On May 9, 2019, the Financial Crimes Enforcement Network (“FinCEN”) issued a guidance, Application of FinCEN’s Regulations to Certain Business Models Involving Convertible Virtual Currencies (CVC) (“Guidance”), together with an Advisory on Illicit Activity Involving Convertible Currency(“Advisory”). The Guidance largely summarizes FinCEN’s existing regulatory framework regarding the application of the Bank Secrecy Act (“BSA”) to virtual currency activities. FinCEN applies that framework to a number of specific business models involving convertible virtual currency (“CVC”), including to CVC wallets and to “the issues most frequently raised by industry, law enforcement, and other regulatory bodies within this evolving financial environment.” The Advisory warns financial institutions of the use by criminals and other bad actors of CVC schemes involving darknet marketplaces, P2P exchangers, foreign-located MSBs, and CVC kiosks. It also lists so-called “red flags” that may be associated with each typology. These red flags can assist in the detection and reporting of suspicious CVC activity by entities subject to the BSA.
The Guidance consolidates FinCEN’s existing regulatory framework with respect to businesses engaged in the transmission of virtual currency and their obligations under the BSA. Under the BSA, money services businesses (“MSBs”), including persons providing money transmission services (a “money transmitter”), are required to maintain an anti-money laundering (“AML”) program that includes: (1) policies, procedures, and internal controls; (2) a designated individual responsible for day-to-day compliance with the program; (3) training of appropriate personnel, including regarding the detection of suspicious transactions; and (4) a risk-based independent review function.
FinCEN regulations define the term “money transmission services” to mean “the acceptance of currency, funds, or other value that substitutes for currency to another location or person by any means.” FinCEN clarified in 2013 that this definition does not differentiate between CVC and real currencies. Thus, persons accepting and transferring CVC are generally deemed money services businesses under the BSA, unless an exemption applies. FinCEN’s 2013 VC Guidance clarified that, unlike administrators and exchangers of CVC, mere users of CVC are generally not considered money transmitters.
The Guidance explains how FinCEN applies its existing regulatory framework to seven categories of business models involving the transmission of CVC (so-called CVC business models):
The Guidance confirms that, under the existing FinCEN regulatory framework, these businesses may be considered money transmitters if they receive and transfer CVC. It illustrates the extent to which existing principles can be applied to emerging business models involving CVC.
The Guidance confirms that natural persons operating as P2P exchangers who engage in money transmission services involving either real currency or CVC must comply with the BSA as money transmitters, although a natural person engaging in this activity on an infrequent basis and not for profit is exempt from the scope of money transmission. With respect to payment processors, the Guidance notes that CVC payment processors fall within the definition of money transmitter, and are not eligible for the payment processor exemption because such businesses do not operate through clearing and settlement systems that only admit BSA-regulated financial institutions.
In the case of service providers that accept and retransmit CVCs in a manner designed to prevent others from tracing the original source of the transmission (commonly referred to as “mixers” or “tumblers”), the Guidance refers to a 2007 administrative ruling concerning a company that provided an analogous anonymizing financial product to consumers making online purchases. In that 2007 ruling, FinCEN concluded that the so-called “integral exception” would not apply to such a business model. As confirmed by the Guidance, in order to be covered by the integral exception, “the person’s business must be different from money transmission itself, and the money transmission must be necessary for the business to operate.” Applying this reasoning to anonymizing CVC service providers, the Guidance affirms that a person who provides anonymizing services by accepting and transmitting value in a way to conceal the identity of the transmittor is a money transmitter under FinCEN regulations.
The Guidance also illustrates how existing frameworks may not be applicable to CVC business models. For example, a 2007 FinCEN guidance providing that private ATMs do not meet the definition of a money transmitter in certain specific circumstances does not apply to the owner/operator of a CVC kiosk. Unlike private ATMs that come within this narrow exception, CVC kiosks do not link accountholders to their bank accounts. Owner/operators of CVC kiosks that accept and transmit value are money transmitters and must comply with FinCEN regulations.
Regarding CVC wallet providers, the Guidance explains that the regulatory treatment of a person that acts as an intermediary between the value and the owner of that value is not technology-dependent and depends on four criteria:
The Guidance applies the foregoing criteria to hosted wallets, unhosted wallets, and multi-signature wallets, as follows:
The Guidance concludes by discussing specific business models that may be exempt from the definition of money transmission, including certain CVC trading platforms and decentralized exchanges, and certain activities relating to initial coin offerings.
The Guidance indicates continued interest by FinCEN in evolving business models and activities relating to CVC. Note that last month FinCEN issued its first-ever civil money penalty against a P2P exchanger for violations of the BSA. In that action, P2P exchanger Eric Powers reportedly conducted over 1,700 transactions as an unregistered money transmitter, purchasing and selling virtual currency “by either physical delivering or receiving currency in person, sending or receiving currency through the mail, or coordinating transactions by wire through a depository institution.” Powers’ customers included parties doing business on the website Silk Road, a virtual location often associated with illegal activities.
In the Advisory, FinCEN cautions financial institutions regarding how criminals and other bad actors exploit CVCs for illicit financing purposes and reminds financial institutions of their obligation to file suspicious activity reports (“SARs”), including with respect to suspicious activities involving CVC. The Advisory summarizes prominent typologies, lists common associated red flags, and identifies information that should be included in the filing of SARs relating to CVCs.
The Advisory includes thirty common red flags associated with these typologies and other CVC activity. It notes that some of these red flags may be observable during general transaction screening, while others may become apparent during transaction-specific reviews. The Advisory also cautions financial institutions to evaluate indicators of potential CVC misuse in combination with other red flags and expected transaction activity because some red flags may reflect legitimate financial activities.
The Advisory requests that financial institutions reference the Advisory when filing a SAR relating to possible illicit activity involving a CVC and include the following information:
Separately, the Advisory cautions U.S. individuals and institutions involved in digital currency use or transactions that they should be aware of their responsibilities to ensure that they do not engage in unauthorized transactions prohibited by OFAC.
Taken together, the Guidance and Advisory indicate that FinCEN views certain CVC activities as vulnerable to exploitation by criminals and other bad actors. Financial institutions and CVC businesses should consider the instructions and admonitions provided by FinCEN in the Guidance and Advisory and should examine their risk profile and BSA obligations in light of the same. Businesses should also review and amend, if necessary, controls in place to ensure compliance with their respective OFAC compliance requirements.
 In a 2013 guidance, FinCEN explained that “virtual currency” is a medium of exchange that operates like a currency in some environments but does not have all the attributes of real currency. In particular, virtual currency does not have legal tender status in any jurisdiction. CVC is a type of virtual currency that either has an equivalent value in real currency or acts as a substitute for real currency. FIN-2013-G001, “Application of FinCEN’s Regulations to Persons Administering, Exchanging, or Using Virtual Currencies” (March 18, 2013) (“2013 VC Guidance”).
 31 C.F.R. 1010.100(ff)(5).
 31 C.F.R. 1022.210(d).
 31 C.F.R. 1010.100(ff)(5)(i)(A).
 In the 2013 VC Guidance, FinCEN discussed the applicability of BSA requirements to administrators and exchangers under three scenarios: brokers and dealers of e-currencies and e-precious metals; centralized convertible virtual currencies; and de-centralized convertible virtual currencies.
 The 2013 VC Guidance described an administrator as “a person engaged as a business in issuing (putting into circulation) a virtual currency, and who has the authority to redeem (to withdraw from circulation) such virtual currency” and an exchanger as “a person engaged as a business in the exchange of virtual currency for real currency, funds, or other virtual currency.”
 The Guidance emphasizes that it applies “only to the business model the guidance describes and may not apply to any other variety or combination of factors that falls under the same generic label.” In other words, the descriptive name of the activity does not matter; what matters is the substance of the activity.
 See 31 C.F.R. 1010.100(ff)(5)(ii)(C); FIN-2014-R012 “Request for Administrative Ruling on the Application of FinCEN’s Regulations to a Virtual Currency Payment System” (Oct. 27, 2014).
 “If the funds transmission is removed from the Company’s process, there is no consumer privacy interest to be protected by the Company’s customer protection scheme. From FinCEN’s perspective, therefore, the Company is engaged in the business of offering secure money transmission, rather than security to which money transmission is ancillary. The acceptance and transmission of funds by the Company is thus not integral to the execution and settlement of a transaction other than the funds transmission itself.” FIN-2008-R007, “Whether a Certain Operation Protecting On-line Personal Financial Information is a Money Transmitter” (June 11, 2008). The Guidance also cites FIN-2014-R006, “Whether a Company that Provides Online Real-Time Deposit, Settlement, and Payment Services for Banks, Businesses and Consumers is a Money Transmitter” (April 29, 2014).
 FIN-2007-G006, “Application of the Definitions of Money Services Business to Certain Owner-Operators of Automated Teller Machines Offering Limited Services” (December 3, 2007).
 For example, if the wallet owner is a user, the host is required to identify and verify the user’s identity. If the wallet owner is a financial institution other than an agent, the host must comply with regulatory obligations applicable to correspondent accounts or their MSB equivalents. Where the wallet owner is an agent of the host, the host must comply with requirements concerning a principal MSB’s obligations to monitor the activities of its agent.
 FinCEN notes that in variations of this model – such as where the value is represented as an entry on the accounts of the provider, the owner does not interact directly with the payment system, or the provider maintains total independent control over the value – the provider would qualify as a money transmitter.
 FIN-2014-A005, “Update on U.S. Currency Restriction in Mexico: Funnel Accounts and TBML” (May 28, 2014).