On March 3, 2009, the Financial Crimes Enforcement Network (“FinCEN”) announced a proposed rule clarifying the scope of the statutory prohibition against the disclosure of a Suspicious Activity Report (“SAR”),1 and issued two sets of proposed related interpretive guidance that permit the sharing of SARs with certain U.S. affiliates of depository institutions, as well as broker-dealers in securities (“BDs”), mutual funds, futures commission merchants (“FCMs”), and introducing brokers in commodities (“IB-Cs”).2
Based upon FinCEN’s proposed rule, the Office of the Comptroller of Currency (“OCC”) and the Office of Thrift Supervision (“OTS”), which along with other Federal bank regulatory agencies have parallel SAR requirements for their supervised entities,3 proposed two sets of corollary regulation changes: one to address the confidentiality of SARs,4 and the other to address the standards governing the release of a SAR.5
I. FinCEN’s Proposed Rule Relating to the Confidentiality of SARs
FinCEN’s proposed rule regarding the confidentiality of SARs include key changes that would: (1) clarify the scope of the statutory prohibition against the disclosure of a SAR by a financial institution (“FI”); (2) address the statutory prohibition against the disclosure of a SAR by the government; (3) clarify the standard applicable to the disclosure of a SAR by the government; (4) modify the scope of the safe harbor provision; and (5) harmonize minor technical differences that exist among the various SAR rules.6
Disclosures by a Financial Institution (“FI”)
Currently, FinCEN’s SAR rule prohibits FIs from disclosing that a SAR was filed to any person involved in the transaction. In addition, no FI may disclose a SAR, or provide any information that would disclose that a SAR has been prepared or filed, in response to a subpoena or other request, except where such disclosure is requested by FinCEN or an appropriate regulatory, supervisory or law enforcement agency.
In response to the numerous questions received about the scope of the confidentiality of a SAR, FinCEN proposed several revisions. First, the text of the proposed rule states that a SAR, and any information that would reveal the existence of a SAR, are confidential, without limiting the prohibition on disclosure to the person involved in the transaction. FinCEN opined that the statutory prohibition against notifying the person involved in the transaction must be interpreted more broadly to prohibit disclosures to any persons. According to FinCEN, its view of SAR confidentiality has been repeatedly upheld in relevant case law, which has concluded that, in the context of discovery in connection with civil lawsuits, FIs are broadly prohibited from disclosing a SAR to any person, not just the persons involved in the transaction.7 FinCEN also reasoned that permitting disclosures to an outside party would make it likely that SAR information would be disclosed to a person involved in the transaction, which is expressly prohibited by the SAR statute.8 Thus, consistent with case law and current regulation, FinCEN clarified that the proposed rule does not limit the prohibition on disclosure only to the person involved in the transaction.9
Second, recognizing that in order to protect the confidentiality of a SAR, any information that would reveal the existence of a SAR must be afforded the same protection as the SAR itself, FinCEN’s proposed rule changes the existing phrase—“any information that would disclose that a SAR has been prepared or filed”—to “any information that would reveal the existence of a SAR.”10 FinCEN’s view is that the change in language better describes the type of information that is covered by the prohibition against the disclosure.11 In addition, for purposes of the confidentiality provision, FinCEN purposefully used the term “SAR,” as opposed to a particular version of the SAR form (e.g., a SAR-SF for reports filed by the securities and futures industry), in recognition that a SAR may be the result of a joint filing or the sharing of a SAR among different types of FIs.12 Thus, the confidentiality provision of the SAR rule applies to any type of SAR in the filing institution’s possession, regardless of whether it is the type of SAR that is generally used by the FI.
Third, consistent with the SAR statute, FinCEN’s proposed regulation clarifies that the prohibition against disclosure extends to “directors, officers, employees and agents” of a FI who may have access to a SAR or information that would reveal the existence of a SAR.13 As is the case with the current rule, the proposed rule also provides that any FI, or any director, officer, employee, or agent of a FI, that is subpoenaed or otherwise requested to disclose a SAR or information that would reveal the existence of a SAR, must decline to provide the information, citing this section of the regulations and the SAR statute, and must notify FinCEN, and its primary Federal regulator if that regulator has a parallel SAR requirement, of the request and the response thereto.14
In addition to these amendments, FinCEN proposed three additional changes, which it referred to as “rules of construction,” to address the limited circumstances under which a SAR may be disclosed. The first proposed rule of construction provides that a FI, or any director, officer, employer or agent of a FI, may disclose a SAR or information that would reveal the existence of a SAR to FinCEN, or any federal, state or local law enforcement agency, or any Federal or state regulatory agency that examines the FI for compliance with the Bank Secrecy Act (“BSA”).15 For BDs, FCMs, and IB-Cs, such disclosure is also permissible at the request of an appropriate self-regulatory organization (“SRO”) that is examining the FI for compliance with the SAR requirements.16 Although the permissibility of such disclosures may be apparent, FinCEN clarified that the prohibition against disclosure cannot be used to withhold the information from governmental authorities or other examining authorities that are otherwise entitled by law to receive SARs and to examine for and investigate suspicious activity.
The second proposed rule of construction provides that the phrase “a SAR or information that would reveal the existence of a SAR” does not include the underlying facts, transactions, and documents upon which a SAR is based.17 According to FinCEN, this rule of construction reflects existing case law, which has recognized that factual documents created in the ordinary course of business (e.g., business records and account information upon which a SAR is based) may be discoverable in civil litigation under the Federal Rules of Civil Procedure. In addition, the proposed rule provides two examples of when a FI may disclose the underlying facts, transactions, and documents upon which a SAR is based. The first example clarifies that this information may be disclosed to another FI, or any director, officer, employee, or agent of the FI, for the preparation of a joint SAR. This rule of construction clarifies the authority for a FI that is subject to the SAR requirement to jointly file a SAR with another FI that is also subject to the SAR requirement. The second example, applicable only to depository institutions, BDs, FCMs, and IB-Cs, provides that underlying information may be disclosed in certain written employment references and termination notices. FinCEN explained that these two examples are not intended to be an exhaustive list of all possible scenarios in which the disclosure of underlying information is permissible.
The third proposed rule of construction, applicable only to depository institutions, BDs, mutual funds, FCMs, and IB-Cs, makes clear that the prohibition against disclosure of a SAR does not extend to the sharing by any of these FIs, or any director, officer, employee, or agent of these FIs, of a SAR, or information that would reveal the existence of the SAR, within these FI’s corporate organization structure, for purposes that are consistent with the BSA, as determined by regulation or in guidance.18 In consultation with other federal agencies, FinCEN concurrently issued two interpretive guidance, discussed in Section II below, further clarifying when a SAR can be shared with affiliates of these FIs.
Disclosures by Government Authorities
Currently, Section 351 of the U.S. PATRIOT Act prohibits officers and employees of the government from disclosing a SAR except “as necessary to fulfill [their] official duties,” a phrase not defined by the BSA.
The proposed rule adds a new section relating to disclosures by government authorities. Tracking the statutory language, the proposed regulation prohibits the disclosure “except as necessary to fulfill officials duties consistent with Title II of the Bank Secrecy Act.”19 FinCEN construes the phrase “official duties” in the context of the BSA, in light of the purpose for which SARs are filed, i.e., for “criminal, tax, or regulatory investigations or proceedings, or in the conduct of intelligence or counterintelligence activities, including analysis, to protect against international terrorism.”20 According to FinCEN, examples of permissible disclosures by the government would include disclosures made in response to a grand jury subpoena; a request from an appropriate federal or state law enforcement or regulatory agency; a request from an appropriate Congressional committee or subcommittees; and prosecutorial disclosures mandated by statutes or the Constitution, in connection with the statement of a government witness to be called at trial, the impeachment of a government witness, or as material exculpatory of a criminal defendant.21
Disclosures for a reason unrelated to the purposes of the BSA would be prohibited. For example, FinCEN, noted that this standard would not permit the disclosure of a SAR, or information that would reveal the existence of a SAR, to the media.22 In addition, the proposed rule specifically provides that disclosure is not permitted in response to a request for disclosure of non-public information, or in response to a request for use in a private legal proceeding, including a request under 31 CFR § 1.11, which relates to procedures for taking testimony of employees of the Department of Treasury and the production or disclosure of information contained in Treasury documents for use in legal proceedings pursuant to a request, order, or subpoena. FinCEN stated that permitting disclosures to a private litigant for use in a civil lawsuit would undermine the effectiveness of the reporting system, and could negatively impact full and candid reporting by FIs.23
In addition, the new section extends the prohibition against disclosure to all federal, state, local, territorial, or tribal government authorities, and to any director, officer, employee, or agent of those authorities.24
Disclosures by SROs
In addition to the proposed rule against disclosure by a government authority, FinCEN is adding a section which prohibits disclosures by a SRO. The section closely follows the provision prohibiting disclosures by government authorities, described above, with slight modifications to reflect the fact that SROs are not governmental entities.25
Currently, each of the SAR rules provide a safe harbor for FIs and their employees from civil liability for the reporting of suspicious activity through the filing of a SAR, including any liability which may exist “under any contract or other legally enforceable agreement (including any arbitration agreement),” and the voluntary reporting of possible violations of law and regulations.
The proposed rule clarifies the safe harbor, and more closely tracks the statutory language of the PATRIOT Act, by stating that the safe harbor applies to “disclosures,” as opposed to “reports” made by FIs. In addition, and consistent with the second rule of construction described above, FinCEN clarified that the safe harbor also applies to “a disclosure made jointly with another institution.” FinCEN noted that this language has been inserted for the sake of clarifying that all parties to a joint filing, and not simply the party that provides the SAR form to FinCEN, fall within the scope of the safe harbor.26
Currently, each of FinCEN’s SAR rules applicable to various FIs contains a provision that Treasury, through FinCEN or its delegatees, may audit a FI for compliance with the SAR requirement. These provisions also contain slight nuances. For example, for certain FIs, the SAR rules list the appropriate delegatee(s), while other SAR rules do not. Some of the rules clarify that SARs must be provided to those delegatees within the context of an examination, while others do not.
The proposed rule eliminates the list of delegate(s) and other nuances and streamlines this section for all FIs as follows: (1) FinCEN or its delegatees may examine the FI for compliance with the SAR requirement; (2) a failure to satisfy the requirements of the SAR rule may constitute a violation of the BSA or BSA regulations; and (3) for depository institutions with parallel Title 12 SAR requirements, the failure to comply with FinCEN’s SAR requirement may also constitute a violation of the parallel Title 12 rules.27
Finally, pursuant to a separate Federal Register notice of Nov. 7, 2008, FinCEN proposed reorganizing the Code of Federal Regulations, including the SAR sections. The proposed reorganization would have no substantive effect on the regulations, but would reorganize the sections by financial industry.28
II. Proposed Guidance Relating to the Sharing of SARs
In addition to the proposed rule relating to the confidentiality of SARs, FinCEN issued two new interpretive guidances—one with other federal banking agencies applicable to depository institutions, and the second with the staff of the Securities and Exchange Commission (“SEC”) and the Commodity Futures Trading Commission (“CFTC”) applicable to BDs, mutual funds, FCMs, and IB-Cs—that are substantially similar in substance and address the sharing of SARs within an organizational structure.
The proposed guidance specifies that prior guidance relating to SAR-sharing issued in 2006 continues to be applicable.29 Specifically, on Jan. 20, 2006, FinCEN issued two Interagency Guidance—one with other federal banking agencies applicable to depository institutions,30 and the second with the staff of the SEC and the CFTC applicable to BDs, FCMs, and IB-Cs.31 Both Interagency Guidance noted that these FIs, with certain exceptions or qualifications, were permitted to share a SAR with its parent entities, both domestic and foreign, but reserved judgment as to sharing among affiliates. In addition, in October 2006, FinCEN, in consultation with the SEC, issued guidance that a U.S. mutual fund may share a SAR with the investment adviser that controls the fund, whether domestic or foreign, so that the investment adviser could implement enterprise-wide risk management and compliance functions over all of the mutual funds that it controls, and improve its identification and reporting of suspicious activity.32 Notwithstanding the newly issued proposed rule and interpretive guidance, all three prior guidance continue to be applicable.
In the proposed interpretative guidance, FinCEN concluded that the proposed rule—which provides that depository institutions, BDs, mutual funds, FCMs, and IB-Cs may share a SAR, or any information that would reveal the existence of a SAR, within these entities’ corporate organizational structure—may be interpreted to permit these entities to share a SAR, or any information that would reveal the existence of a SAR, with a U.S. affiliate that is subject to the SAR regulation.33
For depository institutions, the term “affiliate” is defined as “a company under common control with, or a subsidiary of, the depository institution.” FinCEN defines the phrase “under common control” to mean that another company: (1) directly or indirectly or acting through one or more persons owns, controls, or has the power to vote 25 percent or more of any class of the voting securities of the company and the depository institution; or (2) controls in any manner the election of a majority of the directors or trustees of the company and the depository institution. The phrase “controlled by” means that the depository institution (1) directly or indirectly has the power to vote 25 percent or more of any class of the voting securities or the company, or (2) controls in any manner the election of a majority of the directors or trustees of the company.34
Similarly, for BDs, mutual funds, FCMs, and IB-Cs, an “affiliate” of a person is defined as “any company under common control with, or controlled by, such person.” The word “control” means “the power to exercise a controlling influence over the management or policies of a company whether through ownership of securities, by contract or otherwise. Any person who owns beneficially, either directly or through one or more controlled companies, more than 25 percent of the voting securities of any company is presumed to control the company. Any person who does not own more than 25 percent of the voting securities of any company will be presumed not to control the company.”35
In the proposed interpretative guidance, FinCEN declined to permit the sharing of a SAR with affiliates that are not subject to a SAR rule, whether domestic or foreign, reasoning that at this time, it is “not apparent” that such sharing would be consistent with the purposes of the BSA.36 In a footnote to the proposed interpretative guidance for depository institutions, FinCEN noted that because foreign branches of U.S. banks are regarded as foreign banks for purposes of the BSA, they are “affiliates” that are not subject to a SAR regulation.37 Thus, a U.S. bank that has filed a SAR may not share the SAR, or any information that would reveal the existence of a SAR, with its affiliates that are foreign branches. Similarly, in the proposed interpretative guidance for BDs, mutual funds, FCMs and IB-Cs, FinCEN noted that it does not intend this guidance to permit the sharing of SARs with affiliates where such sharing would subject the SARs to the laws of a foreign jurisdiction.38
In issuing the interpretative guidance, FinCEN noted that permitting the sharing of a SAR within a corporate organization is consistent with two important purposes of the BSA. First, the sharing of a SAR among certain U.S. affiliates promotes efforts to detect and report money laundering and terrorist financing by FIs.39 FinCEN also noted that permitting the sharing of a SAR would eliminate the need to create a separate summary document which, if shared, may have inadvertently revealed the existence of a SAR itself.40
Second, permitting the sharing of a SAR with certain U.S. affiliates ensures the confidentiality of a SAR, or any information that would reveal the existence of a SAR.41 FinCEN imposed two restrictions on the sharing of SARs which it views as promoting the confidentiality of SARs. First, SARs may only be shared by a filing institution that has filed a SAR.42 Thus, an affiliate that has received a SAR, or any information that would reveal the existence of a SAR, may not share that SAR or the information that would reveal the existence of that SAR with another affiliate, even if that affiliate is subject to a SAR rule. Second, as part of its internal controls, these FIs should have a written confidentiality agreement in place with its affiliates to ensure that its affiliates protect the confidentiality of the SAR.43 Given these two restrictions, FinCEN noted that sharing of a SAR with U.S. affiliates of these designated FIs is consistent with the objective of ensuring the confidentiality of a SAR.
The proposed interpretative guidance also provides that a SAR, or any information that would reveal the existence of a SAR, must not be disclosed, even under this guidance, if the FI has reason to believe it may be disclosed to any person involved in the suspicious activity that is the subject of the SAR.44 However, provided that no person involved in the transaction is notified that the transaction has been reported, the prohibition against disclosure does not apply to the sharing of a SAR, or any information that would reveal the existence of a SAR, within the corporate organizational structure of a depository institution, a BD, mutual fund, FCM or IB-C for purposes consistent with Title II of the BSA, as determined by regulation or in guidance.
Finally, FinCEN clarified that the proposed guidance is intended only to remove unnecessary obstacles to detect and report suspicious activity, and should not be read to impose any new BSA requirements or to suggest that sharing of SARs with affiliates is compulsory.45
III. Requests for Comments
FinCEN invites comments on all aspects of the proposed rule and guidances. Specifically, with respect to the proposed rule, FinCEN solicits comments regarding, among others, the following areas:46
- Should any of the proposed provisions which would apply only to a limited segment of SAR filers be applicable to additional types of FIs? For example, should sharing within an institution’s corporate organization structure for purposes consistent with Title II of the BSA be limited only to banks, BDs, FCMs and IB-Cs?
- Are any of the terms or provisions that were used for consistency across FIs inappropriate for one type of FI based on its specific characteristics?
- Have any important provisions from the existing regulations been unintentionally or inappropriately eliminated or confused by the proposed new regulations?
- Are any of the provisions or terms used in the rule or the preamble to the rule unclear in their meaning, application or scope?
- If finalized, how would the proposed rule impact compliance costs and practice?
- What additional or alternative methods could be used to strengthen the confidentiality of SARs?
- Should additional parts of the SAR rules be harmonized? If so, please describe the benefit of such revisions.
With respect to the proposed interpretative guidances, FinCEN solicits comments on whether they would achieve the intended effect of promoting compliance with the BSA; whether they will be beneficial; whether they raise any ambiguities; and whether they will result in any negative consequences. In addition, FinCEN invites comments regarding the following:47
- Whether the definition of affiliate is appropriate;
- Whether the scope of the guidance should be expanded to permit sharing with other affiliates within the United States, or outside of the United States, including with foreign branches of U.S. banks;
- Whether similar provisions to allow sharing with certain affiliates should be permitted among all FIs subject to a SAR rule;
- Whether FIs, other than depository institutions, BDs, mutual funds, FCMS and IB-Cs subject to a SAR rule, should be permitted to share a SAR, or any information that would reveal the existence of a SAR, with parent entities and/or affiliates; and
- Whether and how a depository institution, BD, mutual fund, FCM or IB-C can store and provide access to SARs in an electronic system in a way that prevents the SARs from being subject to disclosure laws or obligations of foreign jurisdictions.
In addition to these comments, the interpretative guidance for BDs, mutual funds, FCMs and IB-Cs solicits comments on the following additional question: whether the scope of the guidance clearly limits sharing with affiliates to only those affiliates within the United States based on the application of FinCEN’s SAR rules, or whether further clarification is needed to ensure that SARs are shared only in a domestic context.48
The comment period to the proposed rules for FinCEN, OCC and OTS closes 90 days following the publication of the proposals in the Federal Register, or on June 8, 2009.