A great friend of Glenbrook’s is Broox Peterson, formerly Senior Vice President and Assistant General Counsel at Visa International and currently in private practice. In 2006, Broox wrote a very popular article that we shared on PaymentsNews.com. He’s just updated that article to reflect some changes – and we’re delighted to be able to share the updated version here! This article is © Broox W. Peterson 2006, 2012.
Broox W. Peterson
Why is that? Well, think about your established competitors offering payments services. They include banks and other financial institutions, and these are regulated. Newer competitors like PayPal are also regulated. Now think about why that is. Well, one reason is that they handle other peoples’ money (and presumably your family’s too). Banks and other financial institutions take deposits or sell payment instruments that substitute for cash to consumers. Money transmitters like PayPal receive money from customers for purposes of delivering it to others per instructions of the customer. But, you say, the beauty of my business is that I do not take deposits, or sell payment instruments. I just provide a mechanism for consumers to move value from their existing accounts with banks or other regulated financial institutions. I am merely a financial intermediary, moving data. Surely that is not regulated activity? Yes, no and maybe.
Finding out whether you are required to be licensed or registered as a money transmitter (or other type of money services business) is going to cost you money, but the good news is that discovering this now has saved you lots of money and headache versus finding out about it later. More later about how much more start-up money you will need.
If you have followed the history of PayPal then you already know about the regulatory perils of the payments business. After years of assertion that their business model fell outside of regulation applicable to banks and money transmitters, they were forced to obtain licenses as a “money transmitter” in a large number of states. It was embarrassing for PayPal, since it all came to a head when they were about to do an IPO. Actually, the executives of PayPal should probably have been happy with simple embarrassment, since they could have ended up with an all-expenses-paid federal institution vacation.
Paypal’s experience is not an isolated case, just the most visible. Whether through ignorance of the requirements, or the ever-enthusiastic claim that “we’re different”, many a payment-related start-up has had its rollout plans delayed indefinitely by a last minute scramble for required licenses from regulators not particularly impressed with the applicant’s new-found sense of urgency.
There are actually two distinct money transmitter regulatory schemes to consider, each with different purposes, but with some overlap.
The Bank Secrecy Act
The first regulatory scheme that a payments business must comply with is the federal Bank Secrecy Act (“BSA”), as modified in 2001 by the Patriot Act. The BSA before its modification was designed to ferret out money laundering, but the 2001 amendments gave it new teeth addressing concerns about terrorist financing. Under the law, “Money Services Businesses” are subject to registration and other requirements. Money Services Businesses for purposes of the law and implementing regulations include (partial list most relevant to payments) (i) money transmitters, (ii) check cashers, (iii) issuers, sellers and redeemers of money orders or travelers checks, and (iv) providers of prepaid access (defined later). This article will focus on new entrants into the payments business that are may be money transmitters or providers of prepaid access, if they are subject to the BSA requirements at all.
A “Money Transmitter” is defined as “Any person … who engages as a business in accepting currency, or funds denominated in currency, and transmits the currency and funds, or the value of the currency and funds, by any means…” or “any other business engaged as a business in the transfer of funds”. Although this is as all-encompassing a definition as one can imagine, there are some exceptions: (i) transmission of funds where the transfer is incidental to a transaction for goods or services (other than money transmission) for which the money is paying; (ii) providing delivery, communication, or network access services to a money transmitter to support money transmission activities; and (iii) processing payments through a clearance and settlement system by agreement with a seller or creditor for purchase of, or payment of a bill for, a good or service.
A “Provider of Prepaid Access” is much harder to define, and the rules attempting to do so are complex, layered, and nuanced, which likely pleases only lawyers. Not all prepaid schemes are covered under the rules (e.g, some closed network schemes), but a useful description here of the rules defining which ones are or are not covered would not make good reading (trust me). If a prepaid scheme is covered under the rules, the entity in the program that has principal oversight and control over the program is the Provider of Prepaid Access and must register with the Department of Treasury Financial Crimes Enforcement Network (“FINCEN”, the regulator that enforces the BSA) and be responsible for compliance with the requirements in the BSA. The participants in a prepaid scheme are permitted to designate one of them as the Provider of Prepaid Access by contract, but if they do not, then FINCEN will figure out which entity in the program has principal oversight and control over the program and is required to register and comply with the BSA. It is likely that if FINCEN is having to figure this out, they will not be happy and you will not be either.
All Money Services Businesses are required to register with FINCEN, with certain exceptions. Agents of registered Money Services Businesses are not required to register unless they are conducting money services activities independently of their role as agent. Banks, credit unions and regulated broker-dealers are not required to register since they are already heavily regulated by other agencies.
All Money Services Businesses are required to have effective anti-money-laundering programs in place (an “AML Program”). The AML Program must be designed to address the risks of the particular business but must meet certain minimum requirements. These include policies, procedures and internal controls for customer identity verification, record keeping, report filing and other compliance matters, education of personnel in the AML Program, a designated compliance officer, and provisions for third party review of compliance. Prepaid Access Providers are additionally required to keep for 5 years transaction records created in the ordinary course of business necessary to reconstruct prepaid access activation, loads, reloads, purchases, withdrawals, transfers, or other prepaid-related transactions.
Customer identity verification must be based on the gathering and use of information about Money Service Business customers that reasonably verifies identity. Although the adoption of a Customer Identification Program like that required of banks is not necessary, a program that provides similar verification strength is required. A Provider of Prepaid Access must retain records of identifying information for 5 years, and a retail seller of prepaid products providing a person access to more than $10,000 must obtain identity information and retain the records for 5 years.
Every Money Services Business must report suspicious transactions over $2000 ($5000 in some cases), commonly referred to as a “SAR”, or suspicious activity report. Suspicious transactions are those where the intent appears to be to avoid or violate applicable law or to further illegal activity, e.g., money laundering. Transactions with customers involving currency totaling more than $10,000 must be reported.
Operating a Money Services Business without a license required under any state money transmitter licensing scheme (these are described next) or registration with FINCEN is a serious federal crime, and this liability extends to any person who “knowingly conducts, controls, manages, supervises, directs, or owns all or part of the unlicensed money transmitting business”. As for ignorance of these requirements, remember Jeremy Bentham’s observation that lawyers are the only persons in whom ignorance of the law is not punished.
State Money Transmitter Licensing Requirements
That brings us to the second regulatory scheme a payments business must comply with, state money transmitter licensing requirements currently in effect in 47 states, the District of Columbia, and Puerto Rico. New Mexico, Montana, and South Carolina do not currently have money transmitter licensing laws, but that could change. State money transmitter licensing schemes originally had a consumer protection purpose, but increasingly state regulators require anti-money laundering compliance as well. Failure to obtain the required license and comply with requirements is typically a state criminal or civil offense with fines and the possibility of imprisonment. Many of the licensing requirements are described below in the “Costs” section.
The difficulty with these state statutory and regulatory schemes is that there is no national standard for defining money transmission requiring licensing, or the exclusions from these requirements. This variability and ambiguity adds much complexity to any compliance program, particularly in the start-up phase. For instance, older statutes written before the advent of electronic financial transactions may specify licensing requirements only for sellers of checks (i.e. travelers checks, money orders), since those were the original “money transmitters”. Notwithstanding, regulators in those states may take an expansive view of the coverage of their laws to include the new forms of electronic money transmission. Unfortunately, those regulators choosing to take an expansive view of their authority do not publish that interpretation anywhere, which makes a lawyer’s job more difficult. Most state regulatory schemes are more recent and thus more modern and address directly electronic money transmission businesses. Additionally, many states either expressly include issuance and other operation of prepaid schemes as money transmission or administratively interpret their money transmission licensing requirements to include prepaid, in the latter case again generally not publishing their interpretation.
Some argue that the patchwork of separate and inconsistently drafted and interpreted state licensing schemes hinder payments innovation by new entrants. Although there exists a framework for states to coordinate examination and enforcement actions involving a money transmitter licensed in more than one state, seeking to minimize duplication of effort, few states appear to offer simplified licensing to money transmitters already licensed in another state. Perhaps a federal money-transmitter-licensing scheme would be best in terms of efficiency and facilitating innovation, but it seems doubtful that the need is dramatic enough to get politicians’ attention, and thus the time right to obtain federal legislation to supersede such an entrenched state regulatory power.
Some lawyers have argued that there are loopholes that may be available to a money transmitter that seeks to avoid licensing in particular states. These loopholes are often based on the wording of a state’s statute as it relates to their client’s particular business model. However, if regulators discover an unlicensed entity they think should be licensed, notwithstanding your lawyer’s opinion to the contrary, they will force licensing under the threat of shutting down the business and perhaps imposing other penalties. If the regulator suspects bad faith, he or she may refuse to license you at all, since one purpose of the licensing process is to screen out less than honorable applicants. Unless you enjoy a good near-death experience and a long and expensive fight involving lots of lawyers (preferably different ones than got you into the pickle), it is advisable to find out what the regulator thinks you should do and, unless you can persuade them otherwise, do it up front. If you really want a loophole, the best one is not to touch other people’s money, but rather outsource that function to a bank or other licensed entity. Even if your long-run goal is to be another PayPal, and thus fully-licensed, riding on someone else’s licenses while you figure out if your business model has wheels can make a lot of sense.
What It’s Going to Cost You if You Are a Money Services Business
Registration with FINCEN and development of an AML Program should cost in the lower 5 figures upfront, with ongoing administration and reporting costs being variable depending on your business. It is compliance with the state requirements that can add up.
Most, but not all, states require payment of some sort of non-refundable application/investigation fee. Some fees are fixed, but others are based on the amount of investigation the state needs to do. The range of fixed fees is great, from $250 (Alabama) to $3000 (New York), but most are in the $500-$750 range.
Annual license fees, and similar license renewal fees are required in most states, but not in others. Assume that roughly 75% of the states have some sort of fixed license fee. These can range from $100 to $2500, or more. $1000/jurisdiction with fees could be a rough estimate of the average.
In some states, the annual “fee” is, instead of a fixed fee, an assessment based on the licensee’s share of transaction volume by licensees in the state, calculated to recover regulatory costs. The assessment formula changes but currently in New York licensed money transmitters are assessed a total of $2.343M, allocated among all New York licensed money transmitters, based on New York sales volume. In Texas it currently ranges from $1950-$15,000 per licensee depending on the sales volume in Texas.
There are net worth requirements licensees must satisfy in nearly all jurisdictions, ranging from $25,000 to $500,000.
You will be required to keep in place a surety bond, or deposit of qualifying securities in lieu of bond in all jurisdictions, dedicated to activities in the jurisdiction. This size of this bond ranges from a base of $10,000 in some small states to $500,000 in New York, with a typical bond requirement being $50,000-$100,000, with the option for the regulators in the jurisdiction to require higher amounts at their discretion. The cost of a bond can be 1-3% of the face amount, and can be higher for higher-risk entities.
In many jurisdictions you will pay the cost of investigating your application (and examining you after you are licensed and operating, if that occurs). These expenses cannot be predicted in advance.
In many jurisdictions you will be required to submit quarterly reports, including unaudited financial statements and other information, and all jurisdictions will require some sort of annual report, often including audited financial statements, so this will require administrative time. You will also be required to keep records complying with various requirements, which regulators can request at any time.
Last, but not least, you will need to budget for legal expense, in addition to the expenses described above. As with the other expenses, this is difficult to forecast in absolute terms, since much depends on how many states in which you intend to operate and whether you intend to simply go ahead and obtain licenses in all these jurisdictions or try to persuade regulators that licenses are not required. If you want simply to obtain licenses in every state that thinks you should have one, without fighting their interpretation of their statute, perhaps around $100,000 in legal fees will be sufficient. If you want to minimize the number of licenses you have to obtain, perhaps to minimize the yearly and ongoing compliance tasks that you will have to staff, then the cost can be $300,000 or more.
Although the costs described above are not insignificant, just remember that ignoring the requirements described in this article is priceless.
Conclusion and Caveat
Let me point out, hopefully unnecessarily, that no decisions should be taken based on this brief description of money transmitter licensing and other requirements. You need to work with a lawyer experienced with the payments business and these matters, and the sooner the better, since the way to minimize headache and expense is to work with the regulators early, but do so using counsel who know how to explain your business in terms the regulators appreciate.
