United States: FinCEN Prepaid Access Rule Imposes New Compliance Duties On Non-Bank Money Services Businesses

On July 26, 2011, the Financial Crimes Enforcement Network ("FinCEN") issued a long-awaited final rule implementing the Bank Secrecy Act ("BSA") applicable to Money Services Businesses ("MSBs") with regard to stored value, or prepaid access ("Prepaid Access Final Rule" or "Final Rule").¹ The Final Rule was issued under the Credit Card Accountability Responsibility and Disclosure Act of 2009 (the "CARD Act"), which directed FinCEN to issue final rules regarding the sale, issuance, redemption or international transport of stored value, including stored value cards. Pursuant to that authority, FinCEN published a Notice of Proposed Rulemaking ("NPRM") on June 21, 2010. The Prepaid Access Final Rule follows a related final rule issued by FinCEN on July 18, 2011, which clarified the types of entities subject to the requirements applicable to MSBs ("MSB Definitions Rule").²

Prior to the issuance of the Prepaid Access Final Rule, prepaid products were regulated to a lesser degree compared to other products that could be similarly used as a vehicle for transmitting funds. Notably, issuers, sellers, or redeemers of stored value were not required to register as MSBs and had limited anti-money laundering obligations under the BSA. However, as prepaid products have evolved and become more widely accepted for a variety of purposes, law enforcement agencies, among others, have expressed concern about the lack of comparable regulation over the prepaid industry. The Prepaid Access Final Rule thus reflects FinCEN's belief that the prepaid industry has matured since the MSB categories were originally adopted, and that the industry now warrants regulation at a level commensurate with other categories of MSBs.

In general, the Prepaid Access Final Rule establishes a more comprehensive regulatory framework for "Prepaid Access" (which replaces the term "stored value") in that it expands the parties subject to the BSA to include providers and sellers of prepaid access and expands the obligations of the parties involved in the distribution of prepaid access. For Prepaid Access programs that are subject to the Final Rule, the Provider of Prepaid Access ("Provider") and Sellers of Prepaid Access ("Sellers") (as defined in the Final Rule) will be subject to new registration, customer identification and verification, reporting and recordkeeping obligations, as described below. Providers and Sellers will also be required to adopt and maintain anti-money laundering programs and respond to law enforcement requests for information.

In adopting the Final Rule, FinCEN attempted to balance the needs of law enforcement with the concerns expressed by the prepaid industry regarding the scope of prepaid products covered under the proposal and the potential adverse impact on the many legitimate uses and benefits served by prepaid products. Accordingly, the Final Rule narrows the scope of Prepaid Programs that will be subject to the new requirements for Providers and Sellers of Prepaid Access to those arrangements that "present a realistic risk of being used for money laundering, terrorist financing, and other illicit activities."³ The changes should benefit retailers of prepaid products in particular as far fewer entities will qualify as Sellers of Prepaid Access and become subject to new BSA obligations under the Final Rule.

The effective date of the Prepaid Access Final Rule will be September 27, 2011, except for the new MSB registration requirement for Providers of Prepaid Access, which will become effective January 29, 2012, following FinCEN's adoption of a revised registration Form 107. The effective date of the MSB Definitions Rule will be September 19, 2011.

Overview of the Prepaid Access Final Rule:

Scope

The Prepaid Access Final Rule generally applies to Prepaid Access provided under a Prepaid Program, as those terms are defined in the rule. As further discussed below, the Final Rule also establishes exclusions from the definition of a Prepaid Program for certain types of arrangements that FinCEN believes presents low or minimal risks.

With respect to the entities covered, the Prepaid Access Final Rule does not apply to depository institutions (i.e., banks) issuing prepaid cards, who are subject to separate BSA requirements with respect to their products and services generally. The Final Rule thus applies only to non-bank Providers of Prepaid Access; and (2) Sellers of Prepaid Access.

Definitions

The relevant definitions are Prepaid Access, Prepaid Program, Provider of Prepaid Access, and Seller of Prepaid Access; each of which is discussed in turn below.

Prepaid Access

"Prepaid Access," which replaces the term "stored value" in the BSA rules, is defined as "[a]ccess to funds or the value of funds that have been paid in advance and can be retrieved or transferred at some point in the future through an electronic device or vehicle, such as a card, code, electronic serial number, mobile identification number, or personal identification number."⁴ The supplemental information to the Final Rule notes that the definition of "prepaid access" is modified from the proposal to recognize that Prepaid Access is not itself a device or vehicle, but that such a device or vehicle is a means through which prepaid funds are accessed.⁵

The Final Rule also defines the term "closed loop Prepaid Access" to mean "[p]repaid access to funds or the value of funds that can be used only for goods or services involving a defined merchant or location (or a set of locations), such as a specific retailer or retail chain, a college campus, or a subway system."⁶

Prepaid Program

As noted above, the Prepaid Access Final Rule generally applies only to Prepaid Programs, which are defined as arrangements in which one or more persons acting together provide(s) Prepaid Access.⁷ The Final Rule sets forth circumstances under which particular arrangements involving Prepaid Access will or will not fall within the definition of a Prepaid Program.

Under the Final Rule, certain arrangements that present a low risk of money laundering or other illicit behavior will not be deemed a Prepaid Program.⁸ In a change from the NPRM, these first three arrangements would not be considered a Prepaid Program subject to the rule, regardless of the program features. Thus, for example, an excluded closed loop prepaid access program would not be subject to BSA requirements even if the program allows international use or transfers between prepaid devices within the program.

1. Closed loop Prepaid Access to funds not to exceed $2,000 maximum value. Despite concerns expressed by law enforcement officials and others, the Final Rule excludes most closed loop programs from treatment as a Prepaid Program. In adopting the exclusion, FinCEN stated its belief that closed loop Prepaid Access materially differs from open loop Prepaid Access, and that absent access to very large dollar amounts, closed loop Prepaid Access does not raise significant money laundering concerns.⁹ Accordingly, the Final Rule excludes closed loop Prepaid Access products that do not exceed $2,000 in maximum value.¹⁰

2. Government funded Prepaid Access. The Final Rule expands the scope of the exclusion to capture all levels of government as well as tribal governments and U.S. Territories and Insular Possessions.¹¹

3. Flexible spending and dependent care funded Prepaid Access. This exclusion applies to flexible spending accounts and Health Reimbursement Arrangements. However, the exclusion does not cover access to funds in Health Spending Accounts, because they allow the commingling of health and non-health related funds.¹²

In addition, the Prepaid Access Final Rule provides for limited exclusions for two additional types of arrangements. These two categories may in FinCEN's view present vulnerabilities to criminal use or a higher risk of misuse under certain circumstances.¹³ With respect to these arrangements, the limited exclusions would not apply if the programs offer one or more attributes which FinCEN deems to present heightened AML risks.¹⁴ Specifically, if a program permits any of the following, it would be considered a Prepaid Program under the rule (i.e., its conditional exclusion would be lost): (a) the transmittal of funds or value internationally; (b) transfers between or among users of Prepaid Access within a Prepaid Program; or (c) loading additional funds or the value of funds from non-depository sources.¹⁵

With respect to the condition that additional funds may not be added from non-depository sources, it appears, although it is still not entirely clear, that FinCEN intends to capture the subsequent reload of funds to a Prepaid Access product and not the initial load. The rule text is also not clear as to what constitutes a "non-depository source;" however, the supplemental information to the rule suggests that the term "non-depository source" refers to a non-bank entity that accepts the reload funds on behalf of the issuer, such as a retail location serving as a reload network location.¹⁶

Subject to the high-risk factors or attributes discussed above which would negate the exclusion, the two limited exclusions would apply to:

4. Prepaid Access to employment benefits, incentives, wages, or salaries. This exclusion only applies to the extent that the program is solely employer-funded. Thus, a program that allows cardholders to add their own funds to the underlying card account would be a covered Prepaid Program under the rule. Although several commenters expressed the view that limiting funding sources to employers would reduce the utility of prepaid products as a transaction vehicle for the unbanked and underbanked, FinCEN did not expand the proposed exclusion due to concerns that the ability to co-mingle funds from non-employer sources would increase the risk of money laundering.¹⁷

5. Prepaid Access to funds not to exceed $1,000 maximum value and from which no more than $1,000 maximum value can be initially or subsequently loaded, used, or withdrawn on any day through a device or vehicle. The Final Rule excludes Prepaid Programs in which the Prepaid Access is limited to funds up to a maximum of $1,000. In FinCEN's view, the potential for misuse is significantly reduced for Prepaid Access products subject to low funds limits. In addition, the Final Rule does not adopt the proposed requirement that the maximum value of the Prepaid Access product be clearly visible on the device itself in response to concerns raised by commenters that such a requirement may be un-workable and may not be technologically neutral.¹⁸

Provider of Prepaid Access

In the NPRM, FinCEN proposed to apply a "facts and circumstances" test based on five criteria for identifying as the Provider for a Prepaid Program the party that has "principal oversight and control." Several industry commenters, however, urged FinCEN, for both clarity and simplicity, to permit a contractual determination among program participants as to the appropriate party to serve as the Provider. The Prepaid Access Final Rule thus adopts an "agreement approach" with respect to identifying the party for each Prepaid Program that is the Provider of Prepaid Access.¹⁹ Specifically, the Final Rule permits the participants in a covered Prepaid Program to designate by contract the single party that will serve as the Provider of Prepaid Access. As contemplated by FinCEN, the Provider will serve as the principal conduit of information for the other members of the program and primary source of information about the program for FinCEN, regulators and law enforcement.²⁰

The party designated as the Provider of Prepaid Access must register with FinCEN as an MSB.²¹ In addition, as part of the registration process, each Provider of Prepaid Access must identify each Prepaid Program for which it is the Provider of Prepaid Access. The supplementary information further explains that such list must include sufficient information for FinCEN and law enforcement to identify the Provider of Prepaid Access based on the information submitted in the registration process and the information present on, or included with, the device or vehicle. The Provider of Prepaid Access must also maintain a list of its agents for each Prepaid Program.²² FinCEN intends to publish a new proposed form FinCEN 107 for notice and comment to reflect the Final Rule.²³ For this reason, Providers of Prepaid Access will not be subject to the MSB registration requirement until January 29, 2012.

To address instances where the participants have not designated a Provider, the Final Rule retains the five criteria from the NPRM to establish the activities that FinCEN will consider in determining the appropriate party to be deemed the Provider of Prepaid Access for a particular program.²⁴ These five criteria will assist FinCEN in its determination of which party exercises "principal oversight and control" of the program. The five criteria, which identify indicative activities, are:

The Final Rule does not address enforcement, but the implication of the provision under which FinCEN will determine for a Prepaid Program which party should have registered and filed reports is that penalties for compliance failures will follow if that party is not one that is exempt, i.e., a bank. For example, if the party that best fits the criteria for determining the Prepaid Program's Provider role is a non-exempt entity, such as a non-bank program manager, then enforcement proceedings may follow. The primary agency for enforcement against MSBs will be the Internal Revenue Service.²⁶ It is not clear whether other parties to the Prepaid Program will also be subject to enforcement action. Substantial civil and criminal penalties may be incurred by the parties as well as by individual partners, directors, officers and employees of the parties.²⁷

Seller of Prepaid Access

To address law enforcement concerns regarding the role played by retailers in the prepaid transaction chain, the Prepaid Access Final Rule regulates "Sellers of Prepaid Access" as a type of MSB.²⁸ However, Sellers of Prepaid Access will not be required to register with FinCEN as MSBs. ²⁹The Final Rule takes a more targeted approach for identifying the retailers that would fall under the definition compared to the NPRM and sets forth two circumstances in which a person could become a "Seller of Prepaid Access."³⁰

First, a person will be considered a "Seller of Prepaid Access" if the person sells any Prepaid Access offered under any Prepaid Program, where the customer can use the Prepaid Access before verification of customer identification. Thus, a person would not be a Seller of Prepaid Access with respect to the sale of Prepaid Access that (i) does not fall within the definition of a Prepaid Program; or (ii) includes one or more features that would cause the Prepaid Access to fall within the definition of a Prepaid Program (i.e., international use, person-to-person transfers between users of the Prepaid Access, or reloads from a non-depository source), but does not make such features available prior to the collection and verification of customer identification.³¹

Second, if a person sells Prepaid Access exceeding $10,000 to any person during any one day, it would also be deemed a Seller of Prepaid Access unless the selling entity has implemented policies and procedures reasonably adapted to prevent such sales.³² The risk-based approach is intended to allow retailers with lower risks to avoid the full scope of the rule. The $10,000 threshold applies to any sale of any form of Prepaid Access even if the program is not considered a Prepaid Program under the rule (e.g., closed loop Prepaid Access).³³

Anti-Money Laundering Requirements for Providers and Sellers of Prepaid Access

Under the Final Rule, both Providers and Sellers of Prepaid Access will be subject to requirements generally applicable to MSBs. Thus, they will be required to (1) develop and implement an effective anti-money laundering program; (2) report suspicious activity; (3) comply with recordkeeping requirements relating to customer identifying information and transaction data; and (4) respond to law enforcement requests.³⁴ As noted above, Providers of Prepaid Access will be required to register with FinCEN as MSBs, but Sellers of Prepaid Access will not.

In addition, the Final Rule adds customer identification collection and recordkeeping requirements, including name, date of birth, address, and identification number, for both Providers and Sellers of Prepaid Access.³⁵ The rule also requires an MSB that is a Provider or Seller of Prepaid Access to establish procedures to verify the identity of a person who obtains Prepaid Access under a Prepaid Program.³⁶

Providers of Prepaid Access must collect and retain access to the identifying information for five years after the last use of the Prepaid Access^.37 Separately, a Provider must also maintain access to transactional records necessary to reconstruct Prepaid Access activation, loads, reloads, purchases, withdrawals, transfers, or other prepaid-related transactions, also for a period of five years.³⁸

Sellers of Prepaid Access must collect and retain the identifying information for five years from the date of sale of the Prepaid Access.³⁹

As discussed above, however, FinCEN has modified the definition of "Prepaid Program" with the intent of significantly reducing the types of arrangements that would be subject to the requirements to obtain and retain customer information by a Provider or Seller of Prepaid Access.⁴⁰

Overview of the MSB Definitions Rule

On July 18, 2011, FinCEN separately issued the MSB Definitions Rule in final form to clarify the institutions that would qualify as money services businesses as well as to facilitate FinCEN's subsequent adoption of the Prepaid Access Final Rule. Entities covered under the MSB definition would be required to comply with FinCEN's anti-money laundering rules under the BSA.⁴¹

Revisions to the General Definition of "Money Services Business"

Among other things, the MSB Definitions Rule updates the regulatory definition of "money services business" to clarify the scope of the definition. For example, the rule clarifies that a person or entity's coverage as an MSB depends on activities performed, not on a person's or entity's status as a licensed business or as a for-profit venture.⁴² However, the rule also includes a provision excluding from the MSB definition a natural person, or individual, that engages in otherwise covered MSB activities on an infrequent basis and not for gain or profit.⁴³

In addition, the MSB Definitions Rule clarifies that coverage depends on activities performed within the USA rather than on the physical presence in the USA of agents, agencies, branches or offices. The Final Rule thus recognizes that the Internet and other technological advances have facilitated the ability of foreign-based entities to offer MSB services in the United States. Accordingly, the MSB Definitions Rule extends coverage under the BSA rules to require foreign institutions engaging in Money Services Business "wholly or in substantial part" within the USA to register with FinCEN and otherwise comply with FinCEN BSA regulations. Whether or not a foreign-located person's MSB activities occur within the United States will depend on the "facts and circumstances"; however, the MSB Definitions Rule notes specifically that whether services are being performed for customers located in the USA is one determinative factor. Under the MSB Definitions Rule, foreign-located MSBs will be subject to the same reporting and record keeping and other requirements as MSBs with a physical presence in the United States, with respect to their activities in the United States.⁴⁴

Revisions to Stored Value Related Definitions

The MSB Definitions Rule also separates the provisions dealing with stored value from those covering issuers, sellers and redeemers of travelers checks and money orders. Specifically, the definition of a money services business is clarified to apply to parties that issue stored value or sell or redeem stored value for amounts above the $1,000 per day per person minimum threshold.⁴⁵ Thus, the MSB Definitions Rule consolidates what had been previously separate terms referring to "issuers of stored value" and "sellers or redeemers of stored value" into a single definition covering "issuers, sellers, or redeemers of stored value." As discussed above, the Prepaid Access Rule subsequently adopted the new term of "Prepaid Access" to replace the "stored value" term in the BSA rules and revised the MSBdefinition once more to replace the definition of "issuer, seller, or redeemer of stored value" with the new categories of MSBs of Providers and Sellers of Prepaid Access (discussed above).

The MSB Definitions Rule also revises the definition of "money transmitter" to exclude from that term a person that "provides stored value" to recognize that under the Prepaid Access Final Rule, Providers and Sellers of Prepaid Access will be treated as separate categories of MSBs.⁴⁶

Action Plan – Evaluate Compliance Obligations and Adopt Compliance Measures

Each non-bank participant organization in any program of issuance, distribution or sale of prepaid products must evaluate each program and consider compliance measures that will apply. Key steps will include:

• Determine whether it qualifies as the Provider of Prepaid Access or a Seller;

• Ensure that an appropriate party is identified as the Provider for each Prepaid Program and has accepted the obligations of a Provider; and ensure that all other participating parties understand and accept obligations to provide necessary information to fulfill the Provider's reporting obligations on a timely basis;

• Consider whether modifications should be made to programs to qualify or clarify qualification for exemptions and exclusions from coverage under the Final Rule; and

• Ensure that all parties' obligations regarding each Prepaid Program are adequately documented. In addition, contract amendments adopted by the parties to express designation of a Provider and the parties' related obligations should address allocation of liability through appropriate warranties, representations and indemnification provisions as well as perhaps providing a termination remedy in the event such obligations are breached.

Footnotes

^{1 76 Fed. Reg. 45403 (July 29, 2011). The initial rule release can be found at www.fincen.gov/statutes_regs/frn/pdf/Prepaid_Final_7-22-201.pdf.}

^{2 76 Fed. Reg. 43585 (July 21, 2011).}

^{3 76 Fed. Reg. at 45407.}

^{4 76 Fed. Reg. at 45413; § 1010.100(ww).}

^{5 76 Fed. Reg. at 45413.}

^{6 § 1010.100(kkk).}

^{7 76 Fed. Reg. at 45406-07; § 1010.100(ff)(4)(iii).}

^{8 76 Fed. Reg. at 45407.}

^{9 76 Fed. Reg. at 45407-08.}

^{10 § 1010.100(ff)(4)(iii)(A).}

^{11 76 Fed. Reg. at 45408; § 1010.100(ff)(4)(iii)(B).}

^{12 76 Fed. Reg. at 45408; § 1010.100(ff)(4)(iii)(C).}

^{13 76 Fed. Reg. at 45408-09.}

^{14 Id.}

^{15 § 1010.100(ff)(4)(iii)(D)(2)}

^{16 See, e.g., 76 Fed. Reg. at 45411.}

^{17 76 Fed. Reg. at 45411; § 1010.100(ff)(4)(iii)(D)(1)(i).}

^{18 76 Fed. Reg. at 45409, 45411;§ 1010.100(ff)(4)(iii)(D)(1)(ii).}

^{19 76 Fed. Reg. at 45405-06.}

^{20 Id.}

^{21 76 Fed. Reg. at 45410, 45414; § 1022.380(a)(1).}

^{22 76 Fed. Reg. at 45414; § 1022.380(a)(1).}

^{23 76 Fed. Reg. at 45414.}

^{24 76 Fed. Reg. at 45406.}

^{25 § 1010.100(ff)(4)(ii).}

^{26 § 1010.810(b)(8).}

^{27 §§ 1010.820, 1010.840.}

^{28 76 Fed. Reg. at 45406.}

^{29 § 1022.380(a)(1).}

^{30 76 Fed. Reg. at 45406.}

^{31 76 Fed. Reg. at 45412; § 1010.100(ff)(7)(i).}

^{32 § 1010.100(ff)(7)(ii).}

^{33 76 Fed. Reg. at 45412.}

^{34 76 Fed. Reg. at 45413, 45414; § 1022.210(d)(1).}

^{35 76 Fed. Reg. at 45413; § 1022.210(d)(1)(iv).}

^{36 76 Fed. Reg. at 45413; § 1022.210(d)(1)(iv). In addition, Sellers of Prepaid Access that sell Prepaid Access of any kind (e.g., closed loop Prepaid Access) in excess of $10,000 to any person in one day will also be required to obtain customer identification. See 76 Fed. Reg. at 45413; § 1022.210(d)(1)(iv).}

^{37 § 1022.210(d)(1)(iv).}

^{38 76 Fed. Reg. at 45414; § 1022.420.}

^{39 § 1022.210(d)(1)(iv).}

^{40 76 Fed. Reg. at 45413. FinCEN estimates that less than 1% of retailers currently selling Prepaid Access would be considered "Sellers of Prepaid Access" under the Final Rule. See 76 Fed. Reg. at 45416-17.}

^{41 76 Fed. Reg. 43585. FinCEN further noted that agents of an MSB would also be considered a MSB if it satisfies the definition of "money services business," and that whether a party is an agent of another MSB is relevant only for registration purposes. See 76 Fed. Reg. at 43587.}

^{42 76 Fed. Reg. at 43587-88.}

^{43 76 Fed. Reg. at 43588.}

^{44 76 Fed. Reg. at 43589.}

^{45 76 Fed. Reg. at 43591-92; § 1010.100(ff)(4).}

^{46 76 Fed. Reg. at 43593-94.}

The content of this article does not constitute legal advice and should not be relied on in that way. Specific advice should be sought about your specific circumstances.