BSA Regulatory Implications for Payroll via Digital Currencies

Written by: John Ashley, CIPP/US, CRCMP
Consultant with Bates Group, LLC

Background

The last two years have seen a proliferation in mainstream acceptance of digital currencies. This period has seen the first public listing of a digital asset exchange on a major U.S. stock exchange (Coinbase), the creation of the first state-charted digital asset bank (Kraken Bank), and the first use of cryptocurrencies as legal tender (El Salvador). Major central banks, such as the Federal Reserve, have commissioned studies into the use of their own digital versions of existing fiat, government-backed currencies.

Digital currency’s appeal lies both in its use as a digital asset for investment purposes, but also in the potential for operational speed and security that exceeds that provided by traditional financial institutions and money services businesses (MSBs). Cryptocurrency transactions are not bound by timelines built into traditional means of funds transfer familiar in the U.S., such as ACH and the Fedwire system. Digital currency transfer is only limited by the speed of processing on the blockchain, and settlement to the destination wallet is instantaneous. Transaction security is easily verified through the public ledger distributed on the blockchain.

As such, there are a growing number of companies seeking to disrupt the market through blockchain-based twists on traditional financial services, such as international remittances, money transfers, and banking. Furthermore, as cryptocurrency gains a broad acceptance among younger workers, especially those entering the workforce, there is an opportunity for companies to dispense with the use of fiat currency for traditional corporate payments such as payroll and invoices, provided that all counterparties are willing to accept utilizing digital currencies. This has become more acceptable due to the widespread acceptance of “stablecoins” – digital currencies which are pegged at a fixed rate to a particular fiat currency or basket of fiat currencies. Amongst such digital currencies, Tether (USDT) and USD Coin (USDC) dominate in terms of market capitalization (at approximately $68bn and $30bn, respectively).[1] Stablecoins offer the speed and accessibility of digital currencies without the risk of volatile fluctuations in value associated with more well-known cryptocurrencies, such as Bitcoin or Ethereum.

The use of cryptocurrencies for payroll poses potential risks. In particular, the lack of regulatory clarity from FinCEN (the Financial Crimes Enforcement Network) means that companies must take particular care regarding how payroll operations are structured. Certain structures may classify the company as an MSB, which entails strict registration and compliance requirements, with equally strict penalties for compliance failures. MSBs must register with FinCEN, appoint a chief compliance officer, and maintain a robust compliance program including external reviews and written policies and procedures. In the U.S., most MSBs are also required to obtain a money transmitter license from each U.S. state in which they wish to offer services, a process that is both time and resource-intensive. The penalties for operating an unlicensed MSB are as strict from a state perspective as they are from a federal perspective.

This white paper will examine the regulatory framework surrounding digital currencies and apply it to the use of digital currencies for payroll purposes.

Summary of Relevant FinCEN Guidance and Regulations

FinCEN has issued extensive guidance concerning the applicability of federal laws and regulations to digital currencies (termed “convertible virtual currencies” in FinCEN’s publications). FinCEN divides the applicability of MSB requirements based upon the role that a person plays with regards to the utilization of digital currency in a given arrangement.[2] FinCEN defines three generic types of relationship:

1. User: a “user” is a person who “obtains virtual currency to purchase goods or services.”[3] A person can obtain digital currency in a variety of ways. Mining/creating the currency, purchasing it, or earning it (for instance, through a rewards program) are all examples of “obtaining” digital currency.
2. Exchanger: an “exchanger” is a person who is engaged, as a business, in exchanging digital currency for fiat (or vice versa) and/or other digital currencies.
3. Administrator: an “administrator” is a person who is engaged, as a business, in issuing a digital currency, and who has the authority to redeem that currency (i.e. withdraw from circulation).

FinCEN’s stance is that a “user” of digital currency is not an MSB. Conversely, any “exchanger” or “administrator” who either receives and transmits digital currency or buys and sells digital currency is considered an MSB and subject to appropriate regulation.

At this point, it is important to examine another distinction in FinCEN regulations: the distinction between transmittor and transmitter. While there is only one letter worth of difference between these two words, the distinction is vital to examining how FinCEN’s regulations apply to companies offering payroll through digital currencies.

Per 31 CFR § 1010.100(fff), a transmittor is a person who sends the initial order in the process of a funds transfer. This includes actions such as going to an MSB agent and purchasing a money order, authorizing a payment to a credit card company from one’s bank, or sending an international remittance via an online MSB. A transmitter, on the other hand, (per31 CFR § 1010.100(ff)(5)) is a person who provides money transmission services. In our examples, this would be the MSB issuing the money order, the bank from which one sends a credit card payment, or the online MSB facilitating the international remittance.

We must now ask: how would these definitions apply in the case of payroll via digital currencies?

Application to Payroll via Digital Currencies

FinCEN’s May 2019 Guidance concerning business models utilizing digital currencies provides useful information to parse the consequences of payroll via digital currencies. Of particular note is Section 4.2 concerning digital currency wallets. FinCEN distinguishes between “hosted” wallets and “unhosted” wallets, according to the following criteria:[4]

• Hosted wallets: are provided on an account basis by money transmitters for the purpose of sending, receiving, and storing digital currencies. Account-holders interact with the wallet through a website or mobile app interface.
• Unhosted wallets: are stored on an individual’s device (e.g. a computer, phone, or similar) and with which an individual interacts without the use of a third party to facilitate transactions.

FinCEN clearly states that in the context of hosted wallets, “the money transmitter is the host.”[5] The guidance proceeds to enumerate the responsibilities of the host with regards to the wallet owner, including Know Your Customer (KYC) requirements as provided for by the host’s AML Program. Additionally, the FinCEN guidance stipulates that regulations concerning transmittals of funds, such as the Funds Travel Rule, must be complied with to the extent applicable.

As such, FinCEN’s description of the relationship between the wallet owner and the wallet host maps to the distinction between transmittor and transmitter, as defined in 31 CFR § 1010.100(fff) and 31 CFR § 1010.100(ff)(5), respectively. The wallet host is subject to the same compliance requirements with regards to the wallet owner as a money transmitter is with regards to a transmittor. In the context of providing payroll via digital currency, the hosted wallet model presents a lower risk to businesses that wish to do so. The host wallet is also considered to be a money transmitter as it receives and transmits digital currency.

Let us consider the following example. Company P provides decentralized digital currency exchange and as such receives fee revenue in digital currency. Company P has elected to pay its employees in USDC, a stablecoin pegged to the U.S. dollar at a nearly 1 to 1 ratio. Company P has adopted the following process for payroll:[6]

1. Company P’s revenue, in various digital currencies, is transferred into a wallet hosted on Exchange A.
2. Alice, the employee of Company P in charge of payroll, exchanges these various digital currencies for their equivalents in USDC utilizing the services of Exchange A.
3. Alice then orders the transmittal of appropriate payroll amounts from the hosted wallet on Exchange A to Company P’s employees.

In this case, neither Company P nor Alice would likely be considered a money transmitter. Rather, Alice’s role in the process is that of transmittor, while Exchange A is the money transmitter, as Alice requests transfers from a wallet hosted by Exchange A using Exchange A’s software and interfaces. Furthermore, as the wallet host is receiving and transmitting the currency, it is acting as a money transmitter.

An analogous approach can be described in a similar situation involving fiat currency. In this case, Company Q is a small business consisting of an owner, Bob, and two employees. Bob elects to pay his employees using a popular payments app on his phone. In this case, the payments app is the money transmitter, and Bob (the customer of the app) is the transmittor. Bob does not engage in money transmission.

In the context of unhosted wallets, the mapping is less clear. FinCEN’s guidance states that “in so far as the person conducting a transaction through the unhosted wallet is doing so to purchase goods or services on the user’s own behalf, they are not a money transmitter.”[7] FinCEN is silent on whether the provision of payroll would constitute the purchase of goods or services.

However, the use of an unhosted wallet for payroll services presents a higher risk, as this use might be construed as acting as a peer-to-peer exchanger. A peer-to-peer exchanger, according to FinCEN, is a person (typically a natural person) who is “facilitate[s] transfers from one type of CVC to a different type of CVC, as well as exchanges between CVC and other types of value (such as monetary instruments or payment products denominated in real currency).”[8]

In this case, there is a risk that the person conducting payroll services using an unhosted wallet would not be considered as using the wallet purely for the purposes of purchasing goods or services. In these cases, it is possible that FinCEN would categorize them as a peer-to-peer exchanger, and thus subject to MSB compliance requirements.

Compliance Takeaways

Businesses wishing to provide payroll should take the following steps to minimize the associated compliance risks:

1. Use hosted wallet services – as noted in FinCEN’s guidance, hosted wallet providers are considered money transmitters. This transfers compliance risk from the business to the hosted wallet provider.
2. Due diligence – the digital currency space changes rapidly and regulatory compliance requirements are constantly changing. Businesses should conduct appropriate due diligence on their hosted wallet providers, including ensuring that these providers are appropriately licensed and registered at the state and federal levels.
3. Avoid unhosted wallets – in addition to the risks identified above, an unhosted wallet also poses high-security risks. Consider what would happen if the device holding the wallet were stolen or hacked – how would that impact the company?
4. Avoid the use of individual third parties – utilizing an individual third party (i.e. a natural person) to manage payroll services is high risk. In addition to the compliance risks, businesses should also consider the risk of loss or theft associated with this kind of relationship. Where possible, the business should retain digital currency payroll responsibility within its own employee base.

[1] Data retrieved from https://coinmarketcap.com/ at 12:51 MDT on September 23, 2021.
[2] “Application of FinCEN’s Regulations to Persons Administering, Exchanging, or Using Virtual Currencies” FinCEN Guidance FIN-2013-G001.Department of the Treasury, Financial Crimes Enforcement Network. https://www.fincen.gov/resources/statutes-regulations/guidance/application-fincens-regulations-persons-administering. Retrieved September 23, 2021.
[3] Ibid.
[4] “Application of FinCEN’s Regulations to Certain Business Models Involving Convertible Virtual Currencies.” FinCEN Guidance FIN-2019-G001. Department of the Treasury, Financial Crimes Enforcement Network. https://www.fincen.gov/sites/default/files/2019-05/FinCEN%20Guidance%20CVC%20FINAL%20508.pdf. Retrieved September 23, 2021.
[5] Ibid., p. 15.
[6] We do not consider the application of tax withholding or other payroll activities in this exercise as they are beyond the scope of the paper and the author’s expertise.
[7] FinCEN Guidance FIN-2019-G001, p. 16.
[8]