I've been reading quite a bit about the money transmitter stuff, but I'd appreciate your take on why this would be categorized.
As for the regulatory side of things, I'll pull you the exact citations when I get back from (ironically) a coffee run.
Re: fraud I've definitely been disillusioned that I can handle the tide myself, but OTOH I imagine fraud prevention is a lot like security- make sure the wall is higher than the water. I'll just have to figure out how to do that in a way that's safe, economical, and keeps the core idea behind the service working. It will almost certainly involve hiring people, or cutting off the influx of business down to- say- 5 cards a day.
http://www.ecfr.gov/cgi-bin/text-idx?c=ecfr&sid=d5570d7646c5...
[(5) Money transmitter (i) In general. (A) A person that provides money transmission services. The term “money transmission services” means the acceptance of currency, funds, or other value that substitutes for currency from one person and the transmission of currency, funds, or other value that substitutes for currency to another location or person by any means. “Any means” includes, but is not limited to, through a financial agency or institution; a Federal Reserve Bank or other facility of one or more Federal Reserve Banks, the Board of Governors of the Federal Reserve System, or both; an electronic funds transfer network; or an informal value transfer system; or
(B) Any other person engaged in the transfer of funds.]
You unambiguously accept other value which substitutes for currency from one person. You equally unambiguously transfer value to another location or person, under multiple legal theories: a) the Starbucks card is one location, the Bitcoin account is another, b) the person holding the card and the bitcoin account may be different parties, c) your business operates as a transport layer between your customers and the company which you are unloading thousands of dollars of Starbucks cards on, and as those are different persons, that means you are transmitting that value.
You might think "But wait, FinCEN narrowed the regulations a bit for 'sellers of prepaid access' specifically to avoid overburdening them." Great news for Starbucks, bad news for you. You are not a seller of prepaid access, which you can verify by reading pg 45403 on of the Federal Register.
http://www.gpo.gov/fdsys/pkg/FR-2011-07-29/pdf/2011-19116.pd...
You are, instead, using Starbucks cards and Bitcoins as a transport layer for value. The government is astoundingly non-neutral about that choice of business.
A bitcoin pool ambiguously, perhaps, transfers value too.
Why are they so non-neutral about this, and does it help us that they are?
The currency equivalent value is securing the chain of BTC transactions and discovering new blocks, making the system work at all. New blocks have a currency equivalent value and doing transactions has a currency equivalent value too.
Patio11 only posted an excerpt of the rules. Most businesses which fit this excerpt are excluded by portions of the rules not posted here but which are contained in the link. For example, those exceptions are why retailers who sell gift cards are not treated as money transmitters.
With gift cards, especially Starbucks gift cards, it's almost (if not literally) impossible to verify legitimacy. Generally, almost anyone attempting this type of fraud, even at the lower levels will:
- Mask the fact that funds are loaded with credit cards in the transaction log by purchasing gift cards with gift cards.
- Use services[2] which sell residential IP's by location (infected systems) as proxies
Unfortunately for the service your offering, Starbucks has an internal chain-disable feature which deactivates any gift cards "downline" of a fraudulently loaded card, hence it's entirely possible that after conducting a card transfer, even one fraudulent transfer could put the entire balance of your legitimate holding account at jeopardy, and the average Starbucks call center representative will be unable to help you.
Services like Cardpool (also offered in-store at Safeway locations) verify individuals identities prior to cash-in, however even with that the amount of fraud they experience is staggering. To give you an idea, the rate of successful, fraudulent transactions experienced by Cardpool in Safeway stores for 2012 was over 20%, compare to the average chargeback rate on an adult site, which is between 0.5 and 2%
I think you've made a smart move to put your project on hold until you have a better grasp of the entire situation.
Assume money laundering will happen on your platform. Your priorities are (1) being in compliance with all applicable money transfer laws, e.g. registration and (2) working, within the confines of those laws and industry best practice, to minimise its frequency.
Today, if your service were to be used to launder money I believe you would be looking at asset forfeiture and jail time. That said, I think this business can be run profitably in a compliant way - it just takes planning and some expertise.