Labuan (Malaysia) -- Travel Rule Implementation Regulatory Overview

Labuan, as an international business and financial centre within Malaysia, aligns its Anti-Money Laundering and Counter-Financing of Terrorism (AML/CFT) framework with the Financial Action Task Force (FATF) Recommendations, including the "Travel Rule" for virtual assets. The Labuan Financial Services Authority (LFSA) is the primary regulator for financial services in Labuan.

Here's the status of FATF Travel Rule implementation in Labuan:

Status of FATF Travel Rule Implementation in Labuan

1. Whether Adopted: Yes, the FATF Travel Rule (FATF Recommendation 16, extended to virtual assets) has been adopted in Labuan. The requirements are enshrined in the Labuan FSA Guidelines on AML/CFT for Digital Asset Businesses.

2. Effective Date: The current Labuan FSA Guidelines on AML/CFT for Digital Asset Businesses were issued on 11 August 2022, replacing the previous guidelines issued on 13 October 2020. The Travel Rule requirements within these guidelines are effective from this date.

3. Threshold Amounts: Digital Asset Businesses in Labuan are required to comply with the Travel Rule for transactions that exceed specific thresholds:

• Cross-border transactions: Transfers exceeding RM4,000 (or equivalent to USD1,000).
• Domestic transactions: Transfers exceeding RM10,000 (or equivalent to USD3,000).

4. Which VASPs are Covered: The requirements apply to "Digital Asset Businesses" licensed and regulated by LFSA under the Labuan FSA (Business of Digital Asset) Regulations 2022. This typically includes entities engaged in:

• Operating a digital asset exchange
• Operating a digital asset trading platform
• Providing digital asset custodian services
• Other businesses dealing with or facilitating the exchange of digital assets.

These entities are defined as "Reporting Institutions" under Malaysia's Anti-Money Laundering, Anti-Terrorism Financing and Proceeds of Unlawful Activities Act 2001 (AMLA).

5. Technical Implementation Requirements: The LFSA Guidelines on AML/CFT for Digital Asset Businesses mandate that Digital Asset Businesses must collect and transmit specific information for transactions meeting the thresholds. This includes:

• Originator Information:
  • Name of the originator
  • Originator's account number (or unique transaction identifier)
  • Originator's physical address (or national identity number, customer identification number, or date and place of birth).
• Beneficiary Information:
  • Name of the beneficiary
  • Beneficiary's account number (or unique transaction identifier).

Key technical and procedural requirements include:

• Secure Transmission: The information must be transmitted securely and immediately with the virtual asset transfer.
• Verification: Digital Asset Businesses must take reasonable measures to verify the identity of their customers (originators and beneficiaries) when collecting this information.
• Record-Keeping: All collected information and records of transmission must be retained for at least 6 years.
• Policies and Procedures: VASPs must establish robust internal policies, procedures, and controls to ensure compliance with these requirements, including procedures for handling missing or incomplete information from counterparties (especially in unhosted wallet or non-compliant VASP scenarios).
• Risk Assessment: VASPs are expected to conduct a risk assessment related to their Travel Rule obligations and implement controls proportionate to their identified risks.

6. Penalties for Non-Compliance: Non-compliance with AML/CFT requirements in Labuan can lead to significant penalties, as the Digital Asset Businesses are Reporting Institutions under Malaysian law. Penalties can be levied under:

• Anti-Money Laundering, Anti-Terrorism Financing and Proceeds of Unlawful Activities Act 2001 (AMLA):
  • Individuals: Imprisonment for up to 15 years, and/or a fine not less than five times the amount of the proceeds of an unlawful activity or instrumentalities of an offence, or RM5 million, whichever is higher.
  • Corporate bodies: A fine not less than five times the amount of the proceeds of an unlawful activity or instrumentalities of an offence, or RM25 million, whichever is higher.
• Labuan Financial Services Authority (LFSA) Enforcement Powers: LFSA has wide-ranging powers under the Labuan Financial Services and Securities Act 2010 (LFSSA) and the Labuan Islamic Financial Services and Securities Act 2010 (LIFSSA). These include:
  • Issuing directives or orders.
  • Imposing administrative monetary penalties.
  • Revoking or suspending licenses.
  • Taking criminal action against individuals or entities.
  • Issuing public reprimands.

The LFSA Guidelines on AML/CFT explicitly state that non-compliance may result in enforcement action, emphasizing the serious nature of these obligations.

References:

• Labuan FSA Guidelines on AML/CFT for Digital Asset Businesses (11 August 2022):

  • https://www.lfsa.gov.my/download/4319/guidelines_on_aml_cft_for_digital_asset_businesses_11082022.pdf
  • Specifically refer to Part 4.1.2.3 "Transfers of Digital Assets" (page 49 onwards) for Travel Rule requirements.

• Labuan FSA (Business of Digital Asset) Regulations 2022:

  • https://www.lfsa.gov.my/download/4113/business-of-digital-asset-regulations-2022.pdf
  • Defines "digital asset business" requiring an LFSA license.

• Anti-Money Laundering, Anti-Terrorism Financing and Proceeds of Unlawful Activities Act 2001 (AMLA):

  • While the full Act isn't hosted by LFSA directly, it's the overarching Malaysian AML law. BNM often hosts it: https://www.bnm.gov.my/documents/20124/96092/AMLA_2001.pdf
  • Penalties are detailed in various sections, particularly Part IV.

• Labuan Financial Services and Securities Act 2010 (LFSSA):

  • https://www.lfsa.gov.my/download/2364/labuan-financial-services-and-securities-act-2010-(act-704).pdf
  • Provides LFSA's regulatory and enforcement powers.