Applying the Bank Secrecy Act Framework to Convertible Virtual Currency: FinCEN Issues Guidance and Clarifies Expectations

28 May 2019
View Debevoise Update
Key takeaways:
  • The CVC Guidance does not establish new expectations or requirements but rather, clarifies when CVC market participants may be required, based on existing FinCEN regulations, to register as Money Services Businesses (“MSBs”) and comply with the Bank Secrecy Act (“BSA”) framework that applies to such entities.
  • A “facts and circumstances” test continues to determine whether any particular CVC business is treated as an MSB—requiring it to implement a formal anti-money laundering (“AML”) program and comply with reporting, recordkeeping and transaction monitoring requirements under the BSA. Nevertheless, the CVC Guidance provides an outline of how FinCEN expects its regulations to apply to a number of common business models.
  • Under FinCEN’s analysis, companies engaged in common types of CVC activity may be required to register as MSBs: peer-to-peer exchangers, CVC kiosks, hosted wallet providers and the owners or operators of certain decentralized applications. Before engaging in these types of activity, companies should consider whether registration is necessary and, if so, how to satisfy their BSA/AML-related compliance obligations.

The Financial Crimes Enforcement Network (“FinCEN”) issued interpretive guidance on May 9, 2019 explaining how the agency intends to apply its existing regulatory framework to companies offering common types of convertible virtual currency (“CVC”) products and services (the “CVC Guidance”). Although FinCEN largely summarizes and distills existing guidance, participants in these emerging markets have welcomed additional clarity on the agency’s evolving approach.

This Debevoise Update summarizes the CVC Guidance, outlines its application to specific types of CVC activities and discusses its practical import for the market.


FinCEN explains that participants in CVC markets are subject to the BSA and FinCEN’s implementing regulations to the same extent as “traditional” MSBs. In all cases, the threshold question remains whether the party is engaged in “money transmission services” and, therefore, qualifies as a “money transmitter.” Subject to certain exemptions, FinCEN has historically defined “money transmission services” broadly: the “acceptance of currency, funds, or other value that substitutes for currency from one person and the transmission of [the same]…to another location or person by any means.” This definition remains unchanged in the context of CVC-related activity.

The CVC Guidance reiterates that a “virtual currency” is a medium of exchange that can operate like a currency but does not have all the attributes of a “real” currency including legal tender status. According to the agency, CVCs carry “value that substitutes for currency” and, therefore, expose participants in related markets to potential registration and BSA/AML obligations without regard to how the CVC in question is labeled (e.g., “digital currency,” cryptocurrency,” “cryptoassets” or “digital assets”) or whether the CVC is represented by a physical or digital token, whether the ledger used to record transactions is centralized or decentralized or the type of technology utilized for the transmission of value. Whether a participant in any CVC-related market is an MSB, however, depends on its specific role in related transactions.

The CVC Guidance clarifies that the default framework provided in FinCEN’s 2013 virtual currency guidance continues to apply. That is, parties that qualify as “exchangers” or “administrators” generally will qualify as MSBs; pure “users” of CVC generally will not. FinCEN defines an “administrator” as a person engaged as a business in issuing (putting into circulation) a virtual currency, and who has the authority to redeem (to withdraw from circulation) such virtual currency and defines an “exchanger” as a person engaged as a business in the exchange of virtual currency for real currency, funds or other virtual currency. A “user” is a person that obtains virtual currency to purchase goods or services. As MSBs, these parties must register with FinCEN and implement the now-familiar elements or “pillars” of a BSA/AML compliance program: written policies, procedures and internal controls; a designated AML officer; an appropriate training program; and periodic independent review of the program. They also will be subject to the BSA’s reporting and recordkeeping obligations, including the filing of suspicious activity reports as warranted, and must comply with the so-called “funds transfer rule” and the “funds travel rule.”


The true innovation of the CVC Guidance may be its discussion of how FinCEN is likely to consider various common types of CVC activity within this framework. We highlight selected portions of the agency’s analysis below.

  • Peer-to-Peer Exchangers. These persons are engaged in the business of buying and selling CVCs, usually by confirming that required funds have been deposited by the buyer and then providing the buyer with the requested other currency. According to the CVC Guidance, this activity generally qualifies as money transmission, and, thus, exchangers generally are MSBs subject to the BSA.
  • CVC Trading Platforms and Decentralized Exchanges. CVC trading platforms that merely enable buyers and sellers of CVC to find each other do not, in FinCEN’s view, engage in money transmission where buyers and sellers actually settle trades outside those platforms. However, MSB registration is required if the platform purchases CVC from one party in order to sell it to another.
  • CVC Wallet Providers. MSB status depends on whether a particular wallet is “hosted”—i.e., a third party controls the funds—or “unhosted.” According to FinCEN, the operators of hosted wallets are MSBs to the extent they can receive, store and transmit CVCs on behalf of their accountholders. Because the accountholder in an unhosted CVC wallet retains independent control over the value associated with the account, providers of these wallets generally will not be considered MSBs.
  • CVC Kiosks/ATMs/Vending Machines. CVC kiosks are electronic terminals that act as mechanical agencies of the owner-operator, enabling it to facilitate the exchange of CVC for currency or other CVC. Although the kiosks often connect to a separate exchanger to perform the actual transaction, FinCEN explains that owneroperators generally will qualify as MSBs.
  • Decentralized Applications. Decentralized applications (“DApps”) are software programs deployed on a blockchain platform designed such that they are not controlled by a single person or group of persons. Despite the decentralized nature of these networks, FinCEN explains that they function similarly to CVC kiosks, and, thus, the owner-operators engage in money transmission requiring MSB registration. Developers of DApps generally will not qualify as MSBs solely by acting in that capacity; they could, however, become subject to registration and compliance obligations if they also use the application to engage in money transmission transactions denominated in CVC.
  • CVC Payment Processors. CVC payment processors are financial intermediaries that enable traditional merchants to accept CVC from customers in exchange for goods and services. Payment processors generally are exempt from the definition of “money transmitter” and, therefore, MSB registration but only to the extent a processor operates through clearance and settlement systems that admit only BSA-regulated financial institutions, among other conditions. Because CVC payment processors are generally unable to operate through such clearance and settlement systems, FinCEN explains that this “traditional” exemption is unavailable in the CVC context.
  • Fundraising Through CVCs (ICOs). FinCEN’s analysis focuses on two types of initial coin offerings (“ICO”) and whether they raise BSA compliance obligations: (1) preferential sales of CVC to a select group of buyers; and (2) digital debt- or equity-like instruments offered to investors to finance a company’s activities. FinCEN states that the first model constitutes money transmission and requires MSB registration and BSA compliance if the seller alone can issue and redeem new units of the CVC. The analysis under the second model depends on a variety of factors, including the status of the issuer8 and whether an ICO qualifies for the socalled “Integral Exemption.”

    In addition to the business models discussed above, the CVC Guidance also discussed:

  • Anonymity-Enhanced CVC Transactions. Despite the additional aspect of anonymizing transactions, Anonymity-Enhanced CVC transactions are treated as they would be if the transactions were not anonymity enhanced.
  • Internet Casinos. Any person engaged in the business of gambling that is not covered by the regulatory definition of casino, gambling casino or card club but accepts and transmits value denominated in CVC may be regulated under the BSA as a money transmitter even if the payouts are done on a conditional basis.
  • Mining Pools and Cloud Miners. So long as no ancillary services are offered that would otherwise fall under the money transmitter exemption, persons passing on payments for offering computing power in mining activities will fall under the Integral Exemption because the transmission is integral to the effectiveness of the mining activity.

    The CVC Guidance may not break new analytical ground, but the insight it provides on FinCEN’s approach to various common business models provides helpful clarity to market participants. Parties transacting in CVCs should consider this guidance carefully to determine whether their activity might, in FinCEN’s view, trigger registration and compliance obligations.