Who is a provider of prepaid access, and what must it do?

A provider of prepaid access is the one participant in a prepaid program that agrees to serve as the principal conduit for access to information from its fellow program participants. If the arrangement is a prepaid program and the provider does business wholly or in substantial part within the United States, it is a money services business unless the exclusions in 31 CFR 1010.100(ff)(8) apply (a bank is one example). The MSB SAR rule and a five-year record access requirement then apply to it.

What the rule says:

• A provider of prepaid access is the participant within a prepaid program that agrees to serve as the principal conduit for access to information from its fellow participants. The participants must determine a single participant to serve as the provider (31 CFR 1010.100(ff)(4)(i)).
• If no participant has registered as the provider, the provider is the person with principal oversight and control over the program. That is a matter of facts and circumstances (31 CFR 1010.100(ff)(4)(ii)).
• A person doing business wholly or in substantial part within the United States in the capacity of a provider of prepaid access is a money services business, wherever located, whether or not on a regular basis or as a licensed business (31 CFR 1010.100(ff)). A bank or foreign bank is excluded from the MSB definition (31 CFR 1010.100(ff)(8)).
• The MSB SAR rule covers MSBs described in 31 CFR 1010.100(ff)(4), which includes providers of prepaid access (31 CFR 1022.320(a)(1)).
• A provider must maintain access, for five years, to transactional records generated in the ordinary course of business that would be needed to reconstruct activation, loads, reloads, purchases, withdrawals, transfers, or other prepaid-related transactions (31 CFR 1022.420).

In practice:

• Confirm first that the arrangement is a prepaid program, because certain arrangements are excluded from that definition (31 CFR 1010.100(ff)(4)(iii)).
• Check your role against the oversight-and-control activities: organizing the program; setting its terms and conditions and determining they have not been exceeded; determining the other businesses that participate, which may include the issuing bank, the payment processor, or the distributor; controlling or directing the appropriate party to initiate, freeze, or terminate prepaid access; and other activity that demonstrates oversight and control (31 CFR 1010.100(ff)(4)(ii)).
• Document which participant was chosen as provider, and whether anyone registered as the provider.
• Confirm that your records can reconstruct each transaction type listed above for five years.
• Check the SAR filing details in 31 CFR 1022.320 itself.

Sources

1. 31 CFR § 1010.100(ff)(4)(i)-(ii): https://www.law.cornell.edu/cfr/text/31/1010.100
2. 31 CFR § 1022.420: https://www.law.cornell.edu/cfr/text/31/1022.420
3. 31 CFR 1010.100 (eCFR): https://www.ecfr.gov/current/title-31/section-1010.100
4. 31 CFR 1022.420 (eCFR): https://www.ecfr.gov/current/title-31/section-1022.420

This answer is general information, not legal advice. Forteris is not a law firm.