Customer Due Diligence Requirements for Financial Institutions

1 31 U.S.C. 5318(h)(2).
2 31 U.S.C. 5318(a)(2).
3The term ‘‘covered financial institution’’ refers to: (i) Banks; (ii) brokers or dealers in securities; (iii) mutual funds; and (iv) futures commission merchants and introducing brokers in commodities. 4 31 CFR 1020.220, 1023.220, 1024.220, 1026.220. DEPARTMENT OF THE TREASURY Financial Crimes Enforcement Network 31 CFR Parts 1010, 1020, 1023, 1024, and 1026 RIN 1506–AB25 Customer Due Diligence Requirements for Financial Institutions AGENCY: Financial Crimes Enforcement Network (FinCEN), Treasury. ACTION: Final rules. SUMMARY: FinCEN is issuing final rules under the Bank Secrecy Act to clarify and strengthen customer due diligence requirements for: Banks; brokers or dealers in securities; mutual funds; and futures commission merchants and introducing brokers in commodities. The rules contain explicit customer due diligence requirements and include a new requirement to identify and verify the identity of beneficial owners of legal entity customers, subject to certain exclusions and exemptions. DATES: The final rules are effective July 11, 2016. Applicability Date: Covered financial institutions must comply with these rules by May 11, 2018. FOR FURTHER INFORMATION CONTACT:
FinCEN Resource Center at 1–800–767–
2825. Email inquiries can be sent to frc@
fincen.gov.
SUPPLEMENTARY INFORMATION:
I. Executive Summary
A. Purpose of This Regulatory Action Covered financial institutions are not presently required to know the identity of the individuals who own or control their legal entity customers (also known as beneficial owners). This enables criminals, kleptocrats, and others looking to hide ill-gotten proceeds to access the financial system anonymously. The beneficial ownership requirement will address this weakness and provide information that will assist law enforcement in financial investigations, help prevent evasion of targeted financial sanctions, improve the ability of financial institutions to assess risk, facilitate tax compliance, and advance U.S. compliance with international standards and commitments. FinCEN believes that there are four core elements of customer due diligence (CDD), and that they should be explicit requirements in the anti-money laundering (AML) program for all covered financial institutions, in order to ensure clarity and consistency across sectors: (1) Customer identification and verification, (2) beneficial ownership identification and verification, (3) understanding the nature and purpose of customer relationships to develop a customer risk profile, and (4) ongoing monitoring for reporting suspicious transactions and, on a risk-basis, maintaining and updating customer information. The first is already an AML program requirement and the second will be required by this final rule. The third and fourth elements are already implicitly required for covered financial institutions to comply with their suspicious activity reporting requirements. The AML program rules for all covered financial institutions are being amended by the final rule in order to include the third and fourth elements as explicit requirements. FinCEN has the legal authority for this action in the Bank Secrecy Act (BSA), which authorizes FinCEN to impose AML program requirements on all financial institutions 1 and to require financial institutions to maintain procedures to ensure compliance with the BSA and its implementing regulations or to guard against money laundering.2 B. Summary of the Major Provisions of the Rulemaking

1. Beneficial Ownership
   Beginning on the Applicability Date, covered financial institutions 3 must identify and verify the identity of the beneficial owners of all legal entity customers (other than those that are excluded) at the time a new account is opened (other than accounts that are exempted). The financial institution may comply either by obtaining the required information on a standard certification form (Certification Form (Appendix A)) or by any other means that comply with the substantive requirements of this obligation. The financial institution may rely on the beneficial ownership information supplied by the customer, provided that it has no knowledge of facts that would reasonably call into question the reliability of the information. The identification and verification procedures for beneficial owners are very similar to those for individual customers under a financial institution’s customer identification program (CIP),4 except that for beneficial owners, the institution may rely on copies of identity documents. Financial institutions are required to maintain records of the beneficial ownership information they obtain, and may rely on another financial institution for the performance of these requirements, in each case to the same extent as under their CIP rule. The terms used for the purposes of this final rule, including account, beneficial ownership, legal entity customer, excluded legal entities, new account, and covered financial institution, are set forth in the final rule. Financial institutions should use beneficial ownership information as they use other information they gather regarding customers (e.g., through compliance with CIP requirements), including for compliance with the Office of Foreign Assets Control (OFAC) regulations, and the currency transaction reporting (CTR) aggregation requirements.
2. Anti-Money Laundering Program
   Rule Amendments
   The AML program requirement for each category of covered financial institutions is being amended to explicitly include risk-based procedures for conducting ongoing customer due diligence, to include understanding the nature and purpose of customer relationships for the purpose of developing a customer risk profile. A customer risk profile refers to the information gathered about a customer at account opening used to develop a baseline against which customer activity is assessed for suspicious activity reporting. This may include self-evident information such as the type of customer or type of account, service, or product. The profile may, but need not, include a system of risk ratings or categories of customers. In addition, customer due diligence also includes conducting ongoing monitoring to identify and report suspicious transactions and, on a risk basis, to maintain and update customer information. For these purposes, customer information shall include information regarding the beneficial owners of legal entity customers (as defined in § 1010.230). The first clause of paragraph (ii) sets forth the requirement that financial institutions conduct monitoring to identify and report suspicious transactions. Because this includes transactions that are not of the sort the customer would be normally expected to engage, the customer risk profile information is used (among other sources) to identify such transactions. This information may be integrated into the financial institution’s automated monitoring system, and may be used