AML / KYC for Digital Assets

It can, and for an exchange it usually does. FinCEN's 2013 guidance classified exchangers and administrators of convertible virtual currency as money transmitters, and its 2019 guidance applied that test to hosted wallets, kiosks and other models. A business that qualifies registers with FinCEN within 180 days of establishment and renews every two years, maintains a written program under a designated compliance officer, and files suspicious activity reports on suspect transactions of $2,000 or more. A business that does not qualify, because its users hold their own keys or it only develops software, should have a written analysis saying so, because that memorandum is the first thing an examiner asks to see.

Less than most founders expect in the rule and more in practice. The Bank Secrecy Act's customer-identification and beneficial-ownership rules apply to banks, broker-dealers and a few other covered institutions, not to money services businesses. An exchange's duty comes from the program rule, which requires controls reasonably designed to know who its customers are, and from the recordkeeping rule at $3,000. A workable program verifies identity at onboarding against a document and a database, assigns each customer a risk tier based on geography, volume and source of funds, and applies enhanced diligence to the top tier. Re-screening follows as behavior changes. Examiners test whether the tiers were applied, not whether they were written.

The Travel Rule is the part of FinCEN's recordkeeping regulation that requires a financial institution sending a transmittal of $3,000 or more to pass the originator's name, address and account information, and the beneficiary's details, to the next institution in the chain. It was written for wires in 1995 and applies to convertible virtual currency transfers between money services businesses. FinCEN proposed in 2020 to lower the threshold to $250 for transfers that cross the border and never finalized the rule, so $3,000 remains the US figure; the Financial Action Task Force recommends $1,000 and many jurisdictions have adopted it. The practical problem is that a blockchain carries no field for the data, so compliant exchanges pass it through separate messaging protocols, and a transfer to an unhosted wallet raises collection questions the rule does not answer.

Fully, and without a knowledge requirement. OFAC's prohibitions apply to US persons wherever the value moves, and civil liability is strict, so a transfer to a wallet address or an entity on the Specially Designated Nationals list is a violation whether or not anyone noticed. OFAC has added digital currency addresses to that list since 2018, and its 50 percent rule extends the block to any entity owned half or more by listed persons. A digital-asset business therefore screens names, addresses and counterparties before execution, blocks or rejects what hits, and reports blocked property to OFAC within ten business days and again each September. The sanctions program is documented separately from the anti-money-laundering program it sits beside.

The money services business rule names four parts. Written policies, procedures and internal controls come first, then a designated compliance officer with authority to act and a training program for the people who touch transactions. Independent testing by someone who does not run the program completes it. The risk assessment is not listed, but every examiner starts with it, because it is what makes the program risk-based rather than copied. For a digital-asset business the assessment covers the products and whether value can leave the platform, the customers and their jurisdictions, and the channels, including any exposure to mixers or unhosted wallets. Suspicious activity reports go to FinCEN within 30 days of detection, with a further 30 to identify a suspect, and every record is kept five years.

Hart David Carson LLP advises digital-asset businesses on building and documenting their compliance programs, and we represent clients in matters before regulators, including FinCEN and other authorities, on anti-money-laundering and sanctions questions. We act for the business in front of the agency, never for the agency itself, and we focus on accurate disclosure, sound documentation, and a defensible record.