Final Rules on Correspondent Accounts and Information Sharing Adopted

Introduction
Foreign Shell Bank Correspondent Accounts
Information-Sharing

Introduction

On September 18 2002 the US Treasury Department, through its Financial Crimes Enforcement Network (FinCEN), issued four important proposed and final rules to implement portions of the USA Patriot Act.(1) The proposed rules provide guidance to unregistered investment companies (eg, hedge funds and commodity pools) and insurance companies on compliance with the act's anti-money laundering programme requirements. The two final rules provide guidance on the maintenance of correspondent accounts for foreign banks, and on the sharing of information between financial institutions and government agencies.

This update analyzes the new rules which apply to financial institutions, and discusses them in the context of the Treasury's rule-making efforts over the past year.

The Patriot Act is an ambitious and broadly focused anti-money laundering statute enacted in the wake of the events of September 11 2001. The main purpose of the act is to give law enforcement agencies the necessary tools to detect and prevent future terrorist attacks. Title 3 of the act contains significant new compliance requirements for financial institutions with respect to the detection and prevention of money laundering, and amends portions of the Bank Secrecy Act 1970.(2)

One of the major initiatives introduced by the act is the extension of anti-money laundering requirements to many different types of financial institution. The act uses the same definition of 'financial institution' as that found in the Bank Secrecy Act.(3) The term includes, among other entities:

• any insured bank;
  
  
• a commercial bank or trust company;
  
  
• a private banker;
  
  
• an agency or branch of a foreign bank in the United States;
  
  
• a thrift institution;
  
  
• a registered broker-dealer;
  
  
• an investment company;
  
  
• an insurance company; and
  
  
• a loan finance company.

Some of the act's provisions - such as those governing correspondent accounts for foreign shell banks - apply only to "covered financial institutions", a term meant to define a smaller subset of the broader term found in the Bank Secrecy Act. These include banks, broker-dealers, branches and agencies of foreign banks, trust companies and private bankers.

Foreign Shell Bank Correspondent Accounts

Safe harbour certification requirements
On September 18 2002 the Treasury issued a final rule implementing Sections 313(a) and 319(b) of the act, both of which deal with correspondent accounts. This final rule takes effect on October 30 2002. The Treasury first issued interim guidance with respect to Sections 313(a) and 319(b) on November 20 2001. It then issued a proposed rule on December 20 2001 and requested public comment on its provisions.

Clarification on definitions
Section 313(a) of the USA Patriot Act prohibits covered financial institutions(4) from maintaining correspondent accounts in the United States for foreign shell banks - basically, foreign banks without a physical presence in any country.(5) A 'correspondent account' is defined in the final rule for Section 313 and 319(b) purposes as

"an account established by a covered financial institution for a foreign bank to receive deposits from, to make payments or other disbursements on behalf of a foreign bank, or handle other financial transactions related to the foreign bank."

In its explanation accompanying the final rule, the Treasury indicated that the broad definition of 'correspondent account' in the proposed rule generated the most public comment. Financial institutions that submitted comments sought to narrow the definition to certain account types, and to exempt certain foreign banks that are located in jurisdictions where money laundering poses a relatively low risk. The Treasury rejected these comments on the theory that Congress intended to ban all correspondent accounts with foreign shell banks regardless of account type or location of the foreign bank. In the final rule, the Treasury decided in most respects to keep the same broad definitions of 'correspondent account' and 'account' that were contained in the proposed rule, with minor modifications to the definition of 'account'. As a concession to financial institutions that complained about the overly broad scope of the proposed rule, the Treasury added to the definition of 'account' the requirement that the banking or business relationship must be to provide "regular" services. This meant to exclude from Section 313(a) and 319(b) isolated or occasional transactions that are not part of a regular pattern of banking or business activity.

Foreign branches of US insured banks
The Treasury noted that after the definition of 'correspondent account', the next area that generated the most comment letters was the proposed inclusion of foreign branches of insured banks located in the United States, Puerto Rico, Guam, American Samoa or the Virgin Islands in the definition of 'covered financial institutions'.

The inclusion of foreign branches would have required these institutions to fulfil certification and recordkeeping requirements for all foreign bank accounts. The Treasury concluded, however, that as long as a correspondent account for a foreign branch of a US insured bank is established, maintained, administered or managed outside of the United States, a correspondent account maintained at that branch is not subject to the final rule. The Treasury instead decided to treat a foreign branch of a US insured bank as a 'foreign bank' under the final rule. Moreover, US insured banks are asked to take reasonable steps to ensure that their foreign branches are not indirectly providing banking services to a foreign shell bank.

Definition of 'foreign bank'
In the final rule, the Treasury adopted the same definition of 'foreign bank' as exists in the Bank Secrecy Act. The term is defined as "a bank organized under foreign law, or an agency, branch or office located outside the United States of a bank". The term does not include an agency, branch or office within the United States of a bank organized under foreign law. The term thus excludes an agency or a branch of a foreign bank located in the United States, as these entities are considered 'covered financial institutions' under the act. The definition also excludes:

• foreign central banks;
  
  
• foreign monetary authorities that function as central banks; and
  
  
• certain other international financial institutions, such as multinational development banks where the United States is a member.

However, the definition does include a non-US branch of a US insured bank.

Practical consequences for foreign branches
In practical terms, the final rule's definitions confirm that a US branch of a foreign bank is treated as a covered financial institution, and must therefore comply with the certification and recordkeeping requirements of the act. For example, the New York branch of a bank headquartered in a foreign country is a covered financial institution, and must therefore obtain certifications for all correspondent accounts it holds for foreign banks.

On the other hand, a foreign branch of a US insured bank must provide the certifications upon request. For example, assume that the London branch of a bank headquartered in the United States holds an account with a broker-dealer in the United States. Upon request from the US broker-dealer, the London branch of a US bank must provide the certification to the broker-dealer.

Nonetheless, a US insured bank that maintains a correspondent account for any of its foreign branches is not required to obtain a certification from the foreign branch. Thus, in the example above, the US bank is not required to obtain a certification from its London branch should the London branch hold an account in the United States with the bank.

Certification, recertification and verification
Section 313(a) of the USA Patriot Act requires covered financial institutions to take reasonable measures to ensure that any correspondent account provided to a foreign bank is not being used indirectly to provide banking services to a foreign shell bank. The final rule, similar to the proposed rule, provides a certification form for covered financial institutions that requires foreign banks that maintain correspondent accounts with covered financial institutions to attest that the foreign bank is not a shell bank, and to attest whether the foreign bank provides any services to foreign shell banks. A covered financial institution that determines it maintains an account for a foreign shell bank (that is not a regulated affiliate) must close the account immediately.

The final rule includes a model 'certification' form, receipt of which from a foreign bank would serve as a safe harbour with respect to that bank. The November 2001 interim guidance also contained a model certification form. The biggest difference between the final rule's model certification form and the interim guidance's model certification form is that the former more clearly defines what is required of foreign banks. It contains definitions for foreign banks and correspondent accounts, and provides a step-by-step compliance checklist. Additionally, the model certification in the interim guidance contained the phrase "received, reviewed and accepted" at the end of the certification. The Treasury deleted the word 'accepted' in the final rule's model certification in order to avoid the implication that covered financial institutions must verify the accuracy of the recordkeeping information provided. Rather, financial institutions are required to review the certification to ensure that it appears consistent.

Financial institutions can easily download the model certification from the Treasury's website by accessing its September 18 2002 press release.

The final rule also includes a requirement that covered financial institutions recertify the information contained in the above-stated certification every three years. The proposed rule required covered financial institutions to obtain verification of the information provided every two years. The final rule changed the operative term from 'verification' to 'recertification' in this context. The Treasury attached a model recertification form as a separate document to the press release that announces the Treasury's adoption of the final rule. The recertification form can also be found at the above link.

Covered financial institutions are free to distribute and store completed certifications in electronic form. Moreover, a foreign bank can provide a global certification for all correspondent accounts it maintains at a covered financial institution. The final rule also allows covered financial institutions to obtain electronic copies of such certification from a central registry or database that may be organized to facilitate compliance with the final rule, or from another covered financial institution.

In addition, the final rule states that if at any time a covered financial institution "knows, suspects or has reason to suspect" that the information provided by a foreign bank is not accurate, the covered financial institution must "take appropriate measures" to verify the information. The proposed rule contained a less burdensome "has reason to believe" standard. The Treasury indicated that the need to verify the accuracy of recordkeeping information may arise when a covered financial institution is conducting its required due diligence in accordance with Section 312 of the act. Briefly stated, Section 312 requires that covered financial institutions conduct due diligence for correspondent accounts held by non-US persons to ensure that these persons are not engaged in money laundering. The level of due diligence depends on the type of person holding the account and the jurisdiction from which the person originates. To date, the Treasury has not enacted the final rule implementing Section 312.

To fit within the safe harbour requirements, a covered financial institution must obtain the certification within certain timeframes. For any correspondent account that is in existence on October 30 2002, if the covered financial institution has not obtained the completed certification (or recertification) on or before December 26 2002, and at least once every three years thereafter, the covered institution must close the account within a commercially reasonable time, and may not re-open the account in any form later.

For correspondent accounts opened after October 30 2002, if the covered financial institution has not received the certification (or recertification) within 30 days of the date on which the account is opened, and at least once every three years thereafter, the covered institution must close the account within a commercially reasonable time thereafter, and may not re-open the account in any form later.

Where a covered financial institution has not received verification of the accuracy of information provided within 90 calendar days of undertaking the verification, the covered institution must close the account within a commercially reasonable time thereafter, and may not re-open the account in any form later.

For correspondent accounts in existence on October 30 2002, the certification appended to the November 2001 interim guidance will suffice for compliance, provided this was requested prior to October 30 2002 and is obtained by the covered financial institution on or before December 26 2002.

Recordkeeping requirement for correspondent accounts
The final rule implementing Section 319(b) contains only a few changes from the proposed rule. Section 319(b) requires covered financial institutions that provide a correspondent account in the United States to a foreign bank to maintain (i) records identifying the foreign bank's owners, and (ii) the name of an agent for the foreign bank located in the United States designated to accept service of legal process for records regarding the correspondent account. The final rule defines 'owner' as any person who, directly or indirectly, (i) owns, controls or has power to vote 25% or more of any class of voting securities or other voting interests of a foreign bank, or (ii) controls in any manner the election of a majority of the directors (or individuals exercising similar functions) of a foreign bank. The final rule has retained the 25% threshold contained in the proposed rule.

In the final rule the Treasury indicates that while it does not expect covered financial institutions to verify the accuracy of the recordkeeping information provided by foreign banks, it nonetheless expects covered financial institutions to review the certification to ensure that it contains all required information and otherwise appears "internally consistent" (eg, the location of the bank matches the country of the designated banking authority that regulates the bank). The final rule provides an exception from this recordkeeping requirement for any foreign bank that is required to file its ownership information with the US Federal Reserve on Form FR Y-7. A covered financial institution may verify that a foreign bank is required to do so by checking the list at the Federal Reserve website at www.federalreserve.gov.

Section 319(b) authorizes the secretary of the Treasury or the US attorney general to issue a summons or subpoena to any foreign bank that maintains a correspondent account in the United States and to request records relating to such account, including records maintained outside the United States relating to the deposit of funds into the foreign bank. If a foreign bank fails to comply with or contests the summons or subpoena, the covered financial institution with which the foreign bank maintains a correspondent account must terminate the account not later than 10 business days after receipt of written notice from the secretary of the Treasury or the US attorney general. Failure to terminate the correspondent account could result in a civil penalty of up to $10,000 per day until the date the correspondent account is terminated. The summons and subpoena provisions have not significantly changed from the requirements in the proposed rule.

Due diligence requirements for correspondent accounts
In addition to the certification requirements under Section 313(a) and the recordkeeping requirements under Section 319(b) of the act, financial institutions also have certain due diligence requirements for correspondent accounts and for private bank accounts. Section 312 requires financial institutions to have "appropriate, specific, and where necessary, enhanced due diligence" designed to detect and report money laundering through correspondent accounts or private banking accounts held in the United States for non-US persons.

The provisions in Section 312 became effective on July 23 2002. The Treasury issued a proposed rule on May 23 2002 to implement Section 312. On July 19 2002, with the July 23 2002 deadline looming, the Treasury issued an interim final rule acknowledging that its compliance with the July 23 2002 deadline was not possible. The Treasury has indicated that it will issue a final rule under Section 312 by October 25 2002. The interim rule states that banks (including branches and agencies of foreign banks in the United States), saving associations and credit unions were required to comply with the terms of Section 312 by July 23 2002. Under the interim rule, broker-dealers, futures commission merchants and introducing brokers were required by July 23 2002 to comply with Section 312 only for private banking accounts held for non-US persons. The Treasury has deferred application of the section to all other financial institutions until adoption of the final rule.

Section 312 differs from Section 319(b) in that the latter only requires a financial institution to maintain records of the owners of foreign banks who hold correspondent accounts and the name of a US agent for service of legal process. Section 312, on the other hand, is much broader, in that it requires a financial institution to conduct due diligence for any correspondent account held in the United States for a non-US person. Thus, maintaining the names of the owners of foreign banks and US agents for service of process is not sufficient for overall compliance with the act. Instead, financial institutions must undertake additional due diligence to ensure that non-US persons holding correspondent accounts with them are not engaged in money laundering.

Section 312 also requires financial institutions to conduct enhanced due diligence for correspondent accounts held for foreign banks that:

• operate under an offshore banking licence;
  
  
• are licensed in a "non-cooperative" jurisdiction; or
  
  
• reside in jurisdictions the secretary of the Treasury has designated as warranting "special measures" due to money laundering concerns.

Enhanced due diligence procedures must, at a minimum, include reasonable steps to:

• determine the owners of the foreign bank;
  
  
• conduct enhanced scrutiny of the account and report suspicious activity; and
  
  
• determine whether the foreign bank maintains correspondent accounts for other banks and, if so, identify these banks.

Section 312 defines 'private banking account' as an account for one or more individuals with a minimum aggregate deposit of $1 million that is administered or managed by a liaison between the financial institution and the direct or beneficial owner. Section 312 provides that financial institutions must take reasonable steps to identify the nominal and beneficial owner of private banking accounts and the sources of the account funds. Financial institutions that maintain private banking accounts for senior foreign political figures, immediate family members and close associates must undertake enhanced scrutiny against the laundering of proceeds from foreign corruption.

Information-Sharing

On September 18 2002 the Treasury issued a final rule implementing Sections 314(a) and 314(b) of the USA Patriot Act. The final rule became effective on September 26 2002. These sections permit financial institutions and federal law enforcement agencies to share information related to suspected money laundering and terrorist activities. On February 26 2002 the Treasury issued a proposed rule to implement Section 314(a) and an interim final rule to implement Section 314(b). The September 18 2002 final rule supersedes the interim final rule. The provisions in the final rule are essentially the same as those in the proposed rule and in the interim final rule. The biggest difference is that the final rule provides more guidance as to the steps a financial institution should take if FinCEN contacts it regarding suspected money laundering or terrorist financing activities.

Information-sharing between financial institutions and FinCEN
Section 314(a) of the act seeks to strengthen existing communication links between FinCEN, federal law enforcement agencies and financial institutions. It allows FinCEN to request information regarding suspected terrorists or money launderers from any 'financial institution' as defined in the Bank Secrecy Act.

Under the final rule, federal law enforcement officials will provide a written certification to FinCEN that contains the names and other verification information (eg, date of birth, address and social security number) of suspected money launderers or terrorists. FinCEN will then send this information to financial institutions and will request that they "expeditiously" search their account records for the names. A financial institution may contact the federal law enforcement agency named in the certification with any questions relating to the scope or terms of the request.

If a match is found, financial institutions are asked to report the match to FinCEN in a manner and in the timeframe specified by FinCEN. The report must contain:

• the name of the individual, entity or organization;
  
  
• the number of the account, or in the case of a transaction, the date and type of transaction; and
  
  
• any identifying information (eg, passport number or social security number) provided by the individual, entity or organization that was used to open the account or conduct a transaction.

In addition, financial institutions are asked to appoint a person whom FinCEN may contact should it need additional information. Federal law enforcement officials will then follow up with the financial institution directly.

Except as otherwise provided in the request, a financial institution shall only be required to search its records for:

• any current account for a named suspect;
  
  
• any account maintained for a named suspect during the preceding 12 months; and
  
  
• any transaction conducted by or on behalf of a named suspect, or any transmittal of funds in which a named suspect was either the transmitter or the recipient during the preceding six months.

FinCEN will not ask financial institutions to provide the payee's name on cheques; however, it may ask financial institutions to determine whether a suspect was a transmitter or a recipient to a funds transfer in the amount of $3,000 or more over the previous six months. Unless specified, financial institutions are not required to report any future account activity past the date requested.

In the final rule, the Treasury indicated that a financial institution that complies with an information request under Section 314(a) will not be liable for violation of the privacy provisions of the Gramm-Leach-Bliley Act 1999.(6) However, in transmitting the information a financial institution is required to use the same procedures which it uses to protect the confidentiality of non-public personal information in accordance with the Gramm-Leach-Bliley Act. Financial institutions do not have further duties under the USA Patriot act - such as terminating the suspect accounts - other than providing the information requested to FinCEN.

Information-sharing between financial institutions
Section 314(b) of the act allows financial institutions voluntarily to share information with other financial institutions in order to identify and report suspected money laundering and terrorist activities. To participate, a financial institution must file a notice each year with FinCEN. The interim final rule required a financial institution to submit a "certificate" rather than a "notice", as is now required under the final rule. The Treasury changed the document to be submitted from a certificate to a notice in order to limit the liability that financial institutions may incur as a result of the submission of a technically deficient certification.

The required notice is attached as Appendix A to the final rule. The notice is effective for one year beginning from the date of the notice. In order to continue to participate, a financial institution must re-submit its notice each year. Financial institutions that have already filed the certificate in accordance with the interim final rule need not file a new notice. Instead, these entities should file the notice upon the one-year lapse of the certificate.

Completed notices may be submitted to FinCEN by accessing FinCEN's website at www.treas.gov/fincen and entering the appropriate information as directed. Financial institutions that do not have internet access can post the notice to FinCEN at: FinCEN, PO Box 39, Mail Stop 100, Viena, VA 22183.

Prior to sharing information, a financial institution must take reasonable steps to verify that the counterpart financial institution has submitted the required notice. FinCEN intends periodically to make available to financial institutions a list of financial institutions that have filed a notice. Financial institutions may also choose to contact other financial institutions directly to verify that they have filed the notice. Any information shared among financial institutions must not be used for any purpose other than:

• identifying and reporting suspected money laundering or terrorist activities;
  
  
• determining whether to establish or maintain an account, or to engage in a transaction; or
  
  
• assisting the financial institution in complying with its requirements under Section 314(b).

Financial institutions that comply with the requirements of Section 314(b) are given a safe harbour from liability that may result from the financial institution's sharing of information with other financial institutions.

If, as a result of sharing information, a financial institution knows, suspects or has reason to suspect money laundering or terrorist activity, and the financial institution is subject to the suspicious activity reporting obligations of the act or other regulations, the financial institution must file a suspicious activity report (SAR) with FinCEN. If the situation warrants immediate attention, financial institutions are required to notify immediately by telephone an appropriate law enforcement authority and financial institution supervisory authority in addition to filing the SAR.

For further information on this topic please contact Connie Friesen at Sidley Austin Brown & Wood LLP by telephone (+1 212 839 5507) or by fax (+1 212 839 5599) or by email ([email protected]).

Endnotes

(1) The title stands for Uniting and Strengthening America by Providing Appropriate Tools Required to Intercept and Obstruct Terrorism (USA PATRIOT). See Public Law 107-56.

(2) See 31 USC Sections 5311 et seq.

(3) See 31 USC Section 5312(a)(2).

(4) 'Covered financial institution' is defined under Section 5318(j) of the Bank Secrecy Act as:

• any insured bank;
  
  
• a commercial bank or trust company;
  
  
• a private banker;
  
  
• an agency or branch of a foreign bank in the United States;
  
  
• a credit union;
  
  
• a thrift institution; or

• a US registered broker or dealer.

(5) 'Physical presence' means a place of business, maintained by a foreign bank and located at a fixed address, other than a post office box or electronic address, in a country where the foreign bank is authorized to conduct bank activities, at which location the foreign bank:

• employs one or more individuals full-time;
  
  
• maintains operations and banking-related records; and
  
  
• is subject to inspection by the banking authority that licensed the foreign bank to conduct banking activities.

There is an exception for foreign shell banks that are 'regulated affiliates'. A regulated affiliate is a foreign shell bank that (i) is an affiliate of a depository institution, credit union or foreign bank that maintains a physical presence in the United States or a foreign country, and (ii) is subject to supervision by a banking authority in the country regulating such affiliate.

(6) See 15 USC 6801-6810 (1999). Title 5 of the Gramm-Leach-Bliley Act places limits on the ability of financial institutions to disclose non-public personal information about the financial institution's customers to nonaffiliated third parties.