Ripple Labs Inc fined for failure to register with FinCEN as MSB

Introduction

On May 5 2015 virtual currency exchanger Ripple Labs Inc and its wholly owned subsidiary XRP II, LLC₍₁₎ (together, Ripple) entered into a consent agreement with the Financial Crimes Enforcement Network (FinCEN) in which Ripple consented to a $700,000 civil penalty and stipulated to a "statement of facts and violations" admitting that it had failed to:

• register as a money services business (MSB) as required under the Bank Secrecy Act as a result of selling its "XRP" virtual currency;₍₂₎ and
• satisfy other Bank Secrecy Act requirements, including its anti-money laundering (AML) and transaction reporting obligations.

Ripple concurrently entered into a settlement agreement with the US Attorney's Office in the Northern District of California (USAO) in which Ripple stipulated to the same statement of facts and agreed to forfeit $450,000 to the USAO. This forfeiture will be credited to satisfy partially FinCEN's $700,000 civil penalty. As part of its consent and settlement agreements, Ripple agreed to certain remedial actions.

The enforcement action against Ripple was the first civil enforcement action against a virtual currency exchanger for failing to register as an MSB. In December 2013 FinCEN sent industry outreach letters to virtual currency businesses advising that they may need to register as MSBs, but otherwise initiated no enforcement actions. In FinCEN's news release, Director Jennifer Shasky Calvery explained FinCEN's underlying policy rationale for targeting Ripple by noting that "[v]irtual currency exchangers must bring products to market that comply with our anti-money laundering laws" and that "[i]nnovation is laudable but only as long as it does not unreasonably expose our financial system to tech-smart criminals eager to abuse the latest and most complex products".

Facts

On March 18 2013 FinCEN released guidance clarifying the applicability of the Bank Secrecy Act to "users," "administrators" and "exchangers" of "convertible virtual currency".₍₃₎ The guidance explained that both exchangers and administrators of virtual currencies are money transmitters and that money transmitters are a type of MSB generally required to register under the Bank Secrecy Act.₍₄₎ Ripple stipulated that it had acted as a virtual currency exchanger – therefore constituting a money transmitter under the Bank Secrecy Act – since it sold its XRP virtual currency.₍₅₎ As noted above, the Bank Secrecy Act requires money transmitters to register with FinCEN as an MSB, which Ripple had failed to do.

Violations

According to the consent and settlement agreements, Ripple Labs Inc acted as a virtual currency exchanger from at least March 6 2013 until April 29 2013, and sold at least $1.3 million of its XRP virtual currency. Additionally, Ripple Labs Inc failed to establish an AML programme along with other policies to ensure compliance with the Bank Secrecy Act, including failing to designate a Bank Secrecy Act compliance officer, conduct AML training or obtain an independent review of its procedures.

XRP II stipulated to similar violations. First, it admitted that it commenced its virtual currency exchange business in August 2013 and failed to register as an MSB until September 2013. Second, it stipulated that it failed to develop an adequate AML programme, including failing to:

• develop a written AML programme for nearly two months;
• hire an AML compliance officer for six months;
• conduct an AML risk assessment until March 2014;
• offer AML training for nearly one year;
• obtain an independent review of its AML programme for nearly a year; and
• establish adequate internal controls to otherwise ensure Bank Secrecy Act compliance.

Third, XRP II failed to either file or timely report suspicious activity related to several financial transactions.

Remedial actions

In addition to the civil monetary and forfeiture penalties, Ripple agreed to:

• transact virtual currency exchange activity only through a registered MSB;
• implement an effective AML programme, including transaction monitoring and reporting procedures, satisfying any know-your-customer requirements, hiring an AML compliance officer and providing related AML training;
• comply with the Funds Transfer Rule and Funds Travel Rule (which require the collection and transmission of certain customer information in connection with transactions of $3,000 or more);
• conduct a three-year "look-back" reviewing all prior transactions of at least $2,000 to report any suspicious activity; and
• obtain an independent auditor to review Bank Secrecy Act compliance every two years until and including 2020.

Additionally, Ripple agreed to strengthen the XRP protocol analytical tools to provide for counterparty and funds flow reporting.

Industry stakeholders should take notice of this FinCEN consent agreement as it signals FinCEN's attention to virtual currency activities and expectations with respect to virtual currency exchangers.

For further information on this topic please contact David E Teitelbaum or Joel D Feinberg at Sidley Austin LLP by telephone (+1 202 736 8000) or email ([email protected] or [email protected]). The Sidley Austin website can be accessed at www.sidley.com.

Endnotes

(1) XRP II LLC previously conducted business as XRP Fund II.

(2) At the time of writing, XRP is reportedly the second largest virtual currency after bitcoin by market capitalisation, with approximately $217 million in circulation. In contrast, bitcoin has over $3.37 billion in circulation (see http://coinmarketcap.com/). Further, unlike bitcoin, where new bitcoins are continuously created through a 'mining' process, Ripple's founders created all the XRP virtual currency at its inception and, according to Ripple, no more XRP can be created (see Ripple's website, available at www.ripplelabs.com/xrp-distribution/).

(3) For further information please see "FinCEN guidance on application of Bank Secrecy Act to virtual currencies".

(4) The guidance defines an 'exchanger' as an entity "engaged as a business in the exchange of virtual currency for real currency, funds, or other virtual currency". The guidance defines an 'administrator' as an entity "engaged as a business in issuing (putting into circulation) a virtual currency, and who has the authority to redeem (to withdraw from circulation) such virtual currency".

(5) The statement of facts to which Ripple stipulated further notes that Ripple previously described itself in court filings as "a currency exchange service providing on-line, real-time currency trading and cash management" (see Ripple Labs Inc v Lacore Enterprises LLC, Motion for Preliminary Injunction, 13-cv-5974-RS/KAW (ND Cal 2013)).

This article was first published by the International Law Office, a premium online legal update service for major companies and law firms worldwide. Register for a free subscription.