NO MORE MINDING THE GAP: FINCEN EXPANDS AML AND OTHER REQUIREMENTS TO BANKS LACKING A FEDERAL FUNCTIONAL REGULATOR

For years, private banks and other banks that lack a federal functional regulator (e.g., Federal Reserve, OCC, FDIC, NCUA, SEC, CFTC) have been exempted from having anti-money laundering (“AML”) programs under regulations of the U.S. Treasury Department’s Financial Crimes Enforcement Network (“FinCEN”).  That exemption is set to be eliminated.  In September, FinCEN issued a final rule (the “Final Rule”) that requires, for the first time, minimum standards for AML programs for banks lacking a federal functional regulator.[1]  The Final Rule also extends customer identification and beneficial ownership requirements to such institutions.  The compliance deadline for these requirements is March 15, 2021. 

Background

Since 2002, FinCEN has subjected most banks to comprehensive AML program requirements pursuant to the Bank Secrecy Act of 1970, as amended by the USA PATRIOT Act of 2001 (collectively, the “BSA”).  However, private banks and other financial institutions that are not subject to regulation by a federal functional regulator (such as non-federally insured credit unions and certain trust companies) have not been subject to these requirements.  Although they have been subject to other BSA requirements, including the filing of currency transaction reports and suspicious activity reports, which necessarily require them to establish processes to detect unusual activity, FinCEN has recognized that “the gap in AML coverage between banks with and without a Federal functional regulator presented a vulnerability to the U.S. financial system that could be exploited by bad actors.”[2] 

New Compliance Requirements and Deadline

The Final Rule updates FinCEN’s regulations in three areas: (i) AML program requirements, (ii) CIP requirements, and (iii) beneficial ownership requirements: 

• Anti-Money Laundering Program – AML program requirements generally require (i) the development of internal policies, procedures, and controls; (ii) the designation of a compliance officer; (iii) an ongoing employee training program; and (iv) an independent audit function.The Final Rule removes the exemption from these requirements for banks that lack a federal functional regulator, including, but not limited to, private banks, non-federally insured credit unions, and certain trust companies.
• Customer Identification Program – CIP requirements generally require, among other things, that financial institutions (i) verify the identity of persons seeking to open an account, (ii) maintain records of the information used to the verify the person’s identity, and (iii) determine whether the person appears on any lists of known or suspected terrorists or terrorist organizations.Certain banks lacking a federal functional regulator—namely, private banks, non-federally insured credit unions, and certain trust companies—are already required to maintain CIPs, but the Final Rule eliminates any remaining gap with respect to institutions that were not specifically identified in FinCEN’s prior rulemakings.
• Beneficial Ownership Requirements – Beneficial ownership requirements, which came into effect in 2018, generally require federal regulated banks and certain other financial institutions to identify and verify the identity of the beneficial owners of their legal entity customers.The Final Rule requires banks lacking a federal functional regulator to obtain and maintain identifying information for each beneficial owner from each legal entity customer that opens a new account, including name, address, date of birth, and identification number. In addition, they are required to verify the identity of such persons by documentary or non-documentary methods and to maintain in its records for five years a description of (i) any document relied on for verification, (ii) any such non-documentary methods and results of such measures undertaken, and (iii) the resolution of any substantive discrepancies discovered in verifying the identification information.

According to FinCEN, banks lacking a federal functional regulator will be able to leverage existing policies, procedures, and internal controls required by other statutory and regulatory requirements to fulfill the obligations set out in the Final Rule.  FinCEN estimates that 297 state-chartered non-depository trust companies, 228 non-federally insured credit unions, 29 international banking entities, 12 non-federally insured state-chartered banks and savings and loan or building and loan associations, and one private bank will be required to implement written AML programs as a result of this Final Rule by March 15, 2021.