FinCEN Seeks to Expand BSA Coverage and Modernize Customer Identification Regulations | Skadden, Arps, Slate, Meagher & Flom LLP

The U.S. Treasury’s Financial Crimes Enforcement Network (FinCEN) recently took steps to expand the reach of the Bank Secrecy Act (BSA) and related customer identification regulations. These actions build on FinCEN’s efforts to modernize the anti-money laundering and counterterrorism financing (AML/CFT) framework in the United States.

Specifically, FinCEN issued notices of proposed rulemaking that would require:

Securities and Exchange Commission (SEC) registered investment advisors and Exempt Reporting Advisors (ERA) to establish, document and maintain written customer identification programs (CIPs).
Certain professionals involved in real estate closings and settlements are required to report information on unfinanced transfers of residential real estate to corporations or trusts to FinCEN.

FinCEN also issued a request for information regarding existing requirements for banks under the CIP Regulation to collect a customer’s taxpayer identification number before opening an account.

While the notices of proposed rulemaking show that FinCEN is expanding its regulatory reach to include additional institutions that were not previously subject to BSA regulation, the request for information suggests that FinCEN may take a more pragmatic approach to certain requirements as industries evolve and technological capabilities expand.

Proposed new requirements for registered investment advisers and exempt reporting advisers

On May 13, 2024, FinCEN and the SEC jointly proposed a new rule that would require OSRs and ERAs to establish, document, and maintain written CIP plans. The proposed rule would complement FinCEN’s separate proposal to designate OSR and ERA as “financial institutions” under the BSA, which would impose comprehensive AML program requirements and Suspicious Activity Report (SAR) reporting obligations on them.

This is not the first time FinCEN has attempted to impose anti-money laundering requirements on investment advisers. In 2002 and 2003, FinCEN proposed rules covering them, but FinCEN withdrew them in 2008, in part on the grounds that these industry entities’ activities do not fall entirely outside the BSA framework because they and their clients hold their assets and conduct their financial transactions through through financial institutions subject to BSA requirements.

Under the new proposed rule, OSRs and ERAs will be required to implement reasonable procedures to identify and verify the identity of their customers, among other things, to reasonably believe that they know the true identity of their customers. FinCEN believes that the proposed rule will make it more difficult for criminal, corrupt, or illegal entities to establish client relationships with investment advisors for the purpose of laundering money, financing terrorism, or engaging in other illicit financial activities.

Many RIAs are already subject to AML program requirements, including CIP requirements and SAR filing obligations, because they also operate as broker-dealers or other covered financial institutions. However, for RIAs that are not currently subject to these requirements, the proposed rule – along with FinCEN’s separate proposal to designate OSRs and ERAs as “financial institutions” – could create a new burden, including for many small businesses operating as RIAs. While these changes have been long expected, they remain controversial.

The comment period for the proposed rule expires on July 22, 2024. The comment period for FinCEN’s proposal to designate OSR and ERA as “financial institutions” expired on April 15, 2024.

Proposed new requirements for unfinanced transfers of residential property

On February 7, 2024, FinCEN proposed a new rule that would require certain real estate closing and settlement professionals to report to FinCEN information on unfinanced transfers of residential real estate to corporations or trusts. Although the BSA requires “persons engaged in real estate closings and settlements” to maintain anti-money laundering programs, FinCEN has long exempted such individuals from comprehensive regulation under the BSA. Instead, FinCEN has implemented risk-based measures, such as “geo-targeting orders” issued by FinCEN since 2016, focusing on specific U.S. real estate markets. However, the proposed rule would apply to unfinanced transfers of residential real estate throughout the country.

Under the proposed rule, certain persons involved in real estate closings and settlements would be required to file and maintain a report with FinCEN that would specify:

Reporting person
The legal entity or trust to which residential property is transferred.
Beneficial owners of the acquiring entity or acquiring trust.
Transferer.
Transferred property.
Some transaction information regarding the transfer.

The proposed rule would designate only one reporter for each reportable transfer, identified either by a “cascading” reporting order or by a written agreement among real estate professionals described in the cascading reporting order. In the absence of a written agreement, the reporting obligation rests with the top business in the cascade, unless there is no such business in the transaction, in which case the reporting obligation is moved down one level. The proposed cascade is:

Real estate professionals providing specific settlement services (i.e., closing or settlement agent).
A person who insures a title insurance policy for the transferee.
The person who withdraws the largest amount of funds in connection with a reportable transfer.
A person who prepares a title condition assessment.
Person preparing the act.

For purposes of this new reporting requirement, FinCEN relies on its authority to impose SAR filing obligations on financial institutions, which it elects to do in a “streamlined” manner, without an accompanying AML program requirement. However, given that the proposed streamlined submission criteria are known to all transfer parties, including those whose information will be collected and reported to FinCEN, FinCEN proposes to exempt reporting persons from the confidentiality provisions that would normally apply to reporting of suspicious activity.

FinCEN received over 600 comments on the proposed rule. The comment period ended on April 16, 2024.

Modernization of the CIP rule

On March 29, 2024, FinCEN published a request for information and comments seeking information and comments that would help it assess the risks, benefits, and protections if banks were permitted to collect a partial Social Security Number (SSN) from a customer and then using a reliable third party source to obtain the customer’s full SSN before opening an account. FinCEN cited changes in technology and the financial services industry as one of its reasons for requesting comment.

In the background, FinCEN issued regulations in 2003—collectively known as the CIP Rule—to implement Section 326 of the USA PATRIOT Act. Among other things, the CIP Rule requires that a bank, as part of its anti-money laundering program, implement a written CIP program that contains identity verification procedures that enable the bank to reasonably believe that it knows the true identity of its customers.

According to the rule, banks are obliged to collect an identification number from each customer. For U.S. individuals, the ID number is your taxpayer identification number, which for individuals is usually your SSN. FinCEN pointed out that banks generally must collect the full nine-digit SSN directly from the customer and emphasized that the CIP rule generally does not require a bank to collect part or all of an individual’s SSN from someone other than the customer (e.g.., a reliable external service provider).

However, from its inception, the CIP rule did not require banks to obtain full SSNs for credit card accounts. Customers opening credit card accounts only need to provide the last four digits of their SSN, and banks can obtain the first five digits from a reliable third-party provider. Additionally, outside of credit card accounts, U.S. regulators have allowed institutions to collect only the last four digits of a customer’s SSN in certain situations, such as when the Office of the Comptroller of the Currency granted an exemption to a banking subsidiary through an interpretation of its November 16, 2020 letter.

At the time the CIP rule was adopted, customers typically opened bank accounts in person at branches, while customers often opened credit card accounts over the phone or at a retail store checkout, where providing the full SSN could increase privacy and security concerns.

The ways in which customers interact with banks – and financial service providers more generally – have changed significantly since 2003, and additional means of identity verification have become available that provide a reliable alternative to collecting nine-digit SSNs from customers. At the same time, customers have become more sensitive to the risk of identity theft and are reluctant to share their full SSNs, creating unnecessary friction in online transactions.

This call for comment is both a reminder that FinCEN’s position is that banks must generally collect full SSNs directly from customers to comply with applicable CIP regulations, and it is an opportunity for banks and fintech companies to signal to FinCEN that they are happy to would adopt a market refresh rule.

More broadly, however, the request for information and comments signals FinCEN’s openness to reconsidering the current requirements under the CIP Rule regarding the collection of full nine-digit SSNs from customers. Updating this rule would provide assistance to financial technology companies and others that work with banks and have developed innovative ways to reasonably believe they know the true identity of their customers.

The comment period ended on May 28, 2024.

Application

In recent years, FinCEN has become a more active regulator. FinCEN administers new reporting requirements under the Corporate Transparency Act and increasingly regulates entire classes of financial institutions it previously exempted under the BSA. See our January 31, 2024 Customer Alert: “The Corporate Transparency Act Is Now and the New York LLC Transparency Act Is Coming.” These developments reflect the U.S. government’s growing concern about money laundering and illicit financing, particularly the impact of non-U.S. persons laundering the proceeds of crime through the U.S. financial system.

If issued, these proposed rules would impose significant new compliance obligations on U.S. businesses. However, FinCEN’s apparent willingness to consider modernizing the CIP rule demonstrates that it is willing to update its rules to keep pace with changes in technology and business models.

(Show source.)