Mobile Payments and Virtual Currencies

1. Mobile Payments and Virtual Currencies February 11, 2015 Presented by Obrea Poindexter Jeremy Mandell

2. Agenda • Mobile payments • What is a mobile payment? • Legal framework • Tokenization • FTC focus on consent • Mobile payments and the CFPB’s prepaid proposal • Virtual currencies • What is Bitcoin? • Key virtual currency legal issues • Anonymity • Licensing requirements • Consumer protection • Banking relationships

3. Mobile Payments

4. What Is a Mobile Payment? • The concept of “mobile payments” captures a wide range ofpayment-related activities • Enablement though smartphones and other electronic handheld devices • Mobile payment applications typically offer one or more of the following functionalities • Storage of payment instruments, coupons and/or rewards, and the enabling of payment services • The ability to make and/or process payments for goods and services • The ability to facilitate peer-to-peer transfers

5. Mobile Payment Permutations • Mobile wallet functionality • Point-of-sale functionality • Semi-closed loop and peer-to-peer platforms • Carrier billing

6. Legal Framework • No single law governs mobile payments or entities operating within the mobile payments ecosystem • But, mobile payments are not the “wild west” of financial services • Electronic Fund Transfer Act / Regulation E • Truth in Lending Act / Regulation Z • Gramm-Leach-Bliley Act / Regulation P • Interchange / Regulation II • Covered persons and UDAAP under the Dodd-Frank Act • Payment processors as service providers • Bank Secrecy Act (money services businesses) • State money transmitter licensing laws

7. Tokenization • In October 2013, the major credit card companies introduced a new “tokenization” standard for digital payments • The new standard allows for the traditional 16-digit primary account number (“PAN”) to be replaced with a digital “token” for online purchases and transactions initiated with mobile devices, such as Apple Pay • Tokens can be restricted for transactions with a specific mobile device, merchant or transaction type • Payment tokens map back to the underlying account, providing the account issuer with the full transaction details • Tokenization helps prevent fraud in e-commerce and m-commerce transactions by removing sensitive card account information from the payment process • Merchants and digital payment providers can store payment tokens in place of PANs, further enhancing payment security

8. FTC Focus on Consent • Recent FTC enforcement actions involving mobile apps demonstrate the ongoing interest of the FTC in assuring adequate consumer consent in the context of mobile devices • In the enforcement actions, the FTC focused on adequate consent for • Collection, use and sharing of customer information • Billing practices that authorize charges during app-related activity • The FTC has reached settlements with • Goldenshores Technologies, LLC—December 2013 (geolocation information) • Apple Inc.—January 2014 (in-app charges) • Google, Inc.—September 2014 (in-app charges) • The FTC also is investigating Amazon.com, Inc. (in-app charges)

9. CFPB Prepaid Accounts Proposal – Overview • On December 23, 2014, the CFPB published its long-anticipated proposed rule to regulate prepaid card products • The Proposal would extend a modified version of the regulatory compliance regime currently applicable to payroll card accounts (i.e., “Reg. E Lite”) to “prepaid accounts” • The Proposal would impose a highly prescriptive disclosure regime consisting of “pre-acquisition disclosure requirements” and timing requirements for delivery of those disclosures

10. CFPB Prepaid Proposal – Overview • The Proposal also would extend modified versions of certain credit card requirements under the Credit Card Accountability Responsibility and Disclosure Act (“CARD Act”) to prepaid accounts • And, the Proposal would establish complex special compliance requirements for prepaid accounts with overdraft services or credit features • Separately, in June 2014, the CFPB published a request for information (“RFI”) concerning mobile financial services • The CFPB said it plans to use responses to the RFI to develop the agency’s consumer education strategies related to mobile financial services

11. CFPB Prepaid Proposal – Scope • The Proposal would amend the Regulation E definition of “account” to add a definition of “prepaid account,” which would be defined to mean a card, code or other device not otherwise an “account” established for personal, family or household purposes that is • Issued on a prepaid basis or capable of being reloaded • Redeemable at multiple unaffiliated merchants, usable at ATMs or usable for P2P transfers • Not subject to the Regulation E “gift card rule” • Prepaid accounts would, therefore, include general-purpose prepaid cards (whether or not reloadable) and accounts that are not loaded at acquisition but are eligible to be loaded • The Proposal also would cover prepaid products even if the funds are loaded by a third party, rather than by a consumer

12. CFPB Prepaid Proposal – Scope • A digital wallet that is capable of storing funds would be viewed as a prepaid account • A digital wallet that only holds payment credentials for other accounts, however, would not • Products with P2P or P2B transfer capabilities would also be prepaid accounts subject to the Proposal • The CFPB acknowledges that the Proposal may have potential application to virtual currencies • However, the CFPB has requested comment on how the Proposal would apply • The CFPB further acknowledges that the Proposal does not resolve issues related to the application of the Proposal to virtual currencies

13. CFPB Prepaid Proposal – Disclosures • Short-form and long-form disclosures, consistent with the Model Forms in the Proposal, would need to be provided to a consumer prior to account acquisition • These disclosures would be in addition to the initial disclosure requirements in existing Regulation E • The issuer would need to disclose up to three of the most-frequently incurred “incidence-based” fees on the short-form disclosure • The Proposal includes very detailed and complex grouping, segregation, and prominence and size (e.g., font/pixel size) requirements • The Proposal also would require disclosure of issuer contact information on each prepaid account access device

14. CFPB Prepaid Proposal – Electronic Disclosures • The Proposal would require electronic delivery of short- and long-form disclosures when a consumer acquires a prepaid account through the Internet, including via a mobile app • Electronic acquisition disclosures can be provided without regard to consumer consent and other applicable provisions of the E-SIGN Act • Disclosures must, however, be provided in a manner that is reasonably expected to be accessible in light of how a consumer is acquiring the prepaid account • The Proposal provides guidance on provision of electronic disclosures to meet this new standard in a manner that is not easily bypassable and requests comment on the same

15. CFPB Prepaid Proposal – Account Information • Instead of complying with existing Regulation E periodic statement requirements, an issuer could make available to the consumer each of the following • The consumer’s account balance via telephone • An 18-month history of the consumer’s account transactions online • An 18-month written history of the consumer’s account transactions in response to an oral or written request • For periodic statement information, an electronic history of transactions, and a written history of transactions provided at the request of a consumer, the issuer would need to disclose • The amount of all fees assessed against the account • A summary total of the amount of all fees assessed, the total amount of all deposits, and the total amount of all debits, for the prior calendar month and for the calendar year to date

16. CFPB Prepaid Proposal – Error Resolution • For prepaid accounts, the error resolution time frames and procedures are generally the same as those in existing Regulation E • The Proposal would extend Regulation E’s existing investigation and provisional crediting requirements to prepaid accounts • The Proposal also would set forth the method for an issuer to determine which error resolution regime (i.e., Regulation E or Regulation Z) would apply to a transaction

17. CFPB Prepaid Proposal – Liability Limitations • The Proposal’s 60-day period for reporting any unauthorized transfer would begin on the earlier of • The date the consumer electronically accesses the consumer’s account information reflecting the unauthorized transfer • The date the issuer sends the consumer a written history in response to the consumer’s request • An issuer could comply with the 60-day period requirement by limiting consumer liability for any unauthorized transfer reported by the consumer within 120 days after the transaction occurred • If an issuer makes appropriate disclosures regarding registration of a prepaid account, the issuer would not need to comply with the error resolution requirement, discussed above, or the liability limitations until the account has been verified • This does not apply to payroll card accounts or government benefit accounts

18. CFPB Prepaid Proposal – Credit Feature • In general, prepaid accounts that access overdraft services or credit features for a fee would be considered credit cards subject to Regulation Z and its credit card rules • Effectively, all prepaid accounts could be impacted because of the inability to control force-pay transactions (e.g., when a network is offline and uses a stand-in balance or when a merchant does not seek authorization for the full amount of a transaction) • The Proposal provides that the credit provisions would only be triggered if an issuer imposes a fee or charge • Triggering the credit provisions also would trigger ability-to-pay and other CARD Act requirements

19. CFPB Prepaid Proposal – Posting Agreements • An issuer would need to submit prepaid account agreements to the CFPB on a quarterly basis • An issuer also would need to post and maintain on its own publicly available Web site the prepaid account agreements that the issuer is required to submit to the CFPB

20. Virtual Currencies

21. What is Bitcoin? • Bitcoin is a “peer-to-peer” (“P2P”) system • In a P2P system, there is no central administrator • The ledger (“block chain”) is publicly available and distributed nodes (“miners”) verify transactions • Bitcoin is a “convertible” virtual currency • Bitcoin can be used to purchase real and virtual goods and services and is readily exchangeable for government-issued currency • Bitcoin is a “cryptocurrency” • Transactions are signed using public and private keys

22. Is Bitcoin Currency? • Under the Bank Secrecy Act (“BSA”), “currency” means “The coin and paper money of the United States or of any other country that is designated as legal tender and that circulates and is customarily used and accepted as a medium of exchange in the country of issuance” 31 C.F.R. § 1010.100(m) • In contrast to real currency, “virtual currency” is a medium of exchange that operates like real currency in some environments, but does not have all the attributes of real currency • Specifically, virtual currency does not have legal tender status in any jurisdiction

23. Is Bitcoin Currency? • The BSA regulates, among other things, money transmitters • Any person that provides money transmission services—i.e., “the acceptance of currency, funds, or other value that substitutes for currency from one person and the transmission of currency, funds, or other value that substitutes for currency to another” 31 CFR § 1010.100(ff)(5)(i)(A) • The BSA imposes obligations on financial institutions to assist U.S. government agencies in detecting and preventing money laundering • Under the BSA, money services businesses (“MSBs”), including money transmitters, must • Register with FinCEN • Report suspicious activity and certain currency transactions • Establish an anti-money laundering (“AML”) program • Retain specified records

24. Is Bitcoin Currency? • FinCEN has issued interpretive guidance and administrative rulings on administering, exchanging and using virtual currency • Generally, an administrator or exchanger that accepts and transmits or buys or sells convertible virtual currency is a money transmitter subject to the BSA • Based on FinCEN guidance: • A virtual currency trading and booking platform that matches offers to buy and sell virtual currency for real currency is a money transmitter (FIN-2014-R011) • A company providing a virtual currency payment system that receives payment in real currency and transfers an equivalent value in virtual currency is a money transmitter (FIN-2014-R012)

25. Is Bitcoin Currency? • However, based on other FinCEN guidance • A miner who creates virtual currency and uses it to purchase real or virtual goods and services is not a money transmitter (FIN-2013-G001) • A miner who creates virtual currency and uses it to pay investors in his mining operation is not a money transmitter (FIN-2014-R001) • A person who rents computer systems for mining virtual currency is not a money transmitter (FIN-2014-R007)

26. Is Bitcoin Currency? • Money transmission is also regulated under state law • 48 states and the District of Columbia have money transmission laws • The core purposes of the federal and state money transmission laws are very different • Federal law focuses on anti-money laundering and terrorist financing • State laws focus on the integrity and financial health of those running the money transmission—i.e., consumer protection and safety and soundness • The key issues are whether a third party or intermediary is “holding” money and whether that third party is exempt from state money transmission laws (e.g., bank or broker-dealer)

27. Is Bitcoin Currency? • State regulators have expressed interest in virtual currency • California Department of Financial Institutions Cease and Desist Order • New York Department of Financial Services (“DFS”) subpoenas • New York DFS “BitLicense” proposal • Texas Department of Banking supervisory memorandum • Georgia Department of Banking and Finance guidance for consumers • Kansas Office of the State Banking Commissioner guidance • Washington Department of Financial Institutions guidance and consumer alert • The Conference of State Bank Supervisors (“CSBS”) has issued a policy statement and a draft model regulatory framework that proposes licensing, BSA/AML and recordkeeping requirements, as well as certain consumer protections

28. Is Bitcoin Property? • The Internal Revenue Service (“IRS”) had been pressed by the U.S. Government Accountability Office and others to publish guidance on the tax treatment of virtual currency • The U.S. tax code contains special rules for dealings in foreign currency, but does not define “currency,” and absent guidance it was unclear how bitcoin should be treated • In Notice 2014-21 (March 2014) the IRS confirmed that under existing tax law: • Bitcoin and other “convertible” virtual currencies are not subject to the special tax rules that apply to foreign currency • Instead, convertible virtual currency is simply treated as “property” (not defined; a residual category) for U.S. tax purposes • Notice only applies to “convertible” virtual currencies

29. Is Bitcoin Property? • The usual tax rules that apply to any other “property” therefore also apply to bitcoin • Gain or loss is recognized on the sale or exchange of bitcoin • No de minimis exception; valuation and recordkeeping issues • Gain/loss may be capital or ordinary, depending on holder’s tax status as investor, trader or dealer • Bitcoin miners realize gross income upon receipt of bitcoin • Usual third-party tax reporting and withholding tax obligations can apply • Separately, in issuing final rules on reporting of certain foreign financial assets (December 2014), the IRS said it is considering the proper treatment of virtual currency and requested comments • State tax authorities, including the New York Department of Taxation, have also issued guidance on the tax treatment of convertible virtual currencies such as Bitcoin

30. Is Bitcoin a Commodity? • Generally, a “commodity” is defined as an article of trade or commerce, or a tangible good • Bitcoins can be viewed as tangible goods, because individuals have constructive possession of bitcoins • Constructive possession is control of property without actual possession • However, key characteristics of commodities are price stability and non-substitutability • Bitcoin is subject to severe price volatility • There are emerging virtual currency competitors (e.g., Peercoin and Litecoin)

31. Is Bitcoin a Commodity? • If bitcoins were commodities, how would they be regulated? • The Commodity Exchange Act defines “commodity” to mean “wheat, cotton, rice, corn, oats, barley, [etc.]…and all services, rights, and interests…in which contracts for future delivery are presently or in the future dealt in” 7 U.S.C. § 1a(9) • The CFTC has authority to regulate commodity futures and certain foreign-exchange instruments • Would bitcoin transactions be regulated as commodity futures? • Would bitcoin be regulated as a foreign-exchange instrument? • The CFTC’s authority would, however, extend to derivative contracts based on virtual currencies, which participants in a virtual currency system may use to hedge against exchange rate fluctuations

32. Key Issue: Anonymity • Bitcoin, and virtual currency more broadly, is appealing to illicit actors because it enables use to remain relatively anonymous • Notwithstanding the presumption of anonymity, law enforcement may be able to adapt to new technology • The public key is a user’s pseudonym, which is tied to every transaction recorded in the public ledger • It may be possible to tie a public key to an individual, or at least individually identifiable information, such as an IP address; however, anonymizing software (e.g., Tor) can be used to increase pseudonymity

33. Key Issue: Licensing/Registration • Exchangers (at least) must register with FinCEN and may have to apply for a license under state money transmission laws • Extensive state application process • Significant fees, deposits and surety requirements • Extensive business plans • Information regarding principal officers, directors and equity owners, including background investigation reports, fingerprints and biographic documents • Disclosure of all legal proceedings and financials • Detailed descriptions of operations and compliance programs • Ongoing compliance obligations • Anti-money laundering/counter-terrorist financing (“AML/CTF”) obligations • Capital and surety bond requirements • Subject to regular examinations

34. Key Issue: Licensing/Registration • An MSB must “develop, implement, and maintain an effective [AML] program…reasonably designed to prevent the [MSB] from being used to facilitate money laundering and the financing of terrorist activities” • Program must be commensurate with the risks based on location, size, and the nature and volume business • Program must be in writing and copies must be available for inspection upon request • At a minimum, the AML program must • Describe policies, procedures, and internal controls • Designate a compliance officer • Provide training for responsible personnel • Provide for independent review

35. Key Issue: Licensing/Registration • In February 2015, the NYDFS revised the comprehensive “BitLicense” regulatory scheme it had proposed in July 2014 • The revised proposal would cover activities involving New York State or a New York Resident in which a person: • Receives or transmits virtual currencies on behalf of consumers • Stores, holds or maintains custody or control of virtual currency on behalf of consumers • Performs exchange services—i.e., converting or exchanging virtual currency for fiat currency or other virtual currency • Buys or sells virtual currency as a business or • Controls, administers, or issues virtual currency • Accordingly, the “BitLicense” proposal appears broader than FinCEN’s virtual currency regulation, which generally focuses on virtual currency “exchangers”

36. Key Issue: Licensing/Registration • Under the BitLicense proposal, licensees would be subject to: • Capital requirements • Prior approval for material changes to existing products or services • Extensive recordkeeping requirements • Regular examinations and • Quarterly reporting and annual audited financial statements • Licensees also would be expected to: • Develop an AML compliance program • Develop a cybersecurity program (to include regular penetration testing) • Designate a chief information security officer and a compliance officer • Develop business continuity and disaster recovery plans • There are also consumer protection requirements, discussed below • The February 2015 proposal includes the concept of a transitional license for startups in the virtual currency space that may not meet all of the requirements of the proposed regime

37. Key Issue: Licensing/Registration • In December 2014, the Conference of State Bank Supervisors (“CSBS”) issued a policy statement and draft model state regulatory framework for virtual currencies • The model framework takes a similar, but in some instances less restrictive, approach to that of the NYDFS • Comments on the model framework are due by February 16, 2015

38. Key Issue: Consumer Protection • The value of bitcoins has fluctuated wildly • Accordingly bitcoins are not a “store of value,” which is a key characteristic of real currency • State and foreign banking regulators have issued consumer warnings regarding the risks deriving from buying, holding, or trading virtual currencies, such as bitcoins • Value “held” in bitcoin wallets is not insured, as a deposit account is insured • Bitcoins have been the subject of theft (e.g., Mt. Gox, Sheep Marketplace) • Bitcoin holders do not have the same dispute resolution rights as they may with other forms of payment • Bitcoin may not be subject to conventional counterfeiting, but risk of fraud remains

39. Key Issue: Consumer Protection • On August 11, 2014, the CFPB issued a consumer advisory outlining risks that may be associated with virtual currencies • The CFPB identified risks associated with virtual currencies including • Virtual currencies are a target for hackers • Virtual currencies do not have liability limitations like debit or credit cards and • Virtual currencies have resulted in new scams by fraudsters • The CFPB encourages consumers to • Know who they are doing business with when engaging in virtual currency transactions • Be aware that virtual currencies can experience dramatic price fluctuations • Understand fraud risks when using or investing in virtual currencies • Protect their private keys from theft or loss and • Understand that there is no government insurance for virtual currency accounts

40. Key Issue: Consumer Protection • The CFPB also announced that it would accept complaints from consumers who may encounter a problem with virtual currency products and services, such as exchanges or digital wallet providers • The CFPB will use complaints data to better understand the virtual currency market and its effect on consumers and “if appropriate, take consumer protection policy steps”

41. Key Issue: Consumer Protection • With respect to consumer protections, the NYDFS BitLicense proposal would require licensees to: • Prior disclosure of material risks associated virtual currency activities • Prior disclosure of licensee’s terms and conditions, which must include the right to a periodic statement • Certain disclosures on advertising and marketing materials • Detailed receipts and • Written policies and procedures to resolve complaints fairly and in a timely manner

42. Key Issue: Banking Relationships • Many exchangers and other Bitcoin-related start-ups have had difficulty establishing banking relationships • Many banks are wary of banking MSB customers, which require enhanced monitoring See Interagency Interpretive Guidance on Providing Banking Services to Money Services Businesses Operating in the United States (April 26, 2005) • Moreover, there is substantial uncertainty around the regulatory treatment of Bitcoin and other virtual currencies, including whether exchanges need to obtain a money transmission license in every state • Without bank accounts, exchangers cannot hold U.S. dollars or enable users to buy and sell bitcoins

43. Key Issue: Banking Relationships • With respect to MSBs, like all other customers, banks must • ‰Apply the banking organization’s Customer Identification Program • ‰Conduct a basic BSA/AML risk assessment to determine the level of risk associated with the account and whether further due diligence is necessary • With respect to MSBs, unlike other customers, banks must • Confirm FinCEN registration, if required • Confirm compliance with state or local licensing requirements, if applicable • ‰Confirm agent status, if applicable • If the bank’s risk assessment indicates potential for a heightened risk of money laundering or terrorist financing, the bank is expected to conduct further due diligence in a manner commensurate with the heightened risk