Centralized exchange in Puerto Rico

Required License: Money Transmitter License (MTL) from the OCFI.

FinCEN: Also requires MSB registration (as a money transmitter) with FinCEN.

Net Worth: Applicants must demonstrate a minimum net worth. For a Puerto Rico Money Transmitter License, Act No. 93, Article 5, generally requires a minimum net worth of $100,000 for the first location and an additional $50,000 for each additional location or authorized agent (up to a maximum of $500,000).

Surety Bond: Licensees must maintain a surety bond to protect consumers. The bond amount is determined by the Commissioner based on the anticipated volume of business, typically ranging from a minimum of $10,000 up to a maximum of $500,000.

Physical Office: Licensees generally need to maintain a physical office or place of business within Puerto Rico.

Agent for Service of Process: A designated agent for service of process in Puerto Rico is usually required.

Comprehensive AML Program: Licensed entities must establish and maintain a robust Anti-Money Laundering and Counter-Financing of Terrorism (AML/CFT) program. This includes:

OFAC Compliance: Compliance with sanctions administered by the Office of Foreign Assets Control (OFAC) is also mandatory.

Management Experience & Background Checks: Key personnel (directors, officers, significant shareholders) will undergo thorough background checks (including criminal history, financial history, and regulatory disciplinary actions).

Business Plan: A detailed business plan outlining services, target market, operational procedures, risk management, and financial projections.

Financial Statements: Audited financial statements for existing businesses, and projected financials.

Designate an AML Compliance Officer.

Implement internal policies, procedures, and controls.

Provide ongoing employee training.

Conduct independent reviews/audits of the program.

For Individuals: Obtaining name, date of birth, residential address, and an identification number (e.g., Social Security Number, passport number, alien identification card number).

For Entities: Obtaining the legal name, principal place of business, and often identifying the beneficial owners of the entity.

Risk-Based Approach: Conducting due diligence commensurate with the risks presented by the customer relationship. Higher-risk customers (e.g., those from high-risk jurisdictions, politically exposed persons - PEPs, or engaging in complex/unusual transactions) require Enhanced Due Diligence (EDD).

Beneficial Ownership Identification: For legal entity customers, VASPs must identify and verify the identity of beneficial owners (individuals who directly or indirectly own 25% or more of the equity interests, and a single individual with significant responsibility to control, manage, or direct the legal entity customer).

Requirement: VASPs must report suspicious transactions to FinCEN by filing a Suspicious Activity Report (SAR).

Threshold: A SAR must be filed for any transaction(s) conducted or attempted by, at, or through the VASP that involves at least $5,000 in funds or other assets, if the VASP knows, suspects, or has reason to suspect that the transaction:

Timeline: SARs generally must be filed within 30 calendar days after the date of initial detection of facts that may constitute a basis for filing a SAR. If no suspect is identified, the VASP may have an additional 30 days (total of 60 days).

Ongoing Monitoring: Continuously monitoring customer transactions and activities for suspicious behavior.

For transfers between financial institutions (VASPs), the Travel Rule requires the transmittal of specific originator and beneficiary information for transactions greater than $3,000.

FinCEN has also clarified that for transactions involving a VASP and an unhosted wallet (or person-to-person transfer), additional record-keeping requirements apply for transactions greater than $3,000.

Which VASPs Are Covered:

Puerto Rico Uniform Securities Act (Law No. 60-2020), Article 1.102(28): Defines "security" to include, among other things, "investment contract." This broad definition allows OCIF to apply the Howey Test framework to novel instruments like cryptocurrency tokens.

An investment of money (or other value): The investor contributes capital or other valuable consideration. For crypto, this is typically the purchase of tokens with fiat or other cryptocurrencies.

Required License: The application of the Money Transmitters Act to purely crypto-to-crypto exchanges can be a grey area in some jurisdictions. However, OCFI, like many other U.S. state regulators, generally takes a broad interpretation that if the virtual assets are considered "value" or "funds" and the entity facilitates their transfer for others, an MTL is likely required. It is best practice to assume an MTL is needed or seek specific guidance from OCFI.

Department of Economic Development and Commerce (DDEC): Created its own regulatory framework in February 2023, extending Act 60 tax exemptions to blockchain-related ventures

Criminal Penalties: For willful violations, individuals and entities can face imprisonment and substantial criminal fines.

Bank Secrecy Act (BSA) (31 U.S.C. § 5311 et seq.): This is the foundational AML legislation in the U.S. It requires financial institutions (including MSBs/VASPs) to keep records and file reports on certain financial transactions.