The Regulation of Virtual, Digital and Crypto-currencies // Cooley // Global Law Firm

Introduction: currencies, money and e-money¹

A virtual currency is "a digital representation of value that is neither issued by a central bank or public authority nor necessarily attached to a [fiat currency]², but is used by … persons as a means of exchange and can be transferred, stored or traded electronically".

A virtual currency is not necessarily the same as:

A 'digital currency' (a digital currency is a digital representation of a virtual currency (non-fiat) or a fiat currency (e-money)); or
A 'crypto-currency' (a crypto-currency is a mathematics-based, decentralised, convertible, virtual currency that is protected by cryptography).

For the sake of convenience, unless otherwise indicated, we have used the term 'virtual currencies' in this client alert to refer to virtual, digital and crypto-currencies.

Strictly, virtual currencies are not:

'Currencies' (currencies are (1) exchangeable with other currencies; (2) highly liquid; and (3) widely accepted in their geography. Virtual currencies often meet the first of these criteria, but not the second and third);
'Money' (money "performs three … functions: (1) a unit of account; (2) a means of exchange; and (3) a store of value". Virtual currencies cannot (yet) perform all of these functions at the same time and to the same extent as (real) money);
'Electronic money' ("e-money" means "electronically … stored monetary value as represented by a claim on the issuer which is issued on receipt of funds for the purpose of making payment transactions[;] accepted by … person[s] other than the [e-money] issuer[;]" and a representation of a fiat currency);³ or
'Legal tender' ((yet). If a virtual currency was legal tender, the creditor of a payment obligation would be required to accept it at full face value, and it would be sufficient to discharge a debtor from his payment obligations); or
'Redeemable' (unlike e-money, virtual currencies do not represent a claim on the issuer).

There are more than 600⁴ virtual currencies in use around the world today. Bitcoin is one of the best known and most widely used in Europe and North America.

What is Bitcoin, and how does it work?

Bitcoin is an example of a virtual, digital and crypto-currency. A network of computers is used to create and maintain a digital file. The file includes 'accounts', 'credits' and 'debits'. These credits and debits have a Bitcoin value. They also have a 'real-world' value because people are prepared to sell goods and provide services in exchange for an increase in the value of their Bitcoin account, and they believe others will do the same.

If the owner of one account wants to transfer value to the owner of another, he sends a message to the computers in the Bitcoin network. The message sender uses a 'private key' to create and embed a transaction-specific digital signature in his message. Each computer in the network tests the signature against a 'public key' to make sure it has been created by the person who owns the 'private key' and the Bitcoins associated with it. If it has, the computer updates its copy of the digital file and sends the message to one or more of the other computers in the network. When every computer has received the message and updated its copy of the file, the Bitcoin value has been transferred from one account to the other.

The 'public key' holds less information than the 'private key', and the keys are digital. This makes them more secure than passwords. It can also deliver complete payor / payee anonymity.

Strictly, the 'credits' and 'debits' are lists of input and output transactions, and the accounts do not have 'balances'. Before an account owner can transfer value to the owner of another, he must reference enough Bitcoin transactions to demonstrate that he has enough unspent Bitcoins to make the proposed 'payment'. When the payment instruction is given, the computers in the Bitcoin network check the previous transactions to make sure that each of these tests is met. The links between the transactions are used to pass Bitcoin ownership along in a 'chain'. The validity of each transaction therefore depends on the validity of the earlier transactions.

To stop fraudulent double spending and payments 'bouncing', the Bitcoin system also uses a 'blockchain'. Bitcoin transactions are gathered into groups or 'blocks'. Each block is digitally linked / cross-referenced to the one before it in a blockchain. Transactions in the same block are considered to have happened at the same time, and transactions that are not yet in a block are regarded as 'unconfirmed'. The blocks are filled and ordered by the computers in the Bitcoin network but, for technical reasons, 'payment' transactions can move into and out of several blocks before they come to rest. It is therefore usual for vendors to wait for an hour after receiving a Bitcoin payment before regarding it as 'cleared' and shipping their goods.

The blockchain operates like a digital register of Bitcoin transactions. Every Bitcoin transaction is recorded in the blockchain. A Bitcoin only exists if it is recorded in the blockchain, and it only belongs to someone if the blockchain shows that it was transferred to that person, and that it has not yet been transferred to someone else.

The advantages of Bitcoin

The most commonly cited advantages of Bitcoin are:

Transaction speed – Bitcoin payments are usually much faster than other electronic payments;
Transaction cost –
- It is much less expensive to transfer value using Bitcoin than it is with any other payment mechanism;
- Bitcoins are 'universal', so they do not generate foreign exchange fees when they cross borders;
Transaction certainty – there are no automatic refunds, so a merchant will not lose a payment if a customer makes a (false) non-delivery claim against him;
Security – payments can be made and received without showing or using personal or sensitive data, so the identity theft risk is lower than it is with many other payment mechanisms;
Privacy – Bitcoin can be used to create and maintain payor and payee anonymity;
Absence of central counterparties – Bitcoins:
- Are not controlled by governments or central banks, so they cannot be devalued for political reasons; and
- Are transferred directly from one account to another, so the credit and privacy risks associated with transferring 'money' through intermediaries are reduced or negated.

The risks associated with Bitcoin

The most commonly cited Bitcoin risks include:

Volatility – Bitcoins are volatile. So merchants usually change them into their local currency as soon as possible after receipt;
Irrevocable value destruction – Bitcoins can be irrevocably lost or destroyed:
- On 28 October 2011, more than 2,600 Bitcoins were lost because the payor did not use the correct address for the payee; and
- If a user 'loses' his private key in a hard drive crash, he will also lose the Bitcoins associated with his corresponding public key;
Change of law risk – Bitcoins are largely unregulated. Until we know when and how they will be regulated, we cannot predict what impact that will have on the Bitcoin economy;
Liquidity risk – if a crisis occurs in the Bitcoin economy or elsewhere, the number of Bitcoin sellers could quickly and easily exceed the number of buyers. If that happens, Bitcoins may lose some or all of their value very quickly;
The 'VHS / Betamax' risk – although Bitcoin is one of the best known and most widely used crypto-currencies in the West today, it has not fully 'occupied the space'. Competing virtual currencies may still emerge and dominate the market;
Fraud or theft – an apparently legitimate Bitcoin exchange may be hacked; it may also be a fraud. A Bitcoin user's 'wallet' may also be hacked; and
Money laundering and terrorist financing – payor / payee anonymity and the absence of intermediaries makes it easier to launder money, and the absence of an authorised intermediary makes it much less likely that suspicious transactions will be identified and reported.

Is Bitcoin widely used?

The number of companies that accept Bitcoins is growing. They include: Time Inc., Microsoft, Dell, Expedia, Zynga, Virgin Galactic, PayPal, Atomic Mail, Warner Brothers, Overstock.com, Etsy, Wikimedia, Save the Children, the American Red Cross and Greenpeace.

The Bank of England (BoE) believes there are £60 million worth of Bitcoins circulating in the UK economy, and that 300 UK Bitcoin transactions are carried out each day.⁵

Each of these things seems significant, and they are. However, £60 million is less than 0.1% of the sterling notes and coins currently in issue, and less than 0.003% of broad money. Further, the European Banking Authority (EBA) believes that the number of Bitcoin transactions has never exceeded 100,000 per day across the globe, compared to the 295 million conventional payment transactions that take place in Europe alone.

Is Bitcoin regulated?

The European Union's position

EBA

The EBA argues that virtual currencies should be regulated at a European level to protect consumers, enhance financial stability, and reduce the risk of financial crime. The EBA also argues that pan-European regulation would enhance the single European market. It has therefore invited the European Parliament, Council and Commission to develop an appropriate virtual currency regulatory regime that includes: a system of authorisation; segregation of client accounts; capital requirements; the creation of scheme authorities; customer due diligence; fitness and proprietary standards; transparent price information; and systems and controls to reduce the risk of market abuse.

It is likely to be some considerable time before a regime of this type is developed and brought into force. In the meantime, the EBA has recommended that:

National supervisory authorities should discourage credit, payment and e-money institutions from buying, holding or selling virtual currencies; and
European Union legislators should consider "declaring market participants at the direct interface between conventional and virtual currencies, such as virtual currency exchanges, to become 'obliged entities' under the EU Anti Money Laundering Directive and thus subject to its anti-money laundering and counter terrorist financing requirements".

Some national supervisory authorities are considering whether and, if so how, to discourage relevant institutions from buying, holding or selling virtual currencies (although the UK does not appear to be among them). It is not yet clear whether or when European Union legislators will declare relevant market counterparties as 'obliged entities'.

The European Central Bank (ECB)

The position of the ECB is that although "virtual currency schemes (VCS)" have numerous potential risks, the materialisation of these risks depends on certain risk drivers such as the volume of VCS issued and traded, and user acceptance. As these risk drivers remain low, the ECB considers there is no need to amend or expand the EU legal framework in relation to the ECB tasks of payment systems, financial stability and price stability. The ECB will continue to monitor developments in the VCS sector with a view to reassessing the risks over time.

The UK's position

The UK has five potential virtual currency regulators: the BoE, the Prudential Regulation Authority (PRA); the Financial Conduct Authority (FCA), the Payments Systems Regulator (PSR) and Her Majesty's Treasury (HM Treasury).

The BoE does not believe that "digital currencies … pose a material risk to monetary or financial stability in the United Kingdom". It is not therefore proposing to do any more than monitor developments, for the time being.

The PRA regulates banks, insurers and designated asset managers. It does not therefore seem to have the power to fully regulate virtual currencies at present. What it does have is the power to discourage (or prevent) at least some credit institutions from buying, holding or selling, virtual currencies, as the ECB has recommended, although there is no current reason to think that it will do so.

The FCA has established an 'Innovation Hub' to help innovators develop fintech products and services that meet the FCA's requirements. It has also published a "Project Innovate: call for input" (11 July 2014), and feedback statement "FS14/2 Project Innovate: Call for Input—Feedback Statement" (October 2014), but there is nothing in any of these things which suggests that the FCA is proposing to regulate virtual currencies either.

The PSR will begin to regulate the following HM Treasury designated UK payment systems: BACS; CHAPS; Faster Payments; LINK; Cheque & Credit; Northern Ireland Clearing; Visa; and MasterCard. HM Treasury has the power to vary the list of designations under the Financial Services (Banking Reform) Act 2013. However, HM Treasury and the PSR have not said anything to date which suggests that HM Treasury will or may designate and/or the PSR may be required to regulate, any virtual currencies or virtual currency systems in the short or medium term (at least).

In August 2014, HM Treasury published a "Digital currencies: call for information"; and in March 2015, it published its feedback response and proposals. As it did so, HM Treasury announced that the government:

Intends "to apply anti-money laundering regulation to digital currency exchanges within the UK", and that "full consultation on the regulatory regime" will begin "early in the next Parliament";
"Will work with the British Standards Institution and the digital currency industry to develop voluntary standards for consumer protection";
Has launched a research initiative that will "research opportunities and challenges for digital currency technology", and pledged "£10million to support this"; and
Will continue to feed into the Financial Action Task Force process on virtual currencies.

We have considered how likely it is that the UK will begin to fully regulate virtual currencies in 2015 in a separate blog, which is available here.

The United States' position

In most States, businesses offering financial services in virtual currencies are required to register as money transmitters, and to comply with anti-money laundering rules. The authorities have already used breaches of these requirements to close several virtual currency businesses including, for example, Liberty Reserve⁶, Silk Road⁷ and Western Express International.⁸

New York

On 23 July 2014, the New York State Department of Financial Services (DFS) said that it was proposing to adopt a Bitlicencing regime. Draft legislation was published for consultation, and many responses were received. At the end of December 2014, the DFS published Superintendent Benjamin Lawsky's initial response: the regime would be amended (Revised Framework), and published for further consultation. The second consultation began on 4 February 2015, and it closed at the beginning of March.

Under the Revised Framework, a business that engages in one or more of the following virtual currency activities will need a Bitlicence:

Receiving virtual currency for transmission or transmitting virtual currency, except where the transaction is undertaken for non-financial purposes and does not involve the transfer or more than a nominal amount of virtual currency;
Storing, holding or maintaining custody or control of virtual currency on behalf of others;
Converting or exchanging fiat currency or other value into virtual currency, virtual currency into fiat currency or other value, or one form of virtual currency into another form of virtual currency as a 'customer business' (as distinct from personal use);
Buying and selling virtual currency as a 'customer business'; or
Controlling, administering, or issuing a virtual currency.

Merchants and consumers using a virtual currency to buy or sell goods or services; and firms chartered under the New York Banking Law to conduct exchange services will not need a Bitlicence if (in the latter case) they are also approved to engage in virtual currency business activities. The Revised Framework also clarifies that the development and dissemination of software in and of itself will not require a Bitlicence.

An application for a Bitlicence will require an entity that carries on any of the above business activities to include (for example):

The name of the applicant, form and date of organisation and jurisdiction of organisation or incorporation;
A list of all direct and indirect controllers of the applicant, persons controlled by the applicant or persons under a common control with the applicant;
A list of, detailed biographical information (including name, physical and mailing addresses, and information on each individual's personal history, experience and qualification) for, and a background report on each Relevant Party which includes each:
- individual applicant;
- director;
- executive officer;
- shareholder that directly or indirectly owns, controls or holds power to vote 10% or more of any class or shares or a corporate entity or possesses the power to direct or cause the direction of the management of policies of the entity;
- person entitled to 10% or more of the benefits of a trust.
For each Relevant Party, and every individual employed by the applicant with access to any customer funds (whether denominated in fiat or virtual currency), a set of completed fingerprints and photographs of the individuals (as applicable) must also be included.
An organisation chart of the applicant and its management structure;
A current financial statement for the applicant and each Relevant Party (as applicable);
A projected balance sheet and income statement for the following year of the applicant's operation;
Detailed information on the applicant including:
- a description of its proposed, current and historical business;
- all associated website addresses;
- jurisdictions in which the applicant is engaged in business;
- principal place of business; and
- physical address of any operation in New York
Details of all banking arrangements; and
An explanation of the methodology used to calculate the value of Virtual Currency in Fiat Currency.

Bitlicence holders will be required (for example) to:

Hold an appropriate amount and type of capital;
Maintain a US dollar bond or trust account for the protection of its customers;
Maintain an anti-money laundering program to include the filing of Suspicious Activity Reports;
Verify the identity of their account holders;
Tell consumers about the risks associated with virtual currencies;
Issue a receipt when it completes a virtual currency transaction—the receipt must include the firm's details; the type, value, date, and time of the transaction; the fee; the exchange rate; a statement of the firm's liability for non-delivery or delayed delivery; and a statement of its refund policy;
Establish and maintain written policies and procedures to resolve complaints in a fair and timely manner; and
Designate a qualified employee as its Chief Information Security Officer, and make him responsible for implementing and enforcing an appropriate cyber security program and policy.

It is not yet clear when the DFS will publish the final version of its Bitlicence regime, or when the regime will come into force.

California

California is also in the process of adopting a Bitlicence of its own. Assembly Bill No. 1326 "relating to virtual currency" (the Bill) was filed with the California State Assembly on 27 February 2015. The Bill is expected to be heard by the Committee of Banking and Finance on 31 March 2015. The Bill was filed just one month after California Assembly Bill 129 (Lawful Money) was passed, legalising the use of Bitcoins and other virtual currencies, enabling them to be accepted as if they were money in California.

The Bill defines "Virtual currency" as "any type of digital unit that is used as a medium of exchange or a form of digitally stored value or that is incorporated into payment system technology. Virtual currency shall be broadly construed to include digital units of exchange that (1) have a centralized repository or administrator, (2) are decentralized and have no centralized repository or administrator, or (3) may be created or obtained by computing or manufacturing effort. Virtual currency shall not be construed to include digital units that are used solely within online gaming platforms with no market or application outside of those gaming platforms, nor shall virtual currency be construed to include digital units that are used exclusively as part of a customer affinity or rewards program, and can be applied solely as payment for purchases with the issuer or other designated merchants, but cannot be converted into, or redeemed for, fiat currency".

If passed in its current form, the Bill will require those engaging in the business of virtual currencies to be licenced, but would not apply to consumers using Bitcoin solely for the purpose of buying and selling goods and services. To apply for a licence, applicants would need to pay a non-refundable fee; provide detailed information about themselves and prior virtual currency services they have offered; and provide a sample form of receipt for virtual currency transactions and specified financial statements. The Bill will require licensees to meet minimum capital requirements to "ensure the safety and soundness of the licensee, its ongoing operations and maintain consumer protection". The Bill, unlike the New York regime, does not include anti-money laundering provisions or suspicious reporting obligations.

New Hampshire

On 8 January 2015, a draft Bill "requiring the state treasurer to develop an implementation plan for the state to accept bitcoin as payment for taxes and fees" was introduced into New Hampshire's House of Representatives with support from Republican and Democrat sponsors. If passed, the Bill will require the state treasurer to develop an implementation plan to address "any accounting, valuation, and management issues relative to the acceptance of bitcoin [as payment for taxes and fees]". In its current form, the Bill requires the state treasurer to submit this plan to the New Hampshire State Senate by 1 January 2017, so that Bitcoins can be accepted as payment of taxes and fees from 1 July 2017.

The position in other jurisdictions

The position in other countries varies between those that have outlawed the use of virtual currencies and those that are taking steps towards licensing and supervision. For instance it is unlawful for authorised financial services firms domiciled in China to buy, hold or sell virtual currencies. Russia appears to be moving in a similar direction to China as the Russian Ministry of Finance published a bill in 2014, which effectively bans the use of "monetary surrogates" such as "cryptocurrencies". In the first quarter of 2015, Bank of Thailand and Bank Indonesia softened their previous positions that Bitcoin use was illegal and issued statements warning against the use of Bitcoin because it does not constitute currency or legal tender.

On the other hand, Germany has recognised Bitcoin as a unit of account since 2013, enabling it to be taxed. German companies seeking to use Bitcoin for commercial transactions are required to obtain special permission from the Federal Financial Supervision Authority and authorisation must also be obtained for the provision of additional services relating to Bitcoin. Similarly, Sweden has required virtual currency exchanges to be registered with the Swedish financial supervisory authority since 2012.

Closing comments – keeping up to date

From an international perspective, virtual currency regulation is beginning to change; and the pace of change is increasing. This Client Alert is correct as at 27 March 2015. It will be updated over time. Interim updates are available on our practice blog, which is available here.

NOTES

There is more information about each of these things in the "Report of the Financial Action Task Force—Virtual Currencies: Key Definitions and Potential AML / CFT Risks" (June 2014); and the European Banking Authority's "Opinion on Virtual Currencies" (4 July 2014). back
A "currency" is a "fiat currency" if it is issued by a public authority or a central bank. back
See article 2(2) of the New E-Money Directive (2009/110/EC), and the reports referred to in footnote 1. back
See, for example, http://coinmarketcap.com/all/views/all/back
See The Economics of Digital Currencies, in the Bank of England's Quarterly Bulletin 2014 Q3. back
This Costa Rica-based money transmitter and seven of its principals and employees were charged with operating an unregistered money transmitter business and money laundering. Liberty Reserve had more than a million users worldwide, including 200,000 in the United States. Between 2006 (when it was established) and 2013 (when it was shut down), Liberty Mutual handled 55 million transactions, almost all of which were illegal. It had its own virtual currency (Liberty Dollars), but at each end, transfers were denominated and stored in US dollars. back
Silk Road operated as a global black market to distribute drugs, weapons, and stolen identities. Hundreds of millions of US dollars were laundered through the site using illegal transactions facilitated with Bitcoins that were often purchased from and then converted back into fiat currency by legitimate Bitcoin exchanges. back
A cyber-crime group used Western Express International Inc to launder more than US$35 million raised by buying and selling stolen credit card and identity information. Western Express International Inc operated as a virtual currency exchanger and unregistered money transmitter to coordinate and facilitate these activities using the virtual currencies WebMoney and e-Gold. back