The payment app, used by millions and celebrated by rappers, \u201chad no effective procedure” to establish the true identity of customers, two whistleblowers told officials.<\/p>\n\n\n\n
Federal financial regulators are exploring allegations by two whistleblowers that Cash App, the popular mobile payment platform, and entities providing transaction services to its users performed inadequate due diligence on customers, potentially opening the door to money laundering, terrorism financing and other illegal activities. <\/p>\n\n\n\n
While banks are required to know the true identity of every customer, the Cash App program \u201chad no effective procedure to establish the identity of its customers,\u201d the whistleblowers said. In their complaints, reviewed by NBC News, the whistleblowers detail an array of questionable Cash App transactions with entities under sanction by the Treasury Department\u2019s Office of Foreign Assets Control, operations known to sell personal information and credit card data for illegal purposes, and offshore gambling sites barred to U.S. citizens.<\/p>\n\n\n\n
Among the big-name companies partnering with Cash App are Visa Inc., the giant payment processor, and Wells Fargo.<\/p>\n\n\n\n
The whistleblowers filed their complaint with the Financial Crimes Enforcement Network, or FinCEN<\/a>, a unit of the U.S. Treasury that administers the Bank Secrecy Act and analyzes financial transactions to combat money laundering, terrorist financing and other illicit activities. Early last month, FinCEN officials spoke at length with the whistleblowers, their lawyer told NBC News, and said they were referring the complaint to internal investigators as well as to other federal agencies. As is its custom, FinCEN declined to comment on the existence of the submission.<\/p>\n\n\n\n Over three-quarters of U.S. adults have used a mobile payment app, such as Cash App, PayPal or Venmo, according to a 2023\u00a0study<\/a>\u00a0by the Consumer Finance Protection Bureau.\u00a0But these services, also known as person-to-person payment platforms, pose risks to their users and to the financial system, regulators say.\u00a0In recent years, for example, law enforcement officials have cited criminals\u2019 use of payment apps to evade laws, such as laundering stolen Covid relief funds in\u00a02020<\/a>.<\/p>\n\n\n\n Customers of Cash App<\/a>, introduced in 2013, can <\/strong>instantly send and receive money among themselves, and buy stocks and Bitcoin. They can also <\/strong>spend or withdraw funds using Cash Card, a prepaid Visa debit card. As of September 2023, Cash App<\/a> had 55 million active transacting accounts and generated $239 billion of inflows during the prior four quarters, the company said. Cash App is so popular it has been referenced in hundreds of rap songs, sometimes in connection with illegal activities.<\/p>\n\n\n\n In addition to FinCEN, the whistleblowers made submissions\u00a0alleging\u00a0due diligence flaws at Cash App to the\u00a0Securities and Exchange Commission<\/a>, the nation\u2019s top securities cop, and the\u00a0Commodities Futures Trading Commission<\/a>, which combats fraud in the market for digital assets, their lawyer said. The SEC declined to comment on the existence of a whistleblower submission; the CFTC did not respond to a request for comment.<\/p>\n\n\n\n \u201cThere are obvious national security issues here and it would be foolhardy for the public to think that regulators and law enforcement are keeping pace with the financial \u2018innovators,\u2019\u201d said Edward Siedle, a former SEC enforcement lawyer who represents the whistleblowers. NBC News interviewed the whistleblowers, who are knowledgeable on financial services compliance issues, on the condition of anonymity.<\/p>\n\n\n\n The whistleblowers\u2019 filings arrive as regulators are increasing scrutiny on deficient anti-money laundering practices. On Monday, FinCEN proposed a rule<\/a> that would require investment advisers to adopt systems to prevent money laundering and terrorism financing and report suspicious transactions to the agency. Such advisers oversee trillions of dollars but are not currently subject to these requirements, FinCEN said.<\/p>\n\n\n\n And in December 2022, federal prosecutors<\/a> and the SEC<\/a> took action against Danske Bank, Denmark\u2019s largest, for lying about inadequate transaction monitoring systems that allowed tainted money to enter the U.S. financial system. The bank pleaded guilty to defrauding banks through its lax compliance and forfeited $2 billion. And<\/p>\n\n\n\n Cash App is not a\u00a0<\/strong>bank<\/a>\u00a0and uses\u00a0<\/strong>an array of banking partners to\u00a0<\/strong>conduct certain of its services.<\/strong>\u00a0Wells Fargo<\/a>, for example, holds Cash App users\u2019 funds in a pooled deposit account, making\u00a0them\u00a0eligible for FDIC insurance.\u00a0Until 2021,\u00a0Lincoln Savings Bank<\/a>\u00a0of Iowa handled incoming deposits by Cash App customers.\u00a0Sutton Bank<\/a>, a\u00a0nine-branch institution in Attica, Ohio, issues Cash App\u2019s prepaid\u00a0Visa\u00a0debit cards.<\/p>\n\n\n\n Prepaid debit cards are a platform for potential illegality, according to a 2020 report<\/strong><\/a> from Standard & Poor\u2019s Global Market Intelligence. It described how <\/strong>payment processors, banks and other issuers of prepaid debit cards are \u201cexposed to criminal activity that could lead to reputational damage and run-ins with regulators.\u201d<\/strong><\/p>\n\n\n\n The whistleblowers\u2019 allegations cover 2016 through 2022 and describe \u201ca shadow financial system beyond the reach of regulators\u201d where due diligence on Cash App\u2019s users was negligible and often did not adhere to sound banking practices and rules. In addition, Cash App\u2019s use of different institutions providing services for users prevents bank regulators from seeing the full scope of the transactions at the institutions they monitor, the submissions say. The siloed structure of the Cash App machine, the whistleblowers say, \u201cmisdirects the attention of regulators.\u201d<\/p>\n\n\n\n Lax due diligence on Cash App customers poses risks for shareholders of its parent, Block Inc., the enormous fintech founded by Jack Dorsey, co-founder of Twitter, the whistleblowers said. Ditto for Marqeta Inc., a financial technology startup that acts as a middleman transferring funds for Cash App transactions, and Visa Inc., whose name is on the Cash Card. Shareholders of all three companies have not been fully advised of the risks associated with the Cash App business, the submissions contend.<\/p>\n\n\n\n On Feb. 9, Larry Summers, a former Treasury secretary, resigned from the board of Block, effective immediately, after more than a decade of service. The company said his resignation was not a result of disagreements over its operations or practices and that he was departing to devote more time to his other commitments. <\/p>\n\n\n\n Lincoln Savings Bank, with locations in central and northeastern Iowa, is also highlighted in the complaints. Lincoln began handling customer deposits into Cash App accounts in 2016, the complaints said, and was responsible for conducting due diligence required under banking laws to determine their identities and ensure their funds were not tainted by illegal activities. Lincoln\u2019s vetting process was minimal and did not align with regulations, the complaints allege; Cash App pressed Lincoln to forgo traditional customer due diligence to ease the process of opening accounts and to generate revenues, the whistleblowers said.<\/p>\n\n\n\n NBC News described the whistleblowers\u2019 allegations to Cash App and asked it to comment on them. A spokesperson, who communicated with NBC News on the condition of anonymity, declined to respond on the record. Statements attributable to the company were provided on background via email.<\/p>\n\n\n\n \u201cThe bank partnership model allows Cash App to offer certain financial services products (such as the Cash App Card) that are a benefit to our customers and further our purpose of economic empowerment,\u201d the statement said. The company performs due diligence on customers, the statement continued, employing \u201cseveral hundred people who support Cash App\u2019s Know Your Customer\/due diligence, anti-money laundering and related compliance functions, and augment that workforce with supplemental staffing and resources.\u201d<\/p>\n\n\n\n Like all financial services companies, the company added, \u201cCash App is not immune to bad actors attempting to use the platform for illicit purposes.\u201d It partners with law enforcement \u201cto help disrupt illegal or illicit activity.\u201d<\/p>\n\n\n\n The spokesperson did not respond to allegations that the company pressured Lincoln Savings Bank to minimize due diligence and declined to say why Cash App stopped working with Lincoln in 2021. Cash App\u2019s bank partnership model and fund-flows structure \u201care standard in the industry,\u201d the statement said, \u201cand are known to regulators. We collaborate with our bank partners on controls and monitoring for the activities they are responsible for.\u201d<\/p>\n\n\n\n A representative at Visa Inc. declined to comment on the whistleblowers\u2019 allegations, and Lincoln Savings Bank did not respond to requests for comment.<\/p>\n\n\n\n A Marqeta spokesman said in a statement: \u201cWe take our obligations seriously and stand behind our disclosures regarding the risks associated with our business.\u201d<\/p>\n\n\n\n Wells Fargo said it takes its obligations under anti-money laundering laws seriously and <\/a>that it requires its payment services clients such as Cash App to do the same. \u201cWe conduct ongoing due diligence, including account analysis and monitoring, and where we identify suspicious activity, we report it,\u201d the bank said in a statement.<\/p>\n\n\n\n Sutton Bank, issuer of the Cash App prepaid debit card, confirmed it has no way of knowing the sources of funds transferred from Cash App accounts to the debit card for withdrawals. Those funds come into the bank in large commingled blocks from Marqeta when a customer uses the Cash Card at an ATM or store.<\/p>\n\n\n\n \u201cWe\u2019re an issuer to the card product to spend funds that you have with Block in your Cash App account, but that\u2019s it,\u201d said Mark T. Dabertin, Sutton\u2019s general counsel and chief compliance officer. \u201cWe track ongoing monitoring of the spending activity for the card; we don\u2019t get any visual into how the money gets in there. We report on unusual activity affecting the card usage.\u201d Sutton\u2019s compliance staff is \u201ca very robust group,\u201d he said.<\/p>\n\n\n\n Cash App is a <\/strong>money machine for Block, generating net revenue of $10.4 billion during the first 9 months of 2023, or 65% of Block\u2019s net revenue, its regulatory filings show. Cash App produced $2.9 billion in gross profit for Block during the first 9 months of 2023, up 37% year over year, the company said. Block has a market value of $38 billion.<\/p>\n\n\n\n In 2016, Cash App began working with Lincoln Savings Bank <\/a>to handle customers\u2019 deposits into their accounts. Lincoln, which opened in 1902 as a one-branch agricultural bank in Iowa, is now a fintech pioneer with $1.8 billion in assets. <\/p>\n\n\n\n Its LSB Financial Technologies unit offers virtual cards, mobile wallets and payment processing and \u201chas created processes to allow for something unusual in banking \u2014 speed<\/em>.\u201d<\/p>\n\n\n\n Working with Cash App, Lincoln Savings Bank opened a pooled account where Cash App participants\u2019 money was deposited and held briefly until it was transferred by Marqeta to Sutton Bank for Cash Card use or to Wells Fargo. When Cash App customers want to spend funds or withdraw money at an ATM, their Cash Cards are loaded with money from their Cash App account. At all other times, the Cash Card has a zero balance, Sutton says.<\/p>\n\n\n\n This setup meant that neither Lincoln Savings Bank nor Sutton Bank could monitor both the people sending the money and those withdrawing it, the whistleblowers explained. Lincoln only saw the incoming money while Sutton watched it exit. Cash App and Marqeta, neither of them banks, have views of the entire transactions, the whistleblowers said.<\/p>\n\n\n\n In the rush to attract Cash App users, neither Cash App nor Lincoln performed extensive due diligence on customers, the whistleblowers contend. For example, Cash App allowed access to the Lincoln pooled bank account for customers presenting just an email address or a phone number, the complaint said, and Lincoln \u201chad no effective procedure to establish the identity of its customers.\u201d Under traditional due diligence programs, federal banking regulations require a\u00a0bank to obtain a customer\u2019s name, date of birth, home address, and full Social Security number or other identification number.<\/p>\n\n\n\n To receive a Cash App Visa prepaid debit card, the complaint says, a user would provide a name, date of birth and only the last four digits of their Social Security number and a \u201cmailing address\u201d for the card. This is not the same as a home address and could include post office boxes, the complaint notes. Most of the Visa cards were \u201cvirtual\u201d and sent to a customer\u2019s email address, the whistleblowers said.<\/p>\n\n\n\n The Cash App spokesperson said the company receives full Social Security numbers of customers from a vendor.<\/p>\n\n\n\n In 2018, Cash App began offering transactions in bitcoin, opening the app\u2019s flawed customer due diligence to terrorist financing worldwide, the whistleblowers said. The Cash App spokesperson disputed this, saying bitcoin customers must go through full identity verification and ongoing sanctions screening.<\/p>\n\n\n\n Marqeta, based in Oakland, California, creates digital payment technologies and provides issuer processor and card manager services. It launched its platform publicly in 2014, and Marqeta issued shares<\/a> to the public in 2021 at $27 each. Today the company\u2019s stock trades around $6.<\/p>\n\n\n\n Block is Marqeta\u2019s largest customer, generating 72% of Marqeta\u2019s net revenue during the first nine months of 2023, regulatory filings show. For the first nine months of 2023, 77% of Marqeta payment transactions went through Sutton Bank.<\/p>\n\n\n\n Visa\u2019s involvement in the Cash Card is problematic because of the potential for illegal activity, the complaints say. \u201cVisa has its own compliance requirements and tight limitations on the issuance and use of prepaid cards,\u201d the complaint alleges, but it waived standard anti-money laundering restrictions for Cash App. The whistleblowers speculated that this may have occurred because in 2017, Visa led a $25 million\u00a0investment<\/a>\u00a0in Marqeta with some of the startup\u2019s existing investors.<\/p>\n\n\n\n The whistleblowers told NBC News that Cash App seemed to heighten its due diligence on customers in 2023 and a Cash App executive confirmed that the company currently requires new customers to provide a full nine-digit Social Security number. <\/p>\n\n\n\n But, the whistleblowers say, Cash App appears not to have closed accounts that were opened with inadequate vetting. Evidence for this, they said, can be seen in the market for buying access to Cash App accounts set up in the earlier years of the program when due diligence was spotty and creating the accounts didn\u2019t require identifying information, which allows buyers to avoid the due diligence involved in setting up a new account. Existing Cash App accounts offered for sale on the internet, can go for above $150, up from $50 previously, the whistleblowers told NBC News.<\/p>\n\n\n\n Scrutiny of digital payment systems like Cash App is rising at other agencies. In November, the Consumer Finance Protection Bureau proposed new federal oversight of companies offering digital payment apps.\u00a0\u201cBig Tech and other companies operating in consumer finance markets blur the traditional lines that have separated banking and payments from commercial activities,\u201d the bureau said in the November\u00a0announcement<\/a>. That blurring can put consumers at risk, the bureau said.<\/p>\n\n\n\n‘Economic empowerment’<\/strong><\/h2>\n\n\n\n
Speed in banking<\/strong><\/h2>\n\n\n\n