FinCEN Maps Bank Secrecy Act Rules Across Crypto Business Models

The Financial Crimes Enforcement Network issued detailed cryptocurrency guidance on May 9, 2019, explaining how existing Bank Secrecy Act rules applied to businesses using what the agency called convertible virtual currency. The 30-page document addressed peer-to-peer exchangers, wallet providers, decentralized applications, payment processors, anonymity services, cryptocurrency kiosks, initial coin offerings and mining arrangements.

FinCEN emphasized that the guidance did not establish new regulatory expectations or requirements. It instead consolidated regulations, administrative rulings and guidance issued since 2011, then applied that framework to newer cryptocurrency business models. That qualification was legally important, but it did not make the document inconsequential: the guidance gave companies and enforcement officials a single, detailed account of how the agency interpreted existing obligations.

Activity mattered more than labels

FinCEN’s organizing principle was that regulatory treatment depended on facts and circumstances, not the terminology a company selected. A developer could create or sell software without becoming a money transmitter merely because the software could move cryptocurrency. The conclusion could change if the same person used the product as a business to accept and transmit value for others.

That functional approach reached peer-to-peer exchangers. A natural person exchanging cryptocurrency only for personal purposes could be a user, but someone engaged as a business in exchanging value for other people generally operated as a money transmitter. Covered money transmitters had to register as money services businesses and comply with applicable anti-money-laundering, recordkeeping, monitoring and reporting requirements.

Wallet treatment similarly turned on control. FinCEN distinguished hosted wallets, where a third party controls customer funds, from unhosted wallets, where owners control their funds and interact directly with the payment system. A person using an unhosted, single-signature wallet to buy goods or services on that person’s own behalf was not a money transmitter. A hosted-wallet operator with total independent control over customer value generally was.

Decentralization was not an automatic exemption

The guidance also addressed decentralized applications, or DApps, operating across peer-to-peer blockchain networks. FinCEN said that when a DApp accepted and transmitted value, the money-transmitter definition could apply to the application, its owners or operators, or both. Whether the service operated for profit did not determine the result.

That position mattered because technical decentralization did not, by itself, remove an activity from the agency’s analysis. FinCEN still looked for the people or mechanisms accepting and transmitting value. At the same time, the document acknowledged that different architectures and control arrangements could produce different conclusions, limiting any blanket claim that every blockchain application carried identical obligations.

FinCEN drew another important line around privacy tools. A service that accepted cryptocurrency and retransmitted it in a manner designed to conceal its source was a money transmitter under the guidance. A supplier merely providing anonymizing software was not a money transmitter solely for supplying the tool. The distinction rested on operating a transmission service rather than writing privacy-enhancing code.

Cryptocurrency payment processors also received a firm interpretation. FinCEN said processors that collected cryptocurrency from customers and transmitted currency or funds to merchants fell within the money-transmitter definition and generally could not use the conventional payment-processor exemption because cryptocurrency settlement arrangements did not satisfy all of that exemption’s conditions.

Compliance and enforcement context

FinCEN paired the guidance with an advisory describing illicit-finance risks involving darknet markets, unregistered peer-to-peer exchangers, foreign-located money services businesses and cryptocurrency kiosks. The advisory supplied suspicious-activity indicators for financial institutions and stressed that foreign-located transmitters doing business wholly or substantially within the United States could face the same requirements even without a physical U.S. presence.

No cryptocurrency price, return or trading-volume claim can be attributed to the guidance from the cited record. Its significance on May 9, 2019 was institutional: FinCEN translated a broad money-transmission framework into concrete examples for an industry whose products increasingly blurred the boundaries between software, custody, payments and financial intermediation.