FinCEN AML Requirements for Cryptocurrency Businesses

[cryptolaw_takeaway]Cryptocurrency businesses that exchange, administer, or transmit virtual currency qualify as Money Services Businesses under FinCEN regulations. This classification triggers Bank Secrecy Act compliance obligations including registration, AML program implementation, suspicious activity reporting, and extensive recordkeeping. Civil penalties can reach millions of dollars, and criminal prosecution remains possible for willful violations.[/cryptolaw_takeaway]

Money Services Business Classification

FinCEN guidance, particularly FIN-2013-G001, establishes that persons engaged as a business in exchanging virtual currency for real currency or other virtual currency, or transmitting virtual currency, are money transmitters subject to BSA requirements. This includes cryptocurrency exchanges, payment processors handling crypto, and certain wallet providers.

Key distinctions determine coverage:

• Exchangers: Businesses that exchange virtual currency for fiat or other virtual currency
• Administrators: Persons engaged in issuing and redeeming virtual currency
• Users: Individuals obtaining virtual currency for personal use (generally exempt)

FinCEN clarified in 2019 that these definitions apply regardless of the underlying technology, encompassing DeFi protocols, stablecoins, and other innovations.

Registration Requirements

MSBs must register with FinCEN within 180 days of establishing operations. Registration requires identifying the business, its locations, ownership structure, and the specific MSB activities conducted. Registration renewal is required every two years.

Registration alone is insufficient—businesses must maintain current information and promptly update FinCEN regarding material changes including ownership, business model, or contact information.

AML Program Requirements

The Bank Secrecy Act mandates MSBs implement written Anti-Money Laundering programs containing five pillars:

• Internal Policies and Procedures: Written policies addressing customer identification, transaction monitoring, SAR filing, and sanctions compliance
• Designated Compliance Officer: A qualified individual responsible for day-to-day AML program management
• Ongoing Employee Training: Regular training for all relevant personnel on AML obligations and red flags
• Independent Testing: Periodic review by internal audit or third parties to assess program effectiveness
• Risk Assessment: Documented analysis of ML/TF risks specific to the business model, customer base, and geographic exposure

Customer Identification and Verification

MSBs must verify customer identity before establishing relationships or conducting transactions above certain thresholds. Requirements include collecting identifying information, verifying through documentary or non-documentary methods, and maintaining records of verification procedures.

Customer Due Diligence (CDD) extends beyond initial identification to understanding the nature of customer relationships and monitoring for consistency with expected activity patterns.

Suspicious Activity Reporting

MSBs must file Suspicious Activity Reports (SARs) for transactions of $2,000 or more that the business knows, suspects, or has reason to suspect involve funds from illegal activity, are designed to evade BSA requirements, lack business purpose, or involve criminal activity.

SARs must be filed within 30 days of detection (or 60 days if no suspect is identified). The filing obligation is confidential—businesses cannot disclose SAR filings to customers or others outside law enforcement.

Recordkeeping and Reporting

BSA regulations require maintaining records of transactions exceeding $10,000, customer identification documentation, and AML program records for five years. Currency Transaction Reports (CTRs) must be filed for cash transactions exceeding $10,000, though cryptocurrency-specific CTR requirements remain under development.

Enforcement and Penalties

FinCEN enforcement actions against cryptocurrency businesses have resulted in significant penalties:

• BTC-e: $110 million penalty for operating an unlicensed MSB and AML violations
• BitMEX: $100 million combined penalty with CFTC for BSA violations
• Bittrex: $24 million penalty for AML and sanctions failures

Beyond civil penalties, individuals can face criminal prosecution under 18 U.S.C. § 1960 for operating unlicensed money transmitting businesses, carrying potential imprisonment of up to five years.

This article provides general information about FinCEN requirements for cryptocurrency businesses. Compliance obligations are fact-specific and evolving. Consult qualified AML counsel for guidance on your compliance program. Seth Goettelman is licensed in Wisconsin and Florida.