Keith Barnett and Carlin McCrory discuss the latest FinCEN and OFAC guidance on virtual currency transactions, specifically tailored for companies in the payments industry.
In the latest episode of Payments Pros, hosts Keith Barnett and Carlin McCrory discuss the latest FinCEN and OFAC guidance on virtual currency transactions, specifically tailored for companies in the payments industry. They explore when businesses need to register as money services businesses (MSBs) under federal law and discuss the roles of users, exchangers, and administrators of virtual currencies. Carlin provides a detailed look at the regulatory requirements for both centralized and decentralized virtual currencies.
Keith then shifts the focus to OFAC's expectations for screening virtual currency transactions, emphasizing the importance of compliance with sanctions regulations. He explains the need for a risk-based OFAC sanctions compliance program to avoid prohibited transactions.
This episode provides valuable insights for payments companies navigating the complex virtual currency landscape.
Payments Pros – The Payments Law Podcast — Virtual Currency Regulations: Key Insights for the Payments Industry
Host: Keith Barnett and Carlin McCrory
Aired: March 19, 2025
Keith Barnett:
Welcome to another episode of Payments Pros, a Troutman Pepper Locke Podcast, focusing on the highly regulated and ever-evolving payment processing industry. This podcast features insights from members of our FinTech and payments practice, as well as guest commentary from business leaders and regulatory experts in the payments industry. My name is Keith Barnett, and I’m one of the hosts of the podcast.
Before we jump into today's episode, let me remind you to visit and subscribe to our blog, TroutmanFinancialServices.com. And don't forget to check out our other podcasts on troutman.com/podcasts. We have episodes that focus on trends that drive enforcement activity, digital assets, consumer financial services, and more. Make sure to subscribe to hear the latest episodes.
Today, I'm joined by my colleague, Carlin McCrory to delve into the FinCEN and OFAC guidance on virtual currency transactions. We will explore when a company engaging in these transactions is conferred to be engaging in money transmission. And therefore, must be registered as a money services business under federal law. And, we will also discuss the types of screening that OFAC expects with respect to these transactions, irrespective of whether someone's a money services business. Carlin, thank you for joining me today. Let's get started.
Carlin McCrory:
Thanks, Keith. Looking forward to our conversation today. So, I'll kick off with a little bit of background, which is back in July of 2011, FinCEN published a final rule, which amended their definitions and other regulations relating to money services businesses. Subsequently, in 2013, FinCEN issued some guidance related to who must be registered as an MSB and comply with the related requirements.
Just to give some background and a little bit of definitions to explain some of the guidance. I'll go into detail on that. First, being the definition of a user, which is a person that obtains virtual currency to purchase goods or services. This 2013 guidance also defines an exchanger as a person engaged in a business in the exchange of virtual currency for real currency funds or other virtual currency. And lastly, an administrator is a person engaged as a business in issuing or putting into circulation a virtual currency and who has the authority to redeem or to withdraw from circulation the virtual currency.
A user is basically anyone who obtains convertible virtual currency, CVC, and uses it to purchase real, or virtual goods, or services. Users are not MSBs under FinCEN regulations. However, there are certain circumstances and situations where administrators and exchangers must be registered as MSB. However, there are certain circumstances where administrators and exchangers must be registered as MSBs. An administrator or an exchanger that accepts or transmits a CVC or that buys or sells CVC for any reason is a money transmitter under FinCEN's regulations, unless a limitation or an exemption from the definition applies.
Generally speaking, which many of us know, FinCEN's regulations define the term money transmitter as a person that provides money transmission services for any other person engaged in the transfer of funds. The term, money transmission services means the acceptance of currency funds or other values from one person in the transmission of the currency funds or other value that substitutes for currency to another location or person. Basically, what it requires is both the acceptance and transmission of funds in order to be considered money transmission services. The definition of a money transmitter doesn't depend on whether the currency is real, or fiat currency, or a type of virtual currency.
Back in the 2013 guidance, FinCEN went over different types of currencies and what may be required to be registered as an MSB. So, I'll kick off with talking about centralized convertible virtual currencies. The administrator of any sort of repository will be a money transmitter to the extent that it allows transfers between persons from one location to another. So, that would be both the acceptance and the transmission. For any exchanger that uses its access to the CVC services provided by the administrator to accept and transmit the CVC on behalf of others will also be a money transmitter under FinCEN's regulations.
FinCEN posits that the exchanger's activities may take one or two forms. The first form involves the exchanger acting as that seller of CVC that accepts the real currency or its equivalent from the user and transmits the value of the currency to fund the user's CVC account with the administrator. Under FinCEN's regulations, sending that value that substitutes for currency to another person or location constitutes money transmission, unless there's an exemption.
Under this circumstance, there will be transmission to another location, namely from the user's account to the user's CV C account with the administrator. While it might be argued that the exchanger is entitled to the exemption from the definition of money transmitter for persons involved in the sale of goods or the provisions of services, this argument doesn't carry any water for FinCEN because the exemption doesn't apply when the only services being provided are money transmission services.
The second form of exchanger activities involve a sale of CVC that is not completely transparent. So, the exchanger could accept currency or its equivalent from its user and privately credit the user with an appropriate portion of the exchanger's own CVC held with the administrator. The exchanger then transmits this internally credited value to third parties at the user's discretion. To the extent that the CVC is a substitute for real currency and it's the acceptance in transmission of funds, this will also be considered money transmission and require registration.
The second type of virtual currencies that the FinCEN guidance discusses is decentralized CVCs. So, this is a virtual currency that has no central repository and no single administrator. And that person may obtain by their own computing or manufacturing effort. So, a person that creates units of this type of CVC and uses it to purchase real or virtual goods or services is considered the user of the CVC and not subject to regulation as a money transmitter. However, in contrast, a person that creates these units of CVC and then sells the units to another person for real currency or its equivalent is engaged in money transmission to another location and will be considered a money transmitter.
In addition, if a person is an exchanger and a money transmitter, if the person accepts such decentralized CVC from one person and transmits it to another person as part of the acceptance and transfer of currency or funds, that person is a money transmitter. FinCEN has also clarified that this cannot be considered this providing or selling of prepaid access because prepaid access is limited to real currencies.
I now kind of want to transition to the 2019 FinCEN guidance and a few of the items that that guidance discusses. The first being, peer-to-peer or P2P exchangers, who are typically natural persons engaged in the business of buying and selling CVCs. These P2P exchangers generally advertise and market their services through advertisements or any ads designed on platform websites or forums. These exchangers facilitate transfers from one type of CVC to a different type of CVC, or these could be different exchanges between CVC and other types of monetary instruments or fiat.
Generally, once there is a confirmation that the buyer has delivered or deposited the requested currency or CVC, the P2P exchanger will electronically provide the buyer with the requested CVC or other value. Just as any typical type of crypto exchange would work. So, a natural person operating as a P2P exchanger that engages in money transmission services involving real currency or CVCs must comply with the BSA regulations. This is regardless of the regularity or formality of the transactions, or the location from which the person is operating. However, a natural person engaging in this type of activity on an infrequent basis, and not for profit or gain would be exempt from the scope of money transmission according to this guidance. I also want to discuss CVC wallets, and they are both hosted and unhosted wallets, which I'll touch upon.
As I just mentioned, there are different requirements and hosted wallet providers are account-based money transmitters that receive, store, and transmit CVC on behalf of their account holders, generally interacting with them through websites or mobile app. In this type of business model, the money transmitter is the host, the account is the wallet, and the account holder is the wallet owner. The regulatory framework applicable to the host, including the due diligence or enhanced due diligence procedures the host must follow regarding the wallet owner varies depending on, one, whether the wallet owner is a non-financial institution. And two, the type of transactions channeled through the hosted wallet and their US dollar equivalent.
When the wallet owner is a user, the host must follow procedures for identifying, verifying, and monitoring both the user's identity and profile, consistent with the host's AML program. When the wallet owner is an agent of the host, the host must comply with the same regulations, internal policies and procedures governing the principal MSB's obligation to monitor the activities of its agent.
Unhosted wallets are software hosted on a person's computer phone or other device that allow the person to store and conduct transactions in CVC. Unhosted wallets don't require an additional third party to conduct the transactions. In the case of unhosted single signature wallets, the value is the property of the owner that's stored in the wallet, while the owner interacts with the payment system directly, and has total independent control over the value. So, there is no separate host of the wallet in an unhosted wallet system as the name implies. When a person is conducting a transaction through the unhosted wallet and is doing so to purchase goods or services on behalf of the user's own behalf, they will be considered a money transmitter.
Lastly, I'll touch briefly on CVC kiosks, which are electric terminals that act as mechanical agencies of the owner operator to enable the operator to facilitate the exchange of CVC for currency or other CVC. These kiosks may connect directly to a separate exchanger, which performs the actual money transmission, or they may draw upon their own reserve within the electronic terminal. An owner operator of a CVC kiosk who uses an electronic terminal to accept currency from a customer and transmit the equivalent value qualifies as a money transmitter, both for transactions receiving and dispensing real currency or CVC.
FinCEN issued guidance, clarifying that owner operators of ATMs that link an account holder with his or her account at a regulated depository institution solely to verify balances and dispense currency don't meet the definition of a money transmitter. The guidance addressing BSA coverage of private ATMs doesn't apply to these CVC kiosks because the kiosks don't link account holders to their respective accounts at their own depository institution. Accordingly, these owner operators of the kiosk that accept and transmit value must comply with the FinCEN regulations governing money transmitters due to the nature of their business.
Keith, do you want to provide some insight on OFAC?
Keith Barnett:
Sure thing. Thanks, Carlin. Two things that I want to add here. If you are running a payments business, you cannot overlook the Office of Foreign Assets Control, also known as OFAC, especially if you are in the virtual currency business. For those of you who do not know, OFAC is an office within the U.S. Department of the Treasury that is responsible for administering and enforcing economic sanctions against governments targeted foreign countries, geographic regions, entities, and individuals to further U.S. foreign policy and national security goals.
Now, you're probably wondering, what does this have to do with virtual currency payments? Well, more than you think, because all companies in the virtual currency industry, irrespective of whether you need to be licensed as a money, services business, or a money transmitter, are encouraged by the federal government to develop, implement, and routinely update a tailored risk-based OFAC sanctions compliance program. Why do they suggest that? Well, it's because OFAC sanctions compliance obligations apply equally to transactions involving virtual currencies and those involving traditional fiat currencies. And members of the virtual currency industry are responsible for ensuring that they do not engage either directly or indirectly in transactions that are prohibited by the OFAC sanctions, such as executing payment transactions or other types of dealings with blocked persons or property or engaging in some sort of prohibited trade or investment related transactions.
To be clear as to who this applies to, it's all US persons are required to comply with OFAC regulations. That is even if you're not required to register as a money services business as Carlin had been discussing. Where we see this come up in our practice is the SDN list. The SDN list includes individuals, groups, entities who are prohibited from engaging in economic transactions in the US or with US persons. So, in other words, if there is some sort of business deal, a payments-related business deal that is going on, the principles of the deal, there will be some sort of OFAC check run, right? Or alternatively, if some sort of virtual currency payment is made, if you are making it outside of the jurisdiction of the US, OFAC would be interested in that and running some sort of OFAC search on that.
In fact, OFAC has what they call a 50% rule, which means that any entity owned directly or indirectly, 50% or more individually or in the aggregate by one or more blocked persons is also considered a blocked person, even if that entity does not itself appear on the SDN list. So, what does that mean? It means that you should not affect virtual currency payment transactions to or from that person or entity. What else does this mean in practice with respect to virtual currency? Well, it also means that once a U.S. person determines that they are holding virtual currency that is required to be blocked pursuant to OFAC’s regulations, the person must deny all parties access to that virtual currency and ensure that they are complying with OFAC regulations related to the holding and reporting of blocked assets and implement controls that align with a risk-based approach.
Like I said before, this is not just limited to businesses, right? This is every US person. You're not obligated to convert any blocked virtual currency into traditional fiat currency, and you're not required to hold such blocked property in an interest-bearing account, but you are required to block it. And blocked virtual currency must be reported to OFAC within 10 business days and thereafter on an annual basis, so long as the virtual currency remains blocked, right?
What can happen if you don't do that? Well, you could be subject to sanctions, either monetary or criminal or both sanctions from OFAC. And you especially need to be careful, because OFAC may impose civil penalties for sanctions violations based upon a strict liability legal standard. So, what does that mean for you non-lawyers out there, that means that in some cases, a person could be held civilly liable for sanctions, violations, even if they don't have knowledge or reason to know that they were engaging in a violation.
Now, OFAC has some recommendations as on how you can comply and how you can prevent running a foul of any type of OFAC-related regulation. If you're a business, OFAC likes to see management commitment to a program that is designed to make sure that you're complying with OFAC rules and regulations. Another thing that OFAC looks for is the performance of a risk assessment. One of the examples that OFAC provided is they gave an example of a settlement agreement that they entered into with a virtual currency payment service provider that processed virtual currency transactions between the company's customers and persons located in sanctioned jurisdictions.
Now, you're probably wondering how did this happen, right? How did this company wind up engaging in payment processing transactions with virtual currency to persons located in sanction jurisdictions? Well, the answer is relatively simple. While the company's sanctions compliance controls included screening its direct customers, meaning the merchants in the United States and elsewhere, for potential nexus to sanctions, the company failed to screen available information about the individuals who used its payment processing platform to actually buy products from the merchants. The information that was available to the company included the names, addresses, telephone numbers, email addresses, and sometimes IP addresses for the buyers.
Another thing that OFAC would like people to look at with respect to compliance are internal controls and we hear that in every major industry. So, what are internal controls in connection with a virtual currency payments transaction? Well there's a lot of overlap between virtual currency payments transaction and actual fiat currency payments transaction. In fact, I will call it even 100% overlap, if not close to 100% overlap.
The thing that sticks out to me most here with respect to examples of internal controls that OFAC provides are the geolocation tools, and that is the implementation of internal controls to screen the available data and block activity involving certain IP addresses, that can be used to prevent sanctions violations. For example, IP addresses that relate to or can be associated with a region that is under sanction by OFAC, or even an individual person. We know and understand that individuals who are savvy enough can mask their IP addresses, but the bottom line here is that OFAC expects companies or individuals to make that effort when dealing or at least make the effort of screening when dealing with virtual currency transactions.
Also, very important, know your customer procedures, which payment processors, money transmitters are already doing or should already be doing, monitoring transactions, investigating transactions, and also implementing remedial measures when you know something does slip through the cracks, right? Because nothing is perfect, things might slip through the cracks, but the issue here is identifying the things that slip through the cracks and remedying them, and also having a sanctions screening program, whether you use your own in-house or outsource it. The bottom line here is OFAC expects some sort of sanctioned screening.
Now, there's a lot more that we can cover here. We've only scratched the surface, but we want to provide this to you, at least discuss this area with you, because we expect virtual currencies to evolve exponentially over the next several years in light of recent political changes and news reports, and we'll certainly keep you posted.
Thanks again for joining us today, and, Carlin, thank you for your outstanding analysis. And thank you to our audience for listening to today's episode. Please again, do not forget to visit our blog, troutmanfinancialservices.com, and subscribe to get the latest updates. Also, please make sure to subscribe to this podcast via Apple Podcast, Google Play, Stitcher, or whatever platform you use. We look forward to the next time.
Copyright, Troutman Pepper Locke LLP. These recorded materials are designed for educational purposes only. This podcast is not legal advice and does not create an attorney-client relationship. The views and opinions expressed in this podcast are solely those of the individual participants. Troutman does not make any representations or warranties, express or implied, regarding the contents of this podcast. Information on previous case results does not guarantee a similar future result. Users of this podcast may save and use the podcast only for personal or other non-commercial, educational purposes. No other use, including, without limitation, reproduction, retransmission or editing of this podcast may be made without the prior written permission of Troutman Pepper Locke. If you have any questions, please contact us at troutman.com.