A (Realistic) Primer on the Legal and Regulatory Hurdles of Cryptocurrency

This article is an expanded version of a 5 minute talk given at the March 4, 2014 Los Angeles Bitcoin Meetup. The article was created for general guidance on matters of interest only, and does not constitute legal advice. You should not act upon the information contained in this publication without obtaining specific advice from an attorney. No representation or warranty (expressed or implied) is given as to the accuracy or completeness of the information contained in this post, and I do not accept or assume any liability, responsibility or duty of care for any consequences of you or anyone else acting, or refraining to act, in reliance on the information contained in this post or for any decision based on it.

Amy Y. is an attorney in Los Angeles, California and can be reached at msamywan at gmail dot com or @amyywan. She advises select startups on legal matters, and how they can procure legal services in alternative ways. (This information is to ensure I am compliant with attorney advertising rules). She blogs in her personal capacity, and the opinions here are her own.

It’s been a rough few weeks for bitcoin. Last week, Tokyo-based Bitcoin exchange Mt. Gox suddenly imploded due to hackers, taking $460 million with it. Their troubles are not over, as their U.S.-based customers have filed a class action against the bankrupt company and its CEO Mark Karpeles to freeze its U.S.-based assets. An then there’s

FlexCoin, the bitcoin bank who yesterday simply shut down after hackers made off with $600,000 worth of Bitcoin. “As Flexcoin does not have the resources, assets, or otherwise to come back from this loss, we are closing our doors immediately,” the company said in a statement.

It’s daunting to enter the crytocurrency business--on one hand, you have to repel hackers looking to put you out of business on the one hand and a squadron of government regulators threatening lawsuits, fines, and jail time on the other. While I can’t help you with the former issue, I thought I’d give a brief primer on the latter. Cryptocurrency occupies an unenviable amorphous legal and regulatory space. I argue that if those laws and regulations can be clarified, however, it will bring the industry a predictability that can stabilize the market and unlock more investment capital.

U.S. Regulations

First, it’s helpful to understand that the relevant laws applicable to cryptocurrency are intended to prevent money laundering, terrorism, crime, and tax evasion. Indeed, that’s why the Senate Committee on Homeland Security and Governmental Affairs held a hearing on the issue in November 2013. All this political attention on cryptocurrency, though, is a good thing. The overall tone of those hearings were positive and focused on the need to allow innovation, meaning this could give the cryptocurrency industry the political will to fast-track development and clarification of applicable laws and regulations. (The UAV, or commercial drone industry was not so lucky. Although government acknowledged the innovation aspect, that industry has been largely grounded for the next few years, no excuses. They won’t even let you UAV your friend a beer).

In the U.S., cryptocurrency companies have to deal with both state and federal regulators. The laws that apply are a bit of an alphabet soup. Ready? AML, BSA, KYC, MSB, OFAC, SAR. If you have a cryptocurrency startup and none of those sound familiar, I fear for you. And if they do, just keep doing what you’re doing. Here are those acronyms decoded:

AML: U.S. Treasury Anti-Money Laundering guidelines

BSA: Bank Secrecy Act

KYC: Know Your Customer (info for AML and sanctions-checking)

MSB: Money Service Business

OFAC: U.S. Treasury Office of Foreign Asset Control

SAR: Suspicious Activity Reporting

The Debate

There are two major camps over the debate on cryptocurrency regulation. On one hand, some believe that government regulation to be in direct conflict with the very principles that cryptocurrency standards for. On the other, those favoring regulation--including venture capital investors--support the development and clarification of the regulatory frameworks surrounding cryptocurrency companies. Overly strict regulations could hamper innovation. However, as in every industry, regulatory clarity allows predictability and transparency. Companies are better able to assess risk, invest in compliance, and make better business decisions.

Some Recent Clarification

On March 18, 2013, the Financial Crimes Enforcement Network (FinCEN), part of the U.S. Department of the Treasury, issued guidance on virtual currencies to clarify the applicability of the Bank Secrecy Act (BSA) to persons (individual, corporation, partnership, etc.), “creating, obtaining, distributing, exchanging, accepting, or transmitting virtual currencies.”

The interpretive guidance essentially classified both administrators and exchangers as MSBs, similar to companies such as Western Union. “Administrators” are defined as persons engaged as a business in issuing (putting into circulation) a virtual currency, and who have the authority to redeem (to withdraw from circulation) such virtual currency (e.g. “miners”). “Exchangers” are those engaged as a business in the exchange of virtual currency for real currency, funds, or other virtual currency (e.g. exchange and some wallet companies). IndentityMind does a good job of summarizing the requirements of MSBs:

• Each business that meets the definition of an MSB must register with FinCEN (www.msb.gov).
• MSBs are required to file Suspicious Activity Report (SAR), if knows, suspects, or has reason to suspect that any transaction or activity is suspicious and it involves or aggregates funds or other assets of $2,000 or more ($5,000 or more if identified by issuers from a review of clearance records).
• All MSBs are required to develop and implement a BSA Compliance Program that includes the 4 Pillars of AML: (1) Internal Controls, (2) Training, (3) Compliance Officer, and (4) Independent Testing. Strict customer identification verification and transaction monitoring policies and procedures can be the most effective weapon against money laundering.
• If an MSB provides either cash-in or cash-out transactions of more than $10,000 with the same customer in a day, it must file a Currency Transaction Report (CTR).

Additional, and more detailed information can be found through the following links:

• Bank Secrecy Act Requirements. A Quick Reference Guide for Money Services Businesses.
• Money Laundering Prevention. A Money Services Business Guide.

In addition to federal regulations, 47 states require such businesses to get money-transmitter licenses. The exceptions are Montana, New Mexico, and South Carolina. Cryptocurrency businesses can’t simply move to those states or abroad though — they must be registered in every state in which they do business. Unfortunately, the cost of obtaining these licenses in the whole country, excluding bonding requirements, is approximately $7 million to $10 million a year.

Let’s Be Realistic Here...

The Verge reports that as of December 2013, only 35 Bitcoin businesses have registered with FinCEN. The U.S. Treasury Department has reportedly reached out to companies it believes needs to register, and state authorities have received numerous inquiries but few registrations. Meanwhile, California and New York are still duking it out as to who will set the regulations that other states will follow. New York has proposed a “bitlicense” regime that may make the money-transmitter license moot in the first place, and California is embroiled in its own internal war over payments innovation. All this is to say that many cryptocurrency companies are in a “wait and see” mode to see how regulations will shake out before they invest too much in actual compliance.

It’s clear now from the FinCen guidance that existing regulations governing money laundering and terrorism concerns apply to virtual currency operators. What isn’t clear is how much compliance will still allow a derivative startup to feel things out without getting in trouble. Is being somewhat compliant better than zero compliance? There are stories out there in the blogosphere that some cryptocurrency startups that registered with FinCen then ended up hearing from their state regulators. Rather than apply for the expensive money-transmission license, they shuttered their doors.

The reality is that most startups I’ve worked will avoid having to deal with legal stuff until they absolutely have to--and for good reason. Ninety-something percent of these startups won’t make it through the year, so why invest heavily in compliance anyway? Most startups won’t even file incorporation papers until an investor asks them to, and the time and effort required for corporate formation is nil as compared with that of financial regulatory compliance. Given the latest news over Mt. Gox and Flexcoin, companies have to decide whether to allocate their limited resources towards security to ward off hackers, or compliance to ward off the government. It’s a tough position I don’t envy.

Regardless, the amount of investment for compliance is as much a business decision as it is a legal one. Companies may decide to simply wait until they get a warning from the U.S. Treasury Department.

International Approaches to Cryptocurrency

Before yesterday, experts cited three main approaches to regulating cryptocurrencies. First, the outlaw approach, taken by Russia and China, is a complete ban on cryptocurrency, and the innovations that surround it. The friendly approach has been adopted by the U.S. and EU, in which cryptocurrency is encouraged so long as companies follow the rules. The EU is especially cited as Bitcoin-friendly, and Bitcoin businesses have an advantage in the EU, which has a uniform licensing program for money transmitters governed by the Payment Service Directive. It allows a payment provider regulated in one country to expand into another country under its existing regulations and supervision. The South American countries have also tended to lean towards a friendlier approach due to the volatility in their domestic currencies.

Lastly, there’s the hands-off approach, as was taken by Japan... until yesterday. In reaction to the Mt. Gox fiasco, Japan announced the taxation and regulation of Bitcoin. Notably, it classifies cryptocurrency as a commodity like gold or silver, and not a currency. Capital gains from trading activities and purchases will be subject to Japan’s 8% tax beginning April 1, as are all purchases made in Japanese Yen. Banks will prohibited from dealing with bitcoins, and securities brokers are also not allowed to facilitate bitcoin trades.

For more information, this Coindesk article does a great job of breaking down each country’s approach to Bitcoin.

If you have questions about the legal/regulatory angles of Bitcoin/cryptocurrency, I’d love to hear them. You can tweet me at @amyywan.