Custodial wallet / SaaS in Puerto Rico

Office of the Commissioner of Financial Institutions (OCIF): Responsible for licensing and regulating money services businesses (MSBs) and digital asset custody services

Puerto Rico Uniform Securities Act (Law No. 60-2020), Article 1.102(28): Defines "security" to include, among other things, "investment contract." This broad definition allows OCIF to apply the Howey Test framework to novel instruments like cryptocurrency tokens.

Puerto Rico Money Services Business Act (Act No. 17-2016): This act regulates money services businesses in Puerto Rico, including licensing, examination, and enforcement. VASPs operating as money transmitters in Puerto Rico are typically required to obtain a license under this Act and comply with its provisions, which include AML program requirements.

Office of the Commissioner of Financial Institutions (OCFI) Regulations: OCFI issues regulations and circular letters to implement Act 17-2016 and other financial laws, which would apply to licensed entities, including VASPs.

Bank Secrecy Act (BSA) (31 U.S.C. § 5311 et seq.): This is the foundational AML legislation in the U.S. It requires financial institutions (including MSBs/VASPs) to keep records and file reports on certain financial transactions.

FinCEN Regulations (31 CFR Chapter X): FinCEN, a bureau of the U.S. Department of the Treasury, issues regulations implementing the BSA.

Guidance on Application of FinCEN's Regulations to Persons Administering, Exchanging, or Using Virtual Currencies (FIN-2013-G001, March 18, 2013): This initial guidance clarified that exchangers and administrators of virtual currency are "money transmitters" under the BSA.

Application of FinCEN’s Regulations to Certain Business Models Involving Convertible Virtual Currencies (FIN-2019-G001, May 9, 2019): This updated guidance broadened the scope, clarifying that various VASP models (e.g., peer-to-peer exchangers, DApps, anonymity-enhanced coin providers) may also be MSBs.

Designate an AML Compliance Officer.

Implement internal policies, procedures, and controls.

Provide ongoing employee training.

Conduct independent reviews/audits of the program.

For Individuals: Obtaining name, date of birth, residential address, and an identification number (e.g., Social Security Number, passport number, alien identification card number).

For Entities: Obtaining the legal name, principal place of business, and often identifying the beneficial owners of the entity.

Verification Procedures: Using reliable, independent source documents (e.g., driver's license, passport, utility bill) or non-documentary methods (e.g., credit report, public databases).

Beneficial Ownership Identification: For legal entity customers, VASPs must identify and verify the identity of beneficial owners (individuals who directly or indirectly own 25% or more of the equity interests, and a single individual with significant responsibility to control, manage, or direct the legal entity customer).

Ongoing Monitoring: Continuously monitoring customer transactions and activities for suspicious behavior.

Requirement: VASPs must report suspicious transactions to FinCEN by filing a Suspicious Activity Report (SAR).

Threshold: A SAR must be filed for any transaction(s) conducted or attempted by, at, or through the VASP that involves at least $5,000 in funds or other assets, if the VASP knows, suspects, or has reason to suspect that the transaction:

Required License: Money Transmitter License (MTL) from the OCFI.

Reasoning: When an exchange facilitates the exchange of fiat currency for virtual assets, or vice-versa, it is performing a money transmission service by accepting funds (fiat or virtual assets) from one party and making them available to another, or transmitting funds on behalf of consumers.

FinCEN: Also requires MSB registration (as a money transmitter) with FinCEN.

Required License: The application of the Money Transmitters Act to purely crypto-to-crypto exchanges can be a grey area in some jurisdictions. However, OCFI, like many other U.S. state regulators, generally takes a broad interpretation that if the virtual assets are considered "value" or "funds" and the entity facilitates their transfer for others, an MTL is likely required. It is best practice to assume an MTL is needed or seek specific guidance from OCFI.

FinCEN: FinCEN's guidance explicitly states that exchangers of convertible virtual currency (even crypto-to-crypto) are MSBs and must register as such.

Required License: If a custody provider holds virtual assets on behalf of others and facilitates their transfer or makes them available to others, they are generally considered to be performing a "money transmission" function. Therefore, an MTL from OCFI is typically required.

FinCEN: Entities that act as custodians of virtual currency, facilitating transfers for others, are generally considered "administrators" or "exchangers" under FinCEN guidance and must register as an MSB.

Net Worth: Applicants must demonstrate a minimum net worth. For a Puerto Rico Money Transmitter License, Act No. 93, Article 5, generally requires a minimum net worth of $100,000 for the first location and an additional $50,000 for each additional location or authorized agent (up to a maximum of $500,000).

Surety Bond: Licensees must maintain a surety bond to protect consumers. The bond amount is determined by the Commissioner based on the anticipated volume of business, typically ranging from a minimum of $10,000 up to a maximum of $500,000.

Comprehensive AML Program: Licensed entities must establish and maintain a robust Anti-Money Laundering and Counter-Financing of Terrorism (AML/CFT) program. This includes:

Physical Office: Licensees generally need to maintain a physical office or place of business within Puerto Rico.

Agent for Service of Process: A designated agent for service of process in Puerto Rico is usually required.

Management/Oversight: While not always explicitly requiring local senior management for all roles, OCFI expects adequate local oversight and access to records.

Business Plan: A detailed business plan outlining services, target market, operational procedures, risk management, and financial projections.

Management Experience & Background Checks: Key personnel (directors, officers, significant shareholders) will undergo thorough background checks (including criminal history, financial history, and regulatory disciplinary actions).

Financial Statements: Audited financial statements for existing businesses, and projected financials.

OFAC Compliance: Compliance with sanctions administered by the Office of Foreign Assets Control (OFAC) is also mandatory.