Good afternoon. My name is Michael Rosensaft and I'm a partner at Katten Muchin Rosenman in the white collar crime and investigations group. And today, I'll be covering anti-money laundering developments that happened throughout 2021 and into the first half of 2022. By the end of the CLE, hope you'll understand the changes that were put into place through the AML Act that was implemented right at the end of 2020, but really into 2021. I'll go through the components of an effective AML compliance program. I'll highlight recent enforcement actions and what regulators and law enforcement have identified as their priorities in AML legislation and enforcement. And I'll put a particular focus in the cryptocurrency space as entities there struggle to comply with and understand some of the new laws and regulations that both have passed and seem to be on the horizon. And just a little bit about myself. I'm currently at Katten Muchin Rosenman, but formerly I was a prosecutor at the US Attorneys office in the Southern district of New York where I worked in the international narcotics and terrorism unit. While in that unit, I prosecuted money laundering among other crimes. And that included the prosecution of the former president of Guatemala for money laundering for which he served a sentence of approximately 70 months. Since joining Katten, I have advised clients on their money laundering programs. I've advised cryptocurrency firms on the requirements that have been passed and are planning to be passed and spoken generally to clients about sanctions, Export Control Law, and other requirements related to anti-money laundering. So I first wanna start with the Anti-money Laundering Act of 2020, although it was passed right at the end of 2020. And that act had a number of components which I'll go through today. First, there is a beneficial ownership reporting requirement that's gonna be put into place. And you'll hear in a second that that requires entities to report the beneficial owners who control or have a certain percentage of businesses in order to give law enforcement and treasury and others an increased view into the people and entities behind the businesses. Second, the AML Act included increased foreign subpoena power for law enforcement, enhanced penalties for violations of AML Law, and an expansive whistleblower program that gave increased incentives for whistleblowers and broaden the number of people who could be included as whistle blowers. It also had a major effect on the cryptocurrency world by identifying cryptocurrency exchanges as financial institutions. And finally, the AML Act provides for the information sharing between law enforcement, but also through financial institutions. So let me take each of these in turn. So first, on the beneficial ownership reporting measures of the AML Act. Now, this has not been implemented yet. It's been going through proposed rulemaking. But as part of the act, Congress enacted the Corporate Transparency Act and it requires entities to disclose information about beneficial owners. Information includes the full legal name, the address, and a unique identifying number and further information that treasury will likely propose. Beneficial owners are those that exercise substantial control over an entity or owns or controls 25% or more of the ownership interests of entity. And we'll go through in a minute what that means. And the information of beneficial owners is gonna be placed in a FinCEN database to be available for law enforcement, regulators, intelligence agencies, and some state agencies as well. And there's also provisions that it may be accessible by other financial institutions in order to carry out their AML compliance. So to carry out this act in December of 2021, FinCEN released a Notice of Proposed Rulemaking. And in that notice, it suggested that this beneficiary reporting requirement should apply to companies within the United States, but also foreign reporting companies registered to do business in the United States. It suggested that companies should provide an initial report to FinCEN within one year and any changes thereafter within 30 days of the biographical information changing. And for each beneficial owner, the company should provide the name, address, and also an identification document such as a passport or a driver's license. And the first question people have been grappling with is they consider this proposed rule and what compliance structure they should put in place in order to follow it. You know, it's what is a beneficial owner? Who should be included? And with the legislation in FinCEN, they've been given some guidance, although it's not as specific as some entities may like. So a beneficial owner can control more than 25% of a company, and the real question is what it means can exercise substantial control. Like who is someone that exercises substantial control over the entity? FinCEN said in the proposed rule that ownership interest should include both equity in the reporting company and other types of interests such as capital or profit interest. That those who exercise substantial control include senior officers, individuals that can appoint or remove senior officers, individuals who determine or have significant influence over important matters affecting the company, and anyone else exercising substantial control. So they did specify that beneficial owners will include officers and people who can remove officers, but there's still this wide area of anyone exercises substantial control that there's really been no specific guidance on. Now, through the proposed rulemaking, there'll be comments and a final rule will come out. Hopefully, it'll give further guidance on what a beneficial owner is. Most likely though, it will remain vague and companies will be left to determine how far they should go in their diligence in identifying beneficial owners. And we'll give some examples later of different companies in different types of industries and how they consider some of these issues. So the AML Act also increased foreign subpoena power. Now, agencies can subpoena records from foreign entities as long as they have a correspondent bank account in the United States. There had been attempts to do this before to serve subpoenas on companies when they have a correspondent bank account, but they had not always been successful. So now, it's been codified into law that as long as that correspondent bank account exists in the United States, a subpoena can be served. But that creates a lot of issues. One, and this is not something the AML Act addressed, was that the subpoenas can a lot of times conflict with foreign law. And there's been some cases on this whether US law or foreign law would govern how you balance the rights under US law for law enforcement against the prohibitions under foreign law. With this power given to law enforcement, there should be more litigation as well. And there's also a big issue with foreign privacy laws. In the United States, we have privacy laws, but they're not nearly as robust as the ones in the EU, with the exception of maybe of California who has enacted pretty robust privacy protections. So when we subpoena information, when law enforcement and subpoenas information in the US and asking for identifying information, transactions, identifying numbers and documents, there's gonna be an issue with privacy law in the EU, and whether those subpoenas may violate it. And entities are going to be entities who maybe just have a correspondent bank account in the US are gonna have an issue about whether to comply with the subpoena and risk a violation of privacy law, or refuse to comply with the subpoena and there'll be further litigation. Another big aspect and a big change that the AML Act carried out was changes in the cryptocurrency world. And specifically, it made clear that a financial institution, under the Bank Secrecy Act, was amended to include businesses involved in the exchange of value that substitutes for currency or funds. And specifically, this targets cryptocurrency exchanges. Now, FinCEN already had a position that cryptocurrency exchanges had these reporting duties, but that had been tested and was continuing to be tested in some instances. But now, there's no question. Cryptocurrency exchanges do have the reporting requirements that other financial institutions do. Another aspect of the AML Act that concerned some people in the cryptocurrency world had to do with NFTs or non-fungible tokens. There's been a lot of media attention recently about NFTs. You may have read that these can include pictures, short videos, you know, almost anything that's in a digital format, but it's placed on a public blockchain such that you can show everyone that you own the original. And some of these are artwork by famous artists. Some of them are made by anonymous users, but they've sold for an enormous amount of money, in some cases, millions of dollars. So this is an area where treasury has been looking at to see if regulations are appropriate in the art world. People have used art to launder money in the past. And then the question becomes, for NFTs, is this an area which has a high risk of money laundering? The treasurer report was asked, or the treasurer was asked to issue a report about the art dealer world, and also we assumed it would include NFTs. And it did. And they came out with that report in February of 2022. They noted that emerging online art markets such as the purchase of NFTs do present new AML risks. The report suggested that there should be reporting requirements for institutions perhaps having more than $500,000 in annual sales. And for any of these institutions that sell one NFT at a million dollars or more, they would fall into this group. However, the report ultimately concludes that while art dealers and NFTs is a subset, may be a place where money could be laundered, this should not be a high priority because treasury has other gaps to fill first such as real estate and investment advisors, which we'll talk about later. So in the end, for now, art dealers, and those who have a marketplace to buy or sell NFTs will not have increased regulations. But that said, it is clear that is something the treasury continues to look at. They have identified this area as a high risk for money laundering and any NFT dealer or marketplace should have an AML program in place, both to prevent any money laundering. But also when I expect these changes will go into effect and when new laws are passed, that target NFTs in the art dealership world, they are ready. And finally, I mentioned before, the AML Act has a whistleblower program where they're offering rewards that are up to 30% of government fines. And this could be quite large in some cases. We'll go through it later, but government has fined institutions in the hundreds of millions of dollars in some cases for AML violations. The whistleblower program also specified that compliance personnel can be whistleblowers. Finally, the whistleblower does not have to initially report to the government. This is typically a requirement of whistleblower statutes that the whistleblower first comes to the government, report it, but the AML Act did away with that requirement. The AML Act also has increased penalties. It provides for enhanced penalties if the violator was a partner, director, or employee at the time of the violation. It specifies that repeat violators could be fined three times the profit gain or loss avoided or twice the statutory maximum penalty. And then it criminalizes failing to file beneficiary ownership information. Finally, the AML Act provides for increased information sharing amongst law enforcement agencies, but also amongst private institutions and financial institutions. I now wanna shift my focus to the pillars of an effective AML compliance program. The Federal Reserve, FDIC, National Credit Union Administration and Office of the Comptroller of the Currency, they issued guidance, and later an FAQs to companies, on what they consider the minimum requirements of a BSA, Bank Secrecy Act, AML compliance program. This was welcomed by the industry as previously there had not been this structure in place. Although, as you'll see, it's still very ambiguous, but it provides a roadmap to what institutions should look at. First, they identified Customer Identification Program with risk-based procedures. A company should also have a system of internal controls that assure ongoing compliance. Independent testing of their AML program. They should have a designated individual or individuals responsible for monitoring compliance. And finally, they should have training for appropriate personnel. So first with the Customer Identification Program, and you're gonna see for all of these requirements that this all follows under a risk-based approach. And what that means is, these agencies and regulators have stated when they assess your compliance program they understand at the same time you have to run a business. And it doesn't make sense for an international financial institution to have the same kinda program in place as a small domestic company. So when looking at these pillars that they've set forth, they should be looked at as a risk-based approach. How risky is the business you're doing for money laundering purposes versus how arduous should the requirements be. So for a Customer Identification Program, the kind of information that should be collected is gonna depend on the customer and also the business. For instance, does a customer have a low volume of transactions or high volume of transactions? What is the amount of the transaction? Is the type of service involved an industry in which the entity is working one that presents more of a risk of money laundering? And is the business domestic or international? So for an international company that has a high volume of transactions, that are very substantial in nature, let's say in the art world or in an industry which is identified as one that has a high risk of money laundering, the compliance program must be a lot more robust than dealing with the domestic entity with a smaller volume of modest transactions. Company must also have a good system of internal controls. And again, this is on a risk-based approach with a recognition that you have to run your business. So considerations are some of the same ones in the Customer Identification Program. What sector are you operating in? What type of services are you offering? Who your customer based is? And the difficulty of collecting that information. For instance, in the cryptocurrency world, if you're having users doing small transactions with you and you ask for their driver's license, you're probably gonna lose your customer base. And that's not what FinCEN and treasury department and others are asking. It's a risk-based approach. How can you run your business in a way that's compliant with the anti-money laundering laws, considering the type of business, the risk of money laundering, and how those compliance procedures will affect your business. There should also be independent testing of your AML compliance program. And this is one where a lot of companies get into trouble. Most companies know that they have to due diligence when they onboard customers and they have a third-party database or other procedures in place to check the customer's name and information. Most companies have some individual at the institution that is in charge of watching over money laundering compliance. They may have provisions in their employee manual that employees have to sign that they reviewed. They talk about the dangers of money laundering and how the company is trying to prevent it being used to launder money. But companies do not as often have independent testing. And that means a third party. It could be someone within the company that's outside of the compliance structure, but it's even better if it's a third-party lawyer, or there's a lot of companies that will come in and do this testing. They can look over your records, talk to you about what obstacles you faced in the last year, look over any suspicious activity reports if you have them, and your policies and determine if your program is compliant. And regulators and law enforcement, they're gonna wanna see that that testing is done. And if they don't see it, it's gonna be another sign to them that your program may not be compliant. Each entity should have a money laundering reporting officer, and this can be someone whose sole purpose is to run money laundering compliance, although that's typically done with sanctions. Maybe FCPA compliance as well. Or it can be someone with other duties also at your organization. It could be an outside individual as well. I have clients who have hired third-party companies who specialize in money laundering and similar regulations. And they act as the money laundering reporting officer. But the company needs to designate someone who can monitor the implementation of the AML policies. They receive the internal reports of suspicious transactions and decide how to handle them, whether to consult outside counsel. And they ensure that the staff is properly trained, conduct risk assessments, arrange for testing, and generally try to stay abreast of AML developments. And finally, training. And regulators of stress, this shouldn't just be paper training. This is not just aligned in an employee manual. But employees should be trained, should be given information, in a risk-based approach again, that is commensurate with their position in the company and the risk of money laundering at the company. But it should be training. It should be periodically done. And there should be records kept of the training. And when we talk about what kind of training to do, it also depends on the role of the employee. If the employee is one who onboards customers, then they need robust training. If the employee is not customer-facing and does not look at customer information, then perhaps just alerting them that there are dangers in money laundering is enough. So again, it's a risk-based approach and it's training depending upon the industry in which the company is and the type of employee and what their duties are. So I wanna go through some examples of different institutions and clients that I've had as they've approached me with different questions that they've had, whether it's how to structure their compliance program or when they identify suspicious transactions, what to do about them. So here you have some examples from banks, very large institutions with robust reporting requirements down to local contractors who often ask me, "Do I even need an anti-money laundering program?" Or when I talk to them about what guidance has been given, "Do I really need to do all that?" And the answer is no. Those banks and local contractors are obviously very different organizations. They present different risks of money laundering. And using this risk-based approach, regulators and law enforcement are not gonna require as much from local contractors than they will from large financial institutions. But local contractors may be surprised to know that if there are issues and if they deal with a customer in a sanctioned country, for instance, or a transaction that is put through their business, turns out to be one related to money laundering, they will be asked what their compliance program is and they need to have something in place. We've already talked a little bit about NFT dealers. They're in the cryptocurrency world, but at least for now. There doesn't seem to be new regulations that are gonna be passed that specifically deal with them, but they need to have an AML program in place that's commensurate with treasury department identifying them as a high risk area. We'll talk a little bit later about hedge funds, private equity funds, and other financial institutions and advisors because there's been great scrutiny very recently on what AML compliance should look like for those institutions. And then finally, charitable organizations. I've counseled a number of charitable organizations about their AML procedures. These organizations accept donations a lot of times from all around the world. And I've had clients who were given a donation by a Russian oligarch, for instance, when donations have been sent through third parties for no apparent reason. And these charitable organizations, although not a high risk of money laundering in most cases, they have been looked at by law enforcement and by regulators. And they too should have a program in place that's commensurate with the risk of money laundering. Are they an international organization? Are they a domestic organization? What is the size of the donation they're accepting? If they're accepting donations in the hundreds of dollars, it's a very different case than if they get a large donation from one international benefactor. So I wanna turn to cryptocurrency firms now, because as I said, the AML Act of 2020 codified this idea that cryptocurrency exchanges are financial institutions. But there are other regulations that likely are going to come to pass in the next few years for other entities. I did notice though that between 2021 and 2022, we have gotten slightly different tone from government officials on cryptocurrency firms. In 2021, Secretary of the Treasury Janet Yellen said that cryptocurrencies have been used to launder the profits of online drug traffickers. They've been a tool to finance terrorism. NSE chair said cryptocurrency is used to, quote, skirt our laws and is like the wild west rife with fraud, scams, and abuse. Now, if you look at 2022, though, it seems that both have changed their tone a little bit. Janet Yellen stated that cryptocurrency may become a trusted money comparable to physical cash, and that the financial system benefits from responsible innovation. And the SEC chair quote, "These crypto platforms play roles similar to those of traditional regulated exchanges." So this change from 2021 to 2022, and it's a change you can see in a lot of different agencies and amongst law enforcement as well, I think it happens when these individuals and agencies are better educated on the cryptocurrency world and that there has been an increased sophistication of law enforcement and government officials of what cryptocurrency is and what cryptocurrency isn't. When cryptocurrency first became widely known, I think there was a pervasive view that it was only good for furthering crimes, laundering money, buying illegal substances. And that's not true. But individuals and agencies who didn't know anything about how cryptocurrency works had those assumptions. Today, you see they're a lot more educated though. They understand that cryptocurrency can be seen that there's a public blockchain. And I don't wanna get too far into the weeds, but every transaction, for instance, for a Bitcoin, can be publicly seen. You may not know the identity of the person who sent the Bitcoin or the person who received the Bitcoin. You can learn that through other techniques, in investigative techniques. But every single transaction that happens with that Bitcoin, it's publicly available. You can see it. And I think law enforcement and the government has started to understand that. That it may not be a place actually which lends itself to money laundering like they thought it did before. Nevertheless, there's still a lot of concern over the cryptocurrency industry. And most recently, with the passage of the Infrastructure Bill, there were new provisions in there that many in the cryptocurrency world are very concerned about. The Infrastructure Bill requires cryptocurrency brokers, and that word is not defined, to file informational returns with the IRS for any transactions and cryptocurrency greater than $10,000. The IRS is going to be able to use these reports to identify large transfers of cryptocurrency assets, to conduct money laundering investigations, and try to secure taxable income that they think they have lost by not knowing about these transactions. It likely will be implemented for tax year 2023. So it sounds like maybe it's a good idea. Financial institutions already have to report transactions over a certain amount. And in the cryptocurrency world, if we're considering cryptocurrency similar to Fiat currency and hope it's gonna be used widely around the world, maybe it seems like this regulation may make sense. But the problem is, who is a broker? And there's been a whole movement and you can look up #DontKillCrypto. But if you expand the term broker to be too widely used, you're going to shut down a lot of cryptocurrency companies and there's worries it'll shut down. It'll really hurt the industry at all. Under the Infrastructure Bill, it's been defined as anyone who, for consideration, regularly provides any service responsible for effectuating transfers of digital assets including any decentralized exchange or peer-to-peer marketplace. Now, when I said it wasn't defined, I meant this is so vague. It's unclear here who is a broker, who is not. Senators Warner and Portman wanted to include provisions in the bill that specified that software developers, minors, node operators are all brokers. And you don't need to know necessarily what all these are, but these different companies and individuals who develop software, who are mining for cryptocurrency, they're the underpinning of the cryptocurrency system. And if they're made to report transactions above $10,000 and there's other reporting requirements put on them, this could create a real problem for cryptocurrency. And then you have Senators Toomey, Lummis, and Wyden, and they wanted to include provisions that would've specifically excluded minors and wallet providers. None of these senators got their way. The compromise was to leave it vague. But that creates a lot of worry and uncertainty. Department of Treasury is working on guidance to limit the scope of the term broker according to some confidential sources that have apparently reported that to the press. Hopefully, who is a broker will be specified so that people know who has to file reports, who does not, and it's not gonna be as pervasive as it could be. Another enforcement priority for AML violations is now going to be private equity, hedge funds, and other financial advisors. Not too long ago, the FBI had in a report that was leaked that hedge funds in private equity firms receive funds from entities registered in nations that maintain laws, conductive to masking underlying beneficial owners, thereby making it harder for US financial institutions and regulators to determine the source of the funding. Additionally, the report went on. Hedge funds and private equity firms have been used to facilitate transactions and support a fraud, transnational crime, and sanctions of Asian. The art dealer report that I mentioned earlier, which discussed NFTs, also spoke about private equity funds and hedge funds. And in that report, although it suggested that NFTs and art dealers did not need increased regulation right now, it did suggest that treasury worked to close outstanding gaps in the US AML/CFT regime related to potentially investment advisors and non-financial gatekeepers. There have been renewed calls to include registered investment advisors in the PATRIOT Act's definition of financial institution. And this was something that has kind of been sitting around since 2015. There was a proposed rule by FinCEN that would've required advisors to hedge funds, private equity funds, and other private funds to establish anti-money laundering compliance programs and to report suspicious activity. The proposal was never finalized and it has been on the agencies' active rulemaking agenda on and off since that point. There's now been renewed calls to revive that and put it into place. The SEC's Division of Examinations cite AML compliance, including among other things, the establishment of Customer Identification Programs for financial advisors. In March, 2022, Senators Whitehouse of the Senate Finance Committee and Elizabeth Warren of the Banking and Finance Committee called on treasury to impose AML reporting requirements on hedge and private equity funds. And finally, Secretary of the Treasury Janet Yellen reported to house lawmakers that treasury was actively considering a rule to extend AML requirements to all investment advisors. Now, most large, private equity funds, the hedge funds, they do have AML programs in place. Their investors want it a lot of times. Banks want it. And they've taken conservative views appropriately and put compliance programs in place. For funds that have not done so, now is the time to start doing so. These regulations are on the horizon. I expect that in the next year, at least by 2023, there will be new regulations issued by Department of Treasury, by the SEC, and we'll actually see that a little bit later as well, that impose stricter AML requirements on funds and investment advisors. Now, we've talked a little bit about this already, but cryptocurrency hasn't been identified as an enforcement priority in the AML world. In March of 2022, treasury announced a proposed rule that would require firms to disclose foreign accounts holding more than $50,000 in cryptocurrency. At the same time, however, Treasury Secretary Janet Yellen told house lawmakers that exchanges that convert cryptocurrency to hard currencies are already subject to heightened regulations, which make it more difficult to use cryptocurrency to launder money. And quote, "Trying to use crypto on a large scale, simply we think is something that is not easy to do to launder money." And finally, in April, 2022, SEC chairman said that SEC plans to register and regulate cryptocurrency exchanges. And there's been back and forth among the SEC and the CFTC on who has the power to regulate cryptocurrency exchanges and investigate and enforce cryptocurrency law and violations. The war on Ukraine has also been identified as an enforcement priority in terms of AML Law and whether individuals that have been sanctioned by the US government can subvert those sanctions through money laundering. In March of 2022, the acting head of FinCEN stated that it was ramping up its own AML enforcement efforts amid growing global threats and noted the importance of compliance programs that are well designed and effective and not just quote, unquote paper programs. FinCEN issued two alerts concerning the risk of Russian sanction of Asian using cryptocurrency, real estate transactions, and high-end artwork. It also noted the importance of these beneficial owner filings that are going to come in place. "Oligarchs be warned," remarked US Deputy Attorney General Lisa Monaco, announcing a task force of law enforcement and other agencies to focus on Russian sanctions of Asian, including the use of money laundering. And then one thing I saw that was very interesting in a debate in the UK's House of Lords, a member citing concerns that law firms are being used to help Russian oligarchs launder money due to a lack of KYC controls. Now, in the EU, and the UK in particular, there is heightened anti-money laundering requirements compared to the US. They're very strict in the steps that must be taken. I know that law firms that operate in the US but also have offices in the UK oftentimes have much stricter AML policies in place than those who are the just domestic. But here, the law firms have been identified as a risk of money laundering. Now, in the US, I think most law firms, when they go through their conflict check, they do have some kind of rudimentary check to make sure they're not dealing with sanctioned individuals. They may have a criminal background check of some sort or a new search, although that's not, I think, very common. But in the UK, and I think in the US as well, law firms are gonna be looked at more and more as to whether they're compliant with AML Law. We've seen an increased number of prosecutions in the US of lawyers, of law firms who have been identified as dealing with individuals accused of crimes. And there's been an erosion, I think, of the attorney client privilege, of the work product privilege as investigators who previously tried to keep a wide birth around breaking that privilege now seem to regularly issue subpoenas to law firms and put together taint teams where government officials are reviewing attorney client privilege documents to determine if there's any fraud. So law firms have to be vigilant. It's not just in the UK, but in the US as well, especially for mid to small size law firms who may not have those international offices. Law firms have to have compliant money laundering programs in place that are risk-based and based in those same pillars that treasury has issued for financial institutions. I wanna now talk about some of the enforcement penalties that have been levied in the last year and in the first half of this year as well. Regulators and law enforcement have been relentless against firms who they believe do not have robust AML programs in place. And it's not just in the investigation, but very small inadequacies in AML programs. Even if there's full cooperation by the institution and even if the institution fixes those problems, they still can oftentimes result in very large penalties being assessed. And just going through some of them. In January of 2021, a financial institution was fined $390 million for AML failures, including failure to file SARs. That same month, another financial institution was fined $45 million for quote, unquote inadequate compliance. And then if we move to March of 2021, FINRA imposed a $1.5 million fine on a member for failing to submit SARs. And we've seen that already that it's not just treasury, it's not just the FBI and law enforcement, the SEC, the CFTC, the FINRA, and other regulators over the financial industry have made money laundering one of the priorities. When they audit a company or they send information requests or subpoenas to a company, a lot of times they're asking for their AML compliance manual, their AML procedures, any reports that they had of suspicious activity. And these are things that they expect a company to have. And if they don't, they're incredibly harsh on companies. In August of 2021, there was a $100 million settlement by a cryptocurrency exchange for failing to file SARs and conduct appropriate due diligence. And this gets back to our examples where you have banks who have been financial institutions for a very long time and are very adept usually at AML compliance, although their programs and policies are often picked apart by regulators for any inadequacies. But cryptocurrency exchanges have only recently been defined as financial institutions. And although most of them have AML programs in place that follow the guidelines, a lot of times they're not as robust as banks who have developed those same programs over years. And here, one cryptocurrency exchange was fined $100 million for some of those, from that lack in compliance. In December of 2021, a smaller bank was made to pay $9 million to treasury and FinCEN for understaffing its AML department, and thereby not being able to carry out robust diligence and timely filing SARs. So here, you have a very small bank. We're not even dealing with a large financial institution. And under this risk-based approach, even though it's still a financial institution, you would expect that regulators would look at the smaller bank a little different looking at a bigger global bank. But they cited them for understaffing their department and timely filing SARs. So it wasn't that the bank did not file SARs, but they didn't file them in the time period prescribed by the Bank Secrecy Act. So even for this smaller bank who was trying to put together a program with some less risk of money laundering, at least than a very large institution, they were fined $9 million. And then in March of 2022, another bank was fined $140 million by FinCEN for failure to maintain inadequate AML program after repeated warnings, including the failure to file SARs. So these penalties and these actions are not lighting up. And in fact, in a lot of ways, they're increasing. 2020, I believe, was a record year for AML penalties and fines worldwide. 2021 kept up with that pace. And if the first six months of 2022, or any indication, we're continuing to see these very large fines being levied. And institutions who have a compliance program and maybe trying their best to follow these general guidelines are still being fined for late filings, for failing to staff for quote, unquote inadequate compliance. And they're being fined very, very large amounts. And again, this is not just treasury. This is not just the FBI doing an investigation, but the SEC, the CFTC, FINRA, everyone, all of these agencies have made AML their priorities. Just this month in fact, there have been new proposals to have increased requirements for anti-money laundering and financial institutions. G7 financial leaders, just last week, and this was towards the end of May, called for consistent and comprehensive regulations for digital asset companies that will hold the cryptocurrency industry to the same standards as traditional finance. And the group of G7 which are intergovernmental agencies comprising Canada, France, Germany, Italy, Japan, the UK, and the US, specifically cited that the travel rule should be implemented. Now, the travel rule for anyone who's not familiar is a rule put in place such that when money, when funds travel from one financial institution to the next, the information about who is transferring those funds should travel with the transaction and financial institution should submit that biographical data, the data they know about who originally that transaction to subsequent financial institutions. So here, G7 financial leaders are proposing it for digital asset companies, such that whoever is initiating a digital asset transaction when those other exchanges and financial institutions are involved, that information will travel with that digital currency. I mean, worldwide, I talked about cryptocurrency regulations in the US, but worldwide, rules are being crafted for the cryptocurrency industry. Again, just this month, and I'm talking about in May, an official of the United States Financial Crimes Enforcement Network called on cryptocurrency companies to remain vigilant about illicit activity. And US Senator Cynthia Lummis teased a wide-ranging draft bill that would classify and define various types of digital assets and put requirements on them, depending on what type of digital asset it was. These similar laws and proposals are being considered in Europe and throughout the world. As regulators and governments grapple with what cryptocurrency is, hopefully, as they learn what it isn't, and as it becomes more dominant as, more dominant in the financial industry. So we went through a lot of areas today. There have been massive changes, massive changes in the AML world since the AML Act was passed. And I spent a lot of time talking about the cryptocurrency world today, but that has been, I think, the industry most affected by these new laws. You have a lot of exchanges that are more sophisticated and are establishing themselves in the industry. And then you have very small companies who are just trying to figure out how they're gonna run their business and how they're gonna comply with these guidelines. I just wanted to talk about one example that I've dealt with. I've had a company who was selling digital assets online, and their first question is, do they really need to have an AML program in place? They're not a financial institution. They're not a exchange. Their transactions typically are going to be in small amounts. There could be a large volume maybe, but they're typically gonna be in small amounts. They don't think that there is a high risk of money laundering. So what do they need to put in place? Do they need to put anything in place? And my answer to my clients in these types of situations is usually you should put whatever you can in place. It's restrictive enough such that if a regulator or law enforcement comes and starts asking questions, you can point to the documents you have and the procedures you have in place. But at the same time, you can't put restrictions in place that are gonna kill your business. If you're dealing with customers that are buying things over the internet using cryptocurrency, typically these customers do value the anonymity in some ways. And if you ask them for passports and driver's license and things like that, a lot of times they're just gonna decide not to use your service. So the question becomes, when do you start asking for those documents? Obviously, when you have a transaction that's $10, that doesn't seem a reasonable place to ask for those types of identification documents. When you have a transaction that's a million dollars and you're selling in NFT, that does seem a reasonable place and I think most buyers would expects you to take some information from them and take some identification from them. But where is that line? And again, I think it's put what measures you can put on that are as restrictive as the business can tolerate. Considering where you are in your infancy, what funds you have to put together a program and how much your customers are gonna tolerate your money laundering, anti-money laundering requirements. And then this is a big problem. There are a few things that are very easy. One, an AML manual. This costs a little bit of money from a lawyer or another third-party service just to put one together. But other than that, this is not going to affect your business. It's something that can inform your employees on the required AML requirements. Talk about AML Law. And when investigators or regulators ask about your program, it's the first document you can turn over. Second, an MLRO, the Money Laundering and Reporting Officer that's talked about by the guidelines. This is also something very easy to do. It does not have to be someone whose job is only money laundering compliance. It can be the chief operating officer. It can be someone else in compliance. Could be a lawyer. Could be someone a third party. But appointing someone just who knows about the AML requirements and can address situations if they arise is another easy thing to do that's not gonna hurt your customer base. Training, this is another thing that will cost a little bit of money maybe to do. Although, again, there's third companies that regularly do this training for entities. But having your employees trained in what money laundering is, and making clear that your company's efforts to combat money laundering will impose certain restrictions on them. But again, this isn't going to affect your customer base. Doing these internal controls to make sure you have procedures in place, a manual, training, and then audit, a review of your policies on a periodic basis to determine if they're robust enough. These are things I think every company in the cryptocurrency world should have and can have without hurting their business. The real problem comes in the KYC. How much information are you gonna ask from your customer? And this is gonna depend on the customer. But you could ask for their name. Now, the customers can give a real name or a false name. But if you ask for their name and run it through a system, or just check it on OFAC's online tool, which is free, you can only say you have a procedure in place to check your customer's names. And this could be for smaller transactions. You could go up and ask for a phone number, for address information. Again, this is gonna depend on the size of the transaction and how intrusive the customer will think this is. But a lot of times, when customers sign up to platforms, they do give some kind of biographical information that you have then, and you can check again through free services. The real question comes, when do you start to ask for identification documents? Because that's the point where it can hurt your business and the customer could decide not to continue with the transaction. And it's a hard discussion, but that really is the issue for a lot of these cryptocurrency companies, these young cryptocurrency companies. There's no easy answer and it's something that they should consult a lawyer about. And having the policy in place, whatever it is, is almost more important than determining the exact amount. Because when regulators come or law enforcement comes, you want to be able to show them that you took this seriously, that you did put policies in place, that you did train employees, you worked with a lawyer, or you worked with an outside consultant. And that's really the most important thing. Not that what the dollar amount is, but that you took this seriously and you have the records to prove it. I expect in the next year, we're gonna continue to have new rules, new proposed rules, new legislation whether it's passed or not targeting anti-money laundering. We've seen a flurry of activity of sanction obviously in the last few months. And with the SEC and other regulators, it is going to continue to be their focus going forward.