What must a BitLicense holder's anti-money laundering program include, including the risk assessment and independent testing?
A BitLicense holder (a "licensee") must run a written, risk-based AML program built on an initial risk assessment, with four minimum elements: internal controls, independent testing, designated compliance personnel, and training. The text is as published current through October 31, 2023.
Risk assessment: The licensee must do an initial assessment of legal, compliance, financial, and reputational risks tied to its activities, services, customers, counterparties, and geographic location, and build, maintain, and enforce its program on that basis. It must reassess annually, or more often as risks change, and modify the program to reflect changes (23 NYCRR 200.15(b)).
Minimum elements (23 NYCRR 200.15(c)):
- Internal controls, policies, and procedures designed to ensure ongoing compliance with all applicable AML laws, rules, and regulations.
- Independent testing of compliance and of the program's effectiveness, at least annually. It may be done by qualified internal personnel who are not responsible for the design, installation, maintenance, or operation of the program or its policies and procedures, or by a qualified external party. The findings must be summarized in a written report submitted to the superintendent.
- Designation of a qualified individual or individuals in compliance to coordinate and monitor day-to-day compliance.
- Ongoing training for appropriate personnel so they understand AML requirements, can identify reportable transactions, and can maintain required records.
The program must also include a written AML policy reviewed and approved by the board of directors or equivalent governing body (23 NYCRR 200.15(d)).
The section also sets further requirements, including recordkeeping and reporting, a customer identification program, OFAC compliance, and duties of the designated compliance individual (23 NYCRR 200.15(e), (h), (i), (k)). Their detail is outside this answer.
Sources
This answer is general information, not legal advice. Forteris is not a law firm.
Have a question this doesn't cover?
The Forteris Compliance Assistant answers your team's BSA/AML questions in Slack, from the same checked library, with every answer reviewed by Forteris before it is posted. Free for 14 days or 10 questions.