Taft Compliance Group | FinCEN FIN-2019-G001, "Application of FinCEN's Regulations to Certain Business Models Involving Convertible Virtual Currencies" (May 9, 2019): The BSA/AML Thresholds Explained

On May 9, 2019, FinCEN issued FIN-2019-G001, “Application of FinCEN’s Regulations to Certain Business Models Involving Convertible Virtual Currencies.” The guidance explains when common crypto business models are money transmitters under the Bank Secrecy Act (BSA). The thresholds themselves live in 31 CFR, and the guidance points back to them. They are registration within 180 days, the funds travel rule at $3,000 or more, and suspicious activity reports at $2,000 or more, filed within 30 days. This piece covers federal BSA and OFAC requirements only; state money transmitter licensing is separate.

What FIN-2019-G001, “Application of FinCEN’s Regulations to Certain Business Models Involving Convertible Virtual Currencies” (May 9, 2019), is and is not

FinCEN says the guidance “does not establish any new regulatory expectations or requirements.” It consolidates existing FinCEN regulations, and rulings and guidance issued since 2011, and applies them to common business models involving convertible virtual currency (CVC). The label on a product, whether “cryptocurrency,” “digital asset” or something else, “is not dispositive of its regulatory treatment under the BSA.” What matters is the activity.

Which crypto business models are money transmitters

The guidance treats these as money transmitters:

Hosted wallet providers, which it calls “account-based money transmitters.”
Owner-operators of CVC kiosks that accept and transmit value.
Natural persons acting as peer-to-peer exchangers who engage in money transmission.
Decentralized applications (DApps) that perform money transmission. The definition then applies to the DApp, its owners or operators, or both.
Trading platforms that, when trades are matched, buy the CVC from the seller and sell it to the buyer.

A platform that only lists bids and offers, while the parties settle elsewhere, is not a money transmitter. A person using an unhosted wallet to buy goods or services on their own behalf is not a money transmitter either.

The AML program a crypto MSB needs under 31 CFR 1022.210

Every money services business (MSB) must keep an anti-money laundering program “reasonably designed to prevent the money services business from being used to facilitate money laundering and the financing of terrorist activities.” The program must be commensurate with the business’s risks, in writing, and available to Treasury on request. It must include policies, procedures and internal controls covering, where applicable, verifying customer identification, filing reports, keeping records and responding to law enforcement. It also needs a designated compliance person, training and independent review. An employee may do the review, but not the compliance person. The 2019 guidance adds that the program must be approved by the owner or, for a corporation, the board. The rule’s compliance date is the later of July 24, 2002, and the end of the 90-day period beginning the day after the business is established.

Threshold 1: MSB registration within 180 days

The regulation says the initial registration “must be filed on or before the end of the 180-day period beginning on the day following the date the business is established.” The 2019 guidance phrases it as registering “within 180 days of starting to engage in money transmission.” When that clock starts can depend on the facts of a specific business. Registration runs in two-calendar-year periods, and a renewal must be filed by the last day of the calendar year before the renewal period. Re-registration is also required after certain events, such as a transfer of more than 10 percent of the voting power or equity interests.

Threshold 2: SARs at $2,000, filed within 30 days

An MSB must report a suspicious transaction that is “conducted or attempted by, at, or through a money services business” and “involves or aggregates funds or other assets of at least $2,000.” The SAR is due “no later than 30 calendar days after the date of the initial detection by the money services business of facts that may constitute a basis for filing a SAR.” A separate $5,000 threshold applies only to issuers of money orders or traveler’s checks reviewing clearance records. The program has to show when detection happened, or nobody can check the 30-day clock later.

Threshold 3: the funds travel rule at $3,000

Under 31 CFR 1010.410(f), a transmittor’s or intermediary financial institution must include specified information “in any transmittal order for a transmittal of funds in the amount of $3,000 or more.” The 2019 guidance says “transactions involving CVC qualify as transmittals of funds, and thus may fall within the Funds Travel Rule,” and that a transmittal “of $3,000 or more (or its equivalent in CVC) may trigger certain requirements.” The money transmitter must obtain or provide the required information before or at the time of the transmittal.

Identity checks: no CIP rule for MSBs

The customer identification program (CIP) rules cover banks, broker-dealers, mutual funds, futures commission merchants and introducing brokers. A June 2026 joint proposal by FinCEN and four federal regulators says “money transmitters do not have a CIP obligation, but they are required to, for certain activity, verify an individual’s identity.” The MSB program itself must still cover verifying customer identification, to the extent applicable.

OFAC’s 2021 sanctions guidance for the virtual currency industry

OFAC published its “Sanctions Compliance Guidance for the Virtual Currency Industry” in October 2021, and its release page gives the date as 10/15/2021. The main points:

Sanctions obligations “apply equally to transactions involving virtual currencies and those involving traditional fiat currencies.”
Civil penalties are generally based on a strict liability standard, so a US person may be liable even without knowledge or reason to know of the violation.
Blocked virtual currency must be reported within 10 business days, and then annually while it stays blocked.
Rejected transaction reports are due within 10 business days of the rejection.
OFAC “strongly encourages a risk-based approach to sanctions compliance.”
Its recommended controls include geolocation tools and IP address blocking.

A crypto business’s program usually has to address both the BSA and sanctions.

What has changed since 2019

The 2019 guidance and the thresholds above still stand. Several 2026 actions sit around them.

GENIUS Act rules for stablecoin issuers. The GENIUS Act was enacted on July 18, 2025.

FinCEN and OFAC, proposed. On April 10, 2026, FinCEN and OFAC proposed AML/CFT and sanctions rules for permitted payment stablecoin issuers (PPSIs). Comments were due June 9, 2026. The proposal would make PPSIs subject to obligations “as a PPSI and not as a money services business.” It proposes that the rules take effect 12 months after the final rules are issued.
CIP for PPSIs, proposed. On June 22, 2026, FinCEN, the OCC, the Federal Reserve Board, the FDIC and the NCUA proposed a CIP rule for PPSIs, with comments due August 21, 2026.
OCC, final. The OCC’s GENIUS Act final rule was published on October 23, 2026, and is effective January 18, 2027. OCC Bulletin 2026-50 says it covers the rules the OCC must write under the Act “other than those related to the Bank Secrecy Act, anti-money laundering, and Office of Foreign Assets Control sanctions.” Those will come in a separate rulemaking. Our pieces on the OCC final rule and the Fed’s proposals cover the issuer side.

At publication, the Federal Register showed no final FinCEN rule for PPSIs.

AML/CFT program reform, proposed. Also on April 10, 2026, FinCEN proposed changes to its AML/CFT program rules across financial institution types, including Part 1022 for MSBs, with comments due June 9, 2026. Until a final rule is issued, 1022.210 is the operative MSB program text.

Two crypto proposals withdrawn. FinCEN withdrew its December 23, 2020 unhosted wallet proposal as of October 6, 2026, and said it “will not take any further action on this NPRM.” That proposal would have required reports when a counterparty uses an unhosted wallet and the transaction is greater than $10,000. The same day, FinCEN withdrew its October 23, 2023 proposal on CVC mixing. These withdrawals remove proposed requirements; they do not change the SAR, travel rule or program rules above.

The 2019 guidance created no new rules; the numbers that bind a crypto MSB are still the ones in 31 CFR.

What firms should do

Map each business line against the guidance’s models, and record why it is or is not money transmission.
Date-stamp detection in the SAR workflow, so the 30-day clock can be shown.
Check that travel rule information moves with every transmittal of $3,000 or more, including CVC.
Run the sanctions program alongside the BSA program, with geolocation controls.
If stablecoin issuance is in the plan, track the PPSI proposals; none is final.

For background, see our crypto compliance guide and AML guide for fintechs and funds. Taft’s Compliance X-Ray is one way to get an outside read of how an existing program maps to these rules; it does not change what FinCEN or OFAC require.

Sources

Follow Taft on X

Taft does not provide legal advice. Content is for informational purposes only and subject to regulatory guidance.

Talk to an Expert