Special Information Sharing Procedures To Deter Money Laundering and Terrorist Activity

Monday,
March 4, 2002
Part III
Department of the
Treasury
31 CFR Part 103
Financial Crimes Enforcement Network; Special Information Sharing Procedures To Deter Money Laundering and Terrorist Activity; Final Rule and Proposed Rule

1See 31 U.S.C. 5312(a)(2).
2Treasury and FinCEN are proposing to apply
section 314(a) to all BSA financial institutions. See
the proposed rule implementing section 314(a) published elsewhere in this issue of the Federal Register. 3See Act sections 314(b) and (c), which provide protections from federal and State prohibitions on the disclosure of information to financial institutions that engage in information sharing consistent with the requirements of section 314(b) and its implementing regulations. DEPARTMENT OF THE TREASURY 31 CFR Part 103 RIN 1506–AA26 Financial Crimes Enforcement Network; Special Information Sharing Procedures to Deter Money Laundering and Terrorist Activity AGENCY: Financial Crimes Enforcement Network (FinCEN), Treasury. ACTION: Interim rule. SUMMARY: FinCEN, a bureau of the Treasury Department, is issuing regulations to implement the provision in the Uniting and Strengthening America by Providing Appropriate Tools Required to Intercept and Obstruct Terrorism (USA PATRIOT) Act of 2001 that encourages information sharing among financial institutions for purposes of identifying and reporting activities that may involve terrorist acts or money laundering activities. DATES: This rule is effective March 4, 2002. FOR FURTHER INFORMATION CONTACT:
Judith R. Starr, Chief Counsel (FinCEN), (703) 905–3590; William Langford, Senior Counsel for Financial Crimes, Office of the Assistant General Counsel (Enforcement), (202) 622–1932; or Gary W. Sutton, Senior Banking Counsel, Office of the Assistant General Counsel (Banking & Finance), (202) 622–1976 (not toll-free numbers). Financial institutions with questions about their coverage or compliance obligations under this rule should contact their appropriate federal regulator. SUPPLEMENTARY INFORMATION:
I. Background
On October 26, 2001, the President signed into law the USA PATRIOT Act of 2001 (Public Law 107–56) (the Act). Of the Act’s many goals, the facilitation of information sharing among governmental entities and financial institutions for the purpose of combating terrorism and money laundering is of paramount importance.
Section 314 of the Act furthers this goal
by providing for the sharing of information between the government and financial institutions, and among financial institutions themselves. As with many other provisions of the Act, Congress has charged Treasury with developing regulations to implement these information-sharing provisions.
Section 314(b) of the Act permits
financial institutions, upon providing notice to Treasury, to share information with one another in order to better identify and report to the federal government concerning activities that may involve money laundering or terrorist activities. This interim rule implements section 314(b). The Congress authorized financial institutions to share information to assist in the identification of suspected terrorists and money launderers only after providing notice to Treasury. The notice provision outlined below—a yearly certification to FinCEN that information will be shared and protected from inappropriate disclosure—combined with the requirement that any money laundering or terrorist activities uncovered be reported to FinCEN or other law enforcement, will allow for the sharing of information while protecting the privacy interests of customers of financial institutions. Published elsewhere in this issue of the Federal Register is a notice of proposed rulemaking that solicits comments on proposed provisions that are identical to this interim rule, as well as proposed regulations to implement the provisions of section 314(a) the Act, which concerns enhanced cooperation between financial institutions and federal law enforcement agencies to detect terrorist and money laundering activities. Please refer to the notice of proposed rulemaking for instructions for submitting comments on the proposed provisions that are identical to this interim rule.
II. Analysis of the Interim Rule
A. General Definitions
Section 103.90—Definitions
As noted above, section 314(b) of the Act permits financial institutions, upon providing notice to Treasury, to share information with one another in order to identify and report to the federal government activities that may involve money laundering or terrorist activity. Although section 314 does not define ‘‘money laundering’’ or ‘‘terrorist activity,’’ each of these terms has well￾established definitions. Accordingly, and consistent with the broad intent underlying section 314(b), section 103.90(a) defines ‘‘money laundering’’ to mean any activity described in
section 1956 or 1957 of title 18, United
States Code. Similarly, section 103.90(b) defines ‘‘terrorist activity’’ to mean an act of domestic terrorism or international terrorism as defined in
section 2331 of title 18, United States
Code.
B. Information Sharing Among Financial Institutions
Section 103.110—Voluntary Information
Sharing Among Financial Institutions The Act does not define the term ‘‘financial institution’’ for purposes of the information sharing provisions of 314(b). Under the Bank Secrecy Act (BSA), which is concerned with information reporting to detect and prevent financial crimes, the term ‘‘financial institution’’ is defined broadly.1 Unlike section 314(a), which involves financial institutions responding to requests for information from federal law enforcement agencies,2
section 314(b) involves the sharing of
information among financial institutions and raises issues concerning information privacy.3 For these reasons, Treasury and FinCEN believe that it is appropriate to define the term ‘‘financial institution’’ for purposes of section 314(b) in a manner that is most likely to further the identification of terrorist and money laundering activities while minimizing the likelihood that information sharing will inappropriately intrude on the privacy interests of the customers of those institutions. Accordingly, section 103.110(a)(2) defines ‘‘financial institution’’ for purposes of section 314(b) to mean (1) a financial institution that is subject to SAR reporting that is not a money services business, which includes banks, savings associations, and credit unions; (2) a broker or dealer registered with the Securities and Exchange Commission under the Securities Exchange Act of 1934 (15 U.S.C. 78a et seq.); (3) an issuer of traveler’s checks or money orders, (4) a registered money transmitter, or (5) an operator of a credit card system that is not a money services business. Treasury and FinCEN specifically request comment, in connection with the proposed rule published elsewhere in this issue of the Federal Register, concerning whether these entities should be included within the definition for purposes of section 314(b) of the Act and regulation section 103.110, and whether the definition should be expanded to include other categories of BSA financial institutions.

Section 103.110(b) provides that upon
providing the appropriate certification to Treasury, as described below, a financial institution may share information with other financial institutions regarding individuals, entities, organizations, and countries for purposes of detecting, identifying, or reporting activities that the financial institution or association suspects may involve money laundering or terrorist activity. Because associations of such financial institutions can enhance the sharing of information among its members, this section also permits these associations to participate in the information sharing process. Prior to engaging in information sharing, a financial institution or association of financial institutions must submit to FinCEN a certification described in new Appendix B to 31 CFR
part 103, that confirms: the name of the
financial institution or association of financial institutions; that the financial institution is a financial institution as defined in section 103.110(a), or in the case of an association, that the association’s members that intend to engage in information sharing are financial institutions as defined in
section 103.110(a); that the institution
or association will maintain adequate procedures to protect the security and confidentiality of such information; that the institution or association will not use any shared information for any purpose other than as authorized in
section 103.110; and the identity of a
contact person at the financial institution or association for matters pertaining to information sharing. To streamline the certification process, FinCEN has established a special page on its existing Internet website, http://www.fincen.gov, where financial institutions can enter the appropriate information. If a financial institution or association does not have access to the Internet, the certification may be mailed to FinCEN at the address specified in the rule. By requiring notice to Treasury before information is shared among financial institutions, Congress has injected Treasury into what would otherwise be a purely private communication. The statute did not indicate clearly whether prior notice to Treasury was required before each individual communication or whether a general notice would be sufficient. After considering both the need for flexibility for financial institutions as well as the need to ensure that the right to share information under this section is not being used improperly, Treasury and FinCEN determined that the certification should be effective for a one-year period beginning on the date of the certification. A re-certification, provided to FinCEN in the same manner, is required if a financial institution or association intends to continue to share information. An annual certification will help Treasury determine which financial institutions are sharing information, and it will reinforce the need for financial institutions to protect information shared under this section. Treasury and FinCEN balanced the minimal burden associated with completing the brief electronic or paper certification against its role in protecting the privacy interests of customers of financial institutions.
Section 103.110(c) requires each
financial institution or association of financial institutions that engages in the sharing of information to maintain adequate procedures to protect the security and confidentiality of such information. This section also provides that information received by a financial institution or association of financial institutions pursuant to this section shall only be used for identifying and reporting on activities that may involve terrorist or money laundering activities, or determining whether to close or maintain an account, or to engage in a transaction. A financial institution that fails to comply with these restrictions on the use of shared information may have its certification revoked or suspended. See 103.110(g).
Section 103.110(d) provides that a
financial institution or association of financial institutions that engages in the sharing of information and that complies with sections 103.110(b) and (c) shall not be liable to any person under any law or regulation of the United States, under any constitution, law, or regulation of any State or political subdivision thereof, or under any contract or other legally enforceable agreement (including any arbitration agreement), for such sharing, or for any failure to provide notice of such sharing, to an individual, entity, or organization that is the subject of such sharing.
Section 103.110(e) provides a means
for financial institutions to voluntarily report information to law enforcement concerning suspicious transactions that may relate to money laundering or terrorist activity that may come to the financial institution’s attention as a result of discussions with other financial institutions, or otherwise. In order to accord the highest priority to suspected terrorist activity, a financial institution should report such information to FinCEN by calling the Financial Institutions Hotline (1–866– 556–3974). The purpose of the Financial Institutions Hotline is to facilitate the immediate transmittal of this information to law enforcement. Financial institutions identifying other suspicious transactions should report such transactions by promptly filing a SAR in accordance with applicable regulations, even if they provide information over the Financial Institutions Hotline. The Financial Institutions Hotline is intended to provide to law enforcement and other authorized recipients of SAR information the essence of the suspicious activity in an expedited fashion. Use of the Financial Institutions Hotline is voluntary and does not affect an institution’s responsibility to file a SAR in accordance with applicable regulations.
Section 103.110(f) clarifies that
voluntary reporting under section
103.110 does not relieve a financial
institution from any obligation it may have to file a Suspicious Activity Report pursuant to a regulatory requirement, or to otherwise directly contact a federal agency concerning individuals, entities, or organizations suspected of engaging in money laundering or terrorist activities.
Section 103.110(g) provides that a
federal regulator of a financial institution, or FinCEN in the case of a financial institution that does not have a federal regulator, may revoke or suspend a certification provided by a financial institution under this section if the regulator or FinCEN determines that the financial institution has failed to comply with the requirements of paragraph (c) of this section. Treasury and FinCEN believe this provision is necessary to preclude further participation in information sharing under the authority of section 103.110 by a financial information that fails to accord confidentiality to shared information, or uses that information for purposes other than as permitted by
section 103.110(c). A financial
institution with respect to which a certification has been revoked or suspended may not engage in information sharing under this section during the period of such revocation or suspension.
III. Administrative Procedure Act
In Executive Order 13224 (September 23, 2001), the President found that the continuing and immediate threat of further attacks on the United States constitutes an unusual and extraordinary threat to the national security, foreign policy, and economy of the United States. The interim rule implements statutory provisions intended to prevent terrorist activity by

uncovering and disrupting the financing of terrorist acts. In light of the exigent circumstances described in Executive Order 13224, Treasury has determined, pursuant to 5 U.S.C. 553(b), that it would be contrary to the public interest to delay the publication of this rule in final form during the pendency of an opportunity for public comment. For the same reason, pursuant to 5 U.S.C. 553(d), it has been determined that there is good cause for the interim rule to become effective immediately upon publication.
IV. Regulatory Flexibility Act
The provisions of the Regulatory Flexibility Act, 5 U.S.C. 601 et seq., do not apply to this interim rule because a notice of proposed rulemaking is not required under 5 U.S.C. 553 or any other law.
V. Paperwork Reduction Act
The requirement in section 103.110(b)(2), concerning notification to FinCEN that a financial institution that intends to engage in information sharing, and the accompanying certification in Appendix B to 31 CFR
part 103, do not constitute a collection
of information for purposes of the Paperwork Reduction Act. See 5 CFR 1320.3(h)(1). The collection of information contained in section 103.110(e), concerning reports to the federal government as a result of information sharing among financial institutions, will necessarily involve the reporting of a subset of information currently contained in a Suspicious Activity Report (SAR). SAR reporting has been previously reviewed and approved by the Office of Management and Budget (OMB) pursuant to the Paperwork Reduction Act and assigned OMB Control No. 1506–0001. An agency may not conduct or sponsor, and a person is not required to respond to, a collection of information unless it displays a currently valid OMB control number.
VI. Executive Order 12866
This interim rule is not a ‘‘significant regulatory action’’ for purposes of Executive Order 12866. Accordingly, a regulatory assessment is not required. List of Subjects in 31 CFR Part 103 Authority delegations (Government agencies), Banks and banking, Currency, Investigations, Law enforcement, Reporting and recordkeeping requirements. Dated: February 26, 2002. James F. Sloan, Director, Financial Crimes Enforcement Network. Authority and Issuance For the reasons set forth in the preamble, 31 CFR part 103 is amended as follows:
PART 103—FINANCIAL
RECORDKEEPING AND REPORTING OF CURRENCY AND FOREIGN TRANSACTIONS

1. The authority citation for part 103
   is revised to read as follows:
   Authority: 12 U.S.C. 1829b and 1951–1959; 31 U.S.C. 5311–5331; title III, sec. 314, Pub.
   L. 107–56, 115 Stat. 307.
2. Add new subpart H to part 103 to
   read as follows:
   Subpart H—Special Information Sharing Procedures To Deter Money Laundering and Terrorist Activity Sec.
   103.90 Definitions.
   103.100 Information sharing with federal
   law enforcement agencies. [Reserved]
   103.110 Voluntary information sharing
   among financial institutions.
   Subpart H—Special Information Sharing Procedures To Deter Money Laundering and Terrorist Activity § 103.90 Definitions. For purposes of this subpart, the following definitions apply:
   (a) Money laundering means an activity described in 18 U.S.C. 1956 or 1957. (b) Terrorist activity means an act of domestic terrorism or international terrorism as those terms are defined in 18 U.S.C. 2331. § 103.100 Information sharing with federal law enforcement agencies. [Reserved] § 103.110 Voluntary information sharing among financial institutions. (a) Definitions. For purposes of this
   section:
   (1) The definitions in § 103.90 apply; (2) The term financial institution means any financial institution described in 31 U.S.C. 5312(a)(2) that:
   (i) Is subject to a suspicious activity reporting requirement of subpart B of this part and is not a money services business, as defined in § 103.11(uu); (ii) Is a broker or dealer in securities, as defined in § 103.11(f); (iii) Is an issuer of traveler’s checks or money orders, as defined in § 103.11(uu)(3); (iv) Is a money transmitter, as defined in § 103.11(uu)(5), and is required to register as such pursuant to § 103.41; or (v) Is an operator of a credit card system and is not a money services business, as defined in § 103.11(uu); and (3) The term association of financial institutions means a group or organization the membership of which is comprised entirely of financial institutions as defined in paragraph (a)(2) of this section. (b) Information sharing among financial institutions—(1) In general. Subject to paragraphs (b)(2) and (g) of this section, a financial institution or an association of financial institutions may engage in the sharing of information with any other financial institution (as defined in paragraph (a)(2) of this
   section) or association of financial
   institutions (as defined in paragraph (a) (3) of this section) regarding individuals, entities, organizations, and countries for purposes of detecting, identifying, or reporting activities that the financial institution or association suspects may involve possible money laundering or terrorist activities. (2) Notice requirement—(i) Certification. A financial institution or association of financial institutions that intends to engage in the sharing of information as described in paragraph (b)(1) of this section shall submit to FinCEN a certification described in
   Appendix B of this part.
   (ii) Address. Completed certifications may be submitted to FinCEN:
   (A) By accessing FinCEN’s Internet website, http://www.fincen.gov, and entering the appropriate information as directed; or (B) If a financial institution does not have Internet access, by mail to:
   FinCEN, PO Box 39, Mail Stop 100, Vienna, VA 22183. (iii) One year duration of certification. Each certification provided pursuant to paragraph (b)(2)(i) of this section shall be effective for the one year period beginning on the date of the certification. In order to continue to engage in the sharing of information after the end of the one year period, a financial institution or association of financial institutions must submit a new certification. (c) Security and confidentiality of information—(1) Procedures required. Each financial institution or association of financial institutions that engages in the sharing of information pursuant to this section shall maintain adequate procedures to protect the security and confidentiality of such information. (2) Use of information. Information received by a financial institution or association of financial institutions pursuant to this section shall not be used for any purpose other than:

(i) Detecting, identifying and reporting on activities that may involve terrorist or money laundering activities; or (ii) Determining whether to establish or maintain an account, or to engage in a transaction. (d) Safe harbor from certain liability— (1) In general. A financial institution or association of financial institutions that engages in the sharing of information pursuant to this section shall not be liable to any person under any law or regulation of the United States, under any constitution, law, or regulation of any State or political subdivision thereof, or under any contract or other legally enforceable agreement (including any arbitration agreement), for such sharing, or for any failure to provide notice of such sharing, to an individual, entity, or organization that is identified in of such sharing. (2) Limitation. Paragraph (d)(1) of this
section shall not apply to a financial
institution or association of financial institutions to the extent such institution or association fails to comply with paragraph (b) or (c) of this section. (e) Information sharing between financial institutions and the federal government—(1) Terrorist activity. If, as a result of information sharing pursuant to this section, a financial institution suspects that an individual, entity, or organization is involved in, or may be involved in terrorist activity, such information should be reported to FinCEN:
(i) By calling the toll-free Financial Institutions Hotline (1–866–556–3974); and (ii) If appropriate, by filing a Suspicious Activity Report pursuant to subpart B of this part or other applicable regulations. (2) Money laundering. If as a result of information sharing pursuant to this
section, a financial institution suspects
that an individual, entity, or organization is involved in, or may be involved in money laundering, such information should generally be reported by filing a Suspicious Activity Report in accordance with subpart B of this part or other applicable regulations. If circumstances indicate a need for the expedited reporting of this information, a financial institution may use the Financial Institutions Hotline (1–866– 556–3974). (f) No limitation on financial institution reporting obligations. Nothing in this subpart affects the obligation of a financial institution to file a Suspicious Activity Report pursuant to subpart B of this part or any other applicable regulations, or to otherwise directly contact a federal agency concerning individuals or entities suspected of engaging in money laundering or terrorist activities. (g) Revocation or suspension of certification—(1) Authority of federal regulator or FinCEN. Notwithstanding any other provision of this section, a federal regulator of a financial institution, or FinCEN in the case of a financial institution that does not have a federal regulator, may revoke or suspend a certification provided by a financial institution pursuant to paragraph (b)(2) of this section if the concerned federal regulator or FinCEN, as appropriate, determines that the financial institution has failed to comply with the requirements of paragraph (c) of this section. Nothing in this paragraph (g)(1) shall be construed to affect the authority of any federal regulator with respect to any financial institution. (2) Effect of revocation or suspension. A financial institution with respect to which a certification has been revoked or suspended may not engage in information sharing under the authority of this section during the period of such revocation or suspension.
3. The Appendix to part 103 is
redesignated as Appendix A to part 103 and the heading is revised to read as follows:
Appendix A to Part 103—
Administrative Rulings

---

4. Appendix B is added to part 103 to
   read as follows:
   Appendix B to Part 103—Certification
   for Purposes of Section 314(b) of the USA Patriot Act and 31 CFR 103.110 BILLING CODE 4810-02-P

[FR Doc. 02–5006 Filed 3–1–02; 8:45 am] BILLING CODE 4810–02–C