Ecuador -- AML/CFT Compliance Regulatory Overview

Ecuador has been steadily progressing in its regulatory framework for Anti-Money Laundering (AML) and Counter-Financing of Terrorism (CFT), particularly in response to the Financial Action Task Force (FATF) recommendations, which now explicitly include Virtual Assets (VAs) and Virtual Asset Service Providers (VASPs).

While Ecuador's Central Bank (BCE) maintains that cryptocurrencies are not legal tender and has prohibited financial institutions under its supervision from operating with them, the country has also recognized the need to regulate VASPs from an AML/CFT perspective.

Here's a breakdown of the AML/KYC requirements for cryptocurrency/virtual asset service providers in Ecuador:

Overseeing Authority

The primary authority responsible for supervising and enforcing AML/CFT compliance for Virtual Asset Service Providers (VASPs) in Ecuador is the:

• Unidad de Análisis Financiero y Económico (UAFE) - The Financial and Economic Analysis Unit.
  • URL: https://www.uafe.gob.ec/

The UAFE is Ecuador's Financial Intelligence Unit (FIU) and is responsible for collecting, analyzing, and disseminating information on suspicious financial transactions to combat money laundering and terrorist financing. It designates "obligated subjects" (sujetos obligados) who must comply with AML/CFT regulations.

AML/CFT Legislation and Regulations

1. Ley Orgánica de Prevención, Detección y Erradicación del Delito de Lavado de Activos y Financiamiento de Delitos (Organic Law for the Prevention, Detection, and Eradication of the Crime of Money Laundering and Financing of Crimes)

   • Issued: May 2016 (with subsequent reforms).
   • This is the foundational AML/CFT law in Ecuador, establishing the general framework, defining money laundering and terrorist financing crimes, and outlining the obligations for "obligated subjects." It empowers UAFE to issue specific regulations.

2. Resolución No. UAFE-DG-2022-0001 (Resolution No. UAFE-DG-2022-0001)

   • Issued: January 2022.
   • This is the key regulation for VASPs. It explicitly designates Virtual Asset Service Providers (VASPs) as "Obligated Subjects" (Sujetos Obligados) under the AML/CFT framework in Ecuador. This resolution formalizes the application of AML/CFT obligations to entities involved in virtual asset activities, aligning Ecuador with FATF Recommendation 15.
   • This resolution also defines "Virtual Asset" and "Virtual Asset Service Provider" in line with FATF definitions.

Customer Due Diligence (CDD) Requirements

VASPs in Ecuador, as obligated subjects, must implement robust CDD measures based on a risk-based approach. This includes:

1. Identification and Verification of Customer Identity:

   • Natural Persons: Obtain and verify full name, date of birth, nationality, identification number (e.g., cédula, passport), address, contact information, occupation/activity. Verification usually requires official documents.
   • Legal Entities: Obtain and verify legal name, registration number, date of incorporation, legal form, address of registered office, names of directors/partners/shareholders, and identification of individuals authorized to act on behalf of the entity. Verification requires official registration documents.

2. Beneficial Ownership (BO) Identification:

   • Identify and verify the identity of the natural persons who ultimately own or control the customer, or the natural person on whose behalf a transaction is being conducted. This is crucial for legal entities and trusts.

3. Purpose and Intended Nature of the Business Relationship:

   • Understand the reason for the customer's interest in VASP services and the expected type and volume of transactions.

4. Ongoing Monitoring:

   • Continuously monitor customer transactions and activities to ensure they are consistent with the VASP's knowledge of the customer, their business, and risk profile.
   • Regularly update customer information and documentation.

5. Risk-Based Approach:

   • Develop and implement a risk assessment framework to identify, assess, and mitigate ML/TF risks.
   • Apply enhanced due diligence (EDD) for higher-risk customers (e.g., Politically Exposed Persons - PEPs, customers from high-risk jurisdictions, complex or unusually large transactions, new technologies and products that favor anonymity).
   • Apply simplified due diligence (SDD) for lower-risk customers/transactions where appropriate.

Suspicious Transaction Reporting (STR)

VASPs are legally obligated to report suspicious transactions to the UAFE.

• Reporting Obligation: Any transaction, attempted transaction, or activity that raises suspicion of money laundering or terrorist financing, regardless of the amount, must be reported.
• No Tipping-Off: VASPs and their employees are prohibited from disclosing to the customer or any third party that a report has been or will be submitted to UAFE.
• Reporting Mechanism: Reports are typically submitted through UAFE's electronic system (SARLAFT system).
• Internal Policies: VASPs must have internal policies and procedures to identify, evaluate, and report suspicious transactions.

Record-Keeping Obligations

VASPs must maintain comprehensive records to assist in investigations and demonstrate compliance. This includes:

• Transaction Records: All details of virtual asset transactions (e.g., amount, type of virtual asset, sender/recipient addresses, timestamps, fiat currency equivalents, transaction hashes).
• Customer Identification Data: Records of all documents and information obtained during CDD and EDD processes (identification documents, beneficial ownership information, risk assessments).
• Business Correspondence: Relevant correspondence with customers regarding transactions or relationships.
• Internal Reports: Records of internal suspicious activity reports, analysis, and decisions made.
• Duration: These records must generally be kept for a period of at least five (5) years from the date of the transaction or the end of the business relationship, whichever is later.

Additional Requirements and Considerations

• Internal Control System: VASPs must establish and maintain an internal control system for AML/CFT, including a designated compliance officer, regular training for employees, internal audits, and a manual of procedures.
• Sanctions Screening: VASPs should implement procedures to screen customers and transactions against national and international sanctions lists.
• Technology and Cybersecurity: Given the nature of virtual assets, robust cybersecurity measures are essential to protect customer data and prevent unauthorized access or manipulation of transactions.

Disclaimer: This information is provided for general informational purposes only and does not constitute legal advice. Cryptocurrency regulations are evolving rapidly. It is crucial for any VASP operating in or dealing with customers from Ecuador to consult with legal professionals specializing in Ecuadorian AML/CFT and financial regulations to ensure full compliance.