Law360, New York (March 05, 2014, 4:00 PM ET) -- If you’ve read the financial or legal press over the past several months, you’ve no doubt seen a seemingly endless series of articles proclaiming either that Bitcoin is the greatest innovation since the Internet itself, or alternatively, that it is rapidly losing value and not worth the paper it’s printed on — or, I guess I should say, not printed on. It’s enough to make your head spin, and it’s hard to tell sometimes how much of the information about virtual currencies is real and how much is, well, virtual.

Turns out the rumors of the death of Bitcoin are greatly exaggerated. But so are the rumors of its dominance. So what is it, a force for social transformation or a flash in the pan? The jury is still out, so the answer, at least for now, is “neither.”

Where does that leave businesses, particularly retailers, who are considering accepting bitcoin as a form of payment for goods or services? Businesses should consider three broad categories of risk — legal/regulatory, commercial/financial, and reputational — before deciding whether to do business right now in bitcoin or other virtual currencies.

Legal/Regulatory Risks

Although other agencies like the Federal Trade Commission, the Consumer Financial Protection Bureau, the U.S. Commodity Futures Trading Commission, and the U.S. Securities and Exchange Commission are circling, the primary federal regulator in the bitcoin space so far is the Financial Crimes Enforcement Network.

The leadership ranks at FinCEN are now dominated by former prosecutors from the U.S. Department of Justice, including senior officials from the Criminal Division’s Asset Forfeiture and Money Laundering Section, so they have a keen eye for the potential money laundering implications of virtual currencies. It’s no surprise, then, that FinCEN has been out in front on this issue.

In March 2013, FinCEN issued guidance on the type of conduct involving virtual currencies that would subject a company to the regulations that cover money transmission services. In a nutshell, FinCEN identified three types of actors when it comes to bitcoin and other virtual currencies:

  • an administrator is an entity that is engaged as a business in putting a virtual currency into circulation and that has the authority to withdraw it from circulation;
  • an exchanger is an entity that is engaged as a business in the exchange of virtual currency for real currency, funds or other virtual currency;
  • a user is an entity that obtains virtual currency (whether by purchasing or “mining” it) to purchase goods or services. (In January 2014, FinCEN issued an administrative ruling  clarifying that entities that mine bitcoin for their own use or that buy or sell it as an investment for their own benefit also qualify as “users.”)

Under FinCEN’s guidance, the first two categories — “administrators” and “exchangers” — are required to register as money services businesses and are subject to the Bank Secrecy Act and other anti-money laundering laws and requirements. The third category, “users,” are not.

Within this framework, retailers or other businesses that accept bitcoin as a form of payment generally would be considered “users.” By its terms, the above definition would appear to cover only buyers who use bitcoin to make purchases, but in remarks last April, the FinCEN director indicated that sellers that accept bitcoin for the sale of goods and services are also considered “users.”

The good news is that businesses that seek to accept bitcoin as a form of payment are not subject to the BSA/AML regulatory requirements that apply to “administrators” or “exchangers.” But there is some suggestion in FinCEN’s guidance and other public statements that how a business conducts its bitcoin transactions could cause it to cross over from “user” to “exchanger.”

In particular, if a customer purchasing goods or services pays the bitcoin price to a third party at the direction of the seller rather than to the seller directly, the seller may risk being considered to be participating with the third party in the business of “exchanging” bitcoin, subjecting the seller to the corresponding regulatory requirements.

Of course, the folks at FinCEN are not the only feds in town, and the feds are not the only game in town. Of the other federal agencies identified above, the one to watch the closest may be the FTC. If the FTC’s aggressive approach to data privacy and security is any indication, look for the FTC to become increasingly active in potential consumer protection implications of Bitcoin.

State regulators are also looking hard at regulating virtual currencies, none more so than the New York State Department of Financial Services, also led by a DOJ veteran. NYDFS held two days of hearings in January to study possible regulation of money service businesses in the context of virtual currencies, and is working on proposed regulations for virtual currency firms — possibly including the issuance of “BitLicenses” — likely to be announced in 2014.

Massachusetts and other states are studying the issue as well. The prospect of varying, and possibly conflicting, rules in multiple states could make the regulatory landscape significantly more confusing to navigate. And, of course, other countries, from Canada to Japan, are weighing bitcoin-related regulations as well.

All of this suggests that for retailers and other businesses considering accepting bitcoin as a form of payment, provided the transactions are conducted properly, the legal and regulatory risks are — for now at least — not the most significant hurdle. That brings us to the other two primary categories of risk.

Commercial/Financial Risks

If you take nothing else away from the recent media coverage of bitcoin, it should be that bitcoin is volatile — extremely volatile.

As a general matter, there is a small enough universe of people or entities holding large quantities of bitcoin that it is subject to large fluctuations based on actions taken by individual investors, companies or countries, not to mention hacking and theft.

The events of the last three weeks are a cautionary tale. Until recently the only “mountain” most people could name in Japan was Mt. Fuji. Now many people have also heard of “Mt. Gox,” which was one of the world’s largest bitcoin exchanges and which declared bankruptcy last Friday following the apparent theft of about 850,000 bitcoins.

The missing bitcoins represented approximately 7 percent of the bitcoins in circulation and were valued at the time at over $450 million. By the end of the day on Friday, bitcoin had lost more than half its value from a December high, although it’s up almost 20 percent this week and up considerably from early 2013.

But the Mt. Gox bankruptcy is just one of many examples. In early February, Mt. Gox suspended customer withdrawals after announcing that what it called a “bug” in the bitcoin software code had enabled some users to conduct fraudulent bitcoin transactions. Several other exchanges shut down temporarily due to the same issue. Within days, bitcoin lost 25 percent of its value. When China prohibited its banks from engaging in transactions using bitcoin, the currency lost half of its value within 48 hours.

This potential for extreme fluctuations makes it critical that retailers and other businesses that accept bitcoins get the exchange rate established and locked in before a bitcoin payment is accepted and then do an immediate exchange to dollars. Otherwise what the seller saves in credit card processing fees could be more than offset by a drop in the value of bitcoin, in just a matter of seconds. 

Certainty in the exchange rate is also important for calculating sales taxes. Some third-party services have emerged that take on the risk of fluctuation by offering retailers locked-in exchange rates and immediate exchanges to dollars following a sale to a bitcoin-paying customer.

Of course, as the volatility of bitcoin, and the volume of bitcoin transactions, increases, one has to wonder whether these services will be able to continue guaranteeing exchange rates in this manner for the full amount of transactions.

Even with locked-in rates and immediate exchanges for dollars, businesses need to think about how to adjust their refund and exchange policies for Bitcoin. If a customer buys a product at one exchange rate, and wants to exchange it or return it for a refund later, when the exchange rate is less favorable to the seller, what will the seller’s policy be? Will the seller offer in-store credits, where the customer bears the risk of a less favorable exchange rate? Refunds in bitcoin, at the then-prevailing rate of exchange? Some other approach?

How the business handles these issues will have an impact on the bottom line and the quality of a customer’s experience, so they merit careful consideration before the business enters the bitcoin world.

Reputational Risks

The third broad category of risks — and the hardest to handicap -— is reputational.

The same factors that make Bitcoin appealing to many users — including lower transaction costs, anonymity, independence from the banking system and global reach — make it attractive to criminals.

In their public statements on virtual currencies, including at a recent congressional hearing, law enforcement officials have struck the same theme I used to strike in public statements when I was at the DOJ — that law enforcement is not out to stop the march of new technology, but rather is focused on stopping criminals from using that new technology for bad purposes.

The DOJ has a long history of pursuing criminals who use new forms of payment to facilitate old forms of crime — we went after e-gold and began investigating Liberty Reserve when I was at the DOJ, and the Silk Road case last year is the latest, and perhaps greatest, example.

Make no mistake that federal law enforcement is going to continue to pursue aggressively individuals and entities that use Bitcoin to finance or facilitate criminal activity. (Indeed, there are reports that Mt. Gox is currently under investigation.)

Although there’s no question that bitcoin has entirely legitimate uses and benefits, there is some risk that this sustained law enforcement action may cause the term “Bitcoin” increasingly to become associated in the public’s mind with criminal activity. Putting aside law enforcement actions, will the volatility of, and negative press surrounding, bitcoin cause a “taint” that could impact its value?

And what will be the impact of increased regulation, both here and abroad? Some participants in the bitcoin ecosystem have argued that increased regulation may give bitcoin a greater sense of legitimacy — and stability — which would arguably make it a better bet. On the other hand, increased regulation may cause users who were drawn to bitcoin precisely because it was unregulated to turn to other virtual currencies.

Only time will tell. What we do know is that bitcoin marches on in the wake of this uncertainty. Indeed, bitcoin ATMs arrived in the U.S. at around the same time a senator was calling for a ban on bitcoin in the wake of Mt. Gox’s collapse. Some have suggested that the fall of Mt. Gox may end up being a good thing for bitcoin, if it gives way to stronger, more stable exchanges and smart, tailored regulation.

What is clear is that the actions law enforcement and regulators take in the near term may have a significant impact on bitcoin’s prospects over the long term. This uncertainty underscores the need for companies that accept bitcoin to convert it immediately to hard currency, to avoid the financial and potential public relations hit if the company loses money because it is holding a significant amount of bitcoins at a time when the value drops.

Conclusion

To date, the retailers and other businesses that have announced that they are accepting bitcoin as payment are not major “brand” names that perhaps have a higher risk tolerance than a more established brand. One exception may be Overstock.com, although its CEO has made public statements suggesting that he decided to accept bitcoin in part because virtual currencies are consistent with his worldview.

Even the Sacramento Kings, the one NBA team to accept bitcoin to date, are not exactly National Basketball Association royalty, so the decision to accept bitcoin was viewed by many as an attempt by the team to generate publicity for something other than losing games, firing coaches and threatening to leave town.

Bitcoin is not taking over the world just yet, but it is not going away either. Given this uncertainty, and the currency’s inherent volatility, companies should think carefully — assessing legal/regulatory, commercial/financial, and reputational risks — before deciding whether to make bitcoin a part of their business.