Retailers Issuing Gift Cards and/or Selling Other
Companies’ Gift Card or Prepaid Cards Impacted

New anti-money laundering regulations that directly impact retail businesses that issue or sell gift cards or other prepaid cards have recently been released. These new regulations, known as the prepaid access “Final Rule,” currently effective on September 27, 2011, were issued by the Department of Treasury’s Financial Crimes Enforcement Network (FinCEN) and require the collection and verification of customer information when certain prepaid cards are sold or reloaded. Retailers issuing their own closed loop gift cards, or selling and reloading other companies’ open and/or closed loop gift cards may be significantly impacted by the new Final Rule. (Print-Friendly Version)


Many retailers now issue (either directly or through a gift card company) their own gift cards useable solely to buy goods or services at their own locations. Such programs have in the past been deemed low risk. However, the new Final Rule may impact such programs depending on how such gift cards are sold and structured.

What is Closed Loop Prepaid Access?

Under the new Final Rule, “closed loop prepaid access,” is defined as “[p]repaid access to funds or the value of funds that can be used only for goods or services in transactions involving a defined merchant or location (or set of locations).” The definition includes gift cards that provide access to a specific retailer, affiliated retailers, or retail chain, or alternatively, a designated locale, such as a college campus, or a subway system.

There are two aspects of the prepaid access rule where closed loop issuers may face some sort of affirmative responsibility: if the gift card program constitutes a “Prepaid Program” or if the retailer constitutes a “Seller.”

Does Your Closed Loop Gift Card Program Constitute a “Prepaid Program” under the Final Rule?

The Final Rule exempts closed loop gift card programs where each card is capped at a $2,000 maximum value at any point in time. For reloadable gift cards, this $2000 cap has apparently been interpreted by FinCEN to limit daily loads to no more than $2000 as well. Although this interpretation has not been formally confirmed (and is not reflected in the Final Rule itself), if it stands, this would mean, for example, that even if a reloadable gift card only holds $1000 at any time, it would violate this $2000 cap if the same card can be loaded with $1000, spent, reloaded with another $1000, spent and reloaded again. Other than the $2000 cap and the “closed loop” usage limits, nothing else is required to meet the exclusion; for example, gift cards that permit international access are still excluded. It is also important to note that the $2000 limitation is “per card”; retailers are still permitted to sell 2 or 3 cards, each with $2000 in value, at the same time, and not be deemed to be violating the exclusion. However, if a single person purchases more than $10,000 of closed loop – or any type(s) of cards– at a time, there are other consequences. See below.

If you are a retailer that DOES sell issue and sell your own closed loop gift cards in amounts greater than $2000, you will be deemed a “Provider” of prepaid programs and will be subject to significant compliance obligations. See below.


Does Your Sale of your own Closed Loop Gift Cards In Bulk Mean that You Will be Designated as a “Seller”?

This is an important question because certain obligations are imposed if you are a retailer that is deemed a “Seller” under the Final Rule. A retailer can be deemed a “Seller” if it sells any prepaid access (including phone cards and closed loop cards under $2000) in excess of $10,000 to any person (including a business or corporation) in any day, and has not implemented policies and procedures reasonably adapted to prevent such a sale. This means that so long as a retailer implements policies and procedures to reasonably prevent the sale of gift cards valued at more than $10,000 to any single person on any single day, then it will not be encompassed by this part of the term “Seller” and will be exempt from the rule.

However, if the retailer routinely permits corporate or high net worth customers to make bulk purchases of gift cards or other prepaid access, this exemption will not be available. Retailers that sell more than $10,000 of gift cards to any one person (or entity) during any day – even if those gift cards are “closed loop” gift cards with less than $2000 each – would still be deemed “Sellers.” Because of the implication of being a “Seller” (see below) some retailers are contemplating moving their “bulk sales” and “incentive” sales businesses to separate entities.


A retailer can also be a Seller if it sells prepaid access “under a Prepaid Program” and the cards can be used before verification of customer information is done. What constitutes a “Prepaid Program”?

  • “Open loop” prepaid cards that carry Visa, MasterCard, American Express, or Discover brands, and that can hold more than $1000, can be used internationally, can be used to make person-to-person transfers, OR that can be reloaded from non-depository sources. If you sell or reload other issuers’ open loop gift cards or prepaid cards that offer ANY ONE of these functions AND such cards can be used without verifying the customer’s data, then it is important that you discuss with the card supplier whether the supplier intends to modify the cards to meet these exclusions and if not, what your obligations as Seller will be.
  • “Closed loop” cards which permit a maximum value over $2000. If you sell other issuers’ closed loop gift cards in amounts of more than $2000, you may wish to reconsider such sales, given the impact on your business.

All prepaid cards that you sell should be reviewed carefully to understand the impact of the new Final Rule.


What are Providers and Sellers Required to Do?

Retailers that are Providers or Sellers as described above are required to:

  • Develop, implement and maintain an anti-money laundering (AML) compliance program.
  • Collect and retain identifying information about a person who obtains prepaid access under a Prepaid Program (including name, address, date of birth and identification number), and verify that person’s identity.
  • Collect and retain identifying information about a person who obtains any prepaid access over $10,000 in a day. (This requirement applies to Sellers only, not Providers.)
  • Register as a money services business (MSB) and maintain an agent list. (This requirement applies to Providers only, not Sellers.)
  • Monitor and report any suspicious activity or transactions over $2,000 relevant to a possible violation of law or regulation.
  • Retain access to transactional records related to prepaid access (including the type of transaction, the amount and location of transaction, the date and time of transaction and any other unique identifiers related to transactions). (This requirement applies to Providers only, not Sellers.)
  • Comply with various other FinCEN regulations that apply to MSBs, including currency transaction reporting over $10,000 and retention of other records.

It should be noted that if a retailer issues gift cards that have the ability to be loaded with more than $2000, then the gift card program will constitute a “Prepaid Program,” and as a result, the retailer will be both (i) a Provider (unless another party involved agrees to be the Provider) and (ii) a Seller, if the cards can be used before verification of the customer identification.

In addition, based on the plain letter of the Final Rule, cards that can be loaded in excess of $2000 – even if in fact they are not loaded with that much value (e.g., the card can be loaded up to $2500, but the purchaser only loads $100) – still requires the collection, verification and retention of the purchaser’s identifying information at the time of sale. If a closed loop card program, however, limits each card’s maximum value to no more than $2000, then the retailer (as the card issuer) is not deemed a Provider, and would only be a Seller if it permits the sale of any type(s) of cards totaling more than $10,000 to any person in a day and has not implemented policies and procedures to prevent such a sale.

When Does the Rule Take Effect?

The rule becomes effective September 27, 2011, although there have been some calls for an extension of the compliance date. MSB registration for Providers is not required until January 29, 2012.

Other Issues for Retailers

  • Cash-back Requirements. The exclusion for closed loop cards does not impact a retailer’s obligation to provide cash redemption per state law so long as such redemptions are in de minimis amounts.
  • Escheat. Be aware – the requirement to collect customer identifying information may change the way businesses must escheat unclaimed funds to the states.
  • Payroll Cards. Prepaid cards providing access to employment benefits, incentives, wages or salaries (so long as the funds are not commingled with non-benefit/payroll funds) are exempt, provided they do not permit (1) international transfers, (2) person-to-person transfers within the program, or (3) reloads from non-depository sources.

What Retailers Need to Do Now

Each retailer should review its own gift card program, as well as any arrangements to sell cards issued by other companies, to determine if it is covered as or exempt from being a “Provider” or “Seller” under the Final Rule. If applicable, retailers should draft and implement internal policies and procedures to prevent the sale of any gift cards valued at more than $10,000 to any single person on any day. In addition, all contracts relating to the gift card program should be reviewed to ensure the retailer’s exempt status is maintained.

Otherwise, each retailer should revise its AML compliance program accordingly, and take steps to implement the various requirements imposed by the Final Rule. Finally, each retailer should review its unclaimed property program to ensure that escheatment obligations are properly met if the retailer is required by the Final Rule to collect information from cardholders.

A copy of the final rule may be found at

If you have any questions or would like more information about FinCEN’s prepaid access Final Rule, please contact Margo Strahlberg, Kris Andreassen or Judie Rinearson.

Margo Hirsch Strahlberg
Bryan Cave LLP
161 North Clark Street, Suite 4300
Chicago, IL 60601
(312) 602-5094 phone
(312) 698-7494 fax
Kristine M. Andreassen
Bryan Cave LLP
1155 F Street NW
Washington, DC 20004
(202)508-6117 phone
(202) 220-7417 fax
Judith Rinearson
Bryan Cave LLP
1290 Avenue of the Americas
New York, NY 10404
(212) 541-1135 phone
(212) 541-1385 fax