Customer Identification Programs, Anti-Money Laundering Programs, and Beneficial Ownership Requirements for Banks Lacking a Federal Functional Regulator (2024)

I. Background

A. Statutory Provisions

FinCEN exercises regulatory functions primarily under the Currency and Financial Transactions Reporting Act of 1970, as amended by the Uniting and Strengthening America by Providing Appropriate Tools Required to Intercept and Obstruct Terrorism Act of 2001 (“USA PATRIOT Act”) (Pub. L. 107-56) and other legislation. This legislative framework is commonly referred to as the “Bank Secrecy Act” (“BSA”).^[1] The Secretary of the Treasury (“Secretary”) has delegated to the Director of FinCEN the authority to implement, administer, and enforce compliance with the BSA and associated regulations.^[2] Pursuant to this authority, FinCEN may issue regulations requiring financial institutions to keep records and file reports that “have a high degree of usefulness in criminal, tax, or regulatory investigations or proceedings, or in the conduct of intelligence or counterintelligence activities, including analysis, to protect against international terrorism.” ^[3] Additionally, FinCEN is authorized to impose anti-money laundering (“AML”) program requirements for financial institutions.^[4]

Section 352 of the USA PATRIOT Act requires financial institutions to establish AML programs that, at a minimum, include: (1) The development of internal policies, procedures, and controls; (2) the designation of a compliance officer; (3) an ongoing employee training program; and (4) an independent audit function ( print page 58426) to test programs.^[5] Section 352 of the USA PATRIOT Act authorizes FinCEN, in consultation with the “appropriate” Federal functional regulator (using the definition of “Federal functional regulator” found in 15 U.S.C. 6809), to prescribe minimum standards for AML programs. In determining the appropriate scope and nature for this proposed rulemaking for financial institutions that are not directly regulated by any Federal functional regulator under any definition of that term, FinCEN considered the Federal functional regulators of similar institutions, including Federal bank supervisory authorities, the U.S. Securities and Exchange Commission (“SEC”), and the Commodity Futures Trading Commission (“CFTC”), to be “appropriate” Federal functional regulators within the meaning of Section 352. In preparing this rule, FinCEN consulted with these regulators and in order to be certain of addressing all important issues, it also consulted with state bank supervisory authorities, and the Internal Revenue Service (“IRS”), which, to date, has been the examining authority for all institutions regulated by FinCEN that do not have a Federal functional regulator.

When prescribing minimum standards for AML programs, FinCEN must “consider the extent to which the requirements imposed [under section 352 of the USA PATRIOT Act] are commensurate with the size, location, and activities of the financial institutions to which [the standards] apply.” ^[6] In addition, FinCEN may “prescribe an appropriate exemption from a requirement [in the BSA] or regulations [issued under the BSA].” ^[7] FinCEN used this authority in 2002 to exempt temporarily certain financial institutions identified in section 352 from the requirement to establish an AML program.

Section 326 of the USA PATRIOT Act requires FinCEN to prescribe regulations that require financial institutions to establish programs for account opening that, at a minimum, include: (1) Verifying the identity of any person seeking to open an account, to the extent reasonable and practicable; (2) maintaining records of the information used to verify the person's identity, including name, address, and other identifying information; and (3) determining whether the person appears on any lists of known or suspected terrorists or terrorist organizations provided to the financial institution by any government agency.^[8] These programs are referred to as Customer Identification Programs (“CIPs”).

When prescribing CIP regulations for financial institutions that engage in financial activities described in Section 4(k) of the Bank Holding Company Act of 1956, 12 U.S.C. 1843(k), FinCEN must prescribe such CIP regulations jointly with the Federal functional regulator (again using the definition of “Federal functional regulator” found in 15 U.S.C. 6809, but also including the CFTC) that is “appropriate” for the affected financial institutions.^[9] FinCEN generally considers the Federal functional regulator—if any—that actually regulates a financial institution to be the Federal functional regulator appropriate to promulgate regulations for such a financial institution.^[10] Specifically with respect to CIP rules, FinCEN has maintained publicly since 2003 that, for a CIP rule that applies to institutions not directly regulated by any Federal functional regulator under any definition of that term, it is not “appropriate” for any Federal agency to issue jointly such a CIP rule with FinCEN, given that no Federal agency has direct supervisory authority over such financial institutions comparable in its pervasiveness to the direct authority of the Federal functional regulators over their regulated financial institutions.^[11] Consistent with these long-held positions, FinCEN proposes to issue the CIP rule set forth here under its sole authority.

Section 312 of the USA PATRIOT Act requires each U.S. financial institution that establishes, maintains, administers, or manages a correspondent account or a private banking account in the United States for a non-U.S. person to subject such accounts to certain anti-money laundering measures.^[12] In particular, financial institutions must establish appropriate, specific, and, where necessary, enhanced due diligence policies, procedures, and controls that are reasonably designed to enable the financial institution to detect and report instances of money laundering through these accounts. In addition to the general due diligence requirements, which apply to all correspondent accounts for non-U.S. persons, section 5318(i)(2) specifies additional standards for correspondent accounts maintained for certain foreign banks. Section 5318(i) also sets forth minimum due diligence requirements for private banking accounts for non-U.S. persons. Specifically, a covered financial institution must take reasonable steps to ascertain the identity of the nominal and beneficial owners of, and the source of funds deposited into, private banking accounts, as necessary to guard against money laundering and to report suspicious transactions. The institution must also conduct enhanced scrutiny of private banking accounts requested or maintained for, or on behalf of, senior foreign political figures (which includes family members or close associates). Enhanced scrutiny must be reasonably designed to detect and report transactions that may involve the proceeds of foreign corruption.

B. Regulatory Background

The following information describes the effect of certain previous rulemakings on banks, and specifically on banks lacking a Federal functional regulator.

AML Program Requirements

Most banks became subject to an AML program requirement pursuant to the BSA with FinCEN's issuance of an Interim Final Rule on April 29, 2002 (the “Interim Final Rule”).^[13] The Interim Final Rule stated that an institution regulated by a Federal functional regulator “shall be deemed to satisfy the requirements of 31 U.S.C. ( print page 58427) 5318(h)(1) if it implements and maintains an [AML] program that complies with the regulation of its Federal functional regulator governing such programs.” ^[14] “Federal functional regulator” is defined at 31 CFR 1010.100(r) to include each of the Federal banking agencies, as well as the SEC and the CFTC.

The Interim Final Rule also deferred AML program requirements for certain financial institutions, including “private bankers.” ^[15] On November 6, 2002, FinCEN amended the Interim Final Rule.^[16] The amendment extended the deferral indefinitely,^[17] and included within the deferral not only private bankers, but any bank “that is not subject to regulation by a Federal functional regulator.” ^[18]

Although banks that lack a Federal functional regulator have not been required to establish an AML program, they are required to comply with many other BSA requirements. For example, banks that lack a Federal functional regulator still must file currency transaction reports (“CTRs”) and suspicious activity reports (“SARs”), and make and maintain certain records.^[19] In addition, banks that lack a Federal functional regulator must comply with 31 CFR 1010.630, which prohibits covered financial institutions from maintaining correspondent accounts for foreign shell banks and requires covered financial institutions to obtain and retain information on the ownership of foreign banks.^[20]

Despite being subject to the various BSA obligations detailed above, banks that lack a Federal functional regulator have remained exempt from the AML program requirement since the Interim Final Rule. In contrast, FinCEN has already eliminated the exemption and promulgated AML program rules for other institutions that had been exempted under the Interim Final Rule, including insurance companies, certain loan or finance companies, and dealers in precious metals, precious stones, or jewels.

Customer Identification Program Requirements

CIP requirements were finalized, through a joint final rule, for banks, savings associations, credit unions, and certain non-Federally regulated banks on May 9, 2003. With this action, certain banks that lack a Federal functional regulator, namely, private banks, non-federally insured credit unions and certain trust companies, were required to comply with CIP requirements.^[21] On the same day, FinCEN published a notice of proposed rulemaking that would have imposed CIP requirements on all other state-regulated banks without a Federal functional regulator that were not included in the joint rule.^[22] This rulemaking was never finalized.

Beneficial Ownership Requirement

On May 11, 2016, FinCEN published a final rule (“CDD Rule”),^[23] to clarify and strengthen customer due diligence requirements for certain financial institutions, including federally regulated banks, requiring these financial institutions to identify and verify the identity of the beneficial owners of their legal entity customers, subject to certain exclusions and exemptions. The CDD Rule also amends the AML program requirements for these financial institutions. For purposes of regulatory consistency, FinCEN believes that it is appropriate that these requirements should apply to non-federally regulated banks as well, and accordingly proposes these requirements in this notice.

C. Categories of Banks Lacking a Federal Functional Regulator

FinCEN has identified the following categories of banks that lack a Federal functional regulator and is interested in identifying additional categories of such entities. However, no discussion of such entities should be thought to be exhaustive. This NPRM proposes that any entity that meets the definition of bank in 31 CFR 1010.100(d) would be required to establish an AML program.

State-Chartered Non-Depository Trust Companies

State-chartered non-depository trust companies are generally smaller than depository (or federally regulated non-depository) trust companies, and often provide estate planning and settlement and trust administration on a regional basis.^[24] Trust companies can provide services similar to investment advisory firms, including securities investment advisers, but are generally exempt from registration as investment advisers with the SEC.^[25] Trust companies also may provide services to clients similar to the services offered by other financial services firms. The number of state-chartered non-depository trust companies is difficult to determine; however, according to data available from state banking regulator Web sites, there are upwards of 347 of these entities.^[26]

Non-Federally Insured Credit Unions

Of the more than 6,273 credit unions nationwide, FinCEN understands that there are approximately 265 state-chartered credit unions that are not federally insured. Aside from their lack of a Federal functional regulator, these credit unions generally are similar in structure to federally insured credit unions.^[27]

Private Banks

A private bank is a bank chartered under state law that is owned by an ( print page 58428) individual or a partnership and generally provides financial services to individuals with high net worth.^[28] Although private banks have a long history in certain jurisdictions, including Switzerland and the United Kingdom, at least one private bank remains in the United States.

Non-Federally Insured State Banks and Savings Associations

According to estimates available from state banking regulator Web sites, the number of state-chartered banks and savings and loan or building and loan associations without Federal Deposit Insurance Corporation (“FDIC”) insurance is not more than 12.^[29] These banks function similarly to other federally insured banks, but are privately insured.

International Banking Entities

International banking entities, or “entidades bancarias internacionales” (“EBIs”), are not federally insured, but are authorized by Puerto Rican and the U.S. Virgin Islands law to provide banking and other services to non-resident aliens. As of 2014, 33 EBIs were licensed by Puerto Rico.^[30]

D. Extension of AML Program, CIP and Beneficial Ownership Requirements

The Anti-Money Laundering Program

The statutory mandate that all financial institutions establish anti-money laundering programs is a key element in the national effort to prevent and detect money laundering and the financing of terrorism. Banks without a Federal functional regulator may be as vulnerable to the risks of money laundering and terrorist financing as banks with one. This proposed rule would eliminate the present regulatory “gap” in AML coverage between banks with and without a Federal functional regulator. FinCEN expects uniform regulatory requirements for all banks to reduce the opportunity for criminals to seek out and exploit banks subject to less rigorous AML requirements.

FinCEN also believes that imposing an AML program requirement on banks that lack a Federal functional regulator would not be unduly burdensome, given that such banks already must comply with various BSA recordkeeping, reporting, and, in some cases, CIP requirements. In order to comply with these existing rules, banks lacking a Federal functional regulator have likely developed procedures and protocol comparable to what would be required under the proposed rule.

In 2005, uniform BSA examination procedures were issued through the first publication of the Federal Financial Institutions Examination Council Bank Secrecy Act/Anti-Money Laundering Examination Manual.^[31] FinCEN understands that uniform audits or examinations of policies, procedures, internal controls, reporting structures, transaction monitoring, and recordkeeping have caused many banks that lack a Federal functional regulator to adopt procedures similar to the ones that would be required under the proposed rule.

Customer Identification Program

For the reasons of regulatory consistency and protection against systemic vulnerability discussed above in connection with AML programs, FinCEN believes that CIP should also apply to all banks (including all depository institutions chartered under state banking law, even if the charter was not for a credit union, trust company, or private bank), regardless of whether they are Federally regulated. The preamble of the final CIP rule said that it applied to “banks with a Federal functional regulator and to credit unions, trust companies, and private banks without a federal functional regulator.” However, on the same day that the final CIP rule was issued, FinCEN issued a follow-on Notice of Proposed Rulemaking to ensure that there would be no gaps in the scope of the CIP obligations as they apply to banks.^[32] Because this proposal was never finalized, FinCEN is also re-proposing changes that would explicitly require all banks that lack a Federal functional regulator to establish CIP.

Beneficial Ownership Requirements

As noted above, the CDD Rule requires that federally regulated banks and certain other financial institutions identify, and verify the identity of, the beneficial owners of their legal entity customers, as set forth in section 1010.230.^[33] For purposes of regulatory consistency, FinCEN believes that this requirement should apply to non-federally regulated banks as well.

II. Section-by-Section Analysis

This notice proposes to amend chapter X by adding AML program requirements for banks that lack a Federal functional regulator, and extending CIP and beneficial ownership requirements to those banks not already subject to these requirements. These proposed changes include the following: (1) Amending the provision in § 1010.205 that exempts certain financial institutions from the requirement to establish an AML program; (2) amending the definition of covered financial institution in § 1010.605 so that non-federally regulated banks will be subject to the beneficial ownership requirements pursuant to the CDD Rule (as well as the requirements in §§ 1010.610 and 1010.620); (3) removing the substantive language in the definitions of bank and financial institution in part 1020, Rules for Banks, because there will no longer be a need to make distinctions from the definitions in part 1010's General Definitions; (4) imposing AML program requirements on banks that lack a Federal functional regulator and prescribing minimum standards for the AML programs; and (5) amending the CIP requirements to delete a specific requirement that until banks without a Federal functional regulator are subject to AML program requirements they must have their CIPs approved by their boards of directors. If the proposed changes are implemented, banks without a Federal functional regulator will be required to implement a written AML program approved by their boards of directors or by equivalent functional units within the banks.

A. Exempted Anti-Money Laundering Programs for Certain Financial Institutions

Section 1010.205 provides temporary exemptions for certain financial institutions from the requirement to establish an anti-money laundering ( print page 58429) program.^[34] The proposed amendments to 31 CFR 1010.205 reflect the removal of: (1) The exemption for private bankers (§ 1010.205(b)(1)(vi)); (2) the broader exemption for banks that lack a Federal functional regulator (§ 1010.205(b)(2)); and (3) the exemption for persons subject to supervision by a state banking authority (§ 1010.205(b)(3)).

B. General and Specific Definitions

General rules that apply to all industries appear in part 1010, and industry-specific rules are contained in other parts within chapter X. Because the definition of bank in part 1010 makes no distinctions as to whether a bank has a Federal functional regulator, there are no proposed changes to that definition of bank in § 1010.100(d).^[35] Likewise, there are no proposed changes to the general definition of financial institution in § 1010.100(t).^[36] Specific rules for banks are contained in part 1020, which includes definitions of both “bank” and “financial institution” specific to that part, to note a distinction in the application of AML program and CIP requirements between banks with a Federal functional regulator and those lacking one. FinCEN proposes to amend those definitions, as described below.

Customer Identification Program Requirement

The separate definition of bank in § 1020.100(b) reflects the fact that existing CIP requirements do not apply to all banks that lack a Federal functional regulator. The current definition of bank, for the purposes of 31 CFR 1020.220, is (1) A bank, as that term is defined in 31 CFR 1010.100(d), that is subject to regulation by a Federal functional regulator; and (2) A credit union, private bank, and trust company, as set forth in 31 CFR 1010.100(d) of this chapter, that does not have a Federal functional regulator.^[37]

This rulemaking proposes to remove existing § 1020.100(b), which would result in making all banks, regardless of whether they are subject to regulation by a Federal functional regulator, comply with CIP requirements.

Beneficial Ownership Requirement

The beneficial ownership requirement in the CDD Rule applies to covered financial institutions as defined in § 1010.605(e)(1). This definition includes several types of banks, all of which are federally regulated,^[38] as well as brokers and dealers in securities, futures commission merchants and introducing brokers, and mutual funds. In order to apply this requirement to non-federally regulated banks, this rulemaking proposes to amend the current definition of covered financial institution by replacing paragraphs (i) through (vii) of § 1010.605(e)(1) with the following, which includes all banks (whether or not federally regulated) that are subject to an AML program requirement “a bank required to have an anti-money laundering compliance program under the regulations implementing 31 U.S.C. 5318(h), 12 U.S.C. 1818(s), or 12 U.S.C. 1786(q)(1).”

Anti-Money Laundering Program Requirement

The definition of financial institution in § 1020.100(d) reflects the fact that existing AML program requirements are based on whether a bank is subject to regulation by a Federal functional regulator. The current definition of financial institution is (1) For the purposes of 31 CFR 1020.210, a financial institution is defined in 31 U.S.C. 5312(a)(2) or (c)(1) that is subject to regulation by a Federal functional regulator or a self-regulatory organization; (2) For the purposes of 31 CFR 1020.220, a financial institution is defined in 31 U.S.C. 5312(a)(2) or (c)(1).

This rulemaking proposes to remove existing § 1020.100(d)(1), which along with the proposed amendments to § 1020.210 described below, would result in requiring all banks, regardless of whether they are subject to regulation by a Federal functional regulator, to comply with the obligation to implement an AML program.^[39]

C. AML Program Requirements

Section 1020.210 (as amended by the CDD Rule) sets forth the current AML program requirements for banks. This rulemaking proposes certain changes necessary to ensure that all banks, regardless of whether they are subject to Federal regulation and oversight, are required to establish and implement anti-money laundering programs. One proposed change concerns the title and structure of the section. Currently, the title reads: “Anti-money laundering program requirements for financial institutions regulated only by a Federal functional regulator, including banks, savings associations, and credit unions.” With the proposed change, the title would read: “Anti-money laundering program requirements for banks,” and it would contain one section for banks regulated only by a Federal functional regulator and another section for banks that lack a Federal functional regulator.

As proposed, § 1020.210(a) would be titled: “Anti-money laundering program requirements for banks regulated only by a Federal functional regulator, including banks, savings associations, and credit unions.” The existing language in § 1020.210 states that compliance by a financial institution regulated by a Federal functional regulator that is not subject to the regulations of a self-regulatory organization satisfies the AML program requirement under 31 U.S.C. 5318(h)(1) if its program complies with the requirements of §§ 1010.610 and 1010.620 and the regulations of its Federal functional regulator governing AML programs. FinCEN is unaware of any instance in which a bank is subject to regulations by a self-regulatory organization. Accordingly, FinCEN proposes to remove reference to such regulation from the regulatory text, by ( print page 58430) striking the words “that is not subject to the regulations of a self-regulatory organization.” This proposed change would appear in § 1020.210(a).^[40]

Proposed new § 1020.210(b) would be titled: “Anti-money laundering program requirements for banks lacking a Federal functional regulator including, but not limited to, private banks, non-federally insured credit unions, and certain trust companies.” New § 1020.210(b)(1) would require banks that lack a Federal functional regulator to establish and implement AML programs reasonably designed to assure ongoing compliance with the Bank Secrecy Act. Section 1020.210(b)(1)(ii)(E) would require compliance with due diligence requirements for correspondent accounts for foreign financial institutions (§ 1010.610) and for private banking accounts (§ 1010.620), and new § 1020.210(b)(1) also would prescribe the minimum standards necessary for an AML program.

With respect to minimum standards, proposed § 1020.210(b)(1)(ii)(A) would require that the AML program include a system of internal controls to assure ongoing compliance with the BSA. As part of implementing an AML program, FinCEN would expect banks that lack a Federal functional regulator to assess the money laundering and terrorist financing risks that are associated with their products, customers, distribution channels, and geographic locations. An assessment of customer-related information is a key component to a robust AML program, and banks must ensure that they obtain all the information necessary for their AML program requirements. For purposes of making the required risk assessment, banks have discretion to determine how best to collect the relevant customer information. FinCEN does not anticipate that this requirement will entail obtaining information not already obtained in the ordinary course of business. Policies, procedures, and internal controls also must be reasonably designed to ensure compliance with BSA requirements. Banks may conduct some of their operations through agents and third-party service providers. Some elements of the compliance program may best be performed by personnel of these entities, in which case it is permissible for banks to contract with such entities to assist them with implementation and operation of those aspects of its AML program. Any bank that contracts with an agent or third party to assist with aspects of its AML program, however, remains fully responsible for the effectiveness of the program, as well as ensuring that compliance examiners are able to obtain information and records relating to the AML program.

Proposed § 1020.210(b)(1)(ii)(B) would require that the program provide for independent testing to monitor and maintain an adequate program. A party external to the bank, such as an outside consultant or accountant, need not perform the testing. The testing may be conducted by an officer, employee, or group of employees, so long as the person or persons conducting the testing are independent of the person or group of persons primarily responsible for implementing the bank's AML program. The frequency of independent testing will depend upon the risks posed.^[41] Any recommendations that result from the independent testing should be implemented promptly or reviewed by senior management.

Proposed § 1020.210(b)(1)(ii)(C) would require that the bank designate a person or persons who will be responsible for coordinating and monitoring day-to-day compliance with the AML program. The bank may have one individual, or the bank may designate multiple individuals to perform the function as a group. The person or persons should be competent and knowledgeable regarding BSA requirements and money laundering issues and risks, and should be empowered with full responsibility and authority to develop and enforce appropriate policies and procedures. The role of this function is to ensure that the program is implemented effectively and updated as necessary.

Proposed § 1020.210(b)(1)(ii)(D) would require that the program provide for training of appropriate persons. Employee training is an integral part of any AML program. In order to carry out their responsibilities effectively, employees must be trained in requirements under the BSA and money laundering risks generally, as well as the internal policies and procedures of the institution, so that red flags can be identified. Such training may be conducted by third parties or in-house, and may include computer-based training. Employees should receive periodic updates and refreshers to such training. The nature, scope, and frequency of training would depend upon the functions performed by employees.

Proposed § 1020.210(b)(1)(ii)(E) would require that the program include, at a minimum, appropriate risk-based procedures for conducting ongoing customer due diligence, to include, but not be limited to, understanding the nature and purpose of customer relationships for the purpose of developing a customer risk profile; and conducting ongoing monitoring to identify and report suspicious transactions and, on a risk basis, to maintain and update customer information. For purposes of this proposed paragraph, customer information would include information regarding the beneficial owners of legal entity customers (as defined in § 1010.230). FinCEN views this not as a new requirement, but as an explicit statement of the activities that are already required of covered financial institutions in order to monitor for, and detect and report, suspicious transactions.^[42]

Proposed § 1020.210(b)(2) would require that an AML program be approved by the bank's board of directors or, if the bank does not have a board of directors, an equivalent function within the bank. Additionally, a bank would be required to make a copy of its AML program available to FinCEN or its designee upon request.^[43]

D. CIP Requirements

Currently, the title reads: Section 1020.220, “Customer identification programs for banks, savings associations, credit unions, and certain non-Federally regulated banks.” With the proposed change, the title would read: “Customer identification program requirements for banks.” This proposed change recognizes that going forward CIP requirements would apply to all banks.

The proposed changes would also delete an unnecessary reference in § 1020.220 that stipulates that credit unions, private banks, and trust companies without a Federal functional regulator must seek board approval for their CIPs. With finalization of this proposal, banks lacking a Federal functional regulator would be required to implement a written AML program approved by their boards of directors. Since CIP would be part of their AML ( print page 58431) programs, which must be approved by their boards of directors, it would no longer be necessary to stipulate a separate approval of CIP in this section.

III. Request for Comment

FinCEN welcomes comment on all aspects of the proposed rule. In addition, FinCEN seeks comment on the following issues:

• Whether certain banks lacking a Federal functional regulator should be excluded from the proposed rule;
• Whether there are additional bank categories that should be included in the proposed rule;
• Whether non-federally regulated banks should be subject to the requirements contained in the CDD Rule;
• If the requirements contained in the CDD Rule and under Section 312 are imposed on non-federally regulated banks, what time period should be given to these institutions to implement such requirements; and
• Whether there are banks that are, in fact, regulated by self-regulatory organizations.

IV. Initial Regulatory Flexibility Act Analysis

When an agency issues a rulemaking proposal, the Regulatory Flexibility Act (“RFA”) requires the agency to “prepare and make available for public comment an initial regulatory flexibility analysis” that will “describe the impact of the proposed rule on small entities.” (5 U.S.C. 603(a).) Section 605 of the RFA allows an agency to certify a rule, in lieu of preparing an analysis, if the proposed rulemaking is not expected to have a significant economic impact on a substantial number of small entities.

A. Reasons Why Action by the Agency Is Being Considered

The Anti-Money Laundering Program

The statutory mandate that all financial institutions establish anti-money laundering programs is a key element in the national effort to prevent and detect money laundering and the financing of terrorism. Banks without a Federal functional regulator may be as vulnerable to the risks of AML and terrorist financing as banks with one. This proposed rule would eliminate the present regulatory “gap” in AML coverage between banks with and without a Federal functional regulator. FinCEN expects that uniform regulatory requirements for all banks will reduce the opportunity for criminals to seek out and exploit banks subject to less rigorous AML requirements.

Customer Identification Program

For the reasons of regulatory consistency and protection against systemic vulnerability discussed above in connection with AML programs, FinCEN believes that CIP should also apply to all banks (including all depository institutions chartered under state banking law, even if the charter was not for a credit union, trust company, or private bank), regardless of whether they are Federally regulated. In July 2002, FinCEN issued a Notice of Proposed Rulemaking to ensure that there would be no gaps in the scope of the CIP obligations as they apply to banks. Because this proposal was never finalized, FinCEN is also re-proposing changes that would explicitly require all banks that lack a Federal functional regulator to establish CIP.

Beneficial Ownership Requirements

As noted above, the CDD Rule requires that from and after May 11, 2018, federally regulated banks and certain other financial institutions identify, and verify the identity of, the beneficial owners of their legal entity customers, as set forth in section 1010.230. For purposes of regulatory consistency, FinCEN believes that this requirement should apply to non-federally regulated banks as well.

B. Objectives of, and Legal Basis for, the Proposed Rules

Section 352 of the USA PATRIOT Act requires financial institutions to establish AML programs that, at a minimum, include: (1) The development of internal policies, procedures, and controls; (2) the designation of a compliance officer; (3) an ongoing employee training program; and (4) an independent audit function to test programs. In addition, the CDD Rule described above adds an explicit requirement to conduct ongoing monitoring.

Section 326 of the USA PATRIOT Act requires FinCEN to prescribe regulations that require financial institutions to establish programs for account opening that, at a minimum, include: (1) Verifying the identity of any person seeking to open an account, to the extent reasonable and practicable; (2) maintaining records of the information used to verify the person's identity, including name, address, and other identifying information; and (3) determining whether the person appears on any lists of known or suspected terrorists or terrorist organizations provided to the financial institution by any government agency.

Section 312 of the USA PATRIOT Act requires each U.S. financial institution that establishes, maintains, administers, or manages a correspondent account or a private banking account in the United States for a non-U.S. person to subject such accounts to certain anti-money laundering measures.

C. Small Entities Subject to the Proposed Rules

Based upon current data, for the purposes of RFA, FinCEN estimates that these rules will impact approximately 347 state chartered non-depository trust companies; 265 state-chartered credit unions that are not federally insured; 12 state-chartered banks and savings and loan or building and loan associations without FDIC insurance; and 115 EBIs licensed in Puerto Rico.^[44] FinCEN believes it is likely that most or all of the non-federally insured credit unions are small entities, and has no data on the size of the other entities subject to this rulemaking, and therefore assumes that many of them are small entities. Therefore, FinCEN concludes that the proposed rules will apply to a substantial number of small entities.

D. Projected Reporting, Recordkeeping, and Other Compliance Requirements of the Proposed Rules

The proposed rules would prescribe minimum standards for AML programs for banks without a Federal functional regulator to ensure that all banks, regardless of whether they are subject to Federal regulation and oversight, are required to establish and implement written AML programs, including conducting ongoing customer due diligence, and to identify and verify the identity of the beneficial owners of their legal entity customers. The changes would also extend customer identification program requirements to those banks not already subject to these requirements.

Banks lacking a Federal functional regulator are currently required to comply with many existing requirements under the BSA. All banks, including those not subject to Federal regulation and oversight, are already required to file SARs, which necessarily requires a bank to establish a process to detect unusual activity. Certain banks lacking a Federal functional regulator—namely, private banks, non-federally insured credit unions, and certain trust companies—must maintain CIPs. ( print page 58432) Uniform audits at the state and Federal levels may have caused banks lacking a Federal functional regulator to adopt procedures similar to the ones that would be required under the AML program requirement of the proposed rule.

With respect to the beneficial ownership requirement, the proposed rule would require banks lacking a Federal functional regulator to obtain and maintain the identity of each beneficial owner from each legal entity customer that opens a new account, including name, address, date of birth and identification number. The financial institution would also be required to verify such identity by documentary or non-documentary methods and to maintain in its records for five years a description of (1) any document relied on for verification, (2) any such non-documentary methods and results of such measures undertaken, and (3) the resolution of any substantive discrepancies discovered in verifying the identification information.

The burden on a small non-federally regulated bank at account opening resulting from the final rule would be a function of the number of beneficial owners of each legal entity customer opening a new account, the additional time required for each beneficial owner, and the number of new accounts opened for legal entities by the small banks during a specified period.

None of the small businesses that commented on the CDD Rule's Initial Regulatory Flexibility Analysis (“IRFA”) included an estimate of the amount of time to open a legal entity account; only one noted the number of such accounts it opens per year (70). As a result of the comments FinCEN received to the CDD Rule's-related regulatory impact assessment from other commenters, FinCEN concluded in its Final Regulatory Flexibility Analysis (“FRFA”) ^[45] that the estimated time for financial institutions to open accounts ranges from 20 to 40 minutes. Based on opening 471 new accounts for legal entities and an average wage of $16.77 for “new account clerks,” ^[46] this would result in an annual cost to a small bank of $2,550 to $5,100.^[47] FinCEN also notes that, even among small entities, the costs could be expected to vary substantially.^[48]

In addition, compliance with the beneficial ownership requirement would be expected to require additional training, information technology upgrades, and revisions to policies, procedures, and internal controls. A discussion of the estimated costs for these tasks for small entities is included in the CDD Rule FRFA referred to above.

E. Overlapping or Conflicting Federal Rules

FinCEN is unaware of any existing Federal regulations that would overlap or conflict with the amendments being proposed.

F. Consideration of Significant Alternatives

FinCEN has not identified any alternative means for bringing these categories of non-federally regulated banks into compliance with the same standards as all other banks in the United States. Were FinCEN to exempt small entities from this requirement, those entities would potentially be at greater risk of abuse by money launderers and other financial criminals.

With respect to the CDD pillar of the AML program rule, FinCEN considered several alternatives to that which is being proposed. As described in greater detail elsewhere,^[49] these alternatives included exempting small financial institutions below a certain asset or legal entity customer threshold from the requirements, as well as utilizing a lower ( e.g., 10 percent) or higher ( e.g., 50 percent) threshold for the minimum level of equity ownership for the definition of beneficial owner. FinCEN determined, however, that identifying the beneficial owner of a financial institution's legal entity customers and verifying that identity are necessary parts of an effective AML program. Were FinCEN to exempt small entities from this requirement, or entities that establish fewer than a limited number of accounts for legal entities, those financial institutions would be at greater risk of abuse by money launderers and other financial criminals, as criminals would identify institutions without this requirement. FinCEN also considered increasing the threshold for ownership of equity interests in the definition of beneficial ownership to 50 percent or more of the equity interests. Although this higher threshold would reduce the number of individuals whose identity would need to be verified from five to three, thus reducing marginally the onboarding time, this change would not impact the training or IT costs, and therefore, would not substantially reduce the overall costs of the rule and also would provide less useful information. After considering all the alternatives FinCEN has concluded that an ownership threshold of 25 percent is appropriate to maximize the benefits of the requirement while minimizing the burden.

G. Questions for Comment

Please provide comment on any or all of the provisions of the proposed rule with regard to their economic impact on small entities, and what less burdensome alternatives, if any, FinCEN should consider.

V. Unfunded Mandates Act

Section 202 of the Unfunded Mandates Reform Act of 1995 (“Unfunded Mandates Act”), Public Law 104-4 (March 22, 1995), requires that an agency prepare a budgetary impact statement before promulgating a rule that may result in expenditure by the State, local, and tribal governments, in the aggregate, or by the private sector, of $100 million or more in any one year. If a budgetary impact statement is required, section 202 of the Unfunded Mandates Act also requires an agency to identify and consider a reasonable number of regulatory alternatives before promulgating a rule. Taking into account the factors noted above and using conservative estimates of average labor costs in evaluating the cost of the burden imposed by the proposed regulation, FinCEN has determined that it is not required to prepare a written statement under section 202.

VI. Executive Orders 13563 and 12866

Executive Orders 13563 and 12866 direct agencies to assess costs and benefits of available regulatory alternatives and, if regulation is necessary, to select regulatory approaches that maximize net benefits (including potential economic, environmental, public health and safety effects, distributive impacts, and equity). Executive Order 13563 emphasizes the importance of quantifying both costs and benefits, of reducing costs, of harmonizing rules, and of promoting flexibility. It has been determined that this is not a significant regulatory action for purposes of Executive Order 12866. Accordingly, a regulatory impact analysis is not required. ( print page 58433)

VII. Paperwork Reduction Act

The collection of information contained in this proposed rule is being submitted to the Office of Management and Budget for review in accordance with the Paperwork Reduction Act of 1995 (44 U.S.C. 3507(d)). Comments on the collection of information should be sent (preferably by fax (202-395-6974)) to the Desk Officer for the Department of the Treasury, Office of Information and Regulatory Affairs, Office of Management and Budget, Paperwork Reduction Project (1506), Washington, DC 20503, or by the Internet to [email protected], with a copy to FinCEN by mail or the Internet. Comments on the collection of information should be received by October 24, 2016.

An agency may not conduct or sponsor, and a person is not required to respond to, a collection of information subject to the Paperwork Reduction Act unless it displays a valid control number assigned by the Office of Management and Budget.

The collection of information in the proposed rule would be codified at 31 CFR 1020.210, 1020.220, and 1020.230. The information will be used by examining agencies to verify compliance with these provisions. The collection of information is mandatory. Records required to be retained under the BSA must be retained for five years.

Description of Recordkeepers: Banks without a Federal functional regulator, as defined in 31 CFR 1020.210 and 1020.220.

Estimated Number of Affected Institutions: 1,151.

Estimated Average Annual Burden Hours per Recordkeeper: Since this is a new requirement, the estimated average burden associated with the recordkeeping requirement in this proposed rule is 40 hours for development of a written program, and following the initial development, the program must be reviewed on an annual basis, to include a one (1) hour per year burden recognized for annual maintenance and update.

Estimated Total Annual Reporting Burden: 46,040 hours.

This burden will be added to the existing burden listed under OMB Control Number 1506-0035 currently titled AML Programs for insurance companies and loan and finance companies. The new title for this control number will be AML Programs for insurance companies, and residential mortgage lenders and originators, and banks that lack a Federal functional regulator. The new total burden will be 140,240 hours.

Questions for comment: (1) Whether the collection of information is necessary for the proper performance of FinCEN's mission, including whether the information will have practical utility; (2) Whether FinCEN's estimate of the burden of the collection of information is accurate; (3) What are ways to enhance the quality, utility, and clarity of the information to be collected; (4) What are ways to minimize the burden of the collection of information, including through the use of automated collection techniques or other forms of information technology; (5) What are the estimates of capital or start-up costs to implement and then maintain an AML program; (6) How many banks that lack a Federal functional regulator are considered “small businesses” because the entities have less than $550 million in total assets; (7) What is the average number of employees or the average total annual salary expense for banks that lack a Federal functional regulator; and (8) What is the average number of employees dedicated to bank regulation compliance.

Authority and Issuance

For the reasons set forth in the preamble, parts 1010 and 1020 of chapter X of title 31 of the Code of Federal Regulations are proposed to be amended as follows:

1. The authority citation for part 1010 continues to read as follows:

Authority: 12 U.S.C. 1829b and 1951-1959; 31 U.S.C. 5311-5314 and 5316-5332; title III, sec. 314, Public Law 107-56, 115 Stat. 307.

2. Section 1010.205 is amended by:

a. Removing paragraph (b)(1)(vi);

b. Redesignating paragraphs (b)(1)(vii) through (ix) as paragraphs (b)(1)(vi) through (viii); and

c. Removing and reserving paragraph (b)(2) and removing paragraph (b)(3).

3. Section 1010.605 is amended by:

a. Revising paragraph (e)(1)(i)

b. Removing paragraphs through (e)(1)(ii) through (vii); and

b. Redesignating paragraphs (e)(1)(viii) through (x) as paragraphs (e)(1)(ii) through (iv).

The revision reads as follows:

4. The authority citation for part 1020 continues to read as follows:

Authority: 12 U.S.C. 1829b and 1951-1959; 31 U.S.C. 5311-5314 and 5316-5332; title III, sec. 314, Public Law 107-56, 115 Stat. 307.

5. Section 1020.100 is amended by:

a. Removing paragraphs (b) and (d); and

b. Redesignating paragraph (c) as paragraph (b).

6. Section 1020.210 is revised to read as follows:

7. Amend § 1020.220 by revising the section heading and paragraph (a)(1) to read as follows: