Chapter 2 Regulatory Challenges
Since the signing of The Electronic Fund Transfer Act by President Jimmy Carter in 1978, the rights, liabilities, and responsibilities of consumers who make electronic payments and the companies that offer it as a service have been governed by a complex web of state and federal regulations.
Payment facilitators are doubly subject to regulation, since they sit in the middle of a decoupled transaction.
The extent to which any electronic payment is subject to the various statutes regulating financial services depends on the specific nature of the transaction and the risk (financial and otherwise) associated with it. Payment facilitators are doubly subject to regulation, since they sit in the middle of a decoupled transaction. They are subject to one set of regulations when charging customers and another when disbursing funds to merchants. The legal burden is even heavier for companies that facilitate payments to overseas merchants or for regulated goods or services.
Due to the nature and complexity of the model, payment facilitators often require specialized staff responsible for ensuring regulatory compliance. Outlining the entire regulatory environment and determining which statutes apply to which online platforms is a herculean task; it is certainly outside the scope of this white paper. However, this section covers some of the more potent regulatory issues facing payment facilitators today.
Anti-Money Laundering and Know Your Customer
The Bank Secrecy Act (BSA) of 1970 requires all financial institutions to detect and prevent money laundering. Regulated companies must develop a BSA Anti-Money Laundering (AML) compliance program approved by each company’s board of directors.
The BSA has been amended several times over the past four decades, most notably in 2001 with the signing of the USA PATRIOT Act by President Bush. The PATRIOT Act was intended to help government agencies intercept and obstruct terrorism, but it has far-reaching implications for financial institutions and other regulated businesses. To detect and prevent terrorist financing, companies must now verify the identities of individuals using their services to conduct financial transactions. Upon request, these companies must provide information related to potential terrorist activity to the U.S. government.
The PATRIOT ACT also requires businesses to develop Customer Identification Programs (CIP) appropriate to the size and type of their business. A company’s CIP outlines its process for obtaining, retaining, and reporting information about its customers. These requirements are often referred to as Know Your Customer (KYC) requirements. KYC processes are employed by companies of all sizes to ensure compliance with the BSA and to prevent identity theft, financial fraud, money laundering, and terrorist financing.
Office of Foreign Assets Control
The Office of Foreign Assets Control (OFAC) is an agency of the US Department of the Treasury under the auspices of the Under Secretary of the Treasury for Terrorism and Financial Intelligence.
Federal regulations require all companies to comply with OFAC rules, which apply to all financial transactions between any two counterparties.
OFAC provides an updated list of all individuals and businesses (Specially Designed Nationals), with whom U.S. persons and businesses may not do business. To remain compliant, payment facilitators must develop and enforce procedures that ensure their services are not being used by persons on the OFAC list or to support sanctioned activities.
Financial Crimes Enforcement Network
All money services businesses (MSBs) are required to register with the US Department of Treasury through the Financial Crimes Enforcement Network (FinCEN). FinCEN is a bureau of the US Department of the Treasury that collects, analyzes, and coordinates the sharing of information about financial transactions in order to combat financial crimes. Failure to register with FinCen can result in criminal and/or civil penalties.
Once registered with FinCEN, companies are unequivocally subject to the BSA, which - in addition to other obligations - requires companies to file Suspicious Activity Reports (SARs) for activities that might signify money laundering, tax evasion, or other financial crimes.
Companies may also be required to register as Money Services Businesses (MSBs) with the individual states in which they operate. State regulators have been known to monitor the public FinCEN list for newly-registered companies that have failed to register at the state-level.
MSBs include companies that provide money transmission services, or the acceptance of “currency, funds, or other value that substitutes for currency from one person and the transmission of currency, funds, or other value that substitutes for currency to another location or person by any means.”
It is not uncommon for a business to take 6 months and spend over $500,000 to obtain state licenses.
Virtually all states regulate money transmission through an agency or department located in the consumer affairs or in the financial institutions bureau of the state’s executive branch. In most states, unlicensed money transmission can lead to civil and/or criminal sanctions. Individuals that help to operate an unlicensed money transmitting business may be fined and/or imprisoned.
While the purpose and content of the state laws may be quite similar, each state has its own unique application and compliance requirements. These requirements can be very expensive in terms of fees, legal costs, and time. States often require lengthy and intrusive background checks and disclosure from senior executives, directors, and investors in order to obtain a Money Transmission License (MTL). It is not uncommon for a business to take 6 months and spend over $500,000 to obtain state licenses. Creating nationwide coverage of MTL licenses can easily take years. In addition, companies are subject to bonding and net worth requirements which require large deposits of cash or other assets. This can be a prohibitive roadblock for smaller, early-stage companies.
Furthermore, obtaining full licensure involves continuing compliance-related responsibilities and costs, including annual state MTL fees and assessments. There are ongoing reporting, examination (with concomitant annual assessments), bonding, minimum capital, qualified investment, and other compliance requirements from multiple (and in some cases inconsistent) regulators.
Determining whether a business is a money transmitter is a matter of locality and circumstances.
Money transmitters must typically create and maintain compliance-related support and monitoring functions within the organization to fulfill each state’s individual compliance-related requirements. This involves hiring compliance staff and building IT-related infrastructure capable of supporting each state’s specific compliance requirements.
Determining whether a business is a money transmitter is a matter of locality and circumstances. Not all platforms that facilitate payments are money transmitters, so platforms are highly motivated to design their payment infrastructure in such a way as to minimize the likelihood of being classified as a money transmitter by state or federal regulators.
Tax Reporting and 1099-Ks
In 2011, the IRS introduced the Form 1099-K to reduce the discrepancy between the amount of income that people voluntarily report to the IRS and the total amount of income that they should report. The Form 1099-K only reports the movement of funds; individual merchants must decide whether these funds represent taxable income.
The tax code requires payment facilitators to issue a Form 1099-K to every merchant that processes over $20,000 and 200 payments in a calendar year and to file a corresponding form with the IRS. If the company is required to file over 250 forms in a given year, they must file electronically. The Form 1099-K requires the merchant’s Tax ID, legal name, address, and total transactions for the calendar year. If the company files inaccurate, incomplete, or tardy returns, it may be fined hundreds of dollars per erroneous filing, with no maximum penalty.