I. Introduction

Although the virtual-currency business industry is still in its infancy, the Uniform Law Commission ("ULC") sought to create a statutory structure for regulating virtual-currency business activity in an effort to provide innovators and customers certain assurances with respect to the regulatory landscape. The ULC released its final version of the Uniform Regulation of Virtual-Currency Businesses Act ("VCBA") on October 9, 2017, which sets forth extensive requirements that must be met before a person or entity can engage in virtual-currency business activity with residents of a state. To date, no state has adopted the VCBA, but the expectation is that some states will adopt the VCBA or some version of it. This article summarizes the key provisions of the VCBA and outlines how the Act will affect the virtual-currency industry.

II. Key Provisions of the VCBA

A. Scope and Application

The purpose of the VCBA is to regulate virtual-currency business activity, rather than the virtual currency itself. Thus, the VCBA provides a licensing and regulatory framework for businesses whose products and services include:

1. the exchange of virtual currencies;
2. the transfer of virtual currencies from one person to another; or
3. certain custodial or fiduciary services in which the property or asset under the custodian's control are considered "virtual currency."[1]

The ULC outlines a three-factor test to determine whether a transaction is subject to the VCBA. With respect to the first two factors, the transaction must involve both "virtual currency" and "virtual-currency business activity," which are defined in § 102. If the first two factors are met, the third factor requires a determination of whether the transaction is subject to one of the fourteen exemptions listed in § 103. Each of these factors is discussed below.

1. Virtual Currency

"Virtual currency," as defined in § 102(23), is "a digital representation of value that (1) is used as a medium of exchange, unit of account, or store of value; and (2) is not legal tender" (which is defined as government-issued coin or paper money in § 102(8)). Expressly excluded from the definition of virtual currency are (1) transactions involving merchant rewards programs, if the value of the reward cannot be exchanged for legal tender, bank credit, or virtual currency;[2] and (2) digital representations of value issued by a publisher and used solely within an online game or game platform.

Comment 1 to the definition of "virtual currency" notes that the VCBA's definition tracks the definitions of virtual currency set forth in Department of the Treasury's Financial Crimes Enforcement Network (FinCEN) guidance and the Conference of State Bank Supervisors' September 15, 2015, Framework. The comment also explains that "virtual currency" includes electronic precious metals (e-precious metals) and electronic certificates for precious metals (e-certificates).[3]

The VCBA is intended to cover as many types of virtual currency as possible, regardless of whether it is issued on a centralized or decentralized basis.[4]

2. Virtual-Currency Business Activity

Pursuant to § 102(25), "virtual-currency business activity" means "exchanging, transferring, or storing virtual currency or engaging in virtual-currency administration, whether directly or through an agreement with a virtual-currency control-services vendor."[5] This definition includes holding e-precious metals or e-certificates on behalf of another person or issuing shares or e-certificates representing interests in precious metals. It also includes exchanging digital representations of value used in online games or game platforms for virtual currency if such currency can be converted back to legal tender or bank credit outside the online game or game platform.

The definition of "virtual-currency business activity" turns on whether the activity involves one of the following four verbs-control, exchange, store, and transfer. In other words, if the person or entity controls, exchanges, stores, or transfers virtual currency, then the VCBA will apply unless there is an applicable exemption.

"Control" is defined in § 102(3)(A) as "the power to execute unilaterally or prevent indefinitely a virtual-currency transaction." As the ULC explains, "control" arises when the owner of virtual currency gives to another person who engages in virtual-currency business activity the power to unilaterally transact or permanently prevent transactions with the owner of the virtual currency.[6] Practically speaking, control arises when the owner provides both the public and private keys to enable transactions in virtual currency. As a result, the definition of "control" is not intended to cover "multi-sig transactions," which typically require more than one key to virtual-currency and involves keys held by multiple third parties. Because "control" contemplates the unilateral power to transact or permanently prevent a transaction, multi-sig arrangements are excluded.

Section 102(5) defines "exchange" as "to assume control of virtual currency from or on behalf of a resident, at least momentarily, to sell, trade, or convert: (a) virtual currency for legal tender, bank credit, or for one or more forms or virtual currency; or (b) legal tender or bank credit for one or more forms of virtual currency."[7]

Under § 102(20), "store" simply means to maintain control of virtual currency on behalf of a resident by a person other than the resident, similar to safe deposit business. "Transfer" means to assume control of virtual currency from or on behalf of a resident to (1) credit the virtual currency to the account of another person; (2) move the virtual currency from one account of a resident to another account of the same resident; or (3) relinquish control of virtual currency to another person. This definition of "transfer" is intended to be similar to "money services" or "money transmission" transactions (in other words, wire transfers).

3. Exemptions

The VCBA expressly states that it does not apply to the exchange, transfer, or storage of virtual currency to the extent that the activity is governed by the Electronic Funds Transfer Act of 1978, 15 U.S.C. §§ 1693 through 1693r, the Securities Exchange Act of 1934, 15 U.S.C. §§ 78a through 78oo, the Commodities Exchange Act of 1936, 7 U.S.C. §§ 1 through 27f, or the state's applicable blue sky laws.[8]

Additionally, the VCBA sets forth fourteen exemptions which are similar to those found in the Uniform Money Services Act or in other states "money transmitter" statutes, as well as FinCEN guidance. A complete list of these exemptions can be found in § 103. Entities meeting the definition of "bank" are specifically exempted (but this does not include trust companies seeking to engage in "virtual-currency business activity").[9] Those using virtual currency for personal purposes or businesses that receive virtual currencies from sales of good or services in the ordinary course of business are not subject to the Act.[10] Miners of bitcoin are therefore excluded, as they do not offer services to third parties.[11] Attorneys and title insurance companies providing escrow services are also exempt.[12]

In an effort to encourage innovation, the ULC also exempted those whose virtual-currency business activity is reasonably expected to be valued on an annual basis at $5,000 or less.[13] While this provision was intended to allow individuals to experiment with virtual-currency technology, this is obviously a very low threshold. The VCBA also excludes those who do not charge for services.

B. Licensing and Registration Requirements

The ULC sought to create a three-tier approach to the licensing requirement. If a person engages in virtual-currency business activity and the volume of virtual-currency business activity exceeds $35,000 annually, then a license is required. Section 202 lists the extensive requirements for an application to obtain a license including, but not limited to, a security deposit and a minimum net worth. If a person has a volume of virtual-currency business activity that does not exceed $35,000 annually, he or she has the option of registering with the department rather than obtaining a license.[14] This "on-ramp" option is intended to accommodate start-ups and those doing business in new states, as entities can continue to operate while an application to obtain a license is pending. Finally, those whose volume of virtual-currency business activity is less than $5,000 annually are exempt from the VCBA, as discussed above.

In lieu of an application, the VCBA offers two alternate provisions for reciprocal licensing across states, which is supervised by the Conference of State Bank Supervisors and its National Multistate Licensing System and Registry or through the department's[15] discretionary authority.[16]

The VCBA imposes recordkeeping and reporting requirements on both licensees and registrants. With respect to recordkeeping, the licensee or registrant must keep for five years records of each transaction, the aggregate number of transactions, a monthly ledger of assets and liabilities, bank statements, and reports of any disputes with residents.[17]

The VCBA also requires licensees and registrants to make extensive disclosures to residents who use their products and services. Before establishing a relationship with the resident, a licensee or registrant must disclose, among other things, a fee schedule, whether the provider offers any insurance against loss, the irrevocability of the transfer, and any right to stop the transaction.[18]

Finally, the VCBA imposes mandatory compliance obligations which require licensees and registrants to create and maintain policies and procedures to ensure compliance with the VCBA.[19] Licensees and registrants must also create and maintain policies related to cyber-security, business continuity, anti-fraud, and anti-money laundering, among other things.[20]

C. Potential Liability Under the VCBA

Generally, the VCBA does not allow for a private right of action for violations of its provisions and, instead, authorizes the department to bring enforcement measures and assess penalties. However, there is an exception to this general prohibition on private rights of action.

1. Enforcement Measures by the Department

Article 4 outlines enforcement and civil penalties under the VCBA. Section 402 authorizes the department to take enforcement measures against a licensee or registrant (or those who are not licensed or registered but are nonetheless engaging in virtual-currency business activity) and lists the various circumstances under which an enforcement measure may arise. For example, an enforcement measure may arise if a licensee, registrant, or person materially violates the Act, becomes insolvent, or does not cooperate fully with an investigation.[21] The department may also take an enforcement measure if the licensee, registrant, or person engages in (1) an unsafe or unsound act or practice; (2) an unfair or deceptive trade practice; (3) fraud or intentional misrepresentation; (4) another dishonest act; or (5) misappropriation of legal tender or virtual currency.[22]

2. Defenses

The VCBA expressly recognizes a bona fide error defense to enforcement actions by the department, as the department may waive an enforcement measure if there is bona fide error notwithstanding reasonable procedures designed, implemented, and maintained to prevent errors. Comment 4 to § 402 explains that reliance on and compliance in good faith with a rule or guidance provided by the department will constitute bona fide error, even if the rule or guidance is later invalidated.[23] However, reliance on the opinion of counsel, even in good faith, will not constitute bona fide error if the opinion is incorrect.

If an enforcement action is related to operating without a license, it is a defense that the person has in effect a customer-identification program reasonably designed to identify whether a customer is a resident and it failed to identify the person as a resident.[24]

3. Civil Penalties

The most potentially severe penalty under the VCBA is the penalty for engaging in virtual-currency business activity without being registered or licensed. Under the VCBA, the department is authorized to assess a penalty of up to $50,000 for each day of the violation.[25] For material violations of the Act, the department may assess a penalty not to exceed $10,000 for each day of the violation.[26]

4. Private Right of Action

Although the VCBA contemplates enforcement actions by the department, an individual may maintain a private right of action to enforce his or her rights afforded by § 502.[27] Section 502 requires a licensee or registrant who has "control" of virtual currency to maintain an amount sufficient to satisfy the aggregate entitlements of the persons for whom it has control of the virtual currency.[28] If a virtual-currency business fails to do so, persons have a pro rata property interest in the type of virtual currency to which he or she is entitled.[29] This section is based on Article 8 of the Uniform Commercial Code and is intended to prevent a virtual-currency business that has "control" over virtual currency from maintaining any such virtual currency on its balance sheet or dealing with any such virtual currency as its own property. Practically speaking, in the event of a virtual-currency business' insolvency, creditors will be unable to go after assets solely under the virtual-currency business' "control."

The drafters have also noted that this controversial provision will be replaced with an act that adopts UCC Article 8's approach to this matter.[30] The act should be ready for enactment in 2018.[31]

III. Conclusion

The ULC designed the VCBA to provide a licensing system with a set of ongoing regulatory requirements for recordkeeping and deposit minimums established at the state level. Those that provide virtual-currency business services, as defined by the VCBA, that fail to register and maintain their license in compliance with the VCBA can be subjected to severe public penalties that may also leave open the possibility of private rights of action. While no state has yet adopted the VCBA, it is expected to be proposed for consideration by several state legislatures in 2018.

Burr & Forman will continue to monitor updates to and enactment of the Uniform Regulation of Virtual-Currency Businesses Act.

[1] VCBA, Prefatory Note.
[2] Note, however, that if merchant rewards can be exchanged for legal tender, bank credit, or virtual currency, then they will be considered "virtual currency."
[3] See VCBA, § 102, cmt. 1.
[4] See VCBA, Prefatory Note.
[5] See id. § 102(25).
[6] See VCBA, Prefatory Note.
[7] See VCBA, § 102(5).
[8] See id. § 103(b).
[9] See id. § 102, cmt. 3.
[10] See id. § 103(b)(7).
[11] See id. § 102, cmt. 2.
[12] See id. §§ 103(b)(8)-(9).
[13] See id. § 103(b)(8).
[14] See id. § 207.
[15] "Department" means the state agency implementing the VCBA. See VCBA, § 102(4).
[16] See id. § 203.
[17] See id. § 302.
[18] See id. § 501.
[19] See id. § 601(a)(7).
[20] See id. § 601.
[21] See id. § 402.
[22] See id. § 402(a)(3).
[23] See id. § 402, cmt. 4.
[24] See id. § 402(c).
[25] See id. § 404(a).
[26] See id. § 404(b).
[27] See id. § 407(c).
[28] See id. § 502(a).
[29] See id. § 502(b).
[30] See id. § 502, cmt. 2.
[31] See id.