Title: Recent US Prosecutions Raise Concerns for Cryptocurrency Wallet Developers and Users
Author: Aiying
Source: AiYing Compliance
Since 2013, the US government has maintained a clear policy that developers and users of cryptocurrency wallets are not considered money transmitters. However, the recent decision by the Department of Justice (DOJ) to prosecute wallet developers for unlicensed money transmission has come as a surprise, especially considering these developers do not actually control the assets protected by their software.
Federal prosecutors have presented this unprecedented interpretation in two recent cases: the publicized lawsuit against Samourai Wallet on April 26th and the opposition to the motion to dismiss evidence in the Tornado Cash case, also announced on the same day. Additionally, the Federal Bureau of Investigation (FBI) has issued a warning to cryptocurrency wallet users, stating that they may lose their funds due to criminal seizure and investigation if they do not transfer their funds to regulated institutions.
I. Brief Overview of Current Money Transmission Policies and Detailed Summary of Recent Events
The US has a series of federal laws that regulate anti-money laundering (AML) for money transmitters, primarily based on the Bank Secrecy Act and its amendments. These laws define the category of “financial institutions” and authorize the Secretary of the Treasury to redefine this category as needed. Therefore, the implementing rules under the Bank Secrecy Act determine who must or must not register as money transmitters or other financial institutions, comply with the “Know Your Customer” (KYC) principle, submit reports to the government, and implement other anti-money laundering controls.
These regulations define money transmitters as:
1. Any person who provides money transmission services, where “money transmission services” are defined as “accepting the value of currency, funds, or other substitute currency from one person and transmitting the value of currency, funds, or other substitute currency to another location or person”;
2. Any other person involved in the transfer of funds.
In the context of cryptocurrencies, this definition introduces some ambiguity regarding whether cryptocurrencies are considered “currency, funds, or other substitute currency.” If cryptocurrencies are regarded as “funds,” then “any person involved in the transfer” becomes a money transmitter. If cryptocurrencies are considered “currency” or “other substitute currency,” then anyone who “accepts” and “transmits” cryptocurrencies becomes a money transmitter. According to a direct interpretation of the regulations, cryptocurrencies are seen as alternatives to traditional currencies. Therefore, if someone accepts and transfers others’ cryptocurrencies in a commercial manner, they are considered money transmitters. In other words, if someone actually controls others’ cryptocurrencies and uses this control to transfer them to another person or location, they are money transmitters. This law has been in place long before the advent of cryptocurrencies and has never been modified or overturned by Congress, the courts, or regulations. This minor ambiguity regarding whether cryptocurrencies are considered currency, funds, or other substitute currency will be resolved by FinCEN in the early history of cryptocurrency regulation.
In 2013, FinCEN released its first “Virtual Currency” guidance. In this guidance, FinCEN confirmed that cryptocurrencies (referred to as virtual currencies) are “value that substitutes for currency” and not “funds” or “currency” itself (hence the term “virtual currency”). In a footnote, it explicitly stated that virtual currencies are not considered “funds” because such a definition would trigger certain prepaid access rules that FinCEN believes do not apply to cryptocurrency activities.
FinCEN further explained that merely producing and distributing software itself does not constitute accepting and transmitting value, even if the purpose of the software is to facilitate the sale of virtual currencies.
In 2019, FinCEN issued additional guidance clarifying that partial control over virtual currencies is not sufficient to classify wallet developers as money transmitters because those involved in the transaction and the holders of the coins need to request additional validation, and the developers do not have complete independent control over these values.
This guidance stipulates that only companies engaged in custodial cryptocurrency businesses need to obtain licenses and comply with federal money transmission regulations. The law has always been clear: non-custodial cryptocurrency developers are not money transmitters.
II. Details of the Cases and Points of Contention
On April 26, 2024, a complaint was made public, accusing Samourai Wallet (a Bitcoin wallet that enhances user privacy through CoinJoin transactions) developers of illegal money transmission and other charges. In this discussion, we will not address the charges of money laundering conspiracy, as they depend on specific facts and may not be based on developers providing custodial services rather than non-custodial services. The defendants may have operated a centralized server to coordinate CoinJoin transactions, as alleged in the charges. However, based on our current understanding, Samourai Wallet does not allow developers or any third party to have independent control over the bitcoins protected by the wallet software. According to a direct interpretation of the regulations, especially considering FinCEN’s guidance and administrative rulings, Samourai Wallet developers do not have “complete independent control” over any user funds and, therefore, do not fall under the definition of money transmitters.
In the case of Roman Storm’s Tornado Cash, the prosecution responded to the previous motion to dismiss. They discussed a law called “Section 1960,” which states that operating an unlicensed money transmission business is illegal. The prosecution’s response emphasized that the definition of this law is much broader than what we typically discuss.
Their main argument is that as long as the Tornado Cash software is used to request deposits or withdrawals, it results in the movement of cryptocurrencies on the Ethereum blockchain. Therefore, they believe that the developers of Tornado Cash should be held responsible. This argument expands the scope of liability, implying that almost all cryptocurrency wallets and smart contracts engage in money transmission, and all developers could be involved in illegal money transmission.
In terms of regulatory definitions, the prosecution’s response disregards all previous guidance by interpreting the term “funds” in the law very broadly, simply defining it as anyone involved in the transfer. They even compare it to package delivery, attempting to illustrate that control over the funds is not a necessary condition. This interpretation overlooks FinCEN’s explicit statement that virtual currencies are not considered “funds,” which is highly absurd.
If Tornado Cash is considered a package delivery service, it is clearly not solely serving criminals. Furthermore, the prosecution’s comparison actually proves the opposite of what they intend to prove. A courier service that cannot access the contents of the package being delivered is clearly not a money transmission service. First, if you cannot open the package, how do you know what’s inside? If you are told it is just a box containing canned food and you cannot open the box, how can you be guilty of operating an unlicensed money transmission? Second, the Financial Crimes Enforcement Network (FinCEN) explicitly states that armored car services limited to the secure transportation of money are not considered money transmitters!
Meanwhile, the FBI has issued a warning notice regarding cryptocurrency wallets. The notice “reminds Americans not to use cryptocurrency transmission services that are not registered as Money Services Businesses (MSBs) under US federal law.” The FBI also provides FinCEN’s official tool for users to check if a company is registered as an MSB.
Given the lawsuits against Tornado Cash and Samourai Wallet, if the DOJ’s position is that any action that moves cryptocurrencies on the Ethereum blockchain from one place to another (as argued in Tornado Cash’s defense) constitutes money transmission, then every cryptocurrency wallet is a money transmitter, whether it is software running on your phone, software running on your Trezor or Ledger device, or software running on Coinbase servers. Among these three, only Coinbase is registered. Considering the recent prosecutions, it is a precedent that warrants attention for many wallet companies in the industry, including some decentralized wallets.
It is still unclear whether the DOJ intentionally changed its long-standing policy through criminal enforcement or if there is a serious disconnect between the DOJ and FinCEN. However, regardless of the reason, this practice undoubtedly undermines the principles of the rule of law in the United States. As a side note, whether it is the passage of the TikTok Act or the recent controversial “Anti-Semitism Awareness Act,” we can feel the internal self-destruction in the United States.
III. Uncertainties Lead to Withdrawal of Cryptocurrency Wallets from the US Market
Paris-based Bitcoin company Acinq has declared that “recent announcements by US authorities raise questions about whether self-hosted wallet providers, lightning service providers, and even lightning node operators can be considered money services businesses and subjected to such regulations.” As a result of regulatory uncertainty, they will remove their popular lightning network wallet, Phoenix, from the US app stores. They advise users to close channels and transfer funds before May 3, 2023.
One day later, zkSNACKs announced the closure of access to its privacy-preserving Wasabi wallet in the US and stated in a statement on April 27th that “due to recent announcements by US authorities, zkSNACKs strictly prohibits US users from using its services.”
IV. Questions
1. Do wallet developers and service providers need licenses and registrations if they do not target US users?
If a cryptocurrency wallet or service explicitly does not target US users and ensures that US users cannot use its services, it generally does not need to obtain a US money transmission license or register as a money services business (MSB). US laws and regulations mainly apply to companies operating in the US or serving US residents.
However, even if a service does not directly target US users, it may still attract the attention of US regulatory authorities if it operates through the US financial system or if US users find ways to use the services. Therefore, completely avoiding the risks of US law may be challenging, especially in a globalized and internet environment.
To mitigate potential legal risks, non-US cryptocurrency service providers should take measures to ensure that their services are not accessible or used by US users. This may include technical measures such as geographic blocking and IP address filtering, as well as explicitly stating in the terms of service that the service is not available to US residents.
2. If it is not possible to avoid US users finding ways to use the service, what is the proper course of action?
Register as a Money Services Business (MSB):
According to the requirements of the Financial Crimes Enforcement Network (FinCEN) of the Department of the Treasury, individuals or companies that provide money transmission services must register as Money Services Businesses (MSBs). This includes submitting the necessary registration forms and updating any significant changes in information.
Comply with the Bank Secrecy Act (BSA) regulations:
MSB-registered businesses must comply with the regulations of the Bank Secrecy Act and its amendments, including but not limited to anti-money laundering (AML) regulations and the submission of suspicious activity reports (SARs).
Implement Customer Identification Program (KYC):
Money transmission services need to implement customer identification procedures, which are customer identity verification processes aimed at preventing identity theft, financial fraud, and money laundering activities.
Obtain State-level licenses (MTL licenses):
In addition to federal registration, most states require money transmission services to obtain state-level licenses. Specific requirements may vary depending on the state in which the business operates, so the appropriate license should be applied for based on the specific state of operation.
Maintain compliance records and reporting:
Comply with all record-keeping requirements and regularly report large transactions and suspicious activities to FinCEN. These records may need to be provided during audits or inspections.
Capital and insurance requirements:
Depending on the scale of operations and types of transactions, there may be requirements to meet certain capital adequacy and insurance coverage to ensure the security of customer funds.
