NAFCU Compliance Blog

FinCEN's CDD Rule: Are Subaccounts Considered New Accounts?

Written by Stephanie Lyon, Regulatory Compliance Counsel

Credit unions generally permit existing members to have more than one share savings and checking account — these are often referred to as subaccounts. Whether opening a new subaccount is considered to be opening a new account is a question the NAFCU Compliance team has received several times since the Customer Due Diligence (CDD) rule was finalized in 2016. This question is relevant because starting May 11th, 2018, any time a legal entity member opens a new account, the credit union will be required to identify and verify the identity of the beneficial owners. See, Final 31 C.F.R. § 1010.230(b)(1).

Unfortunately, FinCEN's CDD rule did not explicitly discuss subaccounts anywhere in the proposed or final rule. However, there are several pieces of information located throughout the preambles to the proposed and final rule as well as guidance documents that seem to indicate opening a subaccount is likely considered to be a new account that will trigger the beneficial ownership identification and verification requirements. 

Definitions of Account and New Account

The CDD rule defines a "new account" as "each account opened at a [credit union] by a legal entity customer on or after the applicability date." Final 31 C.F.R. § 1010.230(g). The rule also defines "account" by cross referencing section 1020.100(a) which implements the Customer Identification Program (CIP) requirements, among other things. Under CIP, an "account" means "a formal banking relationship established to provide or engage in services, dealings, or other financial transactions including a deposit account, a transaction or asset account, a credit account, or other extension of credit." FinCEN and other regulators provided an interpretation of the definition of account that is helpful to determine whether a subaccount could be a new account.

In the Interagency Interpretative Guidance on Customer Identification Program Requirements, FinCEN made it clear that CIP does not have to be performed when an existing "customer" renews a loan or rolls over a share certificate as long as the credit union has a reasonable belief that it knows the true identity of the member. See, 31 C.F.R. § 103.121(a)(3)(ii)(C) – Person with an existing account, Q1. However, that same guidance stated that "[f]or the purposes of CIP, each time a loan is renewed or a [share certificate] is rolled over, the [credit union] establishes another formal banking relationship and a new account is established."

From the guidance and the definitions of account and new account, it does appear that opening a subaccount will be considered forming a new formal banking relationship and require the identification and verification of beneficial owners. But while this guidance is significant in explaining how FinCEN views an existing account and a new account for CIP purposes, it is not fully indicative of whether a subaccount is considered to be a new account for CDD purposes so we have to turn to the actual rule.

Preamble to Proposed and Final CDD Rule

In the proposed rule, there is a footnote that talks about the types of new accounts the rule would affect. The footnote seems to indicate FinCEN did not want to create a blanket exemption from the requirement to collect beneficial ownership information for subaccounts opened by a legal entity member after the compliance deadline. The discussion of this footnote was further explained in the preamble to the final rule in which FinCEN seems to strike a balance between requiring beneficial owner information for subaccounts opened after the compliance deadline and not retroactively requiring the collection of this information for accounts opened before the compliance deadline. Here is a relevant excerpt:

Several commenters sought clarification as to whether a financial institution must identify and verify a legal entity customer's beneficial owners each time it opens a new account at the institution after the rule's compliance deadline, or whether the requirement applies only the first time it opens a new account at such institution. FinCEN has concluded that, while it is not requiring periodic updating of the beneficial ownership information of all legal entity customers at specified intervals, the opening of a new account is a relatively convenient and otherwise appropriate occasion to obtain current information regarding a customer's beneficial owners…

81 Fed. Reg. 29406. Both the footnote and several other areas of the preamble make it apparent FinCEN expects credit unions to collect beneficial ownership information whenever an existing legal entity member does something that modifies the account relationship or triggers a review of the account. Additionally, as there is no guidance indicating that subaccounts are exempt from the definition of a new account, it seems FinCEN considers these to be "new accounts" if opened after the compliance deadline.

Finally, remember that other aspects of the CDD rule require credit unions to monitor members and update member information. This applies to currently opened accounts and accounts opened after the compliance deadline. I wrote a blog on triggering events that may be helpful when reviewing legal entity members.

What Else is New With Marijuana Banking?; Another Credit Union ADA Victory; Help Us Help You!

Written by Pamela Yu, Special Counsel for Compliance and Research

A couple of weeks ago, I blogged about what's new with marijuana banking.  Among other things, I provided an update on one credit union's ongoing efforts to become the first credit union chartered to support the marijuana industry and with a field of membership focused on cannabis groups.

In response to my post, several credit union industry players reached out to ask how many cannabis-friendly credit unions are currently handling marijuana-related accounts. 

Who's Holding All That Cannabis Money? 

Recent reports indicate that legal marijuana sales reached $9.7 billion across the seven states where recreational marijuana was legal and Canada in 2017. That number does not include California, which is projected to hit $3.7 billion in legal cannabis sales by the end of 2018, and $5.1 billion in 2019. Overall, despite continued federal prohibition here in the U.S., North American legal cannabis sales are expected to hit $24.5 billion by 2021.

Because the substance continues to be illegal under the federal Controlled Substances Act, marijuana businesses have remained challenged in obtaining traditional financial services but information from the Treasury Department indicates that more institutions are taking on these accounts.

According to FinCEN's Marijuana Banking Update, based on Suspicious Activity Report (SAR) filings, around 400 depository institutions were actively banking marijuana businesses in the U.S. as of September 30, 2017.  Less than 100 of those were credit unions, while the rest were banks.  FinCEN's data shows that the agency received a total of 39,025 SARs using key phrases associated with marijuana-related businesses by the end September 2017. 

Source: FinCEN Marijuana Banking Update (September 2017)

While the number of institutions serving marijuana businesses has more than tripled since 2014, federal data shows that only a small percentage of the 5,573 federally-insured credit unions across the country are reporting service to marijuana businesses.  The growing industry will likely continue to be underbanked as long as cannabis continues to be federally illegal.

***

Third ADA Win for Credit Unions

On March 5, in another win for the credit union industry, a federal district court in Virginia granted a credit union's motion to dismiss an Americans with Disabilities Act (ADA) website accessibility suit.  See, Carroll v. ABNB Federal Credit Union, No. 2:17-cv-521 slip. op. (E.D. Va. Mar. 5, 2018).  NAFCU filed an amicus brief in this case; we have filed five briefs so far in support of our member credit unions.

As discussed in the latest issue of NAFCU's Compliance Monitor, for the past year credit unions have faced a growing litigation threat due to unclear website accessibility standards under the ADA.  To date, NAFCU is aware that credit unions in at least 24 states have been impacted by ADA website accessibility claims. 

In the latest case to be thrown out, the court found that "because [the plaintiff] has not shown that he (1) is a member of [the credit union], (2) that he is within [the credit union's] membership field, or (3) that he could become a member of [the credit union]," the plaintiff had not alleged a "sufficiently concrete injury in fact" necessary to show legal standing. See, Carroll v. ABNB Federal Credit Union, No. 2:17-cv-521 slip. op. at 8 (E.D. Va. Mar. 5, 2018). 

The court's reasoning regarding the plaintiff's standing was consistent with two other recent decisions in virtually identical suits alleging website violations of the ADA by other credit unions. See, Griffin v. Department of Labor Federal Credit Union, 1:17-CV-1419, slip op. (E.D. Va. Feb. 21, 2018); Carroll v. Northwest Federal Credit Union, l:17-cv- 01205, slip op. (E.D. Va. Jan 26, 2018).

In addition, cases against two Texas credit unions (involving the same plaintiff) were dismissed on March 2. NAFCU also filed an amicus brief in support of one of those credit unions.

Please visit NAFCU's ADA webpage to learn more about this issue, and to keep apprised about what NAFCU is doing to fight for credit unions.

***

Monthly Research Survey: Help Us Help You!

NAFCU's Economic and Research Team conducts monthly surveys of NAFCU member credit unions in order to compile meaningful data reports that you can use to benchmark against your geographic and asset level peers. These survey results are also critical to NAFCU's advocacy efforts on your behalf to federal agencies, such as NCUA, CFPB and the Federal Reserve. Your participation helps us help you!

Today is the last day to share your voice on the topic of Financial Literacy & Community Outreach. We rely on your survey responses for our industry analysis and legislative advocacy efforts on behalf of all credit unions.

NAFCU members can participate in this month's Economic and CU Monitor survey with one of the options below:

• Online survey
• PDF file (please return by email to [email protected])

Deadline for Economic & CU Monitor survey: March 9, 2018

 

314(b): Beware of Oversharing

Written by Jennifer Aguilar, Regulatory Compliance Counsel

Under section 314(b) of the Patriot Act, credit unions, and other financial institutions, are permitted to share information with one another regarding individuals they suspect may be involved in terrorist or money laundering activities. Those institutions who elect to share information under 314(b) are provided with a safe harbor from liability if they notify FinCEN of their intent to share, verify that the institution with whom it will share information with has also notified FinCEN of its intent to share, use the shared information only for the permissible purposes and have procedures in place to protect the shared information. See, 31 C.F.R. § 1010.540(b).

One question that often comes up for 314(b) sharing is what type of information can be shared under the safe harbor. Of course, any information directly related to possible terrorist and money laundering activities may be shared, but what about other types of suspected criminal activities, such as fraud? Information about these types of activities can be shared under the 314(b) safe harbor, but only in certain circumstances. FinCEN guidance in this area can be a bit confusing so it's helpful to break it down into a few steps to determine when credit unions are permitted to share information about these types of activities:

1. Whether the credit union suspects a specified unlawful activity has occurred;
2. Whether a transaction involving the proceeds from that activity has taken place; and
3. Whether that transaction is part of a terrorist or money laundering scheme.

First, what types of activities are considered "specified unlawful activities" (SUAs)? FinCEN guidance points to the Patriot Act to determine which activities are SUAs. The Act defines a "specified unlawful activity" rather broadly to include financial transactions resulting from the distribution of controlled substances or extortion, fraud, bribery, trafficking and counterfeiting, as well as many other federal criminal offenses. See, 18 U.S.C. § 1956(c)(7). So, the first step in determining whether information can be shared under 314(b)'s safe harbor is to review the activity involved and establish that a SUA has occurred or that the credit union suspects a SUA has occurred.

Second, has a transaction involving the proceeds from a SUA taken place? FinCEN 2009-G002 explains that a credit union may share information if it "suspects that the transaction may involve the proceeds of one or more SUAs." This phrasing is important because it establishes the fact that the credit union must first suspect that a SUA has occurred. Additionally, FinCEN 2012-R006 explains that a credit union may not share information solely to determine whether a SUA has occurred. This means that sharing in order establish a suspicion that a SUA has occurred is not permissible; sharing is only permitted once the credit union has already established that it suspects a specified unlawful activity has occurred.

For example, suppose John Doe is a pusher for Jane Doe's international drug operation. John sells the drugs then deposits the proceeds at ABC credit union. Under FinCEN guidance, ABC may not share information in order to determine whether the proceeds came from drug sales. However, ABC may share information once it suspects that the proceeds are from drug sales.

Finally, is the transaction part of a terrorist or money laundering scheme? FinCEN 2009-G002 explains that the purpose of 314(b) sharing is "to identify and report activities that the financial institution 'suspects may involve possible terrorist financing or money laundering.'" Even if the credit union suspects that a transaction involved the proceeds from an SUA, it may only share information if it also suspects that the SUA relates to terrorist or money laundering activities. In the fraud context, this means that even if the credit union suspects a fraud has occurred and there is a transaction involving the proceeds from that fraud, the credit union may only share information about that fraud if the credit union also suspects the fraud is part of a terrorist or money laundering scheme.

When it comes to sharing information about SUAs, a credit union would need to review all the facts involved and ensure that all three elements have been satisfied: the credit union knows or suspects a SUA has occurred, a transaction involving the proceeds from that SUA has occurred and that transaction is part of terrorist or money laundering activities. It is important that all three of these elements are present in order to stay within the 314(b) safe harbor. Sharing information about fraud may be important to help prevent further harm, but, if the fraud does not relate to terrorist or money laundering activities, a credit union may lose its safe harbor protection by oversharing. This of course does not mean that the credit union cannot do anything – state law may allow the credit union to report the fraud to the local police and, depending on the circumstances, a SAR may be appropriate.

Marijuana Banking Just Got More Complicated

Written by Pamela Yu, Special Counsel for Compliance and Research

Well, we can't say we didn't see this coming...we blogged back in March, 2017 on what the change in administration might mean for marijuana banking, and the federal government announced a change in its policy towards marijuana enforcement late last week.

U.S. Attorney General Jeff Sessions changes DOJ's position on marijuana.

In a move long forecasted by many legal and policy observers, last Thursday the attorney general issued a memorandum to rescind Obama-era guidance on federal enforcement of marijuana. Released just days after California became the latest (and largest) state to begin sales of recreational marijuana, the memo directs "all U.S. Attorneys to use previously established prosecutorial principles," in marijuana enforcement, thus eliminating the already-limited guidance that provided some measure of direction in navigating the conflict between federal illegality and state legality of marijuana. This policy shift will significantly heighten risks for credit unions serving state-authorized marijuana-related businesses or operating in states with legalized cannabis.

Sessions' memo rescinds a 2013 directive, written by then-Deputy Attorney General James M. Cole, which instructed federal prosecutors to focus its marijuana enforcement efforts on eight priorities, including keeping marijuana out of the hands of minors and black market criminals and cartels.  It also rolls back a 2014 Cole memo that directed U.S. Attorneys to apply the same eight enforcement priorities in prosecuting financial crimes based on transactions involving marijuana proceeds.  The so-called Cole memo guidance had cleared up some of the uncertainty about how federal prosecutors would address the conflict of laws as states began allowing sales of marijuana for medical and recreational use. 

Today, 29 states and the District of Columbia (DC) permit medical marijuana and, of those, eight states and DC also allow adult-use recreational marijuana. A recent Gallup poll shows that public support for the legalization of marijuana is at an all-time high, with 64 percent of Americans favoring legalization, including for the first time a majority of Republicans (51 percent now support legalizing marijuana).  Nevertheless, marijuana remains a schedule 1 substance under the federal Controlled Substances Act. Thus, a litany of federal criminal statutes may be implicated for credit unions handling marijuana-related funds.

So what does this mean for credit unions?  In short, providing financial services in states where marijuana is legal under state law just got a lot more complicated. 

Marijuana Banking

At this point, is unclear whether the rescission of the Cole memo guidance will mean a federal crackdown on state-sanctioned marijuana.  The roll-back of formal guidance with respect to marijuana enforcement has created a policy void (note that the memo eliminates prior directives but does not replace them with new guidance) but it is too soon to tell if enforcement will significantly increase.  In effect, the Sessions memo empowers the country's 93 U.S. Attorneys to exercise prosecutorial discretion in their respective jurisdictions. We don't know how prosecutors will use this discretion—some jurisdictions may take a more aggressive enforcement posture while others may not—but the door is now open for federal officials to carry out enforcement against marijuana activities in states that have legalized cannabis.  This creates significant legal uncertainty for credit unions that have been serving marijuana-related businesses under the auspices of the Cole memo guidance. 

There are some existing barriers to marijuana enforcement that remain in place.  For example, the Rohrabacher-Blumenauer (also known as Rohrabacher-Farr) appropriations bill provision that has been in place since December 2014 prohibits the Department of Justice (DOJ) from using federal funds to prevent states "from implementing their own state laws that authorize the use, distribution, possession or cultivation of medical marijuana."  However, the provision must be renewed each fiscal year in order to remain in effect and its protections apply only to medical marijuana, leaving particularly vulnerable those credit unions operating in recreational states.

 BSA Compliance

 In 2014, as a supplement to the Cole memo on marijuana-related financial crimes, the Financial Crimes Enforcement Network (FinCEN) issued guidance to clarify "how financial institutions can provide services to marijuana-related businesses consistent with their BSA obligations." See, FIN-2014-G001.   Despite limited protections, together the Cole memos and FinCEN guidance created a framework for credit unions to serve marijuana-related businesses consistent with their legal and compliance obligations. 

However, as we previously cautioned, FinCEN's guidance depends heavily on the enforcement posture articulated in the Cole memos. Now that those memos have been reversed, credit unions can no longer rely on the FinCEN guidance for serving marijuana-businesses, significantly heightening BSA compliance risks. To add fuel to the fire, some credit unions may now be questioning whether their compliance with FinCEN's 2014 instruction to file either a "Marijuana Limited," a "Marijuana Priority," or a "Marijuana Termination" suspicious activity report (SAR) for each transaction involving marijuana-related funds has created a damning paper trail for federal prosecutors.  FinCEN and the DOJ have yet to offer any assurance that SARs issued under FIN-2014-G001 will not be used to prosecute financial crimes, even against those who relied on the guidance in good faith.  While it is perhaps unlikely that marijuana SARs will be used as evidence for the widespread prosecution of financial institutions, it is not outside the realm of possibility that federal authorities could make an example out of a bank or credit union to send the message that federal marijuana enforcement priorities have changed. Regardless, the increased liability and compliance risk will certainly have a chilling effect on the ability for credit unions to provide services to marijuana-related businesses. It is likely FinCEN will release additional guidance or information soon in light of these changes.

Momentum for Change

On a more optimistic note, Thursday's rescission may create momentum for congressional action on marijuana.  Marijuana banking advocates on the Hill have been challenged in mobilizing change.  The uncertainties created by Sessions' action could actually galvanize support in Congress to find a legislative solution to the conflict between federal and state drug laws. With support for marijuana protections in both parties the attorney general's tougher stance on marijuana could—ironically—become the impetus for a statutory solution for marijuana banking.

FinCEN SAR Stats; Sessions Releases Marijuana Memo; Request for BSAAG Nominees

Written by Shari R. Pogach, Regulatory Paralegal

Have you ever wondered what happened to the Financial Crimes Enforcement Network's (FinCEN) Suspicious Activity Report Statistics (SAR Stats)?  Well the data is still available; it's just gone totally interactive.

If you go to FinCEN's website www.fincen.gov, you can find a link for "SAR Statistics."

This link goes to the interactive report generator page:

 


The drop down boxes allow for filtering of the statistical data according to:  industry type; year & month; suspicious activity category/type; states/territories; county/metro & micro area; instrument type(s)/payment mechanism(s); product type; relationship; and regulator.  Each drop down allows for all, one, or multiple filter categories.  Once you have determined your filters, you can then generate a report and export it to a CSV file or to a PDF for further study.

FinCEN's FAQ/Glossary page cautions the statistics are:

"Statistical data for SARs are updated as information is processed and refreshed data is periodically made available for this tool. For this reason, there may be discrepancies between the statistical figures returned from queries performed at different times. In addition, slight differences in query criteria may return different statistical results. Also note that the statistics generated by this tool do not include SAR fields that contain unknown or blank data. To the extent statistics including blank or unknown data are tabulated outside of this tool for other purposes, there may be discrepancies between statistics generated by this tool and those generated through other means. FinCEN makes no claims, promises or guarantees about the accuracy or completeness of the statistical figures provided from this tool and expressly disclaims liability for errors, omissions, or discrepancies in the statistical figures."

Still, the generated reports can indicate trends in your area, state or region of your part of the country and can be a useful additional resource for BSA compliance personnel.  The website indicates the data has been updated as of November 30, 2017.

***

Sessions Releases Marijuana Memo.  Attorney General Jeff Sessions released a memorandum on federal marijuana enforcement policy.  Basically the Department of Justice has rescinded the Obama administration policy of non-interference with marijuana-friendly state laws.  Look for more on this in a blog next week.

***

BSAAG.  FinCEN is asking for nominees for membership on the Bank Secrecy Act Advisory Group (BSSAG).  New members will be selected for three-year membership terms.  If you would like more information or are interested in having NAFCU submit you as a candidate, please email Senior Regulatory Affairs Counsel Michael Emancipator at [email protected] by January 15 as potential nominees must be submitted to FinCEN by January 26, 2018.

Should We Block That Marijuana Transaction?

Written by Pamela Yu, Special Counsel for Compliance and Research

Earlier this year, I blogged about some of the legal and compliance uncertainties and operational challenges facing credit unions that are providing, or interested in providing, financial services to marijuana-related businesses that are legal under state law but remain illegal under the federal Controlled Substances Act (CSA).  I've also blogged about one credit union's efforts to become the first cannabis credit union and the difficulties in banking these unbankable businesses.

Not much has changed in 2017 with respect to resolving the conflict of laws impacting marijuana banking.  But in April West Virginia became the 29^th state to legalize medical marijuana and the November elections saw gains for legalized marijuana advocates.  In the meantime, the attorney general continues to see marijuana as a "life-wrecking" substance that is "only slightly less awful" than heroin.  In short, the debate over state-sanctioned pot is ongoing and the law in this area is far from settled.

Meanwhile credit unions are increasingly being forced to contend with the cannabis conundrum, whether they have chosen to take on marijuana-business accounts or not. Recently, some of our members have contacted NAFCU's Compliance Team for assistance with how to handle marijuana-related transactions. Namely—should a credit union affirmatively block marijuana-related transactions?

Liability Under Federal Law

 Marijuana remains a schedule I controlled substance under the CSA, which makes it illegal under federal law.  See, 12 U.S.C. §812(b)(1).  Thus, federal criminal statutes may be implicated when handling marijuana-related funds.  For example, it is a federal criminal offense to engage in certain financial and monetary transactions with the proceeds of a “specified unlawful activity,” including marijuana-related funds.  See, 18 U.S.C. §§ 1956 and 1957.  It is also a federal criminal offense to transact funds “derived from” marijuana-related activity by or through a money transmitting business. See, 18 U.S.C. § 1960.  Financial institutions that conduct transactions with funds derived by marijuana-related activity may also be subject to criminal liability for failing to identify or report financial transactions involving marijuana proceeds.  See, 31 U.S.C. §5318(g).  In light of these liability concerns, some credit unions are wondering if they have an obligation or affirmative duty to prevent marijuana-related payments or transactions of funds associated with marijuana-related activity.

Blocking Merchant Codes

Ultimately it is a risk-based decision for the credit union, but keep in mind that credit unions are under no legal obligation to supervise their members' behavior nor to enforce federal drug laws.  There is no federal regulatory requirement to affirmatively prevent member transactions to state-sanctioned marijuana-related businesses.  Yet, the liability risk remains.  So what should a credit union do?

Some credit unions have considered taking such action as blocking marijuana-related transactions based on merchant codes.  There is some precedent for this: the Unlawful Internet Gambling Enforcement Act (UIGEA), for example, prohibits gambling businesses from knowingly accepting payments in connection with the participation of another person in a bet or wager that involves the use of the Internet and that is unlawful under any federal or state law (“restricted transactions”). See, 31 U.S.C. §§ 5361-5367.  Under the UIGEA, Treasury and the Federal Reserve Board promulgated regulations requiring certain participants in payment systems that could be used for unlawful Internet gambling to have policies and procedures reasonably designed to identify and block or otherwise prevent or prohibit the processing of restricted transactions. See, Unlawful Internet Gambling Enforcement Act of 2006 Overview.

However, blocking marijuana-related transactions would be an administrative burden—and there are ways to circumvent code-blocking. For example, critics have suggested that the UIGEA has had debatable success in effectively blocking illegal gambling transactions.  One reason that code-blocking has not worked well, according to some reports, is because of a circumvention technique called "factoring."  In factoring, a merchant engaged in illegal gambling submits its card transactions through another merchant's terminal using that merchant's identification number and merchant category code and then pays the other merchant a percentage of the submitted transactions.  While this violates card associations' rules, this type of circumvention illustrates the difficulty in trying to police member behavior.  It is also worth bearing in mind that restrictions on internet gambling transactions are specifically governed by federal law, the UIGEA.  There is no similar statute requiring marijuana-related transactions to be blocked by financial institutions.

Also, there is the risk of over-blocking.  Some merchants may sell both legal and (federally) illegal products—the marijuana merchant for example could sell marijuana as well as tobacco products, e-cigarettes, magazines, T-shirts, hats, etc. So, a customer could shop at a marijuana merchant but only purchase legal products and still be blocked. 

Reputation Risk

Another consideration is reputation risk. Although illegal on the federal level, marijuana is legal at the state level in 29 states.  More and more states are legalizing cannabis, both medically and recreationally, and there is majority and growing public support for legalized marijuana.  Particularly with respect to medical marijuana—where members with legitimate medical conditions may rely on medical marijuana to treat or alleviate serious illnesses including cancer and epilepsy—there could be risks to the credit union's reputation if members become upset that their transactions for medical marijuana are blocked by the credit union, particular if there is no regulatory obligation to do so.

On the other hand, there might be reputation risk to allowing marijuana-related transactions or in not taking some affirmative action to prevent payments to marijuana-related businesses.  For example, a credit union with a field of membership that includes law enforcement agencies could suffer reputational harm in allowing marijuana-related transactions despite continued federal prohibitions against marijuana.

BSA Compliance

If the credit union determines to allow marijuana-related transactions, reporting requirements under the Bank Secrecy Act and anti-money laundering (BSA/AML) rules certainly come into play.  If a transaction appears to be associated with marijuana, FinCEN guidance issued in 2014 is instructive. See, FIN-2014-G001. The FinCEN guidance "clarifies how financial institutions can provide services to marijuana-related businesses consistent with their BSA obligations." See, FIN-2014-G001, p.2.  For example, the credit union may need to file a marijuana-related suspicious activity report (SAR) for member transactions that involve marijuana-related funds. 

The FinCEN guidance discusses three specific marijuana-related SARs: (1) marijuana limited; (2) marijuana priority; and (3) marijuana termination.  BSA obligations are heightened for transactions involving marijuana, even if the transaction is related to a marijuana-related business that is legal under state law.  For instance, all transactions with a marijuana-related business require a SAR, simply by virtue of the fact that the subject is engaged in a marijuana-related business. 

FinCEN's discussion of the "marijuana limited" SAR filing states:

A financial institution providing financial services to a marijuana-related business that it reasonably believes, based on its customer due diligence, does not implicate one of the Cole Memo priorities or violate state law should file a “Marijuana Limited” SAR. The content of this SAR should be limited to the following information: (i) identifying information of the subject and related parties; (ii) addresses of the subject and related parties; (iii) the fact that the filing institution is filing the SAR solely because the subject is engaged in a marijuana-related business; and (iv) the fact that no additional suspicious activity has been identified. Financial institutions should use the term “MARIJUANA LIMITED” in the narrative section.

See, FIN-2014-G001, pp.3-4.  Thus, at a minimum, a "marijuana limited" SAR should be filed for all transactions involving a marijuana-related business or marijuana-related funds.

In the end, this is a complex and still uncertain issue and a lot remains unclear about how credit unions should address state-sanctioned marijuana activities.

FinCEN Launches Information Sharing Exchange Program

Written by Shari R. Pogach, Regulatory Paralegal

The Financial Crimes Enforcement Network (FinCEN) wants to strengthen information sharing with financial institutions.  To help achieve this, it announced it has launched its FinCEN Exchange program to enhance public-private information sharing.  Working closely with law enforcement, FinCEN plans to convene regular briefings with financial institutions to exchange information on important potential illegal finance threats.   The program is intended to help financial institutions better identify risks and better focus on higher priority issues.  This will in turn help FinCEN and law enforcement get critical information to continue the fight against money laundering and other financial crimes.

Participation in the FinCEN Exchange is strictly voluntary with no new regulatory requirements.  It also doesn't replace or affect any existing channels by which law enforcement interacts directly with the financial industry. FinCEN indicates operational briefings under this new program will start in the coming weeks.

Historically, FinCEN has convened over a dozen special briefings in five cities with over 40 financial institutions and multiple law enforcement agencies since 2015.  According to FinCEN, the information given by financial institutions through suspicious activity reports (SARs) after these briefings has helped the public sector map out and target weapons proliferators, sophisticated global money laundering operations, human trafficking and smuggling rings, and corruption and trade-based money laundering networks.  The briefings also helped financial institutions to focus on specific priorities and better identify risks.

The FinCEN Exchange will convene more regularly scheduled and as-needed operational briefings across the nation with law enforcement, FinCEN and financial institutions to exchange information on priority illegal finance and national security threats.  In consultation with law enforcement, FinCEN plans to invite financial institutions to participate based on a variety of factors, including whether an institution may have information that is relevant to a particular topic. 

FinCEN states the form of each briefing may vary but the sharing of information is intended to equip financial institutions to provide more responsive information into SARs. Financial institutions are also highly encouraged, as appropriate, to voluntarily share information with other FinCEN Exchange participants as well as other financial institutions or associations of financial institutions pursuant to Section 314(b) of the USA PATRIOT Act.

CDD Rule: Beware of Events that May Trigger Beneficial Ownership Reviews; CFPB Releases Beta HMDA Platform

Written by Stephanie Lyon, Regulatory Compliance Counsel

I have exciting news to share; on Friday I became a Certified Anti-Money Laundering Specialist through ACAMS. This is a great milestone for me and nothing could commemorate this accomplishment better than a BSA blog.  Enjoy!

As the Customer Due Diligence (CDD) rule's implementation date gets closer, we have seen an increase in questions regarding the types of events that may lead a credit union to review the beneficial ownership information of an existing account. So we thought it would be helpful to go over the rule's requirements and give examples of potential triggering events. Before we dig in, remember that the definition of a beneficial owner includes two prongs—ownership and control—so when talking about updating information on beneficial owners, we are referring to both prongs.

The 5th pillar of BSA compliance established by the final rule requires that credit unions include in their anti-money laundering (AML) programs, CDD procedures for the purpose of developing a member risk profile and conducting ongoing monitoring of these relationships. See, 81 Fed. Reg. 29449. Before you sound the alarm at your credit union, it is important to know that the final CDD rule does not impose a categorical requirement to regularly update the beneficial ownership information on an existing account. See, 81 Fed. Reg. 29421. However, as part of the on-going monitoring, credit unions may encounter some events that could lead the credit union to believe that there has been a fundamental change to the ownership of the account and hence trigger a review of beneficial owners. See, 81 Fed. Reg. 29399.

What Triggers A Review?

The rule states that beneficial ownership information should be updated when, in the normal course of business, the credit union detects a relevant change to the account that may alert the credit union to a change in the beneficial ownership structure. Here is an excerpt to the preamble of the CDD rule in which FinCEN explains this concept:

"…our requirement is consistent with current practice, and we expect monitoring-triggered updating of beneficial ownership information (as with other customer information) only to occur on a risk basis when material information about a change in beneficial ownership is uncovered during the course of a bank's normal monitoring (whether of the customer relationship or of transactions)... However, there is no expectation that a financial institution obtain updated beneficial ownership information from its customers on a regular basis, whether by using the Certification Form in Appendix A or by any other means." 81 Fed. Reg. 29421.

Unfortunately, the CDD rule does not have a prescriptive list of events that will trigger the review of beneficial ownership information for existing business accounts. Rather the rule follows the same risk-based review format of other Bank Secrecy Act (BSA) requirements. These risk-based provisions allow credit unions the flexibility to determine its own triggering events and implement appropriate review procedures. The rule does provide a few examples of events that could lead to a review of an account's beneficial ownership structure such as:

• "a situation where an unexpected transfer of all of the funds in a legal entity's account to a previously unknown individual would trigger an investigation in which the bank learns that the funds transfer was directly related to a change in the beneficial ownership of the legal entity…;
• when a financial institution detects information (including a change in beneficial ownership information) about the customer in the course of its normal monitoring….; [and/or]
• a significant and unexplained change in the customer's activity, such as executing cross-border wire transfers for no apparent reason or a significant change in the volume of activity without explanation." 81 Fed. Reg. 29421, 29399.

So if the credit union uncovers a potential change to the beneficial ownership information during a high risk review of an account, during the investigation of an AML alert or a SAR filing, the rule would require the credit union to seek updated information for the account at that time. Other triggering events that may require updated beneficial ownership information, depending on specific facts and circumstances, include:

• A notable increase in CTR filings for the legal entity or any of the beneficial owners
• The filing of a SAR (depending on the nature and type of suspicious activity)
• Changes regarding the authorized users or signatories for the account
• Changes regarding the beneficial owners, ownership structure, nature of the business or customer base
• Opening a new subaccount for the business
• A request to close an active subaccount without providing a legitimate reason
• A 314(a) match
• Information obtained/provided from or to other FIs through 314(b) information sharing
• Results from a high-risk review of the account
• Law enforcement subpoenas or search warrants
• Transaction monitoring alerts for unexpected activity

Before the rule becomes final, credit unions may want to review their current due diligence process and create additional risk-based procedures that specify which triggering events should lead to a more thorough review of legal entity accounts—including obtaining updated beneficial ownership information.

***

CFPB Releases Beta Version of HMDA Platform. Credit unions will finally be able to test their HMDA data collected in 2017 for reporting to the CFPB in 2018  through the long awaited beta version of the HMDA portal. The portal allows credit unions to establish test log-in credentials, upload sample files, validate the data, receive edit reports, confirm test data submissions and complete test filing processes.

FinCEN Finalizes Technical Amendments to CDD Rule; CFPB Updates HMDA Guide

Written by Stephanie Lyon, Regulatory Compliance Counsel

FinCEN recently issued technical amendments to its Customer Due Diligence (CDD) rule or as some of you may know it, the Beneficial Ownership rule. These amendments became effective the day they were published in the Federal Register but the compliance deadline is not until May 11, 2018. Unfortunately, the compliance deadline may take away from the enjoyment of celebrating Eat What You Want Day, but I will nonetheless observe this holiday.

I just wanted to note from the onset that these technical amendments do not provide additional guidance on complying with the CDD rule but we do anticipate additional FAQs before the compliance deadline—specifically on complex corporate structures and how deep to dig to find a natural person (finding the heartbeat).

Of the technical amendments, only one part is specifically relevant to credit unions while the other part deals with the training element of the AML program for mutual funds, which was inadvertently omitted from the final rule. See, 81 Fed. Reg. 45183. Here are the applicable corrections noted in the amendment:

Corrections to the Beneficial Owner Certification Form

Under the final CDD rule, credit unions are required to identify up to 4 beneficial owners who own 25% or more of legal entity customers at the time a new account is opened. To comply with this requirement, the credit union may obtain the required information on a standard certification form or through substantially similar means. Credit unions seeking to comply with this requirement through the standard certification form can find an image of the Certification Regarding Beneficial Owners of Legal Entity in Appendix A of the final rule.

The technical amendments made a couple of corrections to the model Certification Form found in Appendix A. The changes are meant to fix inadvertent mistakes instead of imposing additional requirements to obtain information for beneficial owners of legal entities. Here is a summary of the changes:

1. In the first sentence in Part I under the heading “What information do I have to provide?”, the term “foreign persons” is changed to “non-U.S. persons”.
2. In Part II, the heading of Section II b. is changed to “b. Name, Type, and Address of Legal Entity for Which the Account is Being Opened:”
3. In the headings of the last column in the Tables in Section II c and Section II d, the term “Foreign Persons” is changed to “Non-U.S. Persons” and the term “Social Security Number” is added after the term “persons”.
4. In footnote 1, the term “Foreign Persons” is changed to “Non-U.S. Persons” and “a Social Security Number,” is inserted after the word “provide”.

81 Fed. Reg. 45183. For visual learners, such as myself, I summarized the changes in red in the old model form and highlighted the last change in the new model Certification Form:

Change # 1

 

Change #2

Change #3

Change #4

Credit unions that are relying on a forms provider to create the Certification Form may want to ensure the technical amendments are incorporated before the compliance deadline sneaks up. As I recall, the process of requesting a modification to a form, reviewing the changes and approving the final form can take some time so it is important to get the ball rolling. The technical amendment did include a model Certification Form that incorporates the amendments, but the form is spread out into four parts:

https://s3.amazonaws.com/images.federalregister.gov/ER28SE17.004/original.png?1506528076

https://s3.amazonaws.com/images.federalregister.gov/ER28SE17.005/original.png?1506528077

https://s3.amazonaws.com/images.federalregister.gov/ER28SE17.006/original.png?1506528077

https://s3.amazonaws.com/images.federalregister.gov/ER28SE17.007/original.png?1506528093

***

CFPB Updates HMDA Small Entity Compliance Guide. The CFPB just updated their HMDA small entity compliance guide to incorporate the amendments to its 2015 HMDA rule. The updates incorporate changes introduced in the April 2017 HMDA proposal (technical clarifications) and the July 2017 HMDA proposal regarding transactional thresholds for reporting HELOCs.

Regulatory Compliance School and Seminar. I also wanted to say on behalf of the Regulatory Compliance team, thank you for joining us at NAFCU's Regulatory Compliance School and Seminar in sunny San Diego. It is energizing to see so many engaged compliance professionals in one place!

The Feds Might be Coming for Mary Jane

Written by Pamela Yu, Special Counsel for Compliance and Research

Since moving my family from the DC metro area to Denver last summer, curious friends and family have often asked about the marijuana industry out here in the Mile High City.  After eight months in beautiful Colorado, I can report that yes, we have a pot shop just up the street (actually, it's a pretty fancy "cannabis boutique") and yes, the marijuana industry in this state is booming and thriving.  In 2015 alone, Colorado reportedly collected more than $135 million in taxes and license fees related to legal marijuana sales, with more than $35 million of those funds earmarked for public school construction projects.  But is the Mary Jane Gravy Train about to find a major roadblock in its path?

The Trump Administration is signaling that a major shift in federal marijuana enforcement policy may be just around the corner.  As we have blogged about in the past, credit unions providing, or interested in providing, financial services to marijuana-related businesses already face significant legal, compliance and operational challenges, and these difficulties are about to get worse.

By way of background, to date, more than half the country—28 states in total—has legalized marijuana in some form at the state level.  Under the Controlled Substances Act (CSA), however, marijuana remains a schedule I controlled substance, which makes it illegal under federal law to manufacture, distribute, or dispense marijuana.  See, 12 U.S.C. §812(b)(1).  In addition, criminal provisions of federal money laundering statutes, unlicensed money remitter statutes, and the Bank Secrecy Act (BSA) remain in effect with respect to marijuana-related activity.  For example, it is a federal criminal offense to engage in certain financial and monetary transactions with the proceeds of a “specified unlawful activity,” including marijuana-related funds.  See, 18 U.S.C. §§ 1956 and 1957.  It is also a federal criminal offense to transact funds “derived from” marijuana-related activity by or through a money transmitting business. See, 18 U.S.C. § 1960.  Financial institutions that conduct transactions with funds derived by marijuana-related activity may also be subject to criminal liability for failing to identify or report financial transactions involving marijuana proceeds.  See, 31 U.S.C. §5318(g).

As such, financial transactions involving proceeds from marijuana-related activity can still form the basis for federal criminal prosecution, despite growing legalization under state law.  Due to this conflict between federal and state law, credit unions and banks have been challenged in providing financial services to marijuana-related businesses.  Financial institutions have also faced uncertainty about how they can provide services to marijuana-related businesses consistent with their BSA compliance obligations.  As a result, legal marijuana-related businesses remain largely unbanked and typically operate as cash-based businesses, increasing the risk of robbery and other crimes.  Several members of Congress have called for legislative and/or regulatory action to enhance financial access for legal marijuana-related businesses.  In response, under the Obama Administration, the Department of Justice (DOJ) issued "Cole" memos in 2013 and 2014 addressing marijuana enforcement, and the Financial Crimes Enforcement Network (FinCEN) in 2014 issued guidance on BSA expectations regarding marijuana-related businesses. Together, the DOJ memos and the FinCEN guidance created a path—albeit somewhat narrow—for credit unions to serve marijuana-related businesses consistent with their compliance obligations. 

However, recent comments from the White House and the attorney general are strongly hinting at a reversal from the previous administration's policy that the federal government would not direct its investigative and prosecutorial resources to states where marijuana is allowed under state law. 

In February, while drawing some distinction between medical and recreational marijuana, White House press secretary Sean Spicer indicated that "there is still a federal law that we need to abide by when it comes to recreational marijuana," and "I do believe you will see greater enforcement of it."

Meanwhile, during his Senate confirmation proceedings attorney general Jeff Sessions testified that, "I won't commit to never enforcing federal law," after previously stating, "good people don't smoke marijuana."

While still speculative at this point, a change in federal drug enforcement priorities could mean even greater uncertainty for credit unions already serving or looking to serve marijuana-related businesses. The DOJ memos and FinCEN guidance provided a framework for offering financial services to marijuana-related businesses but the fact remains that marijuana is still illegal under federal law.  At the end of the day, agency guidance and enforcement policies are not binding law.  The Trump Administration has full discretion and authority to overturn the DOJ memos and alter federal enforcement priorities with respect to marijuana-related activity.  If that happens, credit unions providing financial services to marijuana-related businesses are vulnerable to uncertain legal and compliance liabilities. 

Keep in mind that FinCEN's guidance relies on the enforcement posture articulated in the 2013 and 2014 DOJ memos:

FinCEN is issuing this guidance in light of recent state initiatives to legalize certain marijuana-related activity and related guidance by the U.S. Department of Justice (“DOJ”) concerning marijuana-related enforcement priorities. This FinCEN guidance clarifies how financial institutions can provide services to marijuana-related businesses consistent with their BSA obligations, and aligns the information provided by financial institutions in BSA reports with federal and state law enforcement priorities.

Accordingly, if federal law enforcement priorities change or the DOJ memos are repealed or revised, credit unions can no longer rely on the FinCEN guidance for serving marijuana-businesses, heightening BSA compliance risks.  It is also unclear at this point how NCUA would respond to any change in federal drug enforcement policy.  While the agency instructed its examiners to follow the DOJ and FinCEN guidance, all bets are off if the current White House reverses course, and NCUA will almost certainly comply with any new directives from the Trump Administration with respect to federal enforcement of marijuana-related activities.

A lot remains uncertain, but if your credit union is serving or looking to serve marijuana-related businesses, be sure to watch this space for updates on any further developments.  Also, as always, feel free to reach out the NAFCU Compliance Team with any questions.

AML Violations Cost Western Union $586 Million; January 2017 BSA Blast

Written by Shari R. Pogach, Regulatory Paralegal, NCBSO

On January 19, 2017, it was announced that the Western Union Company (Western Union) had agreed to forfeit $586 million and enter into agreements with the Department of Justice (DoJ) and the Federal Trade Commission (FTC) for willful anti-money laundering (AML) violations.  Not only did Western Union fail to maintain an effective AML program, it violated the Bank Secrecy Act (BSA) by aiding and abetting wire fraud from 2004 to 2012 by processing hundreds of thousands of transactions for its agents and others involved in international consumer fraud schemes.

The coordinated investigations determined that Western Union agents were:  participating in activities to defraud tens of thousands of U.S. residents via various forms of mass marketing schemes promoting prizes or job opportunities; assisting in hundreds of millions of dollars being sent to China in structured transactions (a great deal of this money was sent by illegal immigrants to pay their human smugglers); and not limiting transactions indicating illegal gaming from Florida to other countries offshore sportsbooks.

On the same day the Financial Crimes Enforcement Network (FinCEN) announced its $184 million civil money penalty against a subsidiary of Western Union, Western Union Financial Services, Inc. (WUFSI) for violating the BSA’s AML requirements.  Specifically FinCEN determined that prior to 2012, WUFSI failed to implement and maintain an effective, risk-based AML program on foreign agents/outlets and to timely file suspicious activity reports (SARs).  The company was found not to have appropriate controls to “effectively mitigate its money laundering risks along the southwest border between the United States and Mexico.  For example, in not performing proper or enhanced due diligence, it was found that some former agents owned by persons formerly terminated by WUFSI for money laundering concerns were able to sign “new agent” agreements and continue to use the company’s money transfer system for their fraud and money laundering activities.  And, before 2012, WUFSI took over 90 days to investigate activity for which the company had the facts as a basis to file a SAR.  WUFSI filed thousands of SARs on customers of its agent locations but only filed such reports on the agent if found to be “complicit.”  Typically an agent was only found to be complicit if the agent was “arrested, publicly identified to be implicated in illicit transactions, or if WUFSI’s own investigation determined that the agent location was complicit.”  This also delayed reporting.

FinCEN determined that WUFSI willfully violated the program and reporting requirements of the BSA and its implementing regulations.  Its $184 million civil money penalty will be deemed satisfied by payment to the DoJ as part of the $586 million forfeiture for the victims of fraud. 

Western Union has also agreed to enhanced compliance obligations.  This includes creating policies and procedures: “for corrective action against agents that pose an unacceptable risk of money laundering or have demonstrated systemic, willful or repeated lapses in compliance; that ensure that its agents around the world will adhere to U.S. regulatory and AML standards; and that ensure that the company will report suspicious or illegal activity by its agents or related to consumer fraud reports.”

***

BSA Blast.  The January 2017 issue of the BSA Blast is available today. (NAFCU login required).  The articles in this issue cover:  the New York State Department Financial Services’ enforcement action against the Agricultural Bank of China for anti-money laundering rules and regulations violations; an example of the importance of updating Bank Secrecy Act compliance programs as an institution’s business model changes; and comments by the deputy director of the Financial Crimes Enforcement Network (FinCEN) on the agency’s current focus.  Also included is a BSA quiz that reviews FinCEN’s last four advisories issued for financial institutions.

Should Credit Unions Photocopy Identification Cards?

Written by Shereefat Balogun, Regulatory Compliance Counsel

So last week, I attempted to take some cash out of my credit union’s ATM but the customer in front of me had a bunch of checks she had to deposit and took forever.  I decided to walk into the branch and ask for the cash withdrawal.  The teller asked me for my driver’s license or any similar ID. I told her that I did not have any ID on me (don’t judge me!), but I had my ATM/debit card.  The teller said she would be able to process my request only if the credit union had a copy of my ID on file.  While I understood the benefits of having the copy on file, I could not help but to think about the different compliance issues this raises.  Yes, the copy of the ID is great for verifying your members’ identity or helping to detect fraud.  However, it got me thinking about compliance issues relating to IDs, such as military IDs and fair lending concerns.  Contrary to what we’ve been taught, what’s good for the goose is NOT always good for the gander. 

Bank Secrecy Act and CIP Recordkeeping

The Bank Secrecy Act requires a credit union to know its member (KYC or KYM whichever lingo you prefer) and have a customer identification program (CIP). This includes checking a government identification number, which can be done with documentary evidence like an ID.  So collecting the ID to verify the information is one thing.  But should a credit union keep a copy of the ID in its records?  For recordkeeping purposes, the CIP rule leaves it up to the credit union to determine how it wants to document verification that has been performed.  Generally, the rule requires a credit union to retain a description of the document that was relied on, noting the type of document, any identification number contained in the document, the place and date of issuance, and expiration date.  So, a description is generally sufficient.  Though the credit union may retain a copy of the ID, it certainly is not required.  See, 31 C.F.R. §1020.220(a)(3)(i)(B).  This is also confirmed in FinCEN’s Guidance on Customer Identification Regulations FAQs:

2. Can a bank keep copies of documents provided to verify a customer’s identity, in addition to the description required under 31 C.F.R. § 103.121(b)(3)(i)(B), even if it is not required to do so?

Yes, a bank may keep copies of identifying documents that it uses to verify a customer’s identity. A bank’s verification procedures should be    risk-based and, in certain situations, keeping copies of identifying documents may be warranted. In addition, a bank may have procedures to keep    copies of documents for other purposes, for example, to facilitate investigating potential fraud…

(Emphasis added.)

Keep in mind though, that although there are no federal regulations prohibiting a credit union from photocopying ID, some states prohibit photocopying IDs.  Be sure to check with your individual state law to see if there are any limitations here.

But wait…what about military IDs?  Good question!  While a credit union may use a military ID to collect identifying information for CIP purposes and other purposes, it cannot copy the ID for CIP purposes.  Federal law generally prohibits the copying or scanning of military ID:

Whoever manufactures, sells, or possesses any badge, identification card, or other insignia, of the design prescribed by the head of any department or agency of the United States for use by any officer or employee thereof, or any colorable imitation thereof, or photographs, prints, or in any other manner makes or executes any engraving, photograph, print, or impression in the likeness of any such badge, identification card, or other insignia, or any colorable imitation thereof, except as authorized under regulations made pursuant to law, shall be fined under this title or imprisoned not more than six months, or both.

(Emphasis added.)

As stated above, photocopying military ID can subject a person to fines and imprisonment up to 6 months.  If your BSA/CIP program permits the photocopying of military ID identification, you may want to reassess your CIP requirements. 

To emphasize, the statute prohibits the photocopying the military identification card.  For CIP purposes, it’s our understanding that some credit unions document information found on the military ID since they are unable to make a copy.  This practice is consistent with the CIP recordkeeping requirement discussed above. 

Fair Lending Concerns

So we’ve established that it is customary to collect and retain a copy of a driver’s license for CIP purposes.  However, for purposes of Regulation B and other fair lending laws, credit unions may want to keep that copy out of the member’s loan application file.  For example, Regulation B prohibits financial institutions from considering certain information when evaluating an application and making a credit decision.  Indeed, the FinCEN FAQ highlighted above also warned:

Nonetheless, a bank should be mindful that it must not improperly use any document containing a picture of an individual, such as a driver’s license, in connection with any aspect of a credit transaction.

(Emphasis added.)

Regulation B and Regulation C require a credit union to collect certain information for monitoring purposes.  For instance, Regulation B requires a credit union that receives a credit application to collect certain information, such as ethnicity, sex, and age.  See, 12 C.F.R. §1002.13(a).  Similarly, Regulation C requires a credit union to collect certain data in relation to applications for home purchase loans, home improvement loans, and refinancings.  This information includes information about the ethnicity, race, and sex of the applicant or borrower.  See, 12 C.F.R. §1003.4(a)(10).  When collecting this information, a credit union may list questions regarding the ethnicity, race, and sex of the applicant on the loan application form, or on a separate form that refers to the application.  See, Appendix B to 12 C.F.R. Part 1003.

Although neither rule explicitly instructs credit unions to refrain from maintaining a copy of a driver’s license from a loan file, doing so may increase your fair lending risks, and may lead to examiner scrutiny.

As always, if you have any questions about this blog or any other compliance issue, please feel free to reach out to NAFCU’s Regulatory Compliance Team.  We’re here for you!

FinCEN Advisory on Cyber-Events and Cyber-Enabled Crime Part 2 - What Should Be Reported in a Cyber-Related SAR

Written by Shari R. Pogach, Regulatory Paralegal, NCBSO

As we’ve previously blogged, last week the Financial Crimes Enforcement Network (FinCEN) issued FIN-2016-A005, its guidance to financial institutions on reporting cyber-related events and cyber-enabled crime.  So what kind of information should a credit union include in a suspicious activity report (SAR) when reporting such activity? 

First, FinCEN reminds filers that SARs are to be complete, accurate and incorporate all relevant information regarding suspicious activity, including cyber-related information.  Why?  Since today’s financial transactions increasingly occur through the use of electronic systems and resources, any illicit financial activity will often have a digital footprint leading back to the individuals, their associates, their activity and any related suspicious transactions.  So any SAR (including a voluntary SAR) should include any available cyber-related information reporting any suspicious activity. Examples of cyber-related information include:  IP addresses with time stamps, virtual-wallet information, device identifiers and cyber-event information. FinCEN states that financial institutions should document and give a detailed description of the suspicious activity reported.  SAR narratives should include descriptive cyber-related information as well as any cyber-related identifiers where there is not a pre-designated SAR field.

So when possible a cyber-related event SAR should include:

• Description and magnitude of the event
• Known or suspected time, location, and characteristics or signatures of the event
• Indicators of compromise
• Relevant IP addresses and their timestamps
• Device identifiers
• Methodologies used
• Other information the institution believes is relevant

FinCEN’s advisory includes an attachment of frequently asked questions (FAQs) with specific details and technical specifications on completing SARs concerning cyber-events and cyber-enabled crime.  The agency states these FAQs supersede its 2001 FAQs on computer intrusion as the new document provides new information and additional details. As one example, the new guidance notes that cyber-events and cyber-enabled crime can involve event-specific information.  Still, FinCEN requests that SAR filers be consistent and use common and accepted terminology.  One resource filers can use is the Glossary of Key Information Security Terms (May 2013), a publication issued by the National Institute of Standards and Technology (NIST).  The guidance also clarifies how a financial institution is to report when it experiences numerous cyber-events; what it should do in instances of continuous scanning or probing of an institution’s systems or network; and whether to report when an otherwise reportable cyber-event is unsuccessful.

FinCEN recommends institutions circulate the advisory with: cybersecurity units, network administrators, risk departments, fraud prevention units, BSA/AML management, AML intelligence units and AML analysts/investigators. According to the agency, it is not* creating any new obligation or expectation requirement for financial institutions to collect cyber-related information as a matter of course. (*wink)

Whale and Spear Phishing Examples and Red Flags; Credit Unions and the Higher Road

Written by Shari R. Pogach, Regulatory Paralegal

I know you’ve all heard about the digital con games that target businesses and individuals and their email accounts.  The endgame goal is to get funds wire transferred into the criminal hacker’s account, usually to a bank located in Asia.  The Financial Crimes Enforcement Network (FinCEN) recently issued an advisory, FIN-2016-A003, to help financial institutions to guard against email phishing fraud that has involved $3.1 billion since 2013.  And, that’s just the 22,000 reported cases.

The two main types of email phishing fraud are:

• When a company’s business email is compromised; and
• When a victim’s personal email account is compromised.

What happens is the bad guys hack into a person’s email (either business or personal) and get as much information as they can about his or her financial institutions, account details, contacts and other related information.  Those stolen details are then used to email instructions that appear to be from the accountholder to get the financial institution to initiate an unauthorized wire transfer of funds into the criminals’ domestic or foreign bank accounts.

The advisory gives examples of the types of scenarios used and a red flag list to help identify possible email phishing fraud.  Here are a few email phishing fraud red flag triggers:

• Seemingly legitimate emailed transaction instructions using different language, timing and amounts than previously verified instructions.
• Instructions coming from an email account that looks very similar to the victim’s email account but has been slightly altered by adding, changing or deleting characters.
• Instructions that direct the payments to a known beneficiary but the beneficiary’s account information is now different.
• The instructions direct payment to a beneficiary where there is no prior payment history or documented relationship to the customer and the payment is significantly higher than payments to other beneficiaries the customer has paid in the past.
• Instructions are delivered in such a way that gives limited time or opportunity to confirm the transaction’s authenticity.
• The instructions come from an employee who is a newly authorized person on the customer’s account or someone who hasn’t previously sent wire transfer instructions.

FinCEN stresses no single transactional red flag indicates suspicious activity, additional questions and further investigation may be necessary to determine if a transaction is indeed suspicious.  It is also recommended the advisory should be widely shared within the institution with its:  cybersecurity and risk departments; fraud prevention units; BSA/AML management; AML intelligence units; and AML analysts/investigators.

***

Speaking of fraud, Wells Fargo was all over the headlines last week with its historic fine for unlawful sales practices.  Just more bad bank behavior. I think our CEO said it best in his Berger Leadership Blog that this is what differentiates us and makes the credit union industry so stellar – putting members first instead of profits.  Take a moment to read his post and give yourself a pat on the back today as you start the week.

So You Want to Service Marijuana Businesses? BSA Expectations for Marijuana- Related Businesses

Written by Shereefat Balogun, Regulatory Compliance Counsel

Currently, about 20 states and the District of Columbia have legalized certain marijuana-related activity.  For example, Alaska, Colorado, Oregon, Washington, and Washington D.C., have legalized recreational and medicinal marijuana for adults.  Moreover, it is anticipated that more states will enact laws allowing for the legalization of marijuana.  In light of these developments, it is important for credit unions that offer, or are thinking about offering, marijuana related business accounts to be reminded of their compliance obligations particularly under the Bank Secrecy Act (BSA).  Warning, the regulators are not making it easy here.

As an initial matter, marijuana is still illegal under federal law.  That said, in 2014, the Financial Crimes Enforcement Network’s (FinCEN) created strict guidelines for credit unions seeking to service marijuana-related businesses.  The guidance set forth new due diligence requirements for opening an account for a marijuana-related business.  As part of its member due diligence, a credit union deciding to provide financial services to these businesses is required to:

• Verify with the appropriate authorities whether the business is duly licensed and registered;

• Review the license application (and related documentation) submitted by the business for obtaining a state license to operate its marijuana-related business;

• Request from state licensing and enforcement authorities available information about the business and related parties;

• Develop an understanding of the normal and expected activity for the business, including the types of products to be sold and the type of customers to be served (e.g., medical versus recreational members);

• Conduct ongoing monitoring of publicly available sources for adverse information relating to the business and related parties;

• Conduct ongoing monitoring for suspicious activity; and

• Update information obtained as part of member due diligence on a periodic basis commensurate with the risk.

See, FinCEN Guidance, 2014-G001.

Along with the above requirements, as part of its due diligence, a credit union is expected to consider whether a marijuana-related business implicates any of the eight priorities defined by the DOJ, in the infamous “Cole Memo”.  The Cole Memo notes that the DOJ is committed to prosecuting any individual or entity that interferes with any of its eight delineated priorities including:

• Preventing proceeds from the sale of marijuana from going to criminal enterprises, gangs, and cartels;
• Preventing state-authorized marijuana activity from being used as pretext for the trafficking of other illegal drugs or other illegal activity.

See, Department of Justice, Guidance Regarding Marijuana Enforcement.   

The DOJ issued a supplemental memo the same day FinCEN issued its guidance.  The memo reiterates the DOJ's 2013 position and generally reaffirms FinCEN's guidance.  In short, credit unions are expected to monitor and ensure marijuana-related businesses do not violate the eight priorities set forth in the Cole Memo, as well as stay in compliance with the member due diligence requirements outlined by FinCEN. 

If you thought that was it, there is more.  SAR filing obligations remain!  While some states allow businesses to sell marijuana, federal law still makes it a crime.  Thus, credit unions must file a SAR on activity involving a marijuana-related business.  Credit unions are advised to review the guidance relating to SAR reporting and filing requirements, as well as some of the red flags to look out for. 

And there’s more- the CTR.  Consistent with BSA/AML reporting requirements, credit unions are also required to file a CTR in connection with marijuana-related businesses. And importantly, a business engaged in marijuana- related activity is not eligible for a CTR exemption under 31 C.F.R. 1020.315(b)(6). See, FinCEN Guidance, 2014-G001.

And there’s more….. No, that’s it…for now.

On a final note, it is worth noting that while FinCEN seems to have given a pass to credit unions interested in banking marijuana-related businesses, so long as the above conditions are met; and while, NCUA has instructed its examiners to follow the guidance, other hurdles make servicing these businesses challenging and unclear.  Aside from the additional regulatory requirements and associated costs to participate in this activity, credit unions thinking about exploring this opportunity cannot avoid the fact that marijuana is still technically illegal- federally speaking. The guidance doesn’t address the legal issue of whether a credit union is violating federal law in providing services to marijuana businesses.  Moreover, credit unions that bank marijuana-related businesses may not have access to the Federal Reserve System, as illustrated in the case of Fourth Corner Credit Union in Colorado.   The credit union sued the Kansas Federal Reserve Bank after it refused to open an account for the credit union.  In dismissing the case earlier this year, the court held that it could not use its authority to require the Fed to facilitate a federal offense. The credit union filed a separate action against NCUA for not providing it with federal share insurance.  Apparently, NCUA had concerns over the credit union’s ability to mitigate the risk of banking only marijuana businesses.

To learn more about marijuana-related businesses, the compliance risks, and what your credit union can do to mitigate those risks, come join us at NAFCU’s BSA Seminar in New Orleans from October 24 – 28.  In addition to learning more about marijuana-related businesses, you can expect a full week of everything you’ve ever wanted to know about BSA.  Check out the full agenda and sessions.  We have limited seating – so register now!

ICYMI: Webinars, Resources and Enforcement Actions! O My!

Written by Elizabeth M. Young LaBerge, Regulatory Compliance Counsel

Happy Wednesday! NCUA has been issuing press releases and webinars left and right this summer. I wanted to take a moment and make sure everyone was up to date. Also, the CFPB has taken some enforcement actions and issued some new volumes of supervisory publications, which credit unions may want to be aware of.

NCUA Webinars and Resources

• On July 15, NCUA released a new video and a colorful brochure for members regarding remittance transfers. Both items are also available in Spanish.

• On August 10, NCUA will host a webinar entitled “Marketing – Effective Use of Social Media” discussing how to create, target, message and execute social media marketing. Online registration is available here. As a reminder, the FFIEC has issued guidance regarding the use of social media in its Social Media: Consumer Compliance Risk Management Guidance.

• On August 18, NCUA will host a webinar focused on its “Revised Interest Rate Risk Supervision Procedures,” and its plans for adding an “S” to CAMEL. There will be a Q&A on supervisory expectations and NCUA’s process for implementing procedures and training examiners. Online registration is available here. For credit unions who are interested, NCUA’s current resources for interest rate risk can be found here.

• Finally, on July 6, NCUA released the latest installment of its Economic Update video series, discussing the current trends, the outlook on interest rates, and the implications of Brexit.

CFPB Supervisory Publications and Enforcement Actions

• The CFPB has released issue 11 of its Supervisory Highlights, a special edition focused on mortgage servicing. The issue discussed supervisory findings surrounding loss mitigation and servicing transfers. Regarding loss mitigation, the CFPB found issues in loss mitigation acknowledgement notices, offer letters, denial notices and related communications. Regarding servicing transfers, it highlighted issues with transfer policies and procedures, especially when a loan is in the loss mitigation process.

• The CFPB also released volume 12 of its Monthly Complaint Report. This volume focused on complaints surrounding consumer loans, including auto lending. In its geographic spotlight, the Report focused on Arkansas.

• On June 29, the CFPB announced the filing of an enforcement action against BancorpSouth Bank alleging discriminatory mortgage lending practices, including redlining, charging more to similarly qualified African-American customers and implementing an explicitly discriminatory loan denial policy. As a reminder, NCUA’s Fair Lending Guide and the FFIEC Interagency Fair Lending Examination Procedures are available for credit unions seeking to comply with fair lending requirements.

• On July 14, Santander Bank entered into a Consent Order with the CFPB regarding violations in connection with its overdraft protection program. The Consent Order states that Santander Bank initiated a vigorous telemarketing campaign to enroll customers in its overdraft protection program, and misled customers regarding the nature of those sales calls and the opt-in process. The violations recited in the Consent Order included failing to obtain an affirmative opt-in and  misleading consumers about the program, including the fees involved, the consequences of not opting-in and the transactions covered by the service. Among other requirements, the Consent Order requires that Santander Bank pay a $10 million civil money penalty. Credit unions seeking to avoid Santander’s fate can consult NCUA’s Letter to Credit Unions 05-CU-03 and its enclosed Interagency Guidance on Overdraft Protection Programs.

One for the Road: FinCEN

• Yesterday FinCEN issued FIN-2016-G003, entitled Frequently Asked Questions Regarding Customer Due Diligence Requirements for Financial Institutions. The FAQs provide 26 Q&As designed to assist credit unions in understanding and implementing the new CDD requirements. Credit unions that are covered must comply by May 11, 2018.

NAFCU member credit unions with questions or looking for resources should reach out to the NAFCU Regulatory Compliance Team. We are here to help!

BSA/AML Compliance Requirements: Frequently Asked Questions This Week; NAFCU’s new BSA Seminar + Certification is Here!

Written by Shereefat Balogun, Regulatory Compliance Counsel

This week NAFCU hosted its annual Regulatory Compliance School, focusing on the most important regulatory compliance issues facing credit unions. Today’s session will cover the Bank Secrecy Act (BSA) and OFAC (Office of Foreign Assets Control) regulatory framework. However, attendees seemed all too anxious and could not wait to ask their BSA/AML related questions- and understandably so. With an increase in enforcement actions for BSA/AML violations, ongoing OFAC sanctions and impending rules on customer due diligence, credit unions, and other financial institutions, are working hard to keep up with their compliance requirements under the BSA/AML regime. Today’s “FAQs” were inspired by the many BSA/AML related questions and concerns raised throughout the week.

Q: Does a credit union have an obligation to reconcile conflicting identification information provided by a member? We have a member who recently filled out a change of address form, and the SSN he put down is completely different from the one he gave to open this account. Is there any responsibility on the credit union’s part to take any action concerning this discrepancy?

A: Yes, the credit union does have an obligation to address any discrepancies as it pertains to identifying information.  Generally, before opening an account for a customer, the credit union must be able to form a reasonable belief that it knows the true identity of the customer based on the information gathered. The conflicting information may have been made in error.  In any event, the CIP procedures must specify how the credit union will resolve the discrepancies.  If the information is indeed conflicting and can’t be reconciled, the credit union may have an obligation to file a SAR.

Each credit union must have a written CIP that allows it to form a reasonable belief that it knows the true identity of each customer.  The CIP must contain procedures for opening an account that specify the identifying information that will be obtained from each customer.  The credit union must obtain, at a minimum, the following four pieces of information from the customer prior to opening an account:

• Name
• DOB for individuals
• Address
• Identification Number

In addition to gathering the four pieces of information outlined above, the credit union is required to verify the identity of the customer using the information gathered.  In verifying the information, the credit union may use documents and/or non-documentary methods, if its CIP procedures allow for that.  If there are discrepancies in the information, this may create a challenge in the credit union’s ability to form a reasonable belief that it  knows the true identity of a member.  The CIP procedures should outline steps the credit union will take to properly, and more accurately, identify an individual.  The conflicting information may have been made in error.  In any event, the CIP procedures must specify how the credit union will resolve discrepancies using documents and/or non-documentary information.   This may include calling the member to address inconsistencies, relying on other sources such as public databases, or checking references with other banks and/or credit unions.  If the information is indeed conflicting and can’t be reconciled, the credit union may have an obligation to file a SAR. Also note that the credit union is well within their right to put the account on hold while it reconciles the information.

 

Q: Can a credit union accept a current passport instead of a taxpayer identification number or social security number at account opening?

A: Generally, credit unions must obtain an identification number before opening an account for a prospective member.  For US persons, this would be a taxpayer identification number.  For non-US persons, a current passport would suffice.  It appears, however, that a credit union may accept other forms of ID if its CIP procedures provide for that, especially where the customer has applied for a taxpayer identification number, but has not yet received one.  Generally, before opening an account for a customer, the credit union must be able to form a reasonable belief that it knows the true identity of the customer based on the information gathered. The relevant rules can be found in 31 CFR 1020.220.

Before opening an account for a customer, a credit union must collect identifying information, including an identification number.  For a U.S. person, this will be a taxpayer identification number.  For a non-U.S. person, one or more of the following will be acceptable: (i) a taxpayer identification number; (ii) passport number and country of issuance; (iii) alien identification card number; or (iv) number and country of issuance of any other government-issued document evidencing nationality or residence and bearing a photograph or similar safeguard.

The rule does make an exception for individuals who are applying for a taxpayer identification number.  According to the rule, a credit union’s CIP may include procedures for opening an account for someone who has applied, but not received a taxpayer identification number.  This may include accepting other forms of identification number, including a current passport.  However, the procedures must ensure that the individual obtains the taxpayer identification number within a reasonable period of time after the account is opened.

(B) Exception for persons applying for a taxpayer identification number. Instead of obtaining a taxpayer identification number from a customer prior to opening the account, the CIP may include procedures for opening an account for a customer that has applied for, but has not received, a taxpayer identification number. In this case, the CIP must include procedures to confirm that the application was filed before the customer opens the account and to obtain the taxpayer identification number within a reasonable period of time after the account is opened.  31 CFR 1020.220(a)(2)(i)(B)(emphasis added.).

Also, the rules provide credit unions with the ability to verify identification through non-documentary methods.  The credit union’s CIP must specify the situations where a credit union would use non-documentary methods to verify a customer’s identity and how to handle them, including when a customer doesn’t have all the necessary documents at the time he/she comes in to open the account.

 

Q: Is a credit union required to file a CTR where a member withdraws $9,500 in cash from a rep payee account and $700 from his personal account on the same day? 

A: The answer to your question can be found in Treasury’s BSA/AML regulations, 31 CFR 1010.  Yes, in this situation, the credit union is required to file a CTR because, although there were multiple transactions, the transactions: (i) resulted in a cash withdrawal in excess of $10k; (ii) occurred during the same business day; and (iii) were made by the same person.

31 CFR 1010.311 requires that a credit union report cash transactions in excess of $10,000 during the same business day. Indeed, the rule states:

Each financial institution other than a casino shall file a report of each deposit, withdrawal, exchange of currency or other payment or transfer, by, through, or to such financial institution which involves a transaction in currency of more than $10,000, except as otherwise provided in this section.  31 CFR 1010.311 (emphasis added.).

Moreover, the amount over $10,000 can be either in one transaction or a combination of cash transactions.  The credit union should treat the multiple transactions as a single transaction if the credit union knows that the transactions are by the same person. The rule provides:

(b) Multiple transactions. In the case of financial institutions other than casinos, for purposes of the transactions in currency reporting requirements in this chapter, multiple currency transactions shall be treated as a single transaction if the financial institution has knowledge that they are by or on behalf of any person and result in either cash in or cash out totaling more than $10,000 during any one business day (or in the case of the U.S. Postal Service, any one day). Deposits made at night or over a weekend or holiday shall be treated as if received on the next business day following the deposit.  31 CFR 1010.313 (b)(emphasis added.).

Here, although the first cash withdrawal of $9,500 was made from a rep payee account, and thus was not his own personal account and not his own personal funds, the aggregate amount withdrew on that day was in excess of $10,000 and was made by the same person.  The credit union was asked to give a single person more than $10,000 in cash on a single day. The fact that the transactions involved multiple, or different, accounts is irrelevant.  Accordingly, the credit union should file the CTR with FinCEN.

 

Q: What steps should a credit union take when it gets an “OFAC hit”?

A: OFAC’s (Office of Foreign Assets Control) regulations prohibit all US persons from engaging in transactions with certain specified persons and countries. Specifically, credit unions must: (i) block accounts and other assets of “Specifically Designated Nationals” (SDNs) and “Blocked Persons”; and (ii) block or reject prohibited transactions with SDNs and Blocked Persons.

Generally, if the credit union gets an “OFAC” hit, the credit union needs to confirm that the individual that was flagged is indeed the individual on the SDN list. Treasury has a hotline dedicated to providing assistance with making a determination if the person is the same. If the person or entity is indeed the same included on the SDN list, the credit union cannot open the account; but rather must block the transaction and account, and also report the blocked transaction/account to OFAC.

While not required by specific regulation, NCUA expects that a credit union will establish and maintain an effective, written OFAC compliance program commensurate with its OFAC risk profile. Amongst other things, the policies, procedures and processes should address how the credit union will identify and review transactions and accounts for possible OFAC violations. The policies and procedures should also define the credit union’s criteria for comparing names provided on the OFAC “SDN” list with the names in the credit union’s files or transactions and for identifying transactions or accounts involving sanctioned countries. Furthermore, the policies and procedures should address how the credit union will determine whether an initial OFAC hit is a valid match or a false hit.

 

Q: Where can I go for assistance in developing our BSA/AML risk-based model? The rules don’t say anything. I’ve checked the FFIEC BSA/AML examination manual and it doesn’t say much on how the risk based model program should look like.

A: Honestly, the guide or the rules will not go into that level of detail. Here’s the reason. Generally, governments around the world feel that the risk-based approach is preferable to a more prescriptive approach in the BSA/AML space because it is:

1. Flexible- AML/BSA risks vary across jurisdictions, customers and products; and
2. Effective- Credit unions are better equipped than legislators to effectively assess and mitigate specific BSA/AML risks they face.

Notwithstanding the lack of specific guidance, however, there are four main things a credit union’s risk assessment should consider:

1. Members- Who are you selling your products or offering services to? Individuals or private companies? Foreign public officials? Money Servicing Businesses?
2. Products and Services- What products and services are you offering that may be vulnerable to money laundering? Online banking? Private banking? Correspondent banking? Wire transfers?
3. Geographical Location- In what countries do your members reside and what are their countries of citizenship? Where are your corporate customers headquartered and where do they conduct their business? Are you engaging in transactions involved with countries included on any government lists?

Generally, some member types , products and services, and geographical locations pose higher risks than others, and thus your program wants to properly identify those and tailor its monitoring accordingly.

As indicated above, we received a substantial number of BSA/AML inquiries. Indeed, compliance with the BSA/AML rules remains a top priority for financial institutions. NAFCU is here to assist you as you navigate through the rules and will keep you abreast of emerging challenges, and regulatory developments. In fact, the industry is still awaiting FinCEN’s final rule on Customer Due Diligence and beneficial ownership requirements, which is expected this year. We will keep you posted.

###

NAFCU’s new BSA Seminar + Certification is Here!

We’ve had hundreds of requests from credit unions to provide more BSA training, and I’m excited to announce, it’s here. We’ll be holding our first in-person, BSA Seminar in New Orleans October 24 – 28. If those dates and location sound familiar to you, it’s not déjà vu. We’ll be running this BSA Seminar concurrently to our Regulatory Compliance Seminar. While they are two separate educational events, the networking aspects will be co-mingled, making it an awesome way to build your network of credit union and BSA professionals from around the country.

You can expect a full week of everything you’ve ever wanted to know about BSA, but didn’t have time to ask. It’s designed for just credit union professionals. You’ll find no erroneous “bank” information that doesn’t apply to credit unions. Check out the full agenda and sessions.

There’s an optional, pre-conference workshop to help get you up-to-speed on BSA fundamentals – it’s perfect if you’re new to BSA or just want a refresher. And at the end of the week, you’ll have the opportunity to get certified when you sit and pass the NAFCU Certified Bank Secrecy Officer (NCBSO) exam.

This seminar, and the certification, is an excellent way to demonstrate to NCUA and FinCEN you’re dedicated to compliance and to protecting your credit union against financial crime. It was designed by NAFCU’s Director of Education Devon Lyon, former director of BSA at State Department Federal Credit Union – so the curriculum is extremely relevant at both a strategic and tactical level. You’ll walk away ready to master your AML responsibilities. And of course, it fulfills your yearly BSA training requirement!

We have limited seating – so register early!

Resources for Fraud Victims

Written by Eliott C. Ponte, Regulatory Compliance Counsel

Last Friday, I became the target of a scammer.  Yes, little ol’ me. Why?  I can’t tell you.  But I was chosen.  And at around 3:30 PM, I received a phone call from a “credit card company” stating that my card was breached.  

Scammer: Hi, my name is John and I am calling to notify you that your credit card was breached.

Eliott:  Again... geez.  What credit card are you calling about?

Scammer:  Well, before I give you any additional information, I need to verify your identity.  Please verify your name, address, and credit card number?

Eliott:  What credit card are you calling about?

Scammer:  I can’t tell you what credit card I am calling about until I verify your identity.

Eliott:  What bank or credit union do you work for?

Scammer:  I am in a call center, but I work for many banks... Bank of America, Wells Fargo, Citi Bank, Capital One, Chase....

Eliott:  Almost everyone in America has a credit card with one of those banks.  Which credit card are you calling about?

Scammer:  Is your cell phone number ###-###-####

Eliott:  Yes.

Scammer: If you give me your name or social security number, I can pull up your account.

Eliott:  I understand your company does not want to give out social security numbers over the phone before a consumer’s identity is verified, but I don’t know what credit card you are calling about. 

Scammer:  Well, I need to know your name before I can pull up your account.

Eliott:  You don’t know my name?  You called me to notify me of a breach.  What’s my first name?

Scammer:  I am trying to help you and protect you from someone ruining your credit.

Eliott:  I am just going to start calling the numbers on the back of my credit cards so I can ensure that my card was actually breached.

Second Scammer:  Hello Sir, we are trying to help you.

Eliott:  Who is this?

Second Scammer:  My name is Michael, I am one of the supervisors at the credit card call center.  I was listening on the phone call, as a part of our quality control.  We need your credit card information so we can cancel your credit cards 

Eliott:  My credit card information?

Second Scammer:  Yes, if you give us your 16 digit credit card number, I can look up your account.

***Eliott Hangs Up****

After I hung up, I called all of the institutions I have credit cards with and confirmed that my cards were not breached. Feeling confident and upset, I redialed the number they called me from.  To no surprise, after one ring I received a message that stated “the magic jack customer you are trying to reach is unavailable.”

Since this week is National Consumer Protection Week, which is a coordinated campaign that encourages consumers nationwide to learn how to protect themselves from fraud and scams, I decided to put the top-three  fraud reporting resources I found to be helpful in a blog.  I hope our blog readers can use these resources to help members, who are victims of theft, report scams to the appropriate authorities.

#1 Federal Trade Commission. The FTC has the most resources available to consumers on its website www.ftc.gov.  I also found their website to be the most helpful and easy to navigate.  The FTC’s website does an excellent job educating consumers on different types of scams, as it has helpful videos and commentary broken down by scam topic.  The FTC also tracks scam trends, which may be helpful to credit union employees tasked with promoting financial literacy.  Consumers can also report identify theft to the FTC.  The FTC employs a three-step process aimed to minimize damage and bring a thief to justice.  Members who want to file a report with the FTC should be directed to www.identifytheft.gov.  A Spanish version of the site is also available at RobodeIdentidad.gov.  Consumers wishing to report mass marketing (including SPAM) and telemarketing fraud can also file a complaint with the FTC.

#2 National Credit Union Administration.  NCUA launched its own Fraud Prevention Center, which helps consumers learn about fraud prevention and online security.  Similar to the FTC’s website, the NCUA does an excellent job of presenting relevant information to consumers.  The website  is not only easy to navigate, but the website does an excellent job at categorizing certain types of fraud.  Consumers can also find consumer protection and personal finance information and resources in Spanish on espanol.MyCreditUnion.gov 

#3 FinCEN. FinCEN’s website contains links to several other websites that will help a victim report fraud.  While not as informative as the FTC’s website, FinCEN is a great place find other resources to all types of fraud.  In addition, FinCEN’s website contains a list of resources on financial education and financial literacy initiatives. 

FinCEN Issues Advisory on FATF’s October 2015 Update; CUSO Registry Webinar

Written by Eliott C. Ponte, Regulatory Compliance Counsel

On January 19, the Financial Crimes Enforcement Network (FinCEN) issued an advisory, FIN-2016-A001, to provide guidance on the list of jurisdictions identified by the Financial Action Task Force (FATF).  The release of this advisory comes in response to FATF updating its list of jurisdiction with strategic Anti-Money Laundering and Counter-Terrorist Financing (AML/CTF) deficiencies.

FATF is an inter-governmental policymaking body that proposes international standards and policies to combat money laundering and terrorist financing.  Since the late 1980’s, FATF has issued several recommendations that aim to protect the international financial system from money laundering and financing of terrorism risks.  Moreover, FATF encourages greater compliance with the anti-money laundering standards.  Most recently, FATF published two statements identifying those jurisdictions that are deemed to have “strategic deficiencies” in their anti-money laundering and counter terrorist financing regimes. 

FinCENs advisory acknowledges FATF’s update and provides guidance for financial institutions engaging with listed jurisdiction.  These jurisdictions appear in two documents: (1) “FATF Public Statement”, which consists of  jurisdictions that are subject to FATF’s call for countermeasures or are subject to Enhanced Due Diligence due to their Anti-Money Laundering and Counter-Terrorist Financing (AML/CFT) deficiencies; and, (2) “Improving Global AML/CFT Compliance: On-going Process,” which consists of jurisdictions identified by FATF to have AML/CFT deficiencies.

Based on FATF’s recent changes, FinCEN is recommending that financial institutions impose countermeasures or consider the risk arising due to a lack of sufficient progress in addressing AML/CFT deficiencies in the countries of Iran and the Democratic People’s Republic of Korea.  FinCEN is also recommending that institutions apply enhanced due diligence for the country of Myanmar.  FinCEN notes, however, that the country of Aleria has made progress in addressing its FATF action plan.  As a result, Algeria has been removed from the “FATF Public Statement” and now includes this jurisdiction in its “Improving Global AML/CFT Compliance: On-going Process” document.  The list of these countries in this document include Afghanistan, Algeria, Angola, Bosnia and Herzegovina, Guyana, Iraq, Lao PDR, Panama, Papua New Guinea, Syria, Uganda, and Yemen.

FinCEN instructs financial institutions to continue to apply countermeasures to protect against AML/CFT risks. For more information, credit unions should consult the FinCEN Advisory.

***

CUSO Registry Webinar

Tomorrow, the NCUA will host a free webinar on how to use the new CUSO Registry system.  The webinar is schedule to start at 2:30 P.M. EST.  NAFCU Blog Readers can register online for this free webinar here. Questions about the registry may be submitted in advance by emailing your question to [email protected]. The NCUA requests that the subject line of the email read, “CUSO Registry Training.”

FinCEN Regulatory Impact Assessment on CDD Proposal; CFPB Issues Letter on TRID Enforcement and Liability

Written by Brandy Bruyere, Director of Regulatory Compliance

I hope everyone had a wonderful New Year! After a couple of long holiday weekends, I thought we would start off 2016 with FinCEN/the BSA and a recent development relating to TRID. Remember that time FinCEN proposed explicit customer due diligence requirements for beneficial owners of legal entities? These rules were originally slated to become final this past summer, but so far, FinCEN has not finalized the proposal. According to the Department of Treasury's fall rulemaking agenda, the proposal could be finalized as early as this month but when NAFCU reached out to FinCEN to confirm, an agency spokesperson indicated that they are “still in the comment analysis stage.”

On December 23, FinCEN released its Regulatory Impact Assessment (RIA) for this proposed rule which highlighted costs of the rule compared to benefits “using an upper bound for costs based on estimated and hypothetical values.” Overall, FinCEN concluded that so long as the CDD proposal would reduce illicit by a minimum of 0.57 percent annually between 2016 and 2025, the rule would “achieve [a] positive net benefit.” Here are some noteworthy items from FinCEN’s costs analysis.

Staff time for completing CDD requirements (page 5) - FinCEN estimates that it would require, on average, 20 minutes to fulfill the beneficial ownership identification, verification and recordkeeping requirements in the proposal.

Annual costs to small institutions (page 6) – FinCEN estimates that the proposal “would result in a cost to a small bank of between approximately $2000 and $4000 per year at account opening”

Training (Page 7) – FinCEN said the following about the costs associated with training staff to implement the proposal: “Assuming that a small financial institution has 125 employees and that the training would take one hour, and applying the wage assumptions used in the RIA, this would result in an estimated cost of between $1250 and $2500, depending on the percentage of employees trained, for the first year that the rule would be in effect…The amount of necessary training would decrease thereafter.” (Emphasis added.)

Here is a table provide on page 10 summarizing FinCEN’s estimates for total costs for training across all institutions, in the millions:

Note, the “client” column represents estimated costs to the member due to increased time to open accounts and similar impacts.

Information Technology costs (page 25, footnote)  – FinCEN included some specifics on reported information technology costs associated with the proposal. One large bank estimated IT costs to be about $20 million, a mid-sized bank estimated these costs to range from $3 million to $5 million, and a small credit union estimated its costs would be between $50,000 and $70,000. 

The RIA goes on to explain how the “benefits” of the CDD proposal were evaluated, noting the difficulty in placing a qualitative dollar amount of benefit to compare to costs.

***

CFPB Issues Letter on TRID Enforcement and Liability. In response to a letter from the Mortgage Bankers Association, last week CFPB Director Richard Cordray sent this letter discussing TRID liability. Here are some excerpts with hyperlinks included:

“…As with any change of this scale, despite the best of efforts, there inevitably will be inadvertent errors in the early days. That is why the Bureau and other regulators have made clear that our initial examinations for compliance with the rule will be sensitive to the progress industry has made…All of the regulators have indicated that their examinations for compliance in the first few months of implementing [TRID] will be corrective and diagnostic, rather than punitive…

[…]

In addition to the cure provisions contained in the rule the Truth in Lending Act itself contains provisions for the correction of errors. These provisions continue to apply to the integrated disclosures. For example, TILA has long permitted creditors to cure violations, provided the creditor notifies the borrower of the error and makes appropriate adjustments to the account before the creditor receives notice of the violation from the borrower. 15 U.S.C. 1640(b). Similarly, TILA contains an exception from liability for unintentional errors, subject to certain conditions. 15 U.S.C. 1640(c).

Furthermore, while [TRID] does integrate the TILA disclosures with the disclosures required under [RESPA], it did not change the prior, fundamental principles of liability under either TILA or RESPA. Therefore, for non-high-cost mortgages:

There is no general TILA assignee liability unless the violation is apparent on the face of the disclosure documents and the assignment is voluntary. 15 U.S.C. 1641(e).

By statute, TILA limits statutory damages for mortgage disclosures, in both individual and class actions to failure to provide a closed-set of disclosures. 15 U.S.C. 1640(a).

Formatting errors and the like are unlikely to give rise to private liability unless the formatting interferes with the clear and conspicuous disclosure of one of the TILA disclosures listed as giving rise to statutory and class action damages in 15 U.S.C. 1640(a).

The listed disclosures in 15 U.S.C. 1640(a) that give rise to statutory and class action damages to not include either the RESPA disclosures or the new Dodd-Frank Act disclosures, including the Total Cash to Close and Total Interest Percentage.

[…]

Accordingly, the Bureau believes that if investors were to reject loans on the basis of formatting and other minor errors, as you indicate has been occurring, they would be rejecting loans for reasons unrelated to potential liability associated with [TRID]…”

The full letter is available here:  CFPB response to MBA TRID letter

NAFCU continues to call on the CFPB to provide greater clarity on TRID. While this clarification on the scope of TRID liability is a step in the right direction, NAFCU hopes that the CFPB will follow this course into 2016 by more proactively resolving ambiguities raised by the industry in official guidance.

Palate Cleanser. We took Nolan to Ohio for the holidays, he had a great time. He also got to see first hand how in mommy's hometown, tractors are much more versatile than here in the DC suburbs - they can take you to the local convenience store! In a somewhat related note, my high school alma mater's annual tradition made the local news last spring, when I shared it with some folks here in DC they thought it was an article from The Onion but nope, this is a real news story about "drive your tractor to school" day. Enjoy!

Friday FinCEN Update

Written by Brandy Bruyere, Director of Regulatory Compliance

It’s been a bit of a slow week, but when you work in compliance sometimes no news is good news. After all, that means no new rules to learn this week, right? Today I’d like to highlight two items that recently came out of FinCEN—a proposed rule that would require “investment advisers” to adopt formal Anti-money laundering (AML) programs and report suspicious activity, and a FinCEN consent order involving Caesar’s Palace.

FinCEN Proposal. A few of our members have asked about this proposed rule so here’s a very brief overview. On Tuesday, September 1st, FinCEN published a proposed rule that would extend particular Bank Secrecy Act (BSA) requirements to investment advisers. Specifically, under this proposal, an investment advisor would be required to establish written AML programs, report suspicious activity to FinCEN and follow recordkeeping requirements. 

Keep in mind that federal credit unions cannot directly offer products like securities, but there are some FCUs that have relationships with CUSOs which sell products like securities. Thus, this proposal may impact a credit union more tangentially, such as through due diligence obligations with regards to third-party relationships. However, the proposal defines “investment adviser” as “[a]ny person who is registered or required to register with the SEC under section 203 of the Investment Advisers Act of 1940…” Thus, whether this rule impacts a particular credit union’s relationships will depend in large part on if any of a credit union’s CUSOs have obligations to register with the Securities Exchange Commission under this cross-referenced statute. This is not the first time FinCEN has issued such a proposal, so time will tell if or when this could be finalized.

FinCEN and Caesars Palace Reach Settlement. While not specific to credit unions, this story caught my eye given some of the facts surrounding the case. Caesars Place, which earlier this year filed for Chapter 11 bankruptcy, agreed to pay an $8 million civil money penalty and implement changes to its BSA/AML program. The case involves allegations that the casino had “systemic and severe AML compliance deficiencies” particularly with its private gaming salons reserved for the wealthiest of gamblers who provided a minimum “front money deposit” of $300,000. According to the consent order, it was not uncommon for this high-end clientele to gamble “millions of dollars in a single visit.” Must be nice, right? I have a hard enough time purchasing a lottery ticket! But back to FinCEN…

The casino permitted wealthy patrons to gamble anonymously without “appropriate [AML] scrutiny” that would “meet these heightened risks” and “failed to file over 100 SARs” for a variety of suspicious activities including potential money laundering. As part of the consent order, Caesars agreed to several conditions:

• undertake improvements to its BSA/AML program, including “fostering a culture of compliance;”
• retain a qualified external auditor to perform independent reviews of its program;
• properly train staff;
• perform a “SAR lookback” and file as necessary after reviewing the deficient time period; and
• report to FinCEN annually for three years.

While this case involves a casino, sometimes these kinds of conditions from a consent order can be useful as illustrations of regulatory expectations.

Enjoy Friday and have a great weekend!

FinCEN’s Customer Due Diligence Rule May Be Finalized Later This Summer; National Money Laundering Risk Assessment and National Terrorist Financing Risk Assessment

Written by Bernadette Clair, Senior Regulatory Compliance Counsel

FinCEN’s Customer Due Diligence Rule May Be Finalized Later This Summer. According to the Spring 2015 Semiannual Unified Regulatory Agenda (Agenda), FinCEN may be releasing a final Customer Due Diligence (CDD) rule later this summer. Dates listed in the Agenda are tentative, and may change, but final action on this rule is currently noted for August 2015.  This CDD rule has been in the works for some time, and if finalized as proposed, would amend existing rules to include explicit CDD requirements, including a requirement to identify beneficial owners of legal entity customers, subject to certain exemptions. For additional details on the proposed rule, check out our previous blog post.

Another item of note from FinCEN on the Agenda that caught my eye –

There is a potential proposal in the works regarding reporting requirements for cross-border electronic transmittals of funds. Back in 2010, there was a proposal to require certain financial institutions to report transmittal orders associated with certain cross-border electronic transmittals of funds to FinCEN. That proposal generated a lot of feedback and was not finalized, however it looks like FinCEN may be issuing another notice of proposed rulemaking in August.

***

National Money Laundering Risk Assessment and National Terrorist Financing Risk Assessment.  Last week, Treasury released the National Money Laundering Risk Assessment and National Terrorist Financing Risk Assessment.  Intended to help the public and private sectors more effectively detect and combat illicit finance, these assessments provide a review of money laundering and terrorist financing methods used in the U.S., the risks these activities pose to the U.S. financial system and national security, and an update on current efforts to combat illicit finance.

Here’s a snippet from page 3 of the National Money Laundering Risk Assessment, discussing vulnerabilities:

“The size and sophistication of the U.S. financial system accommodates the financial needs of individuals and industries globally. The breadth of products and services offered by U.S. financial institutions, and the range of customers served and technology deployed, creates a complex, dynamic environment in which legitimate and illegitimate actors are continuously seeking opportunities.

This assessment finds that the underlying money laundering vulnerabilities remain largely the same as those identified in the 2005 United States Money Laundering Threat Assessment. The money laundering methods identified in this assessment exploit one or more of the following vulnerabilities:

• Use of cash and monetary instruments in amounts under regulatory recordkeeping and reporting  thresholds;

• Opening bank and brokerage accounts using nominees to disguise the identity of the individuals who control the accounts;

• Creating legal entities without accurate information about the identity of the beneficial owner;

• Misuse of products and services resulting from deficient compliance with anti-money laundering obligations; and

• Merchants and financial institutions wittingly facilitating illicit activity.”

Both reports are well worth a read for anyone with Bank Secrecy Act program management responsibilities.

FinCEN Update

Written by Shari R. Pogach, Regulatory Paralegal  

Enforcement Action. Earlier this month, the Financial Crimes Enforcement Network (FinCEN) announced its first civil enforcement action against a virtual currency exchanger.  Ripple Labs Inc. (Ripple) and its wholly- owned subsidiary, XRP II, LLC (formerly known as XRP Fund II, LLC) was assessed a $700,000 civil money penalty for acting as a money services business (MSB) and selling its virtual currency, known as XRP, without registering with FinCEN as well as not having an adequate anti-money laundering (AML) program in place.  Headquartered in San Francisco, CA, Ripple facilitated transfers and provided virtual currency exchange transaction services.  By market capitalization, Ripple cryptocurrency is second only to Bitcoin as of 2015. 

As part of an agreement for corrective action and to ensure future BSA compliance, Ripple must: 1) only transact XRP and “Ripple Trade” activity through a registered MSB; 2) implement and maintain an effective AML program; 3) comply with the Funds Transfer and Funds Travel Rules; 4) conduct a three-year “look-back” to require suspicious activity reporting for prior suspicious transactions; and 5)  retain external independent auditors to review compliance with the BSA every two years up to and including 2020. These reports will be provided to FinCEN and the U.S. Attorney's Office. Ripple is also required to take steps to appropriately monitor all future transactions. 

***

Speech Tidbits.  In a recent speech, FinCEN Director Jennifer Shasky Calvery discussed the agencies reliance on reports filed by financial institutions.  Some highlights:

“Thanks to the reports filed by financial institutions, FinCEN has a wealth of data that we are able to analyze and disseminate in the form of financial intelligence to our Treasury colleagues; and to law enforcement and intelligence community partners. The information you provide allows us to  connect the dots between seemingly unrelated individuals and entities. These capabilities are critical in supporting the U.S. Government’s efforts to disrupt ISIL sources of revenue, to restrict  their access to the international financial system, and to impose sanctions on ISIL facilitators.”

         […]

“Thanks to the reports filed by financial institutions, FinCEN has a wealth of data that we are able   to analyze and disseminate in the form of financial intelligence to our Treasury colleagues; and to law enforcement and intelligence community partners. The information you provide allows us to connect the dots between seemingly unrelated individuals and entities. These capabilities are critical in supporting the U.S. Government’s efforts to disrupt ISIL sources of revenue, to restrict their access to the international financial system, and to impose sanctions on ISIL facilitators.”

         […]

“…At FinCEN, we are working on multiple fronts to optimize the collection, analysis, and dissemination of your reporting to achieve these ends.”

         […]

 “We process about 50,000 new filings each day. To manage a data collection of this size, FinCEN   uses automated “business rules” to search the reporting daily for key terms, entities, or typologies specific interest. The rules are designed to screen daily filings and identify reports that merit   further review by analysts. For example, rules related to ISIL, alone, generate over 800 matches each month for further review and exploitation. “

         […]

“Domestically, FinCEN grants more than 10,000 agents, analysts, and investigative personnel from over 350 unique agencies across the U.S. Government with direct access to your reporting so that it gets the broadest possible use”

         […]

“To support follow-on action by others, FinCEN works closely with our Treasury colleagues within the Office of Foreign Assets Control (OFAC) to support their efforts to target sanctions on ISIL facilitators and deter a wide range of threats.”

In another speech, Shasky Calvery gave an update on the status of the agency’s enhanced customer due diligence proposal.

 “…Beneficial ownership information is so important to our efforts to enhance financial transparency, particularly as it relates to the issues we have discussed this morning surrounding money laundering through real estate and third party money launderers.”

         […]

“As far back as 10 years ago when I was working as a prosecutor, so many of my very own investigations were stalled by an inability to follow the money. And inevitably shell companies were involved. So when people ask “why beneficial ownership” and “why now?” what I really want to say is “why not 10 years ago?”

We all benefit from a level-playing field that requires all financial institutions to employ reasonable efforts to enhance the integrity of their institutions and the financial system as a whole. As most of you know, in July 2014, FinCEN working closely with its partners in Treasury issued an NPRM to amend existing BSA regulations to help prevent the use of shell and shelf companies to engage in or launder the proceeds of illegal activity in the U.S. financial sector.

As proposed, the rule would clarify and strengthen customer due diligence obligations of banks and other financial institutions, including brokers or dealers in securities, mutual funds, futures commission merchants, and introducing brokers in commodities. The proposed amendments would add a new requirement that these entities know and verify the identities of the real people who own, control, and profit from the companies they service.

So where are we now? The comment period on the CDD NPRM closed in October 2014. We received 126 comments, illustrating the high level of interest in the proposal. Commenters included trade associations, law firms, consulting firms, research institutes, banks, other financial institutions within the scope of the rule and otherwise substantially impacted, federal regulatory agencies, and several concerned individuals.

Some commenters requested greater clarification on questions of scope and key definitions, while  others proposed more significant revisions to the rule. Many commenters nonetheless expressed broad thematic support for the rulemaking’s underlying purposes. We are now in the process of thoughtfully reviewing, discussing, and considering the issues that were raised by those that  commented. This is why there is an NPRM process, so we can gather feedback and consider change. We want to get this right.”

***

Law Enforcement Awards.    FinCEN announced the presentation of its first-ever Law Enforcement Awards at a ceremony at the Treasury Department on May 12.  The program is intended to: 1) recognize law enforcement agencies usage of BSA data to obtain a successful prosecution; and 2) to provide concrete evidence of the value of the BSA data to the financial industry.  The program includes six award categories and summaries of the cases are provided in the announcement.

***

SAR Stats.  FinCEN has issued the SAR Stats quarterly update, which provides information on Suspicious Activity Reports (SARs) filed through March 31, 2015.  The updated statistics can be viewed here. Credit Unions filed 20, 345 of the 213,280 SARs filed during first quarter 2015.             

FinCen Releases AML/CFT Deficiencies Advisory; Free Kick

Written by Ricardo Piñeres, Regulatory Compliance Counsel

FinCen Releases AML/CFT Deficiencies Advisory.  On August 5, the Financial Crimes Enforcement Network (FinCen) released FinCen Advisory FIN-2014-A006.  The release of this advisory comes as a response to the Financial Action Task Force (FATF) having updated its lists of jurisdictions with strategic Anti-Money Laundering and Counter-Terrorist Financing (AML/CTF) deficiencies.  Back in late-June, FATF updated its lists of jurisdictions that appear in two different documents:

• FATF Public Statement, which consists of  jurisdictions that are subject to FATF’s call for countermeasures or are subject to Enhanced Due Diligence due to their AML/CFT deficiencies; and
• Improving Global AML/CFT Compliance: On-going Process, which consists of jurisdictions identified by FATF to have AML/CFT deficiencies.

Based on the recent changes to FATF Public Statement, FinCen is advising that institutions apply counter-measures to protect the international financial system from the on-going and substantial money laundering and terrorist financing (ML/FT) risks emanating from Iran and North Korea.  Furthermore, FinCen is advising institutions to apply enhanced due diligence for following countries:

• Algeria;
• Ecuador;
• Indonesia; and
• Myanmar.

FATF recognized that Ethiopia, Pakistan, Syria, Turkey, and Yemen “have made progress in substantially or largely addressing their FATF action plan.”  Therefore, those countries were taken off the FATF Public Statement and have been placed on Improving Global AML/CFT Compliance: On-going Process.  Kenya, Kyrgyzstan, Mongolia, Nepal, and Tanzania were all deemed to have made “significant progress in addressing all or nearly all of their strategic AML/CFT deficiencies.”  Therefore, they were removed from Improving Global AML/CFT Compliance: On-going Process.  The list of countries now on Improving Global AML/CFT Compliance: On-going Process is as follows:

• Afghanistan;
• Albania;
• Angola;
• Argentina;
• Cambodia;
• Cuba;
• Ethiopia;
• Iraq;
• Kuwait;
• Lao PDR;
• Namibia;
• Nicaragua;
• Pakistan;
• Panama;
• Papua New Guinea;
• Sudan;
• Syria;
• Tajikistan;
• Turkey;
• Uganda;
• Yemen; and
• Zimbabwe.

See FinCen’s Advisory for further information on the changes to the lists and guidance regarding U.S. financial institutions’ responsibilities and restrictions with regards to the countries on the lists.

***

Free Kick.  The dawn of a new season is upon us.  Yet, the transfer window will remain open for another 20 days.  While many of the Europe’s top clubs have tried to conduct the majority of their business on the front end of the transfer window, there will likely be a few more moves that will strengthen some teams and weaken some others.  Therefore, I refuse to make any predictions regarding the upcoming season until the window closes and we have some stability amongst the rosters of Europe’s elite squads.

All of that being said, I am still excited for what the season ahead brings for an Arsenal fan such as myself.  With the 3-0 victory over Manchester City in yesterday’s Community Shield, an offseason full of promise and activity has come to a close.  The additions of Alexis Sanchez, Callum Chambers, Mathieu Debuchy, and David Ospina have addressed needs and added some much-needed depth to the squad.  Hopefully, the team can remain relatively healthy this season because when the new additions are added to the likes of Theo Walcott, Aaron Ramsey, Santi Cazorla, Mesut Ozil, and Olivier Giroud, Arsenal should have one of the most exciting attacking squads in the EPL.  Go Gunners!!!