10 ESSENTIAL TERMS FOR BITCOIN REGULATION

Transcription

1

2 In March 2013, the U.S. Financial Crimes Enforcement Network (FinCEN) classified Bitcoin and Virtual Currency exchanges as Money Services Businesses (MSB s) in the U.S., which are financial businesses that transmit or convert money. As a result of this classification, any Bitcoin or Virtual Currency exchange operating in the U.S., or with U.S. customers, must comply with the same regulations that apply to traditional MSB s, regardless of whether these exchanges deal with fiat currency. Businesses that do not comply with regulation can be shut down, or face felony charges for money laundering. We have already seen Bitcoin exchanges in the U.S. closed down and individuals arrested for not complying with the concepts discussed below. This list of terms is intended as an introduction to the essential terms and concepts Bitcoin companies must understand to comply with regulation in the U.S. and abroad. 1.MONEY LAUNDERING Disguising the source of revenue generated from illegal activity to make it appear legitimate. Money Laundering is used to disguise profits from a variety of illegal activitiesincluding the illegal drug trade, human trafficking, weapons, and organized crime. Though sometimes criticized as an inconvenience or infringement of financial privacy, Anti-Money Laundering regulation remains one of the most efficient ways of inhibiting the growth of criminal organizations, by preventing or following the use of their profits. Governments worldwide have mandated that Financial Institutions maintain Anti-Money Laundering programs. In the U.S., the Bank Secrecy Act (BSA) is the main regulation requiring Anti-Money Laundering (AML), including Know Your Customer (KYC) and Transaction Monitoring. However - as with many other countries- some specifics of the BSA are intentionally left undefined, as companies must create an AML compliance program commensurate with risk. Factors such as customer base, size, geography, and products must all be taken into consideration, and programs vary; small financial institutions with only local clients require fewer AML safeguards than large financial institutions with worldwide clientele. This means that regulated Bitcoin companies must: a) Have an AML program with adequate Know Your Customer (KYC) and transaction monitoring b) Have a defensible plan and rationale for the contents of their AML program Additionally, KYC for Bitcoin companies needs to be more robust than traditional financial institutions as a) Their customer base is distributed worldwide b) It is unlikely they will meet their customers in person

3 2. BSA- Bank Secrecy Act Establishes program, recordkeeping and reporting requirements for financial institutions. In 1979, the U.S. government mandated that financial institutions maintain an AML compliance program including record keeping through the BSA. Financial institutions are now audited to ensure they have developed, administered, and maintained an effective program for Anti-Money Laundering compliance, including a Board of Director approved written BSA/AML compliance program that complies with the four pillars of AML (defined next). This means regulated Bitcoin companies must be aware of, and compliant with, the four pillars of AML. There are additional AML requirements past the BSA, including the USA PATRIOT Act and FATCA, however, the BSA s 4 Pillars of AML remain the bedrock for any compliance program. 3. Four pillars of AML Requirements that financial institutions must comply with, as set forth by the BSA. These include: A system of internal controls to ensure ongoing compliance. Independent testing of BSA compliance. A specifically designated person or persons responsible for managing BSA compliance (BSA compliance officer). Training for appropriate personnel.

4 4. Internal Controls A system of internal controls to ensure ongoing compliance. 10 ESSENTIAL TERMS FOR BITCOIN REGULATION The BSA requires a robust system of internal controls that includes: Identifying higher-risk banking operations, Keeping the board of directors informed about compliance Meeting all regulatory requirements Implementing risk-based Customer Due Diligence or KYC policies, procedures, and processes. Identifying reportable transactions and accurately filing all required reports, including Suspicious Activity Reports (SARs), Currency Transaction Reports (CTRs), and CTR exemptions. Providing sufficient controls and monitoring systems for the timely detection and reporting of suspicious activity. This pillar means that FinCEN-regulated Bitcoin companies must have a transaction monitoring program that can identify reportable transactions, and a method of filing reports. Failure to file the necessary forms is a serious offense (e.g. count #4 in the indictment against BitInstant CEO Charlie Shrem). 5. Compliance Testing Independent testing of BSA compliance. The BSA requires that compliance testing: Be independent (e.g., not performed by a person involved with the BSA/AML compliance staff) Judge the overall adequacy and effectiveness of the compliance program for the 4 pillars of AML, including policies, procedures, and process. Vet the suspicious activity monitoring systems, including an evaluation of the system s ability to identify unusual activity. This pillar means companies must have a BSA/AML plan that can be independently tested of its effectiveness. This testing demonstrates to banks, partners and regulators that companies have a handle on AML compliance. The testing must be extensive and at the culmination, must specify the adequacy of a company s existing system, as well as areas for improvement. These areas for improvement will be closely examined in later testing to ensure that major deficiencies have been addressed.

5 6. Compliance Officer A specifically designated person or persons responsible for managing BSA compliance (BSA compliance officer). The Bank Secrecy Act requires that a compliance officer: Be designated by the board of directors Have the necessary authority and resources Have the necessary competency Have no conflict of interest This pillar means that Bitcoin companies must have a compliance officer with financial and compliance knowledge. While many CEO s are tempted to take on this responsibility, they must be able to prove they have no conflict of interest- which is nearly impossible. In this position, certifications by reputable 3rd parties such as ACAMS (Association of Certified Anti-Money Laundering Specialists) are a good start. 7. Appropriate Training Personnel must be trained in the applicable aspects of the BSA. Institutions must train employees to be aware of their responsibilities under the BSA regulations and internal policy guidelines. Regulators are looking for the importance the board of directors and senior management places on ongoing education, training, and AML compliance. They are examining the comprehensiveness of the training, including: Training of all applicable personnel Frequency of training Documentation of attendance records and training materials Penalties for noncompliance with internal policies and regulatory requirements This pillar means that all applicable staff should have training consistent with their assigned tasks. Attendance and content from the training must be saved as regulators will ask to review training records.

6 8. Know Your Customer (KYC) / Customer Identification Program (CIP) Programs that ensure customers of financial institutions are who they claim to be. Intended to enable the bank to form a reasonable belief that it knows the true identity of each customer Formerly known as KYC, and now relabeled as CIP, the basic principle is the same. Both the BSA, and the USA PATRIOT Act, section 326 require written procedures and policies for all financial institutions including the following: Identity Verification Verification Record-keeping Government List Comparison Notice To Customers This means that Bitcoin exchanges must have, and follow a plan for verifying all their customers. This plan should be appropriate for their financial size, and type of business, and meet the minimum requirements mentioned above. 9. Transaction Monitoring Identifying suspicious activity by reviewing customer transaction data. Together with KYC, Transaction Monitoring is a critical component of AML; it s also mandated through the 4 pillars of the BSA under the internal controls pillar. Transaction Monitoring is a two-step process: 1) Flag instances of suspicious transactions. 2) Review flagged transactions to determine if a SAR should be filed This means that regulated Bitcoin companies must have a written system in place to monitor transactions, detect suspicious activity, and report that activity to the U.S. government within the required time-frame (30 days if the individual is known, 60 days otherwise).

7 10.Sanctions Screening Confirming that users or companies are not currently blacklisted or under sanctions. Governments mandate that financial institutions screen customers against various lists, including: United States: Office of Foreign Asset Control (OFAC) Specially Designated Nationals List (SDN) Canada: Office of the Superintendent of Financial Institutions (OSFI) England: Bank of England Sanctions HM Treasury List Europe: Consolidated list of persons, groups and entities (Freeze List) Multiple: Politically Exposed Persons (PEP) International Police Most Wanted This means that Bitcoin companies must screen individuals against the appropriate sanctions lists, regardless of the intent or the dollar value of the transaction. This is particularly true in the United States, where OFAC and SDN screening is mandated by both the BSA and USA Patriot Act. This white paper is intended as an introduction to the essential terms and concepts Bitcoin companies must understand to comply with regulation in the U.S. and abroad. Compliance with existing law is necessary for the Bitcoin ecosystem to grow. As the industry continues to expand, and the technology gains wider acceptance, an increasing number of governments are reacting in an effort to safely regulate usage of virtual currencies. Our goal is to educate the community and provide the resources needed to facilitate a meaningful conversation around regulation, and make compliance something everyone can understand. For more information about Anti-Money Laundering Compliance, follow us on or visit the IdentityMind Global blog at: Contact us at: vvevangelist@identitymind.com