Financial Crimes Enforcement Network Guidance Regarding Convertible Virtual Currencies, Wallets, ICOs, DApps and More

The guidance consolidates current FinCEN regulations and related administrative rulings and guidance issued since 2011, and then applies these rules and interpretations to common CVC business models, including (a) providers of CVC wallets; (b) operators of CVC kiosks; (c) decentralized (distributed) applications (DApps); (d) providers of anonymizing services for CVCs; (e) CVC payment processors; (f) internet casinos using CVC; (g) CVC trading platforms and decentralized exchanges; (h) entities involved in initial coin offerings (ICOs) and related hedging transactions; (i) creators of CVC; and (j) mining pools and cloud miners. FinCEN focuses on whether participants in these business models would be characterized as money transmitters for purposes of the BSA regulations or may be eligible for an exemption from the money transmitter obligations thereunder. Thus, while the guidance asserts that it does not establish any new regulatory expectations or requirements, participants in models not previously addressed by FinCEN guidance may not entirely agree.

Consistent with past FinCEN interpretations, the guidance describes CVC as “a type of virtual currency that either has an equivalent value as currency, or acts as a substitute for currency, and is therefore a type of ‘value that substitutes for currency.” In this regard, the guidance indicates that this definition may include value originally created for another purpose but then repurposed as a currency substitute. In particular, “if assets that other regulatory frameworks define as commodities, securities, or futures contracts were to be specifically issued or later repurposed to serve as a currency substitute, then the asset itself could be a type of value that substitutes for currency, the transfer of which could constitute money transmission.” However, the guidance provides no further analysis of when commodities, securities, futures contracts or other specific types of digital assets, including in-game currencies, might fall within this definition.

A person accepting and transmitting value that substitutes for currency, such as CVC, is a money transmitter and must comply with the applicable AML obligations.³ Money transmitter AML obligations under the BSA regulations include developing, implementing and maintaining an effective written AML program, registering with FinCEN as an MSB, and complying with the “Funds Transfer Rule”⁴ and the “Funds Travel Rule.”⁵ These AML obligations may vary based on the business model, but the potential application of the Funds Travel Rule, which requires that certain information “travel” with a funds transfer, in CVC settings may be overlooked by market participants. Although the guidance helpfully indicates that Funds Travel Rule information can be provided in a message separate from the transfer of the CVC itself, institutions involved in the transfer of CVCs will want to assess their compliance with Funds Travel Rule information transmission requirements.

The guidance discusses the following examples of how the BSA regulations for money transmitters would apply to common business models involving the transmission of CVCs:⁶

• CVC Wallets: The regulatory treatment of intermediaries between the owner of the value in a wallet and the value itself depends on four criteria: (a) who owns the value, (b) where the value is stored, (c) whether the owner interacts directly with the payment system where the CVC runs and (d) whether the person acting as intermediary has total independent control over the value. Although it is not entirely clear how the criteria would be balanced in all situations, the guidance describes providers of hosted wallets that are treated as MSBs and unhosted wallet providers that are not. Moreover, while mere control of a private key for a multiple-signature wallet is not sufficient to trigger MSB obligations, the provider of a hosted multiple-signature wallet would be considered an MSB. 
•  CVC Money Transmission Services Provided Through Electronic Terminals (CVC Kiosks): CVC kiosks are electronic terminals that act as mechanical agencies of the owner-operators to enable the owner-operators to facilitate the exchange of CVC for currency or other CVC. An owner-operator of a CVC kiosk that uses an electronic terminal to accept currency from a customer and transmit the equivalent value in CVC (or vice versa) qualifies as a money transmitter. 
• CVC Money Transmission Services Provided Through DApps: DApps refer to software programs that operate on a P2P network of computers running a blockchain platform, designed such that they are not controlled by a single person or group of persons. A DApp may be deployed by an “owner/operator” to perform a wide variety of functions, including providing financial services, in exchange for a fee commonly paid in CVC. The guidance asserts that “when a DApp performs money transmission, the definition of money transmitter will apply to the DApp, the owners/operators of the DApp, or both.” This, of course, begs the question of who may be considered the “owner” or “operator” of a DApp and what it would mean for the DApp, a piece of software running on a decentralized network, to be considered itself a “money transmitter.” 
• Anonymity-Enhanced CVC Transactions: Anonymity-enhanced CVC transactions are transactions that either (a) are denominated in regular types of CVC but are structured to conceal information otherwise generally available through the CVC’s native distributed public ledger or (b) are denominated in types of CVC specifically engineered to prevent their tracing through distributed public ledgers (also called private coins). The regulatory framework that applies to a person participating in anonymity-enhanced CVC transactions depends on the specific role performed by the person. For example, a person that accepts CVCs and retransmits them in a manner designed to prevent others from tracing the transmission back to its source would be a money transmitter. Also, a person that creates or sells anonymity-enhanced CVCs designed to prevent their tracing through publicly visible ledgers would be a money transmitter depending on the type of payment system and the person’s activity. On the other hand, a person that provides anonymizing software without more is not a money transmitter.⁷
• Payment Processing Services Involving CVC Money Transmission: CVC payment processors, which are financial intermediaries that enable traditional merchants to accept CVC from customers in exchange for goods and services sold, are money transmitters.⁸
• CVC Money Transmission Performed by Internet Casinos: A person engaged in the business of gambling that is not otherwise subject to the BSA regulations as a casino, gambling casino or card club but that accepts and transmits value denominated in CVC may be regulated under the BSA regulations as a money transmitter.

The guidance also discusses the following examples of business models involving CVC transactions that may be exempt in some cases from the definition of money transmission but may nonetheless have other AML obligations based on its type of business:

• CVC Trading Platforms and Decentralized Exchanges: CVC trading platforms that only provide a forum where buyers and sellers of CVC post their bids and offers, and the parties themselves settle any matched transactions through an outside venue, are not money transmitters. However, if, when transactions are matched, a trading platform purchases the CVC from the seller and sells it to the buyer, then the trading platform is CVC exchanger and considered a money transmitter.
• CVC Money Transmission Performed in the Context of Raising Funding for Development of Other Projects—ICOs: The guidance addresses the BSA obligations of two business models involving ICOs:
  • The first type of ICO consists of a group sale of CVC to a distinct set of preferred buyers. The exchange of CVC for another type of value may be instantaneous or deferred to a later date. The seller of the CVC is a money transmitter because at the time of the initial offering the seller is the only person authorized to issue and redeem the new units of CVC and therefore would be considered an “administrator” of the CVC. However, the description provided by the guidance begs the question, among other things, whether any particular ICO token is a CVC in the first place and who would constitute a “seller.” 
  • In a second business model, the ICO raises funds for new projects by selling an equity stake or a debt instrument to early backers or hedges a previous investment in CVC through a derivative, such as a futures contract. The funded project generally involves the creation of DApps,⁹ new CVCs (as well as the applications or platforms on which the CVCs will run) or new hedging instruments. ICOs are accomplished using distributed ledger platforms, in which investors receive a digital token as proof of investment.¹⁰
    
    • Persons involved in an ICO through selling an equity stake or a debt instrument to early backers or through hedging a previous investment may be exempt from MSB status under an exemption available for other types of regulated entities or for the acceptance and transmission of value that is integral to the sale of goods or services different from money transmission.¹¹ Under the former exemption, a person’s AML obligations will flow from the BSA regulations governing those types of financial institutions.
    • In a resale through a P2P transaction, a financial intermediary or secondary market generally does not create any AML obligations for the initial investor. However, if a regulatory framework other than the BSA requires a purchaser or intermediary to register as a broker or dealer in securities, futures commission merchant or introducing broker in commodities, with the SEC or CFTC, as applicable, then the person will have the BSA obligations related to its status under these other applicable regulatory regimes.  
  • The categorization of an ICO token as a CVC or an issuer’s reliance on an applicable exemption from the BSA regulations does not impact the analysis of the ICO under federal securities laws. The guidance defers to the SEC and cites SEC FinHub’s recently issued Framework for “Investment Contract” Analysis of Digital Assets, which discusses when a distribution of digital assets would be considered an investment contract and therefore a security, which may require a person facilitating primary or secondary sales to also register as a broker or dealer with the SEC.¹²
• Status of Creators of CVC and Distributed Applications Conducting CVC Transactions: If a person mines CVC and uses it solely to purchase goods or services on its own behalf, the person is not an MSB. However, if a person mines CVC and uses it to engage in money transmission, such person will be subject to the BSA regulations.
• CVC Money Transmission Performed by Mining Pools and Cloud Miners: If either the leader of a group of persons mining a CVC or a cloud miner that sells mining contracts to purchasers to use the cloud miner’s systems to mine CVC receives CVC and transfers it to pool members or contract purchasers, these transfers are integral to the provision of services and thus not money transmission. However, if the leader or cloud miner combines its managing and renting services with the service of hosting CVC wallets on behalf of the pool members or purchasers, the leader or cloud miner will be a money transmitter.

It is important to note that these are merely examples of current and emerging business models. The determination of whether a person is a money transmitter under the BSA regulations is a matter of facts and circumstances,¹³ thus the FinCEN conclusions are limited to the assumptions on which they are based and, as indicated above, those conclusions and their underlying reasoning is not always entirely clear. As the use of CVCs continues to evolve, organizations involved in CVC activity should review each business model to determine whether the BSA regulations for money transmitters will apply.