Start With Two Separate Regulatory Questions
At the federal level, the question is whether the business qualifies as a money services business, or MSB, under the Bank Secrecy Act and FinCEN’s regulations.
Under 31 C.F.R. § 1010.100(ff)(5), money transmission generally involves accepting currency, funds, or other value substituting for currency from one person and transmitting it to another person or location. The regulation also covers other persons engaged in transferring funds and identifies specific limitations and exceptions. Classification turns on the facts and circumstances.
An MSB determination can bring federal registration and other compliance obligations. For example, 31 C.F.R. § 1022.210 requires an effective written anti-money laundering program appropriate to the business’s risks.
State authorization is a separate question. A company must examine applicable money transmission laws and any distinct virtual-currency licensing regime. Federal registration does not resolve those requirements; New York expressly confirms that registering with FinCEN does not determine whether a BitLicense is required. Department of Financial Services
Our overview of money transmitter licensing for U.S. crypto companies provides broader background. For a noncustodial product, the first task is identifying exactly what the company does.
Software Development Has a Recognized Distinction
FinCEN addressed software development directly in Administrative Ruling FIN-2014-R002. Producing and distributing software does not, by itself, constitute accepting and transmitting value—even where the software facilitates virtual-currency sales.
That distinction matters for developers whose products help customers manage their own assets. Consider a wallet application that generates keys locally, lets the user authorize transfers, and cannot independently move customer funds. Its legal analysis should focus on the software functions actually provided.
Now change the facts. Suppose the company receives assets into an address it controls, credits a customer balance, and later sends assets to a destination selected by the customer. Calling the application a noncustodial wallet would not eliminate the need to analyze that acceptance-and-transfer activity.
A useful legal review therefore separates the software from each additional service offered through it.
Examine Authority Over Assets, Including Exceptional Access
A statement that the company “does not hold private keys” is a starting point. Counsel should also understand recovery procedures, smart-contract permissions, and arrangements with service providers.
Useful questions include:
- Can the company, alone or through parties it directs, authorize a transfer?
- Can an administrator replace a signer or change withdrawal permissions?
- Can recovery procedures give the company access that it lacks during ordinary use?
- Can customers withdraw without the company’s cooperation?
- Can a contract upgrade redirect assets or change who controls them?
- Does the customer hold assets directly, or have a balance recorded by a provider?
These questions identify facts for legal analysis. An administrative feature does not automatically establish money transmission, and a single technical safeguard does not necessarily resolve the entire business model.
FinCEN’s 2019 convertible virtual currency guidance illustrates the nuance. Section 4.2.2 describes a limited multisignature validation service that does not accept and transmit value and therefore is not a money transmitter. Combining that service with hosted-wallet functions changes the analysis. The guidance examines ownership, interaction with the payment system, and independent control rather than relying on the provider’s label.
Review Swaps, Payments, and DeFi Functions Individually
A wallet can provide several legally distinct services through one interface. Its basic storage functionality may present different questions from its exchange, payment, or settlement features.
For an integrated swap, map who receives each asset, who supplies liquidity, which entity contracts with the customer, and who performs settlement. For a merchant payment product, examine whether the company merely supplies checkout software or receives and forwards customer payments.
A payment processor exception should not be assumed. The federal regulation ties that exception to specified conditions, including processing through a clearance and settlement system under an agreement with the creditor or seller.
DeFi terminology requires similar care. In Sections 4.4 and 5.2.2 of its 2019 guidance, FinCEN distinguishes creating an application from using or deploying it to conduct money transmission. The guidance describes potential obligations for owners and operators where a decentralized application performs that activity. These are agency interpretations whose application requires examining the particular arrangement.
The practical question is which functions the business performs and what authority accompanies them. A fee, website, or governance role should be evaluated in that context rather than treated as a complete answer.
State Law Can Draw the Boundary Differently
New York’s BitLicense guidance recognizes that developing and disseminating software as a purely technical service does not, by itself, require a BitLicense. It specifically gives self-custody wallet software as an example. But the state also regulates categories of virtual-currency activity beyond custody, including customer exchange services and certain transmission activities.
California’s Digital Financial Assets Law uses its own definitions. Under Financial Code § 3102(c)(1), control over a transaction includes the power to execute it unilaterally or prevent it indefinitely. Its definitions of exchange, storage, and transfer incorporate control in different ways. Consequently, an inability to move assets alone does not end the California inquiry if the business can indefinitely block a transaction.
California also provides specific exclusions in Financial Code § 3103(b)(7), including certain activities limited to connectivity software, computing power, data storage, or security services. The conditions matter: providing qualifying infrastructure alongside a separate regulated service requires examining both activities.
Document the Analysis Before Launch—and Revisit Product Changes
A productive review begins with materials the engineering and business teams can verify together: transaction diagrams, signing permissions, recovery procedures, administrative controls, customer agreements, vendor contracts, and the jurisdictions the product will serve.
Include unsuccessful transactions and emergency procedures. A diagram showing only normal operation may omit the circumstances in which the company gains authority over assets.
The resulting analysis should identify the factual assumptions supporting each conclusion and the changes that require reassessment. Adding fiat settlement, changing a recovery mechanism, or introducing a new exchange service should trigger that review.
Regulatory developments also need careful reading. For example, FinCEN withdrew its proposed unhosted-wallet transaction reporting and verification rule on October 6, 2026. That withdrawal concerned a specific proposal; it did not create a general licensing exemption for businesses describing themselves as noncustodial.
Kelman PLLC’s MSB, BSA, and AML practice assists businesses with classification, licensing, and compliance questions. If you are launching or expanding a wallet, DeFi interface, or payment product, contact the firm to discuss its transaction flows and operational controls.
Attorney Advertising. This article provides general information, not legal advice. Requirements depend on the business model, applicable law, and facts. Contacting the firm does not establish an attorney-client relationship.
