Uniform Law Commission Approves Model Law Regulating Virtual Currency Business Activities

U.S. Tech Law Update

January 29, 2018

By: Greg Pilarowski| Tiffany J. Gilliam

1.        Introduction

In July 2017, the Uniform Law Commission (“ULC”) adopted the Uniform Regulation of Virtual-Currency Businesses Act (“VCB Act”) to provide a statutory framework for the regulation of virtual currency activity. Since the creation of the first virtual currency in 2008, governments have struggled to determine an appropriate regulatory approach.[1]  Within the United States alone there is a material divide between states that believe virtual currency transactions should be heavily regulated and those that worry a burdensome regulatory approach might stifle innovation.[2] Against this background, the ULC drafted the VCB Act in an attempt to balance these competing interests.[3]

The ULC’s mission is to provide states with non-partisan legislation that brings clarity and stability to timely and important issues where uniformity across states is preferred.[4] Since the ULC is comprised of lawyers appointed by state governments, the resulting adopted measures reflect the diverse outlooks of the states while potentially reducing the burden of knowledge for individuals and businesses who move or conduct business transactions in different states.[5] Any act drafted by a ULC committee must be approved by a majority of states represented by ULC members in order for the act to be officially approved by the ULC.[6] After an act is approved by the ULC, the act is generally presented to state legislatures for consideration, and must be enacted by those state legislatures before becoming a law in those jurisdictions.[7]

One of the ULC’s most significant achievements is the implementation of the Uniform Commercial Code (“UCC”), first published in 1952 and revised several times since.[8] The UCC was created to address the need for standardized regulations of commercial transactions across state lines.[9] All 50 states have adopted the UCC, albeit with some local variations.[10]

Similarly, one purpose in drafting the VCB Act is to establish uniformity in regulating companies that engage in virtual-currency activity.[11] ULC members, representing 45 out of 53 US jurisdictions, approved the current draft of the VCB Act in July 2017. Two states, Hawaii and Nebraska, introduced the VCB Act to their state legislatures in January of this year.[12]

2.        Overview of Virtual Currency

The VCB Act focuses solely on the exchange of virtual currencies. Virtual currency, as defined by the VCB Act, is a digital representation of value that is used as a medium of exchange, unit of account, or store of value and does not have legal tender status, though it may have an equivalent value in real currency.[13] For purposes of the VCB Act, the definition of virtual currency does not include (1) transactions where a merchant grants value that cannot be exchanged for legal tender, bank credit, or virtual currency, and (2) digital representations of value used solely within game platforms.[14]

Virtual currency transactions are recorded on a type of distributed ledger known as a “blockchain.”[15] These ledgers are either recorded by a centralized issuer, who manages all issuances and transfers, or by a decentralized system where a group of individuals, known as “miners” validate each transaction through the act of “mining.”[16] Also essential to the upkeep of blockchains in decentralized systems are “nodes,” or volunteer machines that relay the transactions to the miners, who verify them, and then transmit updates to the blockchain.[17] In sum, blockchains provide a verified and permanent record of every transaction that has occurred.[18]

The exchange of virtual currency is comparable to transacting in cash; the transactions are irreversible and not dependent on a third party to carry out.[19] Furthermore, like exchanges with cash, virtual currency transactions allow individuals and entities to transact without sharing personal information with third parties.[20] However, this anonymity also gives criminals more opportunities to participate in money laundering, terrorist financing, tax evasion, and other cybercrimes such as ransomware attacks.[21] This is one of the issues the VCB Act seeks to address.[22]

3.        Overview of the Current Regulatory Framework for Virtual Currency

As noted above, states have adopted different approaches with respect to regulating virtual currency. Some states, such as North Carolina, have brought virtual currency exchanges within their existing statutory scheme for regulating money transmissions.[23] Other states like New York have specifically exempted virtual currency transactions from their money transmission regulations and instead created a separate statutory scheme for the virtual currency industry.[24]

The first regulatory approach, subsuming virtual currency exchanges within existing regulations for money transmissions, leaves much either unaddressed or unclear in their application since many types of virtual currency transactions are not money transactions.[25] However, heavy regulation, such as New York’s “BitLicense” scheme has been widely criticized as significantly harming innovation due to its slow licensing process, high costs, and strict requirements.[26] Most notably, New York’s BitLicense requires virtual currency businesses to maintain records and disclose the identity and physical addresses of parties to the transaction who are customers or accountholders of the business in an effort to eliminate money laundering.[27] This undermines one of the main advantages of dealing with virtual currency—the ability to protect private information from third parties whose databases are targets for hackers.[28] As a result of these regulations, some virtual currency companies have announced they were stopping all business in New York.[29] Currently, California is contemplating adopting its own version of BitLicense with the introduction of AB 1123 on March 30, 2017.[30] While the existing draft of AB 1123 does not require businesses to disclose private information of customers or account holders like BitLicense does, the proposed bill imposes similar hefty fees and administrative hurdles that may harm the development of the virtual currency industry in California.[31] While the VCB Act in some ways mirrors the regulations included in the BitLicense and AB 1123, the ULC drafted more flexible provisions—such as a three-tier system for determining who is exempt from the act, subject to modest regulatory requirements, or subject to full licensure requirements—to help facilitate innovation in virtual-currency businesses.[32]

At the federal level, virtual currency transactions are not subject to a special regulator regime designed for the industry. The U.S. Securities and Exchange Commission (“SEC”) has, however, released an investigative report clarifying that virtual organizations or capital raising entities using blockchain technology must still comply with U.S. federal securities laws.[33] In addition, businesses that exchange or transmit virtual currency fall into the category of “money transmitters” and are required to register with the Financial Crimes Enforcement Network (“FinCEN”) and comply with the Bank Secrecy Act, the primary federal anti-money laundering law, which incorporates related anti-money laundering provisions such as Title III of the Patriot Act.[34] Summarily, the Bank Secrecy Act requires businesses to collect customer information, adopt a customer identification program, and establish and implement a suspicious activity monitoring and reporting process.[35]

The drafters of the VCB Act wanted to ensure the Act did not conflict with any federal compliance requirements.[36] To that end, the VCB Act specifically requires virtual currency businesses to register as “money services businesses” with FinCEN, if so required, and provide evidence of that registration in their applications for licenses.[37]

4.        The VCB Act

The ULC drafting committee considered these varying approaches, and critics’ comments on them, when composing the VCB Act.[38] The committee’s goal was to impose modest regulatory requirements in order to avoid stifling innovation in the virtual currency industry, while still deterring money laundering and funding of terrorist activities.[39] As a result, the committee drafted the VCB Act such that it regulates only virtual currency business activities that are similar to money transmission or other regulated money service activities.[40]

a.        Who does the VCB Act regulate?

The VCB Act states that licensure and the imposition of regulations is only required of businesses that control an individual’s or entity’s virtual currency.[41]  Control is defined as “the power to execute unilaterally or prevent indefinitely a virtual currency transaction.”[42] Thus, the VCB Act only regulates third-party virtual currency businesses that store or transfer virtual currency in “electronic wallets,” similar to banks that store and transfer legal tender, or exchange virtual currency for other virtual currencies, bank credit, or legal tender and vice versa.[43] Accordingly, the VCB Act does not regulate miners, nodes, or persons creating, investing, buying, selling, or trading virtual currency on their own behalf or for personal, family, household, or academic purposes.[44]

With respect to the business that are subject to the VCB Act, not all must apply for a full license. As mentioned above, the drafters intended to make licensing under the VCB Act more flexible compared to New York’s BitLicense and California’s proposed AB 1123 by introducing a three-tier system.[45] Under this system, only businesses whose volume of virtual currency business exceeds $35,000 annually require a full license issued under the VCB Act.[46] New businesses whose volume of virtual currency business is between $5,000 and $35,000 may instead register as “registrants” for their first year, and be subject to fewer requirements.[47] Any other person who conducts activities aggregately valued on an annual basis at $5,000 or less, is exempt from the scope of the VCB Act.[48]

With the enactment of this three-tier system, the drafters hoped to allow “in the wild” testing of products and services within the enacting state to encourage innovators to expand their businesses and allow for academic research and beta testing.[49]

b.        Application Requirements

To apply for a license, a business is required to provide certain information about itself and each person who is responsible for or has control of it, or manages one of its servers. This includes, among other requirements, a five-year description of the applicant’s history, the names, addresses, and telephone numbers of all people expected to conduct its business, evidence of registration with FinCEN if required, and evidence of a minimum net worth of $25,000 and sufficient unencumbered reserves.[50]  The application must be accompanied by a nonrefundable fee set by the enacting state.[51]

Upon receipt of the application, the respective department investigates the financial condition of the business and the competence, experience, character, and general fitness of both the business and each executive officer, responsible individual, and any other individual with control.[52] The applicant is required to pay the department the reasonable costs of its investigation.[53] Afterwards, but within 31 days of the completion of application, the department will issue a notice of its decision.[54]

The VCB Act also contains a license by reciprocity provision allowing a business licensed under the VCB Act in one state to conduct virtual currency activities in another state by submitting a certification of its license history.[55] It thus gives businesses flexibility in conducting activities in multiple states by not requiring them to pay and apply for multiple licenses under relatively different statutory schemes.

c.        License Maintenance Requirements

After receiving a license, a business must apply to renew their license annually by paying a renewal fee, set by the enacting state, and submitting a renewal report.[56] The renewal report must contain a copy of licensee’s most recent reviewed or audited annual financial statements, a description of any material changes in its financial condition, a list of each location where the licensee conducts its business, and evidence that it maintains an amount of each type of virtual currency sufficient to satisfy the aggregate entitlements to customers in the relevant type.[57]

d.        Record and Policy Requirements

While not a part of the application process, the VCB Act requires licensed businesses to create and maintain various records and policies. Specifically, businesses are required to create and maintain policies and procedures for various cybersecurity programs that are compatible with, and do not conflict with, state and federal law.[58] Licensed businesses must also make certain disclosures to residents that use their services regarding user rights and the nature of virtual currency business activities.[59]

With respect to record keeping, the VCB Act requires businesses to maintain, for at least five years after the date of a transaction, records of each transaction, including the identity of the resident, the form of the transaction, the amount, date, and payment instructions by the resident, and the account number, name, and physical address of the resident.[60]

[1] “What is cryptocurrency, how does it work and why do we use it?,” The Telegraph, September 27, 2017.

[2] See Are U.S. investors interested in cryptocurrencies?, Venture Beat, October 14, 2017.

[3] Uniform Regulation of Virtual-Currency Businesses Act (“VCB Act”), Uniform Law Commission (“ULC”), October 9, 2017.

[13] See page 4 of the VCB Act; see also page 4 of A CFTC Primer on Virtual Currencies, Lab CFTC.

[14] See page 4 of the  VCB Act .

[15] These specific ledgers are so named because the ledger grows as completed “blocks” of information are added to it in a linear and chronological order. See pages 4 and 8 of the VCB Act; see also Distributed Ledger Technology Vs Blockchain Technology, The Merkle, March 25, 2017; CNBC Explains: How to mine bitcoins on your own, CNBC, January 23, 2014.

[16] See pages 3 and 8 of the VCB Act; see also page 5 of A CFTC Primer on Virtual Currencies, Lab CFTC. For a more detailed discussion on how “mining” works, see CNBC Explains: How to mine bitcoins on your own, CNBC, January 23, 2014.

[18] See page 8 of the VCB Act.

[19] See page 4 of the VCB Act.

[20] See pages 8-9 of the VCB Act.

[21] See page 9 of the VCB Act; Terrorist Use of Virtual Currencies: Containing the Potential Threat, Center for a New American Security, May 2017.,

[22] See pages 8-9 of the VCB Act.

[25] See page 8 of the VCB Act.

[28] See pages 8-9 of the VCB Act; New York’s bitcoin hub dreams fade with licensing backlog, Reuters, October 30, 2016.

[31] AB 1123, California Legislative Information; see page 9 of the VCB Act.

[32] See pages 1-2 of the VCB Act.

[33] See page 2 of the Report of Investigation Pursuant to Section 21(a) of the Securities Exchange Act of 1934: The DAO, Securities and Exchange Commission (“SEC”), July 25, 2017.

[34] BSA and Related Regulations, Office of the Comptroller of the Currency; Bitcoin Law: What US businesses need to know, Coin Desk, August 17, 2013.

[36] See page 29 of the VCB Act.

[37] Sections 202(a)(2)(R), 207(a)(5) – (6) of the VCB Act; see also pages 29 and 51 of the VCB Act.

[38] See page 9 of the VCB Act.

[39] See pages 2, 9-10 of the VCB Act.

[40] See pages 21, 28 of the VCB Act.

[41] See pages 14, 21, 23 of the VCB Act.

[42] See page 14 of the VCB Act.

[43] See pages 5-7, 14-15, 17-18, 21-23 of the VCB Act.

[44] See section 103 of the VCB Act; see also pages 21-23, 28-29 of the VCB Act.

[45] See pages 1-2 of the VCB Act.

[46] See section 202 of the VCB Act; see also page 24 of the VCB Act.

[47] See section 207 of the VCB Act; see also page 24 of the VCB Act.

[48] See section 103(b)(8); see also page 24 of the VCB Act.

[49] See pages 30, 52 of the VCB Act.

[50] See sections 202, 204 of the VCB Act.

[51] See section 202(a)(3) of the VCB Act.

[52] See section 202(d) of the VCB Act.

[53] See section 202(g) of the VCB Act.

[54] See section 202(e) of the VCB Act.

[55] See section 203 of the VCB Act.

[56] See section 206 of the VCB Act.

[57] See sections 206, 502 of the VCB Act.

[58] See sections 601, 602 of the VCB Act; see also page 78 of the VCB Act.

[59] See section 501 of the VCB Act; see also page 73 of the VCB Act.

[60] See section 302 of the VCB Act.