Virtual Currencies: FinCEN's Next Enforcement Wave?

The Financial Crimes Enforcement Network (FinCEN), through formal guidance, public appearances, and, most recently, the issuance of its first enforcement action against a virtual currency business, is signaling to participants in the virtual currency industry that a wave of enforcement actions may be imminent.  Consistent with FinCEN's prior enforcement initiatives, it is anticipated that FinCEN will begin to examine and review virtual currency businesses and individuals, and a series of potentially significant virtual currency-related enforcement actions are likely to follow. 

Ripple Labs Enforcement Action

On May 5, 2015, FinCEN, in coordination with the US Attorney's Office for the Northern District of California (USAO-NDCA), assessed a civil money penalty in the amount of $700,000 against Ripple Labs Inc. (Ripple Labs) and its wholly-owned subsidiary, XRP II, LLC (collectively, the Ripple Entities), for failure to register as a money services business (an MSB) under the Bank Secrecy Act and its implementing regulations (the BSA), failure to implement and maintain effective anti-money laundering (AML) programs, and failure to report suspicious activities (the Ripple Labs Enforcement Action).  Through a settlement agreement with the USAO-NDCA, the Ripple Entities resolved possible criminal charges and forfeited $450,000, which will be credited to partially satisfy the civil money penalty.

Ripple Labs, headquartered in San Francisco, provides an online platform for exchanging virtual currency and other assets.  As part of this exchange platform, Ripple Labs created and issued its own virtual currency, known as XRP.  XRP II, LLC was created by Ripple Labs to engage in the sale and transfer of XRP from Ripple Labs to various third parties on a wholesale basis.  XRP, according to FinCEN, is the second largest cryptocurrency by market capitalization behind Bitcoin.  FinCEN stated that the Ripple Entities qualify as MSBs under BSA regulations.  Specifically, the Ripple Entities were operating as "exchangers" and "administrators," and FinCEN has deemed such categories of virtual currency participants to be money transmitters under the BSA.  FinCEN further asserted that Ripple Labs failed to register with FinCEN as an MSB, and that both Ripple Labs and XRP II, LLC failed to maintain the proper AML programs as required of MSBs under the BSA. 

These registration and compliance failures-which closely follow FinCEN's published guidance and advisories applicable to virtual currency businesses, as well as related public remarks by senior FinCEN personnel-resulted in a $700,000 fine, and the requirement that the Ripple Entities adopt a remedial framework developed by FinCEN.  FinCEN penalized the Ripple Entities for not properly assessing their business' activities and for failing to implement the requisite AML safeguards.

Classification as an MSB

Under the BSA, an MSB is broadly defined and generally includes any person doing business, whether or not on a regular basis or as an organized business concern, in one or more of several capacities, including money transmission.  In March 2013, FinCEN issued interpretive guidance providing greater clarity for businesses entering into the virtual currency industry:

• Application of FinCEN's Regulations to Persons Administering, Exchanging, or Using Virtual Currencies defined certain businesses and individuals as MSBs based on the nature of their financial activities, and clarified that an "administrator" or "exchanger" of virtual currency is an MSB under FinCEN regulations, specifically, a money transmitter, unless a limitation to or exemption from the definition applies to the individual or enterprise. 

In 2014, FinCEN issued two administrative rulings providing additional insight into whether a person's conduct related to virtual currency qualifies them as a money transmitter as contemplated by the BSA:

• Application of FinCEN's Regulations to Virtual Currency Mining Operations analyzed whether an entity that mines virtual currency would qualify as a money transmitter and concluded that, to the extent a user creates or mines a virtual currency solely for a user's own purposes, the user is not a money transmitter under the BSA. 
• Application of FinCEN's Regulations to Virtual Currency Software Development and Certain Investment Activity analyzed whether certain investments in virtual currency, and the production and distribution of software to facilitate a company's purchase of virtual currency for purposes of its own investment, would make the company a money transmitter under the BSA, and concluded that a company purchasing and selling virtual currency as an investment exclusively for the company's benefit is not a money transmitter.

As detailed in the Ripple Labs Enforcement Action, qualifying as a money transmitter and, thus, an MSB, obligates a business or individual to register as an MSB with FinCEN.  Moreover, regardless of whether the entity has properly registered, MSBs are subject to certain additional requirements under the BSA, such as implementation of an effective AML program, reporting, recordkeeping, training for employees, and independent reviews. 

Analysis of Past FinCEN Enforcement Waves

A review of FinCEN's enforcement actions over the past 16 years reveals industry-targeted waves of enforcement actions against non-depository institutions.  Often, these waves are shortly preceded by FinCEN rulemaking, guidance, and interpretive issuances.  For example, in the summer of 1998, FinCEN proposed rules that would require casinos to report suspicious activities and held four regional meetings focused on the gaming industry.  Of the seven enforcement actions taken by FinCEN over a 20-month period from 1999 to 2000, all of them targeted the gaming industry. 

Similarly, during a five-month period beginning in December 2004, FinCEN issued two pieces of guidance, an advisory, and two statements, all relating to MSBs.  After not bringing an enforcement action against an MSB since 2003, FinCEN settled five enforcement actions against MSBs from May 2006 to April 2008.

Finally, after a 27-month period when no enforcement actions were taken against an MSB, FinCEN re-focused its attention on the MSB industry in 2009.  From May 2009 to July 2010, FinCEN issued two proposed rules relating to MSBs, a report of FinCEN-conducted outreach to the MSB industry, and Spanish-language MSB examination procedures.  From December 2010 to December 2011, 77 percent of FinCEN enforcement actions targeted MSBs. 

Conclusion

FinCEN's waves of enforcement actions against non-depository institutions are usually clear, and the warning signs tend to be consistent.  FinCEN first demonstrates an increase in rulemaking, guidance, or interpretive issuances, and then initiates a series of enforcement actions targeting participants in that particular industry.

Virtual currency businesses and participants should be aware of FinCEN's enforcement history.  The nascent virtual currency industry is ripe for remedial enforcement actions, as businesses find themselves grappling with unfamiliar FinCEN regulations.  FinCEN's past patterns of enforcement, the Ripple Labs Enforcement Action, and recent guidance and administrative rulings involving virtual currency collectively set the stage for an industry-wide enforcement effort. 

Virtual currency businesses and individuals should carefully evaluate whether their activities require them to register under federal and state MSB regulations, implement requisite AML programs, and comply with the BSA's ongoing reporting and recordkeeping requirements.  If you have questions about whether you are subject to FinCEN regulation, please contact any member of Arnold & Porter's Financial Services group.