PROCESSING...

Anti-Money Laundering
Consulting Services & Strategies

0 Items - Total: $0.00 CAD

2019 AML Updates for Credit Unions

Background

On July 10th, 2019 the final amendments to Canada’s anti-money laundering (AML) regulations, were published in the Canada Gazette.  Many of the changes are based on requirements set out by the Financial Action Task Force (FATF), an inter-governmental body that sets out international standards for combating money laundering and terrorist financing, as well as from certain amendments made to the Proceeds of Crime (Money Laundering) and Terrorist Financing Act (PCMLTFA) made through the Economic Action Plan 2014 Act, No. 1 and the Budget Implementation Act, 2017, No. 1.

For those that prefer to see the updates in context, we have created unofficial red-lined versions of the regulations, which can be found here.

It is expected that all regulated entities will have to significantly revamp their AML compliance program due to the changes. There are three different “coming into force” dates that should be noted:

  • June 25, 2019: a wording change from “original” to “authentic” related to identification. This is welcomed news for digital identification.
  • June 1, 2020: changes related dealers in virtual currency (which do not directly apply to Credit Unions).
  • June 1, 2021: all other regulatory amendments.

Updated guidance from FINTRAC is expected to be seen ahead of the coming into force dates. Given the legislative changes, there will be adjustments to various FINTRAC policy interpretations so be sure to monitor closely and save any interpretations that you may have used for due diligence purposes.

Hefty Disclaimer

This article should not be considered advice (legal, tax or otherwise). That said, any of the content shared here may be used and shared freely – you don’t need our permission. While we’d love for content that we’ve written to be attributed to us, we believe that it’s more important to get reliable information into the hands of community members (meaning that if you borrow content that we wrote and published publicly, we may think you’re a jerk but we’re not sending an army of lawyers).

What Does This Mean For Your Credit Union?

Changes to Canada’s AML regulations will have a direct impact on a Credit Union’s AML obligations, including the following:

  • Reporting;
  • Record keeping; and
  • Member identification.

Many changes will require adjustments in your IT systems to ensure that all necessary information is available to be included in FINTRAC reports, particularly those involving online transactions. If you’re not sure where to start please feel free to contact us. From a practical standpoint, while you do have some time to update your AML program, it is best to start budgeting and planning now.  It may also be prudent to discuss changes with your board of directors as well.

FINTRAC Reporting

This round of changes to AML regulations has a much greater focus on reporting including changes to the information that will need to be included in various reports. We have summarized the applicable changes below.

Certain reports will require information that was not originally included. These changes include information such as:

  • Purpose of transaction;
  • Source of cash or source of funds;
  • For online transactions:
    • Type of device used by person who makes request;
    • Number that identifies device;
    • Internet Protocol address used by device;
    • Person’s or entity’s user name; and
    • Date and time of when a person makes a request.

While most of these fields are mandatory, where fields are marked as optional, if an entity has the information (this may mean in the background of your IT systems), it is expected that it be included in the report. For full details on what has changed for FINTRAC report fields, we have created an unofficial redline which can be found here.

All changes related to reporting come into force on June 1, 2021.

STR Reporting

Currently, if a reporting entity has reasonable grounds to suspect that a transaction, or attempted transaction, is related to money laundering or terrorist financing, a report must be submitted to FINTRAC. The timeframe for submission was within 30 days of the date that a fact was discovered that caused the suspicion. The revised regulations amend this to “as soon as reasonably practicable after measures have been completed to establish that there are reasonable grounds to suspect that a transaction or attempted transaction is related to money laundering or terrorist financing.”

This means that a report will be due shortly after a reporting entity has conducted their analysis that established reasonable grounds for suspicion. It will be important to have detailed processes for unusual transaction investigations and this should include a step in the process that clearly identifies when a determination is made that establishes reasonable grounds to suspect the transaction is related to money laundering or terrorist financing. A defined time for what “as soon as reasonably practicable” means should be documented as well to ensure reports are completed and submitted on time. It will be interesting to see how FINTRAC looks at this obligation during examinations.

Terrorist Property Reporting

A very small change (or clarification), related to Terrorist Property Reports, has been made in the final regulations. The timing requirement for filing has changed from “without delay” to “immediately”. This means regulated entities need to report that they are in possession of terrorist property as soon as they become aware.

EFT Reporting

The definition of an EFT has changed with the amended regulations and reads as such:

An electronic funds transfer means the transmission by any electronic, magnetic or optical means of instructions for the transfer of funds, including a transmission of instructions that is initiated and finally received by the same person or entity. In the case of SWIFT messages, only SWIFT MT-103 messages and their equivalent are included. It does not include a transmission of instructions for the transfer of funds:

    1. that is carried out by means of a credit or debit card or a prepaid payment product if the beneficiary has an agreement with the payment service provider that permits payment by that means for the provision of goods and services;
    2. that involves the beneficiary withdrawing cash from their account;
    3. that is carried out by means of a direct deposit or a pre-authorized debit;
    4. that is carried out by cheque imaging and presentment;
    5. that is both initiated and finally received by persons or entities that are acting to clear or settle payment obligations between themselves; or
    6. that is initiated or finally received by a person or entity referred to in paragraphs 5(a) to (h.1) of the Act for the purpose of internal treasury management, including the management of their financial assets and liabilities, if one of the parties to the transaction is a subsidiary of the other or if they are subsidiaries of the same corporation.

The definition now includes instructions initiated and received by the same person or entity, which means certain internal transfer transactions may be caught.

Also related to EFT reporting, the final amendments removes the language commonly known as the “first in, last out” rule. This means that the first person/entity to ‘touch’ the funds for a transaction incoming to Canada, or the last person/entity to ‘touch’ the funds for a transaction outgoing from Canada, had the reporting obligation (as long as the prescribed information was provided to them). The update will change the reporting obligation to whoever maintains the customer relationship.

Large Virtual Currency Transaction Reporting

If you plan to conduct transactions involving virtual currencies such as bitcoin, you will be required to report the receipt or the sending of amounts of CAD 10,000 or more in a virtual currency to FINTRAC. These basically are the same as Large Cash Transaction reporting obligations, including making a determination if the person from whom the virtual currency is received is acting on behalf of a third party, and will require reporting entities to maintain a Large Virtual Currency Transaction Record.

Most of the recordkeeping requirements for virtual currency are very similar to Large Cash Transaction requirements.

The 24-Hour Rule

Multiple transactions performed by, or on behalf of, the same customer or entity, or are for the same beneficiary, within a 24-hour period are to be considered as a single transaction for reporting purposes when they total CAD 10,000 or more. This would mean that only one report would need to be submitted to capture all transactions that aggregate to CAD 10,000 or more. If you use software to automatically detect these types of transactions, you should begin discussions with your IT department or software provider to determine the time and resources that will be required to update the detection process.

For example, currently, a Large Cash Transaction Report must be submitted either for single transactions of CAD 10,000 (or more), or for multiple transactions of less than CAD 10,000 each that add up to CAD 10,000 or more in a 24-hour period. This can result in situations where two reports are filed for transactions taking place in a 24-hour period.

Cash deposit of CAD 12,000 – LCTR #1 for CAD 12,000
Cash deposits of CAD 5,000 and CAD 6,000 – LCTR #2 for CAD 11,000

Using the same example, under the new rules we would have:
Cash deposits of CAD 12,000, CAD 5,000 and CAD 6,000 – Single LCTR for CAD 23,000

We can expect to see guidance from FINTRAC ahead of the enforce date. If you have questions prior to this,  it is possible to write to FINTRAC to request a policy interpretation.

Compliance Program

In addition to the process changes, including reporting changes discussed above, there are some other changes that you will need to make to your compliance program.

Training

The amended regulations have introduced a new requirement to institute and document a plan for ongoing compliance training.  This differs from the current requirement to develop and maintain a written training program.

In practice, this means that in addition to documenting all of the training that has already been completed, you will need to clearly document future training plans. Be sure staff is receiving training on process changes that are applicable to their roles.

Risk Assessment

One of the deficiencies identified in the Financial Action Task Force (FATF) review of Canada was not having a requirement to assess new technologies before their launch. The final amendments require all reporting entities to assess the risk related to products and their delivery channels, as well as the risk associated with the use of new technologies, prior to public release.

This has been a best practice since the requirement to conduct a risk assessment came into force, but this change makes this a formal requirement. This will require strong communication and closer cooperation between compliance officers and teams involved in the development of new products or services.

Records of Reasonable Measures

The requirement to keep records related to reasonable measures to obtain certain information, has been removed with this round of changes. It is important to note that credit unions must still take reasonable measures and it is only the requirement to keep a record of the measures used that has been repealed. 

Identification

The range of identification methods that can be used will be broadened. This is good news, especially for credit unions that are using identification methods for members who are not physically present.

Prior to this round of changes, there was a requirement that when members are identified, the document and/or data that you collect must be in its “original” format. The final regulations replace the word “original” with “authentic”, and state that a document used for verification of identity must be “authentic”, valid and current. This would allow for scanned copies of documentation, and/or for software that can authenticate a person’s identification document. This change came into force on June 26, 2019.

Other changes to the identity verification requirements are as follows:

  • For credit file verification (single source), the credit file information must now be derived from more than one source (i.e. cannot contain only one trade line on the credit file);
  • For the dual source method, when relying on a credit report as part of a dual source, the credit file must have been in existence for at least six months. Additionally, the person or entity that is verifying the information cannot be a source (i.e. you cannot be a tradeline of the credit file).

In addition, there are provisions that allow a credit union to rely on the identification conducted previously by other reporting entities. If this method is used to identify a member, the credit union must immediately obtain the identification information from the other reporting entity, and have a written agreement in place requiring the entity doing the identification to provide the identification verification as soon as feasible.

If you have members that are publicly traded trusts, credit unions will be required to obtain names and addresses of all persons who own or control, directly or indirectly, 25% or more of the units of the trust.

Politically Exposed Persons (PEPs)

The amended regulations add some new requirements related to PEPs, which are as follows:

  • You must obtain the “source of wealth” of a PEP; and
  • If a PEP is a head of an international organization, the person will continue to be treated as a PEP for five years after they have held the position.

This change comes into force on June 1, 2021, and will likely result in IT system changes related to record keeping and monitoring.

Prepaid Products

If you offer Prepaid Payment Products, the amended regulations now include new obligations for prepaid cards that are issued by financial entities. The obligations are similar to those that apply to regular member accounts, and comes into force on June 1, 2021.

The regulations apply to any prepaid payment product that is tied to an account, that permits funds or virtual currency that total CAD 1,000 or more to be added to the account within a 24-hour period, or where a balance of CAD 1,000 or more will be maintained.

Records that will have to be maintained are as follows:

  • a record of the name and address of each holder of a prepaid payment product account and each authorized user, the nature of their principal business or their occupation and, in the case of a person, their date of birth;
  • if an account holder is a corporation, a copy of the part of its official corporate records that contains any provision relating to the power to bind the corporation in respect of the prepaid payment product account or the transaction;
  • a record of every application in respect of the prepaid payment product account;
  • a prepaid payment product slip in respect of every payment that is made to the prepaid payment product account;
  • every debit and credit memo that it creates or receives in respect of the prepaid payment product account;
  •  a copy of every account statement that it sends to a holder of the prepaid payment product account; and
  • a foreign currency exchange transaction ticket in respect of every foreign currency exchange transaction that is connected to the prepaid payment product account.

There are also record keeping obligations where an international electronic funds transfer of CAD 1,000 or more has been conducted through the prepaid product. Additionally, a prepaid payment product slip, similar to a deposit slip, must be maintained.

Similar to member accounts, you will also have to keep account applications and any foreign currency transaction information related to the prepaid product. A PEP determination is to be made when the prepaid product account is opened, and when a payment of CAD 100,000 or more is made to a prepaid product account.

We’re Here To Help

If you would like assistance in updating your compliance program and/or processes, or have any questions related to the changes, you can get in touch using our online form on our website, by emailing info@outliercanada.com, or by calling us toll-free at 1-844-919-1623.

2019 AML Regulation Highlights for Dealers in Virtual Currency

Back in June 2018, we published an article on proposed AML rules for dealers in Virtual Currency. On July 10th, 2019, updates to Canada’s anti-money laundering (AML) regulations were published in the Canada Gazette. There are three different “coming into force” dates (the dates on which the content of various updates become requirements for regulated entities). 

  • July 10, 2019: a small change in wording (from “original” to “authentic”) is good news for digital identification.
  • June 1, 2020: dealers in virtual currency must be registered as money services businesses (MSBs) and have AML compliance programs in place.
  • June 1, 2021: additional provisions, including reporting large virtual currency transactions.

This is a significant regulatory package with a lot of changes (the document is over 200 pages long). This article will cover the major points for dealers in virtual currency, but it’s important to remember that there is a lot of nuances and differences between business models. We recommend speaking to your local neighbourhood compliance geek about how to adapt to these changes (if you need a compliance geek, please get in touch).

It is also worth noting that tokens that are considered securities would not be considered virtual currencies. Securities and securities dealers were already regulated. If you’re not sure whether or not a token is a security, we recommend reaching out to a securities lawyer (if you need recommendations, please feel free to contact us). It is possible to be both a securities dealer and a dealer in virtual currencies, but if you are only looking for the changes pertinent to securities dealers, you will find those in another article.

Hefty Disclaimers & Sharing

This article should not be considered advice (legal, tax or otherwise). That said, any of the content shared here may be used and shared freely – you don’t need our permission. While we’d love for content that we’ve written to be attributed to us, we believe that it’s more important to get reliable information into the hands of community members (meaning that if you punk content that we wrote, we may think you’re a jerk but we’re not sending an army of lawyers).

Dealers In Virtual Currency

It’s important to start by understanding what’s being regulated. This is best done by considering some of the definitions that have been added to the regulation.

fiat currency means a currency that is issued by a country and is designated as legal tender in that country. (monnaie fiduciaire)

funds means

(a) cash and other fiat currencies, and securities, negotiable instruments or other financial instruments that indicate a title or right to or interest in them; or

(b) a private key of a cryptographic system that enables a person or entity to have access to a fiat currency other than cash.

For greater certainty, it does not include virtual currency. (fonds)

virtual currency means

(a) a digital representation of value that can be used for payment or investment purposes that is not a fiat currency and that can be readily exchanged for funds or for another virtual currency that can be readily exchanged for funds; or

(b) a private key of a cryptographic system that enables a person or entity to have access to a digital representation of value referred to in paragraph (a). (monnaie virtuelle)

virtual currency exchange transaction means an exchange, at the request of another person or entity, of virtual currency for funds, funds for virtual currency or one virtual currency for another. (opération de change en monnaie virtuelle)

In terms of who will be regulated, businesses (whether or not the business is incorporated) that conduct transactions on behalf of their customers, including:

  • Exchanging digital currencies for fiat currencies; and 
  • Exchanging between virtual currencies.

This would include custodial wallet services that hold customers’ private keys on their behalf, as well as exchanges, brokerages, and automated teller machines (ATMs). The requirements apply to foreign and domestically based businesses. The inclusion of foreign MSBs means that it won’t matter where your business is incorporated. If you are targeting your services to Canadians, you are expected to comply with Canadian rules and you will need to be aware of requirements as they apply to your Canadian customers.

One of the most important notes in our view is “These amendments serve to mitigate the money laundering and terrorist activity financing vulnerabilities of virtual currency in a way that is consistent with the existing legal framework, while not unduly hindering innovation. For this reason, the amendments are targeted at persons or entities engaged in the business of dealing in virtual currencies, and not virtual currencies themselves.” It is expected that there will be additional updates to the regulations, and community consultations. During these processes, this distinction should remain an important one.

Digital Identification and “Authentic” Documents

Canadian businesses, such as MSBs, that are regulated for AML purposes must identify certain customers either because there is an ongoing service agreement, an account, or because the customer performs specific types of transactions. In these instances, the methods used to identify customers are prescribed in the regulations. Previously, there was a requirement that any document that was used in identification processes be “original”. A narrow view was taken of the definition of the word original: the document itself, in whatever form it was issued. No scans, copies or other digital representations were permitted. This was a significant challenge in non-face-to-face environments.

Effective on publication of the updates, the word “original” has been replaced with “authentic”. It’s important to keep in mind that while this does allow for documents to be submitted in a myriad of digital formats, there will be an expectation that reporting entities do something in order to determine whether or not the document is authentic. The regulations are not prescriptive in terms of how this will be done. We expect that a number of different solutions, ranging from having a human review documents, to using AI to make risk-based determinations, will be valid. If there are processes that you aren’t sure about, it is possible to write to FINTRAC to request a policy interpretation. We expect that FINTRAC will release updated guidance on identification, and issue many subsequent policy interpretations as the landscape evolves.

For customers that were previously identified, there is an expectation that the customer is identified in accordance with the rules that were in place at the time. Unfortunately, this means that if a customer was identified before the updated regulations were published, and an electronic version of a document was used, the identification may not be considered complete. It will be important for businesses to assess the processes that were in place at this point in time in order to make an accurate determination of whether or not the standards were being met.

Registering as a Money Services Business (MSB)

Although the legislation has been published, Dealers in Virtual Currency are not yet able to register as money services businesses (MSBs) with FINTRAC, Canada’s federal AML regulator and financial intelligence unit (FIU). The process is relatively straightforward, beginning with a pre-registration form. 

The FINTRAC registration process is generally very efficient (taking two to four weeks in total). As part of this process, you must provide FINTRAC with complete information about your business, including:

  • Bank account information;
  • Information about your compliance officer;
  • Number of employees;
  • Incorporation information (if your business type is a corporation);
  • Information about your MSB’s owners and senior management, such as their name and date of birth;
  • An estimate of the expected total dollar amount of transactions per year for each MSB service you provide;
  • Detailed information about every branch; and
  • Detailed information about every Canadian MSB agent.

You are not required to have locations or offices in Canada in order to register as an MSB with FINTRAC. Once registered, the registration must be maintained and you must:

  • Keep registration information up to date;
  • Respond to requests for, or to clarify information, in the prescribed form and manner, within 30 days;
  • Renew our registration before it expires; and
  •  Let FINTRAC know if we stop offering MSB services to Canadians

SCAM ALERT: There is no cost to register an MSB with FINTRAC – although we’ve heard of several scams claiming that there is a fee. Please ensure that you are only registering through valid FINTRAC sites, which will contain “fintrac-canafe.gc.ca” in the url. If you have received a phishing email or other request to pay FINTRAC registration fees, we recommend reporting this to both the Canadian Anti-Fraud Centre and to FINTRAC directly.

All dealers in virtual currency are expected to register with FINTRAC by June 1, 2020.

Building or Updating Your Compliance Program

MSBs in Canada are required to have a documented AML compliance program in place. In all instances, when something is a requirement it’s not enough to have done something to meet that requirement. Both your process and what you’ve actually done in order to meet the requirement must be documented. An AML compliance program has these elements:

  1. Compliance Officer: this is the person who will be responsible for your AML compliance program. They should understand Canadian AML requirements, be relatively senior in your company (access to your Board and Management team is necessary), and sign up to receive updates from FINTRAC.
  2. Policies and Procedures: these are documents that describe what you are required to do, and how you will do it. The processes should be an accurate description of what you are actually doing and detailed enough that a new hire could follow them.
  3. Risk Assessment: this is a document that considers the risk that your business could be used to launder money and/or finance terrorism. FINTRAC has released detailed guidance for MSBs to help create this type of document.
  4. Ongoing Training: any staff (including part-time and temporary staff) that deal with customers, transactions, and systems must receive training on a regular basis (this is generally interpreted to mean at least annually). It’s fine to rely on an external vendor, but your training should also include training on your processes.
  5. AML Compliance Effectiveness Reviews/Audits: every two years, you must complete a formal review of the effectiveness of your AML compliance program and operations. This can be conducted internally or by an external vendor.

In addition, to your documented program, you will need to ensure you operate in a compliant manner which includes, registering with FINTRAC, identifying customers under certain circumstances (more on this under customer identification), collect know your customer (KYC) information, keep records, and report certain transactions to FINTRAC.

All dealers in virtual currency are expected to have compliance programs in place and operational by June 1, 2020.

Customer Identification and Collecting KYC Information

For dealers in virtual currency, customer identification and the collection of KYC information will be required where virtual currency exchange transactions valued at CAD 1,000 or more are conducted. This will include exchanging fiat for virtual currency, as well as exchanges between virtual currencies.

Customers must also be identified, where possible if there are reasonable grounds to suspect that a transaction is related to money laundering or terrorist financing. When a transaction is suspicious, there is no minimum value threshold for identification.

Identification in this context must be completed in specific ways, each of which require particular records to be maintained. The chart below is from FINTRAC’s current customer identification guidance (which must be updated to reflect the change in wording from original to authentic, though other elements remain unchanged).

If the customer is an entity (a company, partnership, trust, etc.), then measures must be taken to confirm the entity’s existence and beneficial ownership. Certain details must be collected for directors, trustees, beneficiaries of trusts, and anyone that owns or controls 25% or more of an entity. This includes “indirect ownership” (such as ownership through another company).

There is also information about the customer that must be collected. For individuals, this includes name, date of birth, address, and occupation or principal business. For entities, this includes name, address, place of incorporation (if applicable), and incorporation number (if applicable). 

All dealers in virtual currency are expected to have processes in place to identify customers and collect KYC information by June 1, 2020.

FINTRAC Reporting

For reporting, there are two important dates. By June 1, 2020, dealers in virtual currency will need to report the same types of transactions that MSBs are currently required to report. These are:

  • Large Cash Transactions: if you receive cash (this means fiat in the form of bills and/or coins) valued at CAD 10,000 or more in the same 24-hour period, by or on behalf of the same customer, it must be reported to FINTRAC within 15 calendar days. 
  • Suspicious Transactions: if there are reasonable grounds to suspect that a transaction is related to money laundering or terrorist financing, it must be reported to FINTRAC within 30 calendar days of the discovery of a fact that led you to determine that the transaction was suspicious.
  • Attempted Suspicious Transactions: if a customer or prospective customer requests a transaction, but does not complete it (including transactions that you reject), and there are reasonable grounds to suspect money laundering or terrorist financing, then it must be reported. The timeframe is the same as it would be for completed transactions.
  • Terrorist Property: if you’re in possession of property (which includes funds and virtual currency) that belong to a terrorist or terrorist group, it must be reported without delay, and the property must be frozen. In addition to reporting to FINTRAC, these reports are also sent to the CSIS and RCMP – by fax. In order to know if customers fall into this category, it is important to screen against lists published by OSFI. We’ve worked with some friends on a tool to make this easier, which you can try here (use the code Free100 for a free trial).
  • Electronic Funds Transfers: if you send or receive international electronic funds transfers (EFTs), including wires, valued at CAD 10,000 or more, by or on behalf of the same customer, it must be reported to FINTRAC within 5 working days.

If you are required to report transactions valued at CAD 10,000 or more in a 24-hour period, you must have a mechanism in place to detect reportable transactions.

It’s noteworthy that if you are conducting international EFTs on your customers’ behalf, you may already be an MSB. The best way to know for certain, in our opinion, is to request a policy position from FINTRAC. This can be done free of charge by emailing guidelines-lignesdirectrices@fintrac-canafe.gc.ca. This can also be done on your behalf by a lawyer or consultant.

By June 1, 2021, a new report will be introduced.

  • Large Virtual Currency Transactions: if you receive virtual currency valued at CAD 10,000 or more in the same 24-hour period, by or on behalf of the same customer, it must be reported to FINTRAC within 5 working days.

There will be some additional changes to reporting and reporting timelines, including the requirement to report suspicious and attempted suspicious transactions “as soon as practicable” after you have determined that there are reasonable grounds to suspect that the transaction is related to money laundering or terrorist financing.

For Extreme Compliance Nerds

We clearly mean nerd as the highest term of admiration and endearment, and for you, we have created red-lined versions of the regulations, with new content showing as tracked changes. This is not an official version of the regulations, and we do, of course, recommend that you check it against the official version.

Need a Hand?

Whether you need to figure out if you’re a dealer in virtual currency, to put a compliance program in place, or to evaluate your existing compliance program, we can help. You can get in touch using our online form, by emailing info@outliercanada.com, or by calling us toll-free at 1-844-919-1623.

Return to Blog Listing