In January 2019, the National Commission for Regulatory Improvement published draft amendments to the anti-money laundering (AML) rules which affect players in the financial industry, including banks.

The proposed amendments aim to improve compliance with Financial Action Task Force (FATF) Recommendations 1 and 10, which concern the risk-based approach and customer due diligence.

They also aim to strengthen the money-laundering prevention regime and enable Mexico to comply with the recommendations set out for it in the FATF's January 2018 assessment.

Notably, the draft amendments incorporate the definition of 'virtual assets' (ie, cryptocurrencies) into the AML rules.

Such virtual assets are considered to be a means of payment, but not a currency, and banks must report transactions involving virtual assets (ie, purchases and sales of virtual assets).

The proposed amendments also incorporate 'innovative models', as regulated by the FinTech Law. Customer due diligence and identification requirements regarding innovative models will be based on a risk-based approach.

Separately, the amendments seek to eliminate the requirement for banks to report to the regulator on their training initiatives on an annual basis.

These amendments, when passed, will help to incorporate the new concepts created by the FinTech Law into the AML regulations which apply to the traditional banking industry.

NASAA said that its ongoing "Operation Cryptosweep", which was launched in May, has now expanded to 200 investigations and resulted in 46 enforcement actions.

Some of the investigations involve suspected securities fraud, but other potential violations of state and provincial securities laws are also coming to light, including failure to properly register a product before it is offered to investors.

NASAA President and Alabama Securities Commission Director Joseph P. Borg said that regulators are "committing significant regulatory resources to protect investors from financial harm involving fraudulent ICOs and cryptocurrency-related investment products and also are raising awareness among industry participants of their regulatory responsibilities".

He added:

“While not every ICO or cryptocurrency-related investment is a fraud, it is important for individuals and firms selling these products to be mindful that they are not doing so in a vacuum; state and provincial laws or regulations may apply, especially securities laws. Sponsors of these products should seek the advice of knowledgeable legal counsel to ensure they do not run afoul of the law. Furthermore, a strong culture of compliance should be in place before, not after, these products are marketed to investors.”

Borg reminded industry players that any product that qualifies as a security needs to be registered with the appropriate regulatory agency or qualify for an exemption from registration.

He also advised investors to "do their homework" and "be cautious when dealing with promoters who claim their ICO offering is exempt from securities registration but do not ask about your income, net worth or level of investing sophistication".

Operation Cryptosweep was announced in May 2018 and saw securities regulators in North America launch dozens of investigations into potentially deceitful cryptocurrency investment products, in one of the largest co-ordinated series of enforcement actions by state and provincial officials in respect of virtual currency scams.

Requirement to identify customers involved in cryptocurrency trading

According to the Banxico Provision number 10/2018 the financial entities authorised to operate in the Interbanking Electronic Payment System (SPEI participants) must comply with the following obligations:

1. Identify among their clients those subjects (other than financial entities) that exchange or trade cryptocurrency in a regular and professional manner, in terms of article 17 of the Federal Law for the Prevention and Identification of Operations with Illicit Proceeds (Ley Federal para la Prevención e Identificación de Operaciones con Recursos de Procedencia Ilícita (the AML/CFT Law)).
2. With respect to clients mentioned in (1), only allow them to use demand deposit accounts with a financial entity, and collect from them the identification data referred in article 115 of the Credit Institutions Law (Ley de Instituciones de Crédito).
3. Refrain from opening any account to the clients mentioned in (1), in order to prevent such clients to offer their users these accounts for electronic fund transfers by SPEI.
4. Carry out additional validations regarding fund transfers to beneficiaries of the accounts mentioned in (1).
5. Have documented policies and procedures regarding the prevention of operations with illicit proceeds that include, at least, the activities that will be carried out to identify the accounts of the beneficiary clients referred to in section (1).
6. Refrain from making the resources available to the clients in (1) on the same banking business day on which those were received, when Banxico issues a notice regarding a situation in which SPEI participants must enhance their monitoring and alert mechanisms with respect to fund transfers by SPEI.
7. Refrain from issuing fund transfers in the name of the SPEI participant and on behalf of a third party, payable in any of the client´s accounts mentioned in (1) opened in the same SPEI participant or in any other.

Internal policy for client account identification regarding cryptocurrency trading

Banxico Provision number 11/2018 requires SPEI participants to establish a policy regarding the process for identifying client accounts that exchange and trade cryptocurrencies, according to the AML/CFT Law.

This process must be documented and attached to the authorisation request to Banxico to operate as a SPEI participant. Information regarding the application is defined in the Banxico Provision 14/2017.

Impact on cryptocurrency-trading platforms

Banks have raised concerns on how these provisions will affect market efficiency. For instance, financial entities now have to wait for a banking business day to process the fund transfer to the exchange.

Also, exchanges will have to comply with additional regulations making transactions take longer. Similarly, exchanges will have to follow client identification processes that will result in greater transaction costs.

Authorisation to exchange or trade cryptocurrencies

The AML/CFT Law states that the exchange of cryptocurrencies is considered a “Vulnerable Activity” and therefore financial entities or any entity authorized to exchange or trade cryptocurrencies must inform the Ministry of Finance (Secretaría de Hacienda y Crédito Público) of all operations over 645 units (Unidades de Medida y Actualización) which is equal to approximately $2,700 in a single operation or traded through a period of six months.

From 10 September 2019, all financial entities must comply with this disposition.

Also, the AML/CFT Law requires financial entities or any entity authorised to exchange or trade cryptocurrencies to have prior authorisation issued by Banxico in terms of the FinTech Law (Ley de Instituciones de Tecnología Financiera).

The FinTech Law establishes that its secondary regulations must include the authorisation requirements, the terms and conditions for financial entities, FinTechs and exchanges involving cryptocurrency trading, other operations that can be carried out with said assets, the measures for custody and control of the assets, among others.

The FinTech Law established a period of 12 months for Banxico to issue the secondary regulation mentioned above, therefore Banxico has until the end of March 2019 to do so.