VANNOY:
NACHA, bank Secrecy Act and Money Transmitter Laws. What every business needs to know about payroll. Hi, I’m Mike Vannoy with Asure, and this is an interesting topic today. So we talk every week on the show about compliance. Usually that’s about tax compliance for payroll or HR laws. This was one where it doesn’t directly impact employers, but it indirectly impacts employers and the fact that they can’t be doing business with a payroll company who isn’t compliant in these three areas that we’re gonna talk about today. But if you’re a CPA firm, you’re an accounting firm, you’re a a, a regional payroll provider, you are anyone who is in the process of, of processing payroll, moving money on behalf of your client, then you really have to watch this show today cuz this directly impacts you. It it, and there’s a lot of change going on.
So, gotta I couldn’t imagine a better guest for today’s show. Chris Bell Chris is a regulatory compliance attorney with, as Asure, Chris has experience in money transmission a ml, and B S A. We’ll get into those acronyms later. And bank regulatory compliance. Chris was previously the senior hotline advisor and Associate General Counsel with the Texas Bankers Association, where he consulted with community bankers throughout the US to help them make sense of the labyrinth of banking regulations. Chris was also the Assistant General Counsel to the Texas Department of Banking. He earned his doctorate of law from St. Mary’s University School of Law. Chris, welcome to the show.
Speaker 1:
Thanks, Mike.
VANNOY:
Thanks for having me. Okay, so there’s so much changing here. Some of, some of these things we’re gonna talk about anybody who had to be involved in processing payroll and moving money has had to be in compliance with for a while now. But some of these things are new. I think if we just step back before jumping into these three buckets, I think the big message that everybody should understand is the states are increasingly regulating payroll providers or anybody who money in association with payroll as though they’re a bank, right? Banking has been regulated forever. Payroll co companies have not. But if you move money in association with payroll, you are increasingly going to be regulated as though you are a bank. And this is putting in many cases a crippling administrative layer on these companies. Before we get into the specifics, could you maybe just kind of put some color on, on this broader continuum of regulatory change you’re seeing?
BELL:
Absolutely. And so for payroll companies up until, you know, I think it was 2019 as an industry, we weren’t regulated, or at least we didn’t know, we were attempting to be regulated by various states. In 2019, I believe it was Texas that made the first enforcement action against a payroll company and said, Hey, payroll company, you actually fit the definition of a money transmitter under the Texas Money Transmission Act. And what that means is that you need a license, a money transmitter license in Texas in order to provide payroll services. A handful of other states since then have now taken that position states like Connecticut, states like Idaho and New Hampshire, where they interpreted their existing laws to say, a, a company providing payroll services. If you’re taking money from an employer, impounding it into your own accounts, and then paying it out to employees or taxing authorities, you are a money transmitter and you have to be licensed by our state financial regulator as a non depository financial institution.
So fast forward a couple of years, and a group called the CSBs that stands for the Conference of State Bank Supervisors. They’re the group that put forward the model behind all of the existing money transmission acts across the country. In 2020. They were working on developing a new model law called the model Money Transmission Modernization Act. The mtma, I’ll be using that acronym you kind of threw out here today. And in the mtma, they actually took the explicit position that money transmission includes providing payroll processing services. And that term is further defined in the law to essentially like I said, if you take money from an employee, impound it into your accounts, and then pay it out to employees or taxing authorities, you’re providing payrolls processing services and need a license with any state that has adopted this model act and kept provision inside.
So that’s where we are today. We have this model act that’s sweeping the nation. At least 10 to 15 states have already enacted that mtma in whole or in part that’s, that’s a kind of a important thing to say because I think it’s Indiana adopted the mtma, but they didn’t adopt the payroll provider provision. So what’s really important for, you know, payroll companies to know is that where it used to be a one-off or a a a fairly unique thing for a state to say, Hey, under our existing definition of money transmission, your payroll company are, you know, a money transmitter. You need a license that you know, formerly fringe opinion is now becoming the majority opinion across the country. Okay. So it it, what it has caused us to do as an industry is to actually step back and look at the laws across all 50 states and the territories, anywhere we move money and say, Hey, do we fit the definition of money transmission in this state? If so, is there a clear exception in the law? And if there’s not, then, you know, we need to either get a license or get something, you know, on paper from the state regulator saying that we don’t need a license, whether there’s ambiguity.
VANNOY:
Hey, Chris, I’m, I’m gonna, I’m gonna pause this right there cuz I, I wanna spend most of our time on the mtl, the money transmitter laws. Cause this is the thing I think that is gonna throw, and this isn’t just, I wanna be clear, this isn’t just quote unquote payroll companies. If you’re an accounting firm providing payroll services for your client, you might be using say, Intuit’s software. But you are, you are impounding funds, you’re holding funds, you’re transmitting funds whether in the form of ACH transactions as as checks or paying state and federal agencies tax receipts or any other third party. This, this applies to you. So this is where I wanna spend most of our time. I wanna build up to it, however, for those, so I think people in the payroll provider business the traditional payroll companies, they know this, but I, I I think it’s really important that the, the, the average entrepreneur understands a couple other concepts around NACHA and the Bank Secrecy Act. Sure. Because it’s really critical that they do business with some, with someone who is in fact compliant. So let’s start with NACHA can let, let’s maybe start with maybe just a definition. What does the acronym stand for and what is it and, and what’s, what’s changing that everyone needs to understand?
BELL:
Sure. So NACHA is an entity and it helps to govern the ACH network. And ACH is Automated Clearinghouse. So the N stands for National and the A stands for association. So it’d be the, you know, national Automated Clearinghouse Association. And the ACH network has been around since the 1970s. And what the ACH network is used for is it’s a batch filing system where files are uploaded and moved to different financial institutions so that, you know, money can be elect electronically transmitted. And NACHA is the group that puts out the operating rules and operating guidelines that then governs this, you know, this payment clearing house. And it’s what allows someone to you know, transfer money without actually having to write, you know write a check or, you know, take physical currency, you know, to the intended destination.
The you know, why that matters to ACH network participants is that you know, we have to follow the operating rules and guidelines while, you know, every year the operating rules say that we have to have risk assessments and audits to show that we’re complying with the rules or what we need to do to remediate any issues so that we can become compliant. Now NACHA is not an enforcement agency. The NACHA operating rules are actually enforced by the banks because the banks are the ones who are on the hook at the end of the day for actually executing on those files. So the banks are the ones saying, let me see your risk assessment. Let me see your audit to make sure that you’re compliant with the rules. Now, of course, you know, if a bank has a problem with that, then that could harm the banking relationship for the, you know, person who’s interacting with the bank. The, you know, Chris,
VANNOY:
Chris, I just wanna, I’m, I’m gonna, I’m gonna kinda restate and make sure we’re all on the same page. So, if you violate Fair Labor Standards Act and you’re not paying overtime, it’s the Department of Labor who can come get you state or federal. If you’re discriminating employees or candidates based on race, gender, something else, it’s the E E O C that can, can come get you. There’s not a government agency that is holding folks accountable for AACH compliance. It is this organization, nacha, which represents the banks. And so, because our banking system is built on trust, and, you know, you send money from bank A to over to Bank B, they must clear the money to make sure it’s all good. They have to rely on each other. They can’t have US Apparel company, a cpa, an accounting firm an employer mucking up the system. So therefore, you must be compliant, otherwise they won’t work with you. And it’s the banks that kick you off the system, not the Department of Labor, not E E O C, not the fbi. Do I have all this, right?
BELL:
Yeah, that’s right, Mike. You know, the, the banking system is built on trust, and trust in this context is built on uniformity. So, you know, if have you know, banks that are following different rules or people interacting with banks following different rules, then that’s going to slow things down. And in the world that we, that we live in, the you know, they are optimizing for speed and speed of money transmission. So we don’t want outliers, as you said, mucking up the system because we want people to be paid timely. Now, the reason that that’s important for employers, and it’s Im important for processors, is if the per, if the payroll company or any kind of money mover that’s, that’s interacting with the bank is not complying and they get kicked off, well, they can’t make payments and, you know, they can’t serve their clients because if people don’t get paid, that’s a big problem.
VANNOY:
That’s right. That’s right.
BELL:
Okay, now, and so,
VANNOY:
So what are, what are the, there’s a lot to it, and we won’t, and we won’t take the time to go through every little detail of NACHA compliance, but what are the biggies and what’s the trend for NACHA compliance?
BELL:
Sure. So the big thing that, you know, I I wanna make sure that our audience today is familiar with, and it it, so that they don’t get surprised. The big thing that employers can do is make sure you have, you know, contracts with the, the people who are moving money on your behalf. Those contracts have special provisions that are required directly in the NACHA operating rules. So there’s specific language that is gonna be in those agreements usually called an origination agreement. But then also you’re, you know, either part of that agreement or a separate agreement. It’s gonna be an ACH authorization form. And this is what allows your, your payroll vendor or anyone moving money on your behalf to go in and debit your account. Now the Notch Operating rules have been updated periodically, and they continue to be so, as an employer, you need to be aware that these rules are changing, and that if your payroll company reaches out to you and says, Hey, we had to update our form, or You closed your account and opened another one, we need you to a new ACH authorization form so that we have the authority to go in and, and pull the money you know, make sure to act timely on those requests.
Because, you know, as a payroll company, we certainly don’t want to you know, have any payments that are lagging or not made as quick as they, as they could be. That’s right. The, you know, new thing that is kind of trending right now in ACH compliance is a concept called nesting. And what that actually means, if you think of the example of those little bitty Russian doll toys that, you know, that they used to have where you take the doll apart and inside there’s another doll, and then so on and, and so forth, that, you know, that concept, that analogy has been operationalized, called nested third party sends. Third party sends is a fancy term for intermediary that, you know, you have the bank on one side, you have the employer on the other, that the employer has hired a company Likesure to do their payroll to move that money.
So, as Asure is called a third party sender, we get directions from the employer that we then forward onto our BA to the banks that we have partnerships with, contracts with, and we stand in the middle. So if, and this doesn’t happen, but if a company like Asure was to hire, say, another company to act on our behalf that doesn’t have a contract with the financial institution, with the bank, then that, that additional middleman would be called a nested third party sender. This actually matters, you know, where the rubber meets the road because it’s a whole lot of work for the banks, and most of the bigger banks are saying, we don’t wanna play that game. We’re not gonna have nested third party sender relationships. You know, so what has is happening in the industry right now is that a lot of contracts are being reassigned. A lot of new ACH authorization agreements are being signed so that we can eliminate the middleman. So if your payroll company is contacting you saying, Hey, we need you to sign this so that we have direct authorization, that’s probably what they’re doing, is they’re trying to eliminate this nested third party sender relationship so that things can keep rock rocking along. And of course, those are not, you know, not requests that you want to ignore.
VANNOY:
So, Chris, I imagine for the big payroll companies, I’d say sure is one of those, this is an expensive pain in the butt, but reasonable to pull off. This gets a lot harder for smaller regional payroll companies. It may be hardest for, I’m envisioning, you know something like a hundred thousand CPA firms across the country, just a straight up accounting firm, a bookkeeping firm who provides payroll services for their local clients who who really have relied on these third parties to move money. They’re not gonna be able to do that, or they’re not gonna be able to do that as easily going forward. Is that safe to say? Or am I, am I being melodramatic there?
BELL:
No, I, I think your, your warning there is both prescient and reasonable. You know, essentially the, the operating rules have been tightened up to make sure that these third party relationship and, you know, third party systems are identified and clarified you know, so that we can know, you know, all along the chain who is moving money and, and who’s taking possession of funds and, and just, you know, all the actors in, in the game. Yeah. And yeah, as, as we get to a situation where because there has been clarity around these roles and responsibilities, you have banks responding, saying, we don’t want to be a part of that. It’s gonna make it harder for companies that rely on those, you know, nested third party sender setups to get banking relationships. And, you know, if, if they’re not successful in finding and identifying those relationships and securing them, what they’re gonna have to do is partner with, you know, a company that can you know, eliminate the middle man and handle the money movement. So, you know, to a alleviate you know, the, the smaller players from, from having that burden and that responsibility.
VANNOY:
Yeah. Very good. All right. Anything else on NACHA that you think specifically CPAs, accounting firms small regional providers, need to understand that’s, that’s changing? One of the things that pops in my head is around tokenization of data.
BELL:
Sure. Tokenization is is a big topic. You know, that has been getting, you know, that has gotten a lot of press, you know, over the years. What you need to keep in mind if tokenization applies to you or could apply to you you need to familiarize yourself with the the triggers of that. It’s volume based metrics. So, you know, it’s how many transactions are you doing and pushing through the system? And you need to look at your, your flow of funds to make sure you’re evaluating that correctly if you’re moving money out of multiple entities. And increasingly when you get your risk assessment and your audits from your your auditors for nacha, they’re gonna be asking that question. I believe starting this year, the firm that we hire to do ours has, has put it in their form this year to start reporting on tokenization so that that can be then, you know, reported to the banks.
VANNOY:
And, and if, for those of you who don’t know what that means, so imagine you go to a website and you’re gonna buy something, you’ve bought something there before. They’re not storing your credit card information. It is tokenized. It might be a bunch of stars followed by the last four digits of your credit card. They’re, that website isn’t physically storing it, it’s a third party who’s tokenizing the data. That’s what we’re talking about, where you can’t store your client’s bank information. So if you’re a a, a a, an accounting firm providing payroll services you can’t store that banking information. Now, there’s Chris alluded to it, there are thresholds where you, if you’re a, a, a, you know, smaller company, a smaller number of transactions, you don’t have to comply yet. But I think it’s safe to say, Chris, that the bar just low keeps on lowering. And yes, I would have an expectation. We don’t, we don’t have any commitment. We don’t have, NACHA hasn’t published a a a a a statement or a date on this. I would have an expectation within the next two, three years, all businesses, all data must be tokenized. You can’t store, you simply can’t store bank information, period. It’s not gonna be just for bigger providers. What do you think about that?
BELL:
Well, I, I would agree, just in principle to that statement, Mike, if, if NACHA doesn’t do it, states will you know, another thing that’s sweeping through the country right now are, you know, different financial privacy acts different you know, privacy acts just in general. You know, the, the one thing that I, I wanted to, to make sure I mention here I was actually having a conversation with one of our VPs on information security, and we were talking about all the different ways that financial information is stored, not just in an ACH file, but, you know, how are you corresponding with your customers? How are you capturing that information, right? You know, in your, in your SharePoint or your Outlook, do you have a whole bunch of account numbers or, you know, personal you know, p i I, which is personally identifiable information?
Is that information just kind of resident on your system? You know, these are kinds of questions that you know, we need to be asking ourselves all the time. You know, what information do we have? Where is it? What safeguards do we have in place? And, and this, you know, that recommendation actually goes for everybody. Because if you have information about other people, largely the states are coming after that and these new privacy laws and saying, Hey, we need to make sure that you are doing proper safeguards to keep people’s information safe from hacks and scams and, you know all the different threats out there.
VANNOY:
Right? okay. So Chris, what, what, what would be a good resource for folks to go to? You know, we could, I, I think I wanna wrap on nacha cuz we had, I really wanna spend more time with, these are the topics. Is there, is there a good website or a resource that people can go to, to understand what are the NACHA requirements to therefore determine whether they are or are not compliant?
BELL:
So NACHA is a paid service, and it’s an association. They put out you know, a, a new version of the NACHA operating Rules every year. You know, I would encourage everyone who’s a nacha, you know, or ACH network participant to sign up with NACHA to get a copy of their rules and guidelines. You know, each year they have lots of lists, workbooks, and things you can purchase on different roles that, you know, third party center relationship. You know, I, I personally have, you know on my desk a, excuse me, a copy of their third party sender guide that they, they put out. Also they put out quarterly webinars to alert folks of changes to the NACHA operating rules to let people know that potential changes are coming and when comment periods are I’m on all of those calls as, as I represent an ACH network participant. So those are you know, those are valuable resources to kind of know what’s coming.
VANNOY:
Yeah. And, and I think maybe the last thing I’d say on this one is larger providers. I think this isn’t news. I think the people that, that are risk of getting caught flat footed here, who I’m really speaking to right now, it’s CPAs and accounting firms providing payroll services to your clients. You might only provide payroll services to 20 or 50 or 200 clients and might not think this is big. And this doesn’t apply to me. And you’re probably right for the last however many decades you’ve been doing this, you’ve gotta comply. Now, the, the rules are changing, whether you’re aware of it or not. Let’s move on to the Bank Secrecy Act. B s A a couple big acronyms that sit underneath the Bank Secrecy Act. Aml, anti-Money Laundering. And what’s my other one?
BELL:
Ofac. Ofac.
VANNOY:
Ofac.
BELL:
Yeah. That’s the Office of Foreign. Nope. access Control. Maybe you know, it, it’s not an acronym I unpack very often. So you know, when you’re,
VANNOY:
And, and, and their acronym is kyc Know Your Customer, right?
BELL:
Actually that has changed. So it used to be kyc and then under the BSA AML law revisions over the last few years, now it’s actually called C I p Customer Identification Program. So <laugh>, so let’s,
VANNOY:
Let’s, this is, let’s kill the acronym soup part of the conversation. Explain to now, now this applies to employers too, cuz you’re gonna have to comply with mm-hmm. <Affirmative> apparel providers process. But again, CPAs, accounting firms, payroll providers, anybody who’s touching money and touching data banking information, what is it that we need to understand in this area? Yeah,
BELL:
So the major thrust of aml, bsa, and ofac, okay. First you have to keep in mind, we don’t wanna do business with bad people. That, that, I mean, that’s where, that’s how it boils down. At the end of the day. You know, you cannot do business with bad people, but in order to not do business with bad people, you have to know who the bad people are. So that means you have to know who your customer is. Yeah, so the aml, BSA laws and regulations and rules put out the you know, the major components of an AML BSA program, and they say, Hey you know, anyone who is to whom these laws are applicable, you have to know who you’re dealing with. You have to verify their identity. And there’s lots of third party resources out there that, that can help you with that.
But the rules define certain information that you have to gather from all of your all of your customers to make sure that those people can be properly vetted or sufficiently vetted to meet the requirements under the regulation. Things like, of course, their name, their e i n or if they’re sole prop, their social security number, their formation documents to make sure that they are, you know, that, that, that the entity has been born and it’s a, you know, a a legitimate going concern. It’s not just kind of some kind of shell company. This information can be loaded onto third party resources like Lexis Nexus, for example. I know Walters Klu also has these kinds of resources, and there’s lots of different ones. I’m not endorsing any, anyone in particular, but a lot of resources exist to where you can upload this data to have it screened against all the applicable and available databases.
And one of those includes the OFAC lists and the OFAC list. If, if you take our basic definition, if you can’t do business with bad people, and OFAC basically says you cannot move block property for blocked persons. And what that is, is OFAC goes through and they, they’ve identified certain foreign actors to say, these people right now, at least at the present moment, are blocked persons, which means you cannot help them move money or property on their behalf. You just can’t do it. And if, if they catch you doing it, I don’t know, I think they lock you under the jail or something. I, you know, you just don’t want to do it. Yeah. Yeah. And it’s easy to avoid if you are collecting the proper information and screening your customers. For those of, you know, for those of us who the BSA laws are applicable, you know, we have to have a BSA compliance officer to oversee our program.
We have to have a written BSA policy that talks about all of these things. I tell people, remember, it’s not a one and done thing. You know, especially if you’re processing payroll, you know, I took your information when you first came on board as a client, but if I process your payroll every week or two, every time I process your payroll, I’m basically telling the government, Hey, I’m not doing business with bad people. The people are still good people, or they’re not on the, on the naughty list. So it’s an ongoing commitment. It’s an ongoing screening. One of the, one of the things that your auditor’s gonna look for, it’s actually called independent review. And bsa, is they’re going to be looking for your customer due diligence program and your transaction monitoring program. Are you on an ongoing basis making sure that you’re still not doing business with bad people? And I, I mentioned the independent review, that’s another requirement of the B S a regulations that it’s, and it’s not defined, the time period’s not defined in the regulation, but in the exam manuals, you’ll see that every 12 to 18 months is expected behavior. So you know, people to whom BSA is applicable, you need to do an annual risk assessment that is defined, and then you need to have an independent review every 12 to 18 months so that you can show that you’re, you’re following the BSA laws. Now. Chris,
VANNOY:
Chris, go ahead. Just, just thinking about this, his historically, so I think, I think the, the aml, the anti-money LAU stuff goes back to what went into the seventies, right? Because you, you, I mean, you, you can imagine the US government doesn’t want to make it easy for crime syndicates to, to launder their money from this bad operation to that bad operation. Hey, I just set up a shell company, and the money comes in there and it comes out in the form of good W2 payroll to a bunch of bunch more bad people. The money is now laundered, right? Enter nine 11, and all of a sudden it’s not just crime syndicates for money laundering, it’s terrorist organizations. Yes. How do we make sure money is, is clean? Fair to say that maybe those are the big initial drivers, but the acceleration of compliance requirements has a lot more to do with just the ever-changing banking infrastructure and how fast and easy it is to move money that you have to real time monitor. It’s not just enough to say, okay, you are a real entity when you set up, because the criminals know that they, they set up a legitimate laundromat and then later start funneling the money through the laundromat, right? That you have to have the ongoing
BELL:
Laundering more than bed sheets,
VANNOY:
<Laugh>. That’s right. That’s right. That’s right. So, so what, what are the challenges that, you know, say a smaller payroll company or probably my bigger concern for is, is, you know, the thousands of accounting firms providing payroll services for their clients. How, how do they continually monitor this and stay compliant?
BELL:
So I mentioned the third party resources that are, are out there, that the, the firms that have tools that specialize in this that’s the only way, you know, if you’re doing, if you, if you’re doing anything at scale, you can’t do this with human beings. I mean, you, you have to, you know, you might have a human being that, you know, uploads it into a database or, or things like that, but you need some sort of automation you know, that’s going to continually work with the third party to, you know, screen all the customers on at the right cadence as defined in your aml BSA policy. You know, but you know, I’m mentioning third party resources. I’m mentioning automation. You know, I, and I know you know all about these things, Mike, you’re one of my go-to resources on, on AI and all automation, but you know, and I know these are expensive words.
Yeah. <laugh>, you know, right. <Laugh>, I, I mean, you know, to have the, the technical development people to build, you know, the AI and the bots and all the processes that will integrate with your third party resources and the third party resources have annual fees. And, and if you’re, you know, they may charge you differently depending upon how many screenings that you’re doing under a certain period of time. You know, see, either these are all questions that you’re gonna want to ask if you’re employing a, a third party vendor to, to help you with your a ml b s a screening. You know, what list come with my membership? How many people can I screen? One of the, one of the small questions that people wouldn’t think about if I have a false positive come up, is there a way to clear that person at least for a certain period of time, so that every week or every month where I screen this person, it’s not coming up with another false positive that I didn’t have to have a human being going in clear. Because that takes a lot of time, and time is money. Yeah. the, you know, other, you know, small thing, or at least you think it’s a small thing. You know, so the aml, bsa, ofac, they actually do have federal regulators that will come in and exactly
VANNOY:
Where I was gonna go. Yeah. Yeah. So, so what does, what does teeth look like and feel like this u unlike nacho?
BELL:
So, you know, if you’re not a bank, you know, but you are a money service business, right? That’s you know, if you’re a money transmitter, then the let’s see. It’s the F F I E C that you have to register with as a, as a money service business. It’s, it’s a, it’s a group of federal regulators that you have to fi, you know, file an online form to register with Fon. Which is the, you know, as a, a federal financial regulator as a money transmitter. I believe the federal regulator would be the irs. And I don’t think I have to define that acronym for anybody on this call. Yeah. So, you know, to add, you know, I know we started this conversation on some of the regulatory uncertainty. I have a lot of friends at fenson, and you know, we’ve, we’ve talked about this conversation about this question of is a payroll service company a money transmitter?
And you know, the answer is, we don’t know. I’ve not seen a written opinion from fenson that clarifies that particular question. So a lot of people are gonna see that and go, oh, well, I can tune out then if it’s uncertain it applies. I’m willing to roll the dice and, and Wait, don’t do that. Here’s, here’s the reason why. There are many states, and increasingly with the M T M A adoption, even if you’re not required to register as an MSB money services business because you’re a money transmitter, that was typically where the Bank Secrecy Act compliance came in. If you’re a, if you’re a federal msb, you have to follow the federal bsa, right? Very simple logic. The states came in and said, their laws used to say, follow the BSA if applicable, and then the states changed and said, no, follow the bsa. We don’t care if you’re required to follow it at the federal level. Oh. So a lot of states have said, follow the BSA as if it applies to you, because now it does. We’re telling you it does.
VANNOY:
Interesting.
BELL:
Okay. If you don’t follow it, and you get, you get a state exam and one of these states that require it, you, you, you’ve been dinged on an exam. So I, I wanna make sure that people on the call
VANNOY:
Irs, so enforcement from federal levels, the irs Yes. Enforcement at the state level, should you be audited, would be their either secretary of state or treasury department, or
BELL:
No, it’s gonna be the bank regulator. It’s gonna be whoever regulates you as a money transmitter. So in Texas, it’ll be the Department of Banking in Alabama that would be the Securities Commission. Got
VANNOY:
It. That makes sense.
BELL:
So just like a bank has both a federal regulator and a state regulator, right. A money transmitter you know, Asure, for example is re is registered with with fenson under our operating company Asure Operations, which is the, you know, our operating company that holds all of our money transmission licenses. We’re registered with fenson because we did out of, out of an abundance of caution you know, talking directly with people at fenson, the answer was, I don’t know. But our banking partners expected to see it. Our state regulators were, they expected to see it, but at the end of the day, they didn’t really care. Of course, we’re already doing all of the compliance things necessary to have you know, a, a stellar BSA program. So it, in our analysis, it didn’t hurt to go ahead and get registered. And it removed all doubt and all risk from our portfolio. So that’s why we made a decision to go ahead and do it. But, you know, to your point, as we get examined by our state regulators, they look at our BSA program and our BSA independent reviews and risk assessments to make sure that we’re complying with the bsa, which they’ve incorporated now into their state walls.
VANNOY:
Got it. Okay. So maybe the, put a ca a, a a a bow on this topic before we move on just to money transmitter. You’re an accounting firm. You’ve been providing payroll services for clients. You likely in it, if, if you, if you were aware, you were probably already compliant, but it, it’s possible that your state could have changed its banking regulations to say you should follow B S A, taken out the words if it replies to you. And so now you, you need to verify whether your estate does require you to follow bsa. If so, you’ve gotta go through all this anti-money laundering, know your customer stuff, proof verification. We won’t get into all the details of the how to do that’s different, different topic. But again, and I’m not trying to be a melodramatic here, but it’s our, it’s my opinion, there’s a lot, there’s thousands, probably, maybe it’s tens of thousands of accounting firms and CPA firms providing payroll services for their clients that are unwittingly not compliant. Is that right?
BELL:
I, I would agree. And, you know, I used to give a lot of trainings in, in, in former roles about BSA and about, you know, different compliance topics. And the thing that I would always tell people, and I, I think it was Mark Twain who originally said it, but you know, don’t believe everything you read on the internet it’s not the things that we know that hurt us. It’s the things that we know that just ain’t so, yeah. Yeah. So for years, there’s been this idea about compliance, oh, that stuff doesn’t apply to us.
VANNOY:
Right?
BELL:
And the regulators have stepped in and said, oh, but it does, and here’s the kicker. They say, and it always has, I was on the phone with a regulator this morning, you know, talking about about, you know, these kind of topics and, and money transmission. And I was asking him directly, you know, the question, when did your state interpret its money transmission laws to include a payroll company? And his reply was, we’ve just never gone after them. It’s always applied. We’ve just not gone after them. So please keep that in mind. We say the regulatory landscape is changing, but we’re only saying that because we were operating under the Asuremption that yeah, the regulation never applied to us
VANNOY:
In, in some cases, absolutely. Black and white regulatory framework is changing in other cases, because I think about states increasingly being handed unfunded mandates, they’re searching for money, right? Mm-Hmm. <affirmative>. And so maybe it’s not the the compliance landscape that’s changed, but the accountability <laugh>, right? It, it, it, it, it’s not, it’s not the laws that have changed, it’s the enforcement of said laws. That’s, that’s changing in some cases.
BELL:
Yeah. And no, that’s, that’s absolutely true. You know, the, you know, I, I’m personally one of those people that say, yes, the regulatory landscape is changing. Now I can point to specific things like the CSBs updating the model act to explicitly define payroll, you know processing services and it, you know, explicitly and expressly included in the definition of money transmission. That is a change. It went from, do you interpret the law this way? To what does the law say? Yeah. You know, to go from interpretation to actual black letter law, that is a big change. Yeah. Now, the, the net result may not change in particular states, Texas, for example, Texas since 2019 has interpreted its law to include payroll companies as money transmitters. But now Texas has adopted a version of the muddle, you know act from the CSPs that takes effect on September 1st. That now just clearly says, but Texas would say, we didn’t, you know, we, nothing changed that under the old law, a payroll company was a money transmitter under the new law. We made it really crystal clear that a payroll company is a money transmitter, but the need for a license was always there. That’s how these interpretations are working.
VANNOY:
The two words that come to my mind scare the hell out of me. And you’re not saying I’m, I am is retroactive fines. I mean mm-hmm. <Affirmative>, if this is, if that’s truly the, the how they’re the position they’re gonna take,
BELL:
This
VANNOY:
Is not just a go forward problem. This is get your in order as fast as you can. Cuz theoretically they could come at you retroactively as well. The same as same as the irs, what did the other kind of audit? Right? Right. Hey, Chris, we’re we’re, I’m looking at time here. I wanna, I wanna spend maybe the rest of our time. So we talked Nacha <affirmative> enforced by the Banks Bank Secrecy Act ofac anti-money laundering enforced by banking regulators,
BELL:
Federal and state.
VANNOY:
Yep. Federal and state. Let’s talk money transmitter law specifically. And, and I want you to, th again, I’m gonna hit hit it, regional payroll providers, accounting firms, CPAs, anybody providing payroll services. Th I want this to be a, a sledgehammer upside the head because this, this is a, this is a massive, I will call it an existential crisis, kind of a change that you gotta gotta get your head around because this, the world is really, really changing here. And if you’re an employer, normally watching this show, thinking, okay, what are the latest HR laws, the person you entrust to provide your payroll services, whether local or, or, or national, big or small, they also must comply here. So start out maybe the debt, you set it up at the beginning, what is this model law that has passed and, and the change that now explicitly says payroll providers?
BELL:
Sure. So if you, if you think back to where we were, you know, in the early days of payroll and in the early money transmission acts, the definition of money transmission, all it said was, if you accept a fee to take money and make that money available at another time or another location, that’s money transmission. That is a very broad definition. Yeah. If, if I told you, Hey, Mike, can you take this $5? You know next time you see our coworker, Scott, and give it to him, can you, can you do me that favor? And you go, sure. And, but I, but I give you a 10. And I say, I don’t have change. Can you just make the change? Give him that five bucks. I’ll let you keep the other five. Well, now you’ve accepted a fee that’s potentially licensable money transmission under the standard broad definition of money transmission.
It’s hyperbolic. Sure. Would it ever happen? No, I would never pay you $5 to get $5 back. But and I like you, Mike, but still, I’m, I’m kind of cheap. So there you have the very broad definition, taking money, paying it out to other people, and you do it for a fee. Does a payroll company fit into that? Sure. You know, but so does everybody else. So the question became to the individual regulators, individual departments of banking and different commissions, Mr. Regulator, do you want to regulate this particular industry? And increasingly now, states have kind of stepped in and said, yeah, we’ll regulate payroll. And then you had you know, this sort of sporadic, one state here takes an enforcement action, another state as another one. And we started kind of getting this feeling of, huh, maybe this is a start, the start of a seismic shift.
Fast forward to, you know, 2020 and 2021, the, the group that in CSBs the conference of state bank supervisors, when they were looking at, Hey, we as regulators are dealing with a changing world. Now we have same day ach, and now we have, you know these different players, these different services and crypto and you know, all different kinds of stuff. We need to update the law to appreciate the 21st century. So they have put out the Model Money Transmission Modernization Act, and in the mtma they have now in the definition of money transmission, they, they kept the broad definition, but they said this term includes payroll processing services, and then payroll processing services is, is further defined. And it’s, it’s payroll. I mean, you know, everything you think of payroll, if you take money from an employer and you pay it out to an employer or a taxing authority, that’s payroll processing services, and that’s money transmission. You need a license.
VANNOY:
So to be clear, this isn’t just Asure ADP Paychecks the big payroll companies. No. If you are not, maybe not even a cpa, you’re an accounting firm, provide bookkeeping services. You use Intuit to process payroll for your client. You impound their funds, you move those funds to their employees. You, the money sits in your account, you or some other account that you pull into and you pay the taxes on their behalf. And you will do that for five clients, is all you’re a money transmitter. Right.
BELL:
You have to look at the laws in the individual states that you, that you operate in. The other thing that I wanna make clear, you know, for the audience today, and I know, I know you know this Mike, cuz we’ve talked about it, this is a model act, it’s a template. It’s color by number. Does that mean that every state adopts the model act the way it’s written? No. You know, what is the, you know, what is the benefit of having, you know, all of this stuff when there’s no uniformity? I don’t really know <laugh> know, but it supposedly makes the regulator’s job easy. So that’s what they did. But you have to look at what states do I operate in? What, you know, what does that state say about how they define money transmission? Do they have exemptions or exceptions?
If so, do they apply to me? You know, you mentioned five clients, right? You know, is there a de minimis exception in the law? Does it say this only applies if you do X number of or more than X number of transactions in a year? You know, you, you have to look at the law and see if it says that mm-hmm. <Affirmative>. but increasingly, if, if you’re, if you’re doing payroll and you can’t look at the law and point to it and say exactly explicitly where it says, I don’t need a license, are, you know, the banking partners, because it raises their risk. Now, third party relationships, they’re increasingly saying, you prove to us why you don’t need a license or else you can’t bank with us. You know? So that’s a real world effect of a lot of this stuff.
VANNOY:
Yeah, that’s interesting because the, so much of the compliance that I think of Dana that day out about employers, it’s about more HR laws leave types, overtime, minimum wage, and there’s clear government agencies that enforce this. Going back to the, the top of our conversation, the banking system is developed on trust. And these banks that they’re in a lot of ways, they’re creating the self enforcement. If you wanna, if you wanna play in this system, you gotta play by their rules, even if it’s not necessarily enforced by some carved out federal agency.
BELL:
Yeah. Well, I mean, money transmission licensing is a, is a little bit this, it’s, it’s an and or situation where money transmission licensing and laws are enforced by the states, but then also the banks, right? Because it increase it because it affects their risk as they’re doing due diligence on their clients. It’s a part of their analysis. So, you know, even going back to when we talked about Fon registration at the federal level for money transmitters, you know, the banks are now kind of getting wise and saying, are you registered with Fon? And if not, why not? So it, it, it does, as you’re saying, it has both a regulatory enforcement aspect, but also an industry enforcement aspect with the banks.
VANNOY:
Chris, I, I, I know it’s different by state mm-hmm. <Affirmative>, so there’s no black and white answer to share a show like this. But can you just kind of paint a picture what some of the broad categories look like? And I’m, and I’m, and I’m thinking it’s it’s the obvious license in of itself. It’s acceptable places that you stick that money, you know, certain funds and, and, and, and where the money can live. It may or may include bonding and insurance and personal assets. There’s, there’s a whole bunch of things that are, that commonly apply here. Can you, can you kind of take us through the most common ones?
BELL:
Absolutely. so the, the first thing I would say is never think about licensing as a one and done deal. It is an ongoing commitment to get and maintain a licensed portfolio to cover all the jurisdictions in which you operate. Now getting the license and keeping the license do require some of the things that you were mentioning, or actually, it requires all of the things that you were mentioning. From an accounting perspective, you have to have audited financials. A lot of smaller non-public companies, they may not have audited financials. But if you’re a money transmitter and you have to get licensed now, you now you will surety bonds, that’s, you know, I don’t think that we operate in a single state that requires a license where Asurety bond is not necessary. And these surety bonds run anywhere from tens of dollars to 2 million on volume, depending on business size assets and, and net worth net worth requirements.
That’s also you know, another requirement, you know, for you know, getting and keeping these money transmission licenses. You know, there’s a, there’s an aspect of net worth called tangible net worth that also applies. So that’s your net worth minus your goodwill and other intangibles. And I’ve seen a lot of entities get in trouble for, you know, not maintaining the proper tangible net worth, even though their net worth was sufficient. You know, there, the thing that I kind of blanched out when I first saw it in, in getting and keeping a license is the amount of information that qualifying individuals and business owners their, their license have to disclose and keep updated. You know, if, if you have a change you know, in your corporate address and you don’t update it timely, you can get fined for that by various states.
It’s ridiculous. You know, I, I get it, but at the same time, if you’re one person on a staff of, I don’t know, 12, that’s handling compliance in addition to the six other jobs that you have when you’re working in a small business, you know, you gotta be aware of that kind of stuff. Permissible investments, that’s another big one. You talked about where we can put money. The general rule on permissible investments is very simple. You have to have enough assets invested in specific types, accounts or investments to stand good for your total outstanding money transmission obligation across the us even where you don’t need a license. That’s another kind of key thing that some people forget. You know, because you know, California right now doesn’t require a payroll company, at least to my knowledge in my research, a payroll company to have a money transmission license. But I still have to count the money transmission obligations that I have in California against my permissible investment requirement to show that I have enough assets to cover that in case something happened. So
VANNOY:
If I’m, so, if I’m a small accounting firm providing payroll services, I probably, and I, and I am a, a money transmitter, so I’m, I’m impounding funds from my client, they’re sitting in my account and then I disperse those funds and I get a fee. So I’m a transmitter. Where are the areas that folks can get in trouble for permissible investments? Because I’m, I’m guessing you get into this business for float, right? You want to earn interest on that money. And so you know, I don’t, I don’t, I don’t pretend to to to know the answer. So, so where do people stick the money most commonly, and how does that maybe get them in trouble?
BELL:
Sure. Well, I mean, you know, you’re, you’re gonna wanna invest that money, right? Because it up and up and until recently bank accounts were paying BCUs you know, so you wanna invest that money so you’re earning even more money on it. And of course, how do you maximize your returns on investments? You take more risky investments you know, and, and you know, I’m, I’m talking, you know, really high risk in investments here. I’m talking triple B bonds, <laugh>, you know but under the, the ntma, the Model Act that all, you know, every, you know, all the stakes are, seem to be adopting Triple Bs are not acceptable categories of permissible investments. You know, unless, well, I was gonna say unless they fit in some other bucket that they certainly won’t qualify because they’re triple B. And so that’s a, that’s a change in the investment policies that I think a lot of companies are gonna have to make when the permissible investment requirements apply to them.
VANNOY:
Wow. Okay. All right. So permissible investments bonds, personal assets, disclosures, the licensing itself. Any other big buckets here?
BELL:
Let’s see. So you’re gonna have to be foreign qualified in all the foreign jurisdictions in which you’re moving money for in order to qualify for licensure. So getting those foreign qualifications and renewing those on a timely basis.
VANNOY:
And what does that mean for,
BELL:
What is it? So let’s say that you are a, you formed your company as a corporation, but like many corporations you filed in Delaware, so you’re a Delaware corporation, but you do business in Texas. So you have to register with the Secretary of State in Texas to say, Mr. Secretary of State, I’m doing business in Texas. Please, you know, please accept this application and let the world know that I am in good standing in Texas.
VANNOY:
Got it.
BELL:
And so what about,
VANNOY:
Chris, what about employees in different states? Is this only where you do business or is it, or is it wherever you might have obligations? So if you’re, you know, your, your your, your, your accounting firm in Philadelphia, you have employee, your client is in Phil Philadelphia. They have employees working from home in Cherry Hills across the border in New Jersey. Right. do they have to apply in both or because their entity is Pennsylvania, that’s the only place.
BELL:
So that’s actually another open question. And there’s a little ambiguity in the laws. It kind of depends on the regulator that you’re talking to. I know I believe it for, you know, for example, in Texas if you were taking money from a Texas employer and paying it to somebody in Arkansas, or sorry, if you were taking money from Arkansas and paying it to someone in Texas, let’s reverse that. Texas would say because the recipient was in Texas, that would be Texas money transmission. Now, interestingly, under their new adoption of the mtma, they’ve actually clarified it to say that the, you know, the activity has to start in the state. Okay. But again, that seemingly is a, is a change of position. We, we, we haven’t gotten guidance from the department yet. No one has, cuz it, I mean, it was just signed, you know, within the last couple of weeks.
So you know, we expect guidance is be coming from the various departments of banking and various regulators to clarify things like this. But again, that’s another, you know, ambiguous thing. Like would that be, you know, New Jersey money transmission activity cuz it’s received in New Jersey? I don’t know. I don’t, I don’t, I don’t rely on my memory of the law to be able to answer questions, unfortunately, cuz it would be irresponsible. But it’s certainly a question that, you know, if, if you have to do this kinda stuff, you’d wanna be asking your regulator.
VANNOY:
All right. So maybe to, to wrap up the conversation here mm-hmm. <Affirmative>, the, the, it’s the banking network itself that, that enforces NACHA rules. It’s federal and state reg banking regulators that implement the Bank Secrecy Act entity money laundering for money transmitter law. What, what does, what does enforcement look like? Who does it, what bad thing happens to someone who is out of compliance, whether on purpose or accidental?
BELL:
Okay. So state money transmission laws are governed by the state. They all provide for examination by the various regulators so that the regulator will come in and examine, you know, your systems, examine how you do business to make sure that it’s, it’s congruent with their laws and you’re compliant. And then if you’re not compliant, you can be looking at fines you know, on the, you know, on the low end. But you could also, depending on what laws you violate, they could run you outta business in that state. You know, they could say, you know, Hey, you’re not compliant with our state money transmission laws, and because of that you cannot, you know, move money in our state. You know, it’s cuz we’re gonna take your, take your license away.
VANNOY:
Yeah. Yeah. And
BELL:
Depending on, depending on how your business is set up, you know, and also keep in mind, if you have an enforcement action by one state, you have to disclose that to all the other states. So if you get run outta business in one state, it might be the House of cards or the dominoes that start falling over.
VANNOY:
Chris, the, the, the goal of this show is just to provide the very best information we can to small businesses, to accounting firms all around issues around payroll, hr.
My intention is not to scare anybody. I think, and I’ve been in some way or another related to this industry for, call it 25 years. This is probably the biggest scariest issue that I’ve seen around compliance on the provider side. And when it’s the big federal, big national companies, you know, publicly traded company like an Asure and adp, a Paychex fine, whatever, we can, we can handle it. The thing that probably worries me the most is, is the tens of thousands of CPA firms, accounting firms just providing good old fashioned payroll services for their, for their bookkeeping and their tax clients. Because there’s obviously a tight relationship there to, to those other functions without unduly scaring this audience. You know, what, what, what’s your, what’s your word of caution about how serious people should be taking this? And maybe, you know, specifically, what should they be doing to begin their investigation to, to, to make sure that they are now or will be compliant?
BELL:
Okay, so let me, let me take that question apart first. You know, you said, you know, without scaring folks, you know, basically talk about how important this is. I can’t do that. If I were, if I were in the shoes of representing a small regional company that’s five to 10 staff members and they’re moving money in more than two states, I, I I, I’d be looking at this going, I’m not sure we’re going to survive this new regulatory regime. The way I talk about it, and you’ve heard me, Mike, we’ve talked about this personally, is that these new laws and these new interpretations, they’re raising the table stakes to participate in this business. And I’m afraid this is personal. This is my own personal opinion that this is going to force dramatic changes in our business. And the, if you’re a smaller player whether you play the game or how you play the game in the future is going to be different.
I’m not saying it’s gonna put you at a business, but it may change the kind of, the part of the business that you’re in. Because it likely will not be money transmission after the dust settles because the, the co the, the capital expenditures to get and keep all these licenses, and for all the BSA and NACHA compliance and everything, it’s cost prohibitive. You know, unless, unless you have the kinds of assets of an adp, a Paychex or an Asure. So I unfortunately, being honest, which is the only way I know how to do, I, I can’t do that without being scary because I would be scared if I were in their position. Now here’s, here’s the actual plan, and this is exactly what I’ve done, you know, in, in my practice. First sit down and you ask the question, where are we operating? Where are our clients?
What states are we in? Make a list then go to n MLS and their resource center, or go to directly to the state, which is preferable, and look to see, do I need a license in this state? And if so, you know, how do I, how do I go about getting it? One word of caution I would give is, you know, in our, in our free information age, right? It’s easy to go to third party resources. There’s so much change around these topics right now. Don’t trust the third party resources. Just don’t, they’re outdated. You know, I, I saw things that were published a couple of months ago that I’m like, oh, that’s, that piece is no longer accurate because that state has now, you know, passed the ntma. So go directly to the states please. And basically map out a game plan. And if you choose to play in this new game, get right and be prepared for enforcement actions and be prepared for fines for prior activity that was done without the necessary licenses.
VANNOY:
Yeah. so Chris, I I appreciate that. I mean, it’s a sober message, but I think it, I think that’s what it is. This is this is a change that we haven’t seen before. I’ve often talked to folks that I, I I, I kinda characterize what’s happening around HR compliance as this Cambrian explosion, if you remember from middle school, you know, earth science, you know, the Cambrian period is when all of a sudden, you know, go from single celled creatures to this, you know, the, the fossil record just explodes into all these different kinds of kind of species. For the last, call it 70, 80 years you’ve had big federal laws, fair Labor Standards Act, civil Rights Act, title vii OSHA for workplace safety big federal acts. The, the what, the, the, what’s happened in the last 10 years, but just in the last, I’ll, I’ll say just on fire accelerating since I’ll call it covid is states implementing their own versions of these federal HR laws mm-hmm.
<Affirmative>. And we’re just seeing the same thing happen now in the banking world, and which now touches payroll. And so there’s this, again, this Cambrian explosion. This is not as simple as the bsa, the Bank Secrecy Act. How do I know who my customer is? How do I stay compliant with this federal thing when every single state has their own version? I maybe do business to a couple states. I certainly have customers in different states. They, those customers have employees in different states. The the level of complexity is just, just kind of through the roof here. So
BELL:
I mean, go ahead. I’ll tell you, you know, just on that, right? You know, when we have states that are adopting big laws you know, I, I’ve spoken to a lot of people on the concept of gun ownership and how gun manufacturers they will, will try to comply with California regulation because it’s the quote unquote, the toughest in the nation. And you, you kind of gear toward the toughest in money transmission. You know, there’s certain elements that we can do that in things like net worth, you know, and, and things that we can do that for, but we can’t do that for everything because what has, you know Texas has different notice provisions than than Idaho you know, in Virginia. So you have to be familiar with both the, the requirements themselves and all the different states and make sure that what you’re doing caters to all of them in which you, in which you hold.
VANNOY:
Yeah. Chris, I, I’d love to have you back in the show to talk more about this as, as this topic continues to unfold. <Laugh>, I hate entering, ending this on, on a, on a such a doomsday <laugh> kind, kind of a, kind of a, kind of a note. I, I what I think, I think maybe the way to look at this, so much of our, I think day in, day out audience of this show is the entrepreneur and it’s the owners and executives at small, mid-sized companies. Yeah. This is all for you. It really is. This is to prove, to help prevent employers and employees from getting screwed, right? From, from the bad guys, either laundering money, stealing money, stealing, rerouting bank movement. Hey, you know, when, when money movement used to take 48 hours between banks there’s a window of time to catch the bad God before the money was gone.
In a, in a world where money transmission is, is increasingly headed towards real time when the money’s gone, the money’s gone. Yep. And so the, this framework, this tapestry of, of, of laws, I I, I suspect one day will simplify once again as a new standard gets set. But until that happens, we’re gonna be in a really complex tapestry of, of regulations and, and they’re all aimed at, at, at protecting employers and employees. So puts a, a, a bigger burden on CPA’s, accounting firms, perel providers than ever before. But better to know and do your best to comply than to not know and suffer the consequences. Chris, anything you’d wanna say in closing?
BELL:
No, I mean, I wanna thank you for your time today, Mike. You know, I’m, I’m happy to come back. I’m happy to have a conversation with you on or off camera anytime, anywhere you know, but you know, I hate to leave people with you know, with a down message. Unfortunately, this is just one of those things that I just don’t know. I, I, I think business owners, and especially the businesses that to which these regulations apply, they need to hear this message. They need to be evaluating their own businesses, making sure that they’re doing what’s necessary to stay in business. So as you’re saying, at the end of the day, this is all about the employer and the employee, and if the employer can’t trust a company to pay its employees, then you know, that third party company’s not gonna be in business for very long.
You know, that’s right. I know. We, we really appreciate all the customers that we have. We, we, you know, we thank them for entrusting you know, their employees’ paychecks with us. And that’s why we’re being so aggressive at, at getting and keeping licenses and making sure that we are you know, playing the game by all the changing rules, even the rules that conflict with the other rules. You know, because at the end of the day, we want our clients to have you know, to have confidence and to have trust that their employees will get paid and paid on time.
VANNOY:
Yeah. Well said. Chris. Enjoyed it so much. Thanks to everybody for joining us today. Such an important topic and tough news. Perhaps for some if you’re an employer, just make sure you know who you’re doing business with and their staying compliant so that your employees can trust you and no one’s paycheck ever gets messed up. Until next week, thanks to everybody else. Thanks Chris. We’ll talk to you soon.