Beneficial Ownership Information Access and Safeguards

Federal RegisterDec 22, 2023

Ask Donna

What actually matters in this document.

Text

DEPARTMENT OF THE TREASURY

Financial Crimes Enforcement Network

31 CFR Part 1010

RIN 1506-AB59

Beneficial Ownership Information Access and Safeguards

AGENCY:

Financial Crimes Enforcement Network (FinCEN), Treasury.

ACTION:

Final rule.

SUMMARY:

FinCEN is promulgating regulations regarding access by authorized recipients to beneficial ownership information (BOI) that will be reported to FinCEN pursuant to section 6403 of the Corporate Transparency Act (CTA), enacted into law as part of the Anti-Money Laundering Act of 2020 (AML Act), which is itself part of the National Defense Authorization Act for Fiscal Year 2021 (NDAA). The regulations implement the strict protocols required by the CTA to protect sensitive personally identifiable information (PII) reported to FinCEN and establish the circumstances in which specified recipients have access to BOI, along with data protection protocols and oversight mechanisms applicable to each recipient category. The disclosure of BOI to authorized recipients in accordance with appropriate protocols and oversight will help law enforcement and national security agencies prevent and combat money laundering, terrorist financing, tax fraud, and other illicit activity, as well as protect national security.

DATES:

These rules are effective February 20, 2024.

FOR FURTHER INFORMATION CONTACT:

The FinCEN Regulatory Support Section at 1-800-767-2825 or electronically at

frc@fincen.gov.

SUPPLEMENTARY INFORMATION:

I. Introduction

This final rule implements the beneficial ownership information (BOI) access and safeguard provisions in the Corporate Transparency Act (CTA).

The rule balances the statutory requirement to create a database of BOI that is highly useful to authorized BOI recipients, with the requirement to safeguard BOI from unauthorized use. This final rule reflects FinCEN's understanding of the critical need for the highest standard of security and confidentiality protocols to maintain confidence in the U.S. Government's ability to protect sensitive information while achieving the objective of the CTA noted above—establishing a database of BOI that will be highly useful in combatting illicit finance and the abuse of shell and front companies by criminals, corrupt officials, and other bad actors.

The CTA is Title LXIV of the William M. (Mac) Thornberry National Defense Authorization Act for Fiscal Year 2021, Public Law 116-283 (Jan. 1, 2021) (the NDAA). Division F of the NDAA is the Anti-Money Laundering Act of 2020 (AML Act), which includes the CTA. Section 6403 of the CTA, among other things, amends the Bank Secrecy Act (BSA) by adding a new section 5336, Beneficial Ownership Information Reporting Requirements, to Subchapter II of Chapter 53 of Title 31, United States Code.

Specifically, this final rule implements the provisions in the CTA, codified at 31 U.S.C. 5336(c), that authorize certain recipients to receive disclosures of identifying information associated with reporting companies, their beneficial owners, and their company applicants (together, BOI). The CTA requires reporting companies to report BOI to FinCEN pursuant to 31 U.S.C. 5336(b). This rule reflects FinCEN's careful consideration of public comments, including those received in response to (1) an advance notice of proposed rulemaking (ANPRM)

on the implementation of the CTA, (2) an NPRM regarding BOI reporting requirements (Reporting NPRM),

and (3) an NPRM regarding BOI access and safeguards (Access NPRM).

86 FR 17557 (Apr. 5, 2021).

86 FR 69920 (Dec. 8, 2021).

87 FR 77404 (Dec. 16, 2022).

As Congress explained in the CTA, “malign actors seek to conceal their ownership of corporations, limited liability companies, or other similar entities in the United States to facilitate illicit activity, including money laundering, the financing of terrorism, proliferation financing, serious tax fraud, human and drug trafficking, counterfeiting, piracy, securities fraud, financial fraud, and acts of foreign corruption, harming the national security interests of the United States and allies of the United States.”

Access by authorized recipients to BOI reported under the CTA would significantly aid efforts to protect U.S. national security and safeguard the U.S. financial system from such illicit use. It would impede illicit actors' ability to use legal entities to conceal proceeds from criminal acts that undermine U.S. national security and foreign policy interests, such as corruption, human trafficking, drug and arms trafficking, and terrorist financing. BOI can also add critical data to financial analyses in activities the CTA contemplates, including tax investigations. It can also provide essential information to the intelligence and national security professionals who work to prevent terrorists, proliferators, and those who seek to undermine our democratic institutions or threaten other core U.S. interests from raising, hiding, or moving money in the United States through anonymous shell or front companies.

CTA, section 6402(3).

A front company generates legitimate business proceeds to commingle with illicit earnings.

See

U.S. Department of the Treasury,

National Money Laundering Risk Assessment

(2018), p. 29, available at

https://home.treasury.gov/system/files/136/2018NMLRA_12-18.pdf.

The United States currently does not have a centralized or complete store of information about who owns and operates legal entities within the United States. The beneficial ownership data available to law enforcement and national security agencies are generally limited to certain commercial databases and the information collected by financial institutions on legal entity accounts pursuant to their Customer Due Diligence (CDD) or broader Customer Identification Program (CIP) obligations, some of which has been included in Suspicious Activity Reports (SARs) or provided to law enforcement in response to judicial process.

As set out in detail in the Notice of Proposed Rulemaking regarding BOI reporting requirements

and the BOI reporting final rule,

U.S. law enforcement officials and the Financial Action Task Force (FATF),

among others, have for years noted how the lack of timely access to accurate and adequate BOI by law enforcement and other authorized

recipients remained a significant gap in the United States' anti-money laundering/countering the financing of terrorism (AML/CFT) and countering the financing of proliferation (CFP) framework. Broadly, and critically, BOI can identify linkages between potential illicit actors and opaque business entities, including shell companies. Furthermore, comparing BOI reported pursuant to the CTA against data collected under the Bank Secrecy Act (BSA) and other relevant government data is expected to significantly further efforts to identify illicit actors and combat their financial activities.

See, e.g.,

31 CFR 1010.230. Even then, any BOI a financial institution collects is not systematically reported to any central repository.

Supra

note 3, 86 FR at 69923-69924.

87 FR 59498, 59506 (Sept. 30, 2022).

The FATF, of which the United States is a founding member, is an international, inter-governmental task force whose purpose is the development and promotion of international standards and the effective implementation of legal, regulatory, and operational measures to combat money laundering, terrorist financing, the financing of weapons proliferation, and other related threats to the integrity of the international financial system. The FATF assesses over 200 jurisdictions against its minimum standards for beneficial ownership transparency. Among other things, it has established standards on transparency and beneficial ownership of legal persons, to deter and prevent the misuse of corporate vehicles.

See

FATF Recommendation 24, Transparency and Beneficial Ownership of Legal Persons, The FATF Recommendations: International Standards on Combating Money Laundering and the Financing of Terrorism and Proliferation (updated Oct. 2020), available at

https://www.fatf-gafi.org/publications/fatfrecommendations/documents/fatf-recommendations.html;

FATF Guidance, Transparency and Beneficial Ownership, Part III (Oct. 2014), available at

https://www.fatf-gafi.org/media/fatf/documents/reports/Guidance-transparency-beneficial-ownership.pdf.

At the same time, however, FinCEN recognizes that BOI is sensitive information. This final rule reflects FinCEN's commitment to creating a highly useful database for authorized BOI recipients while protecting this sensitive information from unauthorized disclosure. To this end, the final rule aims to ensure that: (1) only authorized recipients have access to BOI; (2) authorized recipients use that BOI only for purposes permitted by the CTA; and (3) authorized recipients re-disclose BOI only in ways that balance protection of the security and confidentiality of the BOI with furtherance of the CTA's objective of making BOI available to a range of users for purposes specified in the CTA. The final rule also provides a robust framework to ensure that BOI reported to FinCEN, and received by authorized recipients, is subject to strict cybersecurity controls, confidentiality protections and restrictions, and robust audit and oversight measures. Coincident with the protocols described in this final rule, FinCEN continues to work to develop a secure, nonpublic database in which to store BOI, using rigorous information security methods and controls typically used in the Federal government to protect nonclassified yet sensitive information systems at the highest security level. Against this backdrop and consistent with the CTA, FinCEN will permit certain Federal, State,

local, and Tribal officials, as well as foreign officials acting through a Federal agency, to obtain BOI for use in furtherance of statutorily authorized activities such as those related to national security, intelligence, and law enforcement. Financial institutions with customer due diligence requirements under applicable law will have access to BOI to facilitate compliance with those requirements, as will the Federal functional regulators or other appropriate regulatory agencies that supervise or assess those financial institutions' compliance with such requirements.

FinCEN will interpret the term “State” consistent with the definition of that term in the final Beneficial Ownership Information Reporting Requirements rule at 87 FR 59498 (Sep. 30, 2022) (which defines the term “State” to mean “any state of the United States, the District of Columbia, the Commonwealth of Puerto Rico, the Commonwealth of the Northern Mariana Islands, American Samoa, Guam, the United States Virgin Islands, and any other commonwealth, territory, or possession of the United States.”).

II. Background

A. Access to Beneficial Ownership Information

For more than two decades, the U.S. government has been raising awareness about the misuse of legal entities by criminal actors for illicit ends.

Recently, Secretary of the Treasury Janet L. Yellen affirmed that:

See

87 FR 59501-59503 (Sept. 30, 2022).

“The United States has a unique obligation to tackle corruption. Corrupt actors from around the world continually attempt to exploit the vulnerabilities in the U.S. framework—for countering money laundering, terrorist financing, and other forms of illicit finance. . . . Just like legitimate investors, corrupt actors move their money through the United States to take advantage of the world's largest and most dynamic economy. They incorporate companies to benefit from our strong legal system, buy assets like real estate, and invest in our deep and liquid markets. . . . Unmasking shell corporations is the single most significant thing we can do to make our financial system inhospitable to corrupt actors. . . . The beneficial ownership database will deter dirty money from entering the U.S.—and give law enforcement and other partners the tools they need to follow the money when it does.”

U.S. Department of the Treasury (Treasury),

“Remarks by Secretary Janet L. Yellen on Anti-Corruption as a Cornerstone of a Fair, Accountable, and Democratic Economy at the Summit for Democracy,

” (Mar. 28, 2023), available at

https://home.treasury.gov/news/press-releases/jy1371.

The Department of the Treasury (Treasury) has previously observed in its 2020 National Strategy for Combating Terrorist and other Illicit Financing (the 2020 Illicit Financing Strategy) that “[m]isuse of legal entities to hide a criminal beneficial owner or illegal source of funds continues to be a common, if not the dominant, feature of illicit finance schemes, especially those involving money laundering, predicate offences, tax evasion, and proliferation financing. . . .”

The 2020 Illicit Financing Strategy further noted a Treasury finding that, between 2016 and 2019, legal entities were used in a substantial proportion of adjudicated Internal Revenue Service (IRS) cases to perpetrate tax evasion and fraud.

In a separate report, the Drug Enforcement Administration highlighted that drug trafficking organizations frequently use shell and front companies to commingle illicit drug proceeds with legitimate front company revenue to launder the illicit drug proceeds.

Treasury,

National Strategy for Combating Terrorist and Other Illicit Financing

(2020), p. 13, available at

https://home.treasury.gov/system/files/136/National-Strategy-to-Counter-Illicit-Financev2.pdf.

The 2022 National Strategy for Combating Terrorist and Other Illicit Financing noted that “[t]he passage of the CTA was a critical step forward in closing a long-standing gap and strengthening the U.S. AML/CFT regime” and that “[a]ddressing the gap in collection at the time of entity formation is the most important AML/CFT regulatory action for the U.S. government.” Treasury,

National Strategy for Combating Terrorist and Other Illicit Financing

(May 2022), p. 8, available at

https://home.treasury.gov/system/files/136/2022-National-Strategy-for-Combating-Terrorist-and-Other-Illicit-Financing.pdf

(“2022 Illicit Financing Strategy”).

Id.

at 14.

Drug Enforcement Administration,

2020 Drug Enforcement Administration National Drug Threat Assessment

(“DEA 2020 NDTA”) (2020), pp. 87-88, available at

https://www.dea.gov/sites/default/files/2021-02/DIR-008-21%202020%20National%20Drug%20Threat%20Assessment_WEB.pdf.

As Treasury stressed in its 2022 Illicit Financing Strategy, law enforcement's lack of access to uniform BOI hinders its ability to swiftly investigate those entities created and used to hide ownership for illicit purposes.

Consequently, authorized recipients' access to BOI reported under the CTA will significantly aid efforts to protect U.S. national security; safeguard the U.S. financial system; and support U.S. foreign policy and other interests by providing a tool to counter corruption, human smuggling, drug and arms trafficking, terrorist financing, and other criminal acts. BOI can also add critical data to financial analyses in activities the CTA contemplates, including tax investigations. BOI can also provide essential information to the intelligence and national security professionals who work to prevent terrorists, proliferators, and those who seek to undermine our democratic institutions or threaten other core U.S. interests from raising, hiding, or moving money in the United States through anonymous shell or front companies.

See

Treasury,

2022 Illicit Financing Strategy, supra

note 3, p. 12.

Entity formation and registration in the United States happen at the state and Tribal levels. Although state- and Tribal-level entity formation laws vary, most jurisdictions do not require the party forming an entity to identify its individual beneficial owners at or after the time of formation. Additionally, the vast majority of states require little to no contact information or other information about an entity's officers or others who

control it.

Furthermore, although many financial institutions are required to collect certain beneficial ownership information pursuant to FinCEN's 2016 Customer Due Diligence Rule (2016 CDD Rule),

and broader Customer Identification Program (CIP) obligations,

that information is not systematically reported to a central repository.

See

CTA, section 6402(2) (“[M]ost or all States do not require information about the beneficial owners of corporations, limited liability companies, or other similar entities formed under the laws of the State”); U.S. Government Accountability Office,

Company Formations: Minimal Ownership Information Is Collected and Available

(Apr. 2006), available at

https://www.gao.gov/assets/gao-06-376.pdf; see also, e.g.,

The National Association of Secretaries of State (NASS),

NASS Summary of Information Collected by States

(Jun. 2019), available at

https://www.nass.org/sites/default/files/company%20formation/nass-business-entity-info-collected-june2019.pdf.

Final Rule,

Customer Due Diligence Requirements for Financial Institutions,

81 FR 29398-29402 (May 11, 2016); 31 CFR 1010.230.

See e.g.,

31 CFR 1020.220.

Identifying individual beneficial owners of legal entities in the United States therefore is often a significant challenge for law enforcement,

and it represents a significant weakness in the United States' AML/CFT and CFP frameworks, as Treasury

and the FATF

have noted for some time. Currently, obtaining BOI through grand jury subpoenas and other means can involve considerable effort. Grand jury subpoenas, for example, require an underlying grand jury investigation into a possible violation of law. Furthermore, the law enforcement officer or investigator must work with a prosecutor's office, such as a U.S. Attorney's Office, to open a grand jury investigation, obtain the grand jury subpoena, and issue it on behalf of the grand jury. The investigator also needs to determine who should receive the subpoena and coordinate service, which creates additional complications in cases involving complicated corporate structuring. Sometimes this work is all for naught because the investigation involves an entity formed or registered in a jurisdiction that does not require BOI for formation or registration.

In 2019, for example, Steven M. D'Antuono, Acting Deputy Assistant Director of the FBI's Criminal Investigative Division testified before Congress that “[t]he process for the production of [beneficial ownership] records can be lengthy, anywhere from a few weeks to many years, and . . . can be extended drastically when it is necessary to obtain information from other countries . . . . [I]f an investigator obtains the ownership records, either from a domestic or foreign entity, the investigator may discover that the owner of the identified corporate entity is an additional corporate entity, necessitating the same process for the newly discovered corporate entity. Many professional launderers and others involved in illicit finance intentionally layer ownership and financial transactions in order to reduce transparency of transactions. As it stands, it is a facially effective way to delay an investigation.” D'Antuono further acknowledged that these challenges may be even greater for State, local, and Tribal law enforcement agencies that may not have the same resources as their Federal counterparts to undertake long and costly investigations to identify beneficial owners. D'Antuono noted that requiring the disclosure of BOI by legal entities and the creation of a central BOI repository available to law enforcement and regulators could address these challenges. Federal Bureau of Investigation (FBI),

Testimony of Steven M. D'Antuono, Section Chief, Criminal Investigative Division, “Combatting Illicit Financing by Anonymous Shell Companies

” (May 21, 2019), available at

https://www.fbi.gov/news/testimony/combating-illicit-financing-by-anonymous-shell-companies.

Treasury,

Treasury Announces Key Regulations and Legislation to Counter Money Laundering and Corruption, Combat Tax Evasion,

May 5, 2016, available at

https://home.treasury.gov/news/press-releases/jl0451.

See

https://www.fatf-gafi.org/publications/fatfrecommendations/documents/fatf-recommendations.html.

FinCEN's existing regulatory tools help, but they provide only partial solutions. The 2016 CDD Rule, for example, requires that certain types of U.S. financial institutions identify and verify the beneficial owners of legal entity customers at the time of account opening.

The information financial institutions must collect under the 2016 CDD Rule, however, is generally neither comprehensive nor reported to the U.S. government (nor to State, local, or Tribal governments), except when filed in suspicious activity reports (SARs) or in response to judicial process. Moreover, the 2016 CDD Rule applies only to legal entities that open accounts at certain U.S. financial institutions. Other FinCEN authorities—geographic targeting orders

and the so-called “311 measures” (

i.e.,

special measures imposed on foreign jurisdictions, foreign financial institutions, or international transactions of primary money laundering concern)

—offer temporary and targeted tools. Neither provides law enforcement the ability to reliably, efficiently, and consistently identify new entities for investigation or follow investigatory leads.

31 CFR 1010.230(b)(1).

31 U.S.C. 5326(a); 31 CFR 1010.370.

31 U.S.C. 5318A, as added by section 311 of the USA PATRIOT Act (Pub. L. 107-56).

This Final Rule will help to fill in these gaps while creating a framework to keep BOI secure and confidential.

B. The CTA

The CTA is part of the AML Act, which is a part of the 2021 NDAA. The CTA added a new section, 31 U.S.C. 5336, to the BSA to enhance beneficial ownership transparency while minimizing the burden on the regulated community.

This new section requires certain types of domestic and foreign entities, called “reporting companies,” to submit BOI to FinCEN.

Specifically, reporting companies must submit to FinCEN, for each beneficial owner and each individual who files an application to form a domestic entity or register a foreign entity to do business in the United States (the “company applicant”), four pieces of information: the individual's full legal name, date of birth, current residential or business street address, and either a unique identifying number from an acceptable identification document (

e.g.,

a passport) or the individual's “FinCEN identifier.”

CTA, section 6403.

31 U.S.C. 5336(b)(1), (2). The CTA generally exempts from the reporting requirements banks and other entities that are already subject to significant regulatory regimes meant to expose their beneficial owners, among other purposes.

See id.

at 5336(a)(11)(B).

Id.

at 5336(b)(2).

The CTA establishes that BOI is “sensitive information.”

The statute treats it as such by limiting its access and use to specified parties for particular purposes.

In particular, Congress authorized FinCEN to disclose BOI only to a statutorily defined group of governmental authorities and financial institutions, and only in defined circumstances. The CTA further provides that the Secretary of the Treasury (Secretary) must “maintain [BOI] in a secure, nonpublic database, using information security methods and techniques that are appropriate to protect nonclassified information systems at the highest security level.”

As discussed in detail in section II.E, FinCEN is currently building the secure information technology (IT) system into which reporting companies will submit, and from which authorized recipients will generally obtain, BOI.

CTA, section 6402(6).

Id.

CTA, section 6402(7)(A). While the statutory language seems to include a typographical error that refers to another provision (not related to BOI), it also seems clear that the object of protection in this case is BOI.

In addition to setting out requirements and restrictions related to BOI reporting and access, the CTA requires that FinCEN revise the 2016 CDD Rule within one year of the BOI reporting requirements taking effect. In particular, the CTA directs FinCEN to revise the 2016 CDD Rule to: (1) bring it into conformity with the AML Act as a whole, including the CTA; (2) account for financial institutions' access to BOI

reported to FinCEN “in order to confirm the beneficial ownership information provided directly to the financial institutions” for AML/CFT and customer due diligence purposes; and (3) reduce unnecessary or duplicative burdens on financial institutions and legal entity customers.

In carrying out these provisions, the CTA further requires FinCEN to rescind paragraphs (b) through (j) of 31 CFR 1010.230.

CTA, section 6403(d)(1)(A)-(C).

CTA, section 6403(d)(1)-(2). The CTA orders the rescission of paragraphs (b) through (j) directly (“the Secretary of the Treasury shall rescind paragraphs (b) through (j)”) and orders the retention of paragraph (a) by a negative rule of construction (“nothing in this section may be construed to authorize the Secretary of the Treasury to repeal . . . [31 CFR] 1010.230(a)[.]”). The statute also provides a list of considerations to take into account when revising the 2016 CDD Rule.

See generally

CTA, section 6403(d)(3).

FinCEN began implementing the CTA by publishing an ANPRM on April 5, 2021.

The ANPRM sought input on five open-ended categories of questions, including questions on clarifying key CTA definitions and on how FinCEN should implement CTA provisions governing FinCEN's maintenance and disclosure of BOI subject to appropriate access protocols. In response to the ANPRM, FinCEN received and considered 220 comments from parties that included businesses, civil society organizations, trade associations, law firms, secretaries of state and other state officials, Indian Tribes, members of Congress, and private citizens.

86 FR 17557 (Apr. 5, 2021).

FinCEN next published the Reporting NPRM on December 8, 2021.

The Reporting NPRM described Treasury's efforts to address the lack of transparency in the ownership of certain legal entities, and proposed regulations specifying what BOI must be reported to FinCEN pursuant to CTA requirements, by whom, and when. These regulations also proposed processes for obtaining, updating, and using FinCEN identifiers. The Reporting NPRM included a 60-day comment period, which closed on February 7, 2022. FinCEN received over 240 comments on the Reporting NPRM.

86 FR 69920 (Dec. 8, 2021).

After considering those comments, FinCEN published a final rule implementing the CTA's BOI reporting requirements on September 30, 2022 (Reporting Rule).

The Reporting Rule takes effect on January 1, 2024, and is the first of three rulemakings required by the CTA. Under the Reporting Rule, reporting companies in existence before the effective date will have until January 1, 2025, to report.

The Reporting Rule also provided that reporting companies created or registered to do business on or after January 1, 2024 would need to submit BOI to FinCEN within 30 days of receiving notice of a company's creation or registration.

However, on November 30, 2023, FinCEN published a final rule to extend the timeframe for reporting companies created or registered on or after January 1, 2024, and before January 1, 2025, to submit their initial BOI reports to FinCEN. Under this amendment to the Reporting Rule, reporting companies created or registered on or after January 1, 2024, and before January 1, 2025, will have 90 days to submit their initial BOI reports, instead of 30 days. Reporting companies formed on or after January 1, 2025, will continue to be required to submit their initial BOI reports within 30 days.

87 FR 59498 (Sept. 30, 2022).

Reporting Rule, 31 CFR 1010.380(a)(1)(i)-(ii).

Id.

at 1010.380(a)(iii).

The Reporting Rule also reserved for further consideration certain provisions concerning the use of FinCEN identifiers for entities.

FinCEN next published the Access NPRM regarding the CTA's BOI access and safeguard provisions on December 16, 2022.

The proposed regulations reflected information gleaned from over 30 outreach sessions with representatives from Federal agencies, state courts, state and local prosecutors' offices, Tribal governments, financial institutions, financial self-regulatory organizations (SROs), and government offices that had established beneficial ownership databases, as well as from comments to the prior CTA-related publications. The Access NPRM also included proposed amendments to the reporting regulations that would finalize the remaining Reporting Rule provisions concerning the use of FinCEN identifiers for entities. The comment period for the Access NPRM closed on February 14, 2023.

87 FR 77404 (Dec. 16, 2022).

This final rule adopts, with modifications, the proposed regulations in the Access NPRM and is the second rulemaking required by the CTA. These final access and safeguard regulations (“Access Rule”) aim to ensure that: (1) only authorized recipients have access to BOI; (2) authorized recipients use that access only for purposes permitted by the CTA; and (3) authorized recipients only re-disclose BOI in ways that balance protecting its security and confidentiality with the CTA objective of making BOI available to a range of users for authorized purposes. The regulations also provide a robust framework to ensure that BOI reported to FinCEN, and received by authorized recipients, is subject to strict cybersecurity controls, confidentiality protections and restrictions, and robust audit and oversight measures.

FinCEN will implement the CTA requirement to revise the 2016 CDD Rule through a future rulemaking process. That process will provide the public with an opportunity to comment on the effect of the final provisions of the BOI reporting and access rules on financial institutions' customer due diligence obligations.

Finally, the CTA requires the Inspector General of the Department of the Treasury to provide public contact information to receive external comments or complaints regarding the BOI notification and collection process or regarding the accuracy, completeness, or timeliness of such information.

Treasury's Office of Inspector General (“Treasury OIG”) has established the following email inbox to receive such comments or complaints:

CorporateTransparency@oig.treas.gov.

See

31 U.S.C. 5336(h)(4).

C. The Access NPRM

As noted above in section II.B, FinCEN published the Access NPRM on December 16, 2022. The NPRM had a 60-day comment period that closed on February 14, 2023. FinCEN received over 80 comments. The NPRM described who would be authorized to access BOI reported to FinCEN, how those parties could use the information, and how they would be required to safeguard it.

The proposed regulations would amend 31 CFR 1010.950(a) to clarify that the disclosure of BOI would be governed by proposed 31 CFR 1010.955, rather than 31 CFR 1010.950(a), which governs disclosure of other BSA information. The CTA specifies disclosure rules applicable to BOI that are distinct from BSA provisions authorizing disclosure of other BSA information.

See

31 U.S.C. 5336(c)(2), (5).

The Access NPRM proposed to incorporate the CTA's general prohibition on the disclosure of BOI by individual recipients to others unless authorized to do so under the statute or its implementing regulations, with certain clarifications regarding the applicability and duration of that prohibition. The proposed regulations would authorize the disclosure and use of BOI to facilitate the purposes of the CTA, with FinCEN further proposing to retain the authority to permit in writing the re-disclosure of BOI in other circumstances.

The proposed regulations included provisions that would address a range of

administrative matters,

e.g.,

circumstances under which FinCEN could decline to provide requested BOI or debar or suspend an authorized recipient, and would incorporate CTA provisions that impose civil and criminal penalties for knowingly disclosing or knowingly using BOI in ways that were not authorized by the CTA. The proposed rule also would reinforce the security and confidentiality requirements of the CTA by making clear the range of actions that could constitute unauthorized disclosure and use.

Finally, the Access NPRM made a new proposal regarding the use of FinCEN identifiers for entities, which was initially addressed in the Reporting NPRM and then deferred in the Final Reporting Rule. Specifically, the proposed regulations would clarify that a reporting company would be permitted to report the FinCEN identifier of an intermediate entity (

i.e.,

an entity through which an individual beneficial owner exercises substantial control or owns ownership interests in a reporting company) in lieu of a beneficial owner's PII only when three criteria are met. Taken together, these requirements sought to avoid the use of FinCEN identifiers to obscure beneficial ownership in a reporting company when the entity's ownership structure involves multiple beneficial owners and intermediate entities. FinCEN published a final rule to implement these provisions regarding the use of FinCEN identifiers for entities on November 8, 2023.

88 FR 76995 (Nov. 8, 2023).

The Access NPRM, however, primarily focused on the scope of and requirements for access to and protection of BOI reported to FinCEN. The following subsections outline how the proposed regulations would apply to five categories of authorized recipients for which the CTA prescribes specific requirements with respect to access to and use of BOI.

i. Domestic Agencies

The first category of BOI recipients authorized by the CTA consists of (1) Federal agencies engaged in national security, intelligence, or law enforcement activity if the requested BOI is for use in furtherance of such activity;

and (2) State, local, and Tribal law enforcement agencies if “a court of competent jurisdiction” authorizes the law enforcement agency to seek the information in a criminal or civil investigation.

Federal agency access to BOI would be contingent on the

type of activity

an agency engages in. In contrast, State, local, and Tribal access would be contingent on two conditions; (1) whether the recipient is a law enforcement agency,

i.e.,

the

type of agency;

and (2) whether a State, local, or Tribal law enforcement agency receives authorization from a court of competent jurisdiction to request BOI from FinCEN.

31 U.S.C. 5336(c)(2)(B)(i)(I).

31 U.S.C. 5336(c)(2)(B)(i)(II).

The Access NPRM proposed definitions for “national security,” “intelligence,” and “law enforcement” activities in a manner consistent with the CTA. In particular, the Access NPRM proposed that “law enforcement” include both criminal

and

civil investigations and actions, including actions to impose civil penalties, civil forfeiture actions, and civil enforcement through administrative proceedings. For access by State, local and Tribal law enforcement, the Access NPRM proposed to define “court of competent jurisdiction” as any court with jurisdiction over the criminal or civil investigation for which the State, local, or Tribal law enforcement agency requested BOI. The Access NPRM further proposed that the requisite court authorization would have to be in the form of a court order, with the understanding that the term “order” could encompass many authorization types issued by a range of court officers (

i.e.,

individuals empowered to exercise a court's authority and issue authorizations on its behalf, excluding individual attorneys). The NPRM specifically sought feedback on the scope of this definition.

The proposed regulations would also require all Federal agencies engaged in national security, intelligence, or law enforcement activity to provide a brief justification for each search for BOI in the FinCEN IT system and certify compliance with the applicable regulatory requirements. State, local, and Tribal law enforcement agencies would also have had to provide a brief justification for each search for BOI and submit copies of their court orders for FinCEN review. Upon meeting these requirements, both Federal agencies engaged in national security, intelligence, or law enforcement activity and State, local, and Tribal law enforcement agencies would have the ability to conduct searches for BOI in the beneficial ownership IT system (the “BO IT system”) relevant to their investigation. The BO IT system would provide these users with both a reporting company's BOI at the time of the request as well as any previously submitted BOI.

Furthermore, the Access NPRM proposed that Federal agencies engaged in a national security, intelligence, or law enforcement activity, as well as State, local, and Tribal law enforcement agencies, would be authorized to disclose BOI obtained directly from FinCEN to courts of competent jurisdiction or parties to a civil or criminal proceeding. This authorization would only apply to civil or criminal proceedings involving U.S. Federal, State, local, and Tribal laws. In the preamble to the Access NPRM, FinCEN explained that it envisioned agencies relying on this provision when, for example, a prosecutor would need to provide a criminal defendant with BOI in discovery or use it as evidence in a court proceeding or trial.

See

CTA, section 6402(5)(D).

The CTA prescribes a number of security and confidentiality requirements that the Secretary must impose on requesting Federal, State, local, and Tribal agencies and their heads. These include requirements for secure storage systems and access policies and procedures; personnel access controls; recordkeeping, reporting, and audit requirements; and written certifications. These requirements affirm the importance of the security and confidentiality protocols and the need for a high degree of accountability for the protection of BOI. The proposed regulations described how each requesting agency, before it could obtain BOI from FinCEN, would be required to enter into a memorandum of understanding (MOU) with FinCEN specifying the standards, procedures, and systems that the agency would be required to maintain to protect BOI, including security plans. FinCEN explained in the preamble to the Access NPRM that these requirements are extensive by necessity given the broad search functionality within the BO IT system that would be available to this category of authorized recipients.

ii. Foreign Requesters

The second category consists of foreign law enforcement agencies, judges, prosecutors, central authorities, and competent authorities (“foreign requesters”), provided their requests come through an intermediary Federal agency, meet additional criteria, and are made either (1) under an international treaty, agreement, or convention; or (2) via a request made by law enforcement, judicial, or prosecutorial authorities in a trusted foreign country (when no international treaty, agreement, or convention is available).

See

31 U.S.C. 5336(c)(2)(B)(ii).

FinCEN generally did not propose to identify in the Access NPRM any specific Federal agencies that would serve as intermediaries with foreign governments.

FinCEN instead indicated that it would work with Federal agencies to identify those that are well positioned to be intermediaries, based on several factors, including: the level of engagement with foreign law enforcement agencies, judges, prosecutors, central authorities, or competent authorities; responsibility under international treaties, agreements, or conventions; and capacity to process requests for BOI while managing risks of unauthorized disclosure. The Access NPRM proposed to permit intermediary Federal agencies to use BOI obtained from FinCEN at the behest of a foreign requester only to facilitate a response to that foreign requester.

Given its longstanding relationships and relevant experience as the financial intelligence unit of the United States, FinCEN proposed to directly receive, evaluate, and respond to requests for BOI from foreign financial intelligence units.

With respect to the requirement that a foreign request be made under an “international treaty, agreement, or convention,” FinCEN explained that it understood those terms to cover a legally binding agreement governed by international law. FinCEN did not propose to identify specific countries it would treat as “trusted” in situations when no international treaty, agreement, or convention applied. The Access NPRM explained that to define “trusted foreign country” would have risked arbitrarily excluding foreign requesters with whom sharing BOI might be appropriate in some cases but not others. FinCEN instead proposed to conduct case-by-case assessments in consultation with relevant U.S. government agencies to determine whether to disclose BOI to a foreign requester in a particular instance.

In the Access NPRM, FinCEN explained that it did not expect foreign requesters to have direct access to the BO IT system, but rather that intermediary Federal agencies would perform BOI searches in the system on a foreign requester's behalf. Before acting as intermediaries, Federal agencies would first have to fulfill several requirements, including: (1) ensuring that they have secure systems for BOI storage; (2) entering into MOUs with FinCEN outlining expectations and responsibilities; (3) incorporating the CTA foreign sharing requirements into evaluation criteria with which to review BOI requests from foreign requesters; (4) integrating the evaluation criteria into their existing information-sharing policies and procedures; (5) developing additional security protocols and systems as required under the CTA and this rule; and (6) ensuring that their personnel have sufficient training on BOI security and use requirements and restrictions.

Under the Access NPRM, an intermediary Federal agency would be authorized to submit foreign requests for BOI to FinCEN only after meeting these requirements. Such requests would need to include certain information, including: (1) the names of both the individual within the intermediary Federal agency making the request and the individual affiliated with the foreign requester on whose behalf the request was being made; and (2) either the international treaty, agreement, or convention under which the request was being made, or a statement that no such instrument governs along with an explanation of the information's intended use. Intermediary Federal agencies would also need to certify that a request meets applicable eligibility criteria. After doing so, an intermediary Federal agency could then search for and retrieve requested BOI from the system and respond to the foreign requester in a manner consistent with either the international treaty, agreement, or convention, or the request from the trusted foreign country. Intermediary Federal agencies would be required to maintain records documenting specified elements of each search, both for the agency's own internal auditing and for FinCEN audits as required under the CTA.

Recognizing the importance that all authorized BOI recipients—including foreign requesters—take appropriate steps to keep BOI confidential and secure and to prevent misuse, FinCEN also proposed requiring foreign requesters to handle, disclose, and use BOI consistent with the requirements of the applicable international treaty, agreement, or convention under which it is requested. When no treaty, agreement, or convention applies, the Access NPRM proposed that the head of an intermediary Federal agency, acting on behalf of a foreign requester, or their designee, would need to submit to FinCEN a written explanation of the specific purpose for which the foreign requester is requesting BOI. The intermediary Federal agency in such cases would have also needed to provide FinCEN with a certification that the requested BOI would be: (1) used in furtherance of a law enforcement investigation or prosecution, or for a national security or intelligence activity that is authorized under the laws of the relevant foreign country; (2) only used for the particular purpose or activity for which it was requested; and (3) handled in accordance with specified security and confidentiality requirements. Under the proposed rule, the certification would reflect what the head of the intermediary Federal agency head or their designee understands to be the intended use for the BOI, rather than a guarantee from the intermediary Federal agency that the foreign requester would not use the information for unauthorized purposes. The Access NPRM further specified that FinCEN could request additional information from the requester to support FinCEN's evaluation of whether to disclose BOI to a foreign requester when the request is not pursuant to an international treaty, agreement, or convention.

iii. Financial Institutions With Customer Due Diligence Compliance Obligations Under Applicable Law

The third authorized recipient category under the CTA is financial institutions that use BOI “to facilitate compliance with customer due diligence requirements under applicable law.”

FinCEN proposed to define the term “customer due diligence requirements under applicable law” to mean FinCEN's customer due diligence regulations at 31 CFR 1010.230, which require covered financial institutions to identify and verify beneficial owners of legal entity customers. FinCEN considered other approaches, but concluded that focusing on its 2016 CDD Rule alone would make this access category easier to administer, reduce uncertainty about which financial institutions could access BOI under the proposed rule, and better protect the security and confidentiality of sensitive BOI by limiting the circumstances under which financial institutions could access the information. There also did not appear to be any State, local, or Tribal customer due diligence requirements comparable in substance to FinCEN's 2016 CDD Rule.

31 U.S.C. 5336(c)(2)(B)(iii).

In the Access NPRM, FinCEN specifically asked commenters to identify any Federal, State, local, or Tribal law requirements comparable to the 2016 CDD Rule regarding financial institutions identifying and verifying beneficial owners of legal entity customers. FinCEN received no responses to that request.

The CTA further requires that a reporting company's consent is necessary in order for a financial institution to obtain BOI from FinCEN. FinCEN proposed to make financial institutions responsible for obtaining this consent. That proposal reflected FinCEN's assessment that financial institutions are best positioned to obtain and manage consent through existing

processes and by virtue of having direct relationship with reporting companies as customers. Although certain certifications would be required, the Access NPRM did not propose that financial institutions submit proof of a reporting company's consent. FinCEN recognized that it would not have the capacity to review, verify, and store consent forms, and additional FinCEN involvement would create undue delays for the ability of financial institutions to onboard customers. FinCEN also explained that a financial institution's compliance with these requirements would be assessed by Federal functional regulators in the ordinary course during examinations, or by financial SROs during their routine BSA examinations.

The CTA requirements financial institutions must satisfy to qualify for BOI disclosure from FinCEN are part of the BSA, a statute enacted in pertinent part in Chapter X of the Code of Federal Regulations. FinCEN has delegated its authority to examine financial institutions for compliance with Chapter X to the Federal functional regulators.

See

31 CFR 1010.810. Separately, the FBAs have their own authority to examine the financial institutions that they supervise for compliance with the BSA.

See

12 U.S.C. 1786(q)(2), 1818(s)(2).

FinCEN described in the Access NPRM its plan to establish for financial institutions a more circumscribed BO IT system interface than would be available to most Federal agencies and State, local, and Tribal law enforcement agencies. This would be based on the defined purposes for which financial institutions can use BOI under the CTA and the proposed requirement that they obtain reporting company consent before requesting the information from FinCEN. The interface would require financial institutions to submit identifying information specific to a particular reporting company (for example, the company name and tax identification number). In return, the financial institution would receive an electronic transcript with that reporting company's BOI at the time of the request. The transcript would not include any previously submitted BOI for the reporting company.

Although the CTA does not specifically address the safeguards that financial institutions must implement as a condition for requesting BOI, the CTA authorizes FinCEN to prescribe by regulation any other safeguards determined to be necessary or appropriate to protect the confidentiality of BOI.

In exercising this authority, FinCEN proposed a principles-based approach by requiring that financial institutions develop and implement administrative, technical, and physical safeguards reasonably designed to protect BOI as a precondition for receiving the information. The proposed regulations would establish that the security and information handling procedures necessary to comply with section 501 of the Gramm-Leach-Bliley Act (Gramm-Leach-Bliley)

and related regulations to protect nonpublic customer personal information, if applied to BOI under the control of the financial institution, would satisfy this requirement. Financial institutions not subject to regulations issued pursuant to section 501 of Gramm-Leach-Bliley would be held to these same substantive standards under the proposed rules.

31 U.S.C. 5336(c)(3)(K).

Public Law 106-102, 113 Stat. 1338, 1436-37 (1999).

Subject to certain conditions, the Access NPRM proposed to authorize financial institutions to share BOI that they obtained from FinCEN for use in fulfilling customer due diligence obligations with: (1) their Federal functional regulators, (2) qualifying SROs, or (3) any other appropriate regulatory agency. FinCEN proposed this authorization for the sake of efficiency and to more easily provide regulators with a complete picture of how financial institutions are obtaining and using BOI for customer due diligence compliance, thereby supporting the aims and purposes of the CTA, as well as helping them detect compliance failures.

iv. Regulatory Agencies

The fourth category of authorized recipient under the proposed regulations is Federal functional regulators and other appropriate regulatory agencies that (1) are authorized to assess, supervise, enforce, or otherwise determine financial institution compliance with customer due diligence requirements under applicable law; (2) use BOI solely to conduct an assessment, supervision, or authorized investigation or activity under 31 U.S.C. 5336(c)(2)(C)(i); and (3) enter into an agreement with FinCEN describing appropriate protocols for obtaining BOI.

The proposed regulations also incorporated the CTA's limitation on the scope of access by these agencies. The CTA states that BOI that FinCEN discloses to financial institutions should “

also

be available to [their qualifying regulators].”

The Access NPRM therefore proposed to allow only qualifying regulators to obtain from FinCEN BOI that financial institutions that they supervise for customer due diligence compliance had already obtained under the CTA and its implementing regulations. Obtaining BOI from FinCEN would require Federal functional regulators and other appropriate regulatory agencies to certify to FinCEN when requesting BOI that the agency (1) is authorized by law to assess, supervise, enforce, or otherwise determine the relevant financial institution's compliance with customer due diligence requirements under applicable law, and (2) would use the information solely for that activity.

31 U.S.C. 5336(c)(2)(C) (emphasis added).

FinCEN made clear in the Access NPRM that it did not believe this customer due diligence-specific authorization was the exclusive means through which one of these regulators could obtain BOI. The access provision for Federal agencies engaged in national security, intelligence, or law enforcement activities focuses on activity categories, not agency types. To the extent that a Federal functional regulator, like the Securities and Exchange Commission (SEC), engages in civil law enforcement activities, agency officers, employees, contractors, and agents responsible for those activities could obtain BOI under the access provision for Federal law enforcement activity. The same principle applies to other agencies with both supervisory responsibility and authority to engage in other covered activity, including, potentially, State, local, and Tribal law enforcement agencies.

In the Access NPRM, FinCEN clarified that it would adopt its existing regulatory definition of “Federal functional regulators” to minimize the risk of confusion.

FinCEN did not propose to define “other appropriate regulatory agencies,” because it assessed that the requirement that an agency be authorized by law to supervise financial institutions for customer due diligence compliance sufficiently circumscribed the category.

Under this definition, the six Federal functional regulators that supervise financial institutions with customer due diligence obligations are the Board of Governors of the Federal Reserve System (FRB), the Office of the Comptroller of the Currency (OCC), the Federal Deposit Insurance Corporation (FDIC), the National Credit Union Administration (NCUA), the SEC, and the Commodity Futures Trading Commission (CFTC).

See

31 CFR 1010.100(r).

In the Access NPRM, FinCEN considered whether SROs registered with or designated by a Federal functional regulator pursuant to Federal statute

(“qualifying SROs”) should qualify as “other appropriate regulatory agencies.” These organizations—like the Financial Industry Regulatory Authority (FINRA) or the National Futures Association (NFA)—are not traditionally

understood to be agencies of the U.S. government,

but they do exercise self-regulatory authority within the framework of Federal law, and work under the supervision of Federal functional regulators to assess, supervise, and enforce financial institution compliance with, among other things, customer due diligence requirements.

These qualifying SROs also are subject to extensive oversight by Federal agencies.

See, e.g.,

7 U.S.C. 21; 15 U.S.C. 78o-3.

See, e.g., In re William H. Murphy & Co.,

SEC Release No. 34-90759, 2020 WL 7496228, *17 (Dec. 21, 2020) (explaining that FINRA “is not a part of the government or otherwise a [S]tate actor” to which constitutional requirements apply).

See, e.g.,

FINRA Rule 3310(f); NFA Compliance Rule 2-9(c)(5).

See, e.g., Scottsdale Cap. Advisors Corp.

FINRA,

844 F.3d 414, 418 (4th Cir. 2016) (“Before any FINRA rule goes into effect, the SEC must approve the rule and specifically determine that it is consistent with the purposes of the Exchange Act. The SEC may also amend any existing rule to ensure it comports with the purposes and requirements of the Exchange Act.” (citations omitted);

Birkelbach

SEC,

751 F.3d 472, 475 (7th Cir. 2014) (“A [FINRA] member can appeal the disposition of a FINRA disciplinary proceeding to the SEC, which performs a

de novo

review of the record and issues a decision of its own.”).

FinCEN believed that qualifying SROs fulfill a critical role in overseeing participants in the financial services sector which justified their limited and derivative access to BOI: Without this level of access, qualifying SROs would not be able to effectively evaluate a financial institution's customer due diligence compliance. The CTA provides FinCEN broad discretion to specify the conditions under which authorized recipients of BOI may re-disclose that information to others. Consequently, the Access NPRM proposed to permit both financial institutions and Federal functional regulators to re-disclose to qualifying SROs any BOI they obtained from FinCEN for use in complying with customer due diligence requirements under applicable law. A qualifying SRO would (1) need to satisfy the same three conditions applicable to Federal functional regulators and other appropriate regulatory agencies, and (2) be permitted to use the information for the limited purpose of examining compliance with applicable customer due diligence obligations.

The Access NPRM further proposed that Federal functional regulators would also be permitted to disclose BOI to DOJ for purposes of making a referral to DOJ or for use in litigation related to the activity for which the requesting agency requested the information.

v. Department of the Treasury Access

The CTA includes separate, Treasury-specific provisions for accessing BOI, tying the access to a Treasury officer's or employee's official duties requiring BOI inspection or disclosure,

including for tax administration purposes.

Proposed 31 CFR 1010.955(b)(5) tracked these authorizations, and provided that Treasury officers and employees may receive BOI where their official duties require such access, or for tax administration, consistent with procedures and safeguards established by the Director of FinCEN. The proposed regulations also clarified the term “tax administration purposes” by adding a reference to the definition of “tax administration” in the Internal Revenue Code.

See

31 U.S.C. 5336(c)(5)(A).

See

31 U.S.C. 5336(c)(5)(B).

26 U.S.C. 6103(b)(4).

The Access NPRM explained that FinCEN envisioned Treasury components having broad search functionality comparable to that of Federal agencies engaged in national security, intelligence, or law enforcement activity. This would include using BOI for enforcement actions, intelligence and analytical purposes, sanctions-related investigations, and identifying property blocked pursuant to sanctions, as well as for activities unique to Treasury, such as for tax administration and administration of the BOI framework, including audits, enforcement, and oversight. As with other Federal agencies requesting BOI for their own use, Treasury would also be permitted to disclose BOI for purposes of making a referral to DOJ or for use in litigation related to the activity for which Treasury officers, employees, contractors, or agents requested the information.

The Access NPRM further explained that FinCEN expected to work with other Treasury components to establish internal policies and procedures governing Treasury access to BOI. FinCEN noted that it anticipated that the security and confidentiality protocols in those policies and procedures would include elements of the protocols described in proposed 31 CFR 1010.955(d)(1) as applicable to Treasury activities and organization. Furthermore, officers and employees identified as having duties potentially requiring access to BOI would receive training on, among other topics, determining when their duties require access to BOI, what they can do with the information, and how to handle and safeguard it. Their activities would also be subject to audit.

D. CTA Implementation Efforts

i. Beneficial Ownership IT System

The CTA directs the Secretary to maintain BOI “in a secure, nonpublic database, using information security methods and techniques that are appropriate to protect nonclassified information security systems at the highest security level . . . .”

FinCEN is implementing this requirement by developing a secure BO IT system to receive, store, and maintain BOI. Consistent with the CTA's requirement

and FinCEN's recognition that BOI is sensitive information warranting stringent security, the system will be cloud-based and will meet the highest Federal Information Security Management Act (FISMA)

level (FISMA High).

A FISMA High rating indicates that losing the confidentiality, integrity, or availability of information within a system would have a severe or catastrophic adverse effect on the organization maintaining the system, including on organizational assets or individuals.

The rating carries with it a requirement to implement certain baseline controls to protect the relevant information.

System functionality will vary by recipient category consistent with statutory requirements, limitations on BOI disclosure, and FinCEN's objective of minimizing access to the data as much as practicable to minimize the risk of unauthorized disclosure. The target date for the system to begin accepting BOI reports is January 1, 2024, the same day on which the Reporting Rule takes effect.

CTA, section 6402(7).

31 U.S.C. 5336(c)(8).

44 U.S.C. 3541

et seq.

See

U.S. Department of Commerce,

Federal Information Processing Standards Publication: Standards for Security Categorization of Federal Information and Information Systems

(“FIPS Pub 199”) (Feb. 2004), available at

https://nvlpubs.nist.gov/nistpubs/fips/nist.fips.199.pdf

Id.

at 3.

Id.

ii. Additional CTA Implementation Efforts

In addition to continuing development of the BO IT system, FinCEN is working across several other CTA implementation efforts. First, it is working intensively to develop guidance and other educational materials to ensure that small businesses have the information they need to comply and that reporting beneficial ownership information is as streamlined and straightforward as possible. On March 24, 2023, for example, FinCEN published its first set

of guidance materials to aid the public, and in particular the small business community, in understanding the BOI reporting requirements taking effect on January 1, 2024.

That guidance, available on FinCEN's website, includes Frequently Asked Questions (FAQs), guidance on BOI filing dates, and informational videos.

FinCEN published a Small Entity Compliance Guide on September 18, 2023, as well as additional guidance to address more complex topics around BOI reporting. FinCEN is also developing the infrastructure to respond to queries, conduct audit and oversight, and provide partner agencies and financial institutions with access to BOI.

FinCEN,

FinCEN Issues Initial Beneficial Ownership Information Reporting Guidance

(Mar. 24, 2023), available at

https://www.fincen.gov/news/news-releases/fincen-issues-initial-beneficial-ownership-information-reporting-guidance

FinCEN, Beneficial Ownership Information Reporting, available at

https://www.fincen.gov/boi

FinCEN is particularly focused on providing helpful customer service to reporting companies in the first year and beyond as they file their BOI. FinCEN currently fields approximately 13,000 inquiries a year through its Regulatory Support Section, and approximately 70,000 external technical inquiries a year through the IT Systems Helpdesk. FinCEN has estimated that there will be approximately 32 million reporting companies in Year 1 of the reporting requirement and approximately 5 million new reporting companies each year thereafter.

Given the expected increase in incoming inquiries, FinCEN is working to stand up a dedicated beneficial ownership contact center to respond to inquiries about the beneficial ownership reporting requirements, and to provide assistance to users encountering technical issues with the BO IT system. FinCEN expects the contact center to begin operations prior to January 1, 2024.

87 FR 59498, 59549 (Sept. 30, 2022).

FinCEN is also working to establish internal policies and procedures governing Treasury officer and employee access to BOI, as well as to draft and negotiate MOUs for access to BOI and related materials. In keeping with protocols described in this final rule, Federal, State, local and Tribal agencies outside of Treasury will be required to enter into MOUs with FinCEN specifying the standards, procedures, and systems they will be required to maintain to protect BOI. Agency MOUs will, among other things, memorialize and implement requirements regarding reports and certifications, periodic training of individual recipients of BOI, personnel access restrictions, re-disclosure limitations, and access to audit and oversight mechanisms. MOUs will also include security plans covering topics related to personnel security (

e.g.,

eligibility limitations, screening standards, and certification and notification requirements); physical security (

i.e.,

system connections and use, conditions of access, and data maintenance); computer security (

i.e.,

use and access policies, standards related to passwords, transmission, storage, and encryption); and inspections and compliance. Agencies will be able to rely on existing databases and related IT infrastructure to satisfy the requirement to “establish and maintain” secure systems in which to store BOI where those systems have appropriate security and confidentiality protocols, and FinCEN will engage with recipient agencies on these protocols during the MOU development process.

iii. Administration of Access to BOI

For any given user agency, the administrative steps described in the preceding section will need to be completed

before

authorized users obtain access to the BO IT system. These steps will require resources to complete. Every Federal, State, local, and tribal user agency will need to enter into an MOU with FinCEN for access to the BO IT system and put in place the policies and procedures required under the final Access Rule and the MOU. FinCEN will also need to establish BO IT system individual user accounts for all personnel who are authorized to access the system at agencies and financial institutions.

To smoothly manage the draw on resources that this process will demand, FinCEN will take a phased approach to providing access to the BO IT system. The first stage will be a pilot program for a handful of key Federal agency users starting in 2024, as required MOUs and policies and procedures are completed. The second stage will extend access to Treasury Department offices and certain Federal agencies engaged in law enforcement and national security activities that already have Bank Secrecy Act MOUs (

e.g.,

FBI, IRS-CI, HSI, DEA, Federal banking agencies (FBAs)). Subsequent stages will extend access to additional Federal agencies engaged in law enforcement, national security, and intelligence activities, as well as key State, local, and Tribal law enforcement partners; to additional State, local, and Tribal law enforcement partners; in connection with foreign government requests; and finally, to financial institutions and their supervisors.

FinCEN believes that starting with a small pilot program of users in 2024 will help test the system and ensure that any issues can be addressed before expanding access to other users. Making access more broadly available in the four subsequent stages outlined above will help ensure the orderly onboarding of authorized users and will space out the timing of the annual audits of agency users that FinCEN is required to conduct under the CTA. Additionally, there is a good reason for FinCEN's sequencing of access, making financial institutions and their supervisors the last category of users that will receive access to the BO IT system: FinCEN expects that the timing of their access will roughly coincide with the upcoming revision of FinCEN's 2016 CDD Rule. This will allow financial institutions to enjoy certain administrative efficiencies by bundling system and compliance changes. FinCEN anticipates providing additional information on the timing and details regarding this phased implementation approach in early 2024.

E. Comments Received

In response to the NPRM, FinCEN received over 80 comments. Submissions came from a broad array of individuals and organizations, including members of Congress, the financial industry and related trade associations, groups representing small business interests, corporate transparency advocacy groups, law enforcement representatives, regulatory associations, legal associations, and other interested groups and individuals.

In general, many commenters expressed support for the proposed regulations. These commenters agreed that the proposed regulations were a significant step forward in improving the ability of law enforcement and national security agencies to identify illicit actors hiding behind anonymous shell and front companies. One of the commenters stated that the proposed regulations would confer benefits to both the United States and its overseas partners and bring the United States in line with emerging global practices relating to beneficial ownership information reporting. These commenters viewed the proposed regulations as being consistent with the statutory text. They supported the approach taken to provide access to BOI to authorized recipients and were encouraged by the proposed limitations and security provisions to protect the BOI and prevent unauthorized disclosure. These commenters were

particularly supportive of the proposed regulations with respect to U.S. Federal agencies' access to the BOI database. Supportive commenters agreed that U.S. Federal agencies accessing the database for law enforcement, intelligence, and national security purposes should have broad access, and that foreign requesters should be able to request BOI for similar purposes.

Other commenters expressed general opposition to the proposed regulations, arguing that the proposed regulations deviate from the CTA and congressional intent. These commenters argued that the proposed regulations, if finalized without significant changes, would impose unnecessary requirements, limitations, and burdens with respect to certain types of access. Commenters also argued that the proposed regulations would be too costly and burdensome for small businesses. In particular, commenters expressed concern over the access provisions relating to State, local, and Tribal law enforcement authorities and financial institutions. Some commenters stated that certain requirements for law enforcement access to BOI, such as the requirement to submit “a copy of a court order” and “written justification” in proposed 31 CFR 1010.955(d)(1)(ii)(B)(

), would create undue barriers for State, local and Tribal law enforcement and contradict the statutory text. Other commenters argued that the proposed restrictions on access by financial institutions and their regulators would significantly limit the utility of the database. These commenters argued that proposed regulations interpreted “customer due diligence requirements under applicable law” in 31 U.S.C. 5336(c)(2)(B)(iii) too narrowly and objected to the requirement that individuals with access to BOI be located in the United States (31 CFR 1010.955(c)(2)(ii)). These commenters suggested that FinCEN adopt a broader approach to financial institutions' access to BOI and asked for clarification on a number of related provisions, including, for example, expectations around customer consent, database usage, and discrepancy reporting. One commenter suggested that FinCEN withdraw the proposed regulations and engage with the financial services industry and small businesses to develop a new proposal to better achieve the objectives of the CTA and the AML Act.

Many commenters, regardless of their overarching views, suggested specific modifications to the proposed regulations to enhance clarity, refine policy expectations, ensure technical accuracy, and improve implementation more broadly. Commenters sought clarification on specific definitions, use cases, technical requirements and processes, and database functionality, among other things. Several commenters advocated for providing certain additional categories of users access to BOI, while others shared views on the sensitivity of BOI. Several commenters emphasized their view that BOI needed to be verified and suggested ways to improve the quality of the database.

Commenters also shared views on future revisions to the 2016 CDD Rule, highlighting the ways in which they anticipated the proposed regulations with respect to access would interact with the 2016 CDD Rule. Among other things, these commenters expressed concerns about potential inconsistencies between BOI in the database and the customer information that financial institutions maintain pursuant to customer due diligence obligations. Many of these commenters urged FinCEN to address these concerns before 2016 CDD Rule revisions are finalized; some suggested that these concerns be addressed as part of the final Access Rule. Several commenters expressed frustration over the sequencing of the CTA rulemakings, stating, for example, that it is difficult to provide meaningful comments on the proposed regulations given uncertainties about revisions to the 2016 CDD Rule.

Commenters shared views on the proposed regulations on FinCEN identifiers for reporting companies. While some commenters were supportive of FinCEN's approach, others found the proposal complex and confusing. Whether or not generally supportive, commenters suggested specific modifications to the proposal and asked for clarification on the availability of the information underlying FinCEN identifiers. One commenter expressed generalized concern about the availability of FinCEN identifiers and their potential misuse.

FinCEN also received comments on topics not directly related to the proposed regulations. Some of these comments focused on elements of the Reporting Rule,

e.g.,

information to be reported, company applicants, enforcement mechanism, and the proposed BOI report form. Others identified typographical errors, offered specific recommendations with respect to MSBs and mutual funds, and urged FinCEN to take steps to prevent the creation of fraudulent FinCEN websites. One commenter suggested that FinCEN should be designated as part of the intelligence community, while another suggested that Congress should repeal the USA PATRIOT Act. Finally, one commenter highlighted that some individuals may feel discouraged from submitting comments on proposed regulations if their views do not align with those of their employer.

FinCEN carefully reviewed and considered each comment submitted. Many specific proposals will be discussed in more detail in section III below. FinCEN's analysis and approach has been guided by the statutory text, including the statutory obligations to disclose BOI to authorized users for specified purposes while following strict security and confidentiality protocols and minimizing burdens on stakeholders.

In implementing this final rule, FinCEN took into account the many comments and suggestions intended to clarify and refine the scope of the rule and to reduce burdens on authorized users to the greatest extent practicable. FinCEN further notes that implementation of the final rule will require additional engagement with stakeholders to ensure a clear understanding of the rule's requirements, including through additional guidance, FAQs, and help lines. FinCEN intends to work within Treasury and with interagency partners to inform these specific efforts and the broader implementation of this final rule.

III. Discussion of Final Rule

This final rule builds on the Access NPRM and is the next step after the Reporting Rule in FinCEN's implementation of the CTA. The final rule aims to ensure that: (1) only authorized recipients have access to BOI; (2) authorized recipients use that access only for purposes permitted by the CTA; and (3) authorized recipients only re-disclose BOI in ways that balance protecting its security and confidentiality with the CTA objective of making BOI available to users for a range of authorized purposes. The regulations also provide a robust framework to ensure that BOI reported to FinCEN, and received by authorized recipients, is subject to strict cybersecurity controls, confidentiality protections and restrictions, and robust audit and oversight measures.

FinCEN is adopting the proposed rule largely as proposed, but with certain modifications that are responsive to comments received and intended to reduce barriers to the effective use of BOI, while maintaining appropriate protections for the information. Among other things, the final rule broadens the purposes for which financial institutions may use BOI, and

streamlines the requirements for State, local, and Tribal law enforcement access to BOI. FinCEN believes that these changes will help to ensure that the database is highly useful to relevant stakeholders who are authorized to access BOI. FinCEN has made certain other clarifying and technical revisions throughout the rule. We discuss specific comments, modifications, revisions, and the shape of the final rule section by section here.

We discuss the elements of the final rule under seven headings: (A) availability of information—general; (B) prohibition on disclosure; (C) disclosure of information by FinCEN; (D) use of information; (E) security and confidentiality requirements; (F) administration of requests for information reported pursuant to 31 CFR 1010.380; and (G) violations. In addition, this section discusses general implementation efforts as they apply to the development of the IT system.

A. Availability of Information—General

Proposed Rule.

FinCEN proposed to amend 31 CFR 1010.950(a) to clarify that the disclosure of BOI would not be governed by § 1010.950(a) but instead by proposed 31 CFR 1010.955.

Comments Received.

FinCEN did not receive comments on this proposal.

Final Rule.

The final rule adopts the amendments to 31 CFR 1010.950(a) as proposed. The amendments clarify that the disclosure of BOI is governed by a new provision, 31 CFR 1010.955, rather than 31 CFR 1010.950(a). Section 1010.950(a) governs disclosure of other BSA information by Treasury and states that “[t]he Secretary may within his discretion disclose information reported under this chapter for any reason consistent with the purposes of the Bank Secrecy Act, including those set forth in paragraphs (b) through (d) of this section.” In contrast, the CTA authorizes FinCEN to disclose BOI only in limited and specified circumstances.

As these CTA provisions are separate and distinct from provisions authorizing disclosure of other BSA information, distinct regulatory treatment is warranted.

See

31 U.S.C. 5336(c)(2), (5).

See, e.g.,

31 U.S.C. 5319.

B. Prohibition on Disclosure

Proposed Rule.

Proposed 31 CFR 1010.955(a) would implement the broad prohibition in the CTA on the disclosure of information reported to FinCEN pursuant to 31 CFR 1010.380, except as authorized under the proposed rule. Specifically, the CTA provides that, except as authorized by 31 U.S.C. 5336(c) and the protocols promulgated thereunder, BOI reported to FinCEN by reporting companies is confidential and shall not be disclosed by (1) an officer or employee of the United States, (2) an officer or employee of any State, local, or Tribal agency, or (3) an officer or employee of any financial institution or regulatory agency receiving information under this subsection of the CTA.

The proposed rule adopted this broad prohibition on disclosure but extended it in two ways. First, it extended the prohibition to any of the officers or employees described in (1) through (3) above regardless of whether they continue to serve in the position through which they were authorized to receive BOI. Second, it extended the prohibition on disclosure to any individual who receives BOI as a contractor or agent of the United States; as a contractor or agent of a State, local, or Tribal agency; or as a member of the board of directors, contractor, or agent of a financial institution.

See

31 U.S.C. 5336(c)(2)(A).

Comments Received.

One commenter supported the proposed extension of the prohibition on disclosure of BOI to contractors or agents of the United States and State, local or Tribal law enforcement agencies, and to contractors, agents, and directors of financial institutions. The commenter noted that this extension furthers the purpose of the CTA and would close potential loopholes around prohibited disclosures of BOI. Several commenters requested greater clarity on the prohibition on disclosure or further extension of the prohibition to additional individuals. One commenter opposed extending the prohibition to agents, contractors, and, in the case of financial institutions, directors, arguing that the existing prohibition in the statute was already overly protective of BOI. One commenter did not believe that the proposed rule adequately clarifies that the prohibition on disclosure covers individuals who receive BOI even after they leave the position in which they were authorized to receive the BOI. This commenter suggested that the rule should include language that explicitly addresses this scenario. This commenter also asked that the prohibition on disclosure explicitly extend to an officer, employee, contactor, or agent of foreign law enforcement agencies, foreign law enforcement agencies, foreign judges, foreign prosecutors, or other foreign authorities. Another commenter suggested adding a provision to prohibit disclosure by attorneys or parties who may receive BOI in the context of a civil or criminal proceeding. Another commenter suggested extending access requirements (which would include the prohibition on disclosure of BOI) to any individual under contract or under the remit of an entity authorized to access BOI (non-employee agents), such as consultants, auditors, and third-party service providers.

Final Rule.

The final rule adopts 31 CFR 1010.955(a) as proposed. FinCEN believes that the proposed rule, including the extension of the disclosure prohibition to certain specified individuals, is necessary to fully carry out the CTA's intent to protect sensitive BOI and prevent unauthorized disclosure of this information. FinCEN proposed these extensions pursuant to 31 U.S.C. 5336(c)(3)(K), which provides that “the Secretary of the Treasury shall establish by regulation protocols described in [31 U.S.C. 5336(2)(A)] that . . . provide such other safeguards which the Secretary determines (and which the Secretary prescribes in regulations) to be necessary or appropriate to protect the confidentiality of the beneficial ownership information.” Further, after considering the comments to this provision, FinCEN has concluded that this provision is sufficiently clear, in terms of the prohibition on disclosure applying to those individuals who leave a position in which they were previously authorized to receive BOI. The proposed rule stated that, except as authorized, BOI is confidential and “shall not be disclosed by any individual who receives such information as” an officer, employee, contractor, agent, or director. This prohibition means that individuals who

receive

BOI when acting in these specified roles cannot disclose BOI (except as authorized in the rule) regardless of whether they continue in or leave these roles.

FinCEN has also determined not to add language extending the prohibition on disclosure to an officer, employee, contactor, or agent of foreign law enforcement agencies, foreign law enforcement agencies, foreign judges, foreign prosecutors, or other foreign authorities. FinCEN believes there are existing mechanisms in place under the CTA that would appropriately protect BOI in these circumstances. For example, in the context of foreign access to BOI through a request made under an international treaty, agreement, or convention, the handling and use of BOI would be governed by the disclosure and use provisions of the relevant international treaty, agreement, or

convention.

As for trusted foreign countries, the CTA explicitly limits the use of BOI “for any purpose other than the authorized investigation or national security or intelligence activity”

and proposed 31 CFR 1010.955(c)(2)(ix) (now renumbered as 31 CFR 1010.955(c)(2)(x)) provided that “any information disclosed by FinCEN under paragraph (b) of this section shall not be further disclosed to any other person for any purpose without the prior written consent of FinCEN, or as authorized by applicable protocols or guidance that FinCEN may issue.” In the event of improper disclosure of BOI by a trusted foreign country, FinCEN would consider all available remedies including FinCEN's authority to reject a request for BOI or suspend a requesting party's access to such information.

See

31 U.S.C. 5336(c)(2)(B)(ii)(I)(aa).

31 U.S.C. 5336(c)(2)(B)(ii)(II)(bb).

See

proposed 31 CFR 1010.955(e)(3).

FinCEN has also decided not to specifically extend the prohibition on disclosure to parties in a civil and criminal proceeding because it views this scenario as being covered by the regulations, specifically by the provision prohibiting redisclosure without the prior consent of FinCEN.

FinCEN will consider, however, whether to issue guidance or FAQs to further address issues relating to public disclosure of BOI in civil or criminal proceedings. With respect to the commenter suggesting that FinCEN add language to specify that individuals under contract or under the remit of an entity authorized to access BOI (including consultants, auditors, and third-party service providers) are covered by the prohibition on disclosure, FinCEN believes that proposed 31 CFR 1010.955(a) sufficiently covers these individuals as contractors or agents.

31 CFR 1010.955(c)(2)(ix).

C. Disclosure of Information by FinCEN

As discussed in the proposed rule, the CTA authorizes FinCEN to disclose BOI to five categories of recipients. The first category consists of recipients in Federal, State, local and Tribal government agencies.

Within this category, FinCEN may disclose BOI to Federal agencies engaged in national security, intelligence, or law enforcement activity if the requested BOI is for use in furtherance of such activity.

FinCEN may also disclose BOI to State, local, and Tribal law enforcement agencies if “a court of competent jurisdiction” has authorized the law enforcement agency to seek the information in a criminal or civil investigation.

31 U.S.C. 5336(c)(2)(B) and 31 U.S.C. 5336(c)(5).

31 U.S.C. 5336(c)(2)(B)(i)(I).

31 U.S.C. 5336(c)(2)(B)(i)(II).

The second category consists of foreign law enforcement agencies, judges, prosecutors, central authorities, and competent authorities (“foreign requesters”), provided their requests come through an intermediary Federal agency, meet certain additional criteria, and are made either (1) under an international treaty, agreement, or convention, or (2) via a request made by law enforcement, judicial, or prosecutorial authorities in a trusted foreign country (when no international treaty, agreement, or convention is available).

31 U.S.C. 5336(c)(2)(B)(ii).

The third authorized recipient category are financial institutions using BOI to facilitate compliance with customer due diligence requirements under applicable law, provided the financial institution requesting the BOI has the relevant reporting company's consent for such disclosure.

31 U.S.C. 5336(c)(2)(B)(iii).

The fourth category is Federal functional regulators and other appropriate regulatory agencies acting in a supervisory capacity assessing financial institutions for compliance with customer due diligence requirements.

These agencies may access the BOI information that financial institutions they supervise received from FinCEN.

31 U.S.C. 5336(c)(2)(B)(iv).

The fifth and final category of authorized BOI recipients is the Treasury itself, for which the CTA provides access to BOI tied to an officer or employee's official duties requiring BOI inspection or disclosure, including for tax administration.

31 U.S.C. 5336(c)(5).

i. Disclosure to Federal Agencies for Use in Furtherance of National Security, Intelligence, or Law Enforcement Activity

a. Definition of National Security Activity

Proposed Rule.

Proposed 31 CFR 1010.955(b)(1)(i) specified that national security activity includes activity pertaining to the national defense or foreign relations of the United States, as well as activity to protect against threats to the safety and security of the United States.

Comments Received.

Commenters generally provided broad support for the definition of national security activity in proposed 31 CFR 1010.955(b)(1)(i), stating that the activity-based approach is reasonable, clear, and adequately justified. Some commenters expressed the view that the definition should not be further delimited or narrowed, as this may impede the intent of the CTA. One recommended that FinCEN clarify that the proposed definition is not meant to limit Congress's language identifying specific national security threats in the CTA's Sense-of-Congress provision.

Another commenter suggested adding a reference in the preamble to the illicit finance strategy, as defined in the 2021 Memorandum on Establishing the Fight Against Corruption as a Core United States National Security Interest. One commenter urged FinCEN to include the words “threats to” before “national defense or foreign relations,” and two commenters suggested substituting the word “means” for “includes” to clarify that the definition is finite. In particular, one of those two commenters noted that replacing “includes” with “means” would be consistent with the statute cited in support of the proposed regulation, 8 U.S.C. 1189(d)(2), which provides that national security “means” the national defense, foreign relations, or economic interests of the United States.

See

CTA, section 6402(3).

Final Rule.

The final rule largely adopts the proposed rule, but substitutes “means” for “includes” in definition in the final rule. FinCEN agrees that changing “includes” to “means” will provide additional clarity while still retaining the approach described by the proposed rule that draws, in large part, from 8 U.S.C. 1189(d)(2). Section 1189(d)(2) defines “national security” for purposes of designating foreign terrorist organizations (FTOs) that threaten U.S. national security. As stated in the proposed rule, FinCEN believes this definition is appropriate for several reasons. First, the FTO statute covers a broad range of national security threats to the United States, including those with an economic dimension. That scope is consonant with the CTA's goal to combat national security threats that are financial in nature, such as money laundering, terrorist financing, counterfeiting, fraud, and foreign corruption.

Second, the FTO statute arises in a related context insofar as it involves efforts to hinder illicit actors' economic activities. FinCEN does not intend this definition to exclude any national security threats that Congress identified in the CTA. FinCEN also notes that it will determine whether an agency's activities are “national security activities” that qualify the agency for

access to BOI during the process to establish a MOU governing access between the agency and FinCEN. Some undertakings, such as vetting potential recipients of foreign assistance and procurement contract awards, might constitute “national security activities” depending on the particular facts and circumstances, and therefore may be evaluated as part of that process. FinCEN declines to incorporate into the final rule reference to specific strategies to counter corruption or other types of specific national security threats. Acts of foreign corruption are specifically mentioned in the CTA as acts that harm the national security interests of the United States, and as discussed above, are already contemplated by the final rule. Referencing specific strategy documents is therefore unnecessary and could cause confusion.

See

CTA, section 6402(3)-(6).

b. Definition of Intelligence Activity

Proposed Rule.

Proposed 31 CFR 1010.955(b)(1)(ii) defines intelligence activity to include “all activities conducted by elements of the United States Intelligence Community that are authorized pursuant to Executive Order 12333 (“E.O. 12333”), as amended, or any succeeding executive order.”

Comments Received.

A number of commenters supported the proposed rule's definition of “intelligence activity,” and noted the approach taken by FinCEN is reasonable. Some commenters expressed that the definition should not be further delimited or narrowed, as this may impede the intent of the CTA. Three commenters suggested that the use of the word “includes” was too broad, and it should be replaced with “means” to clarify that the definition is finite. One commenter argued that “includes” implies that the proposed rule might allow sharing BOI under the intelligence activity provisions of 31 U.S.C. 5336, outside of the authorization provided by E.O. 12333. This commenter also argued that the definition of “intelligence activity” in proposed 31 CFR 1010.955(b)(1)(ii) conflicts with proposed 31 CFR 1010.955(b)(3)(i), which refers to disclosures of BOI by FinCEN to an intermediary Federal agency for transmission to a foreign agency for assistance in intelligence activity authorized under the laws of a foreign country. The commenter suggested that FinCEN should revise § 1010.955(b)(1)(ii) to read “(ii) intelligence activity, when used in this section in reference to an activity of the United States, means all activities that elements of the United States intelligence community are authorized to conduct pursuant to E.O. 12333, as amended, or any successor [E]xecutive order.” A different commenter recommended that FinCEN make clear that E.O. 12333's limitation on the use of United States person information by the Intelligence Community would not constrain use of BOI, if the use was otherwise permitted by the CTA. One commenter, while concurring with the proposed rule as sensible and workable, suggested it should include a reference to the 2021 U.S. Strategy on Countering Corruption and its calls for increasing intelligence activity on corrupt actors and bolstering information sharing between the Intelligence Community and law enforcement.

Final Rule.

The final rule adopts the proposed rule with two clarifying edits. First, FinCEN adopts the recommendation to substitute “means” for “includes” within the definition, in order to clarify that “intelligence activity” covers only those activities conducted by elements of the United States Intelligence Community that are authorized pursuant to E.O. 12333, as amended, or any succeeding executive order. Second, FinCEN agrees that the definition of “intelligence activity” in proposed 31 CFR 1010.955(b)(1)(ii) was incompatible with the authorization for sharing of BOI with foreign requesters in proposed 31 CFR 1010.955(b)(3)(i), as it proposed to define intelligence activities throughout the rule exclusively by reference to U.S. legal authorities. The final rule corrects this mistake by inserting new 31 CFR 1010.955(b)(3)(iv), a definition of the term “intelligence activity authorized under the laws of a foreign country” that clearly relates such activity to foreign legal authorities that establish what constitute legally acceptable intelligence activities under the laws of another country, as E.O. 12333 does for U.S. law.

FinCEN has addressed an analogous drafting problem in proposed 31 CFR 1010.955(b)(1)(i) with reference to the term “national security activity” by defining the term “national security activity authorized under the laws of a foreign country” in new 31 CFR 1010.955(b)(3)(iii).

FinCEN does not believe that additional clarifications are necessary regarding the scope of access to BOI by Federal agencies engaged in intelligence activity, to the extent the activity relates to United States persons. E.O. 12333 sets out the scope of authorized activity and, among other things, provides that agencies shall, consistent with the provisions of the Order, prepare and provide intelligence in a manner that “allows the full and free exchange of information, consistent with applicable law and presidential guidance.” Internal procedures established pursuant to the Order further govern the handling of information relating to U.S. persons. Finally, FinCEN declines to incorporate into the final rule reference to specific strategies to counter corruption or other national security threats, while noting that acts of foreign corruption are specifically mentioned in the CTA as acts that harm the national security interests of the United States.

c. Definition of Law Enforcement Activity

Proposed Rule.

Proposed 31 CFR 1010.955(b)(1)(iii) defined “law enforcement activity” to include “investigative and enforcement activities relating to civil or criminal violations of law.” The proposed rule specified that such activity does not include routine supervision or examination of a financial institution by a Federal regulatory agency with authority described in 31 CFR 1010.955(b)(4)(ii)(A). The inclusion of both investigation and enforcement as “law enforcement activity” was based on FinCEN's view that it is consistent with the CTA to authorize Federal agencies to access BOI at all stages of the law enforcement process.

Comments Received.

Commenters generally agreed with the definition in 31 CFR 1010.955(b)(1)(iii), stating that the proposed rule is reasonable and workable. One commenter emphasized the need for law enforcement to have access to BOI during all stages of criminal or civil investigations. Two commenters suggested that the use of the word “includes” was too broad, and it should be replaced with “means” to clarify that the definition is finite. Some commenters expressed that the definition should not be further delimited or narrowed, as this may impede the intent of the CTA. One commenter concurred with the exclusion of routine supervision and examination by Federal regulator agencies, as these activities are covered by a separate section of the CTA, and the proposed rule also recognizes that Federal functional regulators engage in law enforcement activities that will enable them to request BOI. However, two commenters took an opposite view, arguing that the proposed rule should be modified either at 31 CFR 1010.955(b)(1) or 31 CFR 1010.955(b)(1)(iii) to explicitly include disclosure to Federal regulatory agencies for law enforcement purposes as a disclosure governed by 1010.955(b)(1). Another commenter supported the broad definition of law enforcement activity but sought an explicit extension of the definition to State, local, and Tribal authorities, as

well as the inclusion of specific exemplar criminal violations related to taxes, wages, theft, forgery, insurance fraud, and human trafficking.

Final Rule.

The final rule adopts the proposed rule with the exception of one clarifying edit. Specifically, FinCEN adopts the recommendation to substitute “means” for “includes” within the definition to further clarify the definition, while retaining the approach from the proposed rule. FinCEN also notes that it will determine whether an agency's activities are “law enforcement activities” qualifying it for access to BOI during the process to establish a MOU between the agency and FinCEN governing such access. FinCEN declines to incorporate into the final rule reference to specific criminal violations, as this is redundant considering the existing language regarding civil or criminal violations of law.

Regarding the role of Federal regulatory agencies, FinCEN does not believe that a change to the proposed language is warranted. As stated in the proposed rule, the access provision for Federal agencies engaged in national security, intelligence, or law enforcement activities focuses on activity categories, not agency types. To the extent a Federal functional regulator engages in civil law enforcement activities, those activities would be covered by the law enforcement access provision.

ii. Disclosure to State, local, and Tribal Law Enforcement Agencies for Use in Criminal or Civil Investigations

a. A Court of Competent Jurisdiction

Proposed Rule.

The CTA permits FinCEN to disclose BOI upon receipt of a request, through appropriate protocols, “from a State, local, or Tribal law enforcement agency, if a court of competent jurisdiction, including any officer of such a court, has authorized the law enforcement agency to seek the information in a criminal or civil investigation.”

Proposed 31 CFR 1010.955(b)(2) implements this provision and would allow FinCEN to disclose BOI to a State, local, or Tribal law enforcement agency that requests this information if a court of competent jurisdiction has authorized the agency's request for the BOI for use in a criminal or civil investigation. Proposed 31 CFR 1010.955(b)(2)(i) further provided that a court of competent jurisdiction is “any court” with jurisdiction over the criminal or civil investigation for which a State, local, or Tribal agency requests BOI.

31 U.S.C. 5336(c)(2)(B)(i)(II).

Comments Received.

Commenters were generally supportive of the definition of the phrase “court of competent jurisdiction” in proposed 31 CFR 1010.955(b)(2)(i). These commenters noted that the proposed definition is flexible enough to encompass a wide variety of courts and will facilitate the ability of State, local, or Tribal law enforcement agencies to seek court authorization for the purpose of requesting BOI from FinCEN. Several commenters requested that FinCEN explicitly include administrative courts and adjudicatory bodies such as boards and commissions. One commenter noted that state and local governments allow civil law enforcement proceedings to occur in hearings before adjudicators that are independent of law enforcement, such as administrative law judges. Some commenters also recommended that “court of competent jurisdiction” should explicitly account for jurisdiction over an investigation or a “case” because BOI may be relevant to both.

Final Rule.

The final rule adopts 31 CFR 1010.955(b)(2)(i) as proposed. FinCEN agrees with the commenters who thought the level of clarity provided by this provision is sufficient to encompass the various types of courts and adjudicatory bodies that exist in State, local, and Tribal jurisdictions, including those which some commenters suggested that FinCEN explicitly reference. The reference in this provision to “any court” that has jurisdiction over an investigation provides broad and, in FinCEN's view, sufficiently clear applicability. As such, FinCEN believes it is unnecessary to list specific types of adjudicatory bodies that would qualify as a court of competent jurisdiction. Further, in response to the comments that requested that FinCEN clarify that a court of competent jurisdiction includes an adjudicative body with jurisdiction over both investigations and “cases” (understood as ongoing civil or criminal court proceedings), FinCEN has followed the formulation in the CTA, which uses the term “criminal or civil investigation.”

However, FinCEN does not believe that this clause excludes State, local, or Tribal agencies from seeking a request for BOI as part of an ongoing “case,” whether that be a civil proceeding or a criminal prosecution following an initial investigation.

See

31 U.S.C. 5336(c)(2)(B)(i)(II).

b. State, Local, or Tribal Law Enforcement Agencies

Proposed Rule.

Proposed 31 CFR 1010.955(b)(2)(ii) defined a “State, local, or Tribal law enforcement agency” as “an agency of a State, local, or Tribal government that is authorized by law to engage in the investigation or enforcement of civil or criminal violations of law.” The proposed rule defined this term in a manner similar to the proposed definition of “law enforcement activity” for Federal agencies to ensure consistency regardless of whether law enforcement activity occurs at the Federal, State, local, or Tribal, level.

Comments Received.

Several commenters argued that FinCEN should clarify in the final rule that State, local, and Tribal law enforcement agencies include various types of administrative and regulatory bodies covering a range of subject areas such as labor and employment, contracting, tax, unemployment insurance, and workers' compensation, among others. One commenter recommended that FinCEN amend 31 CFR 1010.955(b)(2)(ii) to state that a State, local or Tribal law enforcement agency is one that is authorized by law to investigate or enforce civil, criminal, “or administrative” violations of law. Some commenters noted that many State, local, and Tribal regulatory agencies also have law enforcement functions insofar as they have the authority to both issue regulations and enforce compliance with regulations. One of these commenters believed that proposed 31 CFR 1010.955(b)(2)(ii) already covers these regulatory agencies. Finally, one commenter suggested that FinCEN clarify that local enforcement agencies include non-Federal agencies within the government of the District of Columbia.

Final Rule.

FinCEN is adopting 31 CFR 1010.955(b)(2)(ii) as proposed. FinCEN believes that this provision is adequately clear and sufficiently flexible to encompass the many varieties of State, local, and Tribal law enforcement agencies that engage in the investigation or enforcement of civil or criminal violations of law, including regulatory violations. As a result, it is not necessary, in FinCEN's view, to specifically list examples of State, local, and Tribal law enforcement agencies, as some commenters requested. Furthermore, in response to the commenter's request that the final rule explicitly include non-Federal agencies within the District of Columbia, FinCEN believes this is unnecessary because the

definition of “State” in the CTA includes the District of Columbia.

31 U.S.C. 5336(a)(12);

see also supra

note 5.

c. Court Authorization and Written Certification

Proposed Rule.

The CTA provides that FinCEN may disclose BOI to a State, local, or Tribal law enforcement agency “if a court of competent jurisdiction, including any officer of such a court, has authorized the law enforcement agency to seek the information in a criminal or civil investigation.”

Proposed 31 CFR 1010.955(b)(2) would implement this provision of the CTA by allowing FinCEN to disclose BOI to a State, local, or Tribal law enforcement agency that requests this information if a court of competent jurisdiction authorizes the agency's request for the BOI for use in a criminal or civil investigation. FinCEN did not propose to identify every kind of court authorization that would satisfy the CTA, and it did not propose to specify which officers of a court may provide authorization. That is because FinCEN recognized that State, local, and Tribal practices are likely to be varied with respect to how law enforcement agencies may be authorized by a court to seek information in connection with an investigation or prosecution.

See

31 U.S.C. 5336(c)(2)(B)(i)(II).

In addition, the proposed rule included safeguards designed to protect the confidentiality of BOI and ensure it is not misused. These requirements were also meant to ensure that FinCEN could properly audit requests for BOI from State, local, and Tribal law enforcement agencies, consistent with the CTA's audit requirements.

As a result, proposed 31 CFR 1010.955(d)(1)(ii)(B)(

) required that when a State, local, or Tribal law enforcement agency requests BOI from FinCEN, the head of such an agency or their designee would have to submit to FinCEN, “in the form and manner as FinCEN shall prescribe:” (i) a copy of a court order from a court of competent jurisdiction authorizing the agency to seek the BOI in a criminal or civil investigation, and (ii) a written justification explaining why the request for BOI is relevant to the civil or criminal investigation. The proposed rule further explained that after FinCEN reviewed the relevant authorization for sufficiency and approved the request, an agency could then conduct searches using multiple search fields consistent in scope with the court authorization and subject to audit by FinCEN.

Thus, the court order and written justification requirements in the proposed rule were meant to serve multiple purposes—

i.e.,

to ensure that a court of competent jurisdiction has authorized an agency's request for the BOI, protect the security of confidential BOI, and enable FinCEN to conduct required audits of searches by State, local, or Tribal law enforcement agencies.

See

31 U.S.C. 5336(c)(3)(J).

87 FR at 77409-10.

These requirements were proposed alongside other security and confidentiality requirements applicable to all domestic government requesters of BOI. For example, the proposed rule explained that Federal agency users of FinCEN's BOI database would be required to submit brief justifications to FinCEN for their searches, explaining how their searches further a particular qualifying activity, and these justifications would be subject to oversight and audit by FinCEN. Additionally, the proposed rule required a Federal, State, local, or Tribal agency requesting BOI to minimize to the greatest practicable extent the scope of BOI it seeks, consistent with the agency's purpose in requesting BOI.

Comments Received.

Commenters generally opposed the requirements in proposed 31 CFR 1010.955(d)(1)(ii)(B)(

)(

) that the head of a State, local, or Tribal law enforcement agency, or their designee, must obtain and submit a copy of a court order to FinCEN authorizing the agency to seek BOI in a criminal or civil investigation. Commenters opposed the court order requirements for two broad reasons: they argued that, first, these requirements conflict with the plain language of the CTA as well as with congressional intent; and second, these requirements would create burdens on State, local, and Tribal agencies that would impede their ability to access BOI in a timely manner, which would be contrary to the goals of the CTA. In general, commenters encouraged FinCEN to take a more flexible approach in specifying the manner in which a court authorizes a request for BOI, which court personnel can provide that authorization, and at what stage in an investigation or proceeding agencies may seek the BOI from FinCEN. In sum, these commenters argued that the final rule should adopt the broader concept of court authorization from the CTA.

Commenters also generally opposed for largely the same reasons the requirement in proposed 31 CFR 1010.955(d)(1)(ii)(B)(

)(

) that the agency head must also submit a written justification to FinCEN explaining the relevance of the BOI for the investigation. Specifically, some commenters noted that the CTA does not contain such a requirement, expressed concerns that this requirement would unduly delay requests by agencies for BOI, and highlighted the challenges involved in FinCEN reviewing each justification provided by an agency that requests BOI.

In the first category of objections to the court order requirement, several commenters argued that the proposed rule conflicts with the plain language of the CTA which does not require a court order for State, local, or Tribal law enforcement agencies seeking access to BOI. Instead, these commenters pointed out that the CTA uses the general concept of court authorization, which could also include other kinds of authorization. Commenters also cited the legislative history of the CTA in arguing that Congress intended to create a less formal and more flexible process. These commenters noted that Congress had considered and rejected a narrower concept than court authorization when debating the CTA's provision concerning State, local, and Tribal law enforcement agency access to BOI.

In the second category of objections to the proposed court order requirement, commenters argued that a court order requirement would place unnecessary burdens on State, local, and Tribal law enforcement agencies as well as the courts involved because of the need to take additional efforts to obtain a court order. These burdens would be exacerbated because these agencies often face greater resource constraints compared to their Federal counterparts. The result would be delays in investigations. One commenter noted that the requirement could give some courts the impression that formal pleadings, evidence-based standards, or a hearing is necessary to authorize a request for BOI.

Furthermore, commenters argued that a court order requirement would effectively restrict agencies to working only with a narrow category of court officers, most likely a judge, rather than “any officer of such court” as the CTA permits. These commenters also argued that, as a result, the court order requirement conflicts with the CTA. One commenter recommended that the final rule should clearly state that a court officer includes any individual who exercises court authority, including a judge, magistrate, clerk, bailiff, sheriff, prosecutor, clerk assistant, or other personnel that the court designates to authorize a request for BOI. A few commenters argued that since an attorney is commonly considered a “court officer,” and many jurisdictions allow attorneys to issue subpoenas,

attorneys should be able to authorize a request for BOI. However, one commenter disagreed with this view, arguing that only court personnel should be allowed to authorize an agency's request for BOI. In addition, one commenter requested that FinCEN provide guidance to court officials who are involved in authorizing an agency's request for BOI, setting forth the proper procedures for reviewing these requests as well as potentially providing an authorization form for agencies and courts to use. Commenters also recommended that FinCEN provide flexibility in how the court order was reported to FinCEN.

Several commenters also highlighted the need for flexibility regarding when in the course of a civil or criminal investigation courts may authorize a State, local, or Tribal law enforcement agency to seek BOI. For example, some commenters requested that FinCEN clarify in the final rule that a grand jury subpoena qualifies as court authorization under the CTA. Some commenters also argued that the final rule should provide more clarity regarding how prosecutors can draft grand jury subpoenas to ensure that they would satisfy the court authorization requirement. Commenters also requested that the final rule clarify that courts should be permitted to authorize BOI requests throughout the full life cycle of an investigation, including after the initiation of a civil or criminal proceeding.

As for the written justification requirement in the proposed rule, commenters argued that it could limit the ability of State, local, and Tribal law enforcement agencies to access BOI, and commenters noted that there is no such requirement in the text of the CTA. Several commenters argued that the written justification requirement would create a double review process in which these agencies would first have to obtain approval from a court for their request for BOI, and then they would need to gain a second level of approval from FinCEN. According to these commenters, FinCEN would compare the written justification to the court order, and based on its review, could reject the court's decision to authorize an agency's request for BOI. Some commenters argued that such case-by-case review of justifications by FinCEN would overwhelm FinCEN's resources and cause significant delays in the ability of State, local, and Tribal law enforcement agencies to access BOI.

The result, according to several commenters, is that the written justification requirement would undermine the CTA's policy goal that the database be “highly useful” to law enforcement.

Commenters made several other arguments against the written justification requirement. For example, another commenter argued that it would be inappropriate for FinCEN to require “justification” from State, local, or Tribal law enforcement agencies because the CTA only required “certifications” from Federal agency heads; that FinCEN does not have the required subject matter expertise to evaluate justifications; and that the term “justification” implied a level of persuasiveness that would be required in the written statements that State, local, or Tribal law enforcement agencies provide when they request BOI.

See

CTA, section 6402(8)(C).

Finally, some commenters focused on alternative approaches to State, local, and Tribal law enforcement access to BOI. One commenter argued that the final rule should require that State, local, and Tribal law enforcement agencies obtain a grand jury subpoena in order to request BOI, and this commenter also supported the written justification requirement. One commenter raised concerns about whether courts could adequately protect the privacy of BOI and argued that a separate government agency should be responsible for managing BOI access requests on behalf of State, local, and Tribal agencies. Further, one commenter noted that the CTA itself had imposed stricter requirements on State, local, and Tribal agencies than it imposed upon their Federal counterparts since the CTA imposed a court authorization requirement on the former agencies. This commenter believed that statutory changes would be necessary to remove the court authorization requirement in order to make it simpler for State, local, and Tribal agencies to access the BOI database.

Final Rule.

The final rule adopts the requirements for State, local, and Tribal law enforcement agencies' access to BOI in proposed 31 CFR 1010.955(b)(2) without change. However, FinCEN was persuaded by comments that were critical of the requirements in proposed 31 CFR 1010.955(d)(1)(ii)(B)(

) that State, local, and Tribal law enforcement agencies submit a copy of a court order and written justification for FinCEN review prior to searching for BOI. Accordingly, FinCEN has made several changes to that provision in the final rule. These revisions are intended to streamline State, local, and Tribal law enforcement agency access to BOI and reduce burdens on these agencies and courts as well as on FinCEN, while at the same time maintaining robust confidentiality and security requirements for these agencies and FinCEN oversight and audit of these requests.

First, § 1010.955(d)(1)(ii)(B)(

)(

) will no longer require that these agencies obtain a specific form of court authorization, such as a court order. Instead, the final rule requires only that State, local, and Tribal law enforcement agencies obtain “court authorization” to seek BOI from FinCEN as part of a civil or criminal investigation. As the preamble to the proposed rule noted, FinCEN requested comment on the various types of relevant court authorization that exist at the State, local, and Tribal level, and requested that commenters explain what role courts or court officers play in authorizing evidence-gathering activities, what existing practices involve court authorization, and the extent to which new court processes could be developed and integrated into existing practices to satisfy the CTA's authorization requirement. FinCEN also requested comment on the need for access to BOI at different stages of an investigation, as well as the privacy interests that may be implicated by such access. In requesting comment on these topics, FinCEN sought greater clarity on the various mechanisms in which courts might satisfy the CTA standard of “court authorization.” The comments that FinCEN received provided greater clarity on how State, local, and Tribal law enforcement agencies could satisfy the CTA's court authorization requirement while also meeting FinCEN's obligations under the CTA to protect the confidentiality of BOI and prevent potential misuse, including by being able to audit requests by agencies for BOI.

FinCEN agrees that requiring State, local, and Tribal law enforcement agencies to obtain a court order may create unnecessary burdens. FinCEN further agrees that the statutory language concerning court authorization would maintain sufficient flexibility and facilitate access to BOI by State, local, and Tribal law enforcement agencies while still protecting against unauthorized use or disclosure. FinCEN intends the final rule to provide enough flexibility so that a variety of court officers—such as a judge, clerk of the court, or magistrate—could provide authorization at appropriate stages of the investigation process. FinCEN may issue guidance or FAQs on this subject in the future if needed, including, for example, on how the court authorization requirement would apply to grand jury proceedings. Such guidance may also further address questions about court personnel, stages of the investigation, court procedures

for reviewing requests for BOI, and other topics concerning court authorization in the context of specific factual circumstances.

However, FinCEN agrees with those commenters who argued that being an attorney, by itself, is not sufficient to empower an individual to grant the required court authorization under the CTA. As discussed in the proposed rule, FinCEN does not believe the CTA, which includes numerous provisions limiting who may access BOI, permits any individual with a license to practice law to authorize the disclosure of BOI, even if they are sometimes referred to as “officers of the court” in other contexts. FinCEN further does not agree with the commenter that suggested that a separate government agency, apart from a court of competent jurisdiction, should handle BOI requests from State, local, or Tribal law enforcement agencies. The CTA is clear that these agencies must seek court authorization in order to request BOI from FinCEN, and FinCEN believes that the security and confidentiality requirements reflected in the final rule will be sufficient to protect against unauthorized use or disclosure.

Second, rather than

submit

a copy of the authorization (such as a copy of a court order) to FinCEN, § 1010.955(d)(1)(ii)(B)(

) now only requires that State, local, and Tribal law enforcement agencies (1)

certify

that they have received authorization to seek BOI from a court of competent jurisdiction and that the BOI is relevant to a civil or criminal investigation, and (2) provide a description of the information the court has authorized the agency to seek.

FinCEN is persuaded by comments stating that the requirement in the proposed rule would have set more stringent requirements for State, local, and Tribal law enforcement agencies than would apply to their Federal counterparts. FinCEN is further persuaded by comments that FinCEN should instead allow these agencies to certify that they have obtained appropriate authorization from a court of competent jurisdiction.

FinCEN will specify the precise method of certification at a later date.

FinCEN does not intend to look behind these certifications to assess the sufficiency of a court's authorization at the time a request is submitted. Instead, the final rule clearly reflects FinCEN's role in auditing requesting agencies' BOI requests, which requires a process to ensure that a request for BOI by a State, local, or Tribal law enforcement agency remains within the terms of the court authorization. FinCEN believes that the certification requirement, along with the requirement to provide a description of the information the court has authorized the agency to seek, will provide FinCEN with a sufficiently robust means to effectively conduct oversight and audit of such access.

Third, in response to commenters' concerns, the final rule eliminates the written justification requirement in proposed 31 CFR 1010.955(d)(1)(ii)(B)(

)(

). Moreover, after considering commenters' concerns about potential delays associated with a case-by-case review of written justifications from these agencies in connection with BOI requests, and taking into account available resources, FinCEN has determined that, as a policy matter, it will not conduct individual reviews of each request for BOI by State, local, or Tribal law enforcement agencies when they are submitted. Rather, consistent with requirements of the CTA, FinCEN will conduct robust audit and oversight of State, local, and Tribal law enforcement agency searches for BOI to ensure that BOI is requested for authorized purposes by authorized recipients. Finally, by adopting the broad notion of court authorization that the CTA uses, FinCEN is also choosing not to further specify in the rule the particular stages of an investigation during which courts could authorize a request for BOI by State, local, or Tribal agencies.

iii. Disclosure for Use in Furtherance of Foreign National Security, Intelligence, or Law Enforcement Activity

a. General

Proposed Rule.

Proposed 31 CFR 1010.955(b)(3) authorized FinCEN to disclose BOI to foreign requesters when certain criteria were satisfied. The criteria were that the foreign request for BOI must (1) come to FinCEN through an intermediary Federal agency; (2) be for assistance in a law enforcement investigation or prosecution, or for a national security or intelligence activity, authorized under the laws of the foreign country; and (3) either be made under an international treaty, agreement, or convention, or, when no such instrument was available, be an official request by a law enforcement, judicial, or prosecutorial authority of a trusted foreign country.

Comments Received.

A few commenters supported both foreign requester access to BOI and the threshold requirements for that access. Another commenter stated that the proposed rule should specify timelines for processing and responding to foreign requests. One commenter stated that BOI should not be shared with foreign requesters at all.

Final Rule.

FinCEN adopts the proposed rule without changes. The final rule is consistent with the letter, spirit, and purposes of the CTA by permitting foreign requesters to obtain BOI for, and use it in, the full range of activities contemplated by 31 U.S.C. 5336(c)(2)(B)(ii) (

i.e.,

law enforcement, national security, and intelligence activities). The rule also resolves ambiguities arising from inconsistent statutory language. Specifically, one part of the CTA's foreign access provision appears to require a request to arise from a foreign “investigation or prosecution,”

while another appears to allow a foreign requester to use BOI to further any “authorized investigation or national security or intelligence activity.”

The final rule resolves this discrepancy by clarifying that authorized national security and intelligence activities, as well as law enforcement investigations or prosecutions, could be a basis for a BOI request.

31 U.S.C. 5336(c)(2)(B)(ii)(I).

31 U.S.C. 5336(c)(2)(B)(ii)(II)(bb).

FinCEN declines to specify timelines for processing and responding to foreign requests. At this juncture, FinCEN does not have sufficient data to support a prediction about the average amount of time it will take to issue a response to a foreign request. Average response times for requests from foreign countries when no international treaty, agreement, or convention applies are particularly hard to predict. These may often require highly fact-intensive assessments of both the requester and the request, require broad analysis of U.S. interests and priorities, and involve consultation with other relevant U.S. government agencies. Such assessments could take a matter of days or significantly longer. While sharing under international treaties, conventions, or agreements might follow more predictable timelines, unforeseeable procedural, legal, or inter-governmental impediments hurdles could create delays. FinCEN commits to processing requests as quickly as practicable with available resources rather than establish deadlines based on limited data.

b. Intermediary Federal Agency

Proposed Rule.

Proposed 31 CFR 1010.955(b)(3) authorized FinCEN to disclose BOI to foreign requesters when certain criteria were satisfied. One criterion identified by the CTA and the proposed regulation was that requests for BOI must come to FinCEN through an intermediary Federal agency.

The CTA did not identify particular intermediary Federal agencies, and FinCEN did not propose to identify any by regulation. FinCEN instead stated its intention to work with Federal agencies to identify agencies suited to serving as intermediaries between FinCEN and foreign requesters. For example, one indicator of potential suitability identified by FinCEN in the Access NPRM was a Federal agency having regular engagement and familiarity with foreign law enforcement agencies, judges, prosecutors, central authorities, or competent authorities on matters related to law enforcement, national security, or intelligence activity. Other factors would include whether a prospective intermediary Federal agency has established policies, procedures, and communication channels for sharing information with those foreign parties, and whether the prospective intermediary Federal agency represents the U.S. government in relevant international treaties, agreements, or conventions; other factors include the expected number of requests that the agency could receive, and the ability of the agency to efficiently process requests while managing risks of unauthorized disclosure.

In the Access NPRM, FinCEN stated that it would work with potential intermediary Federal agencies to: (1) ensure that they have secure systems for BOI storage; (2) enter into MOUs outlining expectations and responsibilities; (3) translate the CTA foreign sharing requirements into evaluation criteria against which intermediary Federal agencies could review requests from foreign requesters; (4) integrate the evaluation criteria into the intermediary Federal agencies' existing information-sharing policies and procedures; (5) develop additional security protocols and systems as required under the CTA and its implementing regulations; and (6) ensure that intermediary Federal agency personnel have sufficient training on applicable requirements under the CTA and its implementing regulations. Under the proposal, FinCEN would exercise oversight and audit functions to ensure that intermediary Federal agencies adhere to requirements and take appropriate measures to mitigate the risk of foreign requesters abusing the information.

Given its longstanding relationships and relevant experience as the financial intelligence unit (FIU) of the United States, FinCEN proposed to directly receive, evaluate, and respond to requests for BOI from foreign FIUs.

Comments Received.

One commenter expressed surprise that the proposed rule did not include examples of intermediary Federal agencies, while another commenter supported the potential for any Federal agency to become an intermediary Federal agency. There were varying perspectives on the proposal that FinCEN should act as an intermediary Federal agency for BOI requests from foreign FIUs. One commenter stated that foreign requesters might funnel all requests for BOI through their FIUs if FinCEN served as an intermediary Federal agency for foreign FIU requests, which would significantly increase FinCEN's workload. That commenter also said that exchanges through FIUs were not admissible in court. In contrast, one commenter indicated that FinCEN's role should be broadened to include receiving, reviewing, and evaluating all foreign requests, not just those from foreign FIUs. Another commenter asked FinCEN to clarify that, when reviewing and responding to requests for BOI from foreign FIUs, FinCEN would adhere to the proposed requirements applicable to other intermediary Federal agencies.

Final Rule.

FinCEN adopts the proposed rule without any changes. FinCEN is still in the early stages of working to identify intermediary Federal agencies, and therefore is not in a position to list those agencies in a regulation. FinCEN can anticipate several Federal agencies that likely could serve as intermediary Federal agencies given that (1) the rule contemplates FinCEN taking indirect requests for BOI from foreign requesters; (2) requests will be for assistance in law enforcement investigations or prosecutions, or for a national security or intelligence activity, authorized under the laws of the relevant foreign country; and (3) many requests for BOI will come under international treaties, agreements, and conventions. Federal agencies that are likely to meet these criteria include the U.S. Departments of State and Justice, the Federal Bureau of Investigation, U.S. Customs and Border Protection, the IRS, and member agencies of the Intelligence Community. This list only provides examples of Federal agencies whose activities seem to align with the functions of an intermediary Federal agency and is not intended to create expectations regarding possible intermediary Federal agencies.

FinCEN itself will very likely act as the intermediary Federal agency for requests for BOI from foreign FIUs. As the FIU for the United States, FinCEN already has policies and procedures for, and extensive experience in, sharing information related to national security, intelligence, and law enforcement activities with foreign FIUs through the Egmont Group. Accordingly, FinCEN could leverage existing processes and relationships to fulfill the requirements of the CTA and its implementing regulations.

FinCEN does not expect that foreign requesters will funnel all requests for BOI through their FIUs and overwhelm FinCEN. The rule permits foreign FIUs to request BOI in two scenarios. The first scenario is when two conditions apply: (1) the request is for assistance in a law enforcement investigation or prosecution, or for a national security or intelligence activity, authorized under the laws of the foreign country, and (2) a governing international treaty, agreement, or convention identifies the foreign FIU as the central or competent authority in the matter or otherwise dictates that the foreign FIU should request BOI from FinCEN. The second scenario in which a foreign FIU may request BOI is when there is no international treaty, agreement, or convention available. In this scenario, the foreign FIU may request BOI from FinCEN when (1) the request is for assistance in a law enforcement investigation or prosecution, or for a national security or intelligence activity, authorized under the laws of the foreign country, and (2) the FIU qualifies as a law enforcement (

i.e.,

authorized by law to engage in the investigation or enforcement of civil or criminal violations of law), judicial, or prosecutorial authority of a trusted foreign country. Both scenarios involve multiple requirements that a foreign FIU must satisfy to request BOI from FinCEN and are unlikely to result in a large number of potential requests from foreign FIUs.

On the question of BOI admissibility, FinCEN does not agree with the claim by one commenter that information exchanges through FIUs necessarily render the disclosed information inadmissible in courts around the world with enough frequency to warrant concern. Furthermore, if information exchanges between FIUs do render information inadmissible in some foreign courts, the CTA and this final rule provide means other than FIU exchanges by which foreign requesters may obtain BOI, namely through foreign judges, prosecutors, law enforcement agencies, and other central and competent authorities.

100

FinCEN is confident that foreign requesters that require admissible BOI, that are

authorized to receive BOI under the terms set forth in the CTA and this final rule, and that satisfy all applicable criteria for BOI disclosure will be able to obtain the information they need in an admissible form through an intermediary Federal agency.

100

See

31 U.S.C. 5336(c)(2)(B)(ii); 31 CFR 1010.955(b)(3).

Nonetheless, FinCEN believes it should act as an intermediary Federal agency for BOI requests from foreign FIUs. Receiving, reviewing, and responding to requests for BOI from all foreign requesters would not be feasible, given FinCEN's resource limitations.

c. Foreign Central or Competent Authority

Proposed Rule.

Proposed 31 CFR 1010.955(b)(3) authorized FinCEN to disclose BOI to foreign requesters when certain criteria were satisfied. The CTA did not define central or competent authorities, and so FinCEN proposed to make clear that “[a] relevant `foreign central authority or foreign competent authority' would be the agency identified

an international treaty, agreement, or convention under which a foreign request is made” (emphasis added.) This decision was based on FinCEN's understanding that “foreign central authority” and “foreign competent authority” are terms of art typically defined within the context of a particular agreement. FinCEN's goal was to remove any ambiguity around the terms without unduly excluding appropriate foreign requesters from access to BOI.

Comments Received.

One commenter pointed to the FATF and the Egmont Group as potential means of identifying foreign central and competent authorities. Specifically, the commenter stated that, because the United States is a member of both organizations, either body's method of designating foreign central or competent authorities (with appropriate safeguards) should allow an agency designated through that method to qualify as a foreign central or competent authority for the purposes of the CTA.

Another commenter stated that requiring foreign central and competent authorities to be identified as such in a governing international treaty, agreement, or convention was overly restrictive. The commenter's concern stems from the word “in.” To support its position, the commenter points to the Hague Convention for Service Abroad of Judicial and Extrajudicial Documents in Civil or Commercial Matters and the Hague Convention on the Taking of Evidence Abroad in Civil or Commercial Matters. The commenter states that both agreements provide for the use of a central authority for the receipt of requests for service or evidence by requiring a contracting state to designate a central authority and organize the central authority in accordance with its own law. Requiring designation of that central authority upfront in the treaty itself, the commenter claims, would remove some level of flexibility, and would require cumbersome treaty amendment processes were a party to change the specified central authority.

As an alternative, this same commenter suggested looking to the service provisions of the Foreign Sovereign Immunities Act, and in particular 28 U.S.C. 1608, to allow for largely undefined “special arrangements” to govern BOI disclosure through agencies other than central authorities. The commenter again pointed to the difficulty of changing treaties to reflect new central authorities, and viewed “special arrangements” as possibly providing “an approach to better manage the foreign access provisions of the CTA on a case-by-case basis.”

Final Rule.

FinCEN adopts the proposed rule, but with a clarification about its meaning.

In the course of drafting the Access NPRM, FinCEN conducted extensive outreach to the Department of State, the Department of Justice, and other Federal agencies that participate in international affairs on behalf of the United States. As a result, Treasury understands that “central authority” and “competent authority” are referents that may be reliant on international treaties, agreements, and conventions for context and meaning. If an institution derives its status as a central and competent authority pursuant to an international treaty, agreement, or convention, then by definition requiring foreign central and competent authorities to be identified as such under governing international treaties, agreements, or conventions is not overly restrictive. In contrast, FATF and the Egmont Group are not international bodies established by treaty, agreement, or convention, nor do they issue, implement, or administer any of the international treaties, agreements, or conventions that make an institution a central or competent authority. That said, information from both bodies could be useful in determining whether foreign countries are “trusted” in situations when no international treaty, agreement, or convention is available.

When such an agreement is available, a commenter makes a reasonable point that the instrument might not specifically identify particular central or competent authorities, but might instead direct contracting states to identify them through other means. The Hague conventions, which the commenter points to as examples, are instructive. As the commenter notes, both conventions require contracting states to identify central authorities to administer convention obligations, but do not themselves identify specific institutions of any particular governments as central authorities. That work is left to implementing statutes and regulations in contracting states. FinCEN understands that this is a common arrangement in international agreements. Consequently, for purposes of 31 CFR 1010.955(b)(3), a foreign central or competent authority may be identified as such either directly by a governing treaty, agreement, or convention, or by the statutes, regulations, or other legal means by which the relevant foreign requester country has implemented the agreement.

With this clarification, FinCEN sees no need to resort to “special arrangements” under 28 U.S.C. 1608 of the Foreign Sovereign Immunities Act to disclose BOI to foreign requesters. The CTA is clear about which foreign requesters may obtain BOI from FinCEN, as well as the criteria they must satisfy and the general process they must follow to obtain it. The resulting framework reflects the requirements of the CTA but remains flexible enough to accomplish the stated aims and purposes of the CTA without need for supplemental measures.

d. Trusted Foreign Country

Proposed Rule.

Proposed 31 CFR 1010.955(b)(3)(ii)(B) authorized FinCEN to disclose BOI in response to official requests by law enforcement, judicial, or prosecutorial authorities of “trusted” foreign countries when other criteria are satisfied. The other criteria were that the request for BOI must (1) come to FinCEN through an intermediary Federal agency; and (2) be for assistance in a law enforcement investigation or prosecution, or for a national security or intelligence activity, authorized under the laws of the foreign country. In keeping with the CTA, the “trusted foreign country” requirement would come into play when there is no international treaty, agreement, or convention available under which the relevant foreign country could make the request.

The CTA does not provide criteria for determining whether a particular foreign country is “trusted,” leaving FinCEN with flexibility to make the determination. FinCEN considered identifying particular countries or groups of countries as “trusted” for the

purposes of receiving BOI, but determined that such a restrictive approach could arbitrarily exclude foreign requesters with whom sharing BOI might be appropriate in some cases but not others. FinCEN proposed in the Access NPRM to instead consult with relevant U.S. government agencies on a case-by-case basis to determine whether to disclose BOI to foreign requesters when no international treaty, agreement, or convention applies. In making these determinations, FinCEN and the consulting agencies would consider U.S. priorities and interests, as well as the ability of a foreign requester to maintain the security and confidentiality of requested BOI.

Comments Received.

Commenters generally wanted to know either which foreign countries would be “trusted” or the criteria by which FinCEN would identify trusted foreign countries. One commenter wanted a searchable list of trusted foreign countries. Multiple commenters suggested that FinCEN publicly define its trust criteria, with some arguing that a non-transparent case-by-case determination process could yield unjustifiably disparate treatment. One commenter suggested either defining “trusted” or dropping the term entirely and relying solely on treaties, agreements, and conventions. Another commenter noted a FinCEN definition would promote consistency of access.

A few commenters argued that FinCEN should not have sole discretion to determine which countries are trusted, as such decisions have implications for national security and foreign relations. One commenter supported FinCEN's decision not to develop a prior list of trusted foreign countries because such a list would inevitably change over time. That same commenter further argued, however, that FinCEN should define the “relevant U.S. government agencies” with which it would consult to make trust determinations as including the Departments of State and Justice, and should announce that, at a minimum, FinCEN will treat members of NATO, the EU, and the G7 group of nations as trusted foreign countries absent special circumstances. Another commenter stated that FinCEN had taken a sensible approach regarding the trusted foreign country requirements, but might consider giving advance notice to countries that would explicitly not be trusted.

Final Rule.

FinCEN adopts the proposed rule with limited clarifications. FinCEN agrees with the commenter that the rule would benefit from identifying particular agencies with which FinCEN is likely to consult when no international treaty, agreement, or convention applies to a foreign request for BOI and FinCEN needs to determine whether the country at issue is “trusted.” FinCEN is therefore specifying in the rule that, in determining whether a request is from a “trusted foreign country,” FinCEN will make such determination with the concurrence of the Department of State, and in consultation with the Department of Justice or other agencies as necessary and appropriate. Specifying that FinCEN will seek the Department of State's concurrence on these determinations reflects the Department of State's central role in conducting U.S. foreign policy and foreign relations. FinCEN has also explicitly identified the Department of Justice to reflect the major role that the Department Justice plays in U.S. relations with other countries in law enforcement, national security, and intelligence activities, and the commensurate likelihood that FinCEN will regularly consult it when making trust determinations. However, identifying these two agencies within the regulation does not mean that FinCEN will only consult them when making trust determinations, or that FinCEN is delegating its authority to make those determinations. Indeed, FinCEN will consult with agencies other than the Departments of State and Justice when appropriate,

e.g.,

when those agencies have relevant equities, expertise, or relationships with foreign governments.

While FinCEN is choosing to clarify the interagency coordination element of its trust determination process, it is not defining “trusted” or enumerating criteria it will use to assess requests for BOI when no international treaty, agreement, or convention applies. There are likely too many situations in which providing other countries with BOI might be in the best interest of the United States to reduce that complexity to a single definition or list. That same variability also weighs against preemptively identifying certain countries as either wholly trusted or not. Particular facts and circumstances are relevant to the determination and may result in different outcomes where the same foreign requester is involved. These are dynamic situations to which FinCEN must be able to respond flexibly, in consultation with relevant Federal agencies. At this time, FinCEN believes that it is important to retain appropriate discretion in making determinations regarding “trusted” foreign countries in particular circumstances, and declines to adopt restrictive definitions or criteria that could be detrimental to broader U.S. interests.

e. Training

Proposed Rule.

Proposed 31 CFR 1010.955(d)(3)(i) required foreign requesters to handle, disclose, and use BOI consistent with the requirements of the applicable treaty, agreement, or convention under which it was requested. 31 CFR 1010.955(d)(3)(ii), meanwhile, applied to situations in which there was no applicable treaty, agreement, or convention, and would have imposed on foreign BOI requesters certain general requirements that the CTA imposes on all requesting agencies.

101

FinCEN believed these measures were necessary to protect the security and confidentiality of BOI provided to foreign requesters.

102

Proposed requirements applicable to foreign requesters when no treaty, agreement, or convention applies included having security standards and procedures, maintaining a secure storage system that complies with the security standards that the foreign requester applies to the most sensitive unclassified information it handles, minimizing the amount of information requested, and restricting personnel access to BOI to persons “[w]ho have undergone training on the appropriate handling and safeguarding [BOI].” Foreign requesters that request and receive BOI under an applicable international treaty, agreement, or convention would not have these requirements under the proposed rule, given that such requesters would be governed by standards and procedures prescribed by the applicable international treaty, agreement, or convention.

101

In the Access NPRM, FinCEN misnumbered this provision as a duplicate 31 CFR 1010.955(d)(3)(i).

102

See

31 U.S.C. 5336(c)(3)(A), (K).

Comments Received.

Several commenters indicated that FinCEN should revise the requirement that foreign requesters limit access to BOI to persons “[w]ho have undergone training on the appropriate handling and safeguarding of [BOI].” One commenter expressed the view that the training requirement was stricter than the one proposed for domestic agencies, under which personnel with access to BOI either had to receive training on its handling and safeguarding or received the information from someone who had undergone such training. Another commenter suggested that FinCEN adopt this domestic agency standard for

foreign requesters. Other commenters variously stated that training in this context is superfluous given the other requirements applicable to foreign requesters, that training requirements would exceed reciprocal standards imposed by foreign partners when U.S. government agencies obtained beneficial ownership information from foreign BOI databases, and that FinCEN should define with greater precision the requirements for foreign requester training.

Final Rule.

FinCEN adopts the proposed rule with changes. First, FinCEN fixed the typographical error in 31 CFR 1010.955(d)(3)(ii) to reflect the provision's correct numbering. Second, FinCEN has removed the proposed rule's requirement that an individual from an intermediary Federal agency submit personal details when making each request on behalf of a foreign requester. That is because the individual will submit identifying information to FinCEN at the time they create an account to access FinCEN's BO IT system, which will be necessary to make requests on behalf of foreign governments. FinCEN will provide guidance to intermediary Federal agencies at a later time on how users of the BO IT system will set up these accounts.

The third change to the proposed provision pertains to certification requirements in situations involving “trusted” foreign countries. FinCEN originally proposed to require each intermediary Federal agency requesting BOI on behalf of a foreign requester under proposed 31 CFR 1010.955(b)(3)(ii)(B) to submit to FinCEN “[a] written explanation of the specific purpose for which the foreign person is seeking information . . . along with an accompanying certification that the information is for use in furtherance of a law enforcement investigation or prosecution, or for a national security or intelligence activity, that is authorized under the laws of the relevant foreign country; will be used only for the particular purpose or activity for which it is requested; and will be handled consistent with [applicable security and confidentiality requirements].” FinCEN is modifying the certification requirement to avoid unintentionally imposing on intermediary Federal agencies a requirement to certify to a foreign requester's future behavior with respect to the BOI obtained, which the agency could not know with certainty. Under the final rule, such agencies must still certify to FinCEN that the information is for use in furtherance of a law enforcement investigation or prosecution, or for a national security or intelligence activity, that is authorized under the laws of the relevant foreign country. However, the remainder of the original certification has been modified to require only that the intermediary Federal agency certify that the foreign requester has been informed that BOI disclosed to it may only be used for the particular purpose or activity for which it was requested and must be handled consistent with applicable requirements. This modified certification better reflects what an intermediary Federal agency can know and practically control. FinCEN's expectation that foreign requesters will handle BOI in accordance with applicable requirements and protect it to the best of their ability remains unchanged, as does FinCEN's willingness to withhold BOI from requesters that fail to meet that expectation.

FinCEN declines to make additional revisions suggested by comments. The requirement that foreign requesters apply appropriate standards and procedures to protect BOI and limit BOI dissemination to trained individuals is reasonable under the circumstances and unlikely to place undue burden on foreign requesters. It is critical that all authorized BOI recipients-including foreign requesters-take steps to keep BOI confidential and secure and to prevent its misuse given the sensitivity of the personal information to be reported to the BO IT system. The application of BOI security standards and procedures, including the training requirement, effectuates these underlying objectives, including by requiring individual foreign recipients to have knowledge of those requirements. FinCEN also declines to prescribe specific requirements on the structure and content of any training. FinCEN recognizes that standards and procedures will vary by foreign requester to reflect organizational and resource differences. At root, every individual with access to BOI should understand the purposes for which BOI can be used, the persons with whom they can share BOI with and for what purpose, and the manner in which they must secure it.

The differences between the application of BOI security standards and procedures for domestic and foreign requesters reflect legal and practical considerations. First, the CTA specifically prescribes certain standards for domestic agencies that have access to BOI, but not for foreign requesters. Second, the Access NPRM proposed standards and procedures that are tailored to particular circumstances and challenges involving foreign requesters, and are arguably less burdensome that those required of domestic agencies. For example, FinCEN decided not to propose an MOU requirement for foreign requesters because (1) foreign requesters will not have direct access to the BO IT system, and (2) FinCEN anticipates a significantly lower volume of foreign requests in general relative to other stakeholders. In contrast, the MOUs with domestic agencies are appropriate to mitigate the risks inherent in the expected volume and frequency of searches in the BO IT system. FinCEN anticipates that these MOUs will, among other things, memorialize and implement requirements regarding reports and certifications, periodic training of individual recipients of BOI, personnel access restrictions, re-disclosure limitations, and access to audit and oversight mechanisms. The MOUs will also include security plans covering topics related to personnel security (

e.g.,

eligibility limitations, screening standards, certifications and notification requirements); physical security (system connections and use, conditions of access, data maintenance); computer security (use and access policies, standards related to passwords, transmission, storage, and encryption); and inspections and compliance.

Foreign BOI requesters will only receive BOI through intermediary Federal agencies that will themselves be subject to the detailed MOUs described above. Those intermediary

This text is long and has been trimmed here. Open the source document for the complete record.

This is a copy of a public record, reproduced as it was published. It is not legal advice, and it may not be the version a court would rely on. Check the official source before you cite it.