private ATMs that come within this narrow exception, CVC kiosks do not link accountholders to their bank accounts. Owner/operators of CVC kiosks that accept and transmit value are money transmitters and must comply with FinCEN regulations.Regarding CVC wallet providers, the Guidance explains that the regulatory treatment of a person that acts as an intermediary between the value and the owner of that value is not technology-dependent and depends on four criteria:<ul class="li-margin"><li>Who owns the value?</li><li>Where is the value stored?</li><li>Does the owner interact directly with the payment system on which the CVC runs?</li><li>Does the intermediary have complete independent control over the value?</li></ul>The Guidance applies the foregoing criteria to hosted wallets, unhosted wallets, and multi-signature wallets, as follows:<ul class="li-margin"><li>Hosted Wallets:  The Guidance confirms that FinCEN considers hosted wallet providers to be money transmitters. These wallet providers generally interact with accountholders through a website or mobile application. They then receive, store, and transmit CVCs on behalf of the accountholders.  FinCEN explains that, with respect to such a business model, “the money transmitter is the host, the account is the wallet, and the accountholder is the wallet owner,” and the specific regulatory obligations of the host, as money transmitter, would vary depending on the type of transactions that it facilitates and the nature of the wallet owner.<a class="anchor" id="_ftnref11" name="_ftnref11" href="#_ftn11">[11]</a></li><li>Unhosted Wallets: Applying the criteria to unhosted wallets that do not require an additional third party to conduct transactions, FinCEN notes that: (a) the value is the property of the owner and is stored in a wallet; and (b) the owner interacts with the payment system directly and has complete control over the value. The person conducting the transaction through such an unhosted wallet is thus not a money transmitter, so long as they are conducting the transaction to purchase goods or services on the user’s behalf.</li><li>Multiple-Signature Wallets: With respect to unhosted multiple-signature wallets, FinCEN explains: (a) the value belongs to the owner and is stored in the wallet; (b) the owner interacts with the wallet software or payment system to initiate the transaction and supplies part of the credentials that are required to access the stored value; and (c) the person that provides additional validation of the transaction at the request of the owner does not have total independent control over the value. In this case, so long as they limit their role to creating unhosted wallets that require a second authorization key, the wallet provider is not a money transmitter because they do not accept and transmit value.<a class="anchor" id="_ftnref12" name="_ftnref12" href="#_ftn12">[12]</a> </li></ul>The Guidance concludes by discussing specific business models that may be exempt from the definition of money transmission, including certain CVC trading platforms and decentralized exchanges, and certain activities relating to initial coin offerings.The Guidance indicates continued interest by FinCEN in evolving business models and activities relating to CVC. Note that last month FinCEN issued its first-ever civil money penalty against a P2P exchanger for violations of the BSA. In that action, P2P exchanger Eric Powers reportedly conducted over 1,700 transactions as an unregistered money transmitter, purchasing and selling virtual currency “by either physical delivering or receiving currency in person, sending or receiving currency through the mail, or coordinating transactions by wire through a depository institution.” Powers’ customers included parties doing business on the website Silk Road, a virtual location often associated with illegal activities.<a class="anchor" id="_ftnref13" name="_ftnref13" href="#_ftn13">[13]</a>FinCEN Advisory In the <a target="_blank" href="https://www.fincen.gov/sites/default/files/advisory/2019-05-10/FinCEN%20Advisory%20CVC%20FINAL%20508.pdf">Advisory</a>, FinCEN cautions financial institutions regarding how criminals and other bad actors exploit CVCs for illicit financing purposes and reminds financial institutions of their obligation to file suspicious activity reports (“SARs”), including with respect to suspicious activities involving CVC. The Advisory summarizes prominent typologies, lists common associated red flags, and identifies information that should be included in the filing of SARs relating to CVCs.<ul class="li-margin"><li>Darknet Marketplaces: FinCEN cautions that “the use of CVC in conjunction with darknet market activity may indicate drug purchases or sales, child exploitation, cybercrime, or other criminal activity,” and that “detectable darknet marketplace linkages, such as through a customer’s online behavior, may indicate CVC use in support of illicit activity.”</li><li>P2P Exchangers: Citing a 2014 guidance concerning funnel accounts,<a class="anchor" id="_ftnref14" name="_ftnref14" href="#_ftn14">[14]</a> the Advisory states that financial institutions may identify P2P exchangers through perceived funnel account activity and explains that “[f]inancial institutions may be able to distinguish P2P exchangers from traditional funnel account activity by identifying frequent interactions with CVC-focused MSBs.”</li><li>Unregistered Foreign-located MSBs:  In the Advisory, FinCEN explains that foreign-located MSBs that do not comply with AML obligations are popular among illicit users of CVC that seek to move funds in and out of the United States and that those MSBs represent a significant money laundering vulnerability.</li><li>CVC Kiosks: The Advisory cautions that some CVC kiosk operators have “operated in ways that suggest a willful effort to evade BSA requirements” and “have assisted in structuring transactions, failing to collect and retain required customer identification information, or falsely represented the nature of their business[.]”</li></ul>The Advisory includes thirty common red flags associated with these typologies and other CVC activity. It notes that some of these red flags may be observable during general transaction screening, while others may become apparent during transaction-specific reviews. The Advisory also cautions financial institutions to evaluate indicators of potential CVC misuse in combination with other red flags and expected transaction activity because some red flags may reflect legitimate financial activities.The Advisory requests that financial institutions reference the Advisory when filing a SAR relating to possible illicit activity involving a CVC and include the following information:<ul class="li-margin"><li>virtual currency wallet addresses</li><li>account information</li><li>transaction details (including virtual currency transaction hash and information on the originator and the recipient)</li><li>relevant transaction history</li><li>available login information (including IP addresses)</li><li>mobile device information (such as device IMEI)</li><li>information obtained from analysis of the customer’s public online profile and communications</li></ul>Separately, the Advisory cautions U.S. individuals and institutions involved in digital currency use or transactions that they should be aware of their responsibilities to ensure that they do not engage in unauthorized transactions prohibited by OFAC.Conclusion Taken together, the Guidance and Advisory indicate that FinCEN views certain CVC activities as vulnerable to exploitation by criminals and other bad actors. Financial institutions and CVC businesses should consider the instructions and admonitions provided by FinCEN in the Guidance and Advisory and should examine their risk profile and BSA obligations in light of the same.  Businesses should also review and amend, if necessary, controls in place to ensure compliance with their respective OFAC compliance requirements.<div data-type='hr' style='border-top: 3px solid #bbb'></div><a class="offset" id="_ftn1" name="_ftn1" href="#_ftnref1">[1]</a> In a 2013 guidance, FinCEN explained that “virtual currency” is a medium of exchange that operates like a currency in some environments but does not have all the attributes of real currency. In particular, virtual currency does not have legal tender status in any jurisdiction. CVC is a type of virtual currency that either has an equivalent value in real currency or acts as a substitute for real currency.  FIN-2013-G001, “Application of FinCEN’s Regulations to Persons Administering, Exchanging, or Using Virtual Currencies” (March 18, 2013) (“2013 VC Guidance”).<a class="offset" id="_ftn2" name="_ftn2" href="#_ftnref2">[2]</a> 31 C.F.R. 1010.100(ff)(5).<a class="offset" id="_ftn3" name="_ftn3" href="#_ftnref3">[3]</a> 31 C.F.R. 1022.210(d).<a class="offset" id="_ftn4" name="_ftn4" href="#_ftnref4">[4]</a> 31 C.F.R. 1010.100(ff)(5)(i)(A).<a class="offset" id="_ftn5" name="_ftn5" href="#_ftnref5">[5]</a> In the 2013 VC Guidance, FinCEN discussed the applicability of BSA requirements to administrators and exchangers under three scenarios: brokers and dealers of e-currencies and e-precious metals; centralized convertible virtual currencies; and de-centralized convertible virtual currencies.<a class="offset" id="_ftn6" name="_ftn6" href="#_ftnref6">[6]</a> The 2013 VC Guidance described an administrator as “a person engaged as a business in issuing (putting into circulation) a virtual currency, and who has the authority to redeem (to withdraw from circulation) such virtual currency” and an exchanger as “a person engaged as a business in the exchange of virtual currency for real currency, funds, or other virtual currency.”<a class="offset" id="_ftn7" name="_ftn7" href="#_ftnref7">[7]</a> The Guidance emphasizes that it applies “only to the business model the guidance describes and may not apply to any other variety or combination of factors that falls under the same generic label.”  In other words, the descriptive name of the activity does not matter; what matters is the substance of the activity.<a class="offset" id="_ftn8" name="_ftn8" href="#_ftnref8">[8]</a> See 31 C.F.R. 1010.100(ff)(5)(ii)(C); FIN-2014-R012 “Request for Administrative Ruling on the Application of FinCEN’s Regulations to a Virtual Currency Payment System” (Oct. 27, 2014).<a class="offset" id="_ftn9" name="_ftn9" href="#_ftnref9">[9]</a> “If the funds transmission is removed from the Company’s process, there is no consumer privacy interest to be protected by the Company’s customer protection scheme. From FinCEN’s perspective, therefore, the Company is engaged in the business of offering secure money transmission, rather than security to which money transmission is ancillary. The acceptance and transmission of funds by the Company is thus not integral to the execution and settlement of a transaction other than the funds transmission itself.” FIN-2008-R007, “Whether a Certain Operation Protecting On-line Personal Financial Information is a Money Transmitter” (June 11, 2008). The Guidance also cites FIN-2014-R006, “Whether a Company that Provides Online Real-Time Deposit, Settlement, and Payment Services for Banks, Businesses and Consumers is a Money Transmitter” (April 29, 2014).<a class="offset" id="_ftn10" name="_ftn10" href="#_ftnref10">[10]</a> FIN-2007-G006, “Application of the Definitions of Money Services Business to Certain Owner-Operators of Automated Teller Machines Offering Limited Services” (December 3, 2007).<a class="offset" id="_ftn11" name="_ftn11" href="#_ftnref11">[11]</a> For example, if the wallet owner is a user, the host is required to identify and verify the user’s identity. If the wallet owner is a financial institution other than an agent, the host must comply with regulatory obligations applicable to correspondent accounts or their MSB equivalents. Where the wallet owner is an agent of the host, the host must comply with requirements concerning a principal MSB’s obligations to monitor the activities of its agent.<a class="offset" id="_ftn12" name="_ftn12" href="#_ftnref12">[12]</a> FinCEN notes that in variations of this model – such as where the value is represented as an entry on the accounts of the provider, the owner does not interact directly with the payment system, or the provider maintains total independent control over the value – the provider would qualify as a money transmitter.<a class="offset" id="_ftn13" name="_ftn13" href="#_ftnref13">[13]</a> For additional information regarding that enforcement action, please visit our April 26, 2019 <a href="/resources/publications/190426-fincen-action-against-powers.pdf?#zoom=100">Client Alert</a>.<a class="offset" id="_ftn14" name="_ftn14" href="#_ftnref14">[14]</a> FIN-2014-A005, “Update on U.S. Currency Restriction in Mexico: Funnel Accounts and TBML” (May 28, 2014).

FinCEN Issues Convertible Virtual Currency Guidance and Advisory

Sign Up

Marc-Alain Galeazzi

Partner

FinTech

Finance

Financial Services

<a href="https://media2.mofo.com/v3/assets/blt5775cc69c999c255/blt37f46c607a0f14c8/62730cb35f7b601eaaebcca6/fs-contact-sheet.pdf" target="_blank"><img style="margin-bottom: 4px;" alt="Contact Us" src="https://media2.mofo.com/v3/assets/blt5775cc69c999c255/bltad2fd52d7b86e622/62731295220ab5285f518f33/contactus.jpg" type="asset" sys-style-type="download"></a>.