We have a potential client that would like us to finance the purchase of a Bitcoin ATM. We would not process any transactions for the client through our system, since they do not have a deposit account with us, and our client will engage a third party money services business (MSB) to do all of the actual payment processing associated with the Bitcoin ATM. Under the Bank Secrecy Act (BSA), what type of monitoring would be required for this client, and would the answer change if we begin a deposit relationship with the client?

We do not believe that lending funds to a borrower for the purpose of purchasing a Bitcoin ATM would require your bank to perform the BSA-related due diligence required for an MSB, unless your customer is an agent of the MSB doing the actual payment processing for the Bitcoin ATM.

Whether your bank’s lending relationship with this customer will trigger BSA due diligence requirements ultimately depends on whether your customer is considered an MSB or agent of an MSB under the Financial Crimes Enforcement Network’s (FinCEN) regulations. A “money transmitter” is a category of MSB that includes virtual currency administrators and exchangers that accept and transmit convertible virtual currency (CVC) or buy or sell CVC for any reason. Additionally, agents of MSBs are considered MSBs themselves, but a person that simply provides for the delivery, communication, or network access services used by a money transmitter is not. To confirm that your customer is not an MSB by virtue of its purchase of a Bitcoin ATM, your bank should confirm that your customer will not be accepting, transmitting, buying, or selling convertible digital currency itself or as an agent for the MSB that will be processing payments for the Bitcoin ATM.

We also recommend confirming that your customer is not engaged in the business of receiving money for transmission or transmitting money through the use of the Bitcoin ATMs for purposes related to licensure with the Illinois Department of Financial and Professional Regulation (IDFPR). Entities that engage in such activities are considered “money transmitters” under the Illinois Transmitters of Money Act (TOMA), and IDFPR guidance confirms that such activities trigger the TOMA’s licensing requirements. If your customer would be considered a “money transmitter” under the Illinois TOMA, you should confirm that they have acquired a money transmitter license.

We also recommend reviewing an advisory issued by FinCEN warning of the risks of illicit activity posed by a Bitcoin ATM (also referred to in the advisory as a CVC kiosk). The advisory notes that “while some kiosk operators have registered and implemented AML/CFT controls, other kiosks have operated in ways that suggest a willful effort to evade BSA requirements.” While it does not appear that your customer would be serving as the operator of the Bitcoin ATM, we recommend reviewing the red flags noted in the advisory (linked to in the resources provided below).

Additionally, we do not believe that your approach to this lending customer would change if the customer later establishes a deposit account with your bank. We believe that the interagency guidance on providing banking services to MSBs — which outlines the minimum due diligence expectations associated with providing banking services to MSBs — applies equally to lending and deposit banking services.

For resources related to our guidance, please see:

FinCEN Regulations, 31 CFR 1010.100(ff)(5)(i) (“Money services business [includes a] . . . (5) Money transmitter. . . . (A) A person that provides money transmission services. The term ‘money transmission services’ means the acceptance of currency, funds, or other value that substitutes for currency from one person and the transmission of currency, funds, or other value that substitutes for currency to another location or person by any means. ‘Any means’ includes, but is not limited to, through a financial agency or institution; a Federal Reserve Bank or other facility of one or more Federal Reserve Banks, the Board of Governors of the Federal Reserve System, or both; an electronic funds transfer network; or an informal value transfer system; or (B) Any other person engaged in the transfer of funds.”)

FinCEN, Application of FinCEN’s Regulations to Persons Administering, Exchanging, or Using Virtual Currencies, pages 1–3 (March 18, 2013) (“An exchanger is a person engaged as a business in the exchange of virtual currency for real currency, funds, or other virtual currency. An administrator is a person engaged as a business in issuing (putting into circulation) a virtual currency, and who has the authority to redeem (to withdraw from circulation) such virtual currency. . . . An administrator or exchanger that (1) accepts and transmits a convertible virtual currency or (2) buys or sells convertible virtual currency for any reason is a money transmitter under FinCEN’s regulations, unless a limitation to or exemption from the definition applies to the person.”)

FinCEN Regulations, 31 CFR 1010.100(ff)(5)(ii) (“Whether a person is a money transmitter as described in this section is a matter of facts and circumstances. The term ‘money transmitter’ shall not include a person that only: (A) Provides the delivery, communication, or network access services used by a money transmitter to support money transmission services . . . .”)

Illinois TOMA, 205 ILCS 657/5 (“‘Money transmitter’ means a person who is located in or doing business in this State and who directly or through authorized sellers does any of the following in this State:

(1) Sells or issues payment instruments.

(2) Engages in the business of receiving money for transmission or transmitting money.

(3) Engages in the business of exchanging, for compensation, money of the United States Government or a foreign government to or from money of another government.” 205 ILCS 657/1.”)

Illinois TOMA, 205 ILCS 657/5 (“‘Transmitting money’ means the transmission of money by any means, including transmissions to or from locations within the United States or to and from locations outside of the United States by payment instrument, facsimile or electronic transfer, or otherwise, and includes bill payment services.”)

Illinois TOMA, 205 ILCS 657/10 (“No person may engage in this State in the business of selling or issuing payment instruments, transmitting money, or exchanging, for compensation, payment instruments or money of the United States government or a foreign government to or from money of another government without first obtaining a license under this Act. Separate licenses shall not be required, however, for persons acting as authorized sellers of licensees under this Act.”)

IDFPR, Digital Currency Regulatory Guidance, page 5 (June 13, 2017) (“Exchange of digital currency for sovereign currency through an automated machine is generally considered to be money transmission. For example, several companies have begun selling automated machines commonly called ‘Bitcoin ATMs’ that facilitate contemporaneous exchanges of digital currency for money . . . .”)

FinCEN, Advisory on Illicit Activity Involving Convertible Virtual Currency (May 9, 2019) (“CVC kiosks (also called bitcoin Automated Teller Machines (ATMs) or crypto ATMs) are ATM-like devices or electronic terminals that allow users to exchange cash and virtual currency. CVC kiosks generally facilitate money transmission between a CVC exchange and a customer’s wallet or operate as a CVC exchange themselves. While some kiosk operators have registered and implemented AML/CFT controls, other kiosks have operated in ways that suggest a willful effort to evade BSA requirements. For example, some kiosk operators have assisted in structuring transactions, failed to collect and retain required customer identification information, or falsely represented the nature of their business—for instance by claiming involvement in cash intensive activities—to their CVC exchange and depository institutions.”)

FinCEN, Advisory on Illicit Activity Involving Convertible Virtual Currency (May 9, 2019) (“Red Flag Indicators of the Abuse of Virtual Currencies . . . .

Unregistered or Illicitly Operating CVC Kiosks

A customer operates multiple CVC kiosks in locations that have a relatively high incidence of criminal activity.

Large numbers of transactions from different customers sent to and from the same CVC wallet address but not operating as a known CVC exchange.

Illicit Activity Leveraging CVC Kiosks

Structuring of transactions just beneath the CTR threshold or the CVC kiosk daily limit to the same wallet address either by using multiple machines (i.e., smurfing) or multiple identities tied to the same phone number.”)

Interagency Interpretive Guidance on Providing Banking Services to Money Services Businesses Operating in the United States, page 7 (April 26, 2005) (“Existing regulations require banking organizations to identify and report known or suspected violations of law or/and suspicious transactions relevant to possible violations of law or regulation. Risk-based monitoring of accounts maintained for all customers, including money services businesses, is a key element of an effective system to identify and, where appropriate, report violations and suspicious transactions. The level and frequency of such monitoring will depend, among other things, on the risk assessment and the activity in the account.”)