A potential customer would like to open a deposit account with our bank to accept deposits made at a Bitcoin ATM that they own. We believe the customer is a money services business (MSB), and it would use a security service (like Garda or Brinks) to pick up the cash from the Bitcoin ATM and count the funds, which would then be sent to the customer’s account at our bank via ACH. Funds would flow out of the account by ACH transfer to a Bitcoin exchange. What BSA/AML concerns should we be aware of when considering whether to do business with this customer?

We believe your bank should confirm that the customer is registered as an MSB and is licensed as a money transmitter under Illinois law and review the BSA/AML requirements for providing banking services to MSBs generally, as well as federal and state guidance on MSBs that transmit convertible virtual currency (CVC) such as Bitcoin.

The interagency guidance on providing banking services to MSBs sets forth the minimum due diligence expectations for opening and maintaining accounts for MSBs, which include: (1) applying the bank’s Customer Identification Program (CIP), (2) confirming the MSB is registered with FinCEN, if required, (3) confirming compliance with state and local licensing requirements, if applicable, (4) confirming agent status, if applicable, and (5) conducting a BSA/AML risk assessment to determine the level of risk associated with the account and whether further due diligence is necessary.

MSBs include “money transmitters,” which according to FinCEN’s guidance include virtual currency administrators and exchangers that accept and transmit CVC or buy or sell CVC for any reason. FinCEN also has issued an advisory warning of the risks of illicit activity posed by Bitcoin ATMs (referred to as CVC kiosks), noting that “while some kiosk operators have registered and implemented AML/CFT controls, other kiosks have operated in ways that suggest a willful effort to evade BSA requirements.” Consequently, we recommend confirming that the customer is registered as an MSB with FinCEN and has implemented appropriate AML/CFT controls.

The Illinois Department of Financial and Professional Regulation (IDFPR) also has issued guidance confirming that entities engaged in the business of receiving money for transmission or transmitting money using Bitcoin ATMs are subject to Illinois’s Transmitters of Money Act and its licensing requirements. Accordingly, we recommend confirming that the customer has acquired a money transmitter license from the IDFPR.

Additionally, we note that the OCC has issued guidance providing that OCC-supervised banks should “assess the risks posed by each MSB customer on a case-by-case basis and . . . implement appropriate controls to manage the relationship commensurate with the risks associated with each customer.”

For resources related to our guidance, please see:

Interagency Interpretive Guidance on Providing Banking Services to Money Services Businesses Operating in the United States, page 4 (April 26, 2005) (“Based on existing Bank Secrecy Act requirements applicable to banking organizations, the minimum due diligence expectations associated with opening and maintaining accounts for money services businesses are: [1] Apply the banking organization’s Customer Identification Program; [2] Confirm FinCEN registration, if required; [3] Confirm compliance with state or local licensing requirements, if applicable; [4] Confirm agent status, if applicable; and [5] Conduct a basic Bank Secrecy Act/Anti-Money Laundering risk assessment to determine the level of risk associated with the account and whether further due diligence is necessary.”)

FFIEC BSA/AML Examination Manual, Nonbank Financial Institutions—Overview, page 301, Footnote 283 (“Refer to 31 CFR 1022.380. All MSBs must register with FinCEN (whether or not licensed as an MSB by any state) except: a business that is an MSB solely because it serves as an agent of another MSB; a business that is an MSB solely as a seller of prepaid access; the U.S. Postal Service; and agencies of the United States, of any state, or of any political subdivision of any state. A business that acts as an agent for a principal or principals engaged in MSB activities, and that does not on its own behalf perform any other services of a nature or value that would cause it to qualify as an MSB, is not required to register with FinCEN.”)

FinCEN Regulations, 31 CFR 1010.100(ff)(5)(i) (“Money services business [includes a] . . . (5) Money transmitter. . . . (A) A person that provides money transmission services. The term ‘money transmission services’ means the acceptance of currency, funds, or other value that substitutes for currency from one person and the transmission of currency, funds, or other value that substitutes for currency to another location or person by any means. ‘Any means’ includes, but is not limited to, through a financial agency or institution; a Federal Reserve Bank or other facility of one or more Federal Reserve Banks, the Board of Governors of the Federal Reserve System, or both; an electronic funds transfer network; or an informal value transfer system; or (B) Any other person engaged in the transfer of funds.”)

FinCEN, Application of FinCEN’s Regulations to Persons Administering, Exchanging, or Using Virtual Currencies (March 18, 2013) (“An exchanger is a person engaged as a business in the exchange of virtual currency for real currency, funds, or other virtual currency. An administrator is a person engaged as a business in issuing (putting into circulation) a virtual currency, and who has the authority to redeem (to withdraw from circulation) such virtual currency. . . . . An administrator or exchanger that (1) accepts and transmits a convertible virtual currency or (2) buys or sells convertible virtual currency for any reason is a money transmitter under FinCEN’s regulations, unless a limitation to or exemption from the definition applies to the person.”)

FinCEN, Advisory on Illicit Activity Involving Convertible Virtual Currency (May 9, 2019) (“CVC kiosks (also called bitcoin Automated Teller Machines (ATMs) or crypto ATMs) are ATM-like devices or electronic terminals that allow users to exchange cash and virtual currency. CVC kiosks generally facilitate money transmission between a CVC exchange and a customer’s wallet or operate as a CVC exchange themselves. While some kiosk operators have registered and implemented AML/CFT controls, other kiosks have operated in ways that suggest a willful effort to evade BSA requirements. For example, some kiosk operators have assisted in structuring transactions, failed to collect and retain required customer identification information, or falsely represented the nature of their business—for instance by claiming involvement in cash intensive activities—to their CVC exchange and depository institutions.”)

IDFPR, Digital Currency Regulatory Guidance, page 6 (June 13, 2017) (“Exchange of digital currency for money through an automated machine is generally considered to be money transmission. For example, several companies have begun selling automated machines commonly called ‘Bitcoin ATMs’ that facilitate contemporaneous exchanges of digital currency for money. Most such machines currently available, when operating in their default mode act as an intermediary between a buyer and seller, typically connecting through one of the established exchange sites. When a customer buys or sells digital currency through a machine configured this way, the operator of the machine receives the buyer’s money and is engaging in the ‘business of receiving money for transmission or transmitting money.’”)

Illinois Transmitters of Money Act, 205 ILCS 657/5 (“‘Money transmitter’ means a person who is located in or doing business in this State and who directly or through authorized sellers does any of the following in this State: (1) Sells or issues payment instruments. (2) Engages in the business of receiving money for transmission or transmitting money. (3) Engages in the business of exchanging, for compensation, money of the United States Government or a foreign government to or from money of another government.”)

Illinois Transmitters of Money Act, 205 ILCS 657/5 (“‘Transmitting money’ means the transmission of money by any means, including transmissions to or from locations within the United States or to and from locations outside of the United States by payment instrument, facsimile or electronic transfer, or otherwise, and includes bill payment services.”)

Illinois Transmitters of Money Act, 205 ILCS 657/10 (“No person may engage in this State in the business of selling or issuing payment instruments, transmitting money, or exchanging, for compensation, payment instruments or money of the United States government or a foreign government to or from money of another government without first obtaining a license under this Act. Separate licenses shall not be required, however, for persons acting as authorized sellers of licensees under this Act.”)

OCC Bulletin 2014-58, Banking Money Services Businesses: Statement on Risk Management (“MSBs present varying degrees of risk to an institution. Not all MSBs should be considered high risk. In keeping with the OCC’s mission and commitment to ensuring all customers have fair access to financial services, the agency expects OCC-regulated banks to assess the risks posed by each MSB customer on a case-by-case basis and to implement appropriate controls to manage the relationship commensurate with the risks associated with each customer.”)