Spotlights
A series of spotlights into ongoing best practices, guidance, laws, and regulations across the globe on key risk and compliance matters and how to keep pace in your business model
Featured Spotlight on Third-Party Senders
NACHA OPERATING RULES | US
Nacha Operating Rules and Audit Guidelines
for Third-Party Senders
Third-Party Sender (TPS) is defined under the Nacha Operating Rules as a type of Third-Party Service Provider (TPSP) that acts as an intermediary in transmitting entries between an Originator and an Originating Depository Financial Institution (ODFI). The Nacha Operating Rules require a TPS to conduct an annual audit of their ACH compliance by December 31st each year to ensure adherence to Nacha’s ACH transaction guidelines.
Separately, outside of the annual Nacha audit requirement, typically, a Banking as a Service (BaaS) or For Benefit Of (FBO) master services agreement between a technology platform company and a regulated financial institution will require the submission of the audit to maintain compliance with the agreement.
CYBERSECURITY | EUROPEAN UNION
Strengthening Cybersecurity in the European Union through Digital Operational Resilience
A Spotlight on the Implementation and Requirements of the Digital Operational Resilience Act (DORA)
PAYMENTS | CANADA
Registration and Compliance Requirements for Canadian Payment Service Providers (PSPs)
A Spotlight on the Requirements and Regulations under the Retail Payment Activities Act (RPAA)
REGISTERED INVESTMENT ADVISORS | US
Registered Investment Advisers as Financial Institutions under the Bank Secrecy Act
A Spotlight on the Requirements of the Final Rule for Registered Investment Advisers (RIAs) and Exempt Reporting Advisers (ERAs)
Featured Spotlight on Corporate Transparency
CORPORATE TRANSPARENCY | US
Decoding US Beneficial Ownership Reporting Rules
Following the Financial Action Task Force’s (FATF) enhancements to Recommendations 24 and 25 regarding the transparency and beneficial ownership of legal persons and arrangements, the US introduced significant changes with required Beneficial Ownership Information (BOI) reporting, effective from January 1, 2024. The initiative aims to increase corporate transparency and prevent financial crimes.
Companies should familiarize themselves with FinCEN’s guidelines, exemptions, and the reporting process. Starting January 1, 2024, the BOI reporting requirements take effect. Companies created or registered before January 1, 2024, must file their initial reports by January 1, 2025. Those created or registered during 2024 have 90 days from their creation or registration date to file.
From January 1, 2025, and thereafter, all new incorporated legal entities will have 30 days from the Secretary of State registration date to submit a BOI report. All other updates related to the initially filed report, whether a change or an error to be corrected, will still need to be filed 30 days from the change or discovery date.
[Note: On December 3, 2024, a US court granted a preliminary injunction enjoining the Department of Treasury from enforcing the Corporate Transparency Act. Texas Top Cop Shop, Inc., et al. v. Garland, et al., No. 4:24-cv-478 (E.D. Tex.). The US has appealed the ruling and FinCEN issued a statement that filing is currently voluntary.]
SANCTIONS | US
Geolocation is More Than Just a Postcode
A Spotlight on Geolocation and IP Address Screening to Maintain Compliance with the Office of Foreign Assets Control (OFAC)
CYBERSECURITY
The Understanding and Defending Against Social Engineering Attacks
A Spotlight on How You Can Protect Your Organization From Social Engineering Attacks
CYBERSECURITY
The Rise of Advanced Passwordless Authentication
A Spotlight on the Transition from Traditional Authentication to Passwordless Authentication Methods
Featured Spotlight on Token Due Diligence
DIGITAL ASSETS
The Key Aspects of Conducting Token Due Diligence
Conducting thorough token due diligence (TDD) involves a deep dive beyond just analyzing historical data or predictions. Rather, it means exploring the intricacies of technology, evaluating security measures, understanding liquidity factors, navigating complex regulations, and more. Moreover, TDD encompasses a range of factors, including regulatory compliance, technological stability, and market behavior, to ensure that the token aligns with legal and financial standards.
The Howey Test, established by the US Supreme Court, is crucial in determining whether a digital asset qualifies as a security. This test is essential for TDD as it helps identify the regulatory requirements applicable to the digital asset, influencing how it can be legally offered and sold.
DATA PRIVACY
Handling and Protecting Personal Sensitive Information
A Spotlight on the Global Regulatory Emergence of Consumer Privacy
KNOW YOUR CUSTOMER
Knowing Your Customer Data Journey
A Spotlight on Standards for Know Your Customer (KYC) Framework and Procedures
BANK SECRECY ACT | US
Key Aspects of Regulatory Reporting and Recordkeeping Requirements
A Spotlight on Reporting Requirements for Covered Financial Institutions under the Bank Secrecy Act (BSA)
415.352.1060 2193 Fillmore Street, Suite 1
San Francisco, CA 94115
RISK | STRATEGY | CYBER COMPLIANCE MANAGEMENT
© 2025 Stratis Advisory LLC. All Rights Reserved.
Terms of Use | Privacy Policy