Virtual currency businesses are under scrutiny by U.S. anti-money laundering (AML) regulators. Earlier this year, U.S Treasury Secretary Steven Mnuchin emphasized that virtual currencies are subject to AML regulations. He said that under U.S. law, "if you have a wallet to own bitcoins, that company has the same obligation as a bank to Know Your Customer . . . in the United States, we have rules for anti-money-laundering, for all different types of entities."¹

Is that true? Is a company subject to AML regulations if it provides a virtual currency wallet, or mines for virtual currency, or accepts or exchanges virtual currency? And does that mean it must obtain and verify detailed identification information about its customers? Or file suspicious activity reports? Or engage in a myriad of additional anti-money laundering activities that are required of banks?

Yes and no. This advisory provides an overview of when and how AML regulations apply to businesses that touch virtual currencies. Not all virtual currency businesses are subject to AML regulations, but many may be categorized under federal law as "money services businesses" (MSBs), which do have AML compliance obligations. In particular, many virtual currency businesses are "money transmitters," a subcategory of MSBs, and these money transmitters accordingly are subject to an array of AML regulations.

However, notwithstanding Secretary Mnuchin's comment regarding "the same obligation as a bank," the AML regulations that apply to MSBs are less extensive than those applicable to banks. In fact, AML obligations applicable to virtual currency businesses often can be discharged with a reasonably short AML policy and attendant compliance measures.

Failing to discharge the obligations that do apply, however, can lead to severe penalties. The U.S. government has arrested and charged individuals for AML violations in the virtual currency space and has fined one virtual currency business more than $100 million for its failure to comply with applicable AML rules. AML officials, including Secretary Mnuchin and others, have made clear that AML enforcement in the virtual currency industry is a U.S. government priority.

Money Laundering, the Bank Secrecy Act, and Money Services Businesses

The term "money laundering" is formally defined by several complex provisions in the U.S. criminal code, particularly 18 U.S.C. Sections 1956 and 1957. The term is used more casually to mean conducting transactions to conceal the criminal origins of money, i.e., to conduct transactions with "dirty" (criminally derived) money so that it appears "clean."

In addition to the criminal prohibition, there are many AML regulations that apply primarily to "financial institutions." The AML regulations generally require pro-active measures to ensure that financial institutions are not used for money laundering.

The Bank Secrecy Act (BSA) is the primary federal statute that imposes AML obligations on financial institutions.² Acting under the BSA, the U.S. Treasury Department's primary AML arm, the Financial Crimes Enforcement Network (FinCEN), issues and enforces AML regulations, often in conjunction with other agencies.

There are many categories of financial institutions for which AML obligations are prescribed by the BSA and its implementing regulations. These include banks, securities brokers and dealers, mutual funds, and other businesses that fit a common understanding of the term "financial institution." There are many other types of businesses, however, that might not commonly be perceived as financial institutions but may be classified as such under the BSA. These include card clubs, casinos, and MSBs.

The MSB category applies to anyone doing business "wholly or in substantial part" in the U.S. that falls within one or more subcategories, notably including a "money transmitter."³ Helpfully, FinCEN has clarified that certain other MSB subcategories, such as "dealer in foreign exchange" and providers and sellers of "prepaid access" generally do not cover virtual currency businesses because both of these other subcategories are concerned exclusively with real currencies, not virtual currencies.⁴ In addition, the MSB definition states that a person who is registered with the SEC or CFTC (or analogous foreign financial agency) is not an MSB.

"Money Transmitter" Definition and Other Key MSB Provisions

The most likely reason that a virtual currency business would be categorized as an MSB, and therefore subject to AML rules, is that the business acts as a "money transmitter."

A "money transmitter" is a person or company that provides "money transmission services," or "[a]ny other person engaged in the transfer of funds."⁵

The key jargon here is "money transmission services." Such services are defined as follows:

The acceptance of currency, funds, or other value that substitutes for currency from one person and the transmission of currency, funds, or other value that substitutes for currency to another location or person by any means.⁶

This is a broad and abstract definition, but FinCEN has provided some contextualized guidance by highlighting three categories of participants in the virtual currency industry: (1) users; (2) exchangers; and (3) administrators.⁷

"Users"—those that merely use virtual currency to purchase real or virtual goods or services on the user's own behalf—are not money transmitters according to FinCEN. Further, FinCEN has stated that "miners" of virtual currency are "users," as long as miners use the virtual currency solely for their own purposes and not for the benefit of someone else.⁸ Similarly, a person who produces software to facilitate virtual currency purchase or sale for that person's own purposes (not for the benefit or use by another party) is not a money transmitter.⁹

On the other hand, "exchangers" and "administrators" may be considered money transmitters.¹⁰ An "exchanger" is a person "engaged as a business in the exchange of virtual currency for real currency, funds, or other virtual currency." An "administrator" of virtual currency is a person "engaged as a business in issuing (putting into circulation) a virtual currency, and who has the authority to redeem (to withdraw from circulation) such virtual currency."

To summarize:

• If a person merely uses virtual currency on her or his own behalf or a person mines virtual currency and the same person (the miner) uses it, these activities generally do not make the person a money transmitter.
• If a person exchanges virtual currency for real currency or other virtual currency, and that exchange is the person's business (as opposed to a transaction that is attendant to the person's business, such as the sale of products), then that person may be a money transmitter.
• If a person is an administrator of virtual currency, meaning issuing virtual currency that is used by others and retaining the potential to redeem or withdraw it, and such activity constitutes the person's business, then that person may be a money transmitter.

This is not to say that all virtual currency businesses are the same. Some virtual currency businesses may not be involved in money transmission services, may be in very early development stages, may only deal in securities or commodities, or otherwise may not meet the definition of a money transmitter. To determine whether a particular virtual currency business is a money transmitter is a fact-intensive inquiry and warrants a nuanced review and analysis. That being said, as noted in FinCEN guidance, a virtual currency business that is an exchanger or administrator of virtual currencies (as defined above) raises a significant likelihood that FinCEN would consider it an MSB and, as such, subject to certain AML obligations.¹¹ What are those obligations? We briefly outline the requirements in the next section.

AML Compliance Program Requirements for Money Transmitter MSBs

A money transmitter, as a subcategory of MSB, generally is required to implement AML requirements that apply to MSBs. Money transmitters generally must have a written compliance policy that helps to ensure the following:

• FinCEN registration and renewal;
• Maintenance of a list of agents employed by the MSB, if any;
• Appointment of an AML Compliance Officer;
• AML training for relevant personnel;
• Periodic testing of the AML policy;
• Know Your Customer (KYC) procedures commensurate with the money laundering risks faced by the money transmitter; but note that rigid customer identification and verification rules of the type applicable to banks generally do not apply to money transmitters;
• Reporting suspicious activity; and
• General recordkeeping requirements (five years).

The provisions above are core provisions that any money transmitter should include in its AML program. In addition, depending on the circumstances, the AML program might include additional provisions such as the following:

• Reporting certain cash transactions (often not applicable);
• Recording, identity verification, and reporting of funds transfers over $3,000;
• "Log" for cash purchases of money orders and travelers checks (often not applicable); and
• Recording of certain real currency exchanges in excess of $1,000 (often not applicable).

Not all of these requirements will be required for every virtual currency business, but those in the virtual currency industry should conduct a review to determine whether AML obligations are applicable. If so, a written AML policy, and compliance efforts consistent with that policy, will be needed to discharge those obligations.

Virtual Currency AML Enforcement

There is more than bark in the recent emphasis by U.S. regulators regarding virtual currency AML compliance: there have been several instances of virtual currency businesses getting caught in the web of AML enforcement.

The enforcement action against Ripple Labs was one of the first significant enforcement actions.¹² On May 5, 2015, FinCEN assessed a $700,000 civil monetary penalty against Ripple and its wholly-owned subsidiary, XRP II. FinCEN found that Ripple "willfully violated several requirements of the BSA by acting as an MSB and selling its virtual currency—known as XRP—without registering with FinCEN, and by failing to implement and maintain an adequate AML program designed to protect its products from use by money launderers or terrorist financiers."¹³

If that was a ripple, FinCEN's enforcement action against BTC-e was a tidal wave. On July 26, 2017, FinCEN assessed a civil monetary penalty of nearly $110 million against Canton Business Corporation, more widely known as the virtual currency exchange BTC-e, and a $12 million penalty against Alexander Vinnik, a Russian national who allegedly controlled BTC e's operations, finances, and accounts.¹⁴ On the same day, a 21-count criminal indictment against BTC-e and Vinnik was unsealed, and Vinnik was arrested in Greece.

According to FinCEN, BTC-e lacked internal controls to ensure its services were not used for illegal purposes and, as a result, facilitated money laundering by individuals engaged in cyber-hacking and ransoms, fraud, identity theft, tax refund fraud schemes, public corruption, and drug trafficking. BTC-e did not report any of these suspicious activities to FinCEN or law enforcement. Ultimately, FinCEN found that BTC-e violated several AML requirements by failing to: (1) register as an MSB; (2) maintain an effective AML compliance program; (3) file suspicious activity reports; and (4) keep transaction records.

More recently, on February 9, 2018, the CEO of Bitcoins Inc. was arrested by the U.S. Department of Homeland Security for criminal violations of the AML laws.¹⁵ Several other individuals in Michigan, Missouri, and New York have been arrested for operating independent unregistered bitcoin operations.¹⁶

These enforcements actions of both a civil and criminal nature against virtual currency businesses and individuals reflect an enforcement focus on the virtual currency industry. Indeed, in a recent interview, Treasury Secretary Mnuchin said that his "No. 1 focus on cryptocurrencies, whether that be digital currencies or bitcoin or other things, is that we want to make sure that they're not used for illicit activities."¹⁷

The industry is on notice: any virtual currency business needs to determine whether it is classified as a money transmitter—likely the case for any virtual currency exchanger or administrator—in which case the business generally is required to register with FinCEN and develop an AML compliance program. As is now apparent, failure to do so may give rise to significant civil and even criminal liability.