■ by Duncan B. Douglass, Partner, Alston & Bird, and Lauren P. Giles, Senior Associate, Alston & Bird
“Hi Reddit,” began a post this summer on the popular internet discussion site, “this is Ben Lawsky, Superintendent of Financial Services at the New York State Department of Financial Services.” Lawsky went on to announce to the Reddit community that the department had released its long-awaited proposed virtual currency licensing regulations, the “BitLicense Regulations.”
This unusual move reflected the department’s desire to engage with the virtual currency community. However, responses to the announcement reflect an emerging divide within the virtual currency community over Bitcoin’s future. Those who seek to preserve Bitcoin’s origins as an anonymous, unregulated tool of financial disruption have decried the regulations as out-of-touch, or worse, as an attempt to destroy Bitcoin. On the other hand, venture capitalists and investors who have made significant bets that Bitcoin will become a mainstream consumer payment method have hailed the regulations as a key step in increasing the credibility and reliability of virtual currencies.
As the Bitcoin Foundation pointed out in a comment letter submitted to the New York State Department of Financial Services (“NYDFS”), many in the virtual currency community are unfamiliar with existing financial services regulations and unaccustomed to the regulatory process. Thus, many Bitcoin supporters may be unaware that the debate over regulating virtual currencies is part of a larger conversation about how to mitigate the prudential and consumer risks posed by the growth of alternative payment methods.
Recent years have seen a significant increase in consumer adoption of alternative payment products, such as prepaid cards, person-to-person payment systems, and virtual currencies. Traditional payment methods, such as debit cards, credit cards, and automated clearing house payments, are heavily regulated. Providers of these traditional products are subject to prudential oversight, and consumers are afforded protections, including in the event of erroneous (including unauthorized) transactions. Such protections are limited, and frequently nonexistent, with respect to many alternative payment methods, including virtual currencies. As a result, the appropriate means of regulating alternative payment products currently is a significant focus of attention for state and federal regulators.
If Bitcoin is to become a mainstream payment product, the prudential and consumer risks associated with virtual currency transactions must be addressed. Although virtual currencies pose certain unique regulatory challenges, recent approaches to regulation of other nonbank financial service providers and alternative payment products can serve as useful models for mitigating risks associated with ownership and use of virtual currencies.
Defining Virtual Currency
Virtual currency is an emerging concept and, as yet, has no fixed regulatory definition. Federal and state regulators have generally proposed defining virtual currency as a digital representation of value that is not government-issued legal tender. Within that broad definition, virtual currencies are often further classified: as either non-convertible or convertible (i.e., having an equivalent value in, or acting as a substitute for, fiat currency) and as either decentralized or centrally administered (i.e., managed by an entity with authority to issue new units of currency and withdraw existing units from circulation).
Bitcoin, a convertible, decentralized virtual currency, is the largest virtual currency, with a total circulating value currently in excess of US$6.7 billion, and serves as the paradigmatic example of virtual currency for purposes of this article. Bitcoin’s open-source protocol is the basis for most other major virtual currencies, and therefore, understanding Bitcoin transactions is helpful to understanding the risks associated with virtual currency systems in general.
Characteristics of Bitcoin Transactions
Bitcoin users typically purchase Bitcoins using fiat currency (or another virtual currency) through a Bitcoin exchange. The most basic exchanges simply provide a platform for advertising Bitcoins available for sale, bringing buyers and sellers together for direct transactions. More sophisticated exchanges permit users to establish accounts, maintain Bitcoin and fiat currency balances in accounts, place standing buy/sell orders (similar to traditional brokerage accounts), and facilitate the purchase and transfer of Bitcoins between users. Many exchanges also offer integrated wallet functionality to facilitate use of acquired Bitcoins to make payments (e.g., to make purchases from Bitcoin-accepting retailers) or acceptance of Bitcoins for retail payment transactions.
A user must have a Bitcoin wallet to make purchases with Bitcoins. A wallet is a software program that performs two principal functions:
- Generating Bitcoin addresses and cryptographic keys for Bitcoin users.
- Facilitating Bitcoin transactions by enabling users to send and receive Bitcoins, and publishing the associated transactions to reflect the change in ownership of the transferred Bitcoins.
The most basic wallets are simple, open-source software available for free download—there is no “wallet provider” that facilitates the transaction (i.e., neither the software developer nor a third party provides additional, ongoing services to the users of the wallet software). More sophisticated wallets are actively managed by providers; may have integrated Bitcoin exchange or payments processing services; and often charge fees.
Bitcoin addresses are a fundamental component of the Bitcoin model. A Bitcoin address is a string of letters and numbers that identifies a user for purposes of Bitcoin transactions. Each Bitcoin address is derived from an associated pair of public and private keys, which are used to verify ownership of the Bitcoins linked to the public address. Like the Bitcoin address, the keys are generated by the wallet. A user must have a Bitcoin address and the associated keys in order to conduct Bitcoin transactions. Bitcoin ownership and Bitcoin transactions are anonymous in the sense that there is no comprehensive registry associating Bitcoin addresses or keys to their true owners. The transaction history of each Bitcoin address is viewable through the public registry of Bitcoin transactions—the “blockchain,” but the blockchain does not include any identifying information about the owner of that address.
To conduct a purchase transaction using Bitcoins, the buyer transfers a Bitcoin from his wallet to the retailer’s wallet (or, if the retailer uses a processor as an intermediary, to the processor’s wallet). The retailer’s wallet then broadcasts the record of the transfer to the blockchain.
Regulatory Opportunities for Mitigating Virtual Currency Risks
Prudential Regulation
To date, only one federal financial regulator has taken official action with respect to virtual currency. In early 2013, the Financial Crimes Enforcement Network (“FinCEN”) issued guidance describing the circumstances in which persons engaged in virtual currency transactions are classified as money transmitters for purposes of the Bank Secrecy Act (“BSA”)’s implementing regulations. The guidance was followed in January 2014 by two FinCEN administrative rulings, which applied the guidance to specific Bitcoin fact patterns. Together, the FinCEN guidance and rulings clarified that the agency categorizes many virtual currency system participants (including exchanges and wallet operators) in the United States as money transmitters and that such entities are required to comply with the BSA’s know-your-customer and anti-money-laundering requirements. In issuing its guidance and rulings, FinCEN focused on the prevention of money laundering (rather than on prudential concerns, which are outside of the agency’s jurisdiction). However, FinCEN’s guidance and rulings have had a powerful framing influence on the debate regarding the appropriate means of addressing the prudential risks posed by virtual currencies.
While the federal government exercises prudential regulatory authority over depository financial institutions, the states have traditionally borne responsibility for prudential regulation of nonbank financial services providers, such as money transmitters, check cashers, and payday lenders. Indeed, existing federal laws likely do not provide federal regulators with authority to engage in broad-based prudential regulation of nonbank companies engaged in virtual currency business activities.
Further, there appears to be an emerging consensus among state regulatory authorities that the states can and should act to address the prudential risks associated with virtual currency companies.
After FinCEN’s release of the virtual currency rulings, state regulators in Washington and Texas issued guidance that certain types of virtual currency activities constitute money transmission for state-law purposes. In early 2014, the Conference of State Bank Supervisors established the Emerging Payments Task Force, which is charged with evaluating payments system innovations (including virtual currencies) and developing “ideas for connecting the emerging payments landscape to the financial regulatory fabric.” Subsequently, the Uniform Law Commission established the Study Committee on Alternative and Mobile Payment Systems to consider, in part, whether a new uniform state law should be proposed to cover virtual currency companies and transactions. Finally, in July 2014, the NYDFS released the proposed BitLicense Regulations, a comprehensive set of licensing and oversight regulations for virtual currency businesses.
From a prudential perspective, the risks posed by virtual currency companies are largely similar to those associated with money transmitters, and existing money transmitter statutes and regulations can serve as a model for state prudential regulation of virtual currency businesses. For example, money transmitters typically must submit extensive financial and background information in order to obtain licenses and, once licensed, must meet minimum capital requirements, comply with permissible investment restrictions, and establish a bond or other mechanism of securing certain obligations to customers. In addition, money transmitters are subject to ongoing oversight to ensure their safety and soundness, including review of their financial statements, business-continuity plans, and other business practices.
However, there are some prudential risks that are unique to or more significant in the virtual currency context. For example, cyber theft is one of the most significant risks associated with holding and using virtual currency, and strong security requirements are a critical aspect of ensuring the safety and soundness of virtual currency companies. In addition, the anonymity associated with virtual currency transactions creates opportunities for money launderers, terrorists, and other bad actors to move funds without detection. NYDFS recognizes these concerns in the proposed BitLicense Regulations, requiring licensees to establish and maintain data security standards intended to prevent and detect intrusions, and to implement anti-money laundering measures, including a customer identification program. Many in the virtual currency community have strongly criticized the NYDFS’s proposed prudential requirements for virtual currency businesses, largely due to the burden they would impose on the many small companies dominating the current virtual currency marketplace. However, the risk posed to customers by a virtual currency business often does not correspond to the size of the company.
Given the states’ traditional role as the prudential regulator for nondepository financial service providers, it is appropriate for states to take action to address and protect against the prudential risks posed by virtual currency companies. Existing state laws that set licensing and ongoing compliance standards for money transmitters, such as the Uniform Money Services Act, if expanded or modified to address unique or enhanced risks inherent to virtual currency businesses and transactions, as the NYDFS has done in its proposed BitLicense Regulations, represent an appropriate starting point for this effort.
Consumer Protection
The lack of consumer protections will likely be one of the greatest barriers to widespread consumer adoption of virtual currencies. Federal law has established protections for consumers who use traditional payment methods, including extensive disclosures and protection against unauthorized transactions, but such protections are absent in the virtual currency context—in fact, the absence of substantive consumer protections is often cited by virtual currency promoters as a benefit in seeking to convince merchants to accept virtual currency for payment.
In August, the CFPB released a consumer advisory warning of the risks of holding and using virtual currency. The CFPB did not announce intent to issue regulations, but it invited consumers to submit complaints regarding virtual currency, noting that the CFPB will use such complaints “to enforce federal consumer financial laws and, if appropriate, take policy steps.” Therefore, it seems likely that the CFPB is considering how it may act under existing federal law to protect consumers who use virtual currency.
Existing federal consumer protection laws and regulations, as written, may not in all cases be easily applied to virtual currencies, but given significant functional similarities, the application of these regulatory tools (whether directly or through additional adaptation) to virtual currencies could mitigate certain risks posed by an unregulated virtual currency economy.
Prepaid Cards and Bitcoin Credentials
Existing regulatory definitions of “reloadable general-use prepaid card” reflect certain functional similarities between prepaid cards and Bitcoin addresses and keys (“Bitcoin Credentials”) that may merit similar regulation. The CFPB and the Board of Governors of the Federal Reserve have defined a “general-use prepaid card” to be a card, code, or device that is (i) issued on a prepaid basis primarily for personal, family, or household purposes in a specified amount, whether or not that amount may be increased or reloaded, in exchange for payment; and (ii) redeemable upon presentation at multiple, unaffiliated merchants for goods or services, or usable at automated teller machines.
When a consumer receives Bitcoin Credentials and purchases Bitcoins to associate with those Bitcoin Credentials, the Bitcoin Credentials function similarly to a reloadable general-use prepaid card. The Bitcoin Credentials consist of codes that are associated with prepaid value (value denominated in Bitcoins) and the Bitcoin Credentials may be presented for redemption at multiple, unaffiliated merchants in the purchase of goods or services. Further, a consumer can “reload” the Bitcoin Credentials by purchasing additional Bitcoins and associating them with the Bitcoin Credentials. Subpart A of Regulation E provides key consumer protections (including disclosure requirements, fraud protection, and protection against transaction errors) in connection with electronic fund transfers, including those initiated with debit and payroll cards. Although reloadable general-use prepaid cards currently are subject to limited federal consumer protections, the CFPB is imminently expected to announce regulations extending Subpart A of Regulation E to such cards. The CFPB may not use the occasion to expressly extend Subpart A of Regulation E to virtual currencies (like Bitcoin) that have characteristics akin to reloadable general-use prepaid cards, but Subpart A may provide a reasonable model for the CFPB to follow in extending consumer protections to virtual currencies.
Application of the Remittance Transfer Rule
The CFPB requires any company that electronically transfers funds from a U.S. consumer to a recipient outside the U.S. to provide certain disclosures to the consumer regarding the transfer; to facilitate the resolution of errors; and to permit a sender to cancel the remittance transfer during the thirty-minute period after the transfer was requested. These requirements are described in the Remittance Transfer Rule, which constitutes Subpart B of Regulation E.
The Remittance Transfer Rule defines the term “remittance transfer” broadly to include the vast majority of electronic fund transfers sent by U.S. consumers to consumers and businesses in foreign countries. The CFPB has not taken a public position on whether the Remittance Transfer Rule applies to cross-border virtual currency transactions. However, the CFPB clearly contemplated transactions involving virtual wallets in its remittance transfer rulemakings. In order to provide comparable consumer protections for remittance transfers, whether funded in fiat currency or virtual currency, the CFPB may elect to expressly extend the Remittance Transfer Rule to transactions in virtual currency. Given the novelty and unfamiliarity of virtual currencies to many users, application of Remittance Transfer Rule disclosure requirements and protections are particularly appropriate for consumers funding remittance transfers in virtual currency (indeed, the proposed BitLicense Regulations would require licensed entities to provide certain customer disclosures akin to those required under the Remittance Transfer Rule). Investor Protection
Despite recent high-profile announcements by several retailers (including Dell and Overstock) that they now accept or plan to accept Bitcoins, the majority of Bitcoins are currently held for investment purposes and are not used for payment transactions. Therefore, there has been some question regarding the extent to which virtual currencies are subject to regulation by the Securities and Exchange Commission (“SEC”) or Commodities Futures Trading Commission (“CFTC”).
Although the CFTC gave an early indication that it might consider regulation of virtual currencies as commodities, no official action from either the CFTC or the SEC has followed. Presently, it is unclear how the public interest would be served by federal action to directly regulate units of virtual currency as either securities or commodities, although the SEC, the Financial Industry Regulatory Authority, and securities regulators in several states have issued investor advisories regarding the risks of holding virtual currencies. In addition, as consumer use of virtual currencies in retail payment and purchase transactions increases, treating such currencies as securities or commodities may become impractical. That said, recent SEC enforcement actions have clearly signaled that the SEC believes that investment programs in virtual currency are within the scope of its regulatory authority. In addition, virtual currency-based derivative securities seem likely to fall within the jurisdiction of the SEC without the need for further regulation or guidance.
Innovation and Regulation
Virtual currencies, like other alternative payment products and services, have significant potential to foster innovation and customer choice, but regulators are rightly concerned that the growth of such alternative products may be outpacing existing prudential and consumer protections—or at least the clear application of these requirements to virtual currency businesses and transactions.
Efforts to regulate virtual currency businesses and transactions are embedded in a larger regulatory effort to ensure that customers can rely on the safety and soundness of any financial service provider to which they entrust funds, whether that entity is a regulated depository institution or a nonbank, and that consumers are protected when they conduct transactions, regardless of whether those transactions are denominated in fiat currency or virtual currency.
The regulatory landscape for virtual currencies is likely to look different in the coming years than it does today, as regulators act to apply prudential and consumer protections to the virtual currency marketplace. Whether consumers will broadly adopt virtual currencies as a payment method remains to be seen, but the likelihood of that result should be bolstered by the greater trust engendered by appropriate industry regulation. ■