Joint Fact Sheet on Bank Secrecy Act Due Diligence Requirements for Charities and Non-profit Organizations

BOARD OF GOVERNORS
OF THE
FEDERAL RESERVE SYSTEM
WASHINGTON, D.C. 20551
DIVISION OF SUPERVISION
AND REGULATION
SR 20-26
November 19, 2020
TO THE OFFICER IN CHARGE OF SUPERVISION
AT EACH FEDERAL RESERVE BANK
SUBJECT: Joint Fact Sheet on Bank Secrecy Act Due Diligence Requirements for Charities and Non-profit Organizations Applicability: This guidance applies to all financial institutions supervised by the Federal Reserve that are subject to the Bank Secrecy Act. The Board of Governors of the Federal Reserve System, the Federal Deposit Insurance Corporation, the Financial Crimes Enforcement Network (FinCEN), the National Credit Union Administration, and the Office of the Comptroller of the Currency (collectively, the Agencies) are issuing this joint fact sheet to provide clarity to banks1 on how to apply a risk-based approach to charities and other nonprofit organizations (NPOs) consistent with the customer due diligence (CDD) requirements contained in FinCEN’s 2016 CDD Final Rule. 2,3 The U.S. government does not view the charitable sector as a whole as presenting a uniform or unacceptably high-risk of being used or exploited for money laundering, terrorist financing (ML/TF), or sanctions violations.4 Although some charities and other NPOs have been misused to facilitate ML/TF or sanctions evasion, the Agencies recognize that the vast majority of charities and other NPOs comply with the law and properly support only charitable and humanitarian causes. Like all bank accounts, those held by charity and NPO customers are subject to BSA/AML regulatory requirements, including CDD. Consistent with a risk-based approach, the level and type of CDD should be appropriate for the risks presented by each customer. There is 1 Under the Bank Secrecy Act, the term “bank” is defined in 31 CFR 1010.100(d) and includes each agent, agency, branch, or office within the United States of banks, savings associations, credit unions, and foreign banks. 2 Customer Due Diligence Requirements for Financial Institutions, 81 FR 29398 (May 2016); see also 31 CFR Parts 1010, 1020, 1023, 1024, and 1026. 3 See November 19th, 2020, Board press release at:
https://www.federalreserve.gov/newsevents/pressreleases/bcreg20201119b.htm. 4 See, National Terrorist Financing Risk Assessment, 2018, p. 23.

no regulatory requirement in the CDD rule, nor is there a supervisory expectation, for banks to have unique, additional due diligence steps for charities or other NPO customers. Banks that operate in compliance with applicable laws, properly manage customer relationships, and effectively mitigate risks by implementing controls commensurate with those risks are neither prohibited nor discouraged from providing banking services to charities and other NPOs. The Agencies are issuing this joint fact sheet to reaffirm that the level of ML/TF risk associated with charities and other NPOs varies; these bank customers do not present a uniform or unacceptably high ML/TF risk. Federal Reserve Banks are asked to distribute this letter to the supervised institutions in their districts and to appropriate supervisory staff. In addition, supervised organizations may send questions via the Board’s public website.5 Michael S. Gibson Director Attachment:

• Joint Fact Sheet on Bank Secrecy Act Due Diligence Requirements for Charities and Non￾Profit Organizations
  5 See, http://www.federalreserve.gov/apps/contactus/feedback.aspx.

Board of Governors of the Federal Reserve System Federal Deposit Insurance Corporation Financial Crimes Enforcement Network National Credit Union Administration Office of the Comptroller of the Currency Joint Fact Sheet on Bank Secrecy Act Due Diligence Requirements for Charities and Non-Profit Organizations November 19, 2020 The Board of Governors of the Federal Reserve System (Federal Reserve), the Federal Deposit Insurance Corporation (FDIC), the Financial Crimes Enforcement Network (FinCEN), the National Credit Union Administration (NCUA), and the Office of the Comptroller of the Currency (OCC) (collectively, the Agencies) are issuing this joint fact sheet to provide clarity to banks1 on how to apply a risk￾based approach to charities and other non-profit organizations (NPOs), consistent with the customer due diligence (CDD) requirements contained in FinCEN’s 2016 CDD Final Rule.2 Some charities have reported difficulty in obtaining and maintaining access to financial services, jeopardizing the important contributions charities make to the most vulnerable. The Agencies remind banks that the U.S. government does not view the charitable sector as a whole as presenting a uniform or unacceptably high risk of being used or exploited for money laundering, terrorist financing (ML/TF), or sanctions violations.3 The Agencies remind banks that charities vary in their risk profiles and should be treated according to such profiles. Banks should apply the risk-based approach and evaluate charities according to their particular characteristics to determine whether they can effectively mitigate the potential risk some charities may pose. This approach helps to minimize illicit finance risks. This joint fact sheet does not alter existing Bank Secrecy Act/Anti-Money Laundering (BSA/AML) legal or regulatory requirements, nor does it establish new supervisory expectations. Helping those in need is a core American value, particularly in the difficult conditions caused by the COVID-19 pandemic. The United States is committed to ensuring that humanitarian assistance continues to reach at-risk populations through legitimate and transparent channels, including during the COVID-19 pandemic.4 The Agencies recognize that it is vital for legitimate charities and other

1. Under the Bank Secrecy Act, the term “bank” is defined in 31 CFR 1010.100(d) and includes
   each agent, agency, branch, or office within the United States of banks, savings associations, credit unions, and foreign banks.
2. Customer Due Diligence Requirements for Financial Institutions, 81 FR 29398 (May 2016); see also
   31 CFR Parts 1010, 1020, 1023, 1024, and 1026.
3. National Terrorist Financing Risk Assessment (2018), p. 23.
4. See U.S. Department of the Treasury’s Office of Foreign Assets Control (OFAC) Fact Sheet:
   Provision of Humanitarian Assistance and Trade to Combat COVID-19 (April 16, 2020). See also OFAC Encourages Persons to Communicate OFAC Compliance Concerns Related to the Coronavirus Disease 2019 (COVID-19) (April 20, 2020) and U.S. Department of the Treasury’s Press Release: Treasury Underscores Commitment to Global Flow of Humanitarian Aid in Face of Covid-19 Pandemic (April 9, 2020).

NPOs to have access to financial services, including the ability to transmit funds. Charities and other NPOs rely on banks to facilitate the flow of funds transfers in a timely fashion. Although some charities and other NPOs have been misused to facilitate ML/TF5 or evade sanctions, the Agencies recognize that the vast majority of charities and other NPOs comply with the law and properly support charitable and humanitarian causes. CDD Requirements Like all bank accounts, those held by charity and NPO customers are subject to BSA/AML regulatory requirements. These include requirements related to suspicious activity reporting,6 customer identification,7 CDD, and beneficial ownership,8 as applicable. Banks must apply a risk-based approach to CDD in developing the risk profiles of their customers, including charities and NPOs, and are required to establish and maintain written procedures reasonably designed to identify and verify beneficial owners of legal entity customers, as applicable.9 More specifically, banks must adopt appropriate risk-based procedures for conducting CDD that, among other things, enable banks to: (i) understand the nature and purpose of customer relationships for the purpose of developing a customer risk profile, and (ii) conduct ongoing monitoring to identify and report suspicious transactions and, on a risk basis, to maintain and update customer information.10 Consistent with a risk-based approach, the level and type of CDD should be appropriate for the risks presented by each customer. There is no regulatory requirement in the CDD rule, nor is there a supervisory expectation, for banks to have unique, additional due diligence steps for charities or other NPO customers. Considerations for a Risk-Based Approach As previously stated, charities and other NPOs do not present a uniform or unacceptably high ML/TF risk; rather, the risk to banks depends on facts and circumstances specific to the customer relationship. The ML/TF risk for charitable organizations can vary dramatically depending on the operations, activities, leadership, and affiliations of the organization. U.S. charities that operate and provide funds solely to domestic recipients generally present low TF risk. However, U.S. charities that operate abroad, provide funding to, or have affiliated organizations in conflict regions, can present potentially higher TF risks.11
5. See FinCEN Advisory to Financial Institutions Regarding Disaster-Related Fraud
(October 31, 2017).
6. 12 CFR 208.62, 211.5(k), 211.24(f), and 225.4(f) (Federal Reserve); 12 CFR 353 (FDIC); 12 CFR
748.1(c) (NCUA); 12 CFR 21.11 and 12 CFR 163.180 (OCC); and 31 CFR 1020.320 (FinCEN).
7. 12 CFR 208.63(b)(2), 211.5(m)(2), and 211.24(j)(2) (Federal Reserve); 12 CFR 326.8(b)(2) (FDIC);
12 CFR 748.2(b)(2) (NCUA); 12 CFR 21.21(c)(2) (OCC); and 31 CFR 1020.220 (FinCEN).
8. 31 CFR 1010.230.
9. See 31 CFR 1010.230(e)(3)(ii) (requiring that nonprofit entities only identify a single individual
with significant responsibility to control, manage, or direct the entity).
10. 31 CFR 1020.210(b)(5).
11. National Terrorist Financing Risk Assessment (2018), p. 23.

Charities and other NPOs are subject to federal and state reporting requirements and regulatory oversight. For example, charities report specific information annually on IRS Form 990 regarding their stated mission, programs, finances (including non-cash contributions), donors, activities, and funds sent and used abroad.12 Many NPOs also adhere to voluntary self-regulatory standards13 and controls to improve individual governance, management, and operational practice, in addition to internal controls required by donors and others. Although the CDD rule does not require the collection of this specific information, the following customer information may be useful for banks in determining the ML/ TF risk profile of charities and other NPO customers:

• Purpose and nature of the NPO, including mission(s), stated objectives,
  programs, activities, and services.
• Geographic locations served, including headquarters and operational
  areas, particularly in higher-risk areas where terrorist groups are most active.
• Organizational structure, including key principals, management, and
  internal controls of the NPO.
• State incorporation, registration, and tax-exempt status by the IRS and
  required reports with regulatory authorities.
• Voluntary participation in self-regulatory programs to enhance
  governance, management, and operational practice.
• Financial statements, audits, and any self-assessment evaluations.
• General information about the donor base, funding sources, and
  fundraising methods, and for public charities, level of support from the general public.
• General information about beneficiaries and criteria for disbursement of
  funds, including guidelines/standards for qualifying beneficiaries and any intermediaries that may be involved.
• Affiliation with other NPOs, governments, or groups.
  Additional information that may be useful to banks in determining the customer risk profile of a charity or other NPO is available at the U.S. Department of the Treasury’s Resource Center, Protecting Charitable Organizations.14 Conclusion Charitable organizations and other NPOs build communities, relieve suffering, provide life-saving assistance, and help developing nations. During this COVID-19 pandemic, charities and other NPOs are on the front lines, both

12. The extensive Schedule F of Form 990 includes many categories of reporting requirements for
    charities with overseas activities.
13. National Terrorist Financing Risk Assessment (2018), p. 24.
14. https://www.treasury.gov/resource-center/terrorist-illicit-finance/Pages/protecting-index.aspx.

domestically and internationally, delivering medical supplies and vital assistance to areas most impacted by COVID-19. Banks that operate in compliance with applicable laws, properly manage customer relationships, and effectively mitigate risks by implementing controls commensurate with those risks are neither prohibited nor discouraged from providing banking services to charities and other NPOs. The Agencies are issuing this joint fact sheet to reaffirm that the level of ML/TF risk associated with charities and other NPOs varies; these bank customers do not present a uniform or unacceptably high ML/TF risk. The application of a risk-based approach for charities and other NPOs is consistent with existing CDD and other BSA/AML requirements.

---

Joint Fact Sheet on Bank Secrecy Act Due Diligence Requirements for Charities and Non-Profit Organizations

Board of Governors of the Federal Reserve System Federal Deposit Insurance Corporation Financial Crimes Enforcement Network National Credit Union Administration Office of the Comptroller of the Currency Joint Fact Sheet on Bank Secrecy Act Due Diligence Requirements for Charities and Non-Profit Organizations November 19, 2020 The Board of Governors of the Federal Reserve System (Federal Reserve), the Federal Deposit Insurance Corporation (FDIC), the Financial Crimes Enforcement Network (FinCEN), the National Credit Union Administration (NCUA), and the Office of the Comptroller of the Currency (OCC) (collectively, the Agencies) are issuing this joint fact sheet to provide clarity to banks1 on how to apply a risk￾based approach to charities and other non-profit organizations (NPOs), consistent with the customer due diligence (CDD) requirements contained in FinCEN’s 2016 CDD Final Rule.2 Some charities have reported difficulty in obtaining and maintaining access to financial services, jeopardizing the important contributions charities make to the most vulnerable. The Agencies remind banks that the U.S. government does not view the charitable sector as a whole as presenting a uniform or unacceptably high risk of being used or exploited for money laundering, terrorist financing (ML/TF), or sanctions violations.3 The Agencies remind banks that charities vary in their risk profiles and should be treated according to such profiles. Banks should apply the risk-based approach and evaluate charities according to their particular characteristics to determine whether they can effectively mitigate the potential risk some charities may pose. This approach helps to minimize illicit finance risks. This joint fact sheet does not alter existing Bank Secrecy Act/Anti-Money Laundering (BSA/AML) legal or regulatory requirements, nor does it establish new supervisory expectations. Helping those in need is a core American value, particularly in the difficult conditions caused by the COVID-19 pandemic. The United States is committed to ensuring that humanitarian assistance continues to reach at-risk populations through legitimate and transparent channels, including during the COVID-19 pandemic.4 The Agencies recognize that it is vital for legitimate charities and other

1. Under the Bank Secrecy Act, the term “bank” is defined in 31 CFR 1010.100(d) and includes
   each agent, agency, branch, or office within the United States of banks, savings associations, credit unions, and foreign banks.
2. Customer Due Diligence Requirements for Financial Institutions, 81 FR 29398 (May 2016); see also
   31 CFR Parts 1010, 1020, 1023, 1024, and 1026.
3. National Terrorist Financing Risk Assessment (2018), p. 23.
4. See U.S. Department of the Treasury’s Office of Foreign Assets Control (OFAC) Fact Sheet:
   Provision of Humanitarian Assistance and Trade to Combat COVID-19 (April 16, 2020). See also OFAC Encourages Persons to Communicate OFAC Compliance Concerns Related to the Coronavirus Disease 2019 (COVID-19) (April 20, 2020) and U.S. Department of the Treasury’s Press Release: Treasury Underscores Commitment to Global Flow of Humanitarian Aid in Face of Covid-19 Pandemic (April 9, 2020).

NPOs to have access to financial services, including the ability to transmit funds. Charities and other NPOs rely on banks to facilitate the flow of funds transfers in a timely fashion. Although some charities and other NPOs have been misused to facilitate ML/TF5 or evade sanctions, the Agencies recognize that the vast majority of charities and other NPOs comply with the law and properly support charitable and humanitarian causes. CDD Requirements Like all bank accounts, those held by charity and NPO customers are subject to BSA/AML regulatory requirements. These include requirements related to suspicious activity reporting,6 customer identification,7 CDD, and beneficial ownership,8 as applicable. Banks must apply a risk-based approach to CDD in developing the risk profiles of their customers, including charities and NPOs, and are required to establish and maintain written procedures reasonably designed to identify and verify beneficial owners of legal entity customers, as applicable.9 More specifically, banks must adopt appropriate risk-based procedures for conducting CDD that, among other things, enable banks to: (i) understand the nature and purpose of customer relationships for the purpose of developing a customer risk profile, and (ii) conduct ongoing monitoring to identify and report suspicious transactions and, on a risk basis, to maintain and update customer information.10 Consistent with a risk-based approach, the level and type of CDD should be appropriate for the risks presented by each customer. There is no regulatory requirement in the CDD rule, nor is there a supervisory expectation, for banks to have unique, additional due diligence steps for charities or other NPO customers. Considerations for a Risk-Based Approach As previously stated, charities and other NPOs do not present a uniform or unacceptably high ML/TF risk; rather, the risk to banks depends on facts and circumstances specific to the customer relationship. The ML/TF risk for charitable organizations can vary dramatically depending on the operations, activities, leadership, and affiliations of the organization. U.S. charities that operate and provide funds solely to domestic recipients generally present low TF risk. However, U.S. charities that operate abroad, provide funding to, or have affiliated organizations in conflict regions, can present potentially higher TF risks.11
5. See FinCEN Advisory to Financial Institutions Regarding Disaster-Related Fraud
(October 31, 2017).
6. 12 CFR 208.62, 211.5(k), 211.24(f), and 225.4(f) (Federal Reserve); 12 CFR 353 (FDIC); 12 CFR
748.1(c) (NCUA); 12 CFR 21.11 and 12 CFR 163.180 (OCC); and 31 CFR 1020.320 (FinCEN).
7. 12 CFR 208.63(b)(2), 211.5(m)(2), and 211.24(j)(2) (Federal Reserve); 12 CFR 326.8(b)(2) (FDIC);
12 CFR 748.2(b)(2) (NCUA); 12 CFR 21.21(c)(2) (OCC); and 31 CFR 1020.220 (FinCEN).
8. 31 CFR 1010.230.
9. See 31 CFR 1010.230(e)(3)(ii) (requiring that nonprofit entities only identify a single individual
with significant responsibility to control, manage, or direct the entity).
10. 31 CFR 1020.210(b)(5).
11. National Terrorist Financing Risk Assessment (2018), p. 23.

Charities and other NPOs are subject to federal and state reporting requirements and regulatory oversight. For example, charities report specific information annually on IRS Form 990 regarding their stated mission, programs, finances (including non-cash contributions), donors, activities, and funds sent and used abroad.12 Many NPOs also adhere to voluntary self-regulatory standards13 and controls to improve individual governance, management, and operational practice, in addition to internal controls required by donors and others. Although the CDD rule does not require the collection of this specific information, the following customer information may be useful for banks in determining the ML/ TF risk profile of charities and other NPO customers:

• Purpose and nature of the NPO, including mission(s), stated objectives,
  programs, activities, and services.
• Geographic locations served, including headquarters and operational
  areas, particularly in higher-risk areas where terrorist groups are most active.
• Organizational structure, including key principals, management, and
  internal controls of the NPO.
• State incorporation, registration, and tax-exempt status by the IRS and
  required reports with regulatory authorities.
• Voluntary participation in self-regulatory programs to enhance
  governance, management, and operational practice.
• Financial statements, audits, and any self-assessment evaluations.
• General information about the donor base, funding sources, and
  fundraising methods, and for public charities, level of support from the general public.
• General information about beneficiaries and criteria for disbursement of
  funds, including guidelines/standards for qualifying beneficiaries and any intermediaries that may be involved.
• Affiliation with other NPOs, governments, or groups.
  Additional information that may be useful to banks in determining the customer risk profile of a charity or other NPO is available at the U.S. Department of the Treasury’s Resource Center, Protecting Charitable Organizations.14 Conclusion Charitable organizations and other NPOs build communities, relieve suffering, provide life-saving assistance, and help developing nations. During this COVID-19 pandemic, charities and other NPOs are on the front lines, both

12. The extensive Schedule F of Form 990 includes many categories of reporting requirements for
    charities with overseas activities.
13. National Terrorist Financing Risk Assessment (2018), p. 24.
14. https://www.treasury.gov/resource-center/terrorist-illicit-finance/Pages/protecting-index.aspx.

domestically and internationally, delivering medical supplies and vital assistance to areas most impacted by COVID-19. Banks that operate in compliance with applicable laws, properly manage customer relationships, and effectively mitigate risks by implementing controls commensurate with those risks are neither prohibited nor discouraged from providing banking services to charities and other NPOs. The Agencies are issuing this joint fact sheet to reaffirm that the level of ML/TF risk associated with charities and other NPOs varies; these bank customers do not present a uniform or unacceptably high ML/TF risk. The application of a risk-based approach for charities and other NPOs is consistent with existing CDD and other BSA/AML requirements.