FinCEN's Prepaid Access Rule imposes BSA registration and customer identification requirements on providers and sellers of prepaid access products. This guide explains who it covers, what it requires, and how fintechs offering prepaid products must comply.
What Is the Prepaid Access Rule? FinCEN Requirements Explained
Prepaid cards and digital wallets are among the most common fintech products — and they're specifically regulated under a dedicated FinCEN rule that many founders are not aware of until they're already in violation.
Here's what the Prepaid Access Rule requires and how it applies to your product.
What Is the Prepaid Access Rule?
The Prepaid Access Rule is a regulation issued by FinCEN in 2011 (effective September 27, 2011) under the Bank Secrecy Act. It establishes BSA obligations — including registration and customer identification requirements — for businesses involved in prepaid access products.
The rule was designed to close a gap in the BSA framework: prepaid cards and digital wallets were being used to move money anonymously, outside the KYC and monitoring controls that apply to bank accounts and traditional payment systems.
What Is "Prepaid Access"?
The rule defines prepaid access as access to funds or the value of funds that have been paid in advance and can be retrieved or transferred at some point in the future through an electronic device or vehicle (such as a card, code, or other means).
In practical terms, this covers:
- General-purpose reloadable (GPR) prepaid debit cards
- Digital wallets that store funds
- Gift cards (with some exemptions)
- Payroll cards
- Government-issued benefit cards
Who Is Covered: Providers vs. Sellers
The Prepaid Access Rule creates two categories of regulated entities:
Providers of Prepaid Access
A provider is the participant in a prepaid access arrangement that agrees to serve as the principal conduit for access to information from its fellow program participants.
In simpler terms: the entity that is primarily responsible for managing the prepaid program and the flow of information about the program. Typically, this is:
- The bank or financial institution that issues the prepaid product, OR
- The non-bank program manager that runs the prepaid product and manages customer relationships
Providers must register with FinCEN as MSBs.
Sellers of Prepaid Access
A seller is any person who receives funds or the value of funds in exchange for an initial or subsequent loading of prepaid access — typically retailers that sell prepaid cards at point of sale.
Sellers must file a SAR when they know, suspect, or have reason to suspect suspicious activity involving prepaid access, and must collect certain customer information for large transactions.
Key Requirements for Providers
1. FinCEN Registration
Providers must register with FinCEN as MSBs. This is the standard BSA MSB registration process — free, completed through BSA E-Filing, and renewed every two years.
2. Customer Identification Program (CIP)
Providers must implement a CIP for open-loop prepaid programs — collecting name, address, date of birth, and ID number for customers accessing prepaid products above certain thresholds.
Specifically, CIP requirements apply to open-loop prepaid access programs (cards that can be used broadly, like Visa/Mastercard prepaid cards) that:
- Exceed $10,000 in funds loaded per customer per day, OR
- Allow international transactions, OR
- Allow the transfer of value between customers
3. Transaction Monitoring and SAR Filing
Providers must monitor for and report suspicious activity in the same manner as other MSBs.
4. Recordkeeping
Providers must maintain records of customer identification information and transaction records.
Exemptions: What Is NOT Covered
Several categories are exempt from the Prepaid Access Rule:
- Closed-loop prepaid products — gift cards that can only be used at specific retailers (think a Starbucks card) are not subject to the full rule
- Certain government benefit programs — government-issued benefits cards have specific exemptions
- Low-value open-loop programs — some open-loop programs below specific thresholds may qualify for reduced obligations
The exemption analysis depends on your specific product design and can be complex. Many fintechs believe their prepaid product is exempt when it isn't.
How the Prepaid Access Rule Relates to Your Sponsor Bank
If your fintech offers a prepaid product through a sponsor bank, the bank is typically the registered provider. Your compliance obligations under the prepaid rule flow through your sponsor bank agreement.
However, the bank will require you — as the program manager — to operate the CIP and monitoring functions that the bank is ultimately responsible for. Your program agreement will specify which compliance obligations you own.
Frequently Asked Questions
Is my digital wallet covered by the Prepaid Access Rule?
If your digital wallet stores funds that users can transfer or spend with third parties — making it effectively an open-loop stored value product — it likely falls within the rule's scope. If it can only be used within your own platform for your own goods or services, it may qualify for an exemption.
Do I need to register with FinCEN for my prepaid product?
If you're the provider of an open-loop prepaid access program — particularly if it exceeds the thresholds — yes. Consult a compliance attorney to confirm your specific registration obligations.
What happens if I'm subject to the rule and didn't know?
Operating as an unregistered MSB when registration is required is a BSA violation. Register with FinCEN promptly, implement any missing compliance controls, and document your remediation steps.
Does the prepaid access rule apply to cryptocurrency-based prepaid products?
It may. If your crypto product functions like prepaid access (users load value and spend it), FATF and FinCEN guidance suggests it could be covered. Consult legal counsel for guidance on your specific product.
This article is for educational purposes only and does not constitute legal or compliance advice. Regulations vary by jurisdiction and change frequently. Consult a qualified compliance professional or legal counsel for guidance specific to your business.
