"The FinCEN Final Rule on Card (including Gift Card), Mobile and Internet-Based Prepaid Access – Who is Covered and What Are the Requirements and Compliance Deadlines?"

Background
In the wake of technological change, the Financial Crimes Enforcement Network of the Department of the Treasury (“FinCEN”) issued a final rule to amend the Bank Secrecy Act regulations applicable to money services businesses regarding stored value, which is now known as prepaid access (the “Final Rule”). 76 Fed. Reg. 45403 (July 29, 2011). Prepaid access is not itself a device or vehicle, but rather such device or vehicle is a means through which prepaid funds are accessed. 76 Fed. Reg. 45413 (July 29, 2011). The terms issuer and redeemer of stored value were deleted and the terms provider of prepaid access and seller of prepaid access were added, among other things, in the Final Rule. Consequently, a provider of prepaid access and a seller of prepaid access are money services businesses that are subject to requirements and compliance deadlines. This eUpdate provides definitions of prepaid access and prepaid program and a provider of prepaid access and a seller of prepaid access and an overview of the requirements and compliance deadlines.

Definitions
Prepaid access. Prepaid access means access to funds or the value of funds that have been paid in advance and can be retrieved or transferred at some point in the future through an electronic device or vehicle, such as a card, code, electronic serial number, mobile identification number or personal identification number. 31 CFR § 1010.100(ww).

Prepaid program. A prepaid program is an arrangement under which one or more persons acting together provide(s) prepaid access. However, an arrangement is not a prepaid program if it provides: (A) closed loop prepaid access (that can be used only for goods or services in transactions involving a defined merchant or location or set of locations, e.g., a specific retailer or retail chain, a college campus, or a subway system, per 31 CFR § 1010.100(kkk)) to funds not to exceed $2,000 maximum value that can be associated with a prepaid access device or vehicle on any day; (B) prepaid access solely to funds provided by a Federal, State, local, Territory and Insular Possession or Tribal government agency; (C) prepaid access solely to funds from pre-tax flexible spending arrangements for health care and dependent care expenses or from health reimbursement arrangements for health care expenses or (D)(1) prepaid access solely to: (i) employment benefits, incentives, wages or salaries or (ii) funds not to exceed $1,000 maximum value and from which no more than $1,000 maximum value can be initially or subsequently loaded, used or withdrawn on any day through a device or vehicle and (2) the arrangement does not permit: (i) funds or value to be transmitted internationally; (ii) transfers between or among users of prepaid access within a prepaid program or (iii) loading additional funds or the value of funds from non-depository sources. 31 CFR § 1010.100(ff)(4)(iii).

Provider of prepaid access. A provider of prepaid access is the participant within a prepaid program that agrees to serve as the principal conduit for access to information from its fellow program participants. The participants in a prepaid access program must determine a single participant within the prepaid program that agrees to serve as the principal conduit for access to information from its fellow program participants. 31 CFR § 1010.100(ff)(4)(i).

Where no participant in a prepaid program has registered as the provider of prepaid access for a prepaid program, the provider of prepaid access is the person with principal oversight and control over the prepaid program, which is a “facts and circumstances” determination. Activities indicating “principal oversight and control” include: (A) organizing the prepaid program; (B) setting the terms and conditions of the prepaid program and determining that the terms have not been exceeded; (C) determining the other businesses that will participate in the prepaid program, which may include the issuing bank, the payment processor or the distributor; (D) controlling or directing the appropriate party to initiate, freeze or terminate prepaid access and (E) engaging in activity that demonstrates oversight and control of the prepaid program. 31 CFR § 1010.100(ff)(4)(ii).

Seller of prepaid access. A seller of prepaid access means any person that receives funds or the value of funds in exchange for an initial loading or subsequent loading of prepaid access if that person: (i) sells prepaid access offered under a prepaid program that can be used before verification of customer identification or (ii) sells prepaid access (including closed loop prepaid access) to funds that exceed $10,000 to any person during any one day and has not implemented policies and procedures reasonably adapted to prevent such a sale. 31 CFR § 1010.100(ff)(7).

Requirements and Compliance Deadlines
A provider of prepaid access and a seller of prepaid access must satisfy the requirements and compliance deadlines described below.

Provider of prepaid access. A provider of prepaid access had a September 27, 2011 deadline to (1) implement an anti-money laundering program (“AML program”), (2) file suspicious activity reports with the U.S. Treasury Department and (3) comply with certain record-keeping requirements. A provider of prepaid access has a March 31, 2012 compliance deadline to (1) have a written AML program that (a) establishes policies, procedures and internal controls developed and implemented that include provisions for complying with the requirements applicable to the provider of prepaid access, including verifying customer identification, filing reports, creating and retaining records and responding to law enforcement requests; (b) establishes procedures to verify the identity of a person who obtains prepaid access under a prepaid program and obtain identifying information concerning such person, including name, date of birth, address and identification number (“Identifying Information”); (c) designates a person to assure day to day compliance with the AML program (“Designated Person”); (d) provides education or training of appropriate personnel about their responsibilities under the AML program, including detection of suspicious transactions and (e) provide for independent review to monitor and maintain an adequate AML program conducted by an officer or employee that is not the Designated Person; (2) comply with certain record-keeping requirements; (3) register with FinCEN and (4) prepare and maintain a list of agents.

Seller of prepaid access. A seller of prepaid access has a March 31, 2012 compliance deadline to (1) implement an anti-money laundering program (“AML program”) that must: (a) be in writing; (b) establish policies, procedures and internal controls developed and implemented that include provisions for complying with the requirements applicable to the seller of prepaid access, including verifying customer identification, filing reports, creating and retaining records and responding to law enforcement requests; (c) establish procedures to verify the identity of a person who obtains prepaid access under a prepaid program and obtain identifying information concerning such person, including name, date of birth, address and identification number (“Identifying Information”); (d) establish procedures to verify the identity of a person who obtains prepaid access to funds that exceed $10,000 during any one day and obtain Identifying Information; (e) designate a person to assure day to day compliance with the AML program (“Designated Person”); (f) provide education or training of appropriate personnel about their responsibilities under the AML program, including detection of suspicious transactions and (g) provide for independent review to monitor and maintain an adequate AML program conducted by an officer or employee that is not the Designated Person. A seller of prepaid access also must file suspicious activity reports with the U.S. Treasury Department and comply with certain record-keeping requirements by the March 31, 2012 deadline.

FinCEN will not initiate any compliance matter or enforcement action before March 31, 2012 for violations of the Final Rule, nor will it assess any civil money penalties for violations of the Final Rule that occur before March 31, 2012. FinCEN Notice 2011-3 (September 9, 2011).