The payment app, used by millions and celebrated by rappers, “had no effective procedure” to establish the true identity of customers, two whistleblowers told officials.
Federal financial regulators are exploring allegations by two whistleblowers that Cash App, the popular mobile payment platform, and entities providing transaction services to its users performed inadequate due diligence on customers, potentially opening the door to money laundering, terrorism financing and other illegal activities.
While banks are required to know the true identity of every customer, the Cash App program “had no effective procedure to establish the identity of its customers,” the whistleblowers said. In their complaints, reviewed by NBC News, the whistleblowers detail an array of questionable Cash App transactions with entities under sanction by the Treasury Department’s Office of Foreign Assets Control, operations known to sell personal information and credit card data for illegal purposes, and offshore gambling sites barred to U.S. citizens.
Among the big-name companies partnering with Cash App are Visa Inc., the giant payment processor, and Wells Fargo.
The whistleblowers filed their complaint with the Financial Crimes Enforcement Network, or FinCEN, a unit of the U.S. Treasury that administers the Bank Secrecy Act and analyzes financial transactions to combat money laundering, terrorist financing and other illicit activities. Early last month, FinCEN officials spoke at length with the whistleblowers, their lawyer told NBC News, and said they were referring the complaint to internal investigators as well as to other federal agencies. As is its custom, FinCEN declined to comment on the existence of the submission.
Over three-quarters of U.S. adults have used a mobile payment app, such as Cash App, PayPal or Venmo, according to a 2023 study by the Consumer Finance Protection Bureau. But these services, also known as person-to-person payment platforms, pose risks to their users and to the financial system, regulators say. In recent years, for example, law enforcement officials have cited criminals’ use of payment apps to evade laws, such as laundering stolen Covid relief funds in 2020.
Customers of Cash App, introduced in 2013, can instantly send and receive money among themselves, and buy stocks and Bitcoin. They can also spend or withdraw funds using Cash Card, a prepaid Visa debit card. As of September 2023, Cash App had 55 million active transacting accounts and generated $239 billion of inflows during the prior four quarters, the company said. Cash App is so popular it has been referenced in hundreds of rap songs, sometimes in connection with illegal activities.
In addition to FinCEN, the whistleblowers made submissions alleging due diligence flaws at Cash App to the Securities and Exchange Commission, the nation’s top securities cop, and the Commodities Futures Trading Commission, which combats fraud in the market for digital assets, their lawyer said. The SEC declined to comment on the existence of a whistleblower submission; the CFTC did not respond to a request for comment.
“There are obvious national security issues here and it would be foolhardy for the public to think that regulators and law enforcement are keeping pace with the financial ‘innovators,’” said Edward Siedle, a former SEC enforcement lawyer who represents the whistleblowers. NBC News interviewed the whistleblowers, who are knowledgeable on financial services compliance issues, on the condition of anonymity.
The whistleblowers’ filings arrive as regulators are increasing scrutiny on deficient anti-money laundering practices. On Monday, FinCEN proposed a rule that would require investment advisers to adopt systems to prevent money laundering and terrorism financing and report suspicious transactions to the agency. Such advisers oversee trillions of dollars but are not currently subject to these requirements, FinCEN said.
And in December 2022, federal prosecutors and the SEC took action against Danske Bank, Denmark’s largest, for lying about inadequate transaction monitoring systems that allowed tainted money to enter the U.S. financial system. The bank pleaded guilty to defrauding banks through its lax compliance and forfeited $2 billion. And
Cash App is not a bank and uses an array of banking partners to conduct certain of its services. Wells Fargo, for example, holds Cash App users’ funds in a pooled deposit account, making them eligible for FDIC insurance. Until 2021, Lincoln Savings Bank of Iowa handled incoming deposits by Cash App customers. Sutton Bank, a nine-branch institution in Attica, Ohio, issues Cash App’s prepaid Visa debit cards.
Former Treasury Secretary Larry Summers attends the official White House portrait unveiling ceremony for President Barack Obama and former First Lady Michelle Obama in the East Room of the White House on Sept. 7, 2022.
Former Treasury Secretary Larry Summers, shown in 2022, resigned last week from the board of Block, the parent company of Cash App.Tom Williams / CQ-Roll Call, Inc via Getty Images file
Prepaid debit cards are a platform for potential illegality, according to a 2020 report from Standard & Poor’s Global Market Intelligence. It described how payment processors, banks and other issuers of prepaid debit cards are “exposed to criminal activity that could lead to reputational damage and run-ins with regulators.”
The whistleblowers’ allegations cover 2016 through 2022 and describe “a shadow financial system beyond the reach of regulators” where due diligence on Cash App’s users was negligible and often did not adhere to sound banking practices and rules. In addition, Cash App’s use of different institutions providing services for users prevents bank regulators from seeing the full scope of the transactions at the institutions they monitor, the submissions say. The siloed structure of the Cash App machine, the whistleblowers say, “misdirects the attention of regulators.”
‘Economic empowerment’
Lax due diligence on Cash App customers poses risks for shareholders of its parent, Block Inc., the enormous fintech founded by Jack Dorsey, co-founder of Twitter, the whistleblowers said. Ditto for Marqeta Inc., a financial technology startup that acts as a middleman transferring funds for Cash App transactions, and Visa Inc., whose name is on the Cash Card. Shareholders of all three companies have not been fully advised of the risks associated with the Cash App business, the submissions contend.
On Feb. 9, Larry Summers, a former Treasury secretary, resigned from the board of Block, effective immediately, after more than a decade of service. The company said his resignation was not a result of disagreements over its operations or practices and that he was departing to devote more time to his other commitments.
Lincoln Savings Bank, with locations in central and northeastern Iowa, is also highlighted in the complaints. Lincoln began handling customer deposits into Cash App accounts in 2016, the complaints said, and was responsible for conducting due diligence required under banking laws to determine their identities and ensure their funds were not tainted by illegal activities. Lincoln’s vetting process was minimal and did not align with regulations, the complaints allege; Cash App pressed Lincoln to forgo traditional customer due diligence to ease the process of opening accounts and to generate revenues, the whistleblowers said.
NBC News described the whistleblowers’ allegations to Cash App and asked it to comment on them. A spokesperson, who communicated with NBC News on the condition of anonymity, declined to respond on the record. Statements attributable to the company were provided on background via email.
“The bank partnership model allows Cash App to offer certain financial services products (such as the Cash App Card) that are a benefit to our customers and further our purpose of economic empowerment,” the statement said. The company performs due diligence on customers, the statement continued, employing “several hundred people who support Cash App’s Know Your Customer/due diligence, anti-money laundering and related compliance functions, and augment that workforce with supplemental staffing and resources.”
Like all financial services companies, the company added, “Cash App is not immune to bad actors attempting to use the platform for illicit purposes.” It partners with law enforcement “to help disrupt illegal or illicit activity.”
The spokesperson did not respond to allegations that the company pressured Lincoln Savings Bank to minimize due diligence and declined to say why Cash App stopped working with Lincoln in 2021. Cash App’s bank partnership model and fund-flows structure “are standard in the industry,” the statement said, “and are known to regulators. We collaborate with our bank partners on controls and monitoring for the activities they are responsible for.”
A representative at Visa Inc. declined to comment on the whistleblowers’ allegations, and Lincoln Savings Bank did not respond to requests for comment.
A Marqeta spokesman said in a statement: “We take our obligations seriously and stand behind our disclosures regarding the risks associated with our business.”
Wells Fargo said it takes its obligations under anti-money laundering laws seriously and that it requires its payment services clients such as Cash App to do the same. “We conduct ongoing due diligence, including account analysis and monitoring, and where we identify suspicious activity, we report it,” the bank said in a statement.
Sutton Bank, issuer of the Cash App prepaid debit card, confirmed it has no way of knowing the sources of funds transferred from Cash App accounts to the debit card for withdrawals. Those funds come into the bank in large commingled blocks from Marqeta when a customer uses the Cash Card at an ATM or store.
“We’re an issuer to the card product to spend funds that you have with Block in your Cash App account, but that’s it,” said Mark T. Dabertin, Sutton’s general counsel and chief compliance officer. “We track ongoing monitoring of the spending activity for the card; we don’t get any visual into how the money gets in there. We report on unusual activity affecting the card usage.” Sutton’s compliance staff is “a very robust group,” he said.
Speed in banking
Cash App is a money machine for Block, generating net revenue of $10.4 billion during the first 9 months of 2023, or 65% of Block’s net revenue, its regulatory filings show. Cash App produced $2.9 billion in gross profit for Block during the first 9 months of 2023, up 37% year over year, the company said. Block has a market value of $38 billion.
In 2016, Cash App began working with Lincoln Savings Bank to handle customers’ deposits into their accounts. Lincoln, which opened in 1902 as a one-branch agricultural bank in Iowa, is now a fintech pioneer with $1.8 billion in assets.
Its LSB Financial Technologies unit offers virtual cards, mobile wallets and payment processing and “has created processes to allow for something unusual in banking — speed.”
Working with Cash App, Lincoln Savings Bank opened a pooled account where Cash App participants’ money was deposited and held briefly until it was transferred by Marqeta to Sutton Bank for Cash Card use or to Wells Fargo. When Cash App customers want to spend funds or withdraw money at an ATM, their Cash Cards are loaded with money from their Cash App account. At all other times, the Cash Card has a zero balance, Sutton says.
This setup meant that neither Lincoln Savings Bank nor Sutton Bank could monitor both the people sending the money and those withdrawing it, the whistleblowers explained. Lincoln only saw the incoming money while Sutton watched it exit. Cash App and Marqeta, neither of them banks, have views of the entire transactions, the whistleblowers said.
In the rush to attract Cash App users, neither Cash App nor Lincoln performed extensive due diligence on customers, the whistleblowers contend. For example, Cash App allowed access to the Lincoln pooled bank account for customers presenting just an email address or a phone number, the complaint said, and Lincoln “had no effective procedure to establish the identity of its customers.” Under traditional due diligence programs, federal banking regulations require a bank to obtain a customer’s name, date of birth, home address, and full Social Security number or other identification number.
Scammers using quick pay apps like Zelle to steal money
To receive a Cash App Visa prepaid debit card, the complaint says, a user would provide a name, date of birth and only the last four digits of their Social Security number and a “mailing address” for the card. This is not the same as a home address and could include post office boxes, the complaint notes. Most of the Visa cards were “virtual” and sent to a customer’s email address, the whistleblowers said.
The Cash App spokesperson said the company receives full Social Security numbers of customers from a vendor.
In 2018, Cash App began offering transactions in bitcoin, opening the app’s flawed customer due diligence to terrorist financing worldwide, the whistleblowers said. The Cash App spokesperson disputed this, saying bitcoin customers must go through full identity verification and ongoing sanctions screening.
Marqeta, based in Oakland, California, creates digital payment technologies and provides issuer processor and card manager services. It launched its platform publicly in 2014, and Marqeta issued shares to the public in 2021 at $27 each. Today the company’s stock trades around $6.
Block is Marqeta’s largest customer, generating 72% of Marqeta’s net revenue during the first nine months of 2023, regulatory filings show. For the first nine months of 2023, 77% of Marqeta payment transactions went through Sutton Bank.
Visa’s involvement in the Cash Card is problematic because of the potential for illegal activity, the complaints say. “Visa has its own compliance requirements and tight limitations on the issuance and use of prepaid cards,” the complaint alleges, but it waived standard anti-money laundering restrictions for Cash App. The whistleblowers speculated that this may have occurred because in 2017, Visa led a $25 million investment in Marqeta with some of the startup’s existing investors.
The whistleblowers told NBC News that Cash App seemed to heighten its due diligence on customers in 2023 and a Cash App executive confirmed that the company currently requires new customers to provide a full nine-digit Social Security number.
But, the whistleblowers say, Cash App appears not to have closed accounts that were opened with inadequate vetting. Evidence for this, they said, can be seen in the market for buying access to Cash App accounts set up in the earlier years of the program when due diligence was spotty and creating the accounts didn’t require identifying information, which allows buyers to avoid the due diligence involved in setting up a new account. Existing Cash App accounts offered for sale on the internet, can go for above $150, up from $50 previously, the whistleblowers told NBC News.
Scrutiny of digital payment systems like Cash App is rising at other agencies. In November, the Consumer Finance Protection Bureau proposed new federal oversight of companies offering digital payment apps. “Big Tech and other companies operating in consumer finance markets blur the traditional lines that have separated banking and payments from commercial activities,” the bureau said in the November announcement. That blurring can put consumers at risk, the bureau said.
February 16, 2024 Published by NBC News.
