SECTION 3 THE BANK SECRECY ACT

Transcription

1 2018 CUNA GENERAL OPERATIONS REGULATIONS 3-1

2 Section 3 The Bank Secrecy Act General Overview We ve no doubt all heard the expression: Crime doesn t pay. Indeed, when a perpetrator of crimes is apprehended, indicted, convicted, and sentenced he or she learns that lesson the hard way. Sad but true, however, is the fact that some crime does pay at least until the bad guys are apprehended. Or, perhaps more accurately, crime reaps payments. And crime doesn t usually accept credit cards it takes its payment in cold, hard cash. Whether the crime is blackmail, drug dealing, tax evasion, illegal gambling, loan sharking, embezzlement, or a wide range of other types of activity that our laws have defined as criminal, the successful (the term is used loosely) criminal eventually winds up, somewhere along the line, with a pile of currency. But that currency can present a problem for the typical bad guy. In order to put his loot to work for him, a criminal must eventually re-enter that currency into circulation. And for as long as there has been a banking system, the bad guys have sought to use it to launder their ill-gotten gains by transforming their dirty money into legitimate sources of funds. Law enforcement has its hands full tracking various bad actors (there never seems to be a shortage) in a neverending effort to bring them to justice. Because of the banking system s large, if unwanted, role in allowing criminals to launder their money, Congress has passed a collection of laws which are referred to as the Bank Secrecy Act. In an effort to provide assistance to law enforcement, banks are required to keep certain records and to make certain reports regarding currency (and other) transactions. The Bank Secrecy Act (BSA) is perhaps misnamed. It applies to much more than just banks (as that term is commonly used), and it has more to do with divulging secrets than keeping them. Be that as it may, Bank Secrecy Act is a term now firmly entrenched in the parlance of the financial services industry, and it is not likely to be changed any time soon. In this section, we will briefly discuss the various laws that together make up the Bank Secrecy Act. Next we will turn our attention to the NCUA regulation which generally mandates BSA compliance for all federally insured credit unions. Finally, we will discuss the particular recordkeeping and reporting requirements that are at the heart of BSA compliance. When one thinks of regulatory compliance the first thing that usually comes to mind is consumer protection. Many of the various statutes and regulations with which financial institutions must comply are ultimately created with that end in mind. The BSA is not, however, about consumer protection it is a law enforcement tool. Violations of the various Bank Secrecy Act laws and regulations can, consequently, expose credit unions to both civil and criminal penal CUNA GENERAL OPERATIONS REGULATIONS 3-2

3 ties. We will address those penalties separately below. The laws that form the Bank Secrecy Act As mentioned in the introduction, terms like Bank Secrecy Act, or BSA, are frequently used in connection with the compliance duties of financial institutions, but they do not usually refer to a single statute (although, as we will discuss, there is a federal law called the Bank Secrecy Act). Actually, a number of laws and regulations come into play when discussing BSA compliance. Among these laws and regulations are the Anti-Drug Abuse Act of 1986; the Money Laundering Control Act of 1986; the Bank Secrecy Act of 1970; the Currency and Foreign Transactions Reporting Act; US Patriot Act, Title III; NCUA Rules and Regulations Part 748.2; and the Financial Recordkeeping and Reporting of Currency and Foreign Transactions rules developed by the U.S. Treasury Department and found in 31 C.F.R. Part 103. Anti-Drug Abuse Act of 1986 This law was enacted to help federal law enforcement s efforts to thwart illicit drug crops, to stop international drug trafficking, to improve the enforcement of the antidrug laws already on the books, and to establish more effective drug abuse and prevention programs. Among the antidrug enforcement provisions of the Anti-Drug Abuse Act are the provisions which make up the Money Laundering Control Act of Money Laundering Control Act of 1986 The Money Laundering Control Act of 1986, part of the Anti-Drug Abuse Act of 1986, made money laundering a federal crime. The Act resulted in the following: Criminalized the act of money laundering; Prohibited the act of structuring transactions to evade currency transaction report (CTR) filings; and Introduced civil and criminal forfeiture for BSA violations. The penalties for those offenses include imprisonment for a maximum of 20 years, fines up to $500,000 or two times the amount laundered, and forfeiture of assets. Bank Secrecy Act of 1970 Perhaps best-known among these various statutes is the Bank Secrecy Act of This is the federal statute that mandates, among other things, that financial institutions including credit unions maintain certain financial records about their members and customers transactions and that they report certain transactions in currency which involve more than $10,000. The Currency and Foreign Transactions Reporting Regulation This law requires that persons file a Report of International Transportation of Currency or Monetary Instruments (FinCEN Form 105) whenever they send or receive more than $10,000 in currency or monetary instruments out of or into the U.S. As we will discuss later, this statute rarely directly affects credit unions CUNA GENERAL OPERATIONS REGULATIONS 3-3

4 The USA PATRIOT Act, Title III: International Money Laundering Abatement and Anti-Terrorist Financing Act of 2001 This law amends the Bank Secrecy Act and targets money-laundering issues. One provision of this law will require financial institutions, including credit unions, to have minimum standards to verify the identity of its members when opening accounts. Another provision requires financial institutions to have antimoney-laundering programs in place. NCUA regulations already require federally insured credit unions to have a compliance program in place that is similar to the antimoney-laundering programs required by this Act. Therefore, credit unions that are in compliance with these requirements will be in compliance with the antimoney-laundering programs required by this act. Financial institutions are required to search their records (if requested by FinCEN) to determine if the financial institution maintains or has maintained accounts for, or has engaged in transactions with, individuals or organizations listed on the request. NCUA Rules and Regulations Although the original Bank Secrecy Act of 1970 applied to credit unions, their compliance with that statute was sparse, at best, for many years. But in 1986, the NCUA adopted a regulation which specifically provided rules that credit unions were required to follow to evidence their compliance with the BSA. NCUA Rules and Regulations Section sets forth those specific requirements. Under all federally insured credit unions must develop and provide for the continued administration of a program reasonably designed to assure and monitor compliance with the recordkeeping and reporting requirements set forth in the Bank Secrecy Act. NCUA requires that credit unions compliance programs adhere to the requirements set forth in 31 C.F.R. Part 103 the BSA regulations adopted by the U.S. Treasury Department with regard to BSA. Each credit union s plan must be in writing and must be approved by their board of directors. Section requires that the formal BSA compliance plan must: Provide for a system of internal controls to assure ongoing compliance per Section 748.2(c)(1). Provide for independent testing for compliance to be conducted by credit union personnel or outside parties per Section 748.2(c)(2). Designate an individual responsible for coordinating and monitoring dayto-day compliance per Section 748.2(c)(3). Provide training for appropriate personnel per Section 748.2(c)(4). 31 CFR Chapter X Chapter X of the Code of Federal Regulations contains the nuts and bolts of compliance with credit unions and banks reporting and recordkeeping requirements under the BSA. These Treasury rules broadly define the term bank and that definition clearly includes all credit unions, both state- and federally chartered. FinCEN transferred the BSA regulations found in 31 CFR 103 to a new chapter (Chapter X) as of March 1, CUNA GENERAL OPERATIONS REGULATIONS 3-4

5 Reporting Requirements A number of different reporting requirements are set forth in the BSA regulations. For credit unions and other traditional financial institutions, the Currency Transaction Report (FinCEN Form 104, or CTR) is far and away the most familiar of these reports. Other reports required under the regulations include Suspicious Activity Reports and Reports of International Transportation of Currency or Monetary Instruments. As of April 2013, credit unions must use the Financial Crimes Enforcement Network (FinCEN) reports available only electronically through the e-filing system. Currency Transaction Reports The Currency Transaction Report (FinCEN Form 104 or CTR) is a cornerstone of BSA compliance. In general, a credit union must complete and submit a CTR each time it takes a deposit, gives a withdrawal, or exchanges currency if the transaction involves currency of more than $10,000 per Section In addition, multiple same-day transactions which are completed at any branch of a credit union must be treated as a single transaction if the credit union has knowledge that those transactions are by or on behalf of the same individual. If those multiple transactions result in total cash into or out of the credit union in excess of $10,000, a CTR must be filed. In addition, deposits made at night or over a weekend or holiday must be treated as if they were made on the next business day following the deposit. (Section (b).) It is worth considering a couple of points with respect to the general rule. First, no CTR is ever required unless the transaction or transactions amount to Figure 3.1 CTR or No CTR? Q. A member deposits a check made out to cash for $15,000 and deposits it into her credit union account. Must a CTR be filed? A. No. A check even one made payable to cash is not currency. Q. A member deposits $10,000 worth of $100 bills into his credit union account. Must a CTR be filed? A. No. Although the transaction is in currency, it does not exceed $10,000. Q. A member withdraws $9,000 in currency in the morning from her credit union account. Later that day her teller discovers the same member withdrew $3,000 in currency that same day at another branch of the same credit union. Must a CTR be filed? A. Yes. Same-day withdrawals are aggregated. Q. A member deposits $9,000 in currency in the morning to his credit union account. Later that day his teller discovers the same member withdrew $3,000 in currency that same day at another branch of the same credit union. Must a CTR be filed? A. No. Same-day deposits and withdrawals are not aggregated with each other (although same-day multiple withdrawals are aggregated and same-day multiple deposits are aggregated among themselves) CUNA GENERAL OPERATIONS REGULATIONS 3-5

6 more than $10,000 in currency coming into or going out of the credit union. Thus, a cash deposit of $10,000 on the nose would not trigger CTR filing. Figure 3.1 lists a few examples of transactions and describes whether or not a CTR would be required. Next, the transaction must be in currency to be reportable. Currency is defined in the BSA regulations to include the coin and paper money of the U.S., as well as the coin and paper money of any other country that is designated as legal tender. (Section (m).) Currency includes U.S. silver certificates, U.S. notes and Federal Reserve notes, and official foreign notes that are customarily used and accepted as a medium of exchange in a foreign country. Reportable CTR transactions must be filed by the credit union within 15 days following the date of the transaction. CTRs must be filed electronically. You can access the BSA E-Filing website at Under the BSA regulations, credit unions have an affirmative duty to verify and record the name and address of a member presenting a transaction that will be reportable on a CTR, along with the identity, account number, and Social Security or taxpayer identification number of the person on whose behalf a reportable transaction is to be made. (Section ) If the individual claims to be an alien or not a resident of the U.S., the credit union must verify his or her identification by reviewing a passport, alien identification card, or other official document evidencing nationality or residence. Exemptions Recognizing that not all transactions involving more than $10,000 in currency are likely to have value in assisting law enforcement officials investigating potential criminal activity, the BSA regulations allow credit unions to exempt certain transactions from the general CTR reporting requirements. A credit union is not required to file a CTR with respect to a transaction completed by an exempt person, provided the transaction falls within the exempt person s stated limits. There are two categories (Phase I and Phase II) of potential exempt persons listed in the BSA regulations. (Section (b).) Under the Phase I designation, transactions in excess of $10,000 in currency made by certain entities are eligible for exemption. FinCEN identifies two categories of Phase I exempt persons: Any entity (other than a credit union or bank) whose common stock is listed on the New York, American or NASDAQ stock exchanges (with some exceptions) e.g., public or listed entities. Any subsidiary (other than a credit union or bank) of any listed entity that is organized under U.S. law and at least 51 percent of its stock is owned by the listed entity. FinCEN issued a final rule in December 2008 that simplified the Phase I CTR exemption process. Before the final rule, credit unions were required to complete either currency transaction reports or file a Phase I exemption for triggering transactions between itself and another depository institution, U.S. or State governments or entities acting with governmental 2018 CUNA GENERAL OPERATIONS REGULATIONS 3-6

7 authority. This required credit unions to file CTRs or file an exemption form for operating cash transfers between the credit union and another institution acting in a credit union s credit union capacity. This is no longer the case. Most important, transactions between a credit union and any of these parties would receive an automatic exemption from CTR filing similar to that granted to transactions between a credit union and one of the twelve Federal Reserve Banks. FinCEN identifies two categories of Phase II exempt persons: A business other than a publicly listed corporation or subsidiary as listed above that has maintained a transaction account with the credit union for at least 2 months; frequently (at least five per year) engages in transactions in currency with the credit union in excess of $10,000; and is organized or incorporated under the law of the U.S. or a state. (Section (b) referred to in the regulation as nonlisted businesses ). A person or business that has maintained a transaction account with the credit union for at least 2 months; operates a firm that regularly withdraws more than $10,000 (in currency) in order to pay its employees; and is incorporated or organized under the laws of the U.S. or a state. (Section (b) referred to in the regulation as payroll customers ). Alternatively, the rule gives a credit union the ability to forego the 2 month waiting period (normally required before a Phase II exemption is granted) and enables the credit union to make a riskbased determination of whether or not the exemption is appropriate. Credit unions are expected to perform an annual review of its exemptions (Phase I and II) to determine whether or not the exemption is still appropriate. There is no longer a requirement to biannually renew or report any change of control for Phase II exemptions. Credit unions used to be required to renew Phase II exemptions every two years and report any changes in the control of its Phase II exemption members. To apply for CTR exemption, credit unions must complete the Designation of Exempt Person Form (FinCEN form 110) within 30 days of the triggering transaction. Until the exemption has been filed, the credit union would be required to complete CTR forms for each applicable transaction. A number of businesses are ineligible under BSA regulations to receive exempt person status. A business is ineligible if it is engaged in one or more of the following activities (Section ): Service as financial institutions or agents of financial institutions of any type (examples of financial institutions that are not banks include securities brokers, check cashers, sellers or traveler s checks, or telegraph companies that wire funds). Purchase or sale to customers of motor vehicles of any kind, vessels, aircraft, farm equipment, or mobile homes. The practice of law, accountancy, or medicine. The auctioning of goods CUNA GENERAL OPERATIONS REGULATIONS 3-7

8 The chartering or operation of ships, buses, or aircraft. Gaming of any kind except licensed parimutuel betting at race tracks. Investment advisory services or investment banking services. Real estate brokerage. Pawn brokerage. Title insurance and real estate closing. Trade union activities. Any other activities that may be specified by the Financial Crimes Enforcement Network (FinCEN) the division of the U.S. Treasury charged with BSA enforcement. The method by which a credit union designates a member as an exempt person was substantially revised in Under the regulations prior to 1998, credit unions were permitted to grant exemptions to various types of members by having the member sign under penalty of perjury a request for exemption that listed the reasons the exemption was sought and that was retained on file by the credit union. Credit unions were also required to maintain a centralized Exempt Transactions Log which included all those members who were exempted from CTR requirements. Credit unions had until July 1, 2000, to designate those members as exempt persons under the new rules (for example, by completing a CTR as described above). If those members who were exempt under the old rules were not redesignated as exempt persons under the new rules by the appointed time, credit unions were required to file CTRs with regard to transactions in currency exceeding $10,000 completed by those members. It is important to note that even though a credit union might designate a member as an exempt person under these rules, it still has an obligation to file Suspicious Activity Reports (as discussed below) when circumstances dictate. FinCEN can revoke the status of a member as an exempt person upon written notice. Geographic targeting From time to time, FinCEN may determine reasonable grounds exist for requiring additional recordkeeping and/ or reporting requirements under the BSA regulations within a certain geographical area. (Section (a).) In these cases, the Secretary of the Treasury is empowered to issue an order requiring any domestic financial institution or a group of financial institutions in a geographic area to file CTRs for specially described dollar thresholds. For example, the Secretary could issue an order for all financial institutions in a given area to file CTRs for cash transactions which exceed, say, $6,000 in currency, as opposed to the usual $10,000. Section describes a special order of this nature will be directed to the chief executive officer of an affected credit union, and it will clearly describe the types of transactions that must be reported, including the following: Dollar amount of transactions subject to special reporting. Type of transactions subject to or 2018 CUNA GENERAL OPERATIONS REGULATIONS 3-8

9 exempt from special reporting. Appropriate form to use if filing special reports. Address to which special reports must be filed or which they will be picked up. Starting and ending dates by which such transactions are to be reported. Name of a Treasury official to be contacted for any additional information or questions. Amount of time reports and records of reports generated in response to the order will have to be retained by the financial institution. These special orders may not last more than 60 days unless they are renewed in exactly the same fashion as described above. (Section ) Unless directed otherwise, a credit union that receives an order of this nature may continue to use the exemptions it has already granted members as discussed above. Suspicious Activity Reports A Suspicious Activity Report (SAR) (Section ) must be filed with regard to any transaction that involves or aggregates more than $5000 when the credit union knows, suspects, or has reason to suspect that the transaction... Involves funds derived from illegal activities, is intended or conducted in order to hide or disguise funds or assets derived from illegal activities as part of a plan to violate or evade any Federal law or regulation, or to avoid any CTR requirement. Transaction is designed to evade any requirements of any regulations set forth under the Bank Secrecy Act. Offers no business or apparent lawful purpose or is not the sort in which the particular member would normally be expected to engage, and the credit union knows of no reasonable explanation for the transaction after examining the available facts including the background and possible purpose of the transaction. These provisions make it illegal to structure a transaction that is, to break up a single transaction above the reporting threshold into two or more separate transactions if the purpose in structuring the transaction is to evade the reporting requirement. It is a criminal violation to willfully violate the antistructuring provisions of the BSA. In 1993 the United States Supreme Court held that in order to convict a defendant accused of structuring transactions, the prosecution must prove the defendant acted with knowledge that the structuring he or she undertook was unlawful, not simply that the defendant s purpose was to circumvent the financial institution s reporting requirement. (See Ratzlaf v. United States, 510 U.S. 135, 114 S. Ct. 655.) A SAR must generally be filed within 30 days of the time in which the credit union is aware of the facts that might constitute a basis for filing the form. If no suspect was identified at the time the credit union first discovered facts which might lead to the filing of an SAR, the filing can be delayed up to an additional 30 days. (Section ) In addition to the rules in Chapter X 2018 CUNA GENERAL OPERATIONS REGULATIONS 3-9

10 regarding SAR filing, the NCUA requires that credit unions file an SAR in the following situations (NCUA Final Rule No. 06-RA-07, 12 CFR Part 748): Whenever any known or suspected criminal violation has been committed against a credit union regardless of the amount of money involved if the credit union believes the violation was committed by an insider for example, a director, officer, employee, agent, or other institution-affiliated party. Whenever any known or suspected criminal violation has been committed against a credit union involving $5,000 or more, if the credit union can identify a possible suspect who is not an insider. Whenever there are transactions aggregating $5,000 or more that involve potential money laundering or violations of the Bank Secrecy Act. Whenever any known or suspected criminal violation has been committed against a credit union involving $25,000 or more regardless whether any suspects have been identified. The SAR must be filed electronically with FinCEN through the BSA E-Filing system. Supporting documentation is not to be filed with the SAR. Instead the credit union must maintain records of all SAR supporting documentation for five years from the filing date. (Section ) FinCEN issued guidance (FIN G003), which clarified how credit unions should handle requests for supporting documentation related to a previously filed suspicious activity report (SAR). According to FinCEN, financial institutions must provide all documentation supporting the filing of a SAR upon request by FinCEN, appropriate law enforcement, or a supervisory agency. The guidance makes clear that no legal process is required for such a request. In other words, the Right to Financial Privacy Act requirements (subpoena, summons, search warrant, etc.) aren t applicable if: (i) such a request is made by FinCEN or a supervisory agency during the exercise of its supervisory, regulatory, or monetary functions or (ii) FinCEN, an appropriate agency, or law enforcement requests a copy of the SAR or supporting documentation underlying a SAR filing. So, what is supporting documentation? This refers to all documents or records that assisted a financial institution in determining that the activity in question warranted a SAR filing. Examples include account transaction records, new account information, communication, and written correspondence. Supporting documentation varies in each situation. Note, however, that if the information requested goes beyond the scope of what was detailed in the SAR or the SAR s supporting documentation, the Right to Financial Privacy Act protections apply. A credit union need not file an SAR for a robbery or burglary committed or attempted as long as that robbery or burglary is reported to appropriate law enforcement authorities. When completing the SAR, credit unions should be sure to indicate whether the underlying cause of the criminal activity is the result of identity theft, pretext calling, or computer intrusion CUNA GENERAL OPERATIONS REGULATIONS 3-10

11 SAR confidentiality FinCEN recently updated the BSA regulations to further clarify its expectation with regard to SAR confidentiality. Under the previous regulation, a credit union and its officers, directors, employees, etc. were prohibited from notifying any person involved in a suspicious transaction that was the subject of a SAR report. To further clarify the scope of confidentiality surrounding SAR reports, FinCEN issued a final rule and accompanying guidance clarifying SAR confidentiality. According to the final rule, credit unions are not to disclose the SAR or any information revealing the existence of a SAR to parties other than those authorized to receive this information such as appropriate law enforcement, regulators, etc. FinCEN notes that it was important to clarify the scope of the confidentiality provision due to the potentially serious consequences of an unauthorized disclosure. Guidance on SAR confidentiality may be found at A credit union that files a SAR may not notify any person involved in the reported transaction. And, should an individual inquire of the credit union about whether a SAR has been filed, the credit union is required to report this inquiry to FinCEN. (Section ) In December 2006, NCUA issued a final rule (12 CFR Part 748) that now requires credit union management to promptly notify its board of directors (or designated committee) of any SAR filings. Notification must be at least monthly (usually at the monthly board meeting), unless the activity is serious enough to warrant immediate notification. In instances where the target of a SAR filing is a board member or designee, the credit union must not notify the SAR target. However, the credit union is expected to notify the remaining directors or designees who are not suspects. Finally, the final rule does not specify a particular format and credit unions have ample flexibility in tailoring a format that suits their particular needs. The Federal Financial Institutions Examination Council s (FFIEC) Bank Secrecy Act/Anti-Money Laundering (BSA/AML) Examination Manual gives a number of reporting options such as providing the actual SAR documents (which CUNA does not recommend), providing a report that summarizes the SAR filings, providing tables of SARs filed for specific violation types, etc. Report of International Transportation of Currency or Monetary Instruments BSA regulations also require that a Report of International Transportation of Currency or Monetary Instruments (FinCEN form 105) be filed whenever a person sends or receives more than $10,000 in currency or monetary instruments (checks, money orders, traveler s checks, etc.) into or out of the U.S. A credit union must file a FinCEN form 105: When the credit union physically transports, mails, or ships currency and/ or monetary instruments in excess of $10,000 at one time into, or out of, the U.S. per Section ; or When the credit union receives currency and/or monetary instruments 2018 CUNA GENERAL OPERATIONS REGULATIONS 3-11

12 in excess of $10,000 at one time, which has been transported, mailed, or shipped to it by a member from somewhere outside the U.S. per Section It is important to note that a credit union does not receive the currency or monetary instruments from outside the U.S. if a member deposits the currency or instruments into a credit union account even if the credit union knows that the currency or instruments were received or transported from a place outside the U.S. In such a case, the member would have the duty to file the report, assuming the member was the person who transported, shipped, or received the currency and monetary instruments. The credit union has no duty to inform the member of its duty to file the report, but FinCEN asks that the credit union do so. FinCEN Form 114 Although beyond the scope of this book, there is one more reporting requirement under the BSA. Those credit unions that have financial account relationships outside the U.S. that exceed $10,000 are required to file a FinCEN Form 114 on an annual basis. Credit unions that have such foreign accounts should call FinCEN at for more information about this form. Filing forms electronically The Financial Crimes Enforcement Network (FinCEN) provides credit unions access to the BSA E-Filing system (go to bsaefiling.fincen.treas.gov/main.html.) The system supports secure electronic filing of Bank Secrecy Act (BSA) forms (either singly or in batches) such as Currency Transaction Reports (CTRs), Suspicious Activity Reports (SARs) and Designation of Exempt Person forms (DEP). In addition, institutions can use this system to send secure messages to FinCEN and receive responses, when appropriate. Finally, FinCEN can use the BSA E-Filing system to issue advisories and BSA E-Filing system updates to the user community. Recordkeeping Requirements Part of the initial purpose behind the various BSA statutes and regulations was the fact that, until the original Bank Secrecy Act was passed in 1970, law enforcement officials were frequently frustrated in their attempts to convict perpetrators of financial crimes due to the lax recordkeeping practices of many banks. As such, a great deal of the BSA compliance burden lies in its recordkeeping requirements. A number of specific records that must be retained by financial institutions are listed in the regulations, all of which must be retained for five years. The good news from the standpoint of compliance burdens, is that these types of records are now commonplace for financial institutions. Each of the specific recordkeeping 2018 CUNA GENERAL OPERATIONS REGULATIONS 3-12

13 requirements will be discussed in the following paragraphs. Credit unions are required to retain either the original, or a microfilm, or other copy of each of them for at least the five-year period. Filed reports Records of any report filed pursuant to the BSA regulations Currency Transaction Reports, Suspicious Transaction Reports, or Reports of International Transportation of Currency or Monetary Instruments must be retained on file for at least five years. Certain credit extensions Records of each extension of credit in an amount that exceeds $10,000 must be maintained, unless the credit is secured by real property. These records must include the name and address of the borrower, the amount of the loan, the nature or purpose of the loan, and the date of the loan per Section Certain transfers of currency or monetary instruments Credit unions must maintain either the original or some reproduced form of each advice, request, or instruction received or given regarding any transaction resulting in the transfer of currency or other monetary instruments, funds, checks, investment securities, or credit of more than $10,000 to or from any person, account, or place outside the United States. Credit unions are also required to maintain records of similar cancelled requests, advice, instructions, etc., per Section Records regarding a geographic targeting order As was discussed earlier, there may be instances when the Secretary of Treasury will require a financial institution or a group of financial institutions within a geographic area to maintain special records with respect to currency transactions. The BSA regulations require that any such records including any CTRs filed under such an order must be retained for as long as is specified in the corder. This record retention period may not exceed five year per Section Sales of certain monetary instruments in amounts between $3,000 and $10,000 If a credit union sells a draft, cashier s check, teller s check, money order, or other monetary instrument to a person and the purchase is made in currency, it must maintain certain records with regard to such sales. The specific requirements depend on whether a credit union sells such instruments to a member or a nonmember. (Section ) If a credit union sells one of these instruments to a member in an amount of $3,000 to $10,000, it must maintain a record of: The member s name. The date of purchase. The type of instrument purchased. The serial number of the instrument purchased. The dollar amount of the transaction CUNA GENERAL OPERATIONS REGULATIONS 3-13

14 When a nonmember makes such a purchase, the credit union is required to retain a record of the above information and the purchaser s address, Social Security Number (or alien identification number), and date of birth. Credit unions are free to implement policies by which they require a member who wishes to purchase one of these monetary instruments in cash to first deposit the cash into his account (completing the actual purchase of the instrument via a debit to that account). This is permissible as long as the credit union s policy in this regard is written, includes formal procedures for implementation, and applies to all deposit account holders without exception. However, the implementation of such a policy does not eliminate the record keeping requirements for such purchases. According to the Financial Crime Enforcement Network s (FinCEN) November 2002 guidance on this issue, credit unions are still subject to the record keeping require ments under Section As a practical matter, however, credit unions will typically not have any difficulty retaining a record of the name, date of purchase, type of instrument purchased, and the dollar amount of the transaction. Note: When this recordkeeping requirement was first mandated by Congress in 1988, it included a requirement that credit unions and other financial institutions retain a centralized log which contained records of these sales of monetary instruments for cash in amounts of $3,000 to $10,000. In 1994, this centralized log requirement was eliminated. Certain wire transfers In mid-1996, new rules took effect under BSA regulations that mandate the retention of certain wire transfer records. The records recorded under these new rules are to be retained for five years as is the case with all other BSA recordkeeping requirements. Records of wire transfers for less than $3,000 are exempt from these recordkeeping requirements as are records of wired transfers governed by the Electronic Fund Transfer Act and Regulation E and those made through an automated clearinghouse, automated teller machine, or point of sale system. Under these rules, recordkeeping requirements differ depending on whether the credit union is the originating bank or the beneficiary bank in a wire transfer. When a credit union acts as an originating bank, it executes a wire transfer on behalf of its member. In this case, the credit union must retain a record of: The originator s name and address. The amount, date, and payment instructions received. The beneficiary bank identification. The beneficiary s name and address or the beneficiary s account number if received with the payment order. When a credit union serves as the beneficiary bank in a wire transfer, it is required to keep a copy of each payment order received. Under these wire transfer recordkeeping requirements, if the beneficiary is not an established customer of the credit union, the credit union must verify 2018 CUNA GENERAL OPERATIONS REGULATIONS 3-14

15 his or her name and address and retain a record of the means used to identify the person (for example, driver s license, passport, etc.), and a record of the beneficiary s Social Security number, alien identification number, or employer identification number. An established customer is a person with an account with the credit union or a person from whom the credit union has obtained and maintains on file the person s name, address, and taxpayer identification per Section There are additional identity verification rules with respect to individuals who are not established customers, but because credit unions have historically limited wire transfers to members or joint owners, many credit unions may not be familiar with these additional procedures. However, credit unions that intend to offer limited services to certain nonmembers (in light of authority to offer such services under the 2006 Regulatory Relief Act) should familiarize themselves with these additional procedures. When these rules regarding records of wire transfers were first introduced, there was widespread concern that credit unions would have to invest in sophisticated software through which they could instantaneously retrieve records of wire transfers which fall within the scope of these rules. However, Section makes clear that the required records must be retrievable by reference to the name and or account number of the member who originated the transfer or who was the beneficiary of the transfer within a reasonable period of time. Other Bank Secrecy Act requirements Credit unions are required to retain either the original records or copies of all of the following records with respect to any account: The signature card. Each statement or other record for each deposit or share account, showing each transaction made on the account. Each check, draft, or money order for more than $100 drawn on the credit union or issued and payable by it. Each debit of each member s account in excess of $100. Each check, draft, or transfer of credit of more than $10,000 remitted or transferred to a person, account, or place outside of the U.S. Each check, draft, or transfer of credit for more than $10,000 received directly from a bank, broker or dealer in foreign currency exchange outside the U.S. Each receipt of currency, other monetary instruments, investment securities or checks, and each transfer of funds or credit of more than $10,000 received on any one occasion from a bank, broker, or dealer in foreign currency exchange outside the U.S. Records in the ordinary course of business which would be needed for the credit union to reconstruct a transaction (checking) account and to trace a check in excess of $100 deposited in such account through its domestic pro CUNA GENERAL OPERATIONS REGULATIONS 3-15

16 cessing system or to supply a description of a deposited check in excess of $100. A record containing the name, address, and TIN, if available, of the purchaser of each term share certificate along with a description of the certificate, a notation of the method of payment, and the date of the transaction. A record containing the name, address, and TIN, if available, of any person presenting a term share certificate for payment along with a description of the certificate and the date of the transaction. Each deposit slip or credit ticket reflecting a transaction, wire transfer deposit, or other direct deposit which exceeds $100. For extensions of credit (not secured by real property) in excess of $10,000, a credit union must also retain record of: Name of the borrower Address of borrower Amount of credit extended Nature or purpose of the loan Date of the loan While these record-retention requirements amount to a rather lengthy list, it is difficult to imagine a credit union not retaining all of these records, regardless of the regulatory requirement to do so. As with all other recordkeeping requirements under Bank Secrecy Act regulations, these records must be maintained for at least five years. Information Sharing The USA PATRIOT Act of 2001 encourages information sharing among financial institutions for purposes of identifying and reporting activities that may involve terrorist acts or moneylaundering activities. Credit unions and associations of financial institutions may share information with other financial institutions after they provide notice to FinCEN and agree to maintain adequate procedures to protect the security and confidentiality of the information that is shared. In order to share information (as allowed by the USA PATRIOT Act and FinCEN) with other financial institutions, credit unions must provide an annual notice to Treasury. A new notice must be completed each year. The notification requires credit unions to provide: Federal ID number; Primary Federal Regulator; Mailing address; Contact person s name; Contact person s title; Contact person s , telephone, and facsimile number. Once the notification is submitted to FinCEN, credit unions may share information (regarding money laundering and terrorist financing only) with other financial institutions and not be liable to anyone for this type of information sharing. The notification may be revoked or suspended by NCUA. If there are any suspicious transactions relating to money laundering or 2018 CUNA GENERAL OPERATIONS REGULATIONS 3-16

17 terrorist activity, credit unions may voluntarily report that information to law enforcement by completing the SAR and calling FinCEN s Financial Institution s Hotline for terrorist activity at The information sharing regulations also require credit unions to expeditiously search their records when they receive a request from FinCEN. FinCEN will act on behalf of federal law enforcement agencies investigating money laundering or terrorist activity. FinCEN may require any credit union to search its records to determine whether the credit union maintains an account for or has maintained an account during the preceding 12 months for anyone listed in the request. The credit union also needs to determine if it has engaged in transactions conducted by, and funds transfers involving, a named suspect during the preceding six months that is required under law or regulation to be recorded by the credit union or is recorded and maintained electronically by the institution. Each credit union is required to sign up in order to receive the FinCEN information requests. Signing up for a FinCEN request is done with NCUA as part of the Form 5300 call report. Section 314(a) contact information was added to the March 31, 2003, call report, so every credit union will have registered a contact person. If a credit union needs to change or update its contact information, it should do so on the next call report. If changes occur between cycles, the changes or updates need to be given to the appropriate regional office or NCUA examiner. Credit unions can have more than one contact person and should add the information of a second contact person by sending an or fax to NCUA or FinCEN, if privately insured. The Financial Crimes Enforcement Network (FinCEN) implemented its Web-based USA Patriot Act Section 314(a) secure communication system in March The system provides FinCEN with the ability to issue secure delivery of Section 314(a) subject information to financial institutions via the web. Credit unions who receive Section 314(a) requests electronically should have already completed the registration process. When a credit union receives a request, it must expeditiously search its records to determine whether it maintains or has maintained any account for, or has engaged in any transaction with any individual, entity, or organization named in the FinCEN request during the time period specified. If the credit union has any questions relating to the scope or terms of the request, it should contact the Federal law enforcement agency directly. However, if the credit union identifies a matching account or transaction, it must report to FinCEN not the Federal law enforcement agency the name or account number of each individual as well as a Social Security number, date of birth, or other similar identifying information that was provided by the member or organization when the account was opened or transaction conducted CUNA GENERAL OPERATIONS REGULATIONS 3-17

18 USA PATRIOT Act s Customer Identification Program Requirements The USA PATRIOT Act of 2001 requires the U.S. Treasury Department to issue regulations setting forth minimum standards for financial institutions to identify and verify any person who opens an account. CIP Requirements Section 326 of the USA PATRIOT Act requires financial institutions to: Implement reasonable procedures to verify the identity of any person seeking to open an account, to the extent reasonable and practicable. Maintain records of the information used to verify the person s identity. Determine whether the person appears on any lists of known or suspected terrorists or terrorist organizations provided to the financial institution by any government agency. Provide the customer opening a new account with notice of the information collection requirement. The Treasury Department, National Credit Union Administration, and other federal agencies issued final regulations implementing Section 326 of the USA PATRIOT Act in The aim of the final rule is to protect the U.S. financial system from money laundering and terrorist financing. According to the regulators, this rule will have the added benefit of helping to protect consumers against various forms of fraud, including the growing incidence of identity theft involving new accounts. The final regulation requires all financial institutions, including credit unions, to implement a Customer Identification Program or CIP that requires them to have procedures in place to get identifying information from anyone opening an account and to verify that information. The CIP procedures must enable the credit union to form a reasonable belief that it knows the true identity of the accountholder. The CIP is supposed to be risk based. This means that the final regulations do not impose specific requirements but only minimum standards, and a credit union must tailor its CIP based on its size, location, and membership base. A credit union must apply its CIP to each person establishing a new account relationship. This includes not only members but joint accountholders, coborrowers, and businesses. Required information The final regulation requires credit unions to get at least four pieces of information from each new member/customer. At a minimum, the credit union must obtain the person s: 1. Name 2. Date of birth (for an individual) 3. Address Credit unions must get a residential or business street address. P.O. Boxes are not acceptable. In those instances where a member has to be contacted by a government investigator of some sort, there is a physical address on file CUNA GENERAL OPERATIONS REGULATIONS 3-18

19 If the prospective individual member or customer is unable to provide a residential or business street address, the credit union may accept an address of a friend or relative, or an Army Post Office (APO) or Fleet Post Office (FPO) box number. If the member is participating in an address confidentiality program, the credit union can take the street address of the ACP office that is assisting the member. The address for a business can be either the principal place of business, local office, or other physical location of the business. The credit union, of course, can get additional addresses, such as a mailing address, to meet its own or the member s needs. 4. Identification number For a U.S. person this means a Social Security number (SSN) for an individual or an employer identification number (EIN) for a business. The definition of U.S. person is a U.S. citizen or a business, partnership, or other legal entity that is established or organized under federal or state law. Note that this definition of U.S. person is different than the one used by the IRS which includes resident aliens. For any non-u.s. person which is simply any person or entity not qualifying as a U.S. person, the credit union has more flexibility. It can obtain: 1. a Social Security number from a resident alien; 2. an individual taxpayer identification number (ITIN); 3. a passport number and the country of issuance; 4. an alien identification card number; or 5. a number and country of issuance on any other foreign governmentissued document evidencing nationality or residence and bearing a photograph or similar safeguard (perhaps a similar safeguard may be looking down the pike whereby technology readily exists to identify thumbprints or eye scans). If someone has applied for a taxpayer identification number but has not yet received it, the credit union can still open an account as long as it confirms that the TIN application was filed before the member/ customer opens an account, and the credit union gets the TIN within a reasonable period of time after the account is opened. Beneficial Owner Rule Effective May 11, 2018, credit unions will be required to collect the required CIP information for individuals that are considered a beneficial owner of a legal entity that is opening a new account. A legal entity includes: corporations, imited liability companies, other entities that are created by filing a public document with a Secretary of State or similar office, and 2018 CUNA GENERAL OPERATIONS REGULATIONS 3-19