Remote VASP serving residents in Puerto Rico

Office of the Commissioner of Financial Institutions (OCIF): Responsible for licensing and regulating money services businesses (MSBs) and digital asset custody services

Puerto Rico Money Services Business Act (Act No. 17-2016): This act regulates money services businesses in Puerto Rico, including licensing, examination, and enforcement. VASPs operating as money transmitters in Puerto Rico are typically required to obtain a license under this Act and comply with its provisions, which include AML program requirements.

Office of the Commissioner of Financial Institutions (OCFI) Regulations: OCFI issues regulations and circular letters to implement Act 17-2016 and other financial laws, which would apply to licensed entities, including VASPs.

Bank Secrecy Act (BSA) (31 U.S.C. § 5311 et seq.): This is the foundational AML legislation in the U.S. It requires financial institutions (including MSBs/VASPs) to keep records and file reports on certain financial transactions.

FinCEN Regulations (31 CFR Chapter X): FinCEN, a bureau of the U.S. Department of the Treasury, issues regulations implementing the BSA.

Guidance on Application of FinCEN's Regulations to Persons Administering, Exchanging, or Using Virtual Currencies (FIN-2013-G001, March 18, 2013): This initial guidance clarified that exchangers and administrators of virtual currency are "money transmitters" under the BSA.

Application of FinCEN’s Regulations to Certain Business Models Involving Convertible Virtual Currencies (FIN-2019-G001, May 9, 2019): This updated guidance broadened the scope, clarifying that various VASP models (e.g., peer-to-peer exchangers, DApps, anonymity-enhanced coin providers) may also be MSBs.

Interpretive Ruling on the Application of the BSA to Mixed-Currency Transactions and Other Related Transactions (FIN-2023-R001, October 26, 2023): Clarifies that transactions involving both fiat currency and CVC are covered by BSA requirements.

Designate an AML Compliance Officer.

Implement internal policies, procedures, and controls.

Provide ongoing employee training.

Conduct independent reviews/audits of the program.

For Individuals: Obtaining name, date of birth, residential address, and an identification number (e.g., Social Security Number, passport number, alien identification card number).

For Entities: Obtaining the legal name, principal place of business, and often identifying the beneficial owners of the entity.

Verification Procedures: Using reliable, independent source documents (e.g., driver's license, passport, utility bill) or non-documentary methods (e.g., credit report, public databases).

Risk-Based Approach: Conducting due diligence commensurate with the risks presented by the customer relationship. Higher-risk customers (e.g., those from high-risk jurisdictions, politically exposed persons - PEPs, or engaging in complex/unusual transactions) require Enhanced Due Diligence (EDD).

Beneficial Ownership Identification: For legal entity customers, VASPs must identify and verify the identity of beneficial owners (individuals who directly or indirectly own 25% or more of the equity interests, and a single individual with significant responsibility to control, manage, or direct the legal entity customer).

Ongoing Monitoring: Continuously monitoring customer transactions and activities for suspicious behavior.

Requirement: VASPs must report suspicious transactions to FinCEN by filing a Suspicious Activity Report (SAR).

Threshold: A SAR must be filed for any transaction(s) conducted or attempted by, at, or through the VASP that involves at least $5,000 in funds or other assets, if the VASP knows, suspects, or has reason to suspect that the transaction:

Timeline: SARs generally must be filed within 30 calendar days after the date of initial detection of facts that may constitute a basis for filing a SAR. If no suspect is identified, the VASP may have an additional 30 days (total of 60 days).

For transfers between financial institutions (VASPs), the Travel Rule requires the transmittal of specific originator and beneficiary information for transactions greater than $3,000.

FinCEN has also clarified that for transactions involving a VASP and an unhosted wallet (or person-to-person transfer), additional record-keeping requirements apply for transactions greater than $3,000.

Penalties for Non-Compliance:

Civil Monetary Penalties: Fines of thousands or even millions of dollars, depending on the nature and severity of the violation.

Criminal Penalties: For willful violations, individuals and entities can face imprisonment and substantial criminal fines.

Required License: Money Transmitter License (MTL) from the OCFI.

Reasoning: When an exchange facilitates the exchange of fiat currency for virtual assets, or vice-versa, it is performing a money transmission service by accepting funds (fiat or virtual assets) from one party and making them available to another, or transmitting funds on behalf of consumers.

FinCEN: Also requires MSB registration (as a money transmitter) with FinCEN.

Required License: The application of the Money Transmitters Act to purely crypto-to-crypto exchanges can be a grey area in some jurisdictions. However, OCFI, like many other U.S. state regulators, generally takes a broad interpretation that if the virtual assets are considered "value" or "funds" and the entity facilitates their transfer for others, an MTL is likely required. It is best practice to assume an MTL is needed or seek specific guidance from OCFI.

FinCEN: FinCEN's guidance explicitly states that exchangers of convertible virtual currency (even crypto-to-crypto) are MSBs and must register as such.

Net Worth: Applicants must demonstrate a minimum net worth. For a Puerto Rico Money Transmitter License, Act No. 93, Article 5, generally requires a minimum net worth of $100,000 for the first location and an additional $50,000 for each additional location or authorized agent (up to a maximum of $500,000).

Surety Bond: Licensees must maintain a surety bond to protect consumers. The bond amount is determined by the Commissioner based on the anticipated volume of business, typically ranging from a minimum of $10,000 up to a maximum of $500,000.

Comprehensive AML Program: Licensed entities must establish and maintain a robust Anti-Money Laundering and Counter-Financing of Terrorism (AML/CFT) program. This includes:

Physical Office: Licensees generally need to maintain a physical office or place of business within Puerto Rico.

Agent for Service of Process: A designated agent for service of process in Puerto Rico is usually required.

Business Plan: A detailed business plan outlining services, target market, operational procedures, risk management, and financial projections.

Management Experience & Background Checks: Key personnel (directors, officers, significant shareholders) will undergo thorough background checks (including criminal history, financial history, and regulatory disciplinary actions).

Financial Statements: Audited financial statements for existing businesses, and projected financials.

OFAC Compliance: Compliance with sanctions administered by the Office of Foreign Assets Control (OFAC) is also mandatory.

Evidence fact pr.enforcement.civil-monetary-penalties-fines-of not found (may have been renamed).

Evidence fact pr.enforcement.criminal-penalties-for-willful-violations not found (may have been renamed).

Puerto Rico Uniform Securities Act (Law No. 60-2020), Article 1.102(28): Defines "security" to include, among other things, "investment contract." This broad definition allows OCIF to apply the Howey Test framework to novel instruments like cryptocurrency tokens.