By Marco Santori

 Marco Santori is a business attorney for technology companies. In particular, represents digital currency businesses. Santori is the Chairman of the Bitcoin Foundation’s Regulatory Affairs Committee. Presents here a basic primer on the state of US law as it applies to digital currency entrepreneurs. The aim is to help bitcoin businesses assess their risks and develop an informed business model. marco.santori@pillsburylaw.com.

Bitcoin businesses are in a tough spot. Payment startups that once coasted quietly under the regulatory radar are becoming bright, interesting new blips on government monitors. 22 companies involved in bitcoin were subpoenaed by the state of New York earlier this week; a US judge ruled that bitcoin is a form of money; and the Bitcoin Foundation received a cease and desist letter from the state of California.

If the last few months have taught us anything, it is that there will soon exist a new and evolving body of law: The Law of Digital Currency, or, as some would prefer it: Bitcoin Law.

I will explain, using examples from my own practice and the industry at large, how businesses have been affected by recent US regulation on a granular level. Perhaps most importantly, I’ll set forth some strategies for efficiently complying with those regulations, and for avoiding them altogether.

I will use “digital currency”, “virtual currency” and “bitcoin” interchangeably here, though I acknowledge that bitcoin is only one type of digital currency, that “virtual currency” is something of a loaded term, and that bitcoin may not even be best described as a currency at all.

What regulation is involved?

What digital businesses are affected by US regulation? At minimum, businesses either physically located in the United States, servicing US customers, or sometimes merely soliciting US customers, are governed principally by two regimes: money transmitter regulation (enforced by the Department of the Treasury) and securities regulation (enforced by the Securities and Exchange Commission).

The consensus among legal professionals is that two more government agencies might soon have a hand in the market as well: the Commodity Futures Trading Commission and the Consumer Financial Protection Bureau. This primer will address each of the realities as they stand today, and some possibilities of what the regulation might be tomorrow.

The first regime, and the regime that has received the most press over the past few months, is the law of money transmission. The classic description of a money transmitter is a business, Business A, that accepts money from Person B and transmits that money to Person C, either at a later time or a different place.

Western Union’s services are well-known examples. In the United States, compliance with money transmission law means compliance with both federal government and state government regulations. In this part of the primer, I’ll address the federal level.

Money transmission on the federal level

The Financial Crimes Enforcement Network (“FinCEN”) is the bureau of the US Department of the Treasury that enforces federal regulation of money services businesses in the United States.

On March 18, 2013, FinCEN published guidance announcing that it would make no distinction between transmitters of government (or “fiat”) currency and transmitters of bitcoin, which it now famously referred to as a “decentralized convertible virtual currency”, rather than by name itself.

Thus, businesses that transmitted, sold or exchanged bitcoin were now Money Services Businesses, specifically “money transmitters”, required to register with FinCEN and satisfy ongoing record-keeping and reporting requirements. From the perspective of the federal government, an entire industry of visionary startups that had not already registered, and had no intention of registering, became potential criminal enterprises overnight.

As you might imagine, this announcement was an earth-shattering development for the digital currency space. Some have called it bitcoin’s “watershed moment” because of its clear, unequivocal positive message: bitcoin is not illegal. The negative consequence, though, was just as obvious: Many bitcoin businesses models are illegal.

Some aspects of the FinCEN guidance were comforting. Some were troubling. Some were death knells for otherwise successful businesses. Some could only be described as confusing. Here are the highlights:

• Individuals who merely exchange bitcoin for goods and services (and vice versa) are merely “users” of a virtual currency, not money transmitters.
• Businesses that accept bitcoin from one person and send it to another are money transmitters, and are not exempt from money transmission regulation simply because they do not deal in fiat currency.
• Individual bitcoin miners who convert their “created” coins to fiat are money transmitters, even though they never act “as a business,” nor accept value from one person to transfer it to a third person.
• Any business that exchanges fiat currency for virtual currency – or even one virtual currency for another – is a money transmitter.

Struggling with this guidance, many bitcoin entrepreneurs have understandably felt like modern square pegs being jammed into round regulatory holes meant for ancient business models. Take mining for example.

The guidance did not specifically use the term “miners”, and, as we all know, miners don’t actually “create” bitcoins. The coins are awarded by the network itself.

Nonetheless, the guidance seems to be referring to miners, and miners – especially those large miners pushing multiple terahashes through the network – are right to worry that they could be classified as money transmitters. The (albeit anecdotal) consensus among legal professionals is that despite the terminological confusion, FinCEN did, in fact, mean to specifically call out miners.

There is another level of confusion: miners don’t actually transmit anything, except presumably when they exchange their mined coins for fiat. But how does having mined the coins make miners any more of a “transmitter” than anyone else who exchanges coins for fiat? The guidance does not defend this point in any detail.

As if that wasn’t enough, the FinCEN guidance states that all “persons”, not just businesses, who exchange their mined coins for fiat are money transmitters. This is contrary to the basic premise that operating “as a business” is the fundamental predicate for the definition of a Money Services Business. The guidance’s treatment of individual miners is only one example of the round peg, square hole problem endemic to the federal treatment of the industry.

The consequences of money transmitter classification

Because money transmission is such a heavily regulated business, classification as a money transmitter – especially unwitting classification – comes with real legal and practical consequences.

FinCEN regulates money transmitters pursuant to a legislative framework commonly referred to as the Bank Secrecy Act (“BSA”), which includes elements of the Patriot Act and other pieces of legislation. The primary consequence of this regulation is that money transmitters must put in place and enforce Anti Money Laundering (“AML”) and Know Your Customer (“KYC”) policies designed to aid FinCEN’s investigation of potential criminal activity.

The specific AML and KYC requirements of the BSA could (and do!) fill pages. But in short strokes, businesses must collect personally identifying information about their customers, in some circumstances report that information to FinCEN, and sometimes even outright deny service.

Suspicious transactions – or even ministerial transactions over a certain dollar amount – must be reported to FinCEN. In effect, the BSA deputizes financial institutions, requiring them to act as the government’s foot soldiers in its war on money laundering.

It’s clear why this is a problem for a bitcoin business: privacy (if not anonymity) is one of bitcoin’s most popular features. A business that identifies its customers and then reports that identity to the government simply can’t cater to the significant swathe of customers who want to keep that identity a secret.

Moreover, the reporting requirements add a level of cost and complexity to many business models. For example, imagine an ATM-type vending machine that dispenses bitcoins or other digital currency. Before the FinCEN guidance, a company looking to roll out a network of such machines in the US could have reasonably catered to customers who were strangers: anyone walking up to the machine could see the machine, purchase bitcoin, and walk away with their coin in a matter of seconds.

After the FinCEN guidance, though, we now know that this wouldn’t be so simple. Regulators have dismissively referred to this product as a “laundry machine” – as in money “laundering”.

The guidance made clear that a business exchanging fiat for digital currency is a kind of money transmitter. Thus, the business must collect personally identifying information from the customer before entering into the transaction.

At minimum, the business must collect, record, and sometimes verify the customer’s name, address and telephone number. In the cases of international or otherwise “high-risk” clients, the business must take even more stringent identification measures.

Instead of catering to a broad customer base (anyone walking up to the machine), the company can only service customers who are pre-authorized and pre-cleared against multiple government watch lists – a significant hurdle for a fledgling product. Accordingly, some businesses simply chose not to register with FinCEN.

Those that didn’t register

So it went with Mutum Sigillum. Mutum Sigillum was a US subsidiary of Mt. Gox, the popular digital currency exchange based in Japan that exchanges bitcoins for dollars and other currencies.

Mutum Sigillum allegedly used a US bank account to accept dollars from US customers and send them to Mt. Gox (MT. Gox has since be disbanded due to bitcoin theft) to fund trades on its exchange. Customers could then use Mutum Sigillum’s service to transfer dollars from Mt. Gox back to themselves in the US. In its most simplified form, its business was accepting funds from Person A, a customer, holding them temporarily, transmitting them to Person B, Mt. Gox, and back again

As I mentioned above, this is classic money transmission. Yet Mutum Sigillum allegedly did not register with FinCEN (although Mt. Gox since has), nor did it collect or report the required AML/KYC information. In fact, it allegedly lied on its bank account application, failing to disclose that it was engaged in such a business.

On May 14, 2013 the Department of Homeland Security, acting in concert with FinCEN, seized the US assets of Mutum Sigillum and shuttered its business.

Liberty Reserve didn’t register either. Liberty Reserve was a Costa Rican payment processor that did not use bitcoin, but did use its own form of centralized digital currency called “Liberty Reserve Dollars”. One of its services was accepting funds from Customer A, holding those funds, and then distributing them to Customer B at Customer A’s direction using Liberty Reserve Dollars.

Like Mutum Sigillum’s business, this was also a classic example of money transmission. It serviced customers across the globe, including the United States, without collecting any of the information or making any of the reports required under the BSA.

In May, 2013, the US federal government seized the Liberty Reserve website and shut down its business, citing, among other things, its operation as an unlicensed money transmitter.

Liberty Reserve and Mutum Sigillum teach us that the penalties for failing to register with FinCEN are real. Yet comparatively speaking, the upfront costs of registration are nil. Registration primarily consists of filling out forms and clicking some buttons on FinCEN’s website. The entire affair is over in a matter of minutes. The catch? In addition to requiring registration and the implementation of its own AML and KYC policies, federal law also punishes bitcoin businesses that violate the money transmitter licensing laws of any of the United States.

Contrast this mere “registration” with full-blown “licensure”, which is required by state regulators. In the US, a business must comply with federal regulation and obtain licensure in any state whose regulation requires it.

A money transmission license is not a right, but a privilege. Whether any particular state will consider a business worthy of such a privilege depends entirely on the state in question. This makes tricky business of planning a nationwide rollout.

In the US, a business must comply with federal regulation and obtain licensure in any state whose regulation requires it.

Must my digital currency business be licensed?

Just because your business is considered a money transmitter by the federal government does not necessarily mean it will be classified as such in any particular state.

At minimum, we know that two states do not require money transmission licensure: South Carolina and Montana. A third, New Mexico, only regulates negotiable instruments, a category which, so far, has not been applied to bitcoin.

Washington, D.C., though not technically its own state, does have licensing requirements. Unfortunately, the regulatory waters only get murkier from there. State regulatory bodies have offered little, if any, guidance to bitcoin businesses.

In fact, the most helpful information they have provided is not bitcoin-specific at all. It has to do with a legal principal called “extraterritorial jurisdiction”: some state regulatory bodies have announced that any business servicing or soliciting its state’s citizens must satisfy that state’s licensing requirements, even if the business has no physical presence in that state. This is true whether the business is physically located in a different state, a foreign country, or is as a web service with no physical presence at all.

This principle has special applicability to bitcoin businesses.

Decentralized digital currency is, by design, a borderless medium of exchange. Most bitcoin businesses exist on the internet, where the state of its incorporation and the citizenship of its clientele are all but irrelevant.

A bitcoin business located in New York likely services each of its customers in much the same way, whether that customer lives in New York, Nevada, Nigeria or Norway.

Thus, a bitcoin business planning to service all United States customers must address a dizzying array of state-by-state licensing regimes. Since every bitcoin business is different, determining whether a business must be licensed as a money transmitter in any particular state is critical.

There are at least two procedures – often used in combination – to determine whether a state will require money transmitter licensure.

The first is a state-by-state survey, whereby an attorney reviews the statutes and cases treating money transmission in the states that the company will do business.

Thus, a bitcoin business planning to service all United States customers must address a dizzying array of state-by-state licensing regimes.

The attorney compares the business plan to the rules and produces a risk assessment for each state. Unfortunately, no state’s laws mention bitcoin or any other digital currency. The statutes are archaic. Many were conceived and drafted prior to the invention of the floppy disk, and were never intended to address anything more exotic than a wire transfer.

The men who crafted these laws never considered that a computer could slip into a backpack, let alone store millions of dollars in convertible value.

To give a concrete example, New York’s state money transmission laws require that money transmitters be licensed, but do not even bother defining “money”. In fact, they do not even define “money transmission.”

After all, when the state money transmission laws were written, everyone knew what money was, so a definition wasn’t necessary. Times have changed.

Since no bitcoin-specific guidance has yet been published by any state regulator as to how (or whether) its state’s money transmitter laws apply to digital currency, the “round peg, square hole” problem demonstrated by the FinCEN guidance on the federal level is even more pronounced for businesses looking to comply with state money transmitter law.

Your attorney may be able to analyze the laws and give an interpretation of how they might apply to your business, but that does not mean that a state regulator will interpret it the same way. Thus, a lawyer’s survey cannot offer absolute certainty. It offers a risk assessment. It does, though, have the benefit of being relatively inexpensive compared to the other alternatives.

One of those alternatives is a “no-action” letter campaign, also known as a “request for ruling”. The attorney drafts letters to each state’s regulator describing the client’s proposed business process, and stating a position on how the state’s laws should apply to the process.

Make no mistake, the function of this letter is not merely education; it is advocacy. A request for ruling must, of course, accurately describe the business plan. However, it also cites the relevant law and aims to explain to the regulator why, under that law, the business should not require a license.

If the letter is successful, the regulators will agree, and issue a response stating that the state will take “no action” to enforce the licensure requirements on the business. Thus, the letter campaign has the benefit of greater certainty as to the risk of enforcement.

Unlike a survey, though, it is time and resource-consuming. State regulatory bodies often have no obligation to respond to such letters (i) in a timely fashion, (ii) without lengthy follow-up, or (iii) at all.

Will my digital currency business be granted a license?

Whereas FinCEN regulators see themselves as money laundering preventers, state regulators see themselves as consumer protectors.

Just because a business must be licensed does not guarantee that it will be licensed.

Money transmission in the US is a privilege, not a right, and many states will simply refuse to approve an application. The application process itself is rigorous, and appropriately so. Money transmitters are, in many instances, the only financial services to which many of the unbanked or under-banked in our society have access.

Whereas FinCEN regulators see themselves as money laundering preventers, state regulators see themselves as consumer protectors.

Thus, the application process is affectionately known among industry professionals as the “financial colonoscopy”. Here is a taste of some of the information New York’s Department of Financial Services will request from an aspiring money transmitter:

• Audited financial statements of the applicant business and any subsidiaries
• Personal financial records of all directors, principal officers, owner or 10% shareholders (“Control Persons”)
• Records of occupations for all Control Persons for the last fifteen years, including any disciplinary actions taken by any employer
• List of all lawsuits or criminal complaints against any Control Person in the last fifteen years
• Third-party criminal and civil background checks
• Marital, divorce and familial records, including names of dependents of Control Persons
• Fingerprints of Control Persons

In addition to the disclosure requirements, the financial obligations are substantial. A New York money transmitter must carry at least a $500,000 surety bond, and bonding agents will require a recurring yearly payment of 2-10% of the total bond amount, depending on the personal credit rating of the bond’s guarantor.

An applicant must also satisfy minimum capitalization requirements that push well into the six figures. Add to that the cost of annual reporting, record-keeping, audits and legal fees. It should come as no surprise that (i) the costs of licensure, combined with (ii) the uncertainty of whether licensure is even required in the first instance, drive some businesses to not apply at all.

What if my business operates without a license?

Rather than run a potentially illegal service, Tangible Cryptography voluntarily shuttered its business. As of the time of this writing, it is still not operational in Virginia.

Tangible Cryptography is a company based in Virginia that operated a popular bitcoin purchasing service called FastCash4Bitcoins. The company registered with FinCEN as a money transmitter, but did not seek a money transmitter license in Virginia. FastCash4Bitcoins purchased bitcoin from its customers for a fee. This service provided liquidity and transferability in the digital currency markets.

As a US business, it also provided the comfort, reliability and customer service that foreign exchanges were simply not offering. In May of 2013, Tangible Cryptography received a letter from the Virginia Corporation Commission. The letter stated that FastCash4Bitcoins’ service might constitute “selling or issuing stored value” under Virginia law, and therefore require a money transmitter license.

Rather than run a potentially illegal service, Tangible Cryptography voluntarily shuttered its business. As of the time of this writing, it is still not operational in Virginia.

In New York, the state Department of Financial Services (“DFS”) is the government body empowered to license and regulate money transmitters. This August, the DFS fired over twenty subpoenas in something of a scattershot pattern across the bitcoin industry.

The recipients included institutional investors like Union Square Ventures, incubators like Boost VC bitcoin fund and hardware sellers like Butterfly Labs – businesses that were not even arguably regulated by the DFS as money transmitters.

Other subpoena recipients, however, like BitInstant and Coinbase, provide money transmission services to their customers in a very traditional sense: they take value from person A, their customer, and transmit it to person B at a different place or later time.

The subpoenas were onerous, demanding over twenty broad categories of documents like:

“Documents sufficient to show all affiliates, agents, merchants, consultants, distributors, vendors, partners, and entities with whom you do business (including but not limited to contracts, agreements, and arrangements) regarding virtual currency.”

-and-

“All documents concerning offering materials, presentations, pitchbooks, marketing materials, investor solicitations, financing materials, funding requests, or approval memoranda in connection with your virtual currency products or services.”

The legal costs of responding to such a subpoena could run well into the tens of thousands of dollars for some businesses. For those businesses that never even arguably engaged in money transmission, the subpoena was a five-figure headache.

For those engaging in money transmission without a license, though, it was an aneurism. In New York, the violation of the money transmission licensing laws is punishable by prison time, potentially up to four years per violation. For a high frequency bitcoin exchange, that can add up quickly.

I opened this Part II by stating, albeit somewhat flippantly, that the state level is where the action is. Indeed, it is where the action has always been.

State-by-state licensure is an old problem – one that traditional money transmitters like Western Union and Moneygram have been grappling with for years. Now that digital currency businesses are falling victim to the same risks and uncertainties, it couldn’t be truer.

Compliance and Avoidance Strategies

You can seek licenses, but it’s expensive

The first and most obvious option for complying with state and federal requirements is to register with FinCEN and seek licenses from each of the states in which your customers reside.

Registration with FinCEN is a fairly simple exercise: 15 minutes and a few mouse clicks on FinCEN’s website will satisfy that obligation. The real burden here comes from the ongoing costs of compliance, like verifying customer information and filing Suspicious Activity Reports.

Likewise, compliance on the state level is expensive.

The up-front costs alone of obtaining 48 state money transmission licenses can exceed six-figures for some applicants. On top of that, satisfying the ongoing state requirements is a business unto itself.

You can avoid US customers, but it takes work

Plenty of businesses, some of my own clients included, have decided that the US market just isn’t for them.

They’ve either soured on the idea of servicing US clients altogether, or have decided to launch and wait it out in jurisdictions like Canada until the US sees regulatory reform.

This can be both profitable and practical, but simply incorporating the overseas market isn’t going to cut it.

The smart business will develop a set of policies and procedures reasonably calculated to keep US residents out. A competent attorney can help guide you through this process, and I can give some very basic principles here.

Firstly, a pre-emptive response to a question I get asked weekly: geofiltering incoming IP addresses is only the beginning. The business itself should detect the jurisdiction of the customer’s IP address, display that address, and ask the customer to confirm that this is his or her jurisdiction.

Both customer and business can take affirmative steps: the customer can be required to click a button stating “I affirm that I am a resident of *country*,” and the business can require verifying documentation, like a passport or utility bill.

Several providers offer these kinds of onboarding services. Your business should develop a risk profile for each of its customers in real time setting forth the probability that the customer is a US resident.

The risk profile should take into account different factors like: (i) whether the customer registers a US bank account with your business, (ii) how many transfers to US bank accounts the customer requests (if you offer such a service), and (iii) how many times the customer accesses your service from within the US after setting up a new account.

“The answer to the question: “Am I a payment processor?” is not always obvious, and even then, not all business owners necessarily want to know the answer for sure. After all, the answer might be “no”.”

A customer whose activities, over time, start to resemble those of a US resident, might be a US resident – and your business should consider closing that customer’s account.

Once these policies are in place, your business should implement them and record the results in case of future enforcement by a US regulatory body.

The record shouldn’t just show that your business followed its own policies, but that those policies worked. If push comes to shove, a judge and jury would probably like to see that, every once in a while, your procedures actually caught a US resident trying to use your service, and that you closed his or her account.

Finally, it should go without saying that your business should not advertise to US customers. This all might seem excessive for, or inapplicable to, your business and indeed it might be. The proper set of procedures will depend heavily upon the details of your business model and your degree of risk tolerance.

For some, even crafting and implementing these policies may be just as unappetising as compliance. There is, in fact, a way to service US customers and avoid these burdens.

Namely, you can become the agent of a Bank or Credit Union, as existing MSB Certified agents of banks, credit unions and money services businesses are typically exempt from registration and licensure requirements.

Functionally, becoming an agent means hiring an attorney to negotiate and execute an agreement with the bank, credit union or MSB (called the “principal”) setting forth your relative rights and obligations.

Becoming an agent implies two important consequences. First, you will lose some control over your business. As the agent, you will act at the principal’s direction. The principal will likely possess more leverage in the negotiation of the agreement and its performance.

Second, you will not avoid the compliance requirements altogether. To be sure, your business won’t need to seek out state licenses or to register with FinCEN, but it will still have to comply with any anti-money laundering and know your customer (KYC) requirements put in place by the principal.

Furthermore, your business will need to implement those requirements in the way the principal wants them implemented – which may or may not map onto your business plan.

For a digital currency business, an agency relationship might be difficult to find.

Existing money transmitter license holders are wary of alienating their current agents by signing on an untested and exotic digital currency business.

Worse, banks and credit unions have yet to develop a compliance program properly tailored to digital currency technology. If no existing licensee is interested, or the ongoing costs of compliance are still too high, not all is lost.

Your business model can fit into an exception, or avoid the MSB rules entirely

There are several exceptions to the MSB registration requirements. The most popular – at least in my experience – are the so-called “payment processor” exemptions.

Businesses that merely perform payment processing services for a merchant are exempt from registration with FinCEN, even though they otherwise fit the definition of a money transmitter. These businesses can thrive in the digital currency ecosystem without ever having to verify their customer’s identifying information or file a Suspicious Activity Report.

The answer to the question: “Am I a payment processor?” is not always obvious, and even then, not all business owners necessarily want to know the answer for sure. After all, the answer might be “no”.

To the attorney’s lament, many clients would prefer to beg forgiveness rather than ask permission. For those who value peace of mind, though, the best way to find out is for your attorney to prepare a “request for ruling” to FinCEN and ask them directly.

I talked about this process in the context of state regulatory bodies in part two, but the same is true for the federal regulators at FinCEN.

Sometimes better than fitting into an exception, some digital businesses have found success in avoiding the money transmission regime entirely. They accomplish this by carefully structuring their business model to avoid the common characteristics of money transmission.

The real-world permutations here are literally infinite, but two simplistic examples might be helpful.

Firstly, a business that would otherwise be a payment processor, but also offers hosted wallet functionality, might offload that responsibility to a third party, or require the customer to provide his own wallet address.

Secondly, an institutional bitcoin miner might, instead of selling his mined bitcoins for dollars, sell his hashing power in bulk to customers who can either hold their mined coins or sell them for dollars themselves.

Another very specific example of adjusting a business model to comply with regulation is a time-tested practice: pass the buck to someone else.

You can white label your product

A bitcoin ATM manufactured by Lamassu, but operated by Safello.

You’ve probably heard of white labeling. It means developing your product to completion and bringing it to the cusp of launch, but instead of dealing with the regulation required to use it, selling it or licensing it to someone else.

This has the effect of passing the regulatory burden onto the customer and can be successful whether your product is hardware or software. For example, the manufacturer of a Bitcoin ATM machine need not operate it. The manufacturer can successfully sell machines to a third party who will plug it in, collect the cash and deal with the regulatory worries.

The same is true for developers of Bitcoin exchange software. Developers can always operate the exchange in-house under its own brand and manage the regulatory risk.

Alternatively, it can license the exchange Software As A Service (you’ve probably heard the expression “SAAS”) to a third party in a jurisdiction with less stringent regulatory requirements. A competent attorney can guide your business through this process, and prepare the contracts required to get the job done correctly.

This completes the Bitcoin money transmission trilogy.

In part one, we learned about the federal requirements for money transmitters. In part two, we discussed how state money transmission laws could make or break a digital currency business. In this article, part three, we canvassed some strategies for complying with and avoiding those requirements.

Marco Santori is a business attorney in New York City with Pillsbury Winthrop Shaw Pittman LLP. He is a lawyer, but he is not your lawyer, and this is not legal advice. You can reach Marco at marco.santori@pillsburylaw.com.