Key takeaways
- Under 31 CFR 1010.100(ff)(4), a provider of prepaid access is the one participant in a prepaid program that agrees to act as the principal conduit for information from the other participants, and it is a money services business.
- If no participant registers as provider, FinCEN treats the participant with principal oversight and control as the provider, judged on five factors such as setting the terms and controlling freezes.
- Closed-loop access up to $2,000 per device per day, and open-loop access up to $1,000 a day with no international use, no transfers between users and no non-bank reloads, fall outside the definition of a prepaid program.
- A provider must keep a written AML programme, verify customer identity, register with FinCEN every two years listing each prepaid program, file suspicious activity reports from $2,000, and keep five years of records.
- State money transmission laws such as Maine's treat prepaid access as stored value, which requires permissible investments at least equal to outstanding obligations, so stored balances must be reconciled to the bank daily.
What are the key facts on the provider of prepaid access?
A provider of prepaid access is the single accountable party, a money services business under federal anti-money laundering rules, for a programme that lets people hold and spend balances paid in advance.
| Item | Position |
|---|---|
| Federal rule | 31 CFR 1010.100(ff)(4) (provider), (ff)(7) (seller), (ww) (prepaid access), (kkk) (closed loop) |
| Origin | FinCEN final rule of 29 July 2011, 76 FR 45403, effective 27 September 2011; registration compliance date 29 January 2012 |
| Regulator | Financial Crimes Enforcement Network (FinCEN), US Treasury |
| Core duties | AML programme (1022.210), registration (1022.380), suspicious activity reports (1022.320), records (1022.420) |
| Main exclusions | Closed loop up to $2,000 per device per day; open loop up to $1,000 with three restrictions; government, health and payroll funds |
| Banks | Cannot be a provider of prepaid access, because a bank cannot be a money services business |
| Consumer protection | CFPB Regulation E, 12 CFR 1005.18 (prepaid accounts) and 1005.20 (gift cards) |
| State law | Stored value is money transmission in states with the Money Transmission Modernization Act, for example Maine |
| Last checked | 26 October 2026, against eCFR, the Federal Register, FinCEN and the Maine Revised Statutes |
What counts as prepaid access and a prepaid program?
Prepaid access is any electronic way to reach funds paid in advance, and a prepaid program is the arrangement that provides it, unless it falls into one of four excluded categories.
31 CFR 1010.100(ww) defines prepaid access as "access to funds or the value of funds that have been paid in advance and can be retrieved or transferred at some point in the future through an electronic device or vehicle, such as a card, code, electronic serial number, mobile identification number, or personal identification number." The definition covers access, not plastic: a code or app login that unlocks a stored balance can qualify. FinCEN's 2011 final rule introduced the term, replacing the older idea of "stored value", in response to Section 503 of the Credit CARD Act of 2009.
Paragraph (ff)(4)(iii) defines a prepaid program as an arrangement under which one or more persons acting together provide prepaid access, and then lists what is not a prepaid program. Closed-loop prepaid access, under paragraph (kkk), is access usable only with a defined merchant or location, such as one retail chain, a college campus or a subway system.
| Arrangement | A prepaid program? | Condition in 1010.100(ff)(4)(iii) |
|---|---|---|
| Closed-loop access, such as a single retailer's gift card | No, if within the limit | Not more than $2,000 maximum value associated with a device or vehicle on any day |
| Government-funded access | No | Funds provided solely by a federal, state, local, territory or tribal government agency |
| Health and dependent care funds | No | Solely pre-tax flexible spending or Health Reimbursement Arrangement funds |
| Payroll, benefits or low-value open loop | No, if all three restrictions are met | Employment funds, or not more than $1,000 maximum value and $1,000 loaded, used or withdrawn per day; and no international transfers, no transfers between users, no loads from non-depository sources |
| Open-loop wallet or card that allows transfers between users | Yes | The person-to-person restriction is breached, so the exclusion is lost |
FinCEN's FAQs on the rule confirm that the $2,000 closed-loop limit applies per device or vehicle, not per person. The 2011 rule explains that the international restriction concerns devices usable directly at foreign ATMs or merchants: a card used abroad to buy from a US website does not breach it.
Who is the provider of prepaid access in a programme?
The participants choose one of themselves by agreement, and if no one registers, FinCEN treats the participant with principal oversight and control as the provider.
Under paragraph (ff)(4)(i), the provider is "the participant within a prepaid program that agrees to serve as the principal conduit for access to information from its fellow program participants", and the participants must determine a single participant to fill that role. The 2011 rule called this the agreement approach: the registered provider becomes the contact and source of information for FinCEN, law enforcement and regulators for that programme.
Where no participant has registered, paragraph (ff)(4)(ii) applies a facts-and-circumstances test of principal oversight and control. FinCEN lists five indicators, none decisive on its own: organising the programme; setting its terms and conditions and checking they are not exceeded; choosing the other participants, such as the issuing bank, processor or distributor; controlling or directing who can initiate, freeze or terminate access; and other activity showing oversight and control. The rule calls the ability to affect the movement of funds a very important factor.
Banks are a special case. In FIN-2012-R003, FinCEN ruled that a bank cannot be a money services business and therefore cannot be designated as provider of prepaid access. Where the bank has primary oversight and control, no participant must register as provider, although a retailer selling the cards may still be a seller of prepaid access. A seller, under paragraph (ff)(7), is anyone who receives funds for loading prepaid access where the product can be used before customer identity is verified, or who sells more than $10,000 of prepaid access, closed loop included, to one person in a day without policies to prevent it.
| Programme structure | Who is the provider of prepaid access | Basis |
|---|---|---|
| Non-bank programme manager designs the card, sets fees and limits, picks the bank and processor | The programme manager, which registers and lists the programme | Agreement approach, or oversight and control factors A to D |
| Participants sign an agreement naming one non-bank participant, which registers with FinCEN | The registered participant | 1010.100(ff)(4)(i); FinCEN FAQ 2A |
| Bank sets the terms, controls freezes and runs the AML programme; retailer only sells | No provider registers; the retailer may be a seller | FIN-2012-R003 |
| Platform wallet with stored balances, transfers between users and bank-account withdrawals | The platform, if it controls the terms and the funds | No exclusion applies; oversight and control |
| Single retailer gift card, maximum $500 per card | None: not a prepaid program | Closed-loop exclusion; seller rule still applies above $10,000 per person per day |
| Payroll card with no international use, no transfers between users, no non-bank reloads | None: not a prepaid program | 1010.100(ff)(4)(iii)(D) |
What must a provider of prepaid access do under FinCEN rules?
It must run a written AML programme, verify customers, register with FinCEN and list its programmes, report suspicious activity and keep five years of records.
| Obligation | Rule | What it requires |
|---|---|---|
| AML programme | 31 CFR 1022.210 | Written, risk-based programme with internal controls, a named compliance person, training and an independent review by someone other than that person |
| Customer identification | 1022.210(d)(1)(iv) | Verify identity and collect name, date of birth, address and identification number; keep access to it for five years after the last use of the device |
| Registration | 31 CFR 1022.380 | Register with FinCEN within 180 days of being established, renew every two calendar years, and identify each prepaid program for which it is provider |
| Suspicious activity reports | 31 CFR 1022.320 | Report suspicious transactions involving or aggregating at least $2,000 |
| Transaction records | 31 CFR 1022.420 | Keep access for five years to records needed to reconstruct activation, loads, reloads, purchases, withdrawals and transfers |
Section 1022.210 says the programme must be commensurate with the risks of the business's location, size and the nature and volume of its services, and that firms with automated systems should build their compliance procedures into them. Section 1022.380 also requires re-registration after certain ownership changes, and sets a civil penalty of $5,000 for each violation, with each day counted as a separate violation. Section 1022.420 is the provision that matters most to finance teams: the provider must be able to rebuild every movement on every balance, whichever participant produced the record.
How do state money transmitter laws treat prepaid access?
Separately and in addition: many states license the sale or issue of stored value as money transmission, and their definitions of stored value expressly include FinCEN's prepaid access.
FinCEN registration is not a licence. Maine's Money Transmission Modernization Act (MTMA) is a clear example. 32 MRSA section 6071 defines money transmission to include "selling or issuing stored value to a person located in this State", and defines stored value to include "prepaid access as defined by 31 Code of Federal Regulations, Section 1010.100(ww)", while excluding closed-loop stored value and stored value issued as part of a loyalty, rewards or promotional programme. Unpaid stored value is an outstanding money transmission obligation. Section 6100-T then requires a licensee to hold, at all times, permissible investments with a market value of not less than all its outstanding money transmission obligations. Our guides to the Money Transmission Modernization Act and permissible investments for money transmitters explain how that cover is calculated.
The same Maine section exempts a person appointed as an agent of a payee to collect payments for goods or services, where a written agreement exists, the payee holds the agent out as accepting payments on its behalf, and payment to the agent counts as payment to the payee. A balance a user can keep, spend with other merchants or withdraw is not simply a payment for the payee's goods or services, so it does not fit that exemption. On 30 April 2026 PYMNTS reported, citing government records, that Shopify aims to act as both a money transmitter and a provider of prepaid access, which shows a large platform taking on the two regimes together.
What does the CFPB Prepaid Accounts Rule add?
Consumer protection: Regulation E gives prepaid account holders disclosure, statement, error resolution and liability rights, and separate rules protect gift card value.
Under 12 CFR 1005.2(b)(3), a prepaid account includes payroll card and government benefit accounts, accounts marketed or labelled as prepaid and usable at multiple unaffiliated merchants or ATMs, and accounts whose primary function is to transact with multiple unaffiliated merchants, at ATMs or person to person. Gift certificates, store gift cards and general-use cards marketed and labelled as gift cards are excluded. Section 1005.18, in force since 1 April 2019, requires short and long form fee disclosures before acquisition. In place of periodic statements, an institution may give a balance by telephone, a 12-month electronic history and a 24-month written history on request. It also modifies liability limits and error resolution, which an institution need not provide for accounts, other than payroll and government benefit accounts, whose holder it has not verified, if it has disclosed the risk. Section 1005.19 requires issuers to submit prepaid account agreements to the CFPB within 30 days of offering, amending or withdrawing them.
For gift products, 12 CFR 1005.20 bans dormancy, inactivity or service fees unless there has been no activity for one year, the fee terms are clearly stated and no more than one such fee is charged in a calendar month, and prevents the underlying funds expiring sooner than five years after issue or the last load. These rules shape what a finance team may deduct from a dormant balance.
What does this mean for finance and treasury?
Every user balance is a liability the provider must be able to evidence, so the ledger of balances has to agree to the bank account holding the funds every day.
Section 1022.420 requires records that rebuild every load, spend and withdrawal. State permissible investment rules require cover at least equal to outstanding stored value at all times, which can only be shown if the liability figure is known daily. Regulation E error resolution depends on a transaction history that matches what actually moved. In practice this means a daily reconciliation of the balance ledger to the "for the benefit of" (FBO) bank account, an account opened in the platform's or bank's name but held for users. Our guide to FBO account reconciliation covers that account structure, and marketplace payout reconciliation covers platforms where seller balances are paid out in runs.
Dormant balances need their own control. State unclaimed property laws require balances with no owner activity to be reported and paid to the state after a set period. In Maine, 33 MRSA section 2066 presumes a stored-value obligation abandoned three years after the latest of 30 June of the year it was issued or last loaded, the owner's last indication of interest, and the owner's last balance check, and section 2067 sets two years for gift obligations. The ledger must therefore record the last owner activity date for every balance, not only the amount.
What does a daily stored-balance reconciliation look like?
The balance ledger and the bank statement rarely match at day end, and every difference must be explained by an item with a cause and an owner.
Worked example. Nexus Wallet, a US platform registered as provider of prepaid access, holds user funds in an FBO account. At close, its ledger shows USD 12,480,000.00 owed to users. The bank statement shows USD 12,402,500.00.
| Item | USD | Running total |
|---|---|---|
| Balances owed to users per ledger | 12,480,000.00 | 12,480,000.00 |
| Less card loads credited to users, not yet settled by the processor | (95,000.00) | 12,385,000.00 |
| Add withdrawals debited in the ledger, leaving the bank tomorrow by ACH | 20,000.00 | 12,405,000.00 |
| Add platform fees earned but not yet moved to the operating account | 2,500.00 | 12,407,500.00 |
| Less chargeback debited by the bank, not yet in the ledger | (5,000.00) | 12,402,500.00 |
| Bank statement balance | 12,402,500.00 | Difference 0.00 |
The account is fully explained, but two items need action. The USD 2,500.00 of fees belongs to the platform and should be moved out so user funds are not mixed with the firm's own money. The USD 5,000.00 chargeback is a break: until it is recovered from the user or written off, the platform has paid it from user funds and must top up from its own money. The USD 95,000.00 of unsettled loads must be tracked to settlement the next day. Separately, the same run flags 1,240 balances totalling USD 38,600.00 with no owner activity for over 30 months, for review against each state's unclaimed property period.
What should a provider of prepaid access check?
These checks follow the federal rules, Regulation E and a typical MTMA state.
- A written agreement naming the single provider of prepaid access, or a documented analysis of who has principal oversight and control.
- Each programme tested against the closed-loop and $1,000 exclusions, including whether users can transfer to each other or load from non-bank sources.
- FinCEN registration current, renewed every two calendar years, and listing every prepaid program.
- Customer identification records retained for five years after the last use of each device or account.
- Transaction records able to reconstruct every activation, load, reload, purchase, withdrawal and transfer for five years.
- State licences checked wherever stored value is sold, with permissible investments at least equal to outstanding balances.
- Ledger of user balances reconciled to the FBO bank account daily, with every difference raised and cleared.
- Fees earned moved out of the user-funds account promptly.
- Last owner activity date held for every balance, with state unclaimed property periods applied.
- Regulation E disclosures, transaction histories and error resolution tested against the ledger.
How does Safeheld help?
Safeheld matches the balance ledger, processor reports and bank statements every day, by entity and currency, and raises each difference as a break the day it appears, clearing timing items by rule and recording the cause and evidence for the rest.
The same reconciled figures feed prepared packs for US states and the NMLS call report, with audit packs and read-only access for auditors and banks. Funding needs are forecast over 24 hours, 7 days and 30 days, and top-ups are approved by up to three people. See Safeheld for money transmitters.
Frequently asked questions
What is a provider of prepaid access?
Under 31 CFR 1010.100(ff)(4), it is the participant in a prepaid program that agrees to serve as the principal conduit for access to information from the other participants. It is a money services business subject to FinCEN's AML, registration, reporting and recordkeeping rules.
How is the provider of prepaid access chosen?
The programme participants agree on a single participant, which registers with FinCEN. If no one registers, FinCEN treats the participant with principal oversight and control as provider, looking at who organises the programme, sets its terms, chooses the other participants and controls freezes.
Can a bank be a provider of prepaid access?
No. In FIN-2012-R003 FinCEN ruled that a bank cannot be a money services business, so it cannot be the provider. Where the bank has primary oversight and control, no participant has to register as provider, though a retailer may still be a seller.
Are gift cards covered by the FinCEN prepaid access rule?
A closed-loop gift card usable only with a defined merchant is not a prepaid program if no more than $2,000 can be associated with the card on any day. A seller of closed-loop access can still be covered if it sells more than $10,000 to one person in a day without policies to prevent it.
What is the $1,000 exclusion?
Open-loop access is not a prepaid program if it holds no more than $1,000 and no more than $1,000 can be loaded, used or withdrawn in a day, provided it does not allow international transfers, transfers between users or loads from non-depository sources.
Does a provider of prepaid access need a state money transmitter licence?
Often, yes. FinCEN registration is not a licence. States that have adopted the Money Transmission Modernization Act, such as Maine, treat selling or issuing stored value, including prepaid access, as money transmission requiring a licence and permissible investments.
How long must a provider of prepaid access keep records?
Five years. Customer identification information must remain accessible for five years after the last use of the device, and transaction records needed to reconstruct loads, purchases, withdrawals and transfers must be kept for five years.
Does Regulation E apply to prepaid accounts?
Yes. 12 CFR 1005.18 applies Regulation E to prepaid accounts from 1 April 2019, with pre-acquisition fee disclosures, an alternative to periodic statements, and modified liability and error resolution rules. Gift cards are covered by 12 CFR 1005.20 instead.
References
- eCFR, 31 CFR 1010.100, definitions including (ff)(4) provider of prepaid access, (ff)(7) seller of prepaid access, (ww) prepaid access and (kkk) closed loop prepaid access
- eCFR, 31 CFR 1022.210, anti-money laundering programs for money services businesses
- eCFR, 31 CFR 1022.380, registration of money services businesses
- eCFR, 31 CFR 1022.420, additional records to be maintained by providers and sellers of prepaid access
- Federal Register, FinCEN final rule, Definitions and Other Regulations Relating to Prepaid Access, 76 FR 45403 (29 July 2011)
- FinCEN, FIN-2012-R003, Application of the Prepaid Access Rule to Bank-Controlled Programs (23 May 2012, PDF)
- eCFR, 12 CFR 1005.18, Regulation E requirements for financial institutions offering prepaid accounts
- Maine Revised Statutes, 32 MRSA section 6071, Money Transmission Modernization Act definitions
About Safeheld
Safeheld is reconciliation and regulatory reporting software for regulated firms that hold client money. For platforms that hold stored balances in the US it reconciles the balance ledger to the bank accounts holding user funds every day, raises differences the day they appear, and prepares state and NMLS call report packs from the same figures. To discuss your safeguarding operations, contact us at safeheld.com/contact.
This article is general information on the US prepaid access rules and is not legal or regulatory advice.