The Financial Crimes Enforcement Network (FinCEN), Department of the Treasury.
Notice of proposed rulemaking.
The Financial Crimes Enforcement Network (“FinCEN”), a bureau of the Department of the Treasury (“Treasury”), is proposing to revise the regulations implementing the Bank Secrecy Act (“BSA”) regarding the confidentiality of a report of suspicious activity (“SAR”) to: Clarify the scope of the statutory prohibition against the disclosure by a financial institution of a SAR; address the statutory prohibition against the disclosure by the government of a SAR; clarify that the exclusive standard applicable to the disclosure of a SAR by the government is to fulfill official duties consistent with the purposes of the BSA; modify the safe harbor provision to include changes made by the Uniting and Strengthening America by Providing the Appropriate Tools Required to Intercept and Obstruct Terrorism Act of 2001 (“USA PATRIOT Act”); and make minor technical revisions for consistency and harmonization among the different rules. These amendments are consistent with similar proposals to be issued by some of the Federal bank regulatory agencies.
Comments must be received by June 8, 2009.
You may submit comments, identified by RIN 1506–AA99 or docket number TREAS-FinCen-2008–0022,
•
•
Regulatory Policy and Programs Division, FinCEN (800) 949–2732 and select option 1.
The BSA requires financial institutions to keep certain records and make certain reports that have been determined to be useful in criminal, tax, or regulatory investigations or proceedings, and for intelligence or counter intelligence activities to protect against international terrorism. In particular, the BSA and its implementing regulations require financial institutions to file a SAR when they detect a known or suspected violation of Federal law or regulation, or a suspicious activity related to money laundering, terrorist financing, or other criminal activity.
SARs generally are unproven reports of possible violations of law or regulation, or of suspicious activities, that are used for law enforcement or regulatory purposes. The BSA provides that a financial institution and its officers, directors, employees, and agents are prohibited from notifying any person involved in a suspicious transaction that the transaction was reported.
The USA PATRIOT Act strengthened the confidentiality of SARs by adding to the BSA a new provision that prohibits officers or employees of the Federal government or any State, local, tribal, or territorial government within the United States with knowledge of a SAR from disclosing to any person involved in a suspicious transaction that the transaction was reported, other than as necessary to fulfill the official duties of such officer or employee.
To encourage the reporting of possible violations of law or regulation, and the filing of SARs, the BSA contains a safe harbor provision that shields financial institutions making such reports from civil liability. In 2001, the USA PATRIOT Act clarified that the safe harbor covers voluntary disclosure of possible violations of law and regulations to a government agency and expanded the scope of the limit on liability to cover any civil liability which may exist “under any contract or other legally enforceable agreement (including any arbitration agreement).”
The proposed amendments to FinCEN's SAR rules include key changes that would (1) clarify the scope of the statutory prohibition against the disclosure by a financial institution of a SAR; (2) address the statutory prohibition against the disclosure by the government of a SAR; (3) clarify that the exclusive standard applicable to the disclosure of a SAR, or any information that would reveal the existence of a SAR by the government is “to fulfill official duties consistent with Title II of the BSA,” in order to ensure that SAR information is protected from inappropriate disclosures unrelated to the BSA purposes for which SARs are filed; (4) modify the safe harbor provision to include changes made by the USA PATRIOT Act; and (5) where possible, harmonize minor technical differences that exist between the confidentiality, safe harbor, and compliance provisions of our rulemakings for different industries.
In separate but contemporaneous rulemakings, some of the Federal bank regulatory agencies are proposing to amend their SAR rules to incorporate comparable provisions, and to amend their information disclosure regulations
Additionally, elsewhere in this part, FinCEN is simultaneously issuing for notice and comment proposed guidance regarding the sharing of SARs with affiliates. This proposed guidance interprets one of the provisions of this notice of proposed rulemaking and, accordingly, should be read in conjunction with this notice.
Out of recognition that “reports with a high degree of usefulness” were unlikely to be filed unless afforded strict confidentiality, Congress established what is often referred to as the “non-disclosure provision”
FinCEN believes it is important to clarify that the statutory prohibition on notifying the person involved in the transaction that the transaction has been reported must be interpreted more broadly to prohibit disclosures to any person. SAR rules issued by the Federal bank regulatory agencies already provide that “SARs are confidential.” As described further in the Section-by-Section Analysis below, this view of SAR confidentiality also has been repeatedly upheld in relevant case law.
FinCEN also recognizes that in order to protect the confidentiality of a SAR, any information that would reveal the existence of a SAR must be afforded the same protection as the SAR itself. The confidentiality of SARs must be maintained for a number of compelling reasons. For example, the disclosure of a SAR could result in notification to persons involved in the transaction that is being reported and compromise any investigations being conducted in connection with the SAR. In addition, FinCEN recognizes that any disclosure of a SAR could reduce the willingness of all financial institutions to file SARs. If institutions believe that a SAR can be used for purposes unrelated to the law enforcement and regulatory purposes of the BSA, the disclosure of such information could adversely affect the timely, appropriate, and candid reporting of suspicious transactions. Institutions also may be reluctant to report suspicious transactions for fear that the disclosure of a SAR will interfere with the institution's relationship with its customer. Further, a SAR may provide insight into how an institution uncovers potential criminal conduct that can be used by others to circumvent detection. The disclosure of a SAR also could compromise personally identifiable information or commercially sensitive information, or damage the reputational interests of companies that may be named. Finally, the disclosure of a SAR increases the risk that an institution's employees or others involved in the preparation and filing of SARs could become targets for retaliation by persons whose criminal conduct has been reported.
FinCEN believes that all of the reasons for maintaining the confidentiality of SARs are equally applicable to any information that would reveal the existence of a SAR. Therefore, FinCEN is proposing to modify the general introduction in our rules to state that “[a] SAR, and any information that would reveal the existence of a SAR, are confidential.” The introduction also indicates that neither a SAR, nor any information that would reveal the existence of a SAR, may be disclosed, except as authorized in the limited circumstances that follow.
FinCEN is also proposing to modify this introductory section by clarifying that “for purposes of [the confidentiality provision] only, a SAR shall include any suspicious activity report filed with FinCEN pursuant to any regulation in this part.” By using the term “SAR” in each of the proposed confidentiality provisions, FinCEN is purposefully using a term broader than the existing references in those provisions to specific types of SARs. We note that our rules require institutions to comply with our filing requirements through the use of particular versions of the SAR form,
FinCEN's current rules provide that any institution subpoenaed or otherwise requested to disclose a SAR or the information contained in a SAR must decline to produce the SAR or to provide any information that would disclose that a SAR has been prepared or filed, and must notify FinCEN of the request and its response to the request.
The proposed rules more specifically address the prohibition on the disclosure of a SAR by a financial institution. The rules provide that the prohibition includes “any information that would reveal the existence of a SAR” instead of using the phrase “any information that would disclose that a SAR has been prepared or filed.” FinCEN believes that this phrase more clearly describes the type of information that is covered by the prohibition against the disclosure of a SAR. In addition, the proposed rules incorporate the specific reference in 31 U.S.C. 5318(g)(2)(A)(i) to “directors, officers, employees and agents,” and clarify that the prohibition against disclosure extends to those individuals in a financial institution who may have access to a SAR or information that would reveal the existence of a SAR.
Although 31 U.S.C. 5318(g)(2)(A)(i) states that a person involved in the transaction may not be notified that the transaction has been reported, the proposed rules continue to reflect case law that has consistently concluded, in accordance with applicable regulations, that financial institutions are broadly prohibited from disclosing a SAR, or information that would reveal the existence of a SAR, to any person. Accordingly, these cases have held that, in the context of discovery in connection with civil lawsuits, financial institutions are prohibited from disclosing a SAR or information that would reveal the existence of a SAR because section 5318(g) and its implementing regulations have created an unqualified discovery and evidentiary privilege for such information that cannot be waived by financial institutions.
The proposed rules continue to provide that any financial institution, or any director, officer, employee, or agent of a financial institution, that is subpoenaed or otherwise requested to disclose a SAR or information that would reveal the existence of a SAR must decline to provide the information, citing this section of the rules and 31 U.S.C. 5318(g)(2)(A)(i), and must provide notification of the request and its response thereto to FinCEN and its primary Federal regulator if that regulator has a parallel SAR requirement.
FinCEN is proposing rules of construction to address issues that have arisen over the years about the scope of the SAR disclosure prohibition and to implement statutory modifications to the BSA made by the USA PATRIOT Act. The proposed rules of construction primarily describe situations that are not covered by the prohibition against the disclosure of SAR information. The introduction to these rules makes clear that the rules of construction are each qualified by the statutory mandate that no person involved in any reported suspicious transaction can be notified that the transaction has been reported.
The first proposed rule of construction builds upon the existing
The second proposed rule of construction provides that the phrase “a SAR or information that would reveal the existence of a SAR” does not include the underlying facts, transactions, and documents upon which a SAR is based. This statement reflects case law which has recognized that, while a financial institution is prohibited from producing documents in discovery that evidence the existence of a SAR, factual documents created in the ordinary course of business (for example, business records and account information upon which a SAR is based), may be discoverable in civil litigation under the Federal Rules of Civil Procedure.
This proposed rule of construction includes illustrative examples of situations where the underlying facts, transactions, and documents upon which a SAR is based may be disclosed. The first example clarifies that this information
The second example, applicable only to depository institutions, broker-dealers, futures commission merchants, and introducing brokers in commodities, codifies a rule of construction added to the BSA by section 351 of the USA PATRIOT Act which provides that such underlying information may be disclosed in certain written employment references and termination notices.
The third proposed rule of construction, applicable at this time only to depository institutions, broker-dealers, mutual funds, futures commission merchants, and introducing brokers in commodities, makes clear that the prohibition against the disclosure of a SAR or information that would reveal the existence of a SAR does not include the sharing by any of these financial institutions, or any director, officer, employee, or agent of these institutions, of a SAR or information that would reveal the existence of the SAR within the institution's corporate organizational structure, for purposes that are consistent with Title II of the BSA, as determined by regulation or in guidance. This proposed rule of construction recognizes that these financial institutions may find it necessary to share a SAR or information that would reveal the existence of a SAR to fulfill reporting obligations under the BSA, and to facilitate more effective enterprise-wide BSA monitoring, reporting, and general risk-management. The term “share” used in this rule of construction is an acknowledgement that sharing within a corporate organization for purposes consistent with Title II of the BSA is distinguishable from a prohibited disclosure.
FinCEN and the Federal bank regulatory agencies have already issued joint guidance making clear that the U.S. branch or agency of a foreign bank may share a SAR with its head office, and that a U.S. bank or savings association may share a SAR with its controlling company (whether domestic or foreign). In consultation with the staffs of the SEC and CFTC, FinCEN also issued comparable guidance for broker-dealers, futures commission merchants, and introducing brokers in commodities permitting them to share SARs with parent entities (whether domestic or foreign). These guidance documents recognized that the sharing of a SAR with a head office, controlling company, or parent entity facilitates both the compliance with the applicable requirements of the BSA and the discharge of oversight responsibilities with respect to enterprise-wide risk management and compliance with applicable laws and regulations.
In this same part of the
As previously noted, section 351 of the USA PATRIOT Act, 31 U.S.C. 5318(g)(2)(A)(ii), amended the BSA, adding a new provision prohibiting officers and employees of the government from disclosing a SAR except “as necessary to fulfill [their] official duties.” FinCEN is proposing a new section in the regulations that
As stated in 5318(g)(2)(A)(i), which prohibits a financial institution's disclosure of a SAR, section 5318(g)(2)(A)(ii) also prohibits the government from disclosing a SAR to “any person involved in the transaction.” FinCEN is proposing to address sections 5318(g)(2)(A)(i) and (A)(ii) in a consistent manner, because disclosure to any outside party may make it likely that a SAR or any information that would reveal the existence of a SAR, will be disclosed to a person involved in the transaction. Accordingly, the section of the rules that address the disclosure of a SAR or of such information by the government and its officers, employees, and agents is broad and does not prohibit disclosure only to “any person involved in the transaction.”
Section 5318(g)(2)(A)(ii) narrowly permits governmental disclosures “as necessary to fulfill the official duties,” a phrase that is not defined in the BSA. FinCEN is proposing to construe this phrase in the context of the BSA, in light of the purpose for which SARs are filed. Accordingly, the proposed rules interpret “official duties” to mean “official duties consistent with the purposes of Title II of the BSA,” namely, for “criminal, tax, or regulatory investigations or proceedings, or in the conduct of intelligence or counterintelligence activities, including analysis, to protect against international terrorism.”
The proposed rules also specifically provide that “official duties consistent with Title II of the BSA” shall not include the disclosure of a SAR or information that would reveal the existence of a SAR in response to a request for disclosure of non-public information or in response to a request for use in a private legal proceeding, including a request under 31 CFR 1.11. The BSA exists, in part, to protect the public's interest in an effective reporting system that benefits the nation by helping to assure that the U.S. financial system will not be used for criminal activity or to support terrorism. FinCEN believes that this purpose would be undermined by the disclosure of a SAR or information that would reveal the existence of a SAR to a private litigant for use in a civil lawsuit for the reasons described earlier, including the reason that such disclosures could negatively impact full and candid reporting by financial institutions.
Finally, the proposed regulations would apply to any government authority, in addition to its officers, employees, and agents. FinCEN is proposing to include each government authority itself in the scope of coverage because requests for SARs are typically directed to the government authority, rather than to individuals within the government with authority to respond to the request. In addition, agents are included in the proposed paragraph because agents of a government authority may have access to a SAR or information that would reveal the existence of a SAR.
Although not part of any federal, state, local, territorial, or tribal government authority, self-regulatory organizations registered with or designated by the SEC or CFTC are permitted to access SARs through FinCEN's delegation of examination authority to the SEC or CFTC, for the purpose of examining broker-dealers, futures commission merchants, and introducing brokers in commodities for compliance with their SAR requirements. Although the BSA does not explicitly address the issue of disclosures of SARs by self-regulatory organizations, FinCEN believes it was Congress's clear intent that self-regulatory organizations with access to SARs should be subject to the same confidentiality provisions as all other users of SAR data. Accordingly, in the rules governing entities which may be examined for compliance with their SAR requirements by a self-regulatory organization, FinCEN is proposing a provision regarding disclosures by self-regulatory organizations that closely follows the provision regarding government disclosures. The language differs, however, to reflect the fact that self-regulatory organizations are not governmental entities. As with the provision for financial institutions and government authorities, the provision for self-regulatory organizations would apply equally to any director, officer, employee, or agent of the self-regulatory organization.
In 1992, the Annunzio-Wylie Act amended the BSA by providing a safe harbor for financial institutions and their employees from civil liability for the reporting of known or suspected criminal offenses or suspicious activity through the filing of a SAR.
Additionally, to comport with the authorization to jointly file SARs in the second rule of construction, FinCEN is clarifying that the safe harbor also applies to “a disclosure made jointly with another institution.” This concept exists currently in those SAR rules
For consistency, FinCEN also separated the provision for confidentiality of reports and limitation of liability into two separate provisions in those rules for industries which previously contained both provisions under the single heading “confidentiality of reports; limitation of liability.”
Each of FinCEN's existing SAR rules contains a provision that clarifies that Treasury, through FinCEN or its delegatee,
In addition to the changes described above in the Section-by-Section analysis, FinCEN is proposing technical corrections to harmonize each of the seven SAR rules with rules being issued by some of the Federal bank regulatory agencies. FinCEN believes that such efforts will simplify compliance with SAR reporting requirements.
As per the
(a) 31 CFR 103.15, Reports by mutual funds of suspicious transactions, would be moved to 31 CFR 1024.320.
(b) 31 CFR 103.16, Reports by insurance companies of suspicious transactions, would be moved to 31 CFR 1025.320.
(c) 31 CFR 103.17, Reports by futures commission merchants and introducing brokers in commodities of suspicious transactions, would be moved to 31 CFR 1026.320.
(d) 31 CFR 103.18, Reports by banks of suspicious transactions, would be moved to 31 CFR 1020.320.
(e) 31 CFR 103.19, Reports by brokers or dealers in securities, would be moved to 31 CFR 1023.320.
(f) 31 CFR 103.20, Reports by money services businesses in securities, would be moved to 31 CFR 1022.320.
(g) 31 CFR 103.21, Reports by casinos of suspicious transactions, would be moved to 31 CFR 1021.320.
FinCEN welcomes comments on any aspect of these proposed amendments to the SAR rules. FinCEN has timed the release of the notice of proposed rulemaking to coincide with the following related items: (1) A notice of, and request for comment on, proposed guidance regarding the sharing of SARs with affiliates; (2) parallel amendments proposed by certain Federal bank regulatory agencies to their own respective SAR confidentiality regulations; and (3) proposed rules by certain Federal bank regulatory agencies to amend the information disclosure rules. Commenters are encouraged to consider each proposal when commenting on the others.
• Should any of the proposed provisions which would apply only to a limited segment of SAR filers be applicable to additional types of financial institutions? For example, should sharing within an institution's corporate organizational structure for purposes consistent with Title II of the BSA be limited only to banks, broker-dealers, futures commission merchants, and introducing brokers in commodities?
• Are any of the terms or provisions that were used for consistency across financial institutions inappropriate for any one type of financial institution based on its specific characteristics?
• Have any important provisions from the existing regulations been unintentionally or inappropriately eliminated or confused by the proposed new regulations?
• Are any of the provisions or terms used in the rules or this preamble unclear in their meaning, application, or scope?
• If finalized, how would these proposed rules impact compliance costs and practices?
• What additional or alternative methods could be used to strengthen the confidentiality of SARs?
• Should additional parts of the SAR rules be harmonized? If so, please describe the benefit of such revisions.
Pursuant to the Regulatory Flexibility Act (RFA) ( 5 U.S.C. 601
We have reviewed the proposed rules in accordance with the Paperwork Reduction Act of 1995 (44 U.S.C. 3506; 5 CFR 1320, Appendix A.1) (PRA) and have determined that it does not contain any “collections of information” as defined by the PRA.
It has been determined that this proposed rule is not a significant regulatory action for purposes of Executive Order 12866. Accordingly, a regulatory impact analysis is not required.
Section 202 of the Unfunded Mandates Reform Act of 1995, Public Law 104–4 (2 U.S.C. 1532) (Unfunded Mandates Act), requires that an agency prepare a budgetary impact statement before promulgating any rule likely to result in a Federal mandate that may result in the expenditure by State, local, and tribal governments, in the aggregate, or by the private sector of $100 million or more in any one year. The current inflation-adjusted expenditure threshold is $133 million. If a budgetary impact statement is required, § 205 of the Unfunded Mandates Act also requires an agency to identify and consider a reasonable number of regulatory alternatives before promulgating a rule.
FinCEN has determined that the proposed rules will not result in expenditures by State, local, and tribal governments, or by the private sector, of $133 million or more in any one year. Accordingly, this proposal is not subject to section 202 of the Unfunded Mandates Act.
Administrative practice and procedure, Authority delegations (government agencies), Crime, Currency, Investigations, Law enforcement, Reporting and recordkeeping requirements, Security measures.
For the reasons set forth in the preamble, 31 CFR Part 103 is proposed to be amended as follows:
1. The authority citation for part 103 continues to read as follows:
12 U.S.C. 1829b and 1951–1959; 31 U.S.C. 5311–5314 and 5316–5332; title III, sec. 314 Public Law 107–56, 115 Stat. 307.
2. Section 103.15 is amended by:
a. Revising paragraphs (d) and (e);
b. Redesignating paragraphs (f) and (g) as paragraphs (g) and (h); and
c. Adding new paragraph (f).
(d)
(1)
(ii)
(A) The disclosure by a mutual fund, or any director, officer, employee, or agent of a mutual fund of:
(
(
(B) The sharing by a mutual fund, or any director, officer, employee, or agent of the mutual fund, of a SAR, or any information that would reveal the existence of a SAR, within the mutual fund's corporate organizational structure for purposes consistent with Title II of the Bank Secrecy Act as determined by regulation or in guidance.
(2)
(e)
(f)
3. Section 103.16 is amended by:
a. Revising paragraph (f);
b. Redesignating paragraphs (g) through (i) as paragraphs (h) through (j);
c. Adding new paragraph (g); and
d. Revising newly designated paragraph (h).
(f)
(1)
(ii)
(A) A SAR, or any information that would reveal the existence of a SAR, to FinCEN or any Federal, state, or local law enforcement agency, or any Federal or state regulatory authority that examines the insurance company for compliance with the Bank Secrecy Act; or
(B) The underlying facts, transactions, and documents upon which a SAR is based, including disclosures to another financial institution, or any director, officer, employee, or agent of a financial institution, for the preparation of a joint SAR.
(2)
(g)
(h)
4. Section 103.17 is amended by revising paragraphs (e), (f), and (g) to read as follows:
(e)
(1)
(ii)
(A) The disclosure by an FCM or IB–C, or any director, officer, employee, or agent of an FCM or IB–C of:
(
(
(
(
(B) The sharing by an FCM or IB–C, or any director, officer, employee, or agent of the FCM or IB–C, of a SAR, or any information that would reveal the existence of a SAR, within the FCM's or IB–C's corporate organizational structure for purposes consistent with Title II of the Bank Secrecy Act as determined by regulation or in guidance.
(2)
(3)
(f)
(g)
5. Section 103.18 is amended by revising paragraphs (e) and (f), and adding paragraph (g), to read as follows:
(e)
(1)
(ii)
Provided that no person involved in any reported suspicious transaction is notified that the transaction has been reported, this paragraph (e)(1) shall not be construed as prohibiting:
(A) The disclosure by a bank, or any director, officer, employee, or agent of a bank of:
(
(
(
(
(B) The sharing by a bank, or any director, officer, employee, or agent of the bank, of a SAR, or any information that would reveal the existence of a SAR, within the bank's corporate organizational structure for purposes consistent with Title II of the Bank Secrecy Act as determined by regulation or in guidance.
(2)
(f)
(g)
6. Section 103.19 is amended by revising paragraphs (e), (f), and (g) to read as follows:
(e)
(1)
(ii)
(A) The disclosure by a broker-dealer, or any director, officer, employee, or agent of a broker-dealer of:
(
(
(
(
(B) The sharing by a broker-dealer, or any director, officer, employee, or agent of the broker-dealer, of a SAR, or any information that would reveal the existence of a SAR, within the broker-dealer's corporate organizational structure for purposes consistent with Title II of the Bank Secrecy Act as determined by regulation or in guidance.
(2)
(3)
(f)
(g)
7. Section 103.20 is amended by:
a. Revising paragraph (d);
b. Redesignating paragraphs (e) and (f) as paragraphs (f) and (g);
c. Adding new paragraph (e); and
d. Revising newly designated paragraph (f).
(d)
(1)
(ii)
(A) A SAR, or any information that would reveal the existence of a SAR, to FinCEN or any Federal, state, or local law enforcement agency, or any Federal or State regulatory authority that examines the money services business for compliance with the BSA; or
(B) The underlying facts, transactions, and documents upon which a SAR is based, including disclosures to another financial institution, or any director, officer, employee, or agent of a financial institution, for the preparation of a joint SAR.
(2)
(e)
(f)
8. Section 103.21 is amended by:
a. Revising paragraph (e);
b. Redesignating paragraphs (f) and (g) as paragraphs (g) and (h);
c. Adding new paragraph (f); and
d. Revising newly designated paragraph (g).
(e)
(1)
(ii)
(A) A SAR, or any information that would reveal the existence of a SAR, to FinCEN or any Federal, state, or local law enforcement agency, or any Federal or state regulatory authority that examines the casino for compliance with the BSA; or
(B) The underlying facts, transactions, and documents upon which a SAR is based, including disclosures to another financial institution, or any director, officer, employee, or agent of a financial institution, for the preparation of a joint SAR.
(2)
(f)
(g)