Crypto asset service providers: meeting your FIC act obligations

The crypto asset service provider sector has recently been brought under the regulatory purview of the Financial Intelligence Centre Act (FIC Act).

This is to provide increased safeguards and protection mechanisms for consumers, and to aid in the fight against financial crime within South Africa.

Crypto asset service providers (CASPs) have been included as a new category of accountable institution following amendments to the Schedules to the FIC Act, which came into force on 19 December 2022.

• For more information and guidance refer to the FIC website.

The relative anonymity in the use of crypto assets, the ease and speed of conducting cross-border transactions make crypto assets favourable for money laundering, terrorist and proliferation financing purposes.

Item 22 under Schedule 1 to the FIC Act defines a crypto asset service provider as: “A person who carries on the business of one or more of the following activities or operations for or on behalf of a client:

(a) Exchanging a crypto asset for a fiat currency or vice versa;

(b) exchanging one form of crypto asset for another;

(c) conducting a transaction that transfers a crypto asset from one crypto asset address or account to another;

(d) safekeeping or administration of a crypto asset or an instrument enabling control over a crypto asset; and

(e) participation in and provision of financial services related to an issuer’s offer or sale of a crypto asset, where “crypto asset” means a digital representation of perceived value that can be traded or transferred electronically within a community of users of the internet who consider it as a medium of exchange, unit of account or store of value and use it for payment or investment purposes, but does not include a digital representation of a fiat currency or a security as defined in the Financial Markets Act, 2012 (Act 19 of 2012.)”

The amendments bring South Africa’s anti-money laundering, counter terrorism financing and proliferation financing (AML, CTF and PF) framework regime in line with the Financial Action Task Force’s (FATF’s) Recommendations related to the acquisition, safe custody, trading or use of crypto assets.

FATF sets international standards for combating money laundering, terrorist financing and proliferation financing.

As accountable institutions, CASPs are required to register with the FIC and fulfil AML, CTF and PF regulatory obligations.

FIC Act obligations on CASPs, as with all other accountable institutions, include filing regulatory reports to the Financial Intelligence Centre (FIC) on suspicious and unusual transactions, cash transactions above the prescribed threshold, and where a client has been identified as a designated person on a targeted financial sanctions (TFS) list.

For specific guidance related to a CASP, read draft public compliance communication (PCC) 120 on the FIC website.

Understanding and mitigating money laundering, terrorist financing and proliferation financing risks

As accountable institutions, CASPs must adopt a risk-based approach to understanding and managing their risks in relation to money laundering, terrorist financing and proliferation financing.

They are required to identify, assess, monitor, mitigate and manage the risk that their products or services may be abused by criminals for money laundering, terrorist financing and proliferation financing.

The identified money laundering, terrorist financing and proliferation financing risks as well as the monitoring, mitigating and management controls must be reflected in the CASP’s risk management and compliance programme (RMCP).

CASPs are required to develop, document, maintain and implement an RMCP in terms of section 42 of the FIC Act. For comprehensive guidance on RMCP please refer to the FIC’s Guidance Note (GN) 7 and PCC 53.

Customer due diligence

In addition, CASPs must conduct customer due diligence (CDD) on their clients, beneficial owners, persons acting on behalf of clients and other persons.

Enhanced due diligence must be applied where the client poses a high-risk business relationship or single transaction from a money laundering or terrorist and proliferation financing perspective.

Targeted financial sanctions

CASPs must scrutinise client information to identify persons designated on a targeted financial sanctions list (TFS list) and are prohibited from providing funds or financial services to designated persons.

The United Nations Security Council (UNSC) passes resolutions, which are financial sanctions targeted at designated persons or entities due to being involved in:

• Acts of terrorism
• Threats to international peace and security
• The proliferation of weapons of mass destruction
• Oppressive regimes and/or human rights abuses.

The comprehensive TFS list is published on the FIC website, and accountable institutions must scrutinise their client information against this list.

The TFS list reflects available identity particulars of persons and entities contained in terms of section 26A and 26B of the FIC Act.

The FIC website has a search functionality where CASPs can search against the full TFS list and download an audit trail of these searches for their records.

The TFS list on the FIC website is updated when changes are made to resolutions of the UNSC.

The FIC also sends e-mail notifications to all persons registered on its registration and reporting platform, goAML, whenever the list is updated.

Should you not be the registered person on goAML, you can request to receive these alerts, by subscribing here: Pages – subscribe (fic.gov.za). This is a free service offered by the FIC.

Account transaction or activity monitoring and suspicious and unusual transaction reports

CASPs must monitor transaction activity in order to identify reportable transactions or activities.

Where the CASPs suspects that a transaction or an activity involves money laundering, terrorist financing or proliferation financing, they must report this suspicion to the FIC as a suspicious transaction report (STR).

The reporting of suspicious and unusual transactions and activities is central to South Africa’s anti-money laundering and combating the financing of terrorist and proliferation activities regime.

A suspicion is subjective and may involve several factors that on their own could seem insignificant but taken together may arouse suspicion concerning that situation.

The CASPs should evaluate transactions, as well as the client’s financial history, background, and behaviour, when determining whether a transaction or activity is suspicious or unusual.

STRs must be reported as soon as possible without delay, and no later than 15 days of becoming aware of the suspicion.

The CASPs can continue with the transaction when an STR has been submitted to the FIC. Please refer to GN 4B for further information on STRs and red-flag indicators.

In addition, CASPs are obligated to submit cash threshold reports (CTR) (refer to GN 5C) as well as terrorist property reports (TPR) (refer to GN 6A) with the FIC.

Record-keeping controls

CASP are required to maintain records of its client information, transaction information and regulatory reports (eg. STRs, CTRs, TPRs) filed with the FIC.

The recording keeping process must be documented in the institution’s RMCP and should clearly indicate records access and confidentiality controls. The process could include:

• What records must be kept
• In what format the records will be kept such as hard copies or electronic records
• The period for which records must be kept
• If the records are kept by a third party, the full details thereof and the required notification to the FIC

For more information and guidance refer to the FIC website, www.fic.gov.za, for various guidance notes and public compliance communications.

Alternatively, contact the FIC’s compliance contact centre on +27 12 641 6000 or log an online compliance query on the FIC website.