Source: https://www.blockchainandbanking.com/federal-law-and-regulations-for-bitcoin-atm-operators
Timestamp: 2019-04-19 11:21:00+00:00

Document:
Most businesses must deal with federal, state, and local laws and regulations from time to time. Operators of Bitcoin ATMs are no different. For such operators, the primary regulations arise out of the federal Bank Secrecy Act (the “BSA”), as discussed below, and the state-level money transmitter laws are discussed in another article.
First signed into law in 1970, the BSA now sets-forth the duties “financial institutions” must follow to assist the government in the detection and prevention of money laundering and terrorism financing. The Act also prescribes transactional reporting obligations and federal registration requirements. The Act is construed and administered by implementing regulations. Those regulations are administered by the Financial Crimes Enforcement Network (“FinCEN”), which is a part of the US Department of Treasury.
The BSA’s defines financial institutions broadly and now includes the term “money services business” (“MSB”). If one is an MSB, and thus a BSA financial institution, the Act’s registration, reporting and recordkeeping requirements apply.
As those who are operating in the “traditional” ATM space may know, compliance with the BSA is generally not an issue, even for non-bank operators. However, the introduction of Bitcoin tokens or other virtual currencies into the ATM world complicates matters. In measure, this is because virtual currencies came about only after the BSA was written, and that since then FinCEN has struggled to fit the round (and changing) peg of virtual currency into the square hole of the Act and its implementing regulations.
FinCEN’s position is that the type of funds involved in a funds transmission, whether fiat or virtual currency, is generally irrelevant to its authority under the BSA.
With regard to the virtual currency world, FinCEN sees all actors as generally falling into one of three categories: “user,” “exchanger” or “administrator”. Exchangers and Administrators are both MSBs, and thus “financial institutions,” under the BSA.
Create procedures and internal controls to assure operations are conducted in compliance with the BSA. The written policies must be approved by senior leadership of the operator’s entity, like the board of directors if operated as a corporation. And the policy must be commensurate to the size of and risks anticipated by the operator.
Appoint a compliance officer responsible for implementing the controls, and otherwise guiding compliance with the AML program. The compliance officer must have knowledge of the controlling laws and operations risks; must have serious leadership authority within the organization; and must update the compliance policies as needed. The compliance office will also responsible for the organization’s filing of suspicious activity reports, as facts and circumstances may warrant.
The operator must train, and retrain, its staff on BSA/AML rules and procedures. The training must include exposure to red flag situations which are commonly seen as indicative of suspicious activity and/or money laundering.
The operator must test its policies for effectiveness. The test results must be documented and acted upon if deficiencies are revealed.
The program must meet the Know Your Customer (“KYC”) requirements via a written Customer Identification Procedure (“CIP”). This is relatively new component of the BSA’s mandate is derived from Act’s basic goal of preventing the nation’s financial system from being used for illicit purposes. Although there is much to say respecting proper CIP protocol, the three main components are to verify the identity of the person opening the account or transaction, to maintain the verification records, and to determine if the person is on a list of suspected terrorist persons or organizations.
The regulatory hurdles are all manageable, of course. While compliance with the BSA is important, many businesses have obtained federal registration and thereafter have successfully operated their affairs in compliance with the BSA’s implementing regulations. Strategic planning and the correct team approach is essential to minimizing the business-costs incumbent in federal registration and the implementation of the compliance program. The correct time to consider all these regulatory issues is before one purchases and eagerly awaits the delivery of the Bitcoin ATM kiosks.
If you have specific questions or would like more details, please do not hesitate to contact Josh Rosenblatt, Bill Repasky, or Jeff Gorham with Frost Brown Todd’s Blockchain and Digital Currency Group.
 31 USC §5312; See also, the BSA’s implementing regulation 31 CFR §1010.100(t)(3).
 See e.g., “Application of the Definition of Money Services to Certain Owner-Operators of Automated Teller Machines Offering Limited Services,” FIN-2007-G006.
 Note: industry standard usage dictates that the capitalized Bitcoin refers to code, whereas lowercase bitcoin refers to the unit of currency. For the sake of clarity, this article series will refer to the currency as Bitcoin tokens throughout.
 See e.g., 31 CFR §1010.100(ff)(5)(B)(ii) (“definition of a money transmitter does not differentiate between [the transmission and acceptance of] real currencies and virtual currencies”).
 “Application of FinCEN’s Regulations to Persons Administering, Exchanging, or Using Virtual Currencies,” (FIN-2013-G001) (“Guidance”).
 Guidance, supra. However, non-typical functionality and unexpected methods of operating the Bitcoin ATM may make problematic the likely FinCEN determination.
 31 USC §5330 and 31 CFR §1022.380(e).
 FinCEN also has the authority to assess civil fines and criminal penalties (including imprisonment) for “willful violations” of the BSA. 31 CFR §§1010.820(f) & 840, respectively. See also 18 USC §1960.

References: §5312
 §1010
 §1010
 §5330
 §1022
 §1960