Treasury Department Issues Final Rule on “Prepaid Access” Under the Bank Secrecy Act

On July 27, 2011, the Treasury Department’s Financial Crimes Enforcement Network (FinCEN) released its much anticipated final rule (Final Rule) applying the anti-money laundering requirements of the Bank Secrecy Act to certain open and closed-loop prepaid payment products in a comprehensive manner for the first time. The Final Rule redefines “stored value” as “prepaid access” and imposes significant regulatory obligations on both “providers” and “sellers” of “prepaid access,” including certain anti-money laundering program, reporting and recordkeeping requirements. Notably, in response to public comment, the Final Rule significantly enlarges the exemptions for closed-loop retailer gift card programs and narrows the definition of “seller of prepaid access,” as compared to the proposed rule. A copy of the Final Rule, as published in the Federal Register, is available here.

Overall assessment

The scope of the Final Rule reflects FinCEN’s effort to balance persistent law enforcement concerns about the abuse of “prepaid access” programs for money laundering¹ against strong consumer demand for such products as reflected in the growth of the industry. While the Final Rule suggests FinCEN gained important industry insight as to the value of prepaid programs during the rulemaking process, the Final Rule may still have a significant adverse impact on the development of innovative payment systems and products. The efficacy of the Final Rule in preventing money laundering or terrorist financing remains to be seen, and the case for the necessity of the Final Rule remains—at most—incomplete.

Key definitions

Prepaid Access and Prepaid Programs: The Final Rule defines “prepaid access” to mean “access to funds or the value of funds that have been paid in advance and can be retrieved or transferred at some point in the future” through physical (e.g., card or other device) or non-physical (e.g., code, electronic serial number, mobile identification number, personal identification number) means. The change from “stored value” to “prepaid access” is intended to capture not only physical cards but payment devices that are used today or that may emerge in the future. A “prepaid program” is an arrangement in which one or more persons act together to provide prepaid access. Any prepaid access operation that does not fall within one of the enumerated exemptions (discussed below) is subject to the Final Rule.

Provider of Prepaid Access: A provider is the participant in a non-exempt prepaid program that serves as the principal conduit for access to information from its fellow program participants. The Final Rule adopts the “agreement approach” such that the “provider” is deemed to be whichever party in the prepaid program is designated by agreement among the participants. One party must serve as the designated provider for purposes of registering with FinCEN and complying with its money services business (MSB) regulations. If the parties to a prepaid program are unable to agree who should be designated as the “provider,” FinCEN will determine who has “principal oversight and control” based on five factors: (1) who organizes the prepaid program; (2) who sets the terms and conditions of the program; (3) who determines the parties that may participate in the program; (4) who controls or directs initiation, suspension or termination of the program; and (5) who actually engages in the activities that demonstrate principal oversight and control. These elements are retained from the proposed rule.

Seller of Prepaid Access: A “seller of prepaid access” is any person who “receives funds or the value of funds in exchange for an initial loading or subsequent loading of prepaid access.” To implement a “targeted approach” to regulating prepaid access, the Final Rule only applies to “sellers” that (1) sell prepaid access under a non-exempt prepaid program that can be used before customer verification (i.e., immediately usable prepaid access); or (2) sells any type of prepaid access (whether exempt or not) to funds that exceed $10,000 to any person during any one day, without having implemented policies and procedures “reasonably adapted” to prevent such a sale. Sellers must comply with certain anti-money laundering obligations, but unlike providers, they are not required to register as a money services business. According to FinCEN, the narrow definition of “seller” excludes all but a small percentage of retailers. Indeed, a retailer can avoid “seller” status by either requiring post-purchase activation and verification before use of the prepaid access (standard for open-loop cards), or more simply, implementing “policies and procedures reasonably adapted to prevent” the sale of prepaid access to funds exceeding $10,000 to any person on any day. Together with the $2000 exclusion for closed loop programs noted below, these limitations may significantly mitigate the impact of the Final Rule on the operations of retailers at the point of sale.

Exempted prepaid access programs

The Final Rule identifies five specific types of prepaid programs that pose a low risk of money laundering or other illicit behavior, and thus, are excluded from the definition of a “prepaid program.” Providers and sellers of these types of exempt prepaid programs are therefore not subject to the Final Rule.

1. Closed-loop programs that do not exceed $2000 on any day: This exemption will include the vast majority of retailer gift cards, thus reducing the regulatory burden on these popular programs. International use, transfers within the prepaid program, and loading from non-depository sources are allowed without loss of exempt status, in contrast to the proposed rule.
2. Government-funded programs: This exemption applies to prepaid programs funded solely by federal, State, local, Territory and Insular Possession, or tribal government agencies. International use, transfers within the prepaid program, and loading from non-depository sources are allowed without loss of exempt status.
3. Pre-tax health care or dependant care spending programs: Pre-tax flexible spending arrangements for health care and dependent care expenses, or Health Reimbursement Arrangements for health care expenses, are exempt. International use, transfers within the prepaid program, and loading from non-depository sources are allowed without loss of exempt status.
4. Employer-funded payroll programs: This exemption only applies to payroll programs where the employer, and not the employee, may add funds to the account. However, the exemption does not apply (and thus prepaid program status is triggered) if (i) funds can be added from other sources, including non-depository institutions; (ii) the program allows international transmission of funds; or (iii) it permits transfers within the program.
5. Limited-value programs: Programs that limit account balances to $1,000, and limit loading, use or withdrawal to $1,000 per day, are exempt. The same carveouts to the exemption apply as for employer-funded payroll programs (other sources, international transmission, or account-to-account transfers).

Obligations of providers and sellers of prepaid access

The Final Rule revises the money services business regulations to require both providers and sellers participating in non-exempt programs to implement anti-money laundering programs, which must include the following elements:

1. Procedures to verify the identity of purchasers of prepaid access and the collection and retention of customer information (including name, birthday, address, and identification number). Sellers in particular must establish procedures to verify the identity of persons who obtain prepaid access to funds in excess of $10,000 per day. Providers must retain this information for five years from the last use of the prepaid access. Sellers must retain this information for five years from the sale of the prepaid access.
2. Reporting of suspicious transactions (SARs). The obligation to submit SARs is a significant change for prepaid program participants, which previously were exempted under an exception for “issuers, sellers or redeemers of stored value.” However, the SARs requirement only applies to transactions of $2,000 or more; thus, the actual impact on most prepaid providers may be somewhat limited.
3. Retaining transactional information generated in the ordinary course of business for a period of five years. Providers are responsible for compliance with this recordkeeping requirement.
4. Registration as an MSB. This requirement only applies to providers of prepaid access. As part of registration, the provider must submit a list of the prepaid programs for which it serves as the provider.

Effective dates

The Final Rule becomes effective Sept. 27, 2011 (60 days after publication in the Federal Register, which occurred on July 29, 2011), accordingly, seller and provider compliance is required by this date. However, providers’ compliance with MSB registration is not required until Jan. 29, 2012 (6 months after publication).

FOOTNOTE 1 These concerns have not always been well-grounded in a sound understanding of the prepaid industry or its products . See, e.g., Assessment, Prepaid Stored Value Cards: A Potential Alternative to Traditional Money Laundering Methods, U.S.D.O.J. Nat’l Drug Intelligence Center, 2006-R0803-001 (Oct. 31, 2006), available at http://www.justice.gov/ndic/pubs11/20777/20777p.pdf.