Questions And Answers Regarding The Customer Identification Program Rule For Futures Commission Merchants And Introducing Brokers (31 CFR 103.123)

Guidance From The Staffs Of The U.S. Commodity Futures Trading Commission, Financial Crimes Enforcement Network, and the Department of the Treasury Questions And Answers Regarding The Customer Identification Program Rule For Futures Commission Merchants And Introducing Brokers (31 CFR 103.123) The staff of the Commodity Futures Trading Commission (“CFTC”), Financial Crimes Enforcement Network (“FinCEN”), and the United States Department of the Treasury (“Treasury”) are issuing these questions and answers (“Q&As”) regarding the application of 31 C.F.R. § 103.123. This joint rule implements section 326 of the Uniting and Strengthening America by Providing Appropriate Tools Required to Intercept and Obstruct Terrorism Act of 2001 (“Patriot Act”)1 and requires futures commission merchants (“FCMs”) and introducing brokers (“IBs”) to have a Customer Identification Program (“CIP”).2

While the purpose of these Q&As is to provide interpretive guidance with respect to the CIP rule, the CFTC, FinCEN, and Treasury recognize that this document does not answer every question that may arise in connection with the rule. The CFTC, FinCEN, and Treasury encourage FCMs and IBs to use the basic principles set forth in the CIP rule, as articulated in these Q&As, to address variations on these questions that may arise, and expect FCMs and IBs to design their own programs in accordance with the nature of their business. The CFTC, FinCEN, and Treasury wish to emphasize that an FCM’s or IB’s CIP must include risk-based procedures for verifying the identity of each customer to the extent reasonable and practicable. It is critical that each FCM and IB develop procedures to account for all relevant risks including those presented by the types of accounts maintained by the FCM or IB, the various methods of opening accounts provided, the type of identifying information available, and the FCM’s or IB’s size, location, and type of business or customer base. Thus, specific minimum requirements in the rule, such as the four basic types of information to be obtained from each customer, should be supplemented by risk-based verification procedures, where appropriate, to ensure that the FCM or IB has a reasonable belief that it knows each customer’s identity. The CFTC, FinCEN, and Treasury note that the CIP, while important, is only one part of an FCM’s or IB’s anti-money laundering compliance program. Adequate implementation of a CIP, standing alone, will not be sufficient to meet an FCM’s or IB’s other obligations under the BSA, Rule 2-9(c) of the National Futures Association, CFTC Rule 42.2, or regulations promulgated by the Office of Foreign Assets Control (“OFAC”).3 Finally, these Q&As have been designed to help FCMs and IBs comply with the requirements of the CIP rule. They do not address the applicability of any other Federal or state laws.

1 Public Law 107-56.

2 Section 326 of the Patriot Act adds a new subsection (l) to 31 U.S.C. § 5318 of the Bank Secrecy Act (“BSA”). 3 Moreover, neither the CIP rule nor these Q&As should be interpreted as limiting an FCM’s or IB’s obligations to comply with the Commodity Exchange Act and CFTC regulations.

31 C.F.R. § 103.123(a)(5) -- Definition of “customer”

1. Is a person who becomes co-owner of an existing account a “customer” to whom the CIP rule applies? Yes, any person who becomes the co-owner of an existing account is a “customer” subject to the CIP rule because that person is establishing a new account relationship with the FCM or IB.
2. The CIP rule requires an FCM to verify the identity of each “customer.” Under the CIP rule, a “customer” generally is defined as “a person that opens a new account.” If a pension plan administrator chooses to remove a former employee from the plan pursuant to section 657(c) of the Economic Growth and Tax Relief Reconciliation Act of 2001 (“EGTRRA”), it is required by law to transfer these funds to a financial institution. In addition, an administrator of a terminated plan may remove former employees that it is unable to locate, by transferring their benefits to a financial institution. Would a plan administrator or the former employee be a “customer” where funds are transferred to an FCM and an account established in the name of the former employee, in either of these situations? In either situation, the administrator has no ownership interest in or other right to the funds, and therefore, is not the FCM’s “customer.” Nor would we view the administrator as acting as the customer’s agent when the administrator transfers the funds of former employees in these situations. A customer relationship arises and the requirements of the rule are implicated when the former employee “opens” an account. While the former employee has a legally enforceable right to the funds that are transferred to the FCM, the employee has not exercised that right until he or she contacts the FCM to assert an ownership interest. Thus, in light of the requirements imposed on the plan administrator under EGTRRA, as well as the requirements in connection with plan terminations, the former employee will not be deemed to have “opened a new account” for purposes of the CIP rule until he or she contacts the FCM to assert an ownership interest over the funds, at which time an FCM will be required to implement its CIP with respect to the former employee. This interpretation applies only to (1) transfers of funds as required under section 657(c) of EGTRRA, and (2) transfers to FCMs by administrators of terminated plans in the name of participants that they have been unable to locate, or who have been notified of termination but have not responded, and should not be construed to apply to any other transfer of funds that may constitute opening an account. 31 C.F.R. § 103.123(a)(5)(ii)(C) – Person with an existing account
3. The definition of “customer” excludes a person that has an existing account, provided the FCM or IB has a reasonable belief that it knows the true identity of the person. 2

a. Customer Of A Dual-Registrant If a firm is dually registered as both an FCM and a securities broker-dealer (“BD”), and a person has an existing securities account with the firm and subsequently elects to open a futures account to trade futures contracts, does the person have an existing account for the purpose of this exclusion? Yes. The rule does not artificially treat as two separate financial institutions firms that are dually registered as both an FCM (or IB) and BD. Therefore, a customer with a securities account at the dual-registrant who later opens a futures account (or vice versa) would be considered an existing customer of the dual-registrant. This event would fall within the existing customer exclusion, provided that the dual-registrant maintains a reasonable belief that it knows the true identity of the person. b. Customer That Opens A Different Type Of Account To Trade A Different Type Of Product If a person who has an existing futures account with an FCM subsequently elects to open a new type of account with the FCM to trade another product (e.g., foreign currency contracts in the interbank market or other over-the-counter products), does the person have an existing account with the FCM for the purpose of this exclusion? Yes. The applicability of the existing customer exclusion does not turn on the type of account that the person seeks to open or the type of product the person seeks to trade. As stated in the preamble (68 FR 25149, 25154 (May 9, 2003)), FCMs and IBs will not be required to verify the identities of “persons who open successive accounts of either the same type or multiple types to trade either the same or different products.” Thus, if a person with an existing account seeks to open another account to trade another product, the existing customer exclusion will apply regardless of the type of account or product, provided that the FCM (or IB) maintains a reasonable belief that it knows the true identity of the person. c. Customer Of An Affiliate (1) If the person has an existing account with a BD (or other “financial institution” as defined in section 103.123(a)(7) of the rule) that is an affiliate of an FCM and the person subsequently elects to open a futures account with the affiliated FCM, can the person be considered an existing customer of the FCM for the purposes of this exclusion? (2) If the answer to the preceding question is “no,” may the FCM rely on its affiliate to perform elements of the FCM’s CIP pursuant to section 103.123(b)(6) of the rule? (1) No. The existing customer exclusion does not apply to the customers of affiliated financial institutions. When a customer of an affiliated financial institution seeks to open a futures account with an affiliated FCM, the person will not be viewed as an existing customer of the FCM. (2) The FCM may, nonetheless, rely upon its affiliate to perform elements of the FCM’s CIP, provided that the requirements of section 103.123(b)(6) of the rule are met. 3

2. Does the exclusion from the definition of “customer” in 31 C.F.R. § 103.123(a)(5)(ii)(C) for a person with an existing account extend to a person who has had an account with the FCM or IB in the last twelve months but who no longer has an account? No, this provision only excludes from the definition of “customer” a person that at the time a new account is opened currently “has an existing account,” and only if the FCM or IB has a reasonable belief that it knows the true identity of the person.
3. How can an FCM or IB demonstrate that it has “a reasonable belief that it knows the true identity of a person with an existing account” with respect to persons that had accounts with the FCM or IB as of October 1, 2003? Among the ways an FCM or IB can demonstrate that it has “a reasonable belief” is by showing that prior to the issuance of the final CIP rule, it had comparable procedures in place to verify the identity of persons that had accounts with the FCM or IB as of October 1, 2003, though the FCM or IB may not have gathered the very same information about such persons as required by the final CIP rule. Alternative means include showing that the FCM or IB has had an active and longstanding relationship with a particular person, evidenced, for example, by such things as a history of account statements sent to the person. This alternative, however, may not suffice for persons that the FCM or IB has deemed to be high risk. 31 C.F.R. § 103.123(b)(2)(i) -- Information required
4. What address should be obtained for customers who live in rural areas who do not have a residential or business address or the residential or business address of next of kin or another contact individual? For example, is a rural route number acceptable? Yes, the number on the roadside mailbox on a rural route is acceptable as an address. A rural route number, unlike a post office box number, is a description of the approximate area where the customer can be located. In the absence of such a number, and in the absence of a residential or business address for next of kin or another contact individual, a description of the customer’s physical location will suffice.
5. Can an FCM or IB open an account for a U.S. person that does not have a taxpayer identification number? No, the FCM or IB cannot do so unless the customer has applied for a taxpayer identification number, the FCM or IB confirms that the application was filed before the customer opened the account, and the FCM or IB obtains the taxpayer identification number within a reasonable period of time after the account is opened. Note, however, that an FCM or IB does not need to obtain a taxpayer identification number when opening a new account for a customer that has an existing account, as long as the FCM or IB has a reasonable belief that it knows the true identity of the customer. An FCM or IB may also open an account for a person who lacks legal capacity with the identifying information, including taxpayer identification number, of an individual who opens an account for that person. 4

31 C.F.R. § 103.123(b)(2)(ii) -- Customer verification

1. Must an FCM or IB verify the accuracy of all the identifying information it collects in connection with 31 C.F.R. § 103.123(b)(2)(i)? The final rule provides that an FCM’s or IB’s CIP must contain procedures for verifying the identity of the customer, “using information obtained in accordance with paragraph (b)(2)(i),” namely the identifying information obtained by the FCM or IB. 31 C.F.R. § 103.123(b)(2)(ii). An FCM or IB need not establish the accuracy of each piece of identifying information obtained, but must do so for enough information to form a reasonable belief that it knows the true identity of the customer. See 68 Fed. Reg. 25149, 25154 (May 9, 2003).

2. Can an FCM or IB use an employee identification card as the sole means to verify a customer’s identity? An FCM or IB using documentary methods to verify a customer’s identity must have procedures that set forth the documents that the FCM or IB will use. The CIP rule gives examples of types of documents that have long been considered primary sources of identification and reflects the CFTC’s, FinCEN’s, and Treasury’s expectation that FCMs and IBs will obtain government￾issued identification from most customers. However, other forms of identification may be used if they enable the FCM or IB to form a reasonable belief that it knows the true identity of the customer. Nonetheless, given the availability of counterfeit and fraudulently obtained documents, an FCM or IB is encouraged to obtain more than a single document to ensure that it has a reasonable belief that it knows the customer’s true identity.

3. Can an FCM or IB use an electronic credential, such as a digital certificate, as a non￾documentary means to verify the identity of a customer that opens an account over the Internet or through some other purely electronic channel? An FCM or IB may obtain an electronic credential, such as a digital certificate, as one of the methods it uses to verify a customer’s identity. However, the CIP rule requires the FCM or IB to have a reasonable belief that it knows the true identity of the customer. Therefore, for example, the FCM or IB is responsible for ensuring that the third party that issues the certificate uses the same level of authentication as the FCM or IB itself would use.

4. How should an FCM or IB verify the identity of a partnership that opens a new account when there are no documents or non-documentary methods that will establish the identity of the partnership? An FCM or IB opening an account for such a partnership must undertake additional verification by obtaining information about the identity of any individual with authority or control over the partnership account, in order to verify the partnership’s identity, as described in 31 C.F.R. § 103.123(b)(2)(ii)(C). 5

5. How should an FCM or IB verify the identity of a sole proprietorship that opens a new account (such as an account titled in the name of an individual “doing business as” a sole proprietorship) when there are no documents or non-documentary methods that will establish the identity of the sole proprietorship? In some states, sole proprietorships are required to file “fictitious” or “assumed name certificates.” FCMs and IBs may choose to use these certificates as a means to verify the identity of a sole proprietorship, if appropriate. However, when there are no documents or non￾documentary methods that will establish the identity of the sole proprietorship, the FCM or IB must undertake additional verification by obtaining information about the sole proprietor or any other individual with authority or control over the sole proprietorship account -- such as the name, address, date of birth, and taxpayer identification number of the sole proprietor, or any other individual with authority or control over the account -- in order to verify the sole proprietorship’s identity, as described in 31 C.F.R. § 103.123(b)(2)(ii)(C). 31 C.F.R. § 103.123(b)(3)(i) – Required records

6. Would it be acceptable to retain a description of the non-documentary customer verification method used (such as a consumer credit report or an inquiry to a fraud detection system) in a general policy or procedure instead of recording the fact that a particular method was used on each individual customer’s record? Yes, provided that the record cross-references the specific provision(s) of the risk-based procedures contained in the FCM’s or IB’s CIP used to verify the customer’s identity.

7. Can an FCM or IB keep copies of documents provided to verify a customer’s identity, in addition to the description required under 31 C.F.R. § 103.123(b)(3)(i)(B), even if it is not required to do so? Yes, an FCM or IB may keep copies of identifying documents that it uses to verify a customer’s identity. An FCM’s or IB’s verification procedures should be risk-based and, in certain situations, keeping copies of identifying documents may be warranted. In addition, an FCM or IB may have procedures to keep copies of documents for other purposes, for example, to facilitate investigating potential fraud. (These documents should be retained in accordance with the general recordkeeping requirements in 31 C.F.R. § 103.38.) Nonetheless, an FCM or IB should be mindful that it must not improperly use any document containing a picture of an individual, such as a driver’s license, in connection with any aspect of a credit transaction. 31 C.F.R. § 103.123(b)(3)(ii) – Retention of records

8. Does the original information obtained during account opening have to be retained or can the FCM or IB satisfy the recordkeeping requirement by just keeping updated information about the customer, i.e., the customer’s current address? 6

The CIP rule requires that an FCM or IB retain the identifying information obtained about the customer at the time of account opening for five years after the date the account is closed. 31 C.F.R. § 103.123(b)(3)(ii). Updated information serves valuable, but different, purposes. 2. If the FCM or IB requires a customer to provide more identifying information than the minimum during the account opening process, does it have to keep this information for more than five years? The FCM or IB must keep for five years after the account is closed, all identifying information it gathers about the customer to satisfy the requirements of § 103.123(b)(2)(i) of the CIP rule. 31 C.F.R. § 103.123(b)(3)(ii). This would include any identifying information the FCM or IB will use, at the time the account is opened, to establish a reasonable belief that it knows the true identity of the customer. So, for example, if the FCM or IB obtains other identifying information at account opening in addition to the minimum information required, such as the customer’s phone number, then the FCM or IB must keep that information for five years after the account is closed. 3. How does the record retention period apply to a customer who simultaneously opens multiple accounts with the FCM or IB? If several accounts are opened for a customer simultaneously, all identifying information about a customer obtained under 31 C.F.R. § 103.123(b)(2)(i) must be retained for five years after the last account is closed. All remaining records must be kept for five years after the records are made. 4. Paragraph (b)(3)(ii) of the CIP rule requires every FCM and IB to retain: (a) customer identification information that is obtained pursuant to paragraph (b)(2)(i) for five years from the date an account is closed; and (b) customer verification information that is obtained pursuant to paragraph (b)(2)(ii) for five years from the date the record is made. CFTC Rule 1.31(a)(1) requires all books and records that are required to be kept by the Commodity Exchange Act and the regulations thereunder (collectively, “CEA”) to be kept for a period of five years from the date thereof. Where the same records are subject to different record retention periods under the CEA and the CIP rule, which retention period applies? CFTC Rule 42.2 requires every FCM and IB to comply with the applicable provisions of the BSA and the regulations promulgated by Treasury under the BSA, including any applicable record retention requirements under those regulations. In order to comply with Rule 42.2, FCMs and IBs must comply with the record retention requirements set forth in the CIP rule (and any other record retention requirements set forth in other BSA regulations). Thus, where the same records are required to be maintained under BSA regulations for a period of time that differs from that in CFTC rules, the records must be maintained for the longer period of time. 7

31 C.F.R. § 103.123(b)(4) -- Section 326 List

1. Has a list of known or suspected terrorists or terrorist organizations been designated for purposes of the CIP rule? No such list has been designated to date. FCMs and IBs will be contacted by their functional regulator or a self-regulatory organization when a list is issued. As of the time of publication, lists published by OFAC have not been designated as lists for purposes of the CIP rule. Of course, FCMs and IBs are separately obligated to check these lists in accordance with OFAC’s regulations. 31 C.F.R. § 103.123(b)(5) -- Customer notice
2. Does an FCM or IB have to provide notice to all owners of a joint account? Yes, notice must be provided to all owners of a joint account. In addition, notice must be provided “in a manner reasonably designed to ensure that a customer is able to view the notice, or is otherwise given notice, before opening an account.” 31 C.F.R. § 103.123(b)(5)(ii). The CFTC, FinCEN, and Treasury agree that an FCM or IB may satisfy this requirement by directly providing the notice to any one accountholder of a joint account for delivery to the other owners of the account. Similarly, the FCM or IB may open a joint account using information about each of the accountholders obtained from one accountholder, acting on behalf of the other joint accountholders. 31 C.F.R. § 103.123(b)(6) -- Reliance
3. Where an FCM or IB is entitled to “rely” on another financial institution to perform its CIP, whose CIP must the relied-upon financial institution implement? The reliance provision does not impose on the other financial institution the obligation to duplicate the procedures in the FCM’s or IB’s CIP. The reliance provision permits an FCM or IB to rely on another financial institution to perform any of the procedures of the FCM’s or IB’s CIP, meaning, any of the elements that the CIP rule requires to be in an FCM’s or IB’s CIP: (1) identity verification procedures, which include collecting the required information from customers and using some or all of that information to verify the customers’ identities; (2) keeping records related to the CIP; (3) determining whether a customer appears on a designated list of known or suspected terrorists or terrorist organizations; and (4) providing customers with adequate notice that information is being requested to verify their identities. Note that an FCM or IB can only use the reliance provision when the requirements set forth at 31 C.F.R. § 103.123(b)(6) are satisfied. 8