On January 24, 2022, the Financial Crimes Enforcement Network (“FinCEN”) published a Notice of Proposed Rulemaking (“NPRM”). FinCEN is proposing a rule to establish a pilot program that permits certain financial institutions to share Suspicious Activity Reports (“SARs”) in alignment with Section 6212(a) of the Anti-Money Laundering Act of 2020 (“AML Act”).
The Proposed Rule
This proposed rule would add a new section at 31 C.F.R. section 1010.240, which would enact a pilot program permitting financial institutions with SARs reporting obligations to share SARs and SARs information with its foreign branches, subsidiaries, and affiliates for the purpose of combating illicit finance risks. According to FinCEN, this proposed rule ensures that federal and state law enforcement mechanisms would limit the sharing of SARs and information related to SARs. Moreover, the proposed role considers the intelligence community’s potential concerns and would be governed by requirements and standards surrounding the confidentiality of personally identifying information and data security.
The pilot program does not apply to all foreign branches of a financial institution. Rather, the proposed rule would largely exclude the sharing of SARs and SARs information with foreign affiliates in The People’s Republic of China, the Russian Federation, and any jurisdiction that is a state sponsor of terrorism, that is subject to United States sanctions, or that the Secretary of the Treasury (the “Secretary”) has determined cannot reasonably protect the security of SARs and SARs information. A “state sponsor of terrorism” is a jurisdiction so determined by the United States Department of Justice. The Secretary may, however, make exceptions to this prohibition on a case-by-case basis by notifying the Senate Committee on Banking, Housing, and Urban Affairs and the House Committee on Financial Services that such an exception is in the United States’ national security interests.
In addition, the proposed rule would require participating financial institutions to report certain information to FinCEN on a quarterly basis. This information includes the total number of SARs and SARs information shared, and the name and jurisdiction of each entity that received such information. The information must further include the relationship between the entity and the participating financial institution, and the intended purposes for the sharing of SARs and SARs information. Moreover, this quarterly report must include any legal and compliance issues encountered, any technical difficulties encountered, enhancements to the financial institution’s AML program enabled as a result of the pilot program, and any identified inefficiencies in the institution’s AML program.
The pilot program must terminate three years after the date of the enactment of the AML Act, which is January 1, 2024, unless the Secretary extends the pilot program for a maximum of two years upon submitting a report to the Senate Committee on Banking, Housing, and Urban Affairs and the House Committee on Financial Services.
Emphasizing the importance of balancing SARs confidentiality concerns while combatting illicit financing risks, FinCEN Acting Director Himamauli Das said the following about the pilot program: “We urge stakeholders to provide input to assist us in developing a program that will help combat illicit finance risks and promote enterprise-wide risk management, while ensuring adequate safeguards are in place to protect SAR confidentiality.”
Applying to Participate
Financial institutions wishing to participate must file an application and establish certain compliance requirements. Given the sensitive nature of SARs and SARs information, FinCEN believes a formal application and approval process is necessary to ensure adequate safeguards are established. The application to FinCEN must identify the financial institution’s point of contact for pilot program-related correspondence and specify the particular foreign branch, subsidiary, or affiliate with which the financial institution plans to share SARs and SARs information. Moreover, the application must explain how those foreign affiliates would use the SARs and SARs information. This information must include the operational jurisdiction of the foreign affiliates, and whether the foreign affiliates would provide reciprocal information to the applying financial institution. In addition, the application must provide an estimated commencement date for the pilot program. Moreover, the application must describe the internal controls in place to prevent unauthorized disclosures of SARs and SARs information.
The proposed rule also explains that applying financial institutions should implement certain controls, including confidentiality agreements and procedures for personnel located in the United States to review requests from foreign law enforcement. In general, financial institutions should create compliance requirements that include establishing procedures, policies, and internal controls that are reasonably designed to ensure that the financial institution’s foreign subsidiaries, branches, or affiliates “do not permit unauthorized disclosures of SARs or related information.” Under U.S.C. sections 5321 and 5322, civil penalties and criminal sanctions could be imposed on participating financial institutions for violations of the prohibition on the disclosure of SARs and related information. The proposed rule clarifies that those penalties and sanctions would extend to those participating financial institutions’ foreign subsidiaries, branches, or affiliates.
History of SARs Sharing and Seeking Public Comment on Extending Sharing Obligations
FinCEN previously issued guidance in 2006 on sharing SARs and information related to SARs (the “2006 Guidance”). Under the 2006 Guidance, a U.S. branch of a foreign bank may share a SAR with its head office, and a U.S. bank or savings association may share a SAR with its controlling company, whether domestic or foreign. FinCEN issued this guidance because a financial institution’s head office or controlling entity may need to discharge oversight responsibilities with respect to enterprise-wide risk management and compliance with applicable laws and regulations.
In 2010, FinCEN issued further guidance on sharing SARs with certain U.S. affiliates of financial institutions (the “2010 Guidance”). The 2010 Guidance permits the sharing of SARs and SARs information by financial institutions with their affiliates that are subject to SARs regulations. This includes brokers or dealers in securities, futures commission merchants and introducing brokers in commodities, money services businesses, and residential mortgage lenders or originators. This proposed rule, however, adds to the guidance by allowing SARs sharing with foreign affiliates. FinCEN believes this pilot program would offer important feedback regarding the value of SARs sharing for qualifying financial institutions.
The NPRM seeks public comment on the SARs-sharing pilot program. More particularly, it seeks comment on expected benefits and costs, technical challenges, the merits behind quarterly reporting, and the most effective methods in protecting SARs confidentiality within the pilot program. FinCEN notes that the public’s input in these questions will inform the final rule that FinCEN may issue in the future and the annual Congressional briefings that FinCEN must provide. Comments are due by March 28, 2022.
If you would like to remain updated on these issues, please click here to subscribe to Money Laundering Watch. To learn more about Ballard Spahr’s Anti-Money Laundering Team, please click here.