Decentralized exchanges (“DEXs”) are digital asset exchanges in which users custody their own assets without ever having to trust a centralized counterparty or operator to custody their digital assets.¹ And while DEXs are great for users, DEX Operators should carefully consider how they structure their exchange and consider the regulatory risks of their operation.
So, let’s take a look at the facts and ask, specifically, will DEXs be subject to KYC risk and financial surveillance? How will the Department of the Treasury and the Financial Crimes Enforcement Network (“FinCEN”) view DEXs?
What we know:
The Bank Secrecy Act and Money Service Businesses
The Bank Secrecy Act and the regulations enacted thereunder (the “BSA”) establish extensive requirements for certain financial institutions. These regulations touch on everything from record-keeping to proactive reporting of suspected money laundering.
Here is what you need to know:
- The BSA defines the term “financial institution” broadly² and includes money services businesses (“MSBs”) such as “money transmitters”.
- A “money transmitter” is a person or entity that provides “money transmission services” or any other person engaged in the transfer of funds, subject to certain exceptions.
- The term “money transmission services” is defined as “the acceptance of . . . value that substitutes for currency from one person and the transmission of . . . value that substitutes for currency to another location or person by any means.”
- Whether a person is a money transmitter under the BSA is a matter of facts and circumstances, which doesn’t sound like much but means there are no bright line rules that we can look to for edge cases.
Now, in March 2013, FinCEN, the federal regulatory agency responsible for enforcing compliance with the BSA, issued interpretive guidance (the “Guidance”) to clarify how the BSA applied to persons creating, obtaining, distributing, exchanging, accepting, or transmitting virtual currencies. Such persons are classified into “users,” “administrators,” or “exchangers”.
According to this Guidance:
- A “user” is a person that obtains convertible virtual currency to purchase goods or services on their own behalf.
- An “exchanger” is a person engaged as a business in the exchange of convertible virtual currency for real currency, funds, or other convertible virtual currency.
- And “administrator” is a person engaged as a business in issuing (putting into circulation) a convertible virtual currency, who also has the authority to redeem (to withdraw from circulation) said convertible virtual currency.
- A “virtual” currency is a medium of exchange that operates like a currency in some environments, but does not have all the attributes of real currency.
- A “convertible virtual currency” (“CVC”) is defined as virtual currency that either has an equivalent value in real currency or acts as a substitute for real currency.³
So, what do these legal abstractions mean?
The Guidance states that the primary activity that makes a person an exchanger or administrator and therefore a money transmitter subject to MSB compliance is that if they accept, transmit, buy or sell CVCs for any reason.
There’s a lot to unpack in this sentence, but let me give the quick tldr:
With few exceptions⁴, it starts to look like almost all for-profit exchanges–decentralized or not–will fall under the definition of a money transmitter.
Do assets traded on decentralized exchanges constitute CVCs?
Yes, it is likely that all assets traded on DEXs will be classified as CVCs.
DEXs provide for the transfer of digital assets (mostly Ethereum-based assets) between traders that usually have a visible market price of bids and offers. Most digital assets have a market value and can be used as a substitute for real currency as a general medium of exchange (e.g. buying REP with ETH). Therefore, almost by definition the mere offering of token-token trading pairs by DEXs is facilitating the transfer of a CVC. (Thereby increasing their chance of being classified as a MSB.) Note however, that the mere transfer of a CVC between two parties is not dispositive of falling within the ambit of a regulated activity under the BSA. We must ask more questions.
Is it likely that DEXs Operators could be classified as an “administrator” of a CVC?
“Administrators” are those persons who are engaged 1) “in the business of” 2) issuing a CVC, and 3) while having the authority to redeem such virtual currency.
Since most DEXs do not issue digital assets (CVCs) and do not have the authority to redeem those assets, it is not likely that DEX Operators will be classified as administrators of a CVC under the Guidance.
Although a majority of DEXs do not issue any CVC in connection with their operation, there are a few that do.
For example, IDEX⁵ represents a unique class of DEXs that actually issue their own token. In certain instances, IDEX’s functional smart contract “issues” native ERC 20 tokens to Ethereum accounts that provide liquidity to its exchange. IDEX is not involved with the issuance of its token outside of the development of the smart contract. Rather, IDEX’s smart contract itself issues the tokens in exchange for a user engaging in some pre-defined behavior (here, the exchanging of non-native IDEX Ethereum-based tokens on the IDEX book).
Now obviously, IDEX is in the business of running an exchange. In this pursuit, IDEX created a smart contract specifically designed to issue a CVC and to benefit itself commercially. IDEX however, exerts no control over the token and, once issued, no one, let alone IDEX may remove these market-making tokens from circulation. Therefore, even those DEX that issue CVCs are unlikely to be classified as “administrators” because they cannot remove issued CVCs from circulation.
Is it likely that DEXs Operators could be classified as an “exchanger” of a CVC?
Exchangers of CVCs subject to MSB regulation and money transmission registration are those “person[s] engaged as a business in the exchange of virtual currency for real currency, funds, or other virtual currency.”⁶ Further, any “exchanger that (1) accepts and transmits a convertible virtual currency or (2) buys or sells convertible virtual currency for any reason is a money transmitter under FinCEN’s regulations.”⁷
In the absence of a bright-line rule, whether a DEX must register as “money transmitter” depends on the particular facts and circumstances. Specifically courts and FinCEN are likely to consider: (i) if DEX operators are collecting fees and/or running a business of “accepting” and “transmitting” CVC; (ii) whether DEX operators are custodying funds on behalf of users and customers; and (iii) how a DEX Operator describes its service.⁸
Generally, most DEX Operators utilizing a centralized order book within the architecture of their DEX are likely to be in the “business of exchanging virtual currency for other virtual currency” because they host a centralized service that then collects “maker” and “taker” fees levied to users of their platform. Because most DEX Operators are engaged in the profit-making activity of hosting decentralized exchange services wherein they collect fees for orders (above and beyond any gas costs), the risk of becoming a money transmitter is moderate.
On the other hand, when conversions of CVCs to CVCs are conducted on a DEX managed by open-source software built on the Ethereum Blockchain wherein the DEX Operator is not engaged in a profit seeking enterprise, and the DEX Operator does not offer or facilitate the direct or intermediated exchange of CVCs for real currency, funds or other CVCs, the risk for acting as a “exchanger” is much lower.
Finally, and as the folks at Ripple are keenly aware, those businesses who hold themselves out as virtual currency “exchanges” publicly or in court filings or take custody of their customers funds, however tangentially are more likely to be classified as “exchangers” of virtual currency and therefore required to register as a money transmitter.⁹
Decentralized exchanges are not above the law. Anyone who engages in money-transmission activities are required to follow all federal and state laws and regulations or risk facing severe civil and criminal penalties.
DEX Operators should work closely with their counsel to determine if activities rise to the level of money-transmission and take all appropriate action.
 For good reason. See https://www.reuters.com/investigates/special-report/bitcoin-exchanges-risks/; and “On [November 21, 2017], an alternative virtual currency that is owned and operated by the same people as Bitfinex, known as Tether, announced that it had been hacked and lost around $30 million worth of digital tokens.” (emphasis added). Warning Signs About Another Giant Bitcoin Exchange.
 which encompass, subject to exceptions, “[a] person wherever located doing business, whether or not on a regular basis or as an organized or licensed business concern, wholly or in substantial part within the United States,” in one or more specified capacities, including in the capacity of a money transmitter.
 Alternatively, FinCEN has defined a CVC as a medium of exchange that operates like a currency in some environments but does not have all the attributes of real currency, and either has an equivalent value in real currency or acts as a substitute for real currency.
 “(A) Provides the delivery, communication, or network access services used by a money transmitter to support money transmission services; (B) Acts as a payment processor to facilitate the purchase of, or payment of a bill for, a good or service through a clearance and settlement system by agreement with the creditor or seller; (C) Operates a clearance and settlement system or otherwise acts as an intermediary solely between BSA regulated institutions. This includes but is not limited to the Fedwire system, electronic funds transfer networks, certain registered clearing agencies regulated by the Securities and Exchange Commission (“SEC”), and derivatives clearing organizations, or other clearinghouse arrangements established by a financial agency or institution; (D) Physically transports currency, other monetary instruments, other commercial paper, or other value that substitutes for currency as a person primarily engaged in such business, such as an armored car, from one person to the same person at another location or to an account belonging to the same person at a financial institution, provided that the person engaged in physical transportation has no more than a custodial interest in the currency, other monetary instruments, other commercial paper, or other value at any point during the transportation; (E) Provides prepaid access; or (F) Accepts and transmits funds only integral to the sale of goods or the provision of services, other than money transmission services, by the person who is accepting and transmitting the funds.” 31 CFR 1010.100 (ff)(5)(B)(ii)(A)-(F).
 Id. In 2013, when FinCEN released its MSB guidance on virtual currency, the concept of a DEX was more science-fiction than science. As such, there is a dearth of guidance as to whether the broadcasting of orders/bids on a centralized server hosted by a DEX Operator that extracts fees rises to the BSA level of “accepting” and “transmitting” virtual currency; but see e.g. (BTC-E Enforcement, Ripple Enforcement, and generally Local Bitcoin Enforcement)