FinCEN's Prepaid Access Rule - Crime

On July 29, 2011, the Financial Crimes Enforcement Network ("FinCEN") published a final rule to amend the Bank Secrecy Act ("BSA") regulations applicable to Money Services Businesses ("MSB") with respect to stored value or "prepaid access" ("Final Rule" or "Rule").¹ The Rule's effective date is September 27, 2011. The compliance deadline for 31 C.F.R. § 1022.380 (registration of money services businesses) is January 29, 2012.

COVERAGE OF "PREPAID PROGRAMS"

Section 1010.100(ff)(4)(iii) defines a "prepaid program" as an "arrangement under which one or more persons acting together provide(s) prepaid access." Under the Rule, "prepaid access" is defined as "access to funds or the value of funds that have been paid in advance and can be retrieved or transferred at some point in the future through an electronic device or vehicle, such as a card, code, electronic serial number, mobile identification number, or personal identification number." Exempted, however, from the definition of prepaid program are prepaid arrangements in which:

The prepaid arrangement provides closed-loop prepaid access² to funds not to exceed $2,000 maximum value that can be associated with the prepaid access device or vehicle on any day (this exemption is valid even if the prepaid access permits international use, person-to-person transfers within the prepaid arrangement or loading from non-depository sources);
The prepaid arrangement provides prepaid access solely to funds provided by a federal, state, local, territory and insular possession, or tribal government agency (this exemption also is valid even if the prepaid access permits international use, person-to-person transfers within the prepaid arrangement or loading from non-depository sources);
The prepaid arrangement provides prepaid access solely to funds from pre-tax flexible spending arrangements for health care and dependent care expenses, or from Health Reimbursement Arrangements for health care expenses (again, this exemption is valid even if the prepaid access permits international use, person-to-person transfers within the prepaid arrangement or loading from non-depository sources;
The prepaid arrangement provides prepaid access solely to employment benefits, incentives, wages or salaries and does not permit: (i) funds or value to be transmitted internationally; (ii) transfers between or among users of prepaid access within the prepaid program; or (iii) loading additional funds or the value of funds from non-depository sources;³ or
The prepaid arrangement provides prepaid access to funds not to exceed $1,000 maximum value and from which no more than $1,000 maximum value can be initially or subsequently loaded, used, or withdrawn on any day through a device or vehicle, and that does not permit (i) funds or value to be transmitted internationally; (ii) transfers between or among users of prepaid access within the prepaid program; or (iii) loading additional funds or the value of funds from non-depository sources.

"PROVIDERS" AND "SELLERS" OF PREPAID ACCESS

Provider of Prepaid Access

Designation of a Provider of Prepaid Access

Section 1010.100(ff)(4)(i) defines a "provider of prepaid access" as "the participant within a prepaid program that agrees to serve as the principal conduit for access to information from its fellow program participants."⁴ Specifically, the Rule provides that the participants in each prepaid program must determine a single participant within the prepaid program to serve as the provider of prepaid access. In order to determine the single participant within the prepaid program that will serve as the provider of prepaid access, each of the participants within a prepaid program must contractually agree who among the group will be designated the provider of prepaid access. Under this approach, the designated provider of prepaid access is responsible for managing the prepaid program in a way that complies with regulatory requirements.

If, however, the participants in a prepaid program fail to designate a provider of prepaid access, FinCEN will determine the identity of the provider of prepaid access through the application of five criteria points. Specifically, these five criteria points are designed to pinpoint the entity with the oversight and control necessary to be deemed a provider of prepaid access. While FinCEN recognizes that each of the five criteria points may not be present in any single participant, the supplementary information to the Final Rule provides that these criteria "may be helpful to weigh and assess the totality of the factors against the characteristics of the various program participants in reaching a regulatory determination." The Final Rule identifies the following criteria for indicating principal oversight and control of the prepaid program in the absence of a contractually appointed provider of prepaid access:

What entity organized the prepaid program;
What entity sets the terms and conditions of the prepaid program and determines that the terms have not been exceeded;
What entity determines the other businesses that will participate in the prepaid program, which may include the issuing bank, the payment processor or the distributor;
What entity controls or directs the appropriate party to initiate, freeze or terminate prepaid access; and
What entity engages in activity that demonstrates oversight and control of the prepaid program.

Obligations of a Provider of Prepaid Access as an MSB

Registration as an MSB—Non-bank providers of prepaid access are required to register as an MSB with FinCEN⁵ and are subject to BSA regulations, including the maintenance of an anti-money laundering ("AML") program, the filing of suspicious activity reports, and the recordkeeping and customer identification requirements described below. On the other hand, if a bank issuer is designated the provider of prepaid access, then neither the bank nor any other participants in that particular prepaid program will be required to register with FinCEN.⁶ This exemption for banks does not, however, exempt bank-issued prepaid access or the other participants (e.g., sellers of prepaid access) in that particular prepaid program from their obligations specified in the Final Rule. For example, in a prepaid program in which a bank issues the prepaid access and a retailer sells the prepaid access, the retailer would still be deemed a seller of prepaid access and would be subject to the obligations of a seller of prepaid access.

AML Program—A provider of prepaid access must: (i) establish procedures to verify the identity of a person who obtains prepaid access under a prepaid program and obtain identifying information concerning that person, including name, date of birth, address and identification number; and (ii) retain access to such identifying information for five years after the last use of the prepaid access device.⁷

Suspicious Activity Reporting—A provider of prepaid access must file with the Treasury Department a report, to the extent and in the manner required under Section 1022.320, of any suspicious transactions relevant to a possible violation of law or regulation.⁸

Recordkeeping—A provider of prepaid access must maintain access to transaction records for a period of five years that are generated in the ordinary course of business and that would be needed to reconstruct prepaid access activation, loads, reloads, purchases, withdrawals, transfers, or other prepaid-related transactions.9

Seller of Prepaid Access

Under Section 1010.100(ff)(4)(7), a "seller of prepaid access" is defined as any person that receives funds or the value of funds in exchange for an initial loading or subsequent loading of prepaid access if that person triggers coverage under (i) or (ii) below because it either:

(i) Sells prepaid access offered under a prepaid program that can be used before verification of customer identification under Section 1022.210(d)(1)(iv).

For example, if a business sells closed-loop prepaid access to funds that exceed $2,000 on an individual access device or vehicle, then such business would be a "seller of prepaid access." Similarly, if a business were to sell prepaid access to funds from which more than $1,000 can be initially or subsequently loaded, used or withdrawn, then such business would be a "seller of prepaid access."

Also, if a business sells immediately usable prepaid access that is open loop, it should not be regulated as a "seller of prepaid access" if at the time of the sale, and before the collection of customer identification material, the prepaid access does not permit: (i) access to funds in excess of $1,000; (ii) international use or person-to-person transfers; or (iii) additional loading of the cards at non-depository sources.

(ii) Sells prepaid access (including closed-loop prepaid access) to funds that exceed $10,000 to any person during any one day and has not implemented policies and procedures reasonably adapted to prevent such a sale.

Coverage as a seller of prepaid access based on selling access to funds that exceed $10,000 to any person during any day can be triggered by the sale of any "prepaid access" regardless of whether such prepaid access is part of a covered "prepaid program." For example, even if a business sells closed-loop cards in which the prepaid access is not to exceed $2,000 and, therefore, is not considered part of a covered "prepaid program," the business still would need to have in place "policies and procedures reasonably adapted to prevent" a sale of prepaid access exceeding $10,000.

Obligations of a Seller of Prepaid Access as an MSB

AML Program—A seller of prepaid access must: (i) establish procedures to verify the identity of a person who obtains prepaid access under a prepaid program and obtain identifying information concerning such a person, including name, date of birth, address and identification number; and (ii) retain such identifying information for five years from the date of the sale of the prepaid access device or vehicle.¹⁰

Suspicious Activity Reporting—A seller of prepaid access must file with the Treasury Department a report, to the extent and in the manner required under Section 1022.320, of any suspicious transactions relevant to a possible violation of law or regulation.¹¹

Footnotes

^{1 As part of the Credit Card Accountability Responsibility
and Disclosure Act of 2009 ("CARD Act"), Congress
required the issuance of "regulations in final form
implementing the Bank Secrecy Act, regarding the sale, issuance,
redemption, or international transport of stored value, including
stored value cards." Pub. L. No. 111-24 (May 22, 2009), 123
Stat. 1734, 1756, §§ 503(a), (c).}

^{2 Closed-loop prepaid access is defined as "prepaid
access to funds or the value of funds that can be used only for
goods or services in transactions involving a defined merchant or
location (or set of locations), such as a specific retailer or
retail chain, a college campus, or a subway system." 31 C.F.R.
§ 1010.100(kkk).}

^{3 This exemption applies only to arrangements in which the
employer can add to the underlying funds. The ability to co-mingle
funds added by both the employer and some other source would result
in a prepaid program subject to the Rule.}

^{4 As set forth in footnote 27 in the supplementary
information accompanying the Rule, FinCEN acknowledges that banks
that are "currently serving in a role that could otherwise fit
the definition of a provider of prepaid access are not subject to
[the Rule] because FinCEN has excluded banks from its definition of
MSB."}

^{5 31 C.F.R. § 1022.380.}

^{6 As noted above, the supplementary information
accompanying the Final Rule states that banks that serve as
providers of prepaid access are not subject to the Final Rule
because FinCEN has excluded banks from the definition of an MSB. In
addition, FinCEN states that by "virtue of the regulatory
definition of a money services business, neither a bank nor any
other participants in the bank-centered prepaid program would be
required to register with FinCEN."}

^{7 31 C.F.R. § 1022.210.}

^{8 31 C.F.R. § 1022.320.}

^{9 31 C.F.R. § 1022.420.}

^{10 31 C.F.R. § 1022.210.}

^{11 31 C.F.R. § 1022.320.}

Because of the generality of this update, the information provided herein may not be applicable in all situations and should not be acted upon without specific legal advice based on particular situations.

United States: FinCEN's Prepaid Access Rule