On May 5, 2015, the U.S. Department of Treasury issued a fine in its first-ever virtual currency action. The Financial Crimes Enforcement Network (FinCEN), a bureau of the Department of Treasury, assessed a $700,000 civil penalty against Ripple Labs, Inc. (Ripple Labs) and its wholly-owned subsidiary XRP II, LLC (XRP II) for violating the Bank Secrecy Act (the Act) by operating a money services business and selling XRP – the second largest virtual currency in the world after Bitcoin – without registering with FinCEN. According to FinCEN, Ripple Labs and XRP II also failed to maintain adequate controls to prevent money launderers or terrorists from using its virtual currency. FinCEN’s action against Ripple Labs and XRP II is a warning to sellers and large money transmitters, and the financial industry in general, to stay updated and compliant with regulator’s Bank Secrecy Act guidance and maintain adequate anti-money laundering (AML) programs.
Bank Secrecy Act Registration and Anti-Money Laundering Program Requirements
The Bank Secrecy Act and its accompanying regulations require any person who owns or controls a money transferring business to register the entity as a Money Services Businesses (MSBs) with FinCEN. See 31 U.S.C. § 5330; 31 C.F.R. § 1022.380. Section 5322 of the Act imposes criminal liability for operating an unregistered MSB.
The Act and its regulations also require an MSB to develop a written AML program that is reasonably tailored to ensure that the MSB is not being used for money laundering or financing terrorism. See 31 U.S.C. §§ 5318(a)(2) and 5318(h); 31 C.F.R. § 1022.210. AML programs must include policies geared toward ongoing compliance, a designated individual for AML compliance, training for appropriate personnel regarding detection of suspicious transactions, and independent review to monitor the program’s adequacy. 31 C.F.R. § 1022.210(d). AML programs must also include “Know-Your-Customer/Know-Your-Counterparty” procedures which allow an MSB to assess the risk in providing an account or services to certain customers. See FinCEN Interpretive Release 2004-1, Anti-Money Laundering Program Requirements for Money Service Businesses with Respect to Foreign Agents or Foreign Counterparties, 69 Fed. Reg. 74,439 (Dec. 14, 2004).
March 18, 2013 Guidance Regarding Applicability of Act to Transmitters of Virtual Currency
On March 18, 2013, FinCEN issued guidance clarifying the applicability of the Bank Secrecy Act to virtual money transmitters. FIN-2013-G0001, Application of FinCEN’s Regulations to Persons Administering,
Exchanging, or Using Virtual Currencies (Mar. 18, 2013) (the Guidance). The Guidance made it clear that an administrator or exchanger who accepts, transmits, buys, or sells virtual currency is a money transmitter under FinCEN’s regulations and is subject to the Act’s registration and AML program requirements. The Guidance further clarified the Act by defining which entities qualify as “exchangers” and “administrators” of virtual currency and therefore constitute MSBs subject to the statute. The Guidance defines an “exchanger” as a person or entity “engaged as a business in the exchange of virtual currency for real currency, funds, or other virtual currency” and an “administrator” as a person or entity “engaged as a business in issuing a virtual currency, and who has the authority to redeem such vital currency.” Id.
FinCEN’s Civil Penalty Against Ripple Labs and XRP II
From March 6, 2013, until April 29, 2013, Ripple Labs, headquartered in San Francisco, engaged in transferring XRP, its virtual currency, and provided virtual currency exchange transaction services. Ripple Labs created a wholly-owned subsidiary, XRP II, on July 1, 2013, to conduct the same XRP transactions in place of Ripple Labs. XRP is the second largest virtual currency in the world after Bitcoin. See Matter of Ripple Labs, Inc. and XRP II, LLC, No. 2015-05 (FinCEN May 5, 2015).
Ripple Labs began transferring virtual currency while unregistered prior to the issuance of FinCEN’s March 18, 2013 Guidance but, as noted several times by regulators, the company continued to transfer virtual currency several weeks after the issuance of the Guidance without properly registering under the Act. Ripple Labs also violated the AML program requirements of the Act by failing to implement adequate policies and internal controls. Ripple Labs also failed to designate an officer to ensure compliance with the Act. XRP II violated the Act by transferring virtual currency for months without a written AML, not hiring a compliance officer or maintaining independent oversight, and failing to train employees on its AML until nearly a year after it initiated virtual currency sales. XRP also failed to file or file in a timely fashion suspicious activity reports (commonly referred to SARs) for transactions involving large sums of virtual currency with little paperwork and high-risk overseas customers.
FinCEN assessed a $700,000 monetary penalty in a civil enforcement action against Ripple Labs and XRP II for registration and AML program violations. Ripple Labs and XRP II admitted to its Bank Secrecy Act violations as established by FinCEN and consented to the assessment of the civil monetary penalty. Ripple Labs and XRP II also entered into a settlement agreement with the U.S. Attorney’s Office for the Northern District of California, which agreed not to criminally prosecute either company for their violations. Id.
The civil penalty against Ripple Labs and XRP II demonstrates FinCEN’s aggressive approach to bringing actions against entities with insufficient AML programs. Sellers and large money transmitters must continuously update their compliance programs and policies and know their customer base. Moreover, entities subject to the Bank Secrecy Act should not only familiarize themselves with the statute and its accompanying regulations but should also regularly monitor for any guidance or other clarifying information issued by regulators regarding compliance.