Wallet Provider With Fiat Ramps, Cash Agents, and Cloud Key Backup
PocketKey Inc., a Delaware company, offers a mobile wallet with 400,000 US users. Users generally control private keys, but 4% enable CloudVault, which stores encrypted key shards that PocketKey can reconstruct with a user PIN. PocketKey also offers fiat on/off ramps through a partner bank and a network of 120 convenience-store agents in 14 states. Customers hand cash to agents, who credit wallets within minutes; agents also pay cash for wallet balances. PocketKey charges 1.5% and pays agents 0.5%. It is registered with FinCEN as an MSB and has a surety bond in one state. Its terms say it is 'non-custodial software' and 'not a money transmitter.' Two state regulators sent inquiries after a consumer complaint about a failed cash-out. The general counsel asks whether the current structure is defensible.
1. Analyze PocketKey's federal and state money transmission licensing obligations. Address the CloudVault feature, the agent network, and the 'non-custodial' label.
Read the worked answer
The 'non-custodial' label is not dispositive. FinCEN's money transmission definition covers accepting currency, funds, or value that substitutes for currency and transmitting it by any means. PocketKey accepts cash through agents, credits wallet balances, and enables cash-out, which is money transmission. Its FinCEN MSB registration is necessary but not sufficient. The 120 agents are acting on PocketKey's behalf and should be treated as authorized delegates or agents under a written agreement, with due diligence, training, and monitoring. PocketKey remains responsible for their conduct.
CloudVault strengthens the custody concern: for 4% of users, PocketKey can reconstruct key shards, which may give it control over customer funds and create custodial obligations. State money transmission laws vary, but accepting cash and transmitting value through agents in 14 states likely requires licenses in each state where it operates or has agents, plus surety bonds, net-worth, per-agent registration, and consumer disclosures. One bond is not enough. The structure as described is not defensible without a state-by-state licensing analysis and remediation.
2. What compliance controls should PocketKey implement for its 120 agents, and what are the principal risks of the current agent structure?
Read the worked answer
PocketKey should implement written agent agreements, initial and annual training, background checks, ownership reviews, transaction limits, cash-handling controls, receipt requirements, and a monitoring program that reviews agent-level activity for structuring, fraud, and unusual cash-out patterns. Agents should be listed on state agent rosters where required, and PocketKey should conduct on-site or virtual inspections. It should also maintain a BSA/AML program that includes agent-generated transactions, SAR filing, recordkeeping, and customer identification at the appropriate point.
The current structure creates risks of unlicensed money transmission, BSA violations, agent fraud, consumer harm, and principal liability for agent misconduct. Consumers may not understand that the convenience store is not the wallet provider. A failed cash-out complaint can become a state examination issue. PocketKey should suspend onboarding new agents in unlicensed states until the licensing review is complete and should reconcile agent cash positions daily.
3. How should PocketKey respond to the state inquiries and the consumer complaint?
Read the worked answer
PocketKey should preserve records, investigate the failed cash-out, and provide a truthful, complete response to each regulator. It should not rely on the 'non-custodial' label in correspondence. The response should identify the licenses held, the agents in the state, the cash-flow process, the complaint resolution, and any remedial steps. If unlicensed activity occurred, counsel should evaluate self-disclosure and a remediation plan, including winding down or licensing the affected activity. The consumer complaint should be resolved on the merits, with a refund or account credit if appropriate, and the root cause should be fixed.
The board should receive a written report covering licensing gaps, agent oversight, CloudVault custody, and consumer remediation. PocketKey should also update its terms and disclosures to accurately describe its role and the agent network. Cooperation and prompt remediation are more defensible than arguing that software is not money transmission.