08.02.2011

|

Updates

On July 26, 2011, the Financial Crimes Enforcement Network of the Department of the Treasury ("FinCEN") issued a final rule amending the Bank Secrecy Act's regulations and establishing comprehensive regulatory requirements for prepaid access ("Final Rule"). The Final Rule applies regulations regarding money service businesses ("MSBs") to “providers” and “sellers” of "prepaid access," a term that replaces "stored value" in the existing regulations and that is defined in broad, technology-neutral terms. The Final Rule is effective on September 27, 2011, 60 days after its July 29, 2011 date of publication in the Federal Register.

Under the Final Rule, both providers and sellers of prepaid access must collect personal information from customers, maintain transaction records, file suspicious activity reports and comply with other requirements of MSBs. In addition, providers of prepaid access must register with FinCEN. Forms of prepaid access that FinCEN has determined pose a lower risk of money laundering and terrorist financing are exempt from these regulations, with some limitations.

New regulations imposed by the Final Rule impact prepaid products and prepaid industry participants in many ways, including the following: 

  • Closed loop prepaid access (including in-store credit for merchandise returns) is regulated, for the first time, if more than $2,000 can be associated with the prepaid access device or vehicle on a given day; 
  • Low-value ($1,000 or less) open loop prepaid access is regulated, for the first time, if it can be (1) used internationally, (2) transferred between or among other persons within the prepaid program, or (3) reloaded by a nondepository (nonbank) source;  
  • Retailers who sell nonexempt forms of prepaid access are regulated if the prepaid access can be used before the customer's identity has been verified; 
  • Persons who sell $10,000 or more of prepaid access per person per day (including bulk sales of prepaid closed loop cards) are either regulated or required to have policies and procedures in place to prevent such sales; and 
  • Providers and sellers of prepaid access are required to collect and store personally identifying information from customers on an increased range of prepaid products.

The Final Rule does not shed much new light on issues arising from emerging applications of prepaid products, such as whether prepaid access specific to online marketplaces and in-app purchases is closed loop or open loop.

Regulated Forms of Prepaid Access

Unless an exemption applies, the Final Rule applies broadly to any prepaid program that provides access to funds, or the value of funds, that (1) have been paid in advance and (2) can be retrieved or transferred at some point in the future through an electronic device or vehicle, such as a card, code, electronic serial number, mobile identification number or personal identification number.

FinCEN exempts from most of the regulations certain forms of prepaid access that it has determined pose a decreased risk of money laundering, terrorist financing and other criminal activities, including the following:

Partial Exemption for Closed Loop Prepaid Access to $2,000 or Less. Closed loop prepaid access is "prepaid access to funds or the value of funds that can be used only for goods and services in transactions involving a defined merchant or location (or set of locations), such as a specific retailer or retail chain, a college campus, or a subway system." In the past, FinCEN completely exempted closed loop prepaid access from regulation. Under the Final Rule, closed loop prepaid access is exempt only if no more than $2,000 can be associated with the prepaid access vehicle or device on a given day. Significantly, FinCEN did not adopt a proposed rule (under its July 21, 2010 Notice of Proposed Rulemaking) that would have also regulated low-value closed loop prepaid access that could be used internationally, transferred between users or reloaded by nondepository sources.

Although not stated in the definition, FinCEN's guidance states that a defined merchant may comprise a set of affiliated retailers or retail chains. Similarly, although not stated in the definition's illustrative list of defined merchants or locations, FinCEN's guidance implies that it still considers closed loop prepaid access to include "closed system products such as a mall-wide gift card program." The Final Rule does not address whether prepaid access specific to online marketplaces and in-app purchases should be considered closed loop or open loop.

By definition, closed loop prepaid access is not a medium through which funds paid can later be withdrawn in the form of cash. Given this fact, FinCEN acknowledges that closed loop prepaid access is a somewhat unattractive, unlikely and inefficient means of quickly moving large sums of money. Nevertheless, law enforcement purportedly has emphasized to FinCEN that, in large dollar amounts, closed loop prepaid access remains vulnerable to criminal enterprises laundering funds through merchandise and trade, particularly high-value electronics and technology. FinCEN has apparently attempted to compromise between these two positions by capping the closed loop exemption at $2,000, thereby addressing law enforcement concerns regarding a limited segment of the closed loop prepaid access market while still exempting many retail sales of closed loop prepaid access for consumer goods and services. The $2,000 exemption cap applies to all closed loop prepaid access, including in-store credit for merchandise returns.

Limited Exemption for Prepaid Access to $1,000 or Less. The Final Rule contains a limited exemption for prepaid access to funds of up to $1,000, from which no more than $1,000 can be initially or subsequently loaded, used or withdrawn through a device or vehicle on any day. Significantly, however, this exemption applies only if the following restrictions exist:  

  • No International Transmittals. The prepaid access does not permit funds or value to be transmitted internationally. To determine whether a prepaid access permits international transmittals, FinCEN's guidance suggests that the controlling question is whether the prepaid access can be used as a vehicle for moving money outside the United States. For example, a network-branded general use prepaid card for $1,000 or less is not exempt if it can be used to withdraw cash from foreign ATMs or purchase goods and services from foreign merchants. In contrast, this exemption applies to open loop prepaid access for $1,000 or less that can be used only to make Internet purchases from U.S.-based merchants, even if the customer is outside the United States or the purchased goods are shipped to a foreign location, because the prepaid funds remain in the United States. 
  • No Person-to-Person Transfers. The prepaid access does not permit transfers between or among other users within a prepaid program ("P2P"). FinCEN's commentary does not expand on this restriction.  
  • No Reloads From Nondepository Sources. The prepaid access does not permit nondepository sources to load additional funds or the value of funds. Allowing the initial prepaid access load to come from a nondepository source (for example, a retailer) does not, by itself, trigger this restriction. The Final Rule provides no guidance to define a "nondepository source."

These restrictions on the exemption for prepaid access of $1,000 or less are determined based on the functionality of the prepaid access itself, rather than on what it can be used to purchase. For example, if an open loop prepaid card that satisfies the criteria listed above is used to purchase an open loop prepaid card that does not (e.g., one that allows international transfers), then the first prepaid card is exempt even though the second prepaid card is not.

Limited Exemption for Prepaid Access for Employees. The Final Rule exempts prepaid access to funds for employment benefits, incentives, wages or salaries that meet the international transmittal restriction, P2P restriction and nondepository source reload restriction discussed above.

Regulated Entities

The Final Rule regulates two entities: providers of prepaid access covered by the regulations and certain sellers of prepaid access covered by the regulations.

Providers of Prepaid Access. The Final Rule imposes the most stringent requirements on "providers of prepaid access." A provider of prepaid access can be determined either (1) by agreement between the participants within the prepaid program or (2) under a facts and circumstances test. 

  • Determined by Agreement. The Final Rule affirmatively requires participants in a prepaid program to identify one participant to act as the designated provider of prepaid access and serve as the principle conduit for access to information for fellow prepaid program participants. An addition to the Final Rules based on the near unanimous recommendation from commentators, this agreement-based approach allows for allocation of duties consistent with the particular needs of prepaid program participants. It also allows quick identification of the central source of information regarding the prepaid program for regulators and law enforcement, as the designated provider of prepaid access must register with FinCEN as an MSB.  
  • Determined by Facts and Circumstances. If no participant registers with FinCEN as the provider of prepaid access, then FinCEN will use a facts and circumstances test to determine which participant exercises principal oversight and control over the prepaid program. Although the list is not exhaustive and it is unlikely that all factors will apply to just one participant, the Final Rule provides five factors to determine which prepaid program participant is the provider: (1) organizing the prepaid program; (2) setting the terms and conditions of the prepaid program and determining whether they have been violated; (3) determining the other businesses that will participate in the prepaid program (for example, the issuing bank, payment processor or distributor); (4) controlling or directing the appropriate party to initiate, freeze or terminate prepaid access; and (5) engaging in additional activities that show oversight and control over the prepaid program.

Because financial institutions are excluded from the definition of MSBs, banks that serve in a role that could otherwise fit the definition of a provider of prepaid access are not subject to this particular rule but are subject to other Bank Secrecy Act regulations regarding their products and services, as well as to the regulations of federal banking agencies.

Sellers of Prepaid Access. The Final Rule regulates certain persons who sell prepaid access as a separate category of MSB. Under the Final Rule, a seller of prepaid access is any person who (1) receives funds or the value of funds in exchange for loading or reloading prepaid access and (2) either (a) sells prepaid access that can be used before the customer's identification has been verified, or (b) sells any form of prepaid access to more than $10,000 in funds per person per day without reasonable policies and procedures in place to prevent such sales. FinCEN states in its guidance that regulating sellers of prepaid access is appropriate because sellers have face-to-face contact with customers at the point of sale and are in the best position to collect customers' identifying information.  

  • Use Before Verification of Customer Identification. The Final Rule applies to persons who sell prepaid access for any prepaid program that can be used before a prepaid program participant verifies the customer's identity. Therefore, the regulations do not apply to a person who sells prepaid access if such prepaid access can be activated only after, for example, calling a phone number and providing the requested customer identifying information. Furthermore, this restriction applies only to the sale of prepaid access covered by the definition of prepaid program and therefore does not apply to the sale of prepaid access that meets the exemptions described above. For example, a person who sells prepaid access is not considered a seller of prepaid access and subject to the regulations under this definition by selling only open loop prepaid access that allows $1,000 or less to be loaded and used immediately but also requires customer verification before the customer can use the prepaid access internationally or to effect P2P transfers. In this instance, the regulations apply to the provider of prepaid access but not to the person who sold the prepaid access (assuming that all sales of prepaid access per person per day are capped at under $10,000). 
  • Sale of More Than $10,000 of Any Form of Prepaid Access. Significantly, the $10,000 cap applies to any sale of prepaid access, including prepaid access that is otherwise exempt under the definition of prepaid program. FinCEN states in its guidance that prepaid access transactions involving high dollar amounts pose inherent money laundering risks, so the sale of amounts greater than $10,000 should automatically raise red flags. Retailers are already obligated under Bank Secrecy Act regulations to file reports of cash transactions exceeding $10,000.  
  • However, if a retailer implements and adheres to policies and procedures reasonably adapted to prevent the sales of more than $10,000 of prepaid access per person per day, then the rule suggests that the retailer will receive a safe harbor and will not be subject to the regulations, even if a sale of $10,000 or more of prepaid access to a person in a day occurs inadvertently. Whether the retailer's internal policies and procedures are reasonably adapted to prevent prepaid access sales of more than $10,000 depends on the retailer's line of business, customer base and prepaid access sales volume.

Compliance Requirements for Providers and Sellers of Prepaid Access 

Providers and sellers of prepaid access must now comply with the Bank Secrecy Act's regulations related to MSBs. In particular, the following requirements apply: 

  • Anti-Money Laundering Program and Customer Identification Information Collection and Retention.  Providers and sellers of prepaid access must, as MSBs, maintain adequate anti-money laundering programs.  The anti-money laundering program must be commensurate with the MSB's risk, including its size, geography and customer base. Providers and sellers of prepaid access with higher risks must implement more comprehensive policies, procedures and internal controls than providers and sellers with lower risks. The anti-money laundering program is required to be sufficiently detailed with standards and criteria addressing how information is collected, accessed, verified and retained; communications with employees; and training for persons serving agents of the providers or sellers. 
  • As part of the anti-money laundering program, providers and sellers must have policies and procedures in place to access and retain customer identifying information. Identifying information includes the customer's name, date of birth, address and identification number. While both are responsible under the regulations, providers and sellers of prepaid access can agree with one another regarding who will actually collect the customer identifying information. Sellers must retain this information for five years from the date of sale, and providers must have access to this information for five years from the date of the last transaction using the prepaid access. 
  • Transaction Recordkeeping. The Final Rule requires providers of prepaid access to retain transaction-specific records generated in the ordinary course of business for five years. Transactions include any information necessary to reconstruct activity associated with the prepaid access, such as activation, load, reload, purchase, withdrawal and transfer. Such records must reflect each transaction's type (ATM withdrawals, point-of-sale purchase, etc.), amount, location, date and time, and any other unique identifiers. The records must be easily accessible and retrievable upon request from FinCEN, law enforcement or judicial order. FinCEN does not prescribe any particular format for keeping these records, but providers bear the ultimate responsibility for compliance. 
  • Suspicious Activity Reporting. Providers and sellers of prepaid access also must report suspicious prepaid access transactions involving amounts of $2,000 or more. To enable these reports, providers and sellers must ensure that procedures are in place to monitor transactions for suspicious activity.  
  • Currency Transaction Reporting. The Final Rule requires that providers and sellers report currency transactions of more than $10,000 per person, per day.   
  • Registration (Providers Only). Providers of prepaid access must file a registration form (FinCEN Form 107) with FinCEN once every two years. Because FinCEN Form 107 does not yet contain a field allowing providers to list of all the prepaid programs they serve, providers have six months from the date the amended regulations are effective to register with FinCEN (i.e., late March 2012).

© 2011 Perkins Coie LLP


 

Sign up for the latest legal news and insights  >