Taxes & Rules
FinCEN Rules for U.S. Businesses That Accept Bitcoin
A plain-language guide to FinCEN's bitcoin business rules: MSB registration, AML programs, reporting thresholds, and what most merchants can skip.
If your business accepts bitcoin as payment for goods or services, you almost certainly don't need to register with FinCEN. But the rules have real teeth, and the line between "ordinary merchant" and "money services business" is not always obvious. Misreading it has cost companies significant fines and, in a handful of federal cases, criminal exposure.
This guide explains the current framework in plain language. It isn't legal or compliance advice. Regulations change, and you should confirm current requirements with a licensed attorney or compliance consultant before acting on anything here.
What FinCEN actually regulates
The Financial Crimes Enforcement Network is a bureau of the U.S. Treasury. Its authority over crypto flows from the Bank Secrecy Act, which requires certain financial businesses to register, maintain anti-money-laundering programs, and file specific reports.
FinCEN's 2013 guidance (FIN-2013-G001) was the agency's first formal word on virtual currency. It drew a line between two types of actors:
- Users: people or businesses that obtain and spend bitcoin for their own purposes (buying inventory, paying vendors, accepting payment for goods). Users are generally not subject to MSB rules.
- Exchangers and administrators: businesses that convert bitcoin to fiat or other value on behalf of others, or that issue and redeem a centralized virtual currency. These are classified as money services businesses.
The core test is whether you're moving value for other people as a core function of your business. A bakery that takes bitcoin for croissants is a user. A platform that lets customers swap bitcoin for dollars is an exchanger.
When a business becomes a money services business
An MSB under FinCEN's rules includes several categories: money transmitters, currency dealers/exchangers, and issuers or redeemers of stored value, among others. For crypto purposes, the relevant bucket is usually "money transmitter."
FinCEN's 2019 guidance (FIN-2019-G001) went further and addressed a wide range of business models. Some cases that have tripped up companies:
- Bitcoin ATM operators. Machines that exchange cash for bitcoin (or the reverse) are almost universally treated as MSBs. Operators must register and comply with full AML requirements.
- Payment processors that hold and convert. If a processor receives bitcoin from a customer and converts it to dollars before remitting to a merchant, that conversion function can qualify the processor as an exchanger.
- Peer-to-peer exchangers. Individuals or businesses that regularly buy and sell bitcoin as a business (not as occasional personal transactions) have been charged as unregistered MSBs.
- DeFi and non-custodial protocols. FinCEN's position on decentralized software remains unsettled, but the 2019 guidance made clear that control over funds, not just software design, is the relevant factor.
If any of this sounds like your business model, get a compliance attorney involved before you launch, not after.
What MSB registration actually requires
Businesses that do qualify as MSBs must register with FinCEN using Form 107, which is filed electronically through BSA E-Filing. Registration must happen within 180 days of establishing the business. After that, renewal is required every two years.
Registration is free but is only the beginning. Registered MSBs must also:
Build a written AML program
The Bank Secrecy Act requires an AML compliance program with four components: written internal policies and procedures, designation of a compliance officer, ongoing employee training, and independent testing of the program (usually an audit). FinCEN has repeatedly penalized companies that registered but ran no real program.
File Currency Transaction Reports
CTRs are required for transactions involving more than $10,000 in cash in a single day. For bitcoin businesses, the trigger applies when the underlying transaction involves currency (for example, a customer depositing $12,000 in cash at a bitcoin ATM). The $10,000 threshold is aggregate, not per-transaction: multiple smaller cash transactions with the same customer on the same day can add up.
File Suspicious Activity Reports
SARs are required when a business knows, suspects, or has reason to suspect that a transaction involves funds from illegal activity, is designed to evade reporting requirements, or lacks a lawful purpose, and the amount is $2,000 or more. SARs must be filed within 30 days of detection (60 days if no suspect is identified). They are confidential: you cannot tell the customer a SAR was filed.
Keep records
MSBs must retain records of transactions over $3,000 for five years. This includes sender/receiver information, transaction dates, and amounts. See our guide on recordkeeping for bitcoin payments at tax time for a broader look at what the IRS also wants documented.
What ordinary merchants don't have to do
If your business simply accepts bitcoin as payment for products or services, and you're not converting it on behalf of customers or transmitting value to third parties, the MSB rules don't apply to you. You are a user in FinCEN's framework.
That said, you still have obligations under other laws:
- IRS reporting. The IRS treats bitcoin as property. When you accept it, you recognize ordinary income equal to the fair market value in USD at the time of receipt. When you later spend or sell it, you may recognize a capital gain or loss. The tax side is handled separately from FinCEN; read bitcoin taxes for U.S. businesses explained for details.
- State money transmission licenses. Some states have their own definitions of money transmission that are broader than FinCEN's federal rules. A few states have specifically addressed crypto. New York's BitLicense is the most well-known. If you operate nationally, state-level analysis is worth doing.
- OFAC sanctions. The Office of Foreign Assets Control maintains lists of sanctioned individuals and entities. Businesses accepting crypto should screen counterparties against OFAC lists. This applies to everyone, not just MSBs.
Enforcement: what the penalties look like
FinCEN's enforcement record on crypto MSBs is worth knowing. A few examples from public enforcement actions:
- In 2015, Ripple Labs paid $700,000 to settle charges that it operated as an unregistered MSB and failed to implement an AML program.
- In 2017, BTC-e, a cryptocurrency exchange, was assessed a $110 million penalty for willful violations of AML requirements. Its operator was also criminally charged.
- In 2019, FinCEN assessed a $35 million penalty against a peer-to-peer exchange for operating without registration and failing to collect identifying information on customers.
The pattern in these cases is consistent: unregistered operation plus no AML program plus facilitation of suspicious transactions. Running a real compliance program doesn't make enforcement impossible, but it substantially changes the exposure.
Quick-reference table: MSB rules by business type
| Business type | MSB under FinCEN? | AML program required? | SAR/CTR filing? |
|---|---|---|---|
| Retailer accepting BTC for goods | No | No | No |
| Freelancer paid in BTC | No | No | No |
| Bitcoin ATM operator | Yes | Yes | Yes |
| Crypto-to-fiat payment processor | Likely yes | Yes | Yes |
| Exchange (buys/sells BTC for users) | Yes | Yes | Yes |
| Non-custodial wallet provider | Generally no | Generally no | Generally no |
| P2P trader (regular business activity) | Yes | Yes | Yes |
This table is a general summary. Edge cases are common in this space, and FinCEN has issued numerous guidance letters addressing specific fact patterns. When in doubt, the analysis turns on whether you're moving value for others as a business function.
FAQ
Does accepting bitcoin make my business a money services business?
No. Accepting bitcoin as payment for goods or services makes you a "user" under FinCEN's framework, not an exchanger or money transmitter. MSB status depends on whether you're converting or transmitting value on behalf of customers, not on whether you accept crypto as payment.
Do I need to report bitcoin transactions to FinCEN?
Only if you're a registered MSB. Merchants who are not MSBs have no FinCEN reporting obligations. You do have IRS reporting obligations, though: your bitcoin income must be reported on your tax return. If you're unsure whether your business triggers MSB status, that's a question for a compliance attorney.
What are crypto AML rules, and do they apply to me?
AML (anti-money laundering) rules under the Bank Secrecy Act apply to MSBs, not to ordinary merchants. If you operate a crypto exchange, ATM, or transmitter service, you must have a written AML program with policies, a compliance officer, staff training, and independent testing. Most small businesses accepting crypto payments are outside this requirement entirely.
What's the difference between FinCEN registration and a state money transmission license?
Federal FinCEN registration covers your obligations under the Bank Secrecy Act. State money transmission licenses are separate and governed by each state's own laws. Some states exempt certain crypto activities; others, like New York, have crypto-specific licensing regimes. A business operating nationally may need both federal registration and licenses in multiple states.
How do I know if I need to file a Suspicious Activity Report?
If your business is an MSB and you encounter a transaction of $2,000 or more that you know or suspect involves illegal funds, structuring to avoid reporting, or no apparent lawful purpose, you're required to file a SAR within 30 days. The obligation is on the MSB, not on ordinary merchants. If you're a non-MSB merchant and you suspect fraud, you can voluntarily contact law enforcement, but there's no federal SAR requirement.
Accept Bitcoin USA is an independent educational resource. Nothing here is financial, tax, or legal advice. Regulations in this space change, and the rules above may be updated by FinCEN, the IRS, or state regulators at any time. Confirm current requirements with a licensed attorney or compliance professional before making compliance decisions. Also check out our guide on sales tax and bitcoin transactions for the state tax angle.