Micronesia -- AML/CFT Compliance Regulatory Overview

Micronesia, specifically the Federated States of Micronesia (FSM), is a member of the Asia/Pacific Group on Money Laundering (APG) and is committed to implementing the Financial Action Task Force (FATF) Recommendations. While the FSM's regulatory framework for virtual assets is still evolving, its AML/CFT obligations extend to virtual asset service providers (VASPs) based on international standards and its existing general AML/CFT legislation.

Here's a breakdown of the AML/KYC requirements for cryptocurrency/virtual asset service providers in FSM:

1. AML/CFT Legislation

The primary legislation governing AML/CFT in the Federated States of Micronesia is:

• Anti-Money Laundering and Terrorist Financing Act 2017 (Title 27 of the FSM Code): This act establishes the general framework for combating money laundering and terrorist financing, including obligations for financial institutions and designated non-financial businesses and professions (DNFBPs). While it may not explicitly mention "virtual assets" or "VASPs" as distinct regulated entities, the FSM, as an APG member, is expected to apply these requirements to VASPs in line with FATF Recommendation 15 (now Recommendation 16 in the context of the FATF's June 2019 Guidance for a Risk-Based Approach to Virtual Assets and Virtual Asset Service Providers).
• FSM Banking Act 1980 (Title 29 of the FSM Code): This act provides the general legal framework for banking and financial services. While it does not specifically regulate VASPs, any VASP that offers services resembling traditional financial services (e.g., custody of fiat currency, remittances) might fall under the purview or interpretation of this act or require specific licensing.

It's important to note that the APG's Mutual Evaluation Report for FSM (2019) indicated that the country had not yet specifically regulated or supervised VASPs for AML/CFT purposes, but recommended that it do so in line with FATF standards. This means that while explicit VASP-specific legislation might be nascent, the FIU expects VASPs to comply with existing general AML/CFT obligations.

2. Customer Due Diligence (CDD) Requirements

Based on the Anti-Money Laundering and Terrorist Financing Act 2017 and international FATF standards, VASPs are expected to implement CDD measures including, but not limited to:

• Identification and Verification:
  • For natural persons: Obtaining and verifying identity using reliable, independent source documents, data, or information (e.g., government-issued ID, passport, driver's license).
  • For legal entities: Obtaining and verifying the legal name, form of organization, proof of existence, powers that regulate and bind the entity, and the names of relevant persons holding senior management positions.
• Beneficial Ownership: Identifying and verifying the identity of the beneficial owner(s) of the customer, and taking reasonable measures to understand the ownership and control structure of legal persons and arrangements.
• Purpose and Intended Nature of Business Relationship: Understanding the purpose and intended nature of the business relationship or transaction.
• Ongoing Monitoring: Conducting ongoing due diligence on the business relationship and scrutiny of transactions undertaken throughout the course of that relationship to ensure that the transactions are consistent with the VASP's knowledge of the customer, their business, and risk profile.
• Risk-Based Approach: Applying a risk-based approach to CDD, meaning enhanced CDD (EDD) measures must be applied to higher-risk customers (e.g., Politically Exposed Persons - PEPs, customers from high-risk jurisdictions, complex or unusually large transactions, or where the customer's identity verification poses higher risk) and simplified CDD (SCDD) may be applied to lower-risk customers.

3. Suspicious Transaction Reporting (STR)

VASPs are obligated to report suspicious transactions to the FSM FIU. This includes:

• Reporting any transaction (or attempted transaction) that gives rise to a reasonable suspicion that it may be related to money laundering, terrorist financing, or other criminal activity.
• The obligation to report exists regardless of the amount or type of assets involved (fiat or virtual).
• No Tipping-Off: Prohibitions against informing the customer or any third party that an STR has been filed or that an investigation is being conducted.

4. Record-Keeping Obligations

VASPs are generally required to retain:

• Customer Identification Records: All records obtained through CDD measures (e.g., copies of identification documents, verification data).
• Transaction Records: Records of all transactions, including amounts, types of virtual assets, sending and receiving addresses/accounts, timestamps, and any other relevant transaction data.
• Business Correspondence: All relevant business correspondence, including records of analysis performed.

The FSM Anti-Money Laundering and Terrorist Financing Act 2017 generally requires records to be kept for at least five years after the business relationship has ended or after the date of the occasional transaction.

5. Authority Overseeing Compliance

The primary authority responsible for overseeing AML/CFT compliance for financial institutions and, by extension, VASPs in the Federated States of Micronesia is:

• Financial Intelligence Unit (FIU) of the Federated States of Micronesia (FSM FIU)
  • Role: The FSM FIU is the central national agency responsible for receiving, analyzing, and disseminating suspicious transaction reports and other financial intelligence. It provides guidance and oversight regarding AML/CFT compliance.
  • Website: https://www.fsmfiu.fm/

While the FSM Banking Commissioner (under the Department of Finance and Administration) is the general financial sector regulator, the FIU is specifically tasked with AML/CFT oversight and guidance. VASPs operating in FSM should engage with the FSM FIU to ensure they are meeting their evolving obligations under the national AML/CFT framework and international FATF standards.