January 27, By electronic delivery to:

Transcription

1 Robert G. Rowe, III Vice President & Associate Chief Counsel Regulatory Compliance Phone: January 27, 2016 By electronic delivery to: Jennifer Shasky Calvery Director Financial Crimes Enforcement Network U.S. Department of the Treasury P.O. Box 39 Vienna, VA Re: Regulatory Impact Assessment and Initial Regulatory Flexibility Analysis Regarding the Proposed Customer Due Diligence Rule; Regulatory Identification Number 1506-AB25; Docket Number FINCEN Dear Director Shasky Calvery: The American Bankers Association (ABA) 1 appreciates the opportunity to comment on the request by the Financial Crimes Enforcement Network (FinCEN) for comments on their Regulatory Impact Assessment (RIA) and Initial Regulatory Flexibility Analysis (IRFA) for the proposed rulemaking on Customer Due Diligence Requirements for Financial Institutions (the proposed CDD rule, or the proposed rule). 2 The proposed CDD rule would require financial institutions to identify the beneficial owners of legal entity customers who hold a 25% or greater ownership stake in the legal entity, as well as the individual who controls the entity. Since the enactment of the Bank Secrecy Act (BSA) in 1970, banks have made significant commitments to the fight against money laundering and terrorist financing. The banking industry has a strong interest in protecting financial system integrity and in doing so has a strong history of working with law enforcement agencies to provide quality and valuable information to guard that system integrity. This partnership, in order to be most effective, requires an ongoing commitment by regulators to risk-weight their information requests, so that existing and proposed new BSA/anti-money laundering (AML) requirements focus resources where there is the greatest opportunity for identifying and mitigating risk, do not distract agency and industry attention to low priority efforts, and in the process do not discourage participation by legitimate customers in the financial mainstream or compromise the efficiency of the American banking system and its ability to meet future global and domestic economic needs. 1 The American Bankers Association is the voice of the nation s $15 trillion banking industry, which is composed of small, regional and large banks that together employ more than 2 million people, safeguard $12 trillion in deposits, and extend more than $8 trillion in loans. 2 Notice of Availability of Regulatory Impact Assessment and Initial Regulatory Flexibility Analysis Regarding the Customer Due Diligence Requirements for Financial Institutions, 80 Fed. Reg (Dec. 24, 2015).

2 ABA firmly believes that a rule that has the significance and potential impact of the proposed CDD rule merits thorough and careful public analysis. We question whether FinCEN s costbenefit analysis has been undertaken with the rigor that it deserves and that sound public policy and regulatory mandates demand. The unsubstantiated assumptions and limited quantitative data relied upon, as well as the timing of the request for comment on the RIA and IRFA, suggest that FinCEN could have a more successful policy effort by taking more care in its public consultation with regard to the proposed rule. We fear that at this point FinCEN s efforts have not met these standards for the level of successful policymaking it seeks to achieve. FinCEN released the RIA and IRFA through publication in the Federal Register on December 24, 2015, in the middle of the holiday season when many people were away from their offices. Although FinCEN has had over 15 months to assess the comments it received on the proposed CDD rule, it allowed only 30 days for the public to provide feedback, seriously limiting the public s ability to provide meaningful, substantive feedback. Unfortunately, and we believe hastily, FinCEN denied a request by ABA and a coalition of trade associations representing small financial institutions for adequate time to comment. Within the narrow timeframe allowed for response, ABA was able to obtain information and data from 42 financial institutions, including 16 community banks. Our gathering of information and views would have been more ample, but this limited success within the tight time constraints suggests how much more successful public input could have been, particularly in view of FinCEN s emphasis on valuable quantitative information. 3 Moreover, the summary dismissal of industry s request for additional time undermines the public-private collaboration that Congress has intended and that even international authorities believe is vital to efforts to combat money laundering and terrorist financing. 4 The RIA and IRFA rely on unsubstantiated and overly optimistic assumptions about the potential benefits to be gained from compliance with the proposed CDD rule 5 without adequately identifying and weighing the burden to be imposed on the financial industry. FinCEN concedes that its sample was very small and not statistically representative In fact, its cost analysis is based on interviews conducted with only a handful of institutions and only three small financial institutions. Basing estimates of the proposed rule s costs to the entire financial industry on such a small statistical sample undermines effective policymaking. The approach by FinCEN seems to be, the costs and benefits are hard to measure and therefore we will largely ignore them. Neither statute nor good policymaking authorize such an approach. We believe that better evaluation can be and must be undertaken. 3 ABA surveyed banks regarding the proposed CDD rule and received responses from 42 banks, with asset sizes ranging from $300 million to $9 billion and staffs that range from 18 to over 13,000 employees. Of the 42 responding banks, 16 banks have an asset size of $550 million or less. For purposes of this letter, a bank with an asset size of $550 million or less will be referred to as a community bank. 4 The Financial Action Task Force Recommendations, which set the international standards for AML/CFT, includes Recommendation 31 which states that, Countries should ensure that policy makers, the FIU, law enforcement and supervisors have effective mechanisms in place which enable them to co-operate, and where appropriate coordinate domestically with each other concerning the development and implementation of policies and activities to combat money laundering and terrorist financing. Financial Action Task Force, The FATF Recommendations, February 2012, available at (updated October 2015). 5 FinCEN readily admits that [N]one of the benefits of the proposed rule can be measured with sufficient accuracy at this time to warrant a quantitative assessment. 6 Regulatory Impact Assessment for FinCEN Notice of Proposed Rulemaking: Customer Due Diligence Requirements for Financial Institutions, Docket No.: FinCEN , at 25 (Dec. 2015) (hereinafter, RIA ). 2

3 Moreover, FinCEN has failed even to identify or, in certain instances, credit many significant costs that are likely to result from the proposed rule. For example The proposed rule will likely contribute to de-risking as many financial institutions will find it increasingly difficult to open accounts or extend credit where the risk of correctly identifying the beneficial owners cannot be managed to the satisfaction of the regulatory requirements. Businesses will face diminished availability of both credit and banking services, forcing many to use alternative and even informal sources, reducing law enforcement s access to information. FinCEN s analysis of training costs does not look beyond the time staff would need to spend attending training(s) and does not account for the variety of expenses associated with such training, such as the hiring of consultants or separate staff to conduct trainings. FinCEN has not accounted for the time that staff of financial institutions will need to spend to update their institution s policies and procedures in response to the new rule. FinCEN does not account for the costs that would be incurred by financial institutions for upgrading existing IT systems to comply with the proposed CDD rule. FinCEN did not properly account for costs associated with increased investigations into suspicious transactions and the filing of Suspicious Activity Reports (SAR) that institutions will incur under the proposed rule. These are all real and necessary costs that should be fully comprehended in the analysis. In another part of the analysis, FinCEN severely underestimated the costs that it did consider. FinCEN reported that banks would need to provide 30 to 60 minutes of training on the proposed rule in the first year, and 10 to 15 minutes of refresher training in subsequent years. Banks that responded to ABA s survey stated that they would need to provide an average of nearly 3 hours of training on the proposed rule. FinCEN offers no better source of information for such costs than this. FinCEN s failure to account for these costs seriously undermines its entire cost-benefit analysis and its compliance with the statutory and administrative laws that require government agencies to tailor regulations to impose the least burden on society. We do not question the goals that FinCEN seeks to achieve; we share them. We believe that more attention should be devoted up-front to finding the most effective ways to achieve them. A cost-benefit analysis that does not fully account for the costs of the proposed regulation will not inform sound policymaking but instead leave the false impression that a regulation will not burden private entities when, in fact, it will. ABA strongly recommends that FinCEN not proceed with a final rule until a proper costbenefit analysis has been completed. 3

4 I. Background A. Interagency Guidance In March 2010, the prudential regulators issued guidelines describing their expectations for financial institutions opening accounts for legal entities (any customer other than an individual). 7 At that time, the agencies stated that the guidance was designed to clarify and consolidate existing regulatory expectations. 8 However, despite this characterization, there was much that appeared new in the guidance, and the financial sector raised many questions about the guidance, including to what extent it actually imposed new obligations. The premise for the guidance and the subsequently proposed CDD rule is to codify expectations requiring financial institutions to collect information about their legal entity customers. This information would identify the primary owners of a legal entity as well as identify who controls the entity. While financial institutions conduct a careful and detailed assessment of all customers when opening accounts and periodically during the account relationship, both as a matter of due diligence and to serve their customers better, the guidance and proposed regulations would impose a more prescriptive set of standards. In other countries, notably European countries, the governments that authorize the existence of legal entities also track information about the entity s ownership and control. These public registries allow financial institutions overseas to verify the information collected. Comparable registries do not exist in the United States. One of the factors underlying promulgation of the proposed CDD rule is an attempt to address that lack of transparency in the creation of legal entities in the United States. When the United States was last evaluated by the Financial Action Task Force (FATF), a primary criticism of FATF s report, published in June 2006, was the lack of transparency in the ownership and control of legal entities. 9 That criticism has not been resolved, and now the U.S. is undergoing another evaluation by FATF Joint Release, Guidance on Obtaining and Retaining Beneficial Ownership Information, (FIN-2010-G001), available at 8 Id. at 1. 9 Financial Action Task Force, Third Mutual Evaluation Report on Anti-Money Laundering and Combating the Financing of Terrorism, (June 23, 2006) available at 10 Financial Action Task Force, Global Assessments Calendar, (July 2015), available at 4

5 B. Advanced Notice of Proposed Rulemaking Following the issuance of the 2010 guidance and after extensive discussions among regulators, the private sector, and law enforcement, FinCEN issued an advanced notice of proposed rulemaking (ANPR) on March 5, In the ANPR, FinCEN stated it was considering promulgating a rule that would establish a categorical requirement for financial institutions to identify the beneficial ownership of accountholders. 12 Due to the significance of the proposal, FinCEN and Treasury also held a series of five outreach meetings around the United States to discuss the concept and to help them develop a proposed rule. ABA raised a number of concerns in our comments on the ANPR. 13 In particular, we explained that without the ability to verify information provided by legal entities, financial institutions would not be able to provide information with the reliability that law enforcement would consider useful, nor would the rule achieve the transparency mandated by international AML guidelines. 14 Without the ability to verify the information collected from customers, ABA strongly believes the limited benefits of collecting the information are far outweighed by the costs of the collection. C. Proposed Customer Due Diligence Rule In August 2014, after considering the feedback it had collected, FinCEN published a Notice of Proposed Rulemaking (NPRM). 15 One of the most significant changes from the ANPR was the acknowledgment that the lack of government registries would prevent the financial sector from verifying the information collected from customers seeking to open accounts for legal entities. Nevertheless, FinCEN proposed use of a form to collect but not verify information about the ownership and control of legal entity customers as new accounts are opened. While a number of the changes were welcomed by the financial industry, ABA and others again raised concerns about the overall proposal, including whether the still limited benefits provided by the information collection justified its costs. 16 When it issued the NPRM, FinCEN included a section to address its requirements under the Regulatory Flexibility Act (RFA). The RFA requires that, when an agency publishes a notice of proposed rulemaking, it shall prepare and make available for public comment an initial regulatory flexibility analysis which is designed to ensure that the costs and benefits to small entities are identified and considered. 17 However, the requirement to prepare an IRFA does not apply to a proposed rule if the head of the agency certifies that the rule will not, if promulgated, have a significant economic impact on a substantial number of small entities. 18 FinCEN chose to make this certification, erroneously, since FinCEN conceded that the statistical data does not exist on two key drivers of cost: the average number of beneficial owners of legal entity 11 See Advanced Notice of Proposed Rulemaking (ANPR), Customer Due Diligence Requirements for Financial Institutions, 77 Fed. Reg (Mar. 5, 2012), available at 12 Id. at See, e.g., Letter from Robert Rowe, Am. Bankers Ass n, to FinCEN (June 11, 2012), available at 14 As a more reliable source for the information, ABA recommended that IRS tax filings be used to develop a public registry to verify a legal entity s ownership and control, but FinCEN has not pursued that suggestion. 15 See Notice of Proposed Rulemaking, Customer Due Diligence Requirements for Financial Institutions, 79 Fed. Reg (Aug. 4, 2014), available at 16 See, e.g., Letter from Robert Rowe, Am. Bankers Ass n and BAFT, to FinCEN (Oct. 3, 2014), available at U.S.C. 603(a) U.S.C. 605(b). 5

6 customers of small institutions and the number of such accounts small institutions establish in any time period. 19 The failure of FinCEN to find data on costs does not mean that the costs do not exist, and yet that seems to be the non-compliant approach of FinCEN to its statutory obligation. Widely criticized for the adequacy of its cost benefit analysis, FinCEN published on December 24, 2015, a Regulatory Impact Assessment (RIA) and Initial Regulatory Flexibility Analysis (IRFA) and requested comments on its analysis. 20 We appreciate the recognition by FinCEN of the need to address this problem, even while we note that its December effort falls short. We continue to recommend that FinCEN engage in further evaluation of costs and benefits in order to meet its statutory obligations and to have a much more successful policy outcome. II. The Regulatory Impact Assessment and Initial Regulatory Flexibility Analysis Contravene the Regulatory Flexibility Act and Executive Orders and by Failing to Describe Accurately the Likely Impact of the Rule on Private Entities The purpose of the Regulatory Flexibility Act and Executive Orders and 13563, which require federal agencies to conduct a regulatory impact analysis, is to inform agency policymaking and to ensure that regulatory choices are made after appropriate consideration of the likely impact on the public and industry and, in the case of the RFA, the impact on small entities. This statutory and administrative framework helps ensure that agencies proceed with rulemaking only on the basis of a reasoned and, to the extent feasible, documented determination that the benefits of a rule justify its costs. In addition, the required regulatory impact analyses have an important constitutional function; they promote accountability and transparency. ABA believes that the RIA and IRFA published by FinCEN significantly overstate the perceived benefits of the proposed CDD rule while underestimating, or ignoring entirely, significant costs, and therefore fail to satisfy the statutory mandates. A. The Initial Regulatory Flexibility Analysis Contravenes the Regulatory Flexibility Act As discussed above, the RFA imposes important requirements on an agency to ensure that the agency weighs the costs to small entities of complying with a proposed rule. Regrettably, throughout the rulemaking process FinCEN s RFA analysis has been perfunctory at best. Initially, FinCEN certified (based on no substance that we have been able to find) that the proposed rule would not have a significant economic impact on a substantial number of small entities. 21 After several commenters challenged that conclusion, FinCEN engaged in a cursory cost-benefit analysis that relies on unsubstantiated assumptions and responses from a very small number of financial institutions. In addition, FinCEN has not provided a meaningful discussion of the alternatives to the proposed CDD rule, another requirement for agencies to observe. 19 Notice of Proposed Rulemaking, Customer Due Diligence Requirements for Financial Institutions, 79 Fed. Reg. at Notice of Availability of Regulatory Impact Assessment and Initial Regulatory Flexibility Analysis Regarding the Customer Due Diligence Requirements for Financial Institutions, 80 Fed. Reg (Dec. 24, 2015). 21 Customer Due Diligence Requirements for Financial Institutions, 79 Fed. Reg , (proposed Aug. 4, 2014). 6

7 In the NPRM, FinCEN certified that the proposed rule would not have a significant economic impact on a substantial number of small entities, again without obtaining any documented evidence to support its certification. However, FinCEN conceded that it had limited available information to assess a key driver of the cost to small businesses of the proposed CDD rule the average number of beneficial owners of each legal entity. 22 FinCEN relied only on anecdotal evidence that customers of small institutions do not frequently establish accounts for legal entities. 23 In addition, FinCEN has provided no data to support its conclusion that the proposed rule would require, on average, 20 minutes to perform the additional beneficial ownership identification, verification, and recordkeeping required by the proposed rule. The curious declaration that FinCEN had only limited available information does not dismiss FinCEN from engaging in usual activities to obtain more information a key reason why we have objected to the abbreviated comment period and why we continue to urge FinCEN to conduct more adequate fact finding to inform this rulemaking. The unfounded assumptions that FinCEN relied on are contradicted by feedback from our members, information suggested in discussions at the outreach sessions FinCEN and Treasury held in In those discussions, and in comments to the NPRM, many representatives of the financial sector gave clear indications of the costs the proposed rule would impose. Therefore, rather than certify that the rule would not have a significant impact, FinCEN could and should have engaged the industry to obtain a more statistically valid set of data on which it could have relied. FinCEN did not so engage and, as a result, certification was inappropriate and adverse to the goals of sound policymaking. FinCEN s failure to provide anything more than anecdotal evidence to support its cost analysis also contravenes the Small Business Administration s RFA Guidance, which states that certifications that simply state that the agency has found that the proposed or final rule will not have a substantial economic impact on a substantial number of small entities are not sufficient under [the RFA]. 24 Thus, FinCEN inappropriately dispensed with an important requirement to promote accountability without obtaining any documented evidence to support its conclusion. Moreover, our experience suggests that FinCEN, in the 15 months it had to consider comments it received on the NPRM, could have collected and analyzed data to support its RFA analysis. In the excessively constrained time ABA has had to respond to the RIA and IRFA, we were able to collect responses from 16 community banks, and those responses seriously call into question the premise that the proposed rule will not have a substantial impact on a significant number of small entities. The results of that initial survey support the view that the proposed CDD rule would have a substantial impact on these small entities, information that undermines FinCEN s certification made with less information. Community banks that responded to the survey reported that, on average, each employee who would need to be trained on the new rule would have to receive three hours of training triple the amount of training time that FinCEN estimated in the IRFA would be required. This training time does not fully reflect the time that certain bank employees would have to spend preparing for, and running, multiple training sessions. In addition to the cost of staff time spent in training, these community banks would also incur training-related 22 Id. at Id. 24 OFFICE OF ADVOCACY, SMALL BUS. ADMIN., A GUIDE FOR GOV T AGENCIES: HOW TO COMPLY WITH THE REGULATORY FLEXIBILITY ACT 13 (May 2012) (hereinafter SBA GUIDANCE ), available at 7

8 expenses of nearly $13,000 per bank expenses not accounted for in the IRFA. Also, responding community banks reported they would need to spend 40 hours, on average, to update the bank s policies and procedures in response to the new rule, which represents another category of expense that the IRFA does not account for. In addition, the responding community banks reported that they would need an additional 32 minutes, on average, to open a new legal entity account if the new rule were in place, which exceeds the high end of FinCEN s estimate of minutes. FinCEN s RFA analysis also fails to provide meaningful discussion of the alternatives to the proposed CDD rule. The RFA statute requires each IRFA to contain a description of any significant alternatives to the proposed rule and lists four types of significant alternatives that should be considered. 25 This statutory requirement is the key provision of the IRFA, according to SBA s Guidance. 26 Despite the importance of this part of the IRFA, FinCEN devoted only one paragraph to its consideration of alternatives. 27 That paragraph provides a cursory analysis of two alternative thresholds to the 25% threshold in the proposed rule: one at 10% and one at 50%. The paragraph includes no quantitative analysis of the cost of setting the ownership threshold at different levels. When describing the potential benefits of setting the ownership threshold at 50% which would reduce the potential number of individuals that a financial institution would be required to verify from five to three the IRFA states only that such a change would reduce the cost of initial onboarding time marginally and would not impact training or IT costs. 28 No support is provided for these conclusions. The IRFA s approach completely misses the standards set by the RFA, as reinforced by SBA s Guidance, that agencies provide full consideration of alternatives. Moreover, the IRFA is based on unsubstantiated assumptions and responses from a tiny number of small financial institutions. Despite the SBA Guidance s direction that the IRFA should provide a detailed analysis of the potential impact of the proposed rule on small entities, 29 the IRFA is based on responses from only several financial institutions, including only three small financial institutions. 30 As discussed above, the IRFA s estimates of the additional costs at account opening are based on telephone interviews conducted with an unknown number of financial institutions; these estimated costs are not based on a larger survey of institutions. FinCEN also relied on an assumption that only one or two individuals would be identified, on average, as beneficial owners for each legal entity account opened at a small institution, and that a small financial institution has 125 employees, on average. 31 Because these data points are critical to FinCEN s evaluation of the cost of the proposed CDD rule, FinCEN should have relied on empirical data, not assumptions, for these data points. Under these circumstances, FinCEN s analysis of the impact of the proposed rule on small entities is wholly inadequate and incompatible with the RFA s requirements. FinCEN has failed to account for costs that small financial institutions would incur as a result of the proposed rule and, when FinCEN did credit a cost, often significantly underestimated that cost. ABA urges FinCEN to work with industry to develop meaningful data that would properly support more adequate policymaking regarding costs that will guide FinCEN s work U.S.C. 603(c). 26 SBA GUIDANCE, supra note 24, at Initial Regulatory Flexibility Analysis for FinCEN Notice of Proposed Rulemaking: Customer Due Diligence Requirements for Financial Institutions, Docket No.: FinCEN , 9-10 (hereinafter, IRFA ). 28 Id. at SBA GUIDANCE, supra note 24, at 32 (emphasis added). 30 IRFA, supra note 27, at IRFA, supra note 27, at 4 & 7. 8

9 B. The Regulatory Impact Assessment is Inconsistent with Executive Orders and Presidents Clinton and Obama issued Executive Orders and 13563, respectively, to promote greater awareness of and minimize, where possible the cost to private entities of regulations. Pursuant to these Executive Orders, agencies are required to perform the costbenefit analysis that comprises the RIA. FinCEN has disregarded these Executive Orders by providing an analysis that rests on assumption rather than data, even though quantifiable data are available. In its RIA, FinCEN explains that, due to the difficulties associated with estimating the benefits of the proposed CDD rule, FinCEN applied a threshold or breakeven analysis to evaluate the proposed rule s costs and benefits. Under such an analysis, the agency asks how large the present value of benefits has to be so that it is just equal to the present value of costs. 32 The agency then determines whether the benefits could plausibly exceed those costs. A breakeven analysis may be appropriate when quantification [of benefits and costs] is speculative or impossible. 33 As discussed below, quantification of the benefits and costs of the proposed CDD rule is possible, but FinCEN has chosen not to do the work. As a result, ABA believes a breakeven analysis is inappropriate for this rulemaking. FinCEN chose to provide a qualitative breakeven analysis even though the White House s Office of Information and Regulatory Affairs (OIRA) has emphasized the importance of quantifying costs, stating that the benefits and costs should be quantified and monetized to the extent possible. 34 Instead, FinCEN s analysis relies on unsubstantiated assumptions about the benefits of the proposed rule. For example, the RIA fails to quantify the reduction in criminal activity that it expects to occur as a result of implementation of the proposed rule. It also assumes that the proposed rule would reduce the cost to law enforcement agencies of obtaining beneficial ownership information, but makes no attempt to quantify the value of the saved time, information that should be available since these are costs that the agencies are presumably experiencing. Finally, the RIA expect[s] that, as a result of the proposed rule, recovery of assets by federal authorities would rise, 35 but, again, makes no effort to quantify the amount of increased recovery. 32 RIA, supra note 6, at OFFICE OF INFO. & REGULATORY AFFAIRS, OFFICE OF MGMT. & BUDGET, EXEC. OFFICE OF THE PRESIDENT, REGULATORY IMPACT ANALYSIS: A PRIMER 13 (Aug. 15, 2011), available at 34 Id. at RIA, supra note 6, at 18. 9

10 III. The RIA s and IRFA s Costs Underestimate, or Ignore Entirely, Costs that the Proposed CDD Rule will Impose on Financial Institutions FinCEN s cost-benefit analysis under both the RFA and RIA underestimates or fails to quantify many of the costs that could have been quantified, including the following: A. Staff Costs FinCEN s estimate of the increase in staff-related costs resulting from the proposed CDD rule are based on such a small survey of institutions that they cannot reasonably be relied upon, are not reflective of the complexity of verifying the identities of beneficial owners, and are inconsistent with the results of the brief survey ABA has been able to conduct within the constrained comment period. Employee Training: The RIA posits that between one-third and two-thirds of bank employees would be trained on the proposed CDD rule annually and estimates 30 to 60 minutes of training per employee in the first year, and 10 to 15 minutes of refresher training in subsequent years. 36 This estimate is greatly understated. ABA s survey of member banks, ranging in size from 18 employees to over 13,000 employees, affirmed that the complexity of the proposal will require significant training, far more than the estimated amount used to develop the RIA. Overall, banks that responded to ABA s survey reported that, on average, each employee to be trained on the new rule would receive nearly three times the amount of training that the RIA estimates is needed. In addition, surveyed banks reported they would incur nearly $15,000 in out-of-pocket expenses per bank, on average, to design and conduct training expenses that the RIA does not account for at all. Moreover, the proposed rule will require bank employees to identify the beneficial owners of legal entity customers. Determination of who exercises control of a business, however, often requires a complex legal analysis. Indeed, this assessment will require employees to have a fundamental understanding of the variety of legal structures to determine the right information to collect or to help the customer know what to provide. This will require extensive training for those employees who open deposit or loan accounts for commercial customers. Account Opening (Incremental Onboarding): FinCEN estimates that the additional information required for the proposed rule would add between 15 to 30 minutes of additional banker time to open a legal entity account. 37 Using clerical labor wages from the Bureau of Labor Statistics, FinCEN calculates each bank s increased costs to be $16.77 per account. 38 This calculation would produce a total cost to the industry of $265 million to $330 million. In addition, FinCEN assumes customers will incur an aggregate cost to comply with these new mandates of between $358 million and $716 million annually to produce the information needed. This estimate depends on the assumption that customers walk in the door with all the necessary information assembled, and that they are ready to complete the form. ABA strongly questions that premise. A more likely scenario is that bankers will need to explain the purpose of the form 36 RIA, supra note 6, at Id. at Id. 10

11 and how to complete it, including explaining what is meant by beneficial owner and controlling party. It can be expected that customers also will need time to assemble the necessary information, which in turn will require banks to track missing information and verify that a fully completed form has been filed. 39 However, FinCEN s estimate does not factor in this additional time. Moreover, in the first years after the rule is adopted, it will take far longer since customers will not be familiar with the mandate and will be more likely to resist providing the information. 40 As a further oversight, FinCEN makes no estimate of the number of potential customers who are dissuaded from opening an account by this increase in the time and bother. B. Information Technology Costs Despite receiving comments from financial institutions that IT costs would be large, 41 FinCEN does not provide an overall estimate of the costs that would be incurred by financial institutions for upgrading existing IT systems to comply with the proposed CDD rule. Notably, FinCEN s approach to IT costs i.e., to state that costs cannot be accurately quantified and thus do not warrant inclusion in the overall cost calculation is inconsistent with the agency s inclusion in its cost-benefit analysis of benefits that are similarly difficult to quantify for example, the assumed decrease in illicit activity. Whether a bank purchases software from a third-party vendor or develops it in-house, financial institutions universally identify BSA/AML software as a significant expense. In order to develop an accurate cost-benefit analysis, reasonable effort is needed to approximate the impact the rule will have on IT costs, particularly since commenters have raised the issue. While it may be difficult to determine an amount with precision, it is inappropriate to decide not to quantify any aggregate increase in IT costs. Certainly, an attempt to quantify and aggregate this amount would be just as important as reasonable efforts to identify and document expected benefits, which FinCEN currently merely asserts. Instead, FinCEN fails to credit the costs (which are undeniably real) while justifying its entire rule on the benefits (which are speculative at best), offering little to no factual foundation for either. For example, one issue that banks identified in comments to the proposal is the need to develop software that allows them to track beneficial owners. Currently, bank systems do not, as a general rule, identify or track these individuals. Therefore, at a minimum, all financial institutions will have to build systems or purchase (yet-to-be developed) software to track beneficial ownership information. And once tracking systems are developed or added into existing systems, all the new data processing capacity will have to be integrated into other systems, such as SAR monitoring and reporting programs. Banks will also incur additional costs for account opening platforms to be able to process the new forms and integrate the information into existing systems. However, FinCEN s cost estimate does not factor in the cost of these system changes. Although third-party vendors are likely to provide most institutions particularly small community banks with the necessary software to comply with the proposed rule, the bank will incur a cost 39 The amount of time needed to collect necessary information should also reflect the time needed to contact and collect information from individuals who literally may be located around the globe, including the time spent addressing complications that other jurisdictions privacy and data security restrictions may impose. 40 ABA members often report about experiences with customers being reluctant to provide personal information (such as date of birth), especially at a time when there are increasing concerns about identity theft and data security. Customers often see this as an invasion of privacy, which bankers have to overcome to collect the mandated information. Not infrequently, potential customers drop out of the process. 41 RIA, supra note 6, at

12 to purchase or license the software. In addition, all institutions will need to adapt and adjust the software and test it for compatibility with existing systems, which takes time by IT, compliance and line-of-business employees. Recent reports about implementation of the new mortgage rules demonstrate that it is a specious assumption that software can simply be plugged in to an institution s existing system and be fully operational immediately. 42 C. Other Sources of Cost to Financial Institutions FinCEN s cost-benefit analysis fails to consider other costs that financial institutions would incur to comply with the proposed CDD rule, including costs to change an institution s procedures and internal controls and costs associated with loss of business (either from customers who walk away or those who present excessive uncertainty to allow banks to comply confidently with regulatory requirements). FinCEN asserts that because financial institutions have been subject to customer identification program (CIP) rules for more than ten years institutions should be able to leverage these procedures in complying with this requirement. 43 This vastly underestimates the impact the proposed CDD rule would have on account opening procedures and BSA/AML monitoring. When a financial institution collects additional information about its customers, regulators will expect new procedures and controls to be established to track and process that information. ABA s survey shows that, on average, the proposed rule will require 56 staff hours solely to update the bank s policies and procedures. These aspects of an institution s compliance program are particularly important since internal controls are one of the four pillars of an antimoney laundering compliance program. It will take time for banks to identify affected policies and procedures and ensure appropriate updates are implemented. Certainly, some allowance is needed to reflect this. In addition, the increased investigation and Suspicious Activity Reporting (SAR) costs that institutions will incur should be but are not factored into FinCEN s cost-benefit analysis. Curiously, the RIA recognizes additional costs that may be incurred by law enforcement conducting investigations. But, when it comes to the increased SAR-related costs that institutions will incur, the RIA states that the proposed rule s impact is ambiguous, claiming that the increase in SAR filings would be offset by the capacity of newly collected beneficial ownership data to remove some flagged transactions from suspicion. 44 It is hard to see that costs imposed on the enforcement community disappear when applied to financial institutions. This factor is speculative and not supported by any evidence. Notably, 76% of respondents to ABA s survey reported that they anticipate that complying with the proposed rule will result in additional time spent investigating accounts and inappropriate cases, and the filing of a SAR. This is clearly an added cost that should be factored into FinCEN s cost-benefit analysis. We must again emphasize the significant cost dismissed by FinCEN of customers being discouraged from opening accounts and those cases where excessive uncertainty makes it difficult for banks to open accounts with confidence of complying with the new requirements. This is a significant concern, as noted by the Treasury Acting Under Secretary for Terrorism and Financial Intelligence, Adam Szubin, last November. 45 FinCEN believes that the new rule is 42 The scope of IT costs will be further impacted by the need to obtain careful regulatory guidance as questions arise during the implementation process. 43 IRFA, supra note 27, at RIA, supra note 6, at Adam J. Szubin, Dir., Office of Foreign Assets Control, U.S. Dep t of the Treasury, Remarks at the American Bankers Association s Money Laundering Enforcement Conference (Nov. 16, 2015). 12

13 unlikely to trigger legitimate account holder closings or to dissuade legitimate would-be new account holders from opening new accounts, 46 even though the agency acknowledges that a study of a similar rule adopted by the European Union (EU) concluded that the EU s rule could drive some account holders to relocate their assets to foreign jurisdictions where the policies do not apply. 47 The assertion by FinCEN is the triumph of hope over experience, a poor foundation for rulemaking. In the current environment, ABA believes that the increased risk from incomplete or questionable information on beneficial ownership will cause lost accounts from legitimate customers. IV. The Absence of Statistical Data Underlying the Bureau s Cost Assumptions Renders the Rule Vulnerable to Legal Challenge The absence of statistical data underlying the Bureau s assumptions regarding the proposed CDD rule s costs renders the rule vulnerable to legal challenge under the Administrative Procedure Act (APA). A 2011 decision by the U.S. Court of Appeals for the District of Columbia Circuit, Business Roundtable v. Securities and Exchange Commission, 48 made clear that a court will vacate a rule if the issuing agency fails to assess adequately the economic effects of that rule. In Business Roundtable, the D.C. Circuit held that the Securities and Exchange Commission (SEC) acted arbitrarily and capriciously in failing to assess adequately the economic effects of a rule. Specifically, the court concluded that the Commission inconsistently and opportunistically framed the costs and benefits of the rule; failed adequately to quantify the certain costs... ; neglected to support its predictive judgments;... and failed to respond to substantial problems raised by commenters. 49 These same criticisms apply to the proposed CDD rule. Overall, FinCEN factored into its costbenefit analysis benefits of the proposed CDD rule that are difficult to quantify and, in many cases, highly speculative but chose not to factor into that analysis costs that are similarly difficult to quantify but undeniably certain. The dissimilar treatment between benefits and costs of the proposed rule is arbitrary. For example, FinCEN lists the following as benefits: The reduction in the cost to law enforcement agencies of obtaining beneficial ownership information, 50 An expected rise in the recovery of assets by federal authorities, 51 A potential increase in tax revenue through improved tax compliance, 52 and Enhanced reputational benefits for the United States and financial institutions of meeting international policy standards RIA, supra note 6, at Id. 48 Business Roundtable v. Securities and Exchange Commission, 647 F.3d 1144 (D.C. Cir. 2011). 49 Id. at RIA, supra note 6, at Id. 52 Id. at Id. at

14 For each of these alleged benefits of the proposed rule, FinCEN declines to quantify the benefit, but nonetheless credits the benefit in its cost-benefit analysis, effectively asserting that the value of the benefits is so high as to overwhelm any costs. By contrast, when discussing potential costs of the new rule such as responding to increased SAR reporting and increased investigations, prosecutions, and incarcerations FinCEN states that even predicting the directions of the changes in law enforcement due to the proposed rule can be difficult, so any attempt at estimating magnitudes would be speculative. 54 Because FinCEN finds it too difficult to quantify these costs, FinCEN decides to disregard these costs. In FinCEN s analysis, benefits are significant, costs not worthy of notice, and neither of which merit any effort at quantification or factual support. In sum, FinCEN s inconsistency in crediting difficult-to-quantify benefits in its cost-benefit analysis but disregarding difficult-to-quantify costs is arbitrary and thus inconsistent with the precepts of the APA. V. The RIA Overstates the Benefits of the Proposed CDD Rule In calculating the estimated benefits, FinCEN relies on a number of other questionable assumptions which result in the RIA significantly overstating the benefits that will be achieved by the proposed CDD rule. First, FinCEN bases its analysis of the proposed rule s benefits on a speculative reduction in illicit proceeds from criminal activity. While the RIA presents this figure as definitive, the Department of the Treasury report on which the calculation is based, the 2015 National Money Laundering Risk Assessment, acknowledges that it is an estimated amount. 55 Specifically, FinCEN uses Treasury s $300 billion estimate of the amount generated annually in illicit proceeds and goes on to conclude that even a modest reduction of 0.57 percent in annual U.S. real illicit proceeds would outweigh its costs. 56 However, there is nothing to demonstrate that the rule, if adopted, would reduce criminal activity, either by 0.57 percent or by any amount. A case could be made that there will be increased criminal activity by driving more businesses into the informal sectors for financial services. These hypotheses should be rigorously tested before they are used to justify new regulations. Second, significant deficiencies in the proposed rule would vastly reduce the benefit FinCEN assumes in its cost-benefit calculation. As ABA and others have commented repeatedly, the proposed rule requires financial institutions to require legal entities to complete a form identifying the beneficial owners. It does not require the verification of the accuracy of the information provided, and currently there is no registry that would permit that verification. This fact undermines the efficacy of the proposed rule and substantially reduces any potential benefit. An individual interested in evading the rule can and will merely provide false information at account opening, creating a façade of legitimacy from which it could possibly operate for some time. Similarly, the proposed rule only requires financial institutions to identify beneficial owners that are natural persons. As a result, individuals interested in evading the rule 54 Id. at U.S. DEP T OF THE TREASURY, NAT L MONEY LAUNDERING RISK ASSESSMENT (2015). The RIA s reliance on the Treasury Department s estimate of U.S. illicit proceeds is misplaced, because the Treasury Department acknowledged there are distinct limitations in the data sets it used to produce that figure and that [i]t is difficult to estimate with any accuracy how much money is laundered in the United States. Id. at 2. The RIA should consider with care a costbenefit analysis resting on such a weak foundation, without further reliable facts in support. 56 RIA, supra note 6, at 2. 14

15 and identification of the true owners of an entity might simply create a shell company. The proposed rule will do nothing to uncover shell companies. FinCEN has not addressed either of these shortcomings in its cost-benefit analysis. A third flawed premise of the RIA is that the proposed rule will facilitate the identification of tax scofflaws and thereby help the Internal Revenue Service (IRS) determine whether information has been accurately reported by beneficial owners. However, it is not clear how adoption of the CDD proposed rule would confer this proposed benefit. We have suggested drawing upon IRS data to help verify beneficial ownership claims, but FinCEN has not taken up that recommendation. The RIA also makes implausible assumptions regarding the rule s impact on the behavior of private entities. FinCEN posits that uniform application of AML standards will prevent companies from migrating to other jurisdictions. 57 That premise is not substantiated by existing experience. Numerous other countries have weak AML standards or, if they have strong AML standards, do not enforce their standards. 58 Thus, it is reasonable to expect that criminals will seek and identify the weakest AML jurisdictions and route their illicit activity through those jurisdictions. Another speculative benefit relied upon by FinCEN is that the rule will provide reputational benefits for the federal government and the private sector. In this regard, the rush to finalize the CDD rule may be in response to FATF s 2006 criticism of the United States customer due diligence requirements. However, until governmental registries are in place, it is not clear that a CDD rule that collects non-verifiable information will satisfy international standards. Finally, the RIA overstates the benefits of the proposed rule s impact on crime reduction by failing to account for the increased costs of the additional investigations that will need to be conducted into the new suspicious information filed by financial institutions, many of which cases will likely be found to have involved no illegal activity. Although the RIA states that the proposed rule may increase costs related to investigations, prosecutions, and incarcerations, the RIA dismisses these likely additional costs as speculative. This approach is inconsistent with the RIA s treatment of the rule s expected benefits resulting from an expected decrease in illicit activity and increase in asset recovery, among other benefits cited. Put simply, the RIA cannot, in good faith, credit potential but speculative benefits, but dismiss costs that are similarly potential but speculative. VI. Conclusion The cost-benefit analyses of the proposed CDD rule in the RIA and IRFA reach inaccurate conclusions, because these analyses make assumptions regarding cost that are unrealistically low and are unsupported by meaningful data. Conversely, the RIA and IRFA credit speculative benefits, while they discount factors that might constrain the rule s hoped-for benefits. Moreover, the process leading to the creation of the RIA and IRFA contravene the Regulatory Flexibility Act and Executive Orders and 13563, by failing to ensure that the likely impact of the rule on private entities is fully understood. We urge FinCEN not to adopt a final rule based on the existing RIA or IRFA, given the problems we have identified with the analysis. 57 RIA, supra note 6, at In fact, FinCEN recently published guidance on the FATF identification of jurisdictions that have flawed AML programs. 15