We basically look at their obligations to report to us. Under the legislation, they have the obligation to report large cash transactions of more than $10,000. They have the obligation to report international electronic transfers. They have the obligation to report suspicious transaction reports. If they see people coming in and running financial operations that may look suspicious and can be used in the context of money laundering or terrorism financing, we may penalize them for that.
We may also penalize them for not having a compliance regime, which includes policies, training, and processes. Based on the number of violations and the kinds of violations, we then establish what the penalty should be. Then, depending on the size of the organization, we also look at the capacity to pay.