Ruling on Whether a Certain Operation Protecting On-line Personal Financial Information is a Money Transmitter

Ruling
FIN-2008-R007
Issued: May 27, 2008
Subject: Whether a Certain Operation Protecting On-line Personal Financial Information is a Money Transmitter I am responding to your request for an administrative ruling, dated June 12, 2007, on behalf of [ ] (the “Company”) to the Financial Crimes Enforcement Network (“FinCEN”). You have requested a ruling regarding whether the Company is a money services business, as that term is defined in our regulations.1

As you have described,2 the Company is a limited liability corporation that has developed a financial product that will allow consumers to protect their identities, including personal credit card information, when making on-line purchases of consumer merchandise. The Company will give the consumer the use of a one-time-only virtual replacement credit card (the “Company Card”) with a credit limit equal to an amount understood by the Company to be the full price of the item or items involved in one individual transaction. Once the Company Card is utilized, its limit will revert to zero. The Company Card cannot be reloaded and will expire after use. The Company Card acts as a shield between the consumer and the on-line merchant, masking the consumer’s own personal and financial information and replacing it with information generated by the Company. For instance, the Company Card does not contain the consumer’s name but instead a first name of initials and a last name of [a common name used for all consumers]. The billing address appears as the Company’s customer service address. The only unmasked information the on-line merchant receives is the shipping address selected by the consumer.

31 C.F.R. §103.11(uu).
In addition to your June 12, 2007 letter, you provided information in a July 2007 follow-up telephone conversations with FinCEN staff, where you more fully described your business operations. Furthermore, on July 20 and 30, 2007, you emailed FinCEN business flowcharts (“Company Flowchart,” “Company Enrollment Flowchart” and “Company Payment Flowchart”), and on October 4th you emailed FinCEN answers to additional questions.

The consumer enrolls with the Company by accessing the Company’s website. The consumer provides his/her personal financial information and chooses among three available payment options. The consumer may choose to pay for purchases of virtual cards by billing them to one of the consumer’s existing credit or debit cards3 or by authorizing ACH debits from the consumer’s designated bank account. Thereafter, when the consumer decides to use a Company Card to purchase goods or services on-line, the consumer will access the Company’s website and disclose the amount of the purchase. If the consumer has chosen to bill the purchase of Company Cards to an existing credit or debit card, the Company will obtain pre-authorization for the payment from the consumer’s own card-issuing bank. If the consumer has chosen to debit his or her bank account for the purchase of Company Cards, the consumer will authorize an ACH debit from the consumer’s designated bank account to the Company’s account with [a U.S. bank] (the “Partner Bank”). Once the pre-authorization comes through, or the debit is processed satisfactorily, the Company will (a) instruct the Partner Bank to issue to the Company a Company Card for the amount requested by the consumer, with replacement personal and financial data (including the Company Card number, code name, and billing information) and (b) provide the Company Card information to the consumer. At settlement, the on-line merchant will claim payment for the consumer’s purchase from the Company through the Partner Bank. The Partner Bank will debit the Company’s account with Partner Bank and pay the merchant for the amount of the purchase. The Company will have covered the debit already by either having a hold on the consumer’s existing debit or credit card, or holding funds debited from the consumer’s designated bank account, depending on the consumer’s payment option. If the consumer has chosen to pay for the virtual card with a debit or credit card, the Company will claim payment from the consumer’s account through the consumer’s issuing bank. The ultimate purpose of the Company Card is to protect consumer’s personal and financial information from abuse. The process the Company devised to offer such protection provides the consumer with a new payment mechanism. You have asked whether this new mechanism may cause the Company to fall under the regulatory definition of money services business. Money services businesses are a type of financial institution for purposes of regulations implementing the Bank Secrecy Act.4 The category is defined to include

The consumer may use an existing credit card from any credit card issuer, or apply for a card issued in virtual form by the partner bank at the time of enrollment; the payment process is similar for both options. 31 C.F.R. § 103.11(n).

money transmitters.5
Whether a person is a money transmitter is a matter of facts and circumstances. Our regulations define the term “money transmitter” to include “[a]ny person… who engages as a business in accepting currency, or funds denominated in currency, and transmits the currency or funds, or the value of the currency or funds, by any means through a financial agency or institution… or… [a]ny other person engaged as a business in the transfer of funds.”6 The regulations also provide that “the acceptance and transmission of funds as an integral part of the execution and settlement of a transaction other than the funds transmission itself… will not cause a person to be a money transmitter.”7 The Company accepts funds denominated in currency from the consumer and transmits such funds to the merchant designated by the consumer through the Company’s credit relationship with its Partner Bank. The Company engages in the acceptance and transmission of funds in the manner that it does – through the Company Card – in order to protect a consumer’s personal and financial information from a merchant when the consumer purchases goods or services. However, accomplishing this purpose does not constitute a transaction separate from the funds transmission itself, because the need for the protection of the consumer’s personal and financial information only arises in connection with the transmission of funds. If the funds transmission is removed from the Company’s process, there is no consumer privacy interest to be protected by the Company’s customer protection scheme. From FinCEN’s perspective, therefore, the Company is engaged in the business of offering secure money transmission, rather than security to which money transmission is ancillary. The acceptance and transmission of funds by the Company is thus not integral to the execution and settlement of a transaction other than the funds transmission itself. In consequence, the Company is a money transmitter as that term is defined in our regulations and is obligated to register as a money services business with FinCEN.8 This ruling is provided in accordance with the procedures set forth at 31 C.F.R. § 103.81. In arriving at the conclusions in this letter, we have relied upon the accuracy and completeness of the representations made in your letter and in our conversations. Nothing precludes us from reaching a different conclusion or taking further action if circumstances change or any of the information provided is inaccurate or incomplete. We reserve the right, after redacting your name, and your company’s name and address, to publish this letter as guidance to financial institutions in accordance with our

31 C.F.R. § 103.11(uu)(5).
31 C.F.R. § 103.11(uu)(5)(i)(A) and (B).
31 C.F.R. § 103.11(uu)(5(ii).
8 See 31 C.F.R. § 103.41 (registration of money services businesses required, except issuers of stored value and persons that are money services businesses only because they are agents of other money services businesses).

regulations. You have fourteen days from the date of this letter to identify any other information you believe should be redacted and the legal basis for redaction. If you have questions about this ruling, please contact [FinCEN’s regulatory helpline at (800) 949-2732].

Sincerely,
// signed //

Jamal El-Hindi
Associate Director
Regulatory Policy and Programs Division