Anti-Money Laundering
Consulting Services & Strategies

0 Items - Total: $0.00 CAD

2019 AML Regulation Highlights for Dealers in Virtual Currency

Back in June 2018, we published an article on proposed AML rules for dealers in Virtual Currency. On July 10th, 2019, updates to Canada’s anti-money laundering (AML) regulations were published in the Canada Gazette. There are three different “coming into force” dates (the dates on which the content of various updates become requirements for regulated entities). 

  • July 10, 2019: a small change in wording (from “original” to “authentic”) is good news for digital identification.
  • June 1, 2020: dealers in virtual currency must be registered as money services businesses (MSBs) and have AML compliance programs in place.
  • June 1, 2021: additional provisions, including reporting large virtual currency transactions.

This is a significant regulatory package with a lot of changes (the document is over 200 pages long). This article will cover the major points for dealers in virtual currency, but it’s important to remember that there is a lot of nuances and differences between business models. We recommend speaking to your local neighbourhood compliance geek about how to adapt to these changes (if you need a compliance geek, please get in touch).

It is also worth noting that tokens that are considered securities would not be considered virtual currencies. Securities and securities dealers were already regulated. If you’re not sure whether or not a token is a security, we recommend reaching out to a securities lawyer (if you need recommendations, please feel free to contact us). It is possible to be both a securities dealer and a dealer in virtual currencies, but if you are only looking for the changes pertinent to securities dealers, you will find those in another article.

Hefty Disclaimers & Sharing

This article should not be considered advice (legal, tax or otherwise). That said, any of the content shared here may be used and shared freely – you don’t need our permission. While we’d love for content that we’ve written to be attributed to us, we believe that it’s more important to get reliable information into the hands of community members (meaning that if you punk content that we wrote, we may think you’re a jerk but we’re not sending an army of lawyers).

Dealers In Virtual Currency

It’s important to start by understanding what’s being regulated. This is best done by considering some of the definitions that have been added to the regulation.

fiat currency means a currency that is issued by a country and is designated as legal tender in that country. (monnaie fiduciaire)

funds means

(a) cash and other fiat currencies, and securities, negotiable instruments or other financial instruments that indicate a title or right to or interest in them; or

(b) a private key of a cryptographic system that enables a person or entity to have access to a fiat currency other than cash.

For greater certainty, it does not include virtual currency. (fonds)

virtual currency means

(a) a digital representation of value that can be used for payment or investment purposes that is not a fiat currency and that can be readily exchanged for funds or for another virtual currency that can be readily exchanged for funds; or

(b) a private key of a cryptographic system that enables a person or entity to have access to a digital representation of value referred to in paragraph (a). (monnaie virtuelle)

virtual currency exchange transaction means an exchange, at the request of another person or entity, of virtual currency for funds, funds for virtual currency or one virtual currency for another. (opération de change en monnaie virtuelle)

In terms of who will be regulated, businesses (whether or not the business is incorporated) that conduct transactions on behalf of their customers, including:

  • Exchanging digital currencies for fiat currencies; and 
  • Exchanging between virtual currencies.

This would include custodial wallet services that hold customers’ private keys on their behalf, as well as exchanges, brokerages, and automated teller machines (ATMs). The requirements apply to foreign and domestically based businesses. The inclusion of foreign MSBs means that it won’t matter where your business is incorporated. If you are targeting your services to Canadians, you are expected to comply with Canadian rules and you will need to be aware of requirements as they apply to your Canadian customers.

One of the most important notes in our view is “These amendments serve to mitigate the money laundering and terrorist activity financing vulnerabilities of virtual currency in a way that is consistent with the existing legal framework, while not unduly hindering innovation. For this reason, the amendments are targeted at persons or entities engaged in the business of dealing in virtual currencies, and not virtual currencies themselves.” It is expected that there will be additional updates to the regulations, and community consultations. During these processes, this distinction should remain an important one.

Digital Identification and “Authentic” Documents

Canadian businesses, such as MSBs, that are regulated for AML purposes must identify certain customers either because there is an ongoing service agreement, an account, or because the customer performs specific types of transactions. In these instances, the methods used to identify customers are prescribed in the regulations. Previously, there was a requirement that any document that was used in identification processes be “original”. A narrow view was taken of the definition of the word original: the document itself, in whatever form it was issued. No scans, copies or other digital representations were permitted. This was a significant challenge in non-face-to-face environments.

Effective on publication of the updates, the word “original” has been replaced with “authentic”. It’s important to keep in mind that while this does allow for documents to be submitted in a myriad of digital formats, there will be an expectation that reporting entities do something in order to determine whether or not the document is authentic. The regulations are not prescriptive in terms of how this will be done. We expect that a number of different solutions, ranging from having a human review documents, to using AI to make risk-based determinations, will be valid. If there are processes that you aren’t sure about, it is possible to write to FINTRAC to request a policy interpretation. We expect that FINTRAC will release updated guidance on identification, and issue many subsequent policy interpretations as the landscape evolves.

For customers that were previously identified, there is an expectation that the customer is identified in accordance with the rules that were in place at the time. Unfortunately, this means that if a customer was identified before the updated regulations were published, and an electronic version of a document was used, the identification may not be considered complete. It will be important for businesses to assess the processes that were in place at this point in time in order to make an accurate determination of whether or not the standards were being met.

Registering as a Money Services Business (MSB)

Although the legislation has been published, Dealers in Virtual Currency are not yet able to register as money services businesses (MSBs) with FINTRAC, Canada’s federal AML regulator and financial intelligence unit (FIU). The process is relatively straightforward, beginning with a pre-registration form. 

The FINTRAC registration process is generally very efficient (taking two to four weeks in total). As part of this process, you must provide FINTRAC with complete information about your business, including:

  • Bank account information;
  • Information about your compliance officer;
  • Number of employees;
  • Incorporation information (if your business type is a corporation);
  • Information about your MSB’s owners and senior management, such as their name and date of birth;
  • An estimate of the expected total dollar amount of transactions per year for each MSB service you provide;
  • Detailed information about every branch; and
  • Detailed information about every Canadian MSB agent.

You are not required to have locations or offices in Canada in order to register as an MSB with FINTRAC. Once registered, the registration must be maintained and you must:

  • Keep registration information up to date;
  • Respond to requests for, or to clarify information, in the prescribed form and manner, within 30 days;
  • Renew our registration before it expires; and
  •  Let FINTRAC know if we stop offering MSB services to Canadians

SCAM ALERT: There is no cost to register an MSB with FINTRAC – although we’ve heard of several scams claiming that there is a fee. Please ensure that you are only registering through valid FINTRAC sites, which will contain “fintrac-canafe.gc.ca” in the url. If you have received a phishing email or other request to pay FINTRAC registration fees, we recommend reporting this to both the Canadian Anti-Fraud Centre and to FINTRAC directly.

All dealers in virtual currency are expected to register with FINTRAC by June 1, 2020.

Building or Updating Your Compliance Program

MSBs in Canada are required to have a documented AML compliance program in place. In all instances, when something is a requirement it’s not enough to have done something to meet that requirement. Both your process and what you’ve actually done in order to meet the requirement must be documented. An AML compliance program has these elements:

  1. Compliance Officer: this is the person who will be responsible for your AML compliance program. They should understand Canadian AML requirements, be relatively senior in your company (access to your Board and Management team is necessary), and sign up to receive updates from FINTRAC.
  2. Policies and Procedures: these are documents that describe what you are required to do, and how you will do it. The processes should be an accurate description of what you are actually doing and detailed enough that a new hire could follow them.
  3. Risk Assessment: this is a document that considers the risk that your business could be used to launder money and/or finance terrorism. FINTRAC has released detailed guidance for MSBs to help create this type of document.
  4. Ongoing Training: any staff (including part-time and temporary staff) that deal with customers, transactions, and systems must receive training on a regular basis (this is generally interpreted to mean at least annually). It’s fine to rely on an external vendor, but your training should also include training on your processes.
  5. AML Compliance Effectiveness Reviews/Audits: every two years, you must complete a formal review of the effectiveness of your AML compliance program and operations. This can be conducted internally or by an external vendor.

In addition, to your documented program, you will need to ensure you operate in a compliant manner which includes, registering with FINTRAC, identifying customers under certain circumstances (more on this under customer identification), collect know your customer (KYC) information, keep records, and report certain transactions to FINTRAC.

All dealers in virtual currency are expected to have compliance programs in place and operational by June 1, 2020.

Customer Identification and Collecting KYC Information

For dealers in virtual currency, customer identification and the collection of KYC information will be required where virtual currency exchange transactions valued at CAD 1,000 or more are conducted. This will include exchanging fiat for virtual currency, as well as exchanges between virtual currencies.

Customers must also be identified, where possible if there are reasonable grounds to suspect that a transaction is related to money laundering or terrorist financing. When a transaction is suspicious, there is no minimum value threshold for identification.

Identification in this context must be completed in specific ways, each of which require particular records to be maintained. The chart below is from FINTRAC’s current customer identification guidance (which must be updated to reflect the change in wording from original to authentic, though other elements remain unchanged).

If the customer is an entity (a company, partnership, trust, etc.), then measures must be taken to confirm the entity’s existence and beneficial ownership. Certain details must be collected for directors, trustees, beneficiaries of trusts, and anyone that owns or controls 25% or more of an entity. This includes “indirect ownership” (such as ownership through another company).

There is also information about the customer that must be collected. For individuals, this includes name, date of birth, address, and occupation or principal business. For entities, this includes name, address, place of incorporation (if applicable), and incorporation number (if applicable). 

All dealers in virtual currency are expected to have processes in place to identify customers and collect KYC information by June 1, 2020.

FINTRAC Reporting

For reporting, there are two important dates. By June 1, 2020, dealers in virtual currency will need to report the same types of transactions that MSBs are currently required to report. These are:

  • Large Cash Transactions: if you receive cash (this means fiat in the form of bills and/or coins) valued at CAD 10,000 or more in the same 24-hour period, by or on behalf of the same customer, it must be reported to FINTRAC within 15 calendar days. 
  • Suspicious Transactions: if there are reasonable grounds to suspect that a transaction is related to money laundering or terrorist financing, it must be reported to FINTRAC within 30 calendar days of the discovery of a fact that led you to determine that the transaction was suspicious.
  • Attempted Suspicious Transactions: if a customer or prospective customer requests a transaction, but does not complete it (including transactions that you reject), and there are reasonable grounds to suspect money laundering or terrorist financing, then it must be reported. The timeframe is the same as it would be for completed transactions.
  • Terrorist Property: if you’re in possession of property (which includes funds and virtual currency) that belong to a terrorist or terrorist group, it must be reported without delay, and the property must be frozen. In addition to reporting to FINTRAC, these reports are also sent to the CSIS and RCMP – by fax. In order to know if customers fall into this category, it is important to screen against lists published by OSFI. We’ve worked with some friends on a tool to make this easier, which you can try here (use the code Free100 for a free trial).
  • Electronic Funds Transfers: if you send or receive international electronic funds transfers (EFTs), including wires, valued at CAD 10,000 or more, by or on behalf of the same customer, it must be reported to FINTRAC within 5 working days.

If you are required to report transactions valued at CAD 10,000 or more in a 24-hour period, you must have a mechanism in place to detect reportable transactions.

It’s noteworthy that if you are conducting international EFTs on your customers’ behalf, you may already be an MSB. The best way to know for certain, in our opinion, is to request a policy position from FINTRAC. This can be done free of charge by emailing guidelines-lignesdirectrices@fintrac-canafe.gc.ca. This can also be done on your behalf by a lawyer or consultant.

By June 1, 2021, a new report will be introduced.

  • Large Virtual Currency Transactions: if you receive virtual currency valued at CAD 10,000 or more in the same 24-hour period, by or on behalf of the same customer, it must be reported to FINTRAC within 5 working days.

There will be some additional changes to reporting and reporting timelines, including the requirement to report suspicious and attempted suspicious transactions “as soon as practicable” after you have determined that there are reasonable grounds to suspect that the transaction is related to money laundering or terrorist financing.

For Extreme Compliance Nerds

We clearly mean nerd as the highest term of admiration and endearment, and for you, we have created red-lined versions of the regulations, with new content showing as tracked changes. This is not an official version of the regulations, and we do, of course, recommend that you check it against the official version.

Need a Hand?

Whether you need to figure out if you’re a dealer in virtual currency, to put a compliance program in place, or to evaluate your existing compliance program, we can help. You can get in touch using our online form, by emailing info@outliercanada.com, or by calling us toll-free at 1-844-919-1623.

FATF, VASP – What Does It All Mean?

On June 21, 2019 the Financial Action Task Force (FATF) released “Guidance for a Risk-Based Approach to Virtual Assets and Virtual Asset Service Providers”. In the ensuing days, while we read through and considered the implications of this dense 57 page document, we watched social media go overboard with all sorts of wild speculation and inaccurate representations. When that happens, and it’s within our power to get good information out there, we do our best to get solid information out fast to fight the fear, uncertainty and doubt (affectionately referred to as FUD online). Let’s take a closer look at the latest FATF guidance, and what it means for businesses that deal in crypto/digital/virtual currencies like bitcoin, and other virtual assets.

What is the FATF Anyway?

If you’re an AML geek, you can probably skip this section. For the other 99.99% of the world, the Financial Action Task Force (FATF for short) is an inter-governmental body formed in 1989 by its member jurisdictions. If you live in the developed world, odds are good that your country is a FATF member. The role of this organization is to issue guidance to countries on anti-money laundering (AML) and combatting terrorist financing. Countries that are members of the FATF are also evaluated in terms of how well they’re doing at following the FATF’s recommendations (these are called mutual evaluations). Generally speaking, member countries face a good deal of pressure to achieve positive results in mutual evaluations. Countries that are deemed to be non-compliant, or to have strategic deficiencies, are publicly listed and can face significant trade barriers.

To sum it up, the FATF is an international group made up of member countries that issues guidance to countries. That guidance is not law, but it certainly shapes the laws that are written by member countries. It may seem pedantic, but if you hear/read someone saying that the FATF has issued a law or a regulation, it’s likely that the speaker/writer doesn’t really understand how the FATF works – and this is the first piece of FUD that we’re going to dispel today: the FATF does not write laws or regulations.

Once the FATF has issued guidance, its member countries adapt their existing laws and regulations, and in some instances, impose new ones. Generally speaking, the more common approach is to adapt existing laws and regulations.  Regardless of the approach taken, a statement released with the guidance stating that the FATF will monitor implementation of the new requirements by countries and service providers and conduct a 12-month review in June 2020. The guidance is also expected to be the subject of further discussion at other international forums, including the G20.

Virtual Assets and Virtual Asset Service Providers

The FATF’s Guidance introduces new terms (and corresponding acronyms): virtual assets (VAs) and virtual asset service providers (VASPs). These are defined in the glossary at the end of the document, but it’s useful to start off by understanding what the terms mean.

A virtual asset is a digital representation of value that can be digitally traded, or transferred, and can be used for payment or investment purposes. Virtual assets do not include digital representations of fiat currencies, securities and other financial assets that are already covered elsewhere in the FATF Recommendations.

The broader text makes it clear that VAs are being broadly defined, and may include cryptocurrencies like bitcoin as well as other types of assets, like initial coin offering (ICO) tokens, which may also be considered securities.

There are also clear statements about the intent of the guidance, and that it is not an attempt to regulate technology. This is another important distinction, in particular where there is a discussion of regulation applicable to Bitcoin (with the capital B indicating that this is a reference to the Bitcoin protocol). That is simply not the case. In fact, the guidance notes that the intent is to remain technology agnostic, and that no specific technological adaptations to protocols are being proposed (we’ll dive a bit more deeply into this in the section that covers customer information).

What the guidance is, however, suggesting should be regulated are certain business activities that involve virtual assets.

Virtual asset service provider means any natural or legal person who is not covered elsewhere under the Recommendations, and as a business conducts one or more of the following activities or operations for or on behalf of another natural or legal person:

i) exchange between virtual assets and fiat currencies;

ii) exchange between one or more forms of virtual assets;

iii) transfer of virtual assets;

iv) safekeeping and/or administration of virtual assets or instruments enabling control over virtual assets; and

v) participation in and provision of financial services related to an issuer’s offer and/or sale of a virtual asset.

The first, and probably most important, piece of FUD to fight here is the idea that peer-to-peer activity that is not being conducted for business purposes should be covered. This simply is not the FATF’s recommendation. This doesn’t preclude a country from writing laws or regulation that impose requirements on non-business peer-to-peer activity, but it does make that less likely in our estimation.

If you’ve looked at previous FATF guidance, you’ll notice that the scope is a bit different. Earlier guidance was focussed on what were termed “on and off ramps”, meaning transactions that involved trading fiat currency for a VA, or vice versa. The current scope includes trading between different VAs. To understand this change, consider that when the earlier guidance was issued there were no popular “stablecoin” VAs pegged to the value of an underlying asset (often a fiat currency) and ICOs had yet to raise millions in value in VA alone.

What Will It Mean for Businesses to be Regulated?

Businesses (including individuals that are conducting VASP activities on behalf of customers that have not incorporated a separate legal entity such as a company or partnership) may be subject to laws and regulations in more than one jurisdiction, and the specific requirements for each jurisdiction may be different (though most will follow the FATF’s guidance in broad strokes). For VASPs, it is important to understand the requirements that apply in each jurisdiction in which they operate (it is not enough to say that your business is following the FATF’s guidance).

The FATF recommends in its guidance that countries enact laws and regulations that apply to VASPs. This should include (not a comprehensive list):

  • The licensing and/or registration of VASPs;
  • A prohibition against criminals and their associates being beneficial owners of VASPs;
  • A requirement for VASPs to have qualified Compliance Officers, written policies and procedures, documented risk assessments, ongoing training, and measures of the effectiveness of the compliance program (audits);
  • Know your client (KYC) information and identification should be collected by VASPs for customers and business relationships (with a de minimis exception for occasional transactions valued at less than 1,000 EUR/USD);
  • Where transactions occur between two VASPs or between a VASP and another regulated entity type (such as banks), sender and receiver information must be transmitted. This has received a lot of attention, and it is not yet clear how this will be accomplished. The options noted in the guidance include:
    • Public and private keys,
    • Transport Layer Security/Secure Sockets Layer (TLS/SSL),
    • 590 Certificates,
    • 509 Attribute Certificates,
    • API Technology, and
    • Other Commercially Available Technology.
  • VASPs’ customers and business relationships should be subject to ongoing monitoring; and
  • Mechanisms in place to freeze assets and stop transfers in the case of listed persons and entities (such as known terrorists or sanctioned persons/entities).

The guidance also states that there should be true regulatory oversight, not self-regulatory organizations. There are additional considerations for other entity types that are already regulated (including securities dealers and banks) that engage in VASP activities.

Thinking about Risk

Some of the most interesting content in the guidance is related to the money laundering and terrorist financing risk posed by VAs and VASPs. Here, it was clear that the FATF had done their homework as the discussion included TOR, tumblers, mixers, and other technologies referred to as being “anonymity enhanced”. The factors that are listed as increasing a VAs/VASPs risk include:

  • Value moving into and out of fiat currency,
  • The use of anonymity-enhanced technologies,
  • Operations that are entirely online (non-face-to-face),
  • Links to high risk jurisdictions, and
  • The value that can be accessed/transferred.

The guidance does note that not all VAs/VASPs should be considered to be high risk.

A Quick Note on Financial Inclusion & De-Risking

The FATF’s page on financial inclusion defines the term as: Ensuring that financially excluded or underserved groups (such as low income, rural sector or undocumented groups) have access to regulated financial services helps to strengthen the implementation of AML/CTF measures.

If you’ve been watching or participating in VAs or VASPs, you’ll understand that many of these have financial inclusion related goals themselves, but VASPs often struggle with access to banking. In their guidance, the FATF makes a strong statement against banks and financial service providers de-risking all VASPs: It is important that FIs apply the risk-based approach properly and do not resort to the wholesale termination or exclusion of customer relationships within the VASP sector without a proper risk assessment.

Unfortunately, the same cannot be said of prohibition by countries: Some countries may decide to prohibit VA activities or VASPs, based on their assessment of risk and national regulatory context or in order to support other policy goals not addressed in this Guidance (e.g., consumer protection, safety and soundness, or monetary policy). The guidance goes on to note that countries that chose to ban VAs and/or VASPs would still need to ensure that sufficient safeguards are in place. This approach did not seem to be encouraged, but that it is explicitly mentioned is interesting of itself, as this is not the case for other asset or regulated entity types.

Margin Notes

We’ve been asked to post the annotated copy of the first read-through of the FATF’s guidance document. The annotations were not created with the expectation of the audience. They’re likely to be hard to read, idiosyncratic, and to clearly reveal that the author is dyslexic… but if they are of use to you, then these notes are yours to use.

Guidance for a Risk-Based Approach to Virtual Assets and Virtual Asset Service Providers Marked Up Copy

Need a Hand?

If you want to understand the regulations that apply to your VA business/VASP, please contact us.

Compliance with laws and regulations is nuanced; we do not practice in all jurisdictions (and quite frankly, we believe that anyone claiming to understand the nuance of AML in every jurisdiction is greatly exaggerating their skill set). If we don’t practice in the places that matter to you, we’ll do our best to connect you with qualified people that do.

Information Should Be Free!

Outlier has produced an open-source AML and CTF, and Privacy repositories of definitions, acronyms, and terminology that is free for whoever wants it.

Please feel free to provide contributions and/or feedback, as it would be greatly appreciated. We have already had three contributors!

Discombobulated

About a year ago, we had a client who was interacting with the world of Anti-Money Laundering (AML) and Counter Terrorist Financing (CTF) for the first time. They were aggravated by the amount of jargon, acronyms, and uncommon uses of certain commonly understood terms. An example is, a business relationship. Those of you that are relatively familiar with the AML space know a business relationship doesn’t mean what the rest of the world thinks it means. In Canada, in the AML context, it means something very different.

A Helping Hand

At the time, they wished for a simple reference point where they could easily find the meaning for different terms. Unfortunately, this entails combing multiple locations, including FINTRAC’s website, plus the Act and Regulations themselves. To make a long story short, there is no easy way. Fed up, they (not so) gently suggested that we (Outlier) fix this. Their idea was creating a GitHub repository.

For those unfamiliar with GitHub, it is a web-based hosting service for version control. It is mostly used for computer code, but has also been used to write and edit books. It offers access control and several collaboration features. A GitHub repository is where the code and/or information is maintained for a specific project. This process is fairly simple to someone who is a coder with years of experience working with GitHub. For myself, this was not so simple. A year later, almost to the day, the repository is created, open and available to the public. There is no need to be scared, you are able to comment and make suggestions without knowing how to code at all. If you can’t figure out how to provide commentary in GitHub, send it to use via email at info@outliercanada.com with the subject line “GitHub Feedback.”

The Power of Collaboration

The (not so) gentle nudge meshed well with one of Outlier’s core beliefs: that information should be free. By collecting the information, housing it in GitHub, and making it available to anyone, we are able to provide free information to everyone who wants it. By making information free and public, it gives others the opportunity to make suggestions, add content, and improve the quality of the information.

What Happens When We Work Together?

By sharing this open-source project with the world, we are looking to empower anyone willing to be empowered. From the client who is interacting with the world of AML for the first time. To the seasoned-veteran who is looking for helpful resources. To the person who wants to provide their customer with a helpful resource. Take the information and do what you wish with it. If you would like to attribute Outlier, awesome! If not, that’s ok too. Our only request is this should never be provided for a fee.

Have a Question?

If you looked at the resource and are curious about how to make a contribution, please feel free to contact us anytime. Contributions can include anything from corrections and suggestions, to the addition of different jurisdictional definitions, specifically the European perspective.

This is not a solicitation (but we do get this request often), should you want to provide a tip in BTC or ETH, our addresses are listed below.

To open a channel with our Lightning Node, our address is: 03acb418d5b88c0009cf07d31ec53d0486814bc77917c352bd7e952520edf7bf3c@99.236.76.38:9735

or you can use Tippin.Me.

bitcoin ethereum
33CdqJTw6jMWVBAveT9Ue3rPym8HPKKPow 0x03CDF23a2Eb070F2c79De5B2E6FB90671D3c70fE

Now We Wait… Canada’s Proposed AML Updates

As of last Friday (September 7, 2018) the comment period for Canada’s draft AML amendments has closed (if you have something to say, they’ll likely still accept submissions for a few more days).

TLDR?

Check out our summary here, or this panel digging into the details.

Want to read our submissions? Here they are!

2018Sep07_OutlierCanada Submission to Finance

2018Sep07_Apendix_SurveyResults

What Now?

The Department of Finance is going to head back to the Bat Cave to revise the policy. We expect that a final version will be published at some point in 2019, and that the content will include “dealing in virtual currency” (including businesses like bitcoin exchanges).

Once the final version is published, there will be a transition period (we expect a year or more) before everything is in force. In the meantime, if you’re expecting to be considered a money services business (MSB) when the final version is published, we recommend checking out some of the community events for MSBs, like the Canadian MSB Association (CMSBA)’s Fall Conference in Toronto.

We’re Here To Help

If you have questions about virtual currency and regulation in Canada, or regulation in Canada in general, please contact us.

The Dos & Donts of Breaking into Blockchain

This article was created by Amber D. Scott & Emma Todd (of MMH Blockchain Group) with writing assistance from Ailsa Bristow.

We go to a lot of events, and the number one thing people keep asking us is how to get into Blockchain. Developers, students, accountants, lawyers… anyone with something to sell.

Our knee-jerk response is if you want to get into blockchain, just get into blockchain. Yes, it’s that simple.

However, that doesn’t seem to be the conversation-stopper we intend it to be, so a more fulsome response is called for. Here are our collected thoughts on how to get involved, along with some tips on how (and how not to) conduct yourself along the way.

Get Involved

First things first: blockchain is, at its heart, a community. The best place to start is to do your research, find a meetup in your city, and start talking to people. Don’t just sit at home reading about blockchain and bitcoin on the internet.

The blockchain community is one of the more welcoming places on the planet. Here are people who are passionate about what they do, committed to the open-source philosophy, and willing to help newbies learn. Sure, it can get technical at times, and that can be intimidating when you don’t have a strong opinion about proof of stake, the latest token, or whether it was ok for Microsoft to buy GitHub… but as long as you don’t pretend to know more than you do, you’ll be fine. These folks will know when you’re bluffing, and they will call you out on it.

If you really want a crash course in blockchain, volunteer either through a meetup or at one of the big blockchain conferences. This is a great way to start meeting people: you could be brushing shoulders with the big names in blockchain before you even know who they are.

Learn The Ropes

As you start your journey into blockchain, spend some time listening. Seriously. Listen more than you talk. It’s hard to learn anything when you’re the one speaking. Be interested, and be genuine: these are the attributes that will earn you credibility in the blockchain space. But don’t just rely on people to be your tour guides: people will get frustrated with you when you ask questions without doing your basic research first (if you want a great list of bitcoin resources go here). And seriously: please don’t email/ DM/ whatever at leaders in the blockchain community asking them questions that you can easily google for yourselves. That’s not how to win friends and influence people, folks.

If you want to be a coder, there are a lot of free learning resources out there. You don’t need to spend $100,000s getting a computer science degree (unless that’s something you want to do otherwise) given the wealth of learning you can do online. Two communities that we love are freeCodeCamp and BlockGeeks. There are also scholarships out there if you are planning on following this route.

Finally, if you’ve been in the blockchain for all of a minute, please, don’t start advertising yourself as an expert before you’ve even had a chance to learn the basics. Two months attending Meetups and some internet reading does not an expert make. Showing up on panels or guesting on blogs before you’ve really had a chance to learn is going to hurt your reputation.

Get Some Skin In the Game

If you’re interested in working with or selling to blockchain companies, get some skin in the game. We’re always shocked whenever a vendor asks us about selling to blockchain companies, and when I ask them if they’ve ever used a blockchain based service, or a cryptocurrency they say no. If you haven’t taken the time to understand the ecosystem, how can you possibly hope to understand your customers? Why should anyone in the blockchain world trust anything you have to say?

It’s fine to start small. Set up a wallet. Buy some Dogecoin (it has much of the same “backbone” as bitcoin) or even a small fraction of a bitcoin (yes, they are divisible). You don’t need to break the bank. You should participate only according to your passion, your risk tolerance, and your knowledge. But you do need to get a feel for how things work, and demonstrate a personal investment.

Prove Your Value

Blockchain is about proving your value. If you come from a background where people are impressed by your education, your resume, who your parents are, or how much money you made, get ready for a reality-check. In the blockchain world, people are interested in learning about what you’re doing that’s cool.

There’s room for all skillsets in blockchain, from traditional accounting to marketing. But don’t come in trying to make the hard sell. Do talk about things you’re doing that’s cool, and be interested in what other people are working on in return.

Be Respectful

Respect people’s time. Do not use people’s names or photos or logos to promote your event without checking with them first. Do not call someone an advisor to your project if you’ve only  spoken to them once. Get explicit agreement from people before plastering their name all over your website.

Also, if you’re chatting to someone and you hear they got into bitcoin X number of years ago, do not ask them a) how much coin they have, b) if they are a millionaire. If you wouldn’t feel comfortable asking for somebody’s bank statement, or the state of their investment portfolio, don’t ask them for the ins and outs of how much money they’ve made from bitcoin. Your curiosity is not a reason to override basic good manners.

Twitter is King

If you want to keep your finger on the pulse of what’s happening in Blockchain, Twitter is the place to be. It’s where news breaks, connections get made, and discussions are had. Follow one or two of the biggest names in Blockchain, follower their followers, and start jumping in.

Fit Matters

Finally, know that not everyone should be in Blockchain. Sure, you’ve heard the buzz and that there’s money to be made, but that doesn’t mean you need to be in this world. If you’re simply chasing money, you’re probably going to end up getting burned.  If you don’t like change and uncertainty, this probably isn’t the place for you. If you don’t have the ability to pivot, this probably isn’t the place for you. If the thought of listening to engineers argue technical points fills you with dread, this probably isn’t the place for you. And if you aren’t at least open to the idea of being converted into a flaming libertarian, we’d suggest this probably isn’t the place for you. And if that’s true, that’s ok.

On the other hand, if nothing we’ve said here has put you off and you’re ready to dive in, welcome. You’re joining one of the most passionate, genuine, smart, and exciting communities on the planet.

Welcome – we’re glad you’re here!

Canada’s AML Rules for “Virtual Currency”

On June 9th, 2018, draft amendments to the Proceeds of Crime (Money Laundering) and Terrorist Financing Act (PCMLTFA) and its enacted regulations (there are five separate regulations, that we’re going to collectively call regulations here for simplicity’s sake). While not all of the proposed amendments are related to virtual currency, many are (the term virtual currency comes up 304 times in about 200 pages). This article is intended to give a high-level summary of the proposed amendments as they relate to virtual currency for businesses in that industry (exchanges, brokerages, etc.).

This article should not be considered advice (legal, tax or otherwise). That said, any of the content shared here may be used and shared freely – you don’t need our permission. While we’d love for content that we’ve written to be attributed to us, we believe that it’s more important to get reliable information into the hands of community members (meaning that if you punk content that we wrote, we may think you’re a jerk but we’re not sending an army of lawyers).

Finally, we want to encourage the community to discuss the draft and submit meaningful feedback for policymakers. To this end, we’re going to be posting, hosting and attending community events. We’ve also set up a survey that can be completed without submitting any personal information (though you may choose to do so). If you would like one of our compliance nerds at your event, please get in touch. If you’re already having a related event that benefits the community, let us know or post it in the comments.

The comment period for this draft is 90 days. After this, the Department of Finance takes the feedback to the bat cave and drafts a final version of the amendments. From the time that the final version is published, the draft indicates that there will be 12 months of transition to comply with the new requirements.

What to expect when you’re expecting (to be regulated)?

While we acknowledge that our sample is biased (people that talk to compliance geeks), we know that many businesses such as brokerages and exchanges have expected to be regulated as money services businesses (MSBs) since Bill C-31 was passed in 2014. Many of these businesses already have in place the required elements of an anti-money laundering (AML) compliance regime, including:

  1. The appointment of a Compliance Officer;
  2. Written policies and procedures;
  3. A documented risk assessment;
  4. Training; and
  5. Effectiveness testing (like an audit, but for compliance).

In addition, many have been voluntarily reporting suspicious activity to the Financial Transactions and Reports Analysis Centre of Canada (FINTRAC), the body under which they expect to be regulated for AML.

The proposed amendments would formalize compliance program requirements, as well as create new requirements specific to businesses “dealing in virtual currency” (which would now be considered MSBs). While “dealing in virtual currency” itself is not defined, the text of the regulations implies that it will include exchanging, sending, and receiving virtual currency on behalf of other people or entities. Such entities would be required to register as MSBs if they are serving Canadian customers (whether or not they are located in Canada).

There are a number of thresholds that are proposed, including identification (at CAD 1,000) and reporting (at CAD 10,000). In each case, specific information must be collected and recorded. The identification methods that are available in these circumstances are relatively prescriptive, although the proposed amendments do make some headway towards supporting a broader array of identification methods by requiring that documents be considered “authentic” rather than requiring documents in their original format. Of course, as with any complex issue, guidance from FINTRAC will be required before we’re certain how this will be interpreted by the regulator (It’s good news; we’re just not sure how good, yet).

As always in compliance, the devil is in the details. What follows is a few of those key details, as well as some of the issues that we anticipate. We encourage you to conduct your own analysis and to join the conversation.

What’s In A Definition?

Definitions are generally not very interesting. When was the last time that you read the dictionary? (Sidenote: if you are a serious scrabble geek and do this on the regular, you will enjoy this section more than most)… In this case though, definitions matter. Definitions will make a difference in terms of the businesses and activities that are regulated, and how they are regulated. Fortunately, our community includes a number of engineers, debaters, and other individuals with a penchant for the precise – and your skills are needed here. We encourage you to carefully consider the following and to submit feedback on how they can be improved.

authorized user means a person who is authorized by a holder of a prepaid payment product account to have electronic access to funds or virtual currency available in the account by means of a prepaid payment product that is connected to it.

funds means

(a) cash and other fiat currencies, and securities, negotiable instruments or other financial instruments that indicate a title or right to or interest in them; or

(b) information that enables a person or entity to have access to a fiat currency other than cash.

For greater certainty, it does not include virtual currency. (fonds)

fiat currency means a currency that is issued by a country and is designated as legal tender in that country.

large virtual currency transaction record means a record that indicates the receipt of an amount of $10,000 or more in virtual currency in a single transaction and that contains the following information:

(a) the date of the receipt;

(b) if the amount is received for deposit into an account, the name of each account holder;

(c) the name, address and telephone number of every other person or entity that is involved in the transaction, the nature of their principal business or their occupation and, in the case of a person, their date of birth;

(d) the type and amount of each virtual currency involved in the receipt;

(e) the exchange rate used and the source of the exchange rate;

(f) the number of every other account that is affected by the transaction, the type of account and the name of each account holder;

(g) every reference number that is connected to the transaction;

(h) every other known detail that identifies the receipt; and

(i) if the amount is received by a dealer in precious metals and precious stones for the sale of precious metals, precious stones or jewellery,

(i) the type of precious metals, precious stones or jewellery,

(ii) the value of the precious metals, precious stones or jewellery, if different from the amount of virtual currency received, and

(iii) the wholesale value of the precious metals, precious stones or jewellery.

prepaid payment product means a product that is issued by a financial entity and that enables a person or entity to engage in a transaction by giving them electronic access to funds or virtual currency paid to a prepaid payment product account held with the financial entity in advance of the transaction. It excludes a product that enables a person or entity to access a credit or debit account or one that is issued for use only with particular merchants.

prepaid payment product account means an account that is connected to a prepaid payment product and that permits

(a) one or more transactions that total $1,000 or more to be conducted within a 24-hour period; or

(b) a balance of funds or virtual currency available of $1,000 or more to be maintained.

virtual currency means

(a) a digital currency that is not a fiat currency and that can be readily exchanged for funds or for another virtual currency that can be readily exchanged for funds; or

(b) information that enables a person or entity to have access to a digital currency referred to in paragraph (a).

virtual currency exchange transaction means an exchange, at the request of another person or entity, of virtual currency for funds, funds for virtual currency or one virtual currency for another.

virtual currency exchange transaction ticket means a record respecting a virtual currency exchange transaction — including an entry in a transaction register — that sets out

(a) the date of the transaction;

(b) in the case of a transaction of $1,000 or more, the name, address and telephone number of the person or entity that requests the exchange, the nature of their principal business or their occupation and, in the case of a person, their date of birth;

(c) the type and amount of each of the funds and virtual currencies involved in the payment made and received by the person or entity that requests the exchange;

(d) the method by which the payment is made and received;

(e) the exchange rate used and the source of the exchange rate;

(f) the number of every account that is affected by the transaction, the type of account and the name of each account holder;

(g) every reference number that is connected to the transaction; and

(h) every other known detail that identifies the transaction.

Diving Deeper – Obligations and Potential Issues

1 – Do the definitions capture unintended parties?

We were surprised to see that there were not specific carve-outs for certain types of tokens, including securities, and tokens intended specifically for gaming. The definition, as it’s currently written seems capable of encompassing both tokenized security offerings and gaming tokens.

In addition, the second part of the definition that includes “information that enables a person or entity to have access to a digital currency referred to in paragraph (a).” has the potential to open the definition even more broadly. For instance, if I have stored a copy of a seed phrase or a hardware device with a vault service – have they received virtual currency? Are they sending virtual currency to me if the contents of my vault are couriered to me?

 2 – What about peer-to-peer, decentralized applications, and smart contracts?

The amendments as they are presented appear to take the view that transactions have intermediaries. There are no specific carve-outs for peer-to-peer transactions (though we expect that previous guidance could be applied here), decentralized applications, and smart contracts. This may be a particularly contentious issue in the case of an exchange from one “virtual currency” to another – especially where such an exchange is initiated or completed without any human intervention. Similarly, questions arise for wallet service providers. For instance, what if a wallet provider does not have access to private keys, but connects to applications that permit users to initiate transactions that would be considered to be exchange transactions under the current definition?

That said, there are some astute exclusions, including the following activities which are explicitly not covered:

(a) a transfer or receipt of virtual currency as compensation for the validation of a transaction that is recorded in a distributed ledger; or

(b) an exchange, transfer or receipt of a nominal amount of virtual currency for the sole purpose of validating another transaction or a transfer of information.

Nonetheless, it is difficult to determine where the policymakers intended to draw the line, and where the regulator will later enforce it…

3 – Jurisdiction doesn’t matter; foreign money services businesses (MSBs) are covered.

While not specific to virtual currency, it is noteworthy that the proposed amendments expand the definition of an MSB to include any business that is providing prescribed services in Canada. As we’ve seen in the case of the NY BitLicense, badly drafted legislation can drive away business and lead to a lack of service providers willing to do business in a region.

While we’re not suggesting that the proposed amendments are nearly as ill-conceived as the NY BitLicense, it is important to consider whether or not these will affect Canadians’ ability to access services, and the attractiveness of the Canadian market generally for innovative international businesses. While we do not expect this particular amendment to be altered, we would encourage businesses located outside of Canada that serve Canadians to comment.

What Next?

If you’ve read this far, congratulations and thank you!

We hope that you will contribute your thoughts and comments. You can do this by contacting the Department of Finance directly. Their representative on this file is:

Lynn Hemmings

Acting Director General

Financial Systems Division

Financial Sector Policy Branch

Department of Finance

90 Elgin Street

Ottawa, Ontario

K1A 0G5

Email: fin.fc-cf.fin@canada.ca

If you would like assistance drafting a submission, or have questions that you would like Outlier to answer, please get in touch!

You can also answer specific questions in our survey, or join us at a community event.

Adding Value

An Open Letter to the Blockchain Association of Canada & The Canadian Blockchain Community

My obsession (let’s call it what it is) with Bitcoin and blockchain was born in 2013 when I updated a risk assessment to include bitcoin (and accepted my first bitcoin payment). Soon after, I spoke at the Bitcoin Expo in Toronto and became a member of the Bitcoin Alliance of Canada (BAC). At the time, it seemed to me that so many wonderful things were happening in Canada. This organization had a real opportunity to transcend political leanings and model new methodologies for consensus and transparency. For what it’s worth, I still believe that this is possible if we have the will and dedication to do the work.

In 2016, I was elected to a director position with BAC. In December of that same year, a decision was made to change the name of the association to the Blockchain Association of Canada (still BAC). At that time, it did not occur to me (or to my fellow directors, as far as I know) that there could be confusion with another existing group, Blockchain Canada (BC). This was first brought to my attention by one of BC’s directors and has come up several times since then. At one point there was even talk of merging the two associations, which seems to have since died on the vine. While I believe that there may be many voices that represent our community in Canada, I hope that these voices will at the very least learn to harmonize (read: collaborate).

As a BAC director, I have seen (and experienced) a degree of bullying, a lack of transparency, and mismanagement that has left me unwilling to continue in this role. While it is not my wish to air dirty laundry, I want to make it clear to the directors and volunteers who will replace me that you have a lot of work to do.   I want to provide a public and transparent roadmap that is visible to my fellow BAC members. Unfortunately, this was not something that I was able to do as a director.

In my opinion, the most important immediate tasks are:

  • Sorting out the membership, while respecting paid lifetime members’ (from 2014) privacy and security;
  • Hiring an accountant; having proper financial statements completed and presented at an AGM;
  • Holding an AGM, which includes transparent updates and opportunities for involvement for the membership, and continuing to hold regular AGMs;
  • Taking steps to understand the will of the Bitcoin and blockchain community in Canada;
  • Ensuring that there are clear and transparent processes and functions;
    • Where possible, all contracts and positions should be open competitions; Where this is not possible, or pragmatic, a rationale should be clearly documented and made available;
    • Any conflicts should be clearly disclosed, and directors with personal connections should recuse themselves from the conversation related to the conflict early on;
    • The nature of all contracts should be posted in a manner that is at minimum visible to all members; and
  • Updating the BAC website in a way that supports these functions, and removing all other websites that have not been appropriately reviewed by BAC.

While I love and want to continue to support the Bitcoin and blockchain community in Canada, I do not believe that continuing in my role with the BAC is the best use of my time, nor the best way that I can support the community. If you think that you’re the right person to step up and help with cleanup, I highly encourage you to do so. If you’re not sure, and you want to have an AMA, please reach out to me privately.

Lessons Learned & Things That I Wish I Had Known

My involvement with BAC’s board was my first experience as a director for a not-for-profit organization, though I have been involved as a volunteer, organizer, and leader in other organizations. I’ve learned a great deal from this experience, and I believe that it will help me to set solid parameters for my involvement moving forward.

From here on out, where myself / Outlier is called upon to be part of industry associations or not-for-profit organizations, I am of the opinion that we should be focused on where we can add the most value. These might include:

  • Participating in or managing compliance and/or regulatory committees;
  • Providing training and/or feedback related to compliance and/or regulation; and
  • Speaking at events where we are able to add value (this is our #1 criteria for participation).

The standards that associations must meet to ensure my participation will include:

  • Having administration and coordination functions under control (or having a plan in place to get them under control);
  • Having an accountant appointed;
  • Having appropriate insurance in place;
  • Being committed to both transparency and acting in the service of the membership; and
  • Having well-functioning leadership in place.

I understand that no person or organization is perfect – and that’s ok. There will always be problems to solve, and problem solvers hard at work – this is what keeps life interesting. In looking for specific functions and problem solvers already in place, I am not looking for perfection – only the opportunity to spend my time focusing on the problems that I’m best at solving.

Wishing BAC All The Best

To my fellow BAC directors, I will miss working with the vast majority of you. I encourage you to carry on, fight the good fight and do what you think is right. I believe that BAC has tremendous potential and I hope that the organization finds both its feet and great success.

To the bitcoin and blockchain community at large, and you’ve read this and thought “I could absolutely help solve that problem”, I applaud you and encourage you to get involved. Who knows, we may even sit on a compliance and regulatory committee together one day.

 

Amber D. Scott

Founder & Chief AML Ninja, Outlier Solutions Inc.

Former Director, Blockchain Association of Canada

Skype & Twitter: @OutlierCanada

Email: amber@outliercanada.com

AML & Digital Currency in Canada

Because we’ve been asked a time or two what’s new in AML & digital currency in Canada…

The following are a compilation of FINTRAC’s policy positions in relation to digital currency. This document is current as of July 25, 2017.

We have not charged anyone for access to this information, and if you have downloaded this document, our only condition of its use is that you do not do so either.

Free Download: FINTRAC Bitcoin Policy Interpretations as at 25Jun2017

If you feel inclined to tip, we won’t argue. Tips will be shared among the team members that collaborated to put this memo together.

bitcoin ethereum
1KGxGUos6PCuAzJEmzHAhfLPeiiEZePZE4 0x03CDF23a2Eb070F2c79De5B2E6FB90671D3c70fE
   

 

If you have any questions or concerns about how these may apply to you and your business, please feel free to get in touch.

Amber & The Outlier Canada Team

Email: amber@outliercanada.com

Skype: OutlierCanada

Twitter: @OutlierCanada

AML Regulation Updates & Digital Currency

Amber AML Program_2On July 4th, 2015, draft amendments to Canada’s Proceeds of Crime (Money Laundering) and Terrorist Financing Regulations were published in the Canada Gazette. These updates are intended to, among other things, strengthen Canada’s anti-money laundering (AML) regime and address certain technical issues. The draft does expand the definition of a money services business (MSB) to include “dealers in digital currency,” but digital currency businesses may still consider submitting comments related to the draft, as the consultation period of 60 days is open to the public.

This round of amendments didn’t include ‘dealers in digital currency’ – so why should you comment?

While dealers in digital currency are not yet regulated as MSBs, it is reasonable to expect that this is the direction Canada is taking based on Bill C-31, which was passed last year. This means that the regulations could apply to digital currency businesses in the near future. The 60-day comment period is likely to be the only public comment period before a final version of the amended regulations is published.

One of the most significant changes in the current draft relates to customer identification. The current customer identification methods for non-face-to-face customers (which apply to all online MSB customers) are complicated and heavily reliant on an individual having at least six months of Canadian credit history (you can learn more here). The proposed amendments have the potential to broaden the range of available sources to include sources other than credit reporting bureaus.

Digital currency businesses should consider commenting on these amendments. While we at Outlier consider the changes to be positive overall, we’re aware that there are many identification solutions on the market (many of which don’t meet the current Canadian identification requirements). This has caused more than a few headaches for businesses that operate online. While the proposed changes may alleviate some of the current pain points, businesses should consider how these fit with your business model and service providers.

Customer Identification Measures

In the text below, the text that is struck through includes proposed deletions, while the green text includes proposed additions. You can also see a full marked-up version of the Proceeds of Crime (Money Laundering) and Terrorist Financing Regulations here.

MEASURES FOR ASCERTAINING IDENTITY

  1. (1) In the cases referred to in sections 53, 53.1, 54, paragraph 54.1(a) and sections 55, 56, 57, 59, 59.1, 59.2, 59.3, 59.4, 59.5, 60 and 61, a person’s the identity of a person shall is to be ascertained, at the time referred to in subsection (2) and in accordance with subsection (3), in the following manner:

(a) By referring to the person’s birth certificate, driver’s licence, provincial health insurance card (if such use of the card is not prohibited by the applicable provincial law), passport or other similar document; or

(a) By referring to identification document that contains their name and photograph and that is issued by the federal government or a provincial government or by a foreign government other than a municipal government, and by verifying that the name and photograph are those of the person;

(b) if the person is not physically present when the account is opened, the credit card application is submitted, the trust is established, the client information record is created or the transaction is conducted,

(i) by obtaining the person’s name, address and date of birth and

(A) confirming that one of the following entities has identified the person in accordance with paragraph (a), namely,

(I) an entity, referred to in any of paragraphs 5(a) to (g) of the Act, that is affiliated with the entity ascertaining the identity of the person,

(II) an entity that carries on activities outside Canada similar to the activities of a person or entity referred to in any of paragraphs 5(a) to (g) of the Act and that is affiliated with the entity ascertaining the identity of the person, or

(III) an entity that is subject to the Act and is a member of the same association as the entity ascertaining the identity of the person, and

(B) verifying that the name, address and date of birth in the record kept by that affiliated entity or that entity that is a member of the same association corresponds to the information provided in accordance with these Regulations by the person, or

(ii) subject to subsection (1.3), by using one of the following combinations of the identification methods set out in Part A of Schedule 7, namely,

(A) methods 1 and 3,

(B) methods 1 and 4,

(C) methods 1 and 5,

 (D) methods 2 and 3,

(E) methods 2 and 4,

 (F) methods 2 and 5,

(G) methods 3 and 4, or

(H) methods 3 and 5.

 (b) by referring to information concerning them that is received by the     person or entity that is ascertaining their identity on request from a federal or provincial government body — or a body that is acting as the agent or mandatary of such a body — that is authorized in Canada to ascertain the identity of persons, and by verifying that either the name and address or the name and date of birth contained in the information are those of the person;

(c) by referring to information that is contained in the person’s credit file — if that file is located in Canada and has been in existence for at least      three years — and by verifying that the name, address and date of birth   contained in the credit file are those of the person;

(d) by doing any two of the following:

(i) referring to information from a reliable source that contains their name and address, and verifying that the name and address are those of the person,

(ii) referring to information from a reliable source that contains their name and date of birth, and verifying that the name and date of birth are those of the person, or

(iii) referring to information that contains their name and confirms that they have a deposit account or a credit card or other loan account with a financial entity, and verifying that information; or

(e) by confirming that one of the following entities previously ascertained their identity in accordance with any of paragraphs (a) to (d), and by verifying that the name, address and date of birth contained in the entity’s record are those of the person:

(i) an entity that is referred to in any of paragraphs 5(a) to (g) of the Act and that is affiliated with the entity that is ascertaining the person’s identity, 

(ii) an entity that carries on activities outside Canada similar to the activities of a person or entity referred to in any of paragraphs 5(a) to (g) of the Act and that is affiliated with the entity that is ascertaining the person’s identity, or

(iii) a financial entity that is subject to the Act and that is a member of the same financial services cooperative or credit union central as the entity that is ascertaining the person’s identity.

(1.1) In the case referred to in paragraph 54.1(a), the identity of a person shall be ascertained by a person or entity, at the time referred to in subsection (2) and in accordance with subsection (3),

(a) by referring to the person’s birth certificate, driver’s licence, provincial health insurance card (if such use of the card is not prohibited by the applicable provincial law), passport or other similar document; or

(b) where the person is not physically present when the credit card application is submitted,

(i) by obtaining the person’s name, address and date of birth and

(A) confirming that one of the following entities has identified the person in accordance with paragraph (a), namely,

(I) an entity, referred to in any of paragraphs 5(a) to (g) of the Act, that is affiliated with the entity ascertaining the identity of the person,

(II) an entity that carries on activities outside Canada similar to the activities of a person or entity referred to in any of paragraphs 5(a) to(g) of the Act and that is affiliated with the entity ascertaining the identity of the person, or

(III) an entity that is subject to the Act and is a member of the same association as the entity ascertaining the identity of the person, and

(B) verifying that the name, address and date of birth in the record kept by that affiliated entity or that entity that is a member of the same association corresponds to the information provided in accordance with these Regulations by the person,

(ii) subject to subsection (1.3), by using a combination of any two identification methods referred to in either Part A or Part B of Schedule 7, or

(iii) subject to subsection (1.3), where the person has no credit history in Canada and the credit limit on the card is not more than $1,500, by using combination of any two identification methods referred to in any of Parts A, B and C of Schedule 7.

(1.1) For the purposes of subparagraphs (1)(d)(i) to (iii), the information that is referred to must be from different sources, and the person whose identity is being ascertained and the person or entity that is ascertaining their identity cannot be a source.

(1.2) for the purposes of paragraphs (1)(b)(i) and (1.1)(b)(i), an entity is affiliated with another entity if one of them is wholly owned by the other or both are wholly owned by the same entity.

(1.2) The person or entity that is ascertaining the identity of a person who is at least 12 years of age but not more than 15 years of age may refer under subparagraph (1)(d)(i) to information that contains the name and address of one of the person’s parents or their guardian or tutor in order to verify that the address is that of the person.

(1.21) For the purposes of subparagraphs (1)(b)(i) and (1.1)(b)(i),

(a) a financial services cooperative and each of its members that is a financial entity are considered to be members of the same association; and

(b) a credit union central and each of its members that is a financial entity are considered to be members of the same association.

(1.3) A combination of methods referred to in sub-paragraph (1)(b)(ii) or (1.1)(b)(ii) or (iii) shall not be relied on by a person or entity to ascertain the identity of a person unless

(a) the information obtained in respect of that person from each of the two applicable identification methods is determined by the person or entity to be consistent; and

(b) the information referred to in paragraph (a) is determined by the person or entity to be consistent with the information in respect of that person, if any, that is contained in a record kept by the person or entity under these Regulations.

(1.3) If a document is used to ascertain identity under subsection (1), it must be original, valid and current. Other information that is used for that purpose must be valid and current and must not include an electronic image of a document.

(2) The identity shall be ascertained

(a) in the cases referred to in paragraph 54(1)(a) and subsection 57(1), and paragraph 60(a), before any transaction other than an initial deposit is carried out on an account;

(b) in the cases referred to in section 53, paragraph 54(1)(b), subsection 59(1) and paragraphs 59.3(a), 59.4(1)(a), 59.5(a), 60(b) and 61(b), at the time of the transaction;

(b.1) in the case referred to in section 53.1, before the transaction is reported as required under section 7 of the Act;

(b.2) in the case referred to in paragraph 54.1 (a), before any credit card is activated;

(c) in the cases referred to in paragraphs 55(a), (d) and (e), within 15 days after the trust company becomes the trustee;

(d) in the cases referred to in subsection 56(1) and paragraph 61(a), within 30 days after the client information record is created;

(e) in the cases referred to in paragraphs 59.1(a) and 59.2(1)(a), at the time of the transaction; and

(e.1) in the case referred to in paragraph 60(a), before any funds are disbursed; and

(f) in the case referred to in subsection 62(3), at the time a contribution in respect of an individual member of the group plan is made to the plan, if

(i) the member’s contribution is not made as described in paragraph 62(3)(a), or

(ii) the existence of the plan sponsor has not been confirmed in accordance with section 65 or 66.

(3) Unless otherwise specified in these Regulations, only original documents that are valid and have not expired may be referred to for the purpose of ascertaining identity in accordance with paragraph (1)(a) or (1.1)(a).

64.1 (1) A person or entity that is required to take measures to ascertain a person’s identity under subsection 64(1) or (1.1) may rely on an agent or mandatary to take the identification those measures described in that subsection only if that person or entity has entered into an agreement or arrangement, in writing, with that agent or mandatary for the purposes of ascertaining identity.

(2) A person or entity that enters into an agreement or arrangement referred to in subsection (1) must obtain from the agent or mandatary the customer information obtained by the agent or mandatary under that agreement or arrangement.

(2) The person or entity may rely on measures that were previously taken by an agent or mandatary to ascertain the person’s identity if the agent or mandatary was, at the time they took the measures,

(a) acting in their own capacity, whether or not they were required to take the measures under these Regulations; or

(b) acting as an agent or mandatary under a written agreement or arrangement — entered into with another person or entity that is required to take measures to ascertain a person’s identity — for the purposes of ascertaining identity under subsection 64(1).

(3) In order to rely on measures taken by an agent or mandatary under subsection (1) or (2), the person or entity shall

(a) have entered into a written agreement or arrangement with the agent or mandatary for the purposes of ascertaining a person’s identity under subsection 64(1);

(b) obtain from the agent or mandatary all of the information that the agent or mandatary used to ascertain the person’s identity; and

(c) be satisfied that the information is valid and current and that the agent or mandatary ascertained the person’s identity in the manner described in any of paragraphs 64(1)(a) to (d).

64.2 Every person or entity that is required under these Regulations to ascertain a person’s identity in connection with a record that the person or entity has created and is required to keep under these Regulations — or in connection with a transaction that they have carried out and in respect of which they are required to keep a record under these Regulations or under section 12.1 of the Proceeds of Crime (Money Laundering) and Terrorist Financing Suspicious Transaction Reporting Regulations — shall set out on or in, or include with, that record the person’s name and the following information:

(a) if the person or entity referred to an identification document under paragraph 64(1)(a), the type of document referred to, its reference number and the issuing authority and, if available, the place it was issued and its expiry date; 

(b) if the person or entity referred to information under paragraph 64(1)(b), the source of the information, the type of information referred to, a reference number associated with the information and the date on which the person or entity verified the information;

(c) if the person or entity referred to information under paragraph 64(1)(c), the source of the information, the reference number associated with the search of the credit file and the date on which the person or entity verified the information;

(d) if the person or entity referred to information under paragraph 64(1)(d), the source of the information, the type of information referred to and the account number contained in it — or if there is no account number contained in it, a reference number associated with the information — and the date on which the person or entity verified the information; or

(e) if the person or entity confirmed under paragraph 64(1)(e) that another entity had previously ascertained the person’s identity, the name   of that entity, the manner in which it previously ascertained the person’s identity under any of paragraphs 64(1)(a) to (d), the applicable information set out in one of paragraphs (a) to (d) of this section that is associated with that manner of ascertaining identity and the date on             which the person or entity verified the information.

Submit comments by September 12, 2015

Comments must be submitted in writing during the comment period, either by email or snail mail:

Snail Mail:

Lisa Pezzack, Director Financial Systems Division,

Financial Sector Policy Branch Department of Finance

90 Elgin Street Ottawa, Ontario K1A 0G5

Email:

fcs-scf@fin.gc.ca

Need a Hand?

At Outlier, we believe that it is important to participate in decisions that affect you and your business.  If you would like someone to look over your submission before you make comments to the Department of Finance, you can get in touch with us free of charge.  We will look over your submission and make suggestions, without any cost to you.  If you need a hand, please feel free to contact us.

 

Highlights from the 2015 AML Forum

This year I had the honour of co-chairing the Canadian Institute’s 14th Annual AML Forum, along with Ron King of Scotiabank. The event brought together a diverse group of stakeholders and speakers including regulators, law enforcement, bankers, money service businesses (MSBs), technology experts and government. Over two days, we enjoyed many lively discussions, and while I can’t cover all of the content here, I want to provide some insight for colleagues that weren’t able to attend the event.

Key Messages from Regulators & The Department of Finance

Representatives from the Department of Finance, the Office of the Superintendent of Financial Institutions (OSFI) and the Financial Transactions Reports Analysis Centre of Canada (FINTRAC) were present throughout the conference, and fielded questions from the audience throughout the event. Among the most exciting announcement was the Department of Finance’s assertion that we should expect a new AML regulations package to be released in draft for public comment later this year. Though the target date is set for June or July, anything can happen in an election year and there may be delays.

The Department of Finance, OSFI and FINTRAC also discussed Canada’s upcoming mutual evaluation by the Financial Action Task Force (FATF) and Canada’s countrywide risk assessment. The risk assessment is underway and expected to be shared later this year, in advance of the FATF’s visit this fall (with results expected to be published next summer). The risk assessment will likely prove to be a useful tool for regulated entities struggling to qualify Canadian money laundering and terrorist financing risk.

OSFI emphasized the importance of considering the AML program as part of the overall prudential compliance management strategy for federally regulated financial entities (FRFEs). It is expected that OSFI’s guideline B-8 will be revised in the near term. To avoid rework, OSFI is waiting for several key inputs including the updated AML regulations package, FINTRAC’s updated risk assessment guidance and the countrywide risk assessment. OSFI will also continue to work with FINTRAC on streamlining examination processes, citing the need to create a common framework and approach to examinations.

FINTRAC reviewed its recent statistics and emphasized the importance of the agency’s role as a financial intelligence unit (FIU). Key to this role are suspicious transaction reports (STRs), which will play a key role in upcoming examinations for regulated entities. FINTRAC will be applying several tests to STR data, including:

  • Entity Practitioner: similar transactions within an entity that were not reported to FINTRAC;
  • Sector Practitioner: a comparison of the number and type of STRs submitted by similar entities (the size and type of business are taken into consideration); and
  • Reasonable Practitioner: a comparison of the reported and unreported transactions against relevant guidance on reasonable grounds to suspect that money laundering or terrorist financing activity may be taking place.

This echoes FINTRAC’s comments throughout 2014 on the importance of suspicious activity reporting, a sentiment that was echoed by law enforcement.

Law Enforcement Focus

Speakers representing the Royal Canadian Mounted Police (RCMP) and US Federal Bureau of Investigation (FBI) discussed the strategic value of intelligence obtained through FIUs and directly from the financial services community. While the specifics of ongoing cases cannot be discussed publicly, both speakers emphasized the importance of providing complete and concise information, and excellent examples of how this type of intelligence is used by law enforcement.

The speakers confirmed that the dollar values for terrorism related transactions seen in Canada are consistently low. The RCMP discussed a transaction pattern relevant to individuals planning to attend radical training camps wherein an individual saves a relatively small sum via legitimate work (often at low wage jobs), then purchases a plane ticket and camping gear (which may account for all or almost all of the funds saved). Patterns such as these are useful for institutions seeking to understand and identify patterns of activity that may be indicative of potential terrorism.

The De-Risking Debate Continues

One of the most lively discussions of the event surrounded “de-risking” (refusing to provide service to a customer that is outside of the institution’s risk tolerance). While banks in Canada are private, for profit enterprises, access to banking facilities remains a vital component for business success. The money service business (MSB) sector has struggled with banking relationships both in Canada and abroad. Best-practices discussed included independent third party compliance reviews conducted by qualified practitioners as a valuable tool in assisting banks to assess the state of an MSB’s compliance. It was noted that while the MSB sector is certainly vulnerable to money laundering and terrorist financing, it is not the only vulnerable sector in Canada. While Canadian MSBs are regulated by FINTRAC, other sectors that are both vulnerable and unregulated have not experienced the same degree of de-risking.

Banks emphasized the risks for financial institutions in dealing with certain types of business as being broader than AML compliance. Chief among these risks was reputational risk. As one banker noted, when a bank’s larger clients are offside with requirements, the client, not the bank, is publicly held accountable. When the bank’s client is of a smaller size however, banks are being considered more responsible in the eyes of the media and the public. This, coupled with the profitability of accounts held for smaller entities considered by banks to be high risk, may be at the root of some of the banking woes experienced in the MSB sector, in particular by smaller MSBs.

Sanctions, PEPs and Analytics

Several speakers emphasized the importance of implementing and tuning technology solutions to detect persons and entities subject to sanctions, politically exposed persons and potentially suspicious transactions. Sanctions in particular appeared to be an emerging concern, with list screening alone viewed as being insufficient in terms of banking controls. The increased complexity of sanctions includes not only specific individuals and entities but their affiliates, including subsidiaries (which may not be easy to detect in many cases) and sanctions applied to specific types of transactions. For multinational financial service providers, there is additional complexity in managing sanctions related to doing business in several jurisdictions with different requirements. In order to comply effectively, information sharing across jurisdictions (including information about customer activity and risk) is likely to be required. For many entities, this will mean revising privacy related policies and disclosures to enable information sharing across a network of affiliated entities.

In addition to privacy considerations, the integration of systems and processes across affiliated entities and lines of business was a key consideration. One Canadian bank noted that they are in the process of synchronizing know your client (KYC) requirements across all lines of business, a process that involves the integration of data from over 35 separate IT systems and databases. Such synchronization is necessary to ensure that customer risk is considered consistently across all lines of business.

A Key Question on Emerging Technology

My co-chair raised an insightful point with the emerging payments panel in regards to Bitcoin and other emerging payment technologies. While banks have heard loud and clear that these technologies are not as anonymous as they were initially believed to be, there is a sense within the banking community that there has not, to date, been a solid assessment of the risk (or subsequently established best practices in mitigating these risks). Some of the risks raised by panelists included consumer protection (the risk that funds may be lost through negligence or bad actors) and the risks related to effective controls (which are similar to the types of risk that exist in other vulnerable sectors).

While it’s clear that emerging payment technology companies are working to demonstrate compliance in a changing regulatory landscape, there is clearly a gap between these companies and traditional financial institutions, in terms of messaging and expectations. We expect that this will be an ongoing conversation as the industry, regulations and technology continue to evolve.

We Would Love To Hear From You!

If there are topics that you would like to know more about, or if you need assistance with your compliance program, please contact us.

Return to Blog Listing


PROCESSING...