Notice No. 1/2023

Notice No. 1/2023 of the Bank of Portugal .................................................................................................................................................................................................. Published in: DR, 2nd Series, Part E, No. 17, of 24-01-2023 Mod. 99999910/T – 01/14

Index Text of the Notice Annex I to the Notice Annex II to the Notice Annex III to the Notice Annex IV to the Notice

Text of the Notice

Law No. 83/2017, of August 18, establishes preventive and repressive measures to combat money laundering and terrorist financing, partially transposing into the domestic legal order Directive (EU) 2015/849 of the European Parliament and of the Council, of May 20, 2015, on the prevention of the use of the financial system and of activities and professions especially designated for the purposes of money laundering and terrorist financing.

Law No. 97/2017, of August 23, regulates the application and enforcement of restrictive measures approved by the United Nations or the European Union and establishes the sanctioning regime applicable to the violation of these measures.

On September 1, 2021, Law No. 58/2020, of August 31, entered into force, which transposed into the domestic legal order the revision promoted by Directive (EU) 2018/843 of the European Parliament and of the Council, of October 23, 2018, to Directive (EU) 2015/849, referred to above, amending, among other instruments, Law No. 83/2017, of August 18.

By virtue of such amendments, entities that exercise, on national territory, in their own name or on behalf of a client, at least one of the economic activities with virtual assets listed in point (mm) of paragraph 1 of Article 2 of that instrument, became included in the list of entities obliged to comply with the provisions of Law No. 83/2017, of August 18.

Pursuant to Article 112-A of Law No. 83/2017, of August 18, since the date of entry into force of the new regime, the exercise, in the aforementioned manner, of those activities with virtual assets, may only occur by entities that obtain their prior registration with the Bank of Portugal for this purpose.

For this purpose, Notice No. 3/2021 of the Bank of Portugal was published on April 23, 2021, which regulates the rules relating to the registration process with the Bank of Portugal applicable to entities that exercise activities with virtual assets.

The Bank of Portugal is also the national competent authority for verifying the compliance with the preventive duties of AML/CFT by entities that exercise the aforementioned activities with virtual assets, in accordance with point (j) of paragraph 1 of Article 89 of Law No. 83/2017.

Both Law No. 83/2017, of August 18, in its Article 94, and Law No. 97/2017, of August 23, in its Article 27, provide for the possibility of approving sectoral regulation, intended, essentially, to adapt the duties and obligations provided for in those legal instruments, of an intersectoral nature, to the concrete operational realities to which they apply.

In addition to the general authorization norms referred to above, Law No. 83/2017, of August 18, refers in several of its norms to the regime to be approved by sectoral regulation, as happens in Articles 6, 12, 13, 14, 15, 16, 17, 18, 19, 20, 21, 22, 23, 24, 25, 26, 27, 28, 29, 32, 33, 35, 36, 40, 41, 42, 50, 51, 52, 54 and 55.

It is incumbent upon the Bank of Portugal, as the competent authority in this matter, to approve the regulation applicable to entities that exercise activities with virtual assets (cf., in particular, point (d) of paragraph 2 of Article 94 of Law No. 83/2017, of August 18).

The relevance of this Notice thus stems, above all, from the need to comply with the multiple mandates directed to the Bank of Portugal by the instruments referred to, and simultaneously to adapt the legal commands to the specific operational reality of entities that exercise activities with virtual assets, without prejudice to the technological neutrality that sectoral regulation issued must obey.

This Notice also amends Notice No. 1/2022 of the Bank of Portugal, of June 6, in very circumscribed elements arising from the need to rectify very specific aspects or to shape the way financial entities must relate to entities that exercise activities with virtual assets.

This Notice was subject to public consultation, in accordance with Article 101 of the Code of Administrative Procedure.

Thus, in the exercise of the competence conferred upon it by Article 17 of its Organic Law, approved by Law No. 5/98, of January 31, by Article 94 of Law No. 83/2017, of August 18, and by Article 27 of Law No. 97/2017, of August 23, the Bank of Portugal determines:

TITLE I General Provisions

Article 1. Object and Scope of Application

1. This Notice regulates, in the exercise of the attributions conferred by Article 94 of Law No. 83/2017, of August 18 (hereinafter abbreviated as "Law"), in particular by point (d) of paragraph 2, the conditions of exercise, the procedures, the instruments, the mechanisms, the formalities of application, the information provision obligations and the other aspects necessary to ensure compliance with the preventive duties of money laundering and terrorist financing, within the scope of the activity of entities that exercise activities with virtual assets.

2. This Notice also regulates, in the exercise of the attributions conferred by Article 27 of Law No. 97/2017, of August 23 (Law No. 97/2017), the means and mechanisms necessary for the compliance with the duties provided for in that legal instrument by entities that exercise activities with virtual assets.

Article 2. Definitions

1. For the purposes of application of this Notice, the following are understood by:

a) "Real-time monitoring", the monitoring carried out before the virtual assets are made available to the beneficiary or, if there is one, to another entity that exercises activities with virtual assets, of the beneficiary or intermediary;

b) "Ex post monitoring", the monitoring carried out after the virtual assets are made available to the beneficiary or, if there is one, to another entity that exercises activities with virtual assets, of the beneficiary or intermediary;

c) "Hosted wallet", a wallet hosted with an entity that exercises activities with virtual assets or an entity of an equivalent nature and that allows its holder (client) to control, hold, store, move and receive virtual assets, including private cryptographic keys;

d) "Jumbo (omnibus) wallet", a hosted wallet or self-hosted address titled or held by the entity that exercises activities with virtual assets itself and that it uses on behalf of its clients or counterparties;

e) "Client", any natural person, legal entity, corporate or non-corporate nature, or collective interest center without legal personality, that comes into contact with an entity that exercises activities with virtual assets with the purpose of having a service provided or a product made available by it, through the establishment of a business relationship or the execution of an occasional transaction;

f) "Collaborator", any natural person who, in the name or in the interest of the entity that exercises activities with virtual assets and under its authority or in its dependency, participates in the execution of any operations, acts or procedures proper to the activity pursued by that entity, regardless of having with it a link of a labor nature (internal collaborator) or not (external collaborator);

g) "Relevant collaborator", any internal or external collaborator of the entity that exercises activities with virtual assets, who meets at least one of the following conditions:

i) Be a member of the administrative body of the entity that exercises activities with virtual assets;

ii) Exercise functions that imply direct contact, in person or remotely, with the clients of the entity that exercises activities with virtual assets;

iii) Exercise functions in the entity that exercises activities with virtual assets that relate to compliance with the regulatory framework on the prevention of money laundering and terrorist financing;

iv) Be qualified as such by the entity that exercises activities with virtual assets;

h) "Account", a bank account opened for the constitution of one of the deposit modalities provided for in Article 1 of Decree-Law No. 430/91, of November 2, in its current wording, as well as any other payment account within the meaning of point (g) of Article 2 of the Legal Regime of Payment Services and Electronic Money ("RJSPME"), approved in annex to Decree-Law No. 91/2018, of November 12, in its current wording;

i) "Self-hosted address", an address or wallet that is not hosted with an entity that exercises activities with virtual assets or an entity of an equivalent nature, and that allows its holder or holder, independently, to store, move or receive virtual assets, including private cryptographic keys;

j) "Distributed ledger address", an alphanumeric code that identifies an address on a network that uses distributed ledger technology or similar technology where virtual assets can be sent or received;

k) "Entity that exercises activities with virtual assets", an entity that exercises on national territory, in accordance with paragraph 6 of Article 4 of the Law, one or more of the activities with virtual assets listed in point (mm) of paragraph 1 of Article 2 of the Law, being registered with the Bank of Portugal in accordance with Article 112-A of the Law;

l) "Entity of an equivalent nature", an entity with headquarters abroad that, not being subject to the obligation of registration with the Bank of Portugal in accordance with Article 112-A of the Law, exercises activities with virtual assets;

Corrected by Correction Declaration No. 371/2023, of May 9.

m) "Unique transaction identifier", a combination of letters, numbers or symbols determined by the entity that exercises activities with virtual assets, which allows the traceability of the transfer of virtual assets back to the originator and the beneficiary;

n) "Jurisdictions associated with a higher risk of money laundering or terrorist financing", jurisdictions that, based on the assessment of potentially higher risk factors, present a higher risk of money laundering or terrorist financing, including "high-risk third countries", within the meaning of point (bb) of paragraph 1 of Article 2 of the Law;

o) "Means of remote communication", any means of communication – telephone, electronic, telematic or of another nature – that allows the establishment of business relationships, the execution of occasional transactions or the performance of operations in general, without the physical and simultaneous presence of the entity that exercises activities with virtual assets and its client;

p) "Pooled wallet", a hosted wallet that is used by a client for the holding of virtual assets of its clients, who do not have powers to move the wallet;

q) "Representatives", all persons with decision-making powers in the business relationship or in the occasional transaction, including powers to move virtual assets or fiat currency, based on an instrument of legal or voluntary representation, as well as agents, managers of business or any other natural or legal persons, of any nature, who act before the entity that exercises activities with virtual assets on behalf or in the interest of their clients;

r) "Durable medium", any physical or electronic medium – optical, magnetic or of another nature – that presents a degree of accessibility, durability, reliability, integrity and legibility capable of allowing easy and permanent access to information, faithful and integral reproduction of the same, and correct reading of the data contained therein;

s) "Batch transfers of virtual assets", a set of several individual transfers of virtual assets, aggregated for transmission purposes;

t) "Videoconference", a means of remote communication that allows the proof of identifying elements of natural persons and consists of an interactive form of communication that allows the transmission and capture of sound, image and data in real time.

2. Without prejudice to the provisions of the preceding paragraph, the definitions contained in the Law and in Law No. 97/2017 are applicable to this Notice, and the concepts used in this Notice must be interpreted in the sense attributed to them in those instruments.

TITLE II Duties

CHAPTER I Duty of Control

Article 3. Compliance Control Function

1. Entities that exercise activities with virtual assets ensure the existence of a compliance control function of the regulatory framework on the prevention of money laundering and terrorist financing ("compliance control function"), which guarantees:

a) The definition and effective application of policies, procedures and controls adequate to the effective management of money laundering and terrorist financing risks to which the entity is or may be exposed;

b) Compliance by the entity that exercises activities with virtual assets with legal and regulatory norms on the prevention of money laundering and terrorist financing.

2. Entities that exercise activities with virtual assets ensure the segregation of the compliance control function from the activities that that function monitors and controls, without prejudice to the provisions of the following paragraph.

3. The requirement provided for in the preceding paragraph is not applicable to the compliance control function, whenever the number of collaborators, excluding administrators, is less than 6 and the operating revenues in the last financial year are less than € 1,000,000.

4. Entities that exercise activities with virtual assets ensure that the selection of the staff frame assigned to the compliance control function is made based on high ethical standards and demanding technical requirements.

Article 4. Designation of the Member of the Administrative Body

1. Entities that exercise activities with virtual assets designate an executive member of the administrative body for the purposes of paragraph 4 of Article 13 of the Law, with it being incumbent, in particular:

a) To ensure the protection of the compliance control function and its responsible person, reporting periodically to the administrative body on the activities carried out by them;

b) To directly monitor the execution of the provisions of Articles 12, 14 and 15 of the Law;

c) To ensure that the administrative body has timely access to all information necessary for the effective execution of the tasks provided for in paragraph 2 of Article 13 of the Law;

d) To propose to the administrative body corrective procedures for deficiencies detected in the matter of prevention of money laundering or terrorist financing, ensuring the swift implementation and sufficiency of the measures approved for this purpose and informing the administrative body of the status of execution;

e) To inform the administrative body of relevant interactions with the Bank of Portugal, the Financial Intelligence Unit ("FIU") and other authorities with responsibilities in the matter of prevention of money laundering and terrorist financing;

f) To take into account, directly or by prompting the intervention of the administrative body in cases where it should take place, the opinions and recommendations addressed to it by the compliance officer, always recording in writing the reasons that led to their non-acceptance;

g) To critically review, as provided for in point (b) of paragraph 3 of Article 13 of the Law, the decisions not to exercise the duty of communication, reporting at least monthly to the administrative body the results of that review.

2. Entities that exercise activities with virtual assets ensure that the member of the administrative body designated in accordance with the preceding paragraph:

a) Has the necessary knowledge for the full understanding of the matters covered by these functions;

b) Exercises these functions with the availability, decision-making autonomy and resources necessary for their good performance;

c) Has unrestricted and timely access to all relevant internal information and documentation for the exercise of these functions;

d) Ensures that any situations of potential conflicts of interest are identified in advance, minimized and subjected to careful and independent monitoring.

Article 5. Compliance Officer

1. For the purposes of the provisions of Article 16 of the Law, entities that exercise activities with virtual assets designate a responsible person for the compliance control function ("compliance officer").

2. Without prejudice to the compliance with the other duties provided for in paragraph 2 of Article 16 of the Law and in this Notice, it is incumbent upon the compliance officer:

a) To ensure the currency, sufficiency, accessibility and comprehensiveness of information on the internal control system and on the policies, procedures and instrumental controls for its execution that is made available to the relevant collaborators of the entity that exercises activities with virtual assets;

b) To support the preparation and execution of the assessments provided for in Article 17 of the Law and in Article 10 of this Notice;

c) To coordinate the preparation of reports, reports and other information to be sent to the Bank of Portugal in the matter of prevention of money laundering and terrorist financing;

d) To ensure the immediate availability to all relevant collaborators of the entity that exercises activities with virtual assets of communications from the Bank of Portugal made under the Law and this Notice and other regulatory instruments.

3. For the purposes of point (a) of paragraph 3 of Article 16 of the Law, entities that exercise activities with virtual assets ensure that the compliance officer:

a) Exercises these functions on an exclusive basis;

b) Does not exercise other functions within the entity, without prejudice to the provisions of paragraph 3 of Article 3 of this Notice and point (e) of paragraph 3 of Article 16 of the Law.

Article 6. Subsequent Changes

Entities that exercise activities with virtual assets immediately communicate to the Bank of Portugal, in accordance with the terms and through the channels provided for in Article 51, any changes that occur:

a) Regarding the following identification elements of the member of the administrative body designated for the purposes of paragraph 4 of Article 13 of the Law and Article 4 of this Notice:

i) Name;

ii) Portfolio assigned;

iii) Telephone contact;

iv) Email address;

b) Regarding the following identification elements of the compliance officer designated for the purposes of Article 16 of the Law and Article 5 of this Notice:

i) Name;

ii) Position and respective insertion in the hierarchical structure;

iii) Date of commencement of functions;

iv) Direct telephone contact;

v) Email address;

vi) Insertion in the organizational structure;

vii) Functions entrusted.

Article 7. Risk Identification

1. In compliance with point (a) of paragraph 2 of Article 14 of the Law, in the identification of the concrete money laundering and terrorist financing risks inherent to their specific operational reality, entities that exercise activities with virtual assets consider, among others, the following specific aspects:

a) Types of virtual assets to be made available and the main characteristics of each, including whether they are in any way susceptible to obscuring identity, as well as the protocols used and the susceptibility of these to be altered;

b) Issuer of each virtual asset made available;

c) Total value of the virtual assets made available;

d) Number and value of operations with virtual assets;

e) Execution of transfers of virtual assets originating from, or destined to, self-hosted addresses;

f) Products, services or operations that involve the use of cash or other non-traceable means;

g) Nature and scope of each distribution channel used, including whether it is an "open-loop" or "closed-loop" circuit;

h) Whether and to what extent the distribution channels of products and services with virtual assets interact with, or are linked to, distribution channels of products and services in fiat currency;

i) Use of other service providers to make products, services and operations available.

2. In the identification of the concrete money laundering and terrorist financing risks, entities that exercise activities with virtual assets consider the indicative situations of potentially lower risk listed in Annex II to the Law, taking into account the aspects set out in Annex II to this Notice, the indicative situations of potentially higher risk listed in Annex III to the Law, and the factors and indicative types of risk listed in Annexes III and IV to this Notice.

Article 8. Review