For years, non-profit associations (ASFL) occupied a "comfortable" place in the Dominican Republic's regulatory map: supervised in accounting matters, required in tax matters, and practically invisible to criminal and anti-money laundering scrutiny. That place no longer exists.
In the Dominican Republic, Law 74-2025, which establishes the new Criminal Code, makes the legal entity—and an association is one—criminally liable for acts committed in its name or on its account, for its direct or indirect benefit, by its administrators, directors, members or employees. The part worth reading twice is the last one: it is sufficient that the fact was made possible by an omission of control or supervision. The Board does not need to have known anything.
This is not a Dominican singularity. FATF Recommendation 8 identifies non-profit organizations as a sector vulnerable to misuse, and regional frameworks are moving in the same direction. If your organization channels donations, international cooperation or third-party capital, the question is no longer whether it applies to you, but what you can prove the day you are asked.
Three different laws, one single substantive obligation
An ASFL that moves third-party money does not choose which rule applies to it. By its legal status and by its operation, all of them apply at the same time.
Regulation | What it requires | Answerable to | If non-compliant |
|---|---|---|---|
Law 74-2025 · Criminal Code | Adopt and implement an organization, prevention and compliance management model, before the fact occurs | Criminal jurisdiction | Criminal liability of the association |
Law 155-17 · AML/CFT | Prevention program with risk-based approach, due diligence, beneficial owner, compliance officer and suspicious transaction reporting | Financial Analysis Unit | Administrative sanction and banking exclusion |
Law 122-05 · ASFL Regime | Member registry, transparency of donation origin and destination, audited financial statements | CASFL and DGII | Loss of status and exemption |
A single well-constructed file can satisfy all three supervisors. Three separate files guarantee that none is complete.
There is a point where the regulations intersect and is often overlooked: an international donation activates all three at once. Before CASFL and DGII, you must prove the transparency of the donor and the destination of the fund. Before the UAF, you must prove the legitimacy of the origin and the absence of layering. It is the same fact, but they are two different questions, and the accounting answer does not answer the second one.
The three levels of a program, and why the second one is not enough
Almost all the organizations we review are on the same rung.
The criminal regulation does not ask for a document: it asks for a model that is suitable, verified, auditable and with continuous supervision. All four words matter, and three of them are not fulfilled with an approved manual. They are only fulfilled by operating and leaving a trail.
In other words: the exemption is not declared, it is proven. And it is proven with dated records that the control was executed, not with the manual that says it should have been executed.
Where the real risk lies for an ASFL that channels capital
The most common mistake when building a program is starting from a generic risk catalog. The regulation asks for exactly the opposite: a proprietary risk-based approach. In an investment network, a foundation or an association that administers cooperation, exposure is concentrated in four specific points.
The third is the only critical one, and the reason is that it combines regulatory, criminal and reputational consequence in the same fact. It is also the one that least tolerates a one-time verification: the member who entered clean in January and was listed in August is, by definition, the case that no intake review detects.
The 40 instruments we deliver (Technology + Documentary Library + Training)
A complete program for an ASFL is organized in three layers that support each other: governance (who is responsible?), regulations (what must be done?) and operation (how is it executed and proven?). They are built in that order. Skipping the first leaves the other two without support; staying in the second produces documents that no one executes.
This is the complete documentary body, piece by piece.
Group | Quantity | What is built |
|---|---|---|
Policies · approved by the Board | 12 | Regulatory Compliance and Crime Prevention · AML/CFT Prevention · Code of Ethics and Conduct · Conflicts of Interest · Know Your Investor (KYI) · Know Your Business Counterparty (KYB) · Know Your Donor (KYD) · Know Your Supplier (KYS) · Alert Management and Suspicious Transaction Reporting · Whistleblower Channel and Whistleblower Protection · Document Retention and File · Training and Disclosure |
Manuals · how and who applies | 4 | Regulatory Compliance and Crime Prevention · AML/CFT Prevention of the obligated subject · Functions of the Compliance Officer · System User Manual by profile |
Methodologies · with what criteria is it measured | 6 | AML/CFT risk measurement by factors (5×5 scale) · Operational risk measurement · Criminal risk · Due diligence and enhanced due diligence · Segmentation and qualification of counterparties · Design and evaluation of control effectiveness |
Measurement and controls | 6 | Catalog of risk factors · Inherent risk matrix · Inventory of controls and their evaluation · Residual risk matrix · Inherent vs. residual heat map · Risk appetite and tolerance scale |
Forms · information capture | 6 | KYI of member or investor · KYB of company and responsible parties · KYS of donor and supplier · Sworn statement of fund origin · PEP profiling · Documentary checklist by counterparty |
Records and plans · evidence | 6 | Format for analysis and ROS decision · Compliance Committee Minutes · Training record by person · Compliance Officer Annual Work Plan · Annual Audit Program · Electronic file by counterparty |
Total | 40 |
Two observations about this table, because this is where expensive mistakes are made:
The order is not decorative. Factors, inherent, controls, residual. Reversing it produces a matrix that cannot be sustained before anyone.
The conflict of interest policy is the most omitted and the most needed. In an investment network or in an association that allocates funds, the evaluator also participates. Without that policy, the rest of the program has a hole in the center.
Where does it stop being paper?: the document and its active control
This is the part that distinguishes a program that can be proven from one that can only be shown and how Snap Compliance technology helps us manage all of this. Each document in the regulatory body has a point where it becomes a control that is executed and leaves a trail, without additional manual work, and in an automated manner.
Layer | Document | What it becomes within the Compliance OS (Snap Compliance) |
|---|---|---|
Governance | Designation of the Officer and delimitation of powers | Profiles, permissions and segregation of duties by role, applied on each screen |
Regulations | Risk assessment methodology | 5×5 scale parameterized: stops being described and applies itself to each counterparty |
Regulations | Counterparty knowledge policy | KYI, KYB, KYD and KYS flows configured with their mandatory checklist |
Operation | Forms and documentary checklist | Digital forms that do not close if a mandatory document is missing |
Operation | Restrictive lists and PEP profiling | Permanent matching against international and local lists, with the post-cessation period already counted |
Operation | Risk matrix and heat map | Automatic recalculation as soon as counterparty data changes |
Operation | Alert management and ROS flow | Prioritized alert, case with service clock running and complete decision file |
Operation | Whistleblower channel | Anonymous and encrypted reception, with case traceability |
Cross-cutting | File and proof of supervision | Unalterable record of user, date, time and action |
The last row is what answers a court's or supervisor's question: how does the organization demonstrate that the control operated?. All the previous ones produce the data; that one turns it into proof.
It is worth pausing on three rows.
Permanent matching against lists, it must be daily!, is the only thing that covers the case of the member who changes status after having been admitted. A document cannot match anything, and an intake verification only photographs an instant.
The live matrix changes the nature of the instrument. What changes is not the formula—probability times impact is still probability times impact—but each band comes with its protocol already tied: a critical risk blocks the relationship and notifies the Board without waiting for someone to read the matrix next month.
The ROS flow carefully separates what the system automates from what a person decides. The service agreement clock and the complete decision file are supported by the platform. Whether the transaction is suspicious and whether it is reported is decided by the Compliance Officer. That is not automated, and anyone who says otherwise did not understand the regulation.
How is the Compliance Program implemented?: four phases, each with a functioning deliverable
Phase | What is delivered and verifiable |
|---|---|
1 · Diagnosis and startup | Parameterized system, role architecture and approved permission matrix, active user catalog, restrictive list scope defined |
2 · Matrices and protocols | Criminal and AML/CFT risk matrices loaded, 5×5 scale and validated thresholds, operational KYI/KYB/KYD/KYS protocols, policies and manuals presented to the Board |
3 · Activation of controls | Purged historical database, permanent matching in progress, whistleblower channel open, proven traceability |
4 · Governance and reporting | Training by governance role, complete ROS simulation, auditable model file, annual plans in operation |
A warning we prefer to give at the beginning and not as we go: Phase 3 includes the purging of the historical database, and it is the one that usually brings findings. Someone who today appears on a list, a responsible party with a record, an empty file from three years ago. It is expected, and it is exactly the reason why it is done. Anticipating it turns a future finding into confirmation that the system works.
There is a single requirement that conditions the startup: the designation of the Compliance Officer with real mandate. It is not a formality. If that person can be removed by simple decision the day they veto an important relationship, their autonomy is nominal, and a supervisor detects it in the first interview.
What we do not promise, it is important to understand!
We prefer to say it in the first conversation and not when a discrepancy appears.
No program immunizes against criminal liability. The exemption is subject to proof.
Who evaluates the suitability of a program is a court, not a provider. No one can guarantee that result by contract.
Professional judgment is not automated. The decision to report a suspicious transaction is the Compliance Officer's.
What we do deliver is the other half of the problem, which is what almost no one has solved: the dated and unalterable proof that the control operated.
A provider that promises you criminal immunity is selling you something they cannot deliver
The complete documentary body
Snap Compliance provides you with the DOCUMENTARY LIBRARY with 40 instruments to start immediately, we provide you with TRAINING on how to manage these 40 instruments and we implement the TECHNOLOGY so you can manage your Compliance programs in an agile manner.
The forty pieces are delivered in editable format, for the physical file and for the file presented to the supervisor, and each one is connected with the control that executes it within the Compliance OS.
To get started
If you direct an ASFL, a foundation or a network that channels third-party funds, there are three questions worth answering before any other:
Do you have a designated Compliance Officer with written powers, or just a de facto responsible party?
If a supervisor asked you today for the complete file of a counterparty linked two years ago, could you reconstruct it?
How long does it take your organization to find out that a member was included on a restrictive list?
If any of the three makes you uncomfortable, let's talk: speak with a specialist.
Informational content on the Dominican regulatory framework applicable to non-profit associations. It does not constitute legal advice. Each organization must validate the concrete application of these obligations with its legal advisor and with its Compliance Officer.