Electronic Banking. Law & Commerce

Transcription

1 REPORT Electronic Banking Law & Commerce November 2007 n Volume 12 n Issue 9 Proposed Internet Gambling Regulation Would Require New Policies and Procedures for the U.S. Payments System B y J o n a t h a n W i n e r a n d K a t h r y n M a r k s Jonathan Winer (jwiner@alston.com), a partner at Alston & Bird ( represents domestic and foreign clients on regulatory and enforcement matters as well as on a wide range of government affairs issues including money laundering, sanctions, national security, and data protection and management, and information security and privacy. Kathryn Marks (Kathryn.marks@alston.com) is an associate in the Legislative and Public Policy Group in Alston & Bird s Washington DC office. Her practice includes payment system issues, information privacy and data security. Overview One year following the enactment of the Unlawful Internet Gambling Enforcement Act of 2006 ( UIGEA ), the Federal Reserve Board ( Fed ) and the Department of the Treasury ( Treasury ) (collectively, federal regulators ), have released a joint notice of a proposed regulation implementing the law banning the use of the U.S. payments system to process any illegal Internet gambling transaction. The proposed regulation would require financial services companies subject to U.S. jurisdiction that participate in any of five types of payments automated clearing house ( ACH ) activities, card payments, check collection, money transmission or wire transfers to implement policies and procedures that are reasonably designed to prevent or prohibit the processing of prohibited Internet gambling transactions. The proposed regulation contains limited exemptions for situations where identification and blocking of Internet gambling Continued ON PAGE 4 Content HIGHLIGHTS Proposed Internet Gambling Regulation Would Require New Policies and Procedures for the U.S. Payments System By Jonathan Winer and Kathryn Marks...1 Health Savings Accounts: An Overview By Timothy R. McTaggart and Andrew Maher Emerging Trends: Privacy Litigation Growing Concern for Merchants By Deborah Thoren-Peden Complete Table of Contents listed on page

2 Electronic Banking Law & Commerce Report Table of CONTENTS Proposed Internet Gambling Regulation Would Require New Policies and Procedures for the U.S. Payments System By Jonathan Winer and Kathryn Marks...1 From the EDITOR David E. Brown, Jr., Alston & Bird LLP...3 Health Savings Accounts: An Overview By Timothy R. McTaggart and Andrew Maher...13 Emerging Trends: Privacy Litigation Growing Concern for Merchants By Deborah Thoren-Peden...16 Selected Federal Legislative Developments By Kathryn Marks...18 Selected Regulatory Developments By Scott Anenberg...19 Free Service for Subscribers Online Editions Now Available West Legalworks is pleased to announce that this newsletter is now available on the Internet to Subscribers of the print edition. The online version offers additional interactive capabilities that enhance the usefulness of your subscription including Search features for current and archived articles and Links to other information and Westlaw cases. To take advantage of this service, please visit to register or call Editorial Board Editor-in-Chief: David E. Brown, Jr. Alston & Bird LLP Washington, DC Managing Editor: Elizabeth Thompson Contributing Editors: Scott A. Anenberg Meyer, Brown, Rowe & Maw LLP Washington, DC Kathryn Marks Alston & Bird LLP Washington, DC EDITORIAL BOARD: Roland E. Brandel Morrison & Foerster LLP San Francisco, CA Russell J. Bruemmer Wilmer Cutler Pickering Hale & Dorr LLP Washington, DC Thomas Hal Clarke Senior Vice President and Deputy General Counsel, Wachovia Corp. Kelly McNamara Corley Senior Vice President and General Counsel, Discover Financial Service, Inc. Ellen d Alelio Steptoe & Johnson Washington, DC John L. douglas Paul, Hastings, Janofsky & Walker LLP Atlanta, GA Paul R. Gupta Orrick, Herrington & Sutcliffe LLP New York, NY Henry L. Judy Kirkpatrick & Lockhart Preston Gates Ellis LLP Washington, DC Sylvia Khatcherian Managing Director, Legal Department Morgan Stanley C.F. Muckenfuss III Gibson, Dunn & Crutcher LLP Washington, DC John C. Murphy, Jr. Cleary, Gottlieb, Steen & Hamilton Washington, DC P. Michael Nugent Executive Vice President and General Counsel IntelliRisk Management Coporation Brian W. Smith Latham & Watkins LLP Washington, DC Stuart G. Stein Hogan & Hartson LLP Washington, DC Thomas P. Vartanian Fried, Frank Harris, Shriver & Jacobson Washington, DC Mark A. Weiss Covington & Burling Washington, DC Richard M. Whiting General Counsel and Executive Director The Financial Services Roundtable Electronic Banking Law & Commerce Report West Legalworks 395 Hudson Street, 6th Floor New York, NY One Year Subscription n 10 Issues n $ (ISSN#: XXXX) Please address all editorial, subscription, and other correspondence to the publishers at west.legalworksregistration@thomson.com For authorization to photocopy, please contact the Copyright Clearance Center at 222 Rosewood Drive, Danvers, MA 01923, USA (978) ; fax (978) or West s Copyright Services at 610 Opperman Drive, Eagan, MN 55123, fax (651) Please outline the specific material involved, the number of copies you wish to distribute and the purpose or format of the use. West Legalworks offers a broad range of marketing vehicles. For advertising and sponsorship related inquiries or for additional information, please contact Mike Kramer, Director of Sales. Tel: mike.kramer@thomson.com. This publication was created to provide you with accurate and authoritative information concerning the subject matter covered. However, this publication was not necessarily prepared by persons licensed to practice law in a particular jurisdication. The publisher is not engaged in rendering legal or other professional advice, and this publication is not a substitute for the advice of an attorney. If you require legal or other expert advice, you should seek the services of a competent attorney or other professional. Copyright is not claimed as to any part of the original work prepared by a United States Government officer or employee as part of the person s official duties.

3 November 2007 n Volume 12 n Issue 9 From the EDITOR A year after the Unlawful Internet Gambling Enforcement Act of 2006 was signed into law Jonathan Winer and Kathryn Marks of Alston & Bird take an in-depth look at the proposed regulation that would implement the law. They discuss areas of compliance uncertainty and some of the major policy issues financial institutions would face if the regulation was adopted. The regulations cover financial service companies subject to U.S. jurisdiction that participate in a number of types of payments. Interested parties have until December 12 to comment on the regulations. In the wake of ChoicePoint s and TJX s data breaches, Deborah Thoren-Peden, of Pillsbury Winthrop Shaw Pittman, surveys recent developments in privacy litigation from merchants perspective. Timothy McTaggart and Andrew Maher, of Pepper Hamilton, provide an overview of health savings accounts (HSAs). At the beginning of 2007, an estimated 3 million people were covered by HSAs, up from only 438,000 people in The Treasury Department expects that number to grow to between 14 and 21 million by 2010, representing a huge potential source of investable assets. And finally, our regular columns summarize recent legislative and regulatory developments include important updates regarding pending legislation to renew the Terrorism Risk Insurance Act, a recent court decision upholding a Connecticut ban on stored-value card dormancy fees, and recently issued FACT Act final regulations regarding identity theft red flags and affiliate marketing. David E. Brown, Jr., Alston & Bird LLP

4 Electronic Banking Law & Commerce Report Continued from PAGE 1 payments may not be technologically feasible for some participants in the ACH system, check collection systems and wire transfers, based on their relationship to the flow of funds. Companies who implement the reasonably designed policies and procedures provided as examples in the proposed regulation would be deemed by federal regulators to be in compliance with the law. The proposed regulation does not directly regulate institutions or transactions outside the United States. Accordingly, it is likely to encourage circumvention through the use of payments systems outside the United States in the many jurisdictions in which Internet gambling is lawful. These uses could include techniques to disguise restricted transactions or integrate them into lawful forms of funds, such as foreign bank accounts or stored value cards, prior to their repatriation to the United States. The proposed regulation may also raise concerns about regulatory burden due to the impact of implementation costs on U.S.-based participants in the payments system that are not applicable to similarly situated foreign firms. Its coverage of all forms of cards, including debit cards, storedvalue cards and pre-paid cards as well as credit cards without any exemption for gift cards is unprecedented in scope. Many companies involved with selling such products have had little or no prior direct regulation by the federal government. Moreover, the proposed regulation mandates ongoing monitoring by companies involved in cardrelated transactions and by money transmitters of the Web sites of their commercial users on a global basis. The proposed regulation would require such monitoring to detect unauthorized use of the relevant designated payments system and the unauthorized use of the relevant designated payments system trademarks. Domestic depository institutions may have concerns about complying with the proposed regulation s request for intensified due diligence on foreign commercial companies making use of foreign correspondent banks for what might be restricted transactions. Domestic depository institutions may also have concerns about the proposed regulation s direction that they consider closing correspondent relationships with foreign banks that handle restricted transactions involving U.S. persons even when such transactions are lawful in the foreign jurisdiction where that bank is regulated. This article provides an overview of the proposed regulation and on areas of compliance uncertainty arising from its failure to provide guidance on critical issues, such as assessing what transactions are restricted transactions given the failure of the law or regulation to specify which forms of Internet gambling are legal and which are illegal. This article also identifies some of the major policy issues raised by the regulation, which include financial institutions concern about its extraterritoriality, the problem of lawful circumvention and the regulation s potential implications for areas of online gambling, especially horseracing, that remain of uncertain (and disputed) legality. Comments on the proposed regulation are due December 12, The proposed regulation invites those affected to address whether its provisions are likely to create undue regulatory burden and the feasibility of implementing the examples suggested by the federal regulators as mechanisms to achieve compliance. It also invites responses as to whether the exemptions in the proposed regulation could create opportunities for evading its goals. The federal regulators have proposed that the final regulation take effect six months after the final regulation is published, placing the likely earliest effective date into the final weeks of the Bush administration, or beyond to that of its successor. Definitions The proposed regulation adopts definitions of some key terms, such as automated clearing house, card system and money transmitting business, provided in existing regulatory or statutory provisions. It does not define gambling-related terms or provide guidance on which types of Internet gambling activities are legal or illegal. Under the proposed regulation, the term participant in a designated payment system is defined very broadly to include essentially all participants in the payments system and all financial transaction providers, except to the extent such a participant is acting at the time as a customer or end-user of the transaction:

5 November 2007 n Volume 12 n Issue 9 an operator of a designated payment system, or a financial transaction provider that is a member of or, has contracted for financial transaction services with, or is otherwise participating in, a designated payment system. This term does not include a customer of the financial transaction provider if the customer is not a financial transaction provider otherwise participating in the designated payment system on its own behalf. 1 This position parallels the current state of federal law, which does not provide for criminal penalties for individuals that may gamble online, but rather prohibits gambling operators from accepting bets or wagers. Covered Payments Systems The proposed regulation requires essentially all participants in the payments system to impose effective controls on prohibited Internet gambling payments, including those participating in the ACH system, card systems (including credit, debit and pre-paid cards or stored value cards), check collection systems, money transmitting businesses or wire transfer systems. Federal regulators declined the authority given them by UIGEA to exempt any element of the payments system if it is not reasonably practical for it to prevent or prohibit a restricted transaction. Instead, the proposed regulation requires each covered entity to identify and block restricted transactions wherever it is feasible to do so, and then specifies certain situations in which a company would be understood, due to its location in the payments system, as not having sufficient information to take such steps. Automated Clearing House System The ACH system provides for the clearing and settlement of batched electronic entries for participating financial institutions. Under the proposed regulation, ACH participants would be required to identify and block restricted transactions whenever the ACH payment system participant has a direct customer relationship with the Internet gambling operator, but not in other cases. Thus, the proposed regulation requires the originating depository financial institution ( ODFI ) in an ACH debit transaction and the receiving depository financial institution ( RDFI ) in an ACH credit transaction to prohibit restricted transactions. The federal regulators stated that in these two situations, the institution has a relationship with a customer engaged in an Internet gambling transaction and with reasonable due diligence could determine whether the customer s business might involve restricted transactions. By contrast, the proposed regulation would exempt the ODFI in an ACH credit transaction and the RDFI in an ACH debit transaction from having to put transaction blocking procedures in place for those transactions (except in cross-border transactions) given the difficulty of due diligence on such transactions. Card Systems The proposed regulation requires participants in card systems to block all prohibited Internet gambling transactions. Its coverage of the use of cards for Internet gambling is comprehensive, covering not only credit cards, but debit cards, pre-paid cards and stored-value products. It defines card system as a system for clearing and settling transactions in which credit cards, debit cards, pre-paid cards, or stored value products, issued or authorized by the operator of the system, are used to purchase goods or services or to obtain a cash advance. 2 Implicitly, this definition includes gift cards, which previously have not been regulated by the federal government, and thus in theory would require that issuers of gift cards also have anti-internet gambling controls applicable to the cards. 3 According to the guidance provided by the proposed regulation, no authorization can occur for any of these types of card transactions without the authorization request including (a) the card number, (b) transaction amount, (c) a merchant category code that describes generally the nature of the merchant s business and (d) a transaction code, which indicates if the transaction was handled in person or remotely. According to the guidance, the coding process provides sufficient information to determine if a transaction is a gambling transaction (from the merchant category code) and whether

6 Electronic Banking Law & Commerce Report a transaction was initiated over the telephone or Internet (as opposed to in a licensed casino, which would make the payment lawful). The federal regulators therefore found that all card transactions could be identified by the financial transaction provider as a restricted transaction and subsequently blocked. These assessments by the federal regulators may be challenged by some market participants in the comment process. At present, there is no practical way to differentiate a telephone or Internet gambling transaction that may be lawful from one that is not. As stated previously, neither UIGEA nor the proposed regulation provides any guidance as to what types of Internet gambling may currently be legal. The Department of Justice ( DOJ ) considers all Internet gambling to be illegal, but this position is at odds with the absence of enforcement activity by the DOJ against parimutuel betting operations that every day engage in transactions in the United States using most or all of the forms of payment mechanisms covered by the proposed regulation. If there is no way to differentiate pari-mutuel betting transactions from transactions that are by definition illegal (Internet sports gambling), one practical consequence might be that transactions that may well be legal will likely also be blocked under the proposed regulation. A similar problem potentially pertains to the use of payments mechanisms to pay for lawful brick-and-mortar transactions at casinos that are licensed by states or Indian tribes. Check Collection Systems The proposed regulation defines check collection system as an interbank system for collecting, presenting, returning, and settling checks or intrabank system for settling checks deposited in and drawn on the same bank. The proposed regulation would require the institution serving as the depository bank to block transactions involving prohibited Internet gambling transactions, as this particular institution would receive the check deposit directly from the gambling business and would therefore be in a position, through reasonable due diligence, to identify the nature of the business seeking to deposit the check. Similar to ACH transactions, the proposed regulation would, however, exempt participants in this payment system from being required to block prohibited Internet gambling transactions to the extent that the participant does not have a direct relationship with either the payor or the payee and is thus not in a position to identify the purpose or nature of a particular transaction. Thus, transaction blocking is not required under the proposed regulation for a check clearing house, the paying bank (unless it is also the depository bank), any collecting bank other than the depository bank or any returning bank. Again, this provision of the regulation raises substantial issues about circumvention, as a U.S.- based gambler could in principle send funds by check to a depository bank in another jurisdiction, such as the United Kingdom, where Internet gambling is legal, thereby avoiding the prohibition. The individual could receive any gambling proceeds by check for deposit through the U.S. depository bank so long as the check did not identify itself as relating to online gambling. Money Transmitting Businesses Money transmitting businesses are defined by federal regulation as businesses, other than depository institutions, that engage in the business of funds transmission either domestically or internationally. Although the operational specifics may vary, the proposed regulation treats all money transmitting businesses the same. There are no exemptions for money transmitting businesses under the proposed regulation, reflecting the determination by the federal regulators that in every transaction, the money transmitting business will know the identity of the entity to which money is being transferred and therefore there is no reason for an exemption to be granted. Here again, opportunities for circumvention could undermine the purposes of the proposed regulation and UIGEA through the use of foreignbased third parties who could transmit funds to and from gamblers and Internet gambling establishments, acting as middle-men in compliance with applicable laws in their own jurisdictions.

7 November 2007 n Volume 12 n Issue 9 Wire Transfer Systems The proposed regulation defines wire transfer system as a system through which an unconditional order to a bank to pay a fixed or determinable amount of money to a beneficiary upon receipt, or on a day stated in the order, is transmitted by electronic or other means through the network, between banks, or on the books of a bank. 4 The beneficiary s bank, as the institution receiving the wire transfer on behalf of the gambling operator, would be required to put into effect blocking mechanisms as it would be in a position to determine the nature of the customer s business and could therefore determine if that business involved restricted transactions. The proposed regulation would exempt the originator s bank and intermediary banks from these requirements, as the federal regulators view them not to be in a position to assess the nature and purpose of the transactions. Again, circumvention issues could arise to the extent that beneficiary banks were located outside the United States, Internet gambling is lawful in the jurisdiction in which they are regulated and they chose not to honor UIGEA outside the United States. Other Payments Systems The federal regulators are requesting comments on whether there are other emerging payments systems that should be included in the scope of the regulation, and whether there are non-traditional payments systems that could be used to circumvent the prohibition on processing restricted transactions. The federal regulators have stated that as technology develops, the proposed regulation could be updated to address changes in existing systems and development of new payments systems. Reasonably Designed Policies and Procedures General Overview Section 6 of the proposed regulation provides examples of policies and procedures for the covered payments systems that the federal regulators consider to be reasonably designed to prevent or prohibit unlawful Internet gambling transactions. In general, the policies and procedures should involve due diligence in the commercial customer relationship so that the payments system operator can ensure that the commercial customer is not originating or receiving restricted transactions. Additionally, the policies and procedures must include a response to the discovery that a particular customer is using the payments system to engage in restricted transactions. The federal regulators call for payments system participants to implement due diligence policies and procedures similar to those required by the Bank Secrecy Act, using a flexible risk-based approach to assess whether a particular commercial customer might be involved in Internet gambling activities. Additionally, the federal regulators are seeking comment on whether to explicitly include a requirement that payments system participants periodically confirm the nature of their customers business as part of the overall due diligence requirements. The proposed regulation also requires payments system participants to have policies and procedures in place to address situations in which a commercial customer is found to be engaging in restricted transactions. Such policies and procedures could include fines, restricting access to the payments system or terminating the customer s account. Additionally, the regulation requires appropriate remedial action to be taken against any business, whether a customer or not, if the payments system participant knows that the business is engaging in restricted transactions and is using the payments system participant s trademark to promote the restricted transactions. Additional monitoring of card systems and money transmitting businesses would be required under the regulation, including monitoring and analyzing payment patterns to identify any suspicious activity and monitoring of commercial Web sites on a global basis to detect use of the payments system involving its trademark, as might be done by a foreign gambling operator advertising that a particular payments mechanism involving the United States could be used to handle its transactions. The federal regulators expressly stated that since unlawful Internet gambling businesses could also use individuals as agents to receive restricted transactions to avoid the due diligence procedures required of the payments system, monitoring for

8 Electronic Banking Law & Commerce Report such activity would be required of card systems and money transmitting businesses. The proposed regulation does not contain a similar requirement for ACH, check collection and wire transfer systems because those systems, unlike the card and money transmitting systems, do not have the functionality required to perform such monitoring and analysis of payment patterns and other use. The federal regulators recognize that most Internet gambling operators are outside of the United States and the operators do not have relationships with U.S. banks, thus restricted transactions are likely to come from foreign financial institutions. However, the proposed regulation still requires card systems and money transmitting businesses to ensure that their policies and procedures address both domestic and international transactions. Essentially, the proposed regulation imposes a knowledge-based requirement for participants in these payments system, such that the participant in the payments system that has the direct relationship with the gambling operator would be responsible for preventing or prohibiting restricted transactions. For example, with respect to ACH transactions, the responsibility to block a restricted transaction would rest with the first participant in the United States receiving a transaction directly from a foreign institution. Other participants in ACH, check collection and wire transfer systems would largely be given a free pass, absent specific knowledge that a payment constitutes a restricted transaction. Although the federal regulators have indicated that some of UIGEA s requirements will not be imposed on certain payments systems due to technological issues, there are repeated statements in the proposed regulation that technology will be monitored and evaluated such that at some point in the future, additional requirements may be imposed on the previously exempted payments systems. Examples of Policies and Procedures by Payments System The proposed regulation provides non-exclusive examples of policies and procedures that designated payments systems could implement for identifying, blocking, or otherwise preventing or prohibiting the processing of a restricted transaction as means of complying with UIGEA. The examples are structured so as to function as a safe harbor for designated payments systems, making their adoption per se compliant with the proposed regulation, and leaving in doubt whether in practice any alternatives would be deemed by regulators to be sufficient. ACH Examples Under the proposed regulation, the policies and procedures of the ODFI and any third-party sender in an ACH debit transaction and the RDFI in an ACH credit transaction would be deemed to have reasonable policies and procedures to identify and block restricted transactions if they perform appropriate due diligence with respect to establishing or maintaining customer relationships. The proposed regulation indicates that appropriate due diligence would include the screening of potential commercial customers to determine the nature of their business and the use of contract terms prohibiting the commercial customer from engaging in restricted transactions. Additionally, the proposed regulation requires that they should have in place policies and procedures in the event it is discovered that the commercial customer is engaging in restricted transactions. Such policies and procedures would include the imposition of fines, restricting the commercial customer s ability to originate ACH debit transactions, or closing the account. The proposed regulation would require that policies and procedures of receiving gateway operators and third-party senders seeking to submit ACH debit transactions on behalf of a foreign bank, foreign third-party processor, or foreign originating gateway operator be similar to those outlined above for ACH participants engaged in wholly domestic transactions. Where foreign senders are determined to have sent ACH debit entries for restricted transactions to the receiving gateway operator or third-party sender, the proposed regulation suggests that ACH services to the foreign sender be denied and that in certain circumstances, the cross-border arrangements should be terminated. Finally, under the proposed regulation, an originating gateway operator that receives an ACH credit transaction containing instructions to send

9 November 2007 n Volume 12 n Issue 9 a credit entry to a foreign bank (either directly or through a foreign receiving gateway operator) should have policies and procedures in place to respond when the transaction is identified as a restricted transaction. In such situations, the originating gateway operator should consider whether the ACH credit transactions for the foreign bank or through the foreign gateway operator should be denied or whether the circumstances warrant the termination of the cross-border arrangements with the foreign bank. The implications of this approach could well be the subject of extensive comment, given its potential to require complex due diligence procedures for participants in the ACH system. Card System Examples Card system operators, merchant acquirers and card issuers will be deemed to have reasonably designed policies and procedures for identifying and blocking restricted transactions if they: screen potential merchant customers to determine the nature of their business and include language in the merchant customer agreement that the merchant may not receive any restricted transactions through the card system; establish transaction codes and merchant or business category codes that will enable the card system or card issuer to identify and deny authorization for restricted transactions; perform ongoing monitoring or testing to determine whether authorization requests are coded correctly and to detect suspicious patterns or volumes of transactions relating to a merchant customer; and have a response plan in place to address situations in which the merchant customer becomes aware that a merchant has received restricted transactions, including assessing fines or denying access to the card system. The applicability of these approaches to the use of cards to make payments to non-u.s. based merchant customers whose relationships are with foreign card systems operators, merchant acquirers and card issuers may constitute an area for comment by U.S. participants in the card systems that are uncertain about the extent to which their due diligence obligations could be deemed to reach payments involving foreign Internet gambling operators whose immediate relationship is with a foreign financial institution, rather than any domestic participant in the card system. Check Collection System Examples As stated previously, most participants in a check collection system are exempted by the proposed regulation, as imposing the requirements on these participants would be too costly and burdensome. However, the proposed regulation would apply to the depository bank, because the depository bank is in a position to know if the customer s business is an Internet gambling operation. Depository banks will be deemed to have reasonable policies and procedures to identify and block restricted transactions if they: conduct due diligence in establishing or maintaining a customer relationship by screening potential commercial customers to determine the nature of their business and include language in commercial customer agreements that the customer may not deposit checks that are restricted transactions; and implement procedures for addressing situations in which the depository bank becomes aware that the customer has deposited checks involving restricted transactions, including when checks should be refused and if the account should be closed. To be deemed to have reasonable policies and procedures where a depository bank receives a check directly from a foreign bank, the depository bank should: conduct similar due diligence with respect to the foreign bank to ensure that it will not send checks representing restricted transactions to the depository bank for collection and including in contractual agreements with the foreign bank that the foreign bank will have corresponding policies and procedures in place to ensure that checks involving restricted transactions will not be processed; and implement a response plan to address situations in which the foreign bank is determined to have sent checks involving restricted transactions to the depository bank, including when check collection services should be

10 Electronic Banking Law & Commerce Report denied and when the correspondent account should be closed. Interestingly, the proposed regulation does not make mention of the fact that many foreign banks are located in jurisdictions where Internet gambling is a legal activity, and thus there is no prohibition of the foreign bank accepting transactions involving Internet gambling operations of what might be considered a restricted transaction in the United States. Additionally, the proposed regulation does not address the attempt to impose U.S. law on these foreign banks by including contract language that requires the foreign banks to not accept transactions that are unlawful in the United States (but that are lawful in the jurisdiction in which the foreign bank operates). The burden imposed on the U.S. depository bank is not insignificant either, as the depository bank will have to continually monitor the correspondent banking relationship to determine if the foreign bank is submitting checks involving restricted transactions. Additionally, since depository banks must identify circumstances in which the correspondent account should be closed if the foreign bank submits checks involving restricted transactions, it is possible that long-term correspondent banking relationships could be terminated over the failure of a foreign bank to submit to U.S. law. For these reasons, the check collection examples may also give rise to significant comment by those potentially affected, given that it is not obvious that alternatives to the examples provided would be deemed reasonable alternatives by financial institution examiners. Money Transmitting Examples The policies and procedures of money transmitters will be deemed to be reasonably designed to identify and block restricted transactions if they conduct sufficient due diligence in establishing and maintaining the customer relationship. Such due diligence involves screening potential commercial subscribers to determine the nature of their business and including contract language prohibiting commercial subscribers from receiving restricted transactions. The money transmitter should also implement ongoing monitoring and testing procedures to detect restricted transactions, to detect suspicious payment activity and to detect unauthorized use of the money transmitter s business. The money transmitter should also have in place procedures to impose fines on the commercial subscriber, deny access to the system, or close the account in the event the commercial subscriber is found to be using the money transmitter for processing restricted transactions. The regulation does not address how the money transmitter is to determine whether a transaction is restricted or how to assess funds transmissions to foreign commercial aggregators who may be engaged in retransmission of funds to or from an operator. Wire Transfer Examples As stated previously, the only participant in a wire transfer that is covered by the proposed regulation is the beneficiary s bank, because only the beneficiary s bank is in a sufficient position to know the nature of the commercial customer s business. The policies and procedures of the beneficiary s bank will be deemed to be reasonably designed to identify and block restricted transactions if they require sufficient due diligence in establishing and maintaining the customer relationship to ensure that the commercial customer will not receive restricted transactions. Such due diligence includes screening potential commercial customers to determine the nature of their business and prohibiting the commercial customer through the commercial customer agreement from receiving restricted transactions. Similar to other types of payments systems, the beneficiary s bank should also implement policies and procedures to address situations in which the commercial customer is found to have received restricted transactions and when access to the wire transfer system should be denied or the account closed entirely. With respect to an originator s bank or intermediary bank sending or crediting a wire transfer to a foreign bank, the policies and procedures will be deemed reasonable if they include procedures to address situations in which the foreign bank is found to have received from the originator s bank or intermediary bank wire transfers that constitute restricted transactions. 10

11 November 2007 n Volume 12 n Issue 9 Enforcement The proposed regulation follows the provisions of UIGEA exactly as to enforcement, providing for functional regulation by the federal functional regulators with respect to covered payments systems and the Federal Trade Commission for payments systems not otherwise under the jurisdiction of the federal functional regulators. Small Entities The proposed regulation provides no exemptions for smaller payments systems. The guidance accompanying the proposed regulation states that Treasury does not know how many small entities will be affected by the proposed regulation. Without specifying the basis for its analysis, Treasury found that the proposed regulation would not have a significant economic impact on a substantial number of regulated small entities. Treasury further found that as the requirement to identify and block restricted transactions comes directly from UIGEA, any economic impact would flow from UIGEA rather than the regulation, thus a regulatory flexibility analysis was not required. Small businesses and their representatives, may express other views through the comment process. Broader Policy Considerations Immunity from Liability for Identifying and Blocking Under UIGEA, designated payments systems are provided immunity from liability for blocking transactions that are in fact lawful, if there is a reasonable basis to believe that the transaction may be a restricted transaction. 5 The law also requires the regulation to ensure that lawful transactions are not blocked as being a restricted transaction. 6 The proposed regulation reiterates both of these provisions without elaboration and without providing guidance to enable covered entities to avoid blocking lawful activity. It does not address the fact that certain transactions, such as those involving pari-mutuel betting, may be lawful but may nevertheless be blocked by financial transaction providers. The immunity provisions have the potential of exacerbating the existing dispute between the DOJ, which takes the position that all Internet gambling is illegal under the Wire Act of 1961, 7 and the horseracing industry and its congressional supporters, who state that the Interstate Horseracing Act 8 ( IHA ) permits pari-mutuel betting that occurs via telephone or Internet, provided the activity is lawful in each state involved. Although UIGEA included language expressly stating that it did not have any effect on the IHA, the proposed regulation may well result in financial transaction providers blocking payments for pari-mutuel betting under the theory that the transactions are unlawful Internet gambling transactions. Financial transaction providers may block such transactions arguing that they are justified in doing so based on the DOJ s position and that they are not liable for blocking a permitted transaction under the immunity provision. Since neither UIGEA nor the proposed regulation addressed the need to define or clarify what is and is not legal, there is likely to continue to be disagreement and dispute over the issue. The comment process could result in participants in the horseracing industry seeking express exclusion of their transactions from the regulation, or objecting to the language preventing them from seeking redress from financial transaction providers that block these transactions, if they are in fact legal. Notably, such requests could further complicate U.S. efforts to address its multibillion dollar liability in the World Trade Organization ( WTO ) arising from its prohibition of Internet gambling offered to U.S. persons by foreign operators, which the WTO found discriminatory in light of the availability of Internet gambling domestically in relationship to horseracing. Circumvention of UIGEA and the Proposed Regulation Although the proposed regulation covers five major payments systems, the federal regulators are also requesting comment on whether there are other payments systems that should be covered. Additionally, there is in indication in the proposed regulation that as technology develops, those participants in the designated payments systems that 11

12 Electronic Banking Law & Commerce Report are exempted might subsequently be included if it becomes technologically and economically feasible to do so. Despite the regulatory effort to prevent all unlawful Internet gambling transactions, even under the proposed regulation it would still be possible for a U.S. resident to gamble online. The most obvious way would be for a U.S. resident to open a foreign bank account in a jurisdiction where Internet gambling is legal. Such an account could be used for a variety of things, including Internet gambling, as would a normal banking account. At such time as the individual wanted to repatriate the funds, the individual could simply transfer all or part of the money to the United States. Provided that the U.S. resident reported the bank account to appropriate U.S. authorities, there is no federal prohibition on an individual gambler having the account or using it for lawful purposes under the law of the jurisdiction where the account is located. Thus, whether the U.S. resident wanted to use the funds in the account to gamble online, pay bills, or make purchases, he or she would be free to do so subject to applicable state laws. Credit cards, stored-value cards, pre-paid cards and debit cards issued by foreign financial institutions for multi-purposes could function similarly for circumvention. Assessment The proposed regulation seeks to identify the participants in designated payments systems that are in the best position to determine whether or not a transaction is a restricted transaction and to exempt those who are not in a position to make that determination. However, the proposed regulation does impose significant additional burdens and responsibilities on the covered payments system participants, as they must now develop new policies and procedures that require them to gather more information about their customers business. The proposed regulation also risks creating significant tension between domestic and foreign financial institutions, as U.S. institutions must require their foreign counterparts to agree not to process transactions that may be legal in the foreign jurisdiction and to terminate the relationship if the foreign bank does not comply. In addition, there continues to be ambiguity about the underlying definition of which transactions are legal and which are not, creating uncertainty for financial institutions required to identify and block unlawful transactions. Congress mandated that the regulation implementing UIGEA be in place within 270 days of its enactment October 12, More than one year later, only this proposed regulation has been issued amid renewed congressional consideration of alternative approaches to Internet gambling, such as the regulatory approach advocated by House Financial Services Chairman Barney Frank (D-MA) in H.R In its current form, the proposed regulation would add substantial regulatory burden to a wide scope of participants in the U.S. financial services sector, without being likely to prevent the activity they seek to prohibit. They would also be likely to drive further underground and off-shore payments relating to Internet gambling, potentially making risk assessments for U.S. participants in the payments system even more difficult. U.S. financial services companies with concerns about potential compliance exposure, commercial injury and regulatory burden arising from the proposed regulation may wish to consider the extent to which they are in a position to offer alternative language or solutions to that provided in the proposed regulation. Such language could include, for example, suggestions that any final regulation provide for an even-playing field between U.S.-based and foreign operators, through deferring the imposition of the controls until the U.S. negotiates mechanisms with foreign governments to secure enforcement on an international basis. Other formulations could seek language specifying that examiners not treat what the regulation terms as examples providing a safe-harbor for compliance as mandatory in practice, so long as the relevant entities are not knowingly handling restricted payments. One approach would be to seek expansion of the safe harbor to include any mechanism put into place by the financial services company that is sufficient to avoid knowingly processing restricted transactions, while remaining in compliance with other provisions of federal law, such as know-your-customer requirements. 12

13 November 2007 n Volume 12 n Issue 9 Notes 1. Proposed regulation 12 C.F.R. 2(q). 2. Proposed regulation 12 C.F.R. 2(d). 3. This is more than a theoretical issue, in that gift cards can be sold by a retailer for redemption by that retailer on a global basis, such as by a hotel chain or entertainment company, which might otherwise permit Internet gambling at any of its facilities in a jurisdiction where such activity is lawful. Under the regulation, a merchant issuing such a card would need to have policies and procedures in place to restrict its use by a U.S. person engaged in Internet gambling. 4. Proposed Regulation 12 C.F.R. 2(u) (d) (b)(4) U.S.C U.S.C et seq. Health Savings Accounts: An Overview B y T i m o t h y R. M c T a g g a r t a n d A n d r e w M a h e r Timothy R. McTaggart (mctaggat@pepperlaw.com) is a partner in the Washington, DC, office of Pepper Hamilton LLP. Mr. McTaggart is the former Delaware state bank commissioner and the immediate past chairman of the American Bar Association s banking law subcommittee on Trust and Investment Services. Andrew Maher (mahera@pepperlaw.com) is an associate in the Financial Services Practice Group of Pepper Hamilton LLP, resident in the Philadelphia office. Mr. Maher s practice encompasses work involving a variety of investment management as well as public and project finance matters. Financial institutions have many opportunities to become more involved in offering Health Savings Accounts (HSAs). HSAs are relatively new, but are expected to grow rapidly over the next decade, particularly as a result of legislative changes made last year. HSAs continue to be a favorite topic for policy makers seeking methods to increase retirement savings and to react to health care costs. Also, state led initiatives and marketbased activity continue to emerge with new approaches for HSAs. While it is not a perfect analogy, some believe that the growth in HSAs will be similar to the growth experienced in connection with Individual Retirement Accounts (IRAs). IRAs gained popularity and traction after early market educational efforts and related technical changes were implemented in a manner similar to the process underway with HSAs. What is a Health Savings Account? An HSA is a tax-exempt trust or custodial account that is set up with a qualified HSA administrator, acting as either a trustee or a custodian, to pay or reimburse certain medical expenses. HSAs were created by the Medicare Prescription Drug, Improvement and Modernization Act signed into law by President Bush on December 8, How prevalent are HSAs? As of the beginning of 2007, 3.2 million people were covered under 1.9 million HSAs. In 2004, only 438,000 people were covered. Who can contribute to an HSA? Employers and employees may contribute to an HSA, so long as the combined annual contributions do not exceed the pertinent maximum legal limits. Any employer contribution to an employee HSA must be made on a non-discriminatory basis. Otherwise, employer contributions are subject to an excise tax equal to 35 percent of the aggregate amount contributed to employee HSAs. What are the benefits of an HSA? HSA benefits include: contributions made to an HSA by an individual are tax-deductible, even if that individual does not itemize his or her deductions; employer contributions to an employee s HSA are excludable from gross income and wages for employment tax purposes; contributions made to HSAs can accumulate in the account and can be rolled over from year to year until they are used for qualified 13