On-shore VASP in Puerto Rico

Office of the Commissioner of Financial Institutions (OCIF): Responsible for licensing and regulating money services businesses (MSBs) and digital asset custody services

Puerto Rico Uniform Securities Act (Law No. 60-2020), Article 1.102(28): Defines "security" to include, among other things, "investment contract." This broad definition allows OCIF to apply the Howey Test framework to novel instruments like cryptocurrency tokens.

Bank Secrecy Act (BSA) (31 U.S.C. § 5311 et seq.): This is the foundational AML legislation in the U.S. It requires financial institutions (including MSBs/VASPs) to keep records and file reports on certain financial transactions.

FinCEN Regulations (31 CFR Chapter X): FinCEN, a bureau of the U.S. Department of the Treasury, issues regulations implementing the BSA.

Guidance on Application of FinCEN's Regulations to Persons Administering, Exchanging, or Using Virtual Currencies (FIN-2013-G001, March 18, 2013): This initial guidance clarified that exchangers and administrators of virtual currency are "money transmitters" under the BSA.

Application of FinCEN’s Regulations to Certain Business Models Involving Convertible Virtual Currencies (FIN-2019-G001, May 9, 2019): This updated guidance broadened the scope, clarifying that various VASP models (e.g., peer-to-peer exchangers, DApps, anonymity-enhanced coin providers) may also be MSBs.

Puerto Rico Money Services Business Act (Act No. 17-2016): This act regulates money services businesses in Puerto Rico, including licensing, examination, and enforcement. VASPs operating as money transmitters in Puerto Rico are typically required to obtain a license under this Act and comply with its provisions, which include AML program requirements.

Office of the Commissioner of Financial Institutions (OCFI) Regulations: OCFI issues regulations and circular letters to implement Act 17-2016 and other financial laws, which would apply to licensed entities, including VASPs.

Designate an AML Compliance Officer.

Implement internal policies, procedures, and controls.

Provide ongoing employee training.

Conduct independent reviews/audits of the program.

For Individuals: Obtaining name, date of birth, residential address, and an identification number (e.g., Social Security Number, passport number, alien identification card number).

For Entities: Obtaining the legal name, principal place of business, and often identifying the beneficial owners of the entity.

Risk-Based Approach: Conducting due diligence commensurate with the risks presented by the customer relationship. Higher-risk customers (e.g., those from high-risk jurisdictions, politically exposed persons - PEPs, or engaging in complex/unusual transactions) require Enhanced Due Diligence (EDD).

Beneficial Ownership Identification: For legal entity customers, VASPs must identify and verify the identity of beneficial owners (individuals who directly or indirectly own 25% or more of the equity interests, and a single individual with significant responsibility to control, manage, or direct the legal entity customer).

Ongoing Monitoring: Continuously monitoring customer transactions and activities for suspicious behavior.

Requirement: VASPs must report suspicious transactions to FinCEN by filing a Suspicious Activity Report (SAR).

Threshold: A SAR must be filed for any transaction(s) conducted or attempted by, at, or through the VASP that involves at least $5,000 in funds or other assets, if the VASP knows, suspects, or has reason to suspect that the transaction:

Timeline: SARs generally must be filed within 30 calendar days after the date of initial detection of facts that may constitute a basis for filing a SAR. If no suspect is identified, the VASP may have an additional 30 days (total of 60 days).

FinCEN Guidance (May 2019): Application of FinCEN's Regulations to Certain Business Models Involving Convertible Virtual Currencies (FIN-2019-A003)

For transfers between financial institutions (VASPs), the Travel Rule requires the transmittal of specific originator and beneficiary information for transactions greater than $3,000.

FinCEN has also clarified that for transactions involving a VASP and an unhosted wallet (or person-to-person transfer), additional record-keeping requirements apply for transactions greater than $3,000.

Which VASPs Are Covered:

Penalties for Non-Compliance:

Civil Monetary Penalties: Fines of thousands or even millions of dollars, depending on the nature and severity of the violation.

Criminal Penalties: For willful violations, individuals and entities can face imprisonment and substantial criminal fines.

Enforcement Actions: Consent orders, cease-and-desist orders, and other regulatory actions that can restrict a VASP's operations.

Required License: Money Transmitter License (MTL) from the OCFI.

FinCEN: Also requires MSB registration (as a money transmitter) with FinCEN.

FinCEN: FinCEN's guidance explicitly states that exchangers of convertible virtual currency (even crypto-to-crypto) are MSBs and must register as such.

Net Worth: Applicants must demonstrate a minimum net worth. For a Puerto Rico Money Transmitter License, Act No. 93, Article 5, generally requires a minimum net worth of $100,000 for the first location and an additional $50,000 for each additional location or authorized agent (up to a maximum of $500,000).

Surety Bond: Licensees must maintain a surety bond to protect consumers. The bond amount is determined by the Commissioner based on the anticipated volume of business, typically ranging from a minimum of $10,000 up to a maximum of $500,000.

Comprehensive AML Program: Licensed entities must establish and maintain a robust Anti-Money Laundering and Counter-Financing of Terrorism (AML/CFT) program. This includes:

Designation of an AML Compliance Officer.

Ongoing employee training.

Independent audit function.

Customer Identification Program (CIP) procedures to verify the identity of customers.

Transaction monitoring to detect suspicious activity.

OFAC Compliance: Compliance with sanctions administered by the Office of Foreign Assets Control (OFAC) is also mandatory.

Physical Office: Licensees generally need to maintain a physical office or place of business within Puerto Rico.

Agent for Service of Process: A designated agent for service of process in Puerto Rico is usually required.

Business Plan: A detailed business plan outlining services, target market, operational procedures, risk management, and financial projections.

Management Experience & Background Checks: Key personnel (directors, officers, significant shareholders) will undergo thorough background checks (including criminal history, financial history, and regulatory disciplinary actions).

Financial Statements: Audited financial statements for existing businesses, and projected financials.

Registration: The issuer would typically need to file a registration statement with OCIF, providing comprehensive disclosures about the token, the project, the issuer, risks, and financial information. This is a complex and costly process.

Exemptions: Puerto Rico's securities laws generally provide exemptions mirroring federal exemptions, such as: