; (5) assurance provided by, and testing conducted by, the crypto asset intermediary, including penetration testing and independent audits so conducted; and (6) the potential for crypto asset intermediaries to be used to facilitate illicit activities, including sanctions avoidance. (c) Consumer best practices Not later than 18 months after the date of enactment of this Act, the Securities and Exchange Commission and the Commodity Futures Trading Commission, in consultation with industry and the Director of the Cybersecurity and Infrastructure Security Agency, shall adopt plain-language cybersecurity guidance for customers to safely transact in crypto assets. III Combating illicit finance 301. Higher penalties for crypto asset crimes Section 127 of Public Law 91–508 ( 12 U.S.C. 1957 ) is amended by inserting in relation to a transaction principally composed of crypto assets or after committed . 302. Anti-money laundering examination standards (a) Treasury Not later than 2 years after the date of enactment of this Act, the Secretary of the Treasury, in consultation with the Conference of State Bank Supervisors and the Federal Financial Institutions Examination Council, shall establish a risk-focused examination and review process for money service businesses, as defined in section 1010.100 of title 31, Code of Federal Regulations, to assess— (1) the adequacy of reporting obligations and anti-money laundering programs under subsections (g) and (h) of section 5318 of title 31, United States Code, respectively as applied to those businesses