Puerto Rico

**An investment of money (or other value):** The investor contributes capital or other valuable consideration. For crypto, this is typically the purchase of tokens with fiat or other cryptocurrencies.

**In a common enterprise:** The fortunes of the investor are interwoven with those of the promoter or a third party, or with those of other investors. This can be horizontal (pooling of funds among multiple investors) or vertical (investor's success tied to the promoter's efforts).

**With an expectation of profit:** The investor is motivated by the prospect of financial returns, rather than merely consuming a good or service. This profit can be in the form of capital appreciation, dividends, or other returns.

**To be derived solely (or primarily) from the efforts of others:** The investor does not contribute significantly to the management or operational success of the enterprise; instead, they rely on the entrepreneurial or managerial efforts of the promoter or a third party. The "solely" has been interpreted broadly by courts as "primarily."

**Puerto Rico Uniform Securities Act (Law No. 60-2020), Article 1.102(28)**: Defines "security" to include, among other things, "investment contract." This broad definition allows OCIF to apply the Howey Test framework to novel instruments like cryptocurrency tokens.

**Security Tokens / Investment Tokens:** Tokens explicitly designed to represent ownership (e.g., equity, debt), a share in profits, or other traditional investment rights in an underlying asset or enterprise will almost certainly be considered securities. Examples include:

Tokens that grant voting rights, dividends, or a share of future profits of a company.

Tokens representing a fractionalized ownership interest in real estate, art, or other assets managed by a third party.

**Initial Coin Offerings (ICOs) & Token Generation Events (TGEs):** Many tokens sold in these events, especially during their initial fundraising phase, are likely to be deemed securities because purchasers are typically investing money in a common enterprise with an expectation of profit based on the issuer's or developers' efforts to build and grow the project.

A token *might not* be a security if it has immediate, consumptive utility within a functional network or platform, and its primary purpose is to access a product or service, not to serve as an investment.

**However,** even a "utility token" can be deemed a security if:

It is marketed as an investment opportunity.

Its functionality is not yet developed, and investors are relying on the efforts of the issuer to build the platform.

There's a reasonable expectation of appreciation based on the issuer's efforts.

The token is sold to the general public before a fully developed product or service exists.

**Non-Fungible Tokens (NFTs):** Most NFTs, when simply representing a unique digital collectible, art, or access pass, are unlikely to be securities. However, an NFT *could* be a security if:

It is fractionalized and sold to multiple investors with an expectation of profit.

It is marketed with a promise of future royalties, passive income, or capital appreciation based on the promoter's efforts (e.g., an NFT tied to a revenue-generating project managed by the issuer).

**Stablecoins:** Generally, stablecoins are not considered securities themselves, as they are typically designed to maintain a stable value. However, structured products involving stablecoins (e.g., interest-bearing accounts, pooled stablecoin investments where profits are derived from third-party management) *could* trigger securities classification.

**Registration:** The issuer would typically need to file a registration statement with OCIF, providing comprehensive disclosures about the token, the project, the issuer, risks, and financial information. This is a complex and costly process.

**Exemptions:** Puerto Rico's securities laws generally provide exemptions mirroring federal exemptions, such as:

**Private Placements (e.g., similar to Reg D):** Offerings made to a limited number of sophisticated investors, or those meeting specific accreditation standards, without general solicitation or advertising. These often require a notice filing with OCIF.

**Limited Offerings:** Offerings to a small number of persons (e.g., 10-25) in Puerto Rico during a 12-month period, without general solicitation and primarily for investment purposes.

**Institutional Investors:** Sales to qualified institutional buyers or other specified financial institutions.

**Federal Covered Securities:** Under the National Securities Markets Improvement Act (NSMIA), certain federally registered offerings (e.g., on national exchanges) are "federal covered securities" and are exempt from state-level registration, though states can still require notice filings and collect fees.

**Registration/Exemption for Resales:** Subsequent sales of security tokens must also be registered or qualify for an exemption.

**Restricted Securities:** Tokens acquired in unregistered, exempt offerings (e.g., private placements) are generally considered "restricted securities" and cannot be freely resold in the secondary market without registration or a valid exemption (e.g., after a certain holding period, similar to SEC Rule 144).

**Control Securities:** Tokens held by affiliates of the issuer are "control securities" and face similar restrictions on resale.

**Exchanges/Platforms:** Any platform or exchange facilitating the trading of security tokens in Puerto Rico would likely need to register as a broker-dealer, an exchange, or an alternative trading system (ATS) with OCIF, depending on its functions and the volume of trading. Operating an unregistered exchange for security tokens is a violation of securities law.

**Anti-Fraud Provisions:** All secondary trading, even if exempt from registration, remains subject to the anti-fraud provisions of the Puerto Rico Uniform Securities Act.

**Advisories and Warnings:** OCIF has issued public warnings to consumers regarding the risks associated with cryptocurrency investments, emphasizing the speculative nature and potential for fraud. These warnings serve as a form of regulatory guidance and underscore OCIF's readiness to act.

**Example:** OCIF issued a "Warning to Consumers Regarding Investments in Digital Assets" (Alerta a Consumidores Sobre Inversiones en Activos Digitales) emphasizing that many digital assets fall under the definition of securities and are subject to registration, and cautioning against fraud and volatility.

**Following Federal Precedent:** OCIF closely monitors enforcement actions by the U.S. Securities and Exchange Commission (SEC) and the Commodity Futures Trading Commission (CFTC). It is highly likely that OCIF would take similar enforcement stances against issuers or platforms offering unregistered crypto securities to Puerto Rico residents that violate the Howey Test framework.

**Cease and Desist Orders:** OCIF has the authority to issue cease and desist orders against individuals or entities found to be offering or selling unregistered securities, or engaging in fraudulent activities.

**Fines and Penalties:** Violations of the Puerto Rico Uniform Securities Act can result in significant administrative fines, disgorgement of ill-gotten gains, and even criminal penalties for severe offenses.

**A common reference point for PR laws:** LexisNexis Puerto Rico (often subscription-based).

**An accessible government source for legislative acts:** *Oficina de Servicios Legislativos de Puerto Rico* (Legislative Services Office of PR) might have an archive of laws. Searching for "Ley 60-2020" on their portal would be the way to go.

*Example of a non-official but widely cited source for the text:* https://www.lexpr.com/leyes/pr/l60-2020.pdf (This is a PDF version, not an official government URL, but frequently linked by law firms).

**OCIF Warning to Consumers Regarding Investments in Digital Assets:**

Search OCIF's "Alertas a Consumidores" or "Comunicados de Prensa" sections on their website.

While direct links can change, an example of this type of advisory can be found on their site, typically under "Alertas" or "Noticias."

*Direct link to a similar alert (example, actual date may vary):* https://ocif.pr.gov/alertas-a-consumidores/ (You would then need to navigate or search for the specific "Activos Digitales" alert if available.)

**U.S. Federal Agencies (implicitly apply due to Puerto Rico's status):**

**Financial Crimes Enforcement Network (FinCEN):** For Anti-Money Laundering (AML) and Counter-Terrorist Financing (CTF) compliance, especially for money service businesses (MSBs) that deal with virtual assets.

**Securities and Exchange Commission (SEC):** If a virtual asset is deemed a "security" under the Howey test, it falls under SEC jurisdiction regarding issuance, trading, and investment.

**Commodity Futures Trading Commission (CFTC):** If a virtual asset is deemed a "commodity" (like Bitcoin or Ethereum), the CFTC has jurisdiction over derivatives products and fraud/manipulation in the spot market.

**Internal Revenue Service (IRS):** For taxation of virtual assets.

**Puerto Rico Money Services Act (Act No. 13 of January 19, 2020):** This law replaced previous money transmission statutes. It defines "money services" broadly, which can encompass certain activities involving virtual assets. Entities that engage in exchanging virtual assets for fiat currency, or transmitting virtual assets, especially if they take custody, may be required to obtain a money transmitter license from OCIF under this Act.

**Reference:** Ley de Servicios Monetarios de Puerto Rico, Ley Núm. 13 de 19 de enero de 2020.

*While an official URL to the full text on a government site is not always stable, the legislative portal for Puerto Rico is generally:* http://www.jp.pr.gov/ (search for Act 13 of 2020).

**Puerto Rico International Financial Center Regulatory Act (Act No. 273 of December 29, 2012, as amended):** This Act governs International Financial Entities (IFEs) in Puerto Rico, which are granted specific licenses to conduct international financial business. While not directly aimed at crypto, OCIF has issued guidance regarding IFEs engaging in virtual asset activities. An IFE can *potentially* engage in digital asset business if specifically authorized by OCIF and if such activities fall within the permitted scope of an IFE license.

**Reference:** Ley Reguladora del Centro Financiero Internacional de Puerto Rico, Ley Núm. 273 de 29 de diciembre de 2012.

*Available via the legislative portal:* http://www.jp.pr.gov/ (search for Act 273 of 2012).

**OCIF Interpretive Letters and Circulars:** These provide specific guidance on how existing laws apply to virtual assets.

**OCIF Interpretive Letter IFE-2018-001 (February 27, 2018):** Clarifies that an International Financial Entity (IFE) licensee must obtain explicit authorization from the Commissioner to conduct any business related to virtual currencies. The Commissioner will evaluate such requests on a case-by-case basis, considering the nature of the business, safeguards, and compliance with anti-money laundering (AML) requirements.

*Finding direct URLs to historical interpretive letters on OCIF's site can be challenging, but they are frequently cited by law firms and legal analyses.*

**OCIF Circular Letter CC-2017-004 (December 27, 2017):** Reminded all entities subject to OCIF's jurisdiction (including money transmitters) that virtual currency activities must comply with existing laws, including anti-money laundering obligations and the requirement to obtain appropriate licenses if their activities fall under regulated financial services.

*Similar to above, direct URLs may be elusive, but the content is widely documented.*

**Not Banned, but Regulated:** Crypto trading and exchanges are generally permitted but are subject to existing financial regulations, particularly if they involve fiat currency or custody of virtual assets.

**Money Transmitter Licensing:** Entities operating crypto exchanges that facilitate the exchange of fiat currency for virtual currency (or vice versa), or that hold customers' virtual assets in custody and facilitate transfers, are very likely to be considered **money transmitters** under the Puerto Rico Money Services Act (Act No. 13 of 2020). As such, they would require a license from OCIF and must comply with AML/CTF regulations (including FinCEN's requirements).

**International Financial Entities (IFEs):** As per OCIF Interpretive Letter IFE-2018-001, IFEs may engage in virtual asset activities only with explicit, case-by-case authorization from OCIF. This offers a potential pathway for sophisticated financial operations involving digital assets, provided stringent compliance and safeguards are in place.

**Securities Laws:** If a particular crypto asset is deemed a "security," then its offering and trading would fall under the Puerto Rico Securities Act (Act No. 66 of 1974) as well as the U.S. federal securities laws (SEC).

**Compliance is Key:** Any entity or individual involved in virtual asset activities in Puerto Rico must ensure compliance with both local OCIF regulations (especially for money transmission) and applicable U.S. federal laws, including AML/CTF (FinCEN), securities (SEC), and commodities (CFTC) rules. Due diligence and legal counsel are highly recommended.

**Internal Revenue Service (IRS)**: Federal guidance applies due to U.S. territory status; no specific crypto rules for Act 60 "tainted property," but pre-residency gains are taxable.[3][7]

**Puerto Rico House of Representatives**: Investigates regulatory frameworks (e.g., 2022 resolution).[3]

**Bank Secrecy Act (BSA) (31 U.S.C. § 5311 et seq.):** This is the foundational AML legislation in the U.S. It requires financial institutions (including MSBs/VASPs) to keep records and file reports on certain financial transactions.

**FinCEN Regulations (31 CFR Chapter X):** FinCEN, a bureau of the U.S. Department of the Treasury, issues regulations implementing the BSA.

**Guidance on Application of FinCEN's Regulations to Persons Administering, Exchanging, or Using Virtual Currencies (FIN-2013-G001, March 18, 2013):** This initial guidance clarified that exchangers and administrators of virtual currency are "money transmitters" under the BSA.

**Application of FinCEN’s Regulations to Certain Business Models Involving Convertible Virtual Currencies (FIN-2019-G001, May 9, 2019):** This updated guidance broadened the scope, clarifying that various VASP models (e.g., peer-to-peer exchangers, DApps, anonymity-enhanced coin providers) may also be MSBs.

**Interpretive Ruling on the Application of the BSA to Mixed-Currency Transactions and Other Related Transactions (FIN-2023-R001, October 26, 2023):** Clarifies that transactions involving both fiat currency and CVC are covered by BSA requirements.

**FATF Standards:** While not direct legislation, the U.S. is a member of the Financial Action Task Force (FATF), and FinCEN's guidance is designed to align with FATF recommendations, particularly **Recommendation 15** which specifically addresses new technologies and the "Travel Rule" for VASPs.

**Puerto Rico Money Services Business Act (Act No. 17-2016):** This act regulates money services businesses in Puerto Rico, including licensing, examination, and enforcement. VASPs operating as money transmitters in Puerto Rico are typically required to obtain a license under this Act and comply with its provisions, which include AML program requirements.

**Office of the Commissioner of Financial Institutions (OCFI) Regulations:** OCFI issues regulations and circular letters to implement Act 17-2016 and other financial laws, which would apply to licensed entities, including VASPs.

Designate an AML Compliance Officer.

Implement internal policies, procedures, and controls.

Conduct independent reviews/audits of the program.

**For Individuals:** Obtaining name, date of birth, residential address, and an identification number (e.g., Social Security Number, passport number, alien identification card number).

**For Entities:** Obtaining the legal name, principal place of business, and often identifying the beneficial owners of the entity.

**Verification Procedures:** Using reliable, independent source documents (e.g., driver's license, passport, utility bill) or non-documentary methods (e.g., credit report, public databases).

**Risk-Based Approach:** Conducting due diligence commensurate with the risks presented by the customer relationship. Higher-risk customers (e.g., those from high-risk jurisdictions, politically exposed persons - PEPs, or engaging in complex/unusual transactions) require Enhanced Due Diligence (EDD).

**Beneficial Ownership Identification:** For legal entity customers, VASPs must identify and verify the identity of beneficial owners (individuals who directly or indirectly own 25% or more of the equity interests, and a single individual with significant responsibility to control, manage, or direct the legal entity customer).

**Ongoing Monitoring:** Continuously monitoring customer transactions and activities for suspicious behavior.

**Requirement:** VASPs must report suspicious transactions to FinCEN by filing a Suspicious Activity Report (SAR).

**Threshold:** A SAR must be filed for any transaction(s) conducted or attempted by, at, or through the VASP that involves at least $5,000 in funds or other assets, if the VASP knows, suspects, or has reason to suspect that the transaction:

Involves funds derived from illegal activity or is intended to hide or disguise funds derived from illegal activity.

Is designed to evade any BSA requirement.

Has no business or apparent lawful purpose or is not the sort in which the particular customer would normally be expected to engage, and the VASP knows of no reasonable explanation for the transaction after examining the available facts.

Involves the use of the VASP to facilitate criminal activity.

**Timeline:** SARs generally must be filed within 30 calendar days after the date of initial detection of facts that may constitute a basis for filing a SAR. If no suspect is identified, the VASP may have an additional 30 days (total of 60 days).

**Confidentiality:** SAR filings are strictly confidential and must not be disclosed to the persons involved in the transaction or to unauthorized third parties.

**Customer Identification Records:** All information obtained during the CIP process.

Records of funds transfers, including the "Travel Rule" data for transactions exceeding specific thresholds (typically $3,000 for transfers, but for virtual assets, FinCEN has advised the Travel Rule generally applies to transactions over $3,000 for fiat and $10,000 for virtual asset transfers). This includes originator and beneficiary names, account numbers, addresses, and other identifying information.

Records for currency transactions over $10,000 (Currency Transaction Reports - CTRs). While not directly applicable to crypto in the same way, equivalent records for large virtual asset exchanges are expected.

Records of purchases and sales of monetary instruments.

**AML Program Documentation:** Policies, procedures, risk assessments, training materials, and audit reports.

**SARs:** Copies of all SARs filed and supporting documentation.

**Financial Crimes Enforcement Network (FinCEN):**

**Role:** FinCEN is the lead administrator of the BSA and the primary regulator for AML/CFT compliance for MSBs (including VASPs) at the federal level. It issues regulations, guidance, and enforces compliance.

**Role:** OCFI is the financial regulatory authority in Puerto Rico responsible for licensing, examining, and supervising financial institutions, including money services businesses, under local law (like Act No. 17-2016). They ensure compliance with Puerto Rico's financial laws and often collaborate with federal authorities on AML/CFT matters.

**Required License:** **Money Transmitter License (MTL)** from the OCFI.

**Reasoning:** When an exchange facilitates the exchange of fiat currency for virtual assets, or vice-versa, it is performing a money transmission service by accepting funds (fiat or virtual assets) from one party and making them available to another, or transmitting funds on behalf of consumers.

**FinCEN:** Also requires **MSB registration** (as a money transmitter) with FinCEN.

**Required License:** The application of the Money Transmitters Act to purely crypto-to-crypto exchanges can be a grey area in some jurisdictions. However, OCFI, like many other U.S. state regulators, generally takes a broad interpretation that if the virtual assets are considered "value" or "funds" and the entity facilitates their transfer for others, an **MTL is likely required**. It is best practice to assume an MTL is needed or seek specific guidance from OCFI.

**FinCEN:** FinCEN's guidance explicitly states that exchangers of convertible virtual currency (even crypto-to-crypto) are MSBs and must **register** as such.

**Required License:** If a custody provider holds virtual assets on behalf of others and facilitates their transfer or makes them available to others, they are generally considered to be performing a "money transmission" function. Therefore, an **MTL from OCFI** is typically required.

**FinCEN:** Entities that act as custodians of virtual currency, facilitating transfers for others, are generally considered "administrators" or "exchangers" under FinCEN guidance and must **register as an MSB**.

**Required License:** Payment processors that handle virtual assets (e.g., converting crypto payments into fiat for merchants, or vice-versa) are clearly engaged in money transmission. An **MTL from OCFI** is required.

**FinCEN:** Must **register as an MSB** (money transmitter).

**Net Worth:** Applicants must demonstrate a minimum net worth. For a Puerto Rico Money Transmitter License, Act No. 93, Article 5, generally requires a minimum net worth of **$100,000** for the first location and an additional **$50,000** for each additional location or authorized agent (up to a maximum of **$500,000**).

**Surety Bond:** Licensees must maintain a surety bond to protect consumers. The bond amount is determined by the Commissioner based on the anticipated volume of business, typically ranging from a minimum of **$10,000** up to a maximum of **$500,000**.

**Comprehensive AML Program:** Licensed entities must establish and maintain a robust Anti-Money Laundering and Counter-Financing of Terrorism (AML/CFT) program. This includes:

Designation of an AML Compliance Officer.

Customer Identification Program (CIP) procedures to verify the identity of customers.

Transaction monitoring to detect suspicious activity.

Reporting suspicious transactions (SARs) and large cash transactions (CTRs) to FinCEN, as required by the Bank Secrecy Act (BSA) and its implementing regulations (31 CFR Chapter X).

**OFAC Compliance:** Compliance with sanctions administered by the Office of Foreign Assets Control (OFAC) is also mandatory.

**Physical Office:** Licensees generally need to maintain a physical office or place of business within Puerto Rico.

**Agent for Service of Process:** A designated agent for service of process in Puerto Rico is usually required.

**Management/Oversight:** While not always explicitly requiring local *senior* management for all roles, OCFI expects adequate local oversight and access to records.

**Business Plan:** A detailed business plan outlining services, target market, operational procedures, risk management, and financial projections.

**Management Experience & Background Checks:** Key personnel (directors, officers, significant shareholders) will undergo thorough background checks (including criminal history, financial history, and regulatory disciplinary actions).

**Financial Statements:** Audited financial statements for existing businesses, and projected financials.

**Technology & Security:** Documentation of the technology infrastructure, cybersecurity measures, data protection protocols, and disaster recovery plans.

**Consumer Protection:** Measures to protect consumer funds and data.

**Pre-Application Meeting (Optional but Recommended):** Engaging with OCFI to discuss the proposed business model and clarify any initial questions.

**Preparation of Application Package:** Gathering all required documentation, which includes:

Organizational documents (articles of incorporation, bylaws, corporate structure).

Financial statements (audited financials, pro forma statements).

Personal history statements and background checks for all principals, directors, officers, and significant owners.

Evidence of required net worth and surety bond.

Draft AML/KYC compliance program and other policy documents.

Agent agreements (if using authorized agents).

**Submission of Application and Fees:** Submitting the complete package to OCFI along with the non-refundable application fees.

**Review and Due Diligence:** OCFI conducts a thorough review of the application, which may involve:

Requests for additional information or clarification.

On-site examinations or technology audits.

**Approval or Denial:** Upon satisfactory review, OCFI will issue the license. If deficiencies are found, the application may be denied or conditioned on corrective actions.

**FinCEN Registration:** Concurrently, or immediately upon receiving the state license, the entity must complete its **MSB registration with FinCEN**. This is done electronically via FinCEN's BSA E-Filing System.

**Puerto Rico Office of the Commissioner of Financial Institutions (OCFI/OCIF):**

*Note: Direct links to specific laws or application forms within OCIF's website can sometimes be dynamic or in Spanish. Navigate to "Leyes y Reglamentos" (Laws and Regulations) or "Solicitudes y Formularios" (Applications and Forms) sections.*

**Ley Núm. 93 de 1993 - Ley de Transmisores de Dinero (Money Transmitters Act):** This is the foundational law. You would typically search for "Ley de Transmisores de Dinero Puerto Rico" or "Act No. 93 of 1993" on the OCFI website or a Puerto Rico legislative database for the full text.

**Financial Crimes Enforcement Network (FinCEN):**

**Guidance on Virtual Assets (May 2019):** This is crucial for understanding FinCEN's interpretation of virtual currency activities under BSA.

"Application of FinCEN’s Regulations to Certain Business Models Involving Convertible Virtual Currencies" (FIN-2019-G001): https://www.fincen.gov/resources/statutes-regulations/guidance/application-fincen-regulations-persons-administering

**BSA E-Filing System:** Used for MSB registration and BSA reporting (SARs, CTRs): https://bsaefiling.fincen.treas.gov/