Operating Bitcoin ATM Business in the US: MTL & AML/BSA Guide

A recent surge in the acceptance of Bitcoin as a payment mode has led to a spike in Bitcoin ATM installations. According to the data source, Coin ATM Radar, Bitcoin ATM installations increased by 85 percent before the end of 2020, with 11,798 machines being added last year. Fears surrounding coronavirus have also propelled growth within the contactless payment market. Consequently, Bitcoin’s borderless network of money transfers is even more attractive to investors.

A Bitcoin ATM allows an individual to purchase the cryptocurrency directly from the operator, without going through an exchange. Some machines are one-way, allowing for the purchase of Bitcoin only, while others facilitate the purchase of bitcoin and the sale of cryptocurrency for cash.

Some would-be ATM operators have expressed confusion over state-by-state cryptocurrency regulations, and how to comply with FinCen’s KYC and AML requirements. As experts in all aspects of cryptocurrency and related laws, the Dilendorf Law Firm is fully equipped to help clients set up a Bitcoin ATM that meets all of the state and federal requirements.

Key information about setting up a Bitcoin ATM

Every state has different laws and requirements regarding the setup and operation of Bitcoin ATMs. For example, some states require a money transmitter license (MTL), while others do not. When embarking on such an endeavor, it is important to follow the state laws, while also maintaining compliance with all of the FinCen KYC and AML regulations.

Obtaining the necessary licenses and letters

Even if the ATM will be operated in one of the 35 states that currently do not require an MTL, it is recommended for an operator to obtain a no-action letter from the state. For example, California, Georgia, and Florida are three of the states that allow for the buying and selling of cryptocurrency through an ATM, while Arizona, Maryland and North Carolina are “buy only” states. Knowing whether your state is on one of these lists is an important first step in obtaining the proper permissions.

For example, South Carolina’s Office of the Attorney General determined that:

The exchange of virtual currency for fiat currency through an ATM that acts as a third party exchanger that facilitates contemporaneous exchanges of virtual currency for fiat currency, such as where the operator of the ATM receives the buyer’s fiat currency in exchange for a promise to make it available to the seller, is money transmission and requires a license under the Act.  When an ATM does not act as a third-party, and only facilitates a sale or purchase of virtual currency by the ATM operator directly with the customer, there is no money transmission because at no time is fiat currency received an exchange for a promise to make it available at a later time or different location, and therefore no license is required under the Act.

How the Dilendorf Law Firm can help

Our team has been immersed in all aspects of crypto for the past five years. Thousands of hours of research, analysis and face-to-face meetings with top industry contacts and regulators enabled us to develop a cutting-edge legal framework for issuing, launching and trading digital securities in the US.

We work diligently to keep abreast of new developments governing this fast-paced industry, including federal and state securities, tax and consumer-protection laws, broker-dealer, anti-money laundering (AML) and know-your-customer (KYC) regulations, as well as the local and international market dynamics.

For our clients considering the launch of a Bitcoin ATM, the Dilendorf Firm offers guidance and advice on incorporating the necessary AML and KYC checks, selecting vendors, and abiding by all state and federal laws.

How hard is it to set up a Bitcoin ATM?

As mentioned above, the level of difficulty in setting up the ATM is primarily dependent upon state laws. Aside from determining which laws pertain to that state, it is usually necessary to obtain a no-action letter from the state.  When requesting such a letter, it is important to include explanatory and detailed information about the proposed ATM, including its location, vendor name and machine type, description of the company’s AML/BSA policies and the business plan.

What type of machine is best?

The type of machine a company can operate will largely depend on the state where the machine will be located. Only a handful of states are currently allowing for Bitcoin ATMs that buy and sell. Most of the 35 states allowing ATMs are “buy only” states.

Our firm has worked with numerous ATM vendors and we are aware of the nuances between machines, including how well their software and internal processes addresses AML and KYC compliance issues. It is important to note that Bitcoin ATMs are currently cash only. The financial industry has yet to work through the legal issues of allowing for the use of credit cards, but we are told this could be coming soon.

How can Bitcoin ATMs comply with KYC and AML requirements?

It is important for any company looking to launch an ATM to develop their own AML and KYC policies, as these will be set up within the ATM’s CAS software. Most vendors use cloud services that keep everything compliant, but it is important to ask for specifics. Third-party services are often used to provide automated and compliant KYC verification. Without such a setup, registration within the software would need to be approved manually.

BSA/AML/OFAC Compliance Program

The Bank Secrecy Act (BSA) requires Bitcoin ATM operators to establish and maintain an effective written AML program reasonably designed to prevent ATM machines from being used to facilitate money laundering and the financing of terrorist activities.   The best practice  AML/BSA should include KYC and customer identification program, transaction monitoring, a designated BSA compliance officer, recordkeeping and record retention requirements and periodic independent reviews.

What happens when a customer approaches the machine?

Know-Your-Customer (KYC) verification is done in a number of ways. First, the operator will request certain pieces of information from the customer. Most vendors support validation through the following methods:

• Cell phone number
• Selfie
• ID Card Scans
• Two Documents confirming identity
• Fingerprint scans
• Email address
• Name
• Third-party validation.

Additionally, each ATM will incorporate security measures within its validation software. These include:

• TeleSign Integration: Utilizes CAS within a phone identity check and can restrict transactions to customers with a “known” phone identity. When enabled, a customer’s phone number will be checked against a list maintained by the telecom provider, which can mitigate certain fraud tactics.
• Rejecting PEPs: A PEP is a politically exposed person, who has been entrusted with a prominent public function. By virtue of their position and influence, these individuals generally represent a higher risk for potential bribery and corruption. When enabled within the CAS, transactions by PEPs can be rejected.
• OFAC Scan: During the validation/approval process, an individual can be checked against the OFAC Sanctions List, and depending on the result, the Operator may reject or register the individual.
• EU Sanction List: Similarly, the Operator can compare an identity against the EU Sanctions List, and then manually reject or register the individual based on results.
• CipherTrace: By using a “transaction scoring” process, high-risk wallet addresses (as defined by CipherTrace) can be rejected when presented as a buyer, and incoming coins will not automatically be enabled for cash withdrawals.
• Limits: By setting up generic limits for their customers, ATM Operators can restrict individual transaction amounts on a more granular level. For example, the Operator could limit customers to a certain amount of cash per transaction, per hour, per day, week, month, or longer.

Also, machine limits may be imposed that restrict location amounts, not just the Identity – preventing mule operations at specific locations.

Mechanics of Bitcoin ATMs

Operators should be aware of the strict regulations required, and design programs that meet their individual state’s requirements.

It is currently not legal for a customer using an ATM to purchase Bitcoin directly from an exchange. Instead, when a transaction is made the software sends the coins from the Operator’s hot wallet to the customer’s hot wallet. Afterward, the software buys back the transaction difference from the exchange to the Operator’s wallet, as a way to keep the wallet topped up.

The Bitcoin comes to the customer through the owner of the ATM, and that owner/operator takes a commission of 5 to 6 percent. Additionally, the ATM machine company takes 0.5 to 4 percent commission. Users should be made aware of how these commissions might impact their margins on the investment.

Recent FinCen proposal: How do ATMs comply?

A recent notice of proposed rulemaking (NPRM) from FinCen requires all transactions above $3,000 in value to go through additional KYC and AML checks, which require the operator to perform additional steps to verify the user’s identity. These proposed new rules are designed to prevent cybercrimes in the crypto industry, specifically scams involving money laundering, but add extra burdens for small businesses in the crypto space.

How to ensure a Bitcoin ATM is fully compliant with the law

When launching a new ATM, it is important to work with a professional legal consultant specializing in cryptocurrency compliance. Our team at the Dilendorf Law Firm knows how to ensure that ATM operators meet all state and federal requirements and will confirm that a Bitcoin ATM vendor provides the required level of security checks to ensure full compliance with the law.

Resources:

• 50-State Survey: Money Transmitter Licensing Requirements
• Definition of Money Transmitter (Merchant Payment Processor) – FinCEN
• Enforcement Actions for Failure to Register as a Money Services Business – FinCEN
• FinCEN Guidance, FIN-2019-G001 – FinCEN
• Money Services Business (MSB) Registration – FinCEN
• FAQs: Virtual Currency Business | Department of Financial Services
• Treasury’s Work to Support Money Transmitters
• State of State Money Services Business Regulation & Supervision
• O.C. Man Admits Operating Unlicensed ATM Network that Laundered Millions of Dollars of Bitcoin and Cash for Criminals’ Benefit
• Huntersville, N.C. Man Faces Federal “Dark Net” Drug Charges
• Virtual Currency Has Real-Life Risk
• State of South Carolina | Office of the Attorney General | Virtual Currency and Automated Machines
• Bitcoin and Beyond | Alternative Currencies, or History’s Biggest Bubble?

New York

• Money Transmitter Application Resources – NYSDFS
• Using a Licensed Money Transmitter – NYSDFS

California

• Application for a License to Engage in the Money Transmission Business
• State of California Money Transmitter Laws
• State of California – Application for a License to Engage in the Money Transmission Business
• Money – Transmitter | Frequently Asked Questions

Florida

• OFR-560-01 – Application to Register as a Money Services Business
• OFR-560-02 – Location Notification Form
• OFR-560-03 – Declaration of Intent to Engage in Deferred Presentment Transactions
• OFR-560-04 – Money Services Business Quarterly Report Form
• OFR-560-05 – Pledge Agreement
• OFR-560-06 – Money Services Business Surety Bond Form
• OFR-560-07 – Security Device Calculation Form
• Chapter 560, Florida Statutes – Money Services Businesses
• Rule 69V-560, Florida Administrative Code – Money Transmitters
• Form OFR-560-09 – Disciplinary Guidelines for Money Services Businesses
• Security Device Calculation Form