ANTI-MONEY LAUNDERING MEASURES

Friday,

May 9, 2003

Part II

Department of the Treasury

31 CFR Part 103

Office of the Comptroller of the

Currency

12 CFR Part 21

Office of Thrift Supervision

12 CFR Part 563

Federal Reserve System

12 CFR Parts 208 and 211

Federal Deposit Insurance

Corporation

12 CFR Part 326

National Credit Union

Administration

12 CFR Part 748

Commodity Futures Trading

Commission

17 CFR Parts 1 and 42

Securities and Exchange

Commission

17 CFR Part 270 and 31 CFR Part 103

Transactions and Customer Identification

Programs; Final Rules and Proposed Rule

VerDate Jan<31>2003

17:31 May 08, 2003

Jkt 200001

PO 00000

Frm 00001

Fmt 4737

Sfmt 4737

E:\FR\FM\09MYR2.SGM

09MYR2

25090

Federal Register / Vol. 68, No. 90 / Friday, May 9, 2003 / Rules and Regulations

1 This definition includes banks, savings

associations, credit unions, Edge Act and

Agreement corporations, and branches and agencies

of foreign banks.

DEPARTMENT OF THE TREASURY

Office of the Comptroller of the

Currency

12 CFR Part 21

[Docket No. 03–08]

RIN 1557–AC06

FEDERAL RESERVE SYSTEM

12 CFR Parts 208 and 211

[Docket No. R–1127]

FEDERAL DEPOSIT INSURANCE

CORPORATION

12 CFR Part 326

DEPARTMENT OF THE TREASURY

Office of Thrift Supervision

12 CFR Part 563

[Docket No. 2003–16]

NATIONAL CREDIT UNION

ADMINISTRATION

12 CFR Part 748

RIN 3133

DEPARTMENT OF THE TREASURY

31 CFR Part 103

RIN 1506–AA31

Customer Identification Programs for

Banks, Savings Associations, Credit

Unions and Certain Non-Federally

Regulated Banks

AGENCIES: The Financial Crimes

Enforcement Network, Treasury; Office

of the Comptroller of the Currency,

Treasury; Board of Governors of the

Federal Reserve System; Federal Deposit

Insurance Corporation; Office of Thrift

Supervision, Treasury; National Credit

Union Administration.

ACTION: Joint final rule

Banks, Savings Associations, Credit

Unions and Certain Non-Federally

Regulated Banks

AGENCIES: The Financial Crimes

Enforcement Network, Treasury; Office

of the Comptroller of the Currency,

Treasury; Board of Governors of the

Federal Reserve System; Federal Deposit

Insurance Corporation; Office of Thrift

Supervision, Treasury; National Credit

Union Administration.

ACTION: Joint final rule.

SUMMARY: The Department of the

Treasury, through the Financial Crimes

Enforcement Network (FinCEN),

together with the Office of the

Comptroller of the Currency (OCC), the

Board of Governors of the Federal

Reserve System (Board), the Federal

Deposit Insurance Corporation (FDIC),

the Office of Thrift Supervision (OTS),

and the National Credit Union

Administration (NCUA) (collectively,

the Agencies), have jointly adopted a

final rule to implement section 326 of

the Uniting and Strengthening America

by Providing Appropriate Tools

Required To Intercept and Obstruct

Terrorism (USA PATRIOT) Act of 2001

(the Act). Section 326 requires the

Secretary of the Treasury (Secretary) to

jointly prescribe with each of the

Agencies, the Securities and Exchange

Commission (SEC), and the Commodity

Futures Trading Commission (CFTC), a

regulation that, at a minimum, requires

financial institutions to implement

reasonable procedures to verify the

identity of any person seeking to open

an account, to the extent reasonable and

practicable; maintain records of the

information used to verify the person’s

identity; and determine whether the

person appears on any lists of known or

suspected terrorists or terrorist

organizations provided to the financial

institution by any government agency.

This final regulation applies to banks,

savings associations, credit unions,

private banks, and trust companies.

DATES: Effective Date: This rule is

effective June 9, 2003.

Compliance Date: Each bank must

comply with this final rule by October

1, 2003

s on any lists of known or

suspected terrorists or terrorist

organizations provided to the financial

institution by any government agency.

This final regulation applies to banks,

savings associations, credit unions,

private banks, and trust companies.

DATES: Effective Date: This rule is

effective June 9, 2003.

Compliance Date: Each bank must

comply with this final rule by October

1, 2003.

FOR FURTHER INFORMATION CONTACT:

OCC: Office of the Chief Counsel at

(202) 874–3295.

Board: Enforcement and Special

Investigations Sections at (202) 452–

5235, (202) 728–5829, or (202) 452–

2961.

FDIC: Special Activities Section,

Division of Supervision and Consumer

Protection, and Legal Division at (202)

898–3671.

OTS: Compliance Policy Division at

(202) 906–6012.

NCUA: Office of General Counsel at

(703) 518–6540; or Office of

Examination and Insurance at (703)

518–6360.

Treasury: Office of the Chief Counsel

(FinCEN) at (703) 905–3590; Office of

the General Counsel (Treasury) at (202)

622–1927; or the Office of the Assistant

General Counsel for Banking & Finance

(Treasury) at (202) 622–0480.

SUPPLEMENTARY INFORMATION:

I. Background

A. Section 326 of the USA PATRIOT Act

On October 26, 2001, President Bush

signed into law the USA PATRIOT Act,

Pub. L. 107–56. Title III of the Act,

captioned ‘‘International Money

Laundering Abatement and Anti-

terrorist Financing Act of 2001,’’ adds

several new provisions to the Bank

Secrecy Act (BSA), 31 U.S.C. 5311 et

seq. These provisions are intended to

facilitate the prevention, detection, and

prosecution of international money

laundering and the financing of

terrorism.

Section 326 of the Act adds a new

subsection (l) to 31 U.S.C

tioned ‘‘International Money

Laundering Abatement and Anti-

terrorist Financing Act of 2001,’’ adds

several new provisions to the Bank

Secrecy Act (BSA), 31 U.S.C. 5311 et

seq. These provisions are intended to

facilitate the prevention, detection, and

prosecution of international money

laundering and the financing of

terrorism.

Section 326 of the Act adds a new

subsection (l) to 31 U.S.C. 5318 of the

BSA that requires the Secretary to

prescribe regulations ‘‘setting forth the

minimum standards for financial

institutions and their customers

regarding the identity of the customer

that shall apply in connection with the

opening of an account at a financial

institution.’’

Section 326 applies to all ‘‘financial

institutions.’’ This term is defined very

broadly in the BSA to encompass a

variety of entities, including commercial

banks, agencies and branches of foreign

banks in the United States, thrifts, credit

unions, private banks, trust companies,

investment companies, brokers and

dealers in securities, futures

commission merchants, insurance

companies, travel agents, pawnbrokers,

dealers in precious metals, check-

cashers, casinos, and telegraph

companies, among many others. See 31

U.S.C. 5312(a)(2) and (c)(1)(A).

For any financial institution engaged

in financial activities described in

section 4(k) of the Bank Holding

Company Act of 1956 (section 4(k)

institutions), the Secretary is required to

prescribe the regulations issued under

section 326 jointly with each of the

Agencies, the SEC, and the CFTC (the

Federal functional regulators)

, among many others. See 31

U.S.C. 5312(a)(2) and (c)(1)(A).

For any financial institution engaged

in financial activities described in

section 4(k) of the Bank Holding

Company Act of 1956 (section 4(k)

institutions), the Secretary is required to

prescribe the regulations issued under

section 326 jointly with each of the

Agencies, the SEC, and the CFTC (the

Federal functional regulators).

Section 326 of the Act provides that

the regulations must require, at a

minimum, financial institutions to

implement reasonable procedures for (1)

verifying the identity of any person

seeking to open an account, to the

extent reasonable and practicable; (2)

maintaining records of the information

used to verify the person’s identity,

including name, address, and other

identifying information; and (3)

determining whether the person appears

on any lists of known or suspected

terrorists or terrorist organizations

provided to the financial institution by

any government agency. In prescribing

these regulations, the Secretary is

directed to take into consideration the

various types of accounts maintained by

various types of financial institutions,

the various methods of opening

accounts, and the various types of

identifying information available.

B. Overview of Comments Received

On July 23, 2002, Treasury and the

Agencies published a joint notice of

proposed rulemaking in the Federal

Register (67 FR 48290) applicable to (a)

any financial institution defined as a

‘‘bank’’ in 31 CFR 103.11(c) 1 and

VerDate Jan<31>2003

17:31 May 08, 2003

Jkt 200001

PO 00000

Frm 00002

Fmt 4701

Sfmt 4700

E:\FR\FM\09MYR2.SGM

09MYR2

nformation available.

B. Overview of Comments Received

On July 23, 2002, Treasury and the

Agencies published a joint notice of

proposed rulemaking in the Federal

Register (67 FR 48290) applicable to (a)

any financial institution defined as a

‘‘bank’’ in 31 CFR 103.11(c) 1 and

VerDate Jan<31>2003

17:31 May 08, 2003

Jkt 200001

PO 00000

Frm 00002

Fmt 4701

Sfmt 4700

E:\FR\FM\09MYR2.SGM

09MYR2

25091

Federal Register / Vol. 68, No. 90 / Friday, May 9, 2003 / Rules and Regulations

2 In the preamble for this proposed rule, Treasury

explained that a single final regulation would be

issued for all financial institutions defined as

‘‘banks’’ under 31 CFR 103.11(c), with

modifications to accommodate certain differences

between Federally regulated and non-Federally

regulated banks. See 67 FR 48299, 48300.

3 At the same time, Treasury also published (1)

together with the SEC, proposed rules for broker-

dealers (67 FR 48306) and mutual funds (67 FR

48318); and (2) together with the CFTC, proposed

rules for futures commission merchants and

introducing brokers (67 FR 48328).

4 See footnote 3, supra.

subject to regulation by one of the

Agencies; and (b) any foreign branch of

an insured bank. On the same date,

Treasury separately published an

identical, proposed rule for credit

unions, private banks, and trust

companies that do not have a Federal

functional regulator (67 FR 48299).2

Treasury and the Agencies proposed

general standards that would require

each bank to design and implement a

customer identification program (CIP)

tailored to the bank’s size, location, and

type of business. The proposed rule also

included certain specific standards that

would be mandated for all banks.3

Treasury and the Agencies

collectively received approximately five

hundred comments in response to these

proposed rules (collectively referred to

as the ‘‘proposal’’ or the ‘‘proposed

rule’’ for ‘‘banks’’), although some

commenters sent copies of the same

letter to Treasury and to each of the

Agencies

ed rule also

included certain specific standards that

would be mandated for all banks.3

Treasury and the Agencies

collectively received approximately five

hundred comments in response to these

proposed rules (collectively referred to

as the ‘‘proposal’’ or the ‘‘proposed

rule’’ for ‘‘banks’’), although some

commenters sent copies of the same

letter to Treasury and to each of the

Agencies. The majority of comments

received by Treasury and the Agencies

were from banks, savings associations,

credit unions, and their trade

associations. Most of these commenters

agreed with the largely risk-based

approach set forth in the proposal that

allowed each bank to develop a CIP

based on its specific operations.

Some commenters, however,

criticized the specific requirements in

the proposed rule and suggested that

Treasury and the Agencies issue a final

rule containing an entirely risk-based

approach without any minimum

identification and verification

requirements. According to some of

these commenters, such a thoroughly

risk-based approach would give banks

appropriate discretion to focus their

efforts and finite resources on specific,

high-risk accounts most likely to be

used by money-launderers and

terrorists.

Other commenters, especially those

representing credit card banks and

credit card issuers, asserted that the

proposed minimum identification and

verification requirements should be

eliminated because they did not take

into account the unique nature of credit

card operations. They warned that these

requirements, if implemented, would

have a chilling effect on credit practices

important to U.S. consumers and would

impose significant compliance costs on

their industry with little benefit to law

enforcement.

By contrast, some smaller banks

criticized the flexibility of the proposal

and stated that a risk-based approach

would leave too much room for

interpretation by the Agencies

hese

requirements, if implemented, would

have a chilling effect on credit practices

important to U.S. consumers and would

impose significant compliance costs on

their industry with little benefit to law

enforcement.

By contrast, some smaller banks

criticized the flexibility of the proposal

and stated that a risk-based approach

would leave too much room for

interpretation by the Agencies. These

commenters urged Treasury and the

Agencies to issue a final rule

establishing more specific requirements.

For example, some commenters

suggested that the rule prescribe risk

assessment levels for each customer

type and type of account, along with a

specific description of acceptable forms

of identification and methods of

verification appropriate for each bank’s

size and location.

While commenters representing

various segments of the industry

differed on the approach that should be

taken in the final rule, the vast majority

concluded that Treasury and the

Agencies had underestimated the

compliance burden that would be

imposed by certain elements of the

proposal. Commenters were especially

concerned about the proposed

requirements that banks verify the

identity of signatories on accounts, keep

copies of documents used to verify a

customer’s identity, and retain identity

verification records for five years after

an account is closed.

Some commenters also suggested that

banks be given greater flexibility when

dealing with established customers and

urged that banks be permitted to rely on

identification and verification of

customers performed by a third party,

including an affiliate. Other commenters

asked for additional guidance regarding

the lists of known and suspected

terrorists and terrorist organizations that

must be checked, and regarding what

will be deemed adequate notice to

customers for purposes of complying

with the final rule

hat banks be permitted to rely on

identification and verification of

customers performed by a third party,

including an affiliate. Other commenters

asked for additional guidance regarding

the lists of known and suspected

terrorists and terrorist organizations that

must be checked, and regarding what

will be deemed adequate notice to

customers for purposes of complying

with the final rule. Many commenters

requested that the final rule contain a

delayed implementation date that

would provide banks with the time

needed to design a customer

identification program, obtain board

approval, alter existing policies and

procedures, forms and software, and

train staff.

Several comments were received from

companies engaged in the sale of

technology or services that could be

used to identify and verify customers,

retain records, and check lists of known

and suspected terrorists and terrorist

organizations. Many of these companies

recommended that the proposed rule be

modified to make clear that use of

specific products and services would be

permissible. Some of these commenters

urged that the rule require banks to

authenticate any documents obtained to

verify the identity of the customer

through the use of automated document

authentication technology.

A small number of comments were

received from individuals. Some of

these individuals criticized the

proposed requirement that banks obtain

a social security number from persons

opening an account as an infringement

upon individual liberty and privacy.

Some individuals were concerned that

this requirement would expose them to

an added risk of identity theft. Other

individuals supported the proposal and

concluded that its verification

requirements might diminish instances

of identity theft and fraud. A few

commenters suggested that the

government develop a separate national

identification number or require that

social security cards bear photographs

and or other safeguards

this requirement would expose them to

an added risk of identity theft. Other

individuals supported the proposal and

concluded that its verification

requirements might diminish instances

of identity theft and fraud. A few

commenters suggested that the

government develop a separate national

identification number or require that

social security cards bear photographs

and or other safeguards.

A variety of commenters applauded

the efforts of Treasury and the Federal

functional regulators to devise a

uniform set of rules that apply to banks,

broker-dealers, mutual funds, futures

commission merchants, and introducing

brokers.4 They noted that, without

uniformity, customers of financial

institutions may seek to open accounts

with institutions that customers

perceive to have less robust customer

identification requirements. These

commenters also suggested revisions

that would enhance the uniformity of

the rules.

Treasury and the Agencies have

modified the proposed rule in light of

the comments received. A discussion of

the comments, and the manner in which

the proposed rule has been modified,

follows in the section-by-section

analysis.

In addition, as suggested by a number

of commenters, Treasury and the

Agencies expect to issue supplementary

guidance following issuance of the final

rule.

C. Joint Issuance by Treasury and the

Agencies

The final rule implementing section

326 is being issued jointly by Treasury,

through FinCEN, and by the Agencies.

It applies to (1) a ‘‘bank,’’ as defined in

31 CFR 103.11(c), that is subject to

regulation by one of the Agencies, and

ers, Treasury and the

Agencies expect to issue supplementary

guidance following issuance of the final

rule.

C. Joint Issuance by Treasury and the

Agencies

The final rule implementing section

326 is being issued jointly by Treasury,

through FinCEN, and by the Agencies.

It applies to (1) a ‘‘bank,’’ as defined in

31 CFR 103.11(c), that is subject to

regulation by one of the Agencies, and

(2) to any non-Federally insured credit

union, private bank or trust company

that does not have a Federal functional

regulator (collectively referred to in the

final rule as ‘‘a bank’’).

VerDate Jan<31>2003

17:31 May 08, 2003

Jkt 200001

PO 00000

Frm 00003

Fmt 4701

Sfmt 4700

E:\FR\FM\09MYR2.SGM

09MYR2

25092

Federal Register / Vol. 68, No. 90 / Friday, May 9, 2003 / Rules and Regulations

5 12 CFR 21.21 (OCC); 12 CFR 208.63, 211.5, and

211.24 (FRB); 12 CFR 326.8 (FDIC); 12 CFR 563.177

(OTS); and 12 CFR 748.2 (NCUA).

6 The definition of ‘‘account’’ in the proposed rule

was based on the statutory definition of ‘‘account’’

that is used in section 311 of the Act.

7 This exclusion is consistent with legislative

history indicating that by referencing the term

‘‘customers,’’ Congress intended ‘‘that the

regulations prescribed by Treasury take an

approach similar to that of regulations promulgated

under title V of the Gramm-Leach-Bliley Act of

1999, where the Federal functional regulators

defined ‘‘customers’’ and ‘‘customer relationship’’

for purposes of the financial privacy rules.’’ H.R.

Rep. No. 107–250, pt. 1, at 62 (2001). The

definitions of ‘‘customer’’ and ‘‘customer

The substantive requirements of this

joint final rule are being codified as part

of Treasury’s BSA regulations located in

31 CFR part 103. In addition, each of the

Agencies is concurrently publishing a

provision in its own regulations 5 to

cross-reference this final rule in order to

clarify the applicability of the final rule

to the banks subject to its jurisdiction

tomer’’ and ‘‘customer

The substantive requirements of this

joint final rule are being codified as part

of Treasury’s BSA regulations located in

31 CFR part 103. In addition, each of the

Agencies is concurrently publishing a

provision in its own regulations 5 to

cross-reference this final rule in order to

clarify the applicability of the final rule

to the banks subject to its jurisdiction.

Regulations governing the

applicability of section 326 to certain

financial institutions that are regulated

by the SEC and the CFTC are the subject

of separate rulemakings. Treasury, the

Agencies, the SEC, and the CFTC

consulted extensively in the

development of all joint rules

implementing section 326 of the Act.

All of the participating agencies intend

the effect of the rules to be uniform

throughout the financial services

industry. Treasury intends to issue

separate rules under section 326 for

certain non-bank financial institutions

that are not regulated by one of the

Federal functional regulators.

The Secretary has determined that the

records required to be kept by section

326 of the Act have a high degree of

usefulness in criminal, tax, or regulatory

investigations or proceedings, or in the

conduct of intelligence or

counterintelligence activities, to protect

against international terrorism.

In addition, Treasury, under its own

authority, is issuing conforming

amendments to 31 CFR 103.34, which

imposes requirements concerning the

identification of bank customers.

D. Compliance Date

Nearly all commenters on the

proposed rule requested that banks be

given adequate time to develop and

implement the requirements of any final

rule implementing section 326 of the

Act

terrorism.

In addition, Treasury, under its own

authority, is issuing conforming

amendments to 31 CFR 103.34, which

imposes requirements concerning the

identification of bank customers.

D. Compliance Date

Nearly all commenters on the

proposed rule requested that banks be

given adequate time to develop and

implement the requirements of any final

rule implementing section 326 of the

Act. These commenters stated that if the

proposed rule were implemented, banks

would be required, among other things,

to revise existing account opening

policies and procedures, obtain board

approval, train staff, update forms,

purchase new or updated software for

customer verification and checking of

government lists, and purchase new

equipment for copying or scanning and

storing records. Commenters requested a

delayed effective or compliance date,

but, given the variety of banks that

would be covered by the final rule, there

was no consensus regarding the amount

of time that would be necessary to

comply with the final rule. The

transition periods suggested by

commenters ranged from 60 days to two

years from the date a final rule is

published.

The final rule modifies various

aspects of the proposal and eliminates

some of the requirements that

commenters identified as being most

burdensome. Nonetheless, Treasury and

the Agencies recognize that some banks

will need time to develop a CIP, obtain

board approval, and implement the CIP,

which will include various measures,

such as training of staff, reprinting

forms, and developing new software.

Accordingly, although this final rule

will be effective 30 days after

publication, banks are provided with a

transition period to implement the rule.

Treasury and the Agencies have

determined that each bank must fully

implement its CIP by October 1, 2003.

II. Section-by-Section Analysis of Final

Rule Implementing Section 326

Section 103.121(a)

Definitions

Section 103.121(a)(1) Account

.

Accordingly, although this final rule

will be effective 30 days after

publication, banks are provided with a

transition period to implement the rule.

Treasury and the Agencies have

determined that each bank must fully

implement its CIP by October 1, 2003.

II. Section-by-Section Analysis of Final

Rule Implementing Section 326

Section 103.121(a)

Definitions

Section 103.121(a)(1) Account. The

proposed rule defined ‘‘account’’ as

each formal banking or business

relationship established to provide

ongoing services, dealings, or other

financial transactions and stated that a

deposit account, transaction or asset

account, and a credit account or other

extension of credit would each

constitute an ‘‘account.’’ 6 The proposal

also explained that the term ‘‘account’’

was limited to formal banking and

business relationships established to

provide ‘‘ongoing’’ services, dealings, or

other financial transactions to make

clear that this term is not intended to

cover infrequent transactions such as

the occasional purchase of a money

order or a wire transfer.

Treasury and the Agencies received a

large number of comments on this

proposed definition. Some commenters

agreed with the proposed definition

though others thought the definition of

‘‘account’’ was either too broad or

needed clarification. Some commenters

suggested that the definition of

‘‘account’’ be narrowed to include only

those relationships that are financial in

nature. A number of commenters urged

that the definition be limited to high-

risk relationships that experts have

identified as actually used by money

launderers and terrorists

thought the definition of

‘‘account’’ was either too broad or

needed clarification. Some commenters

suggested that the definition of

‘‘account’’ be narrowed to include only

those relationships that are financial in

nature. A number of commenters urged

that the definition be limited to high-

risk relationships that experts have

identified as actually used by money

launderers and terrorists. Some of these

commenters suggested that particular

types of accounts, especially those

established as part of employee benefit

plans, be excluded from the definition

of ‘‘account.’’

Most commenters requested that the

final rule provide additional examples

of the relationships that would

constitute an ‘‘account.’’ Many

commenters requested that the rule

clarify the meaning of ‘‘ongoing

services.’’ These commenters asked

whether a person who repeatedly and

regularly purchased a money order,

requested a wire transfer, or cashed a

check on a weekly basis, without any

other relationship with a bank, would

be considered to have an ‘‘account.’’

Many other commenters asked that the

exclusion for transfers of accounts

between banks described in the

preamble for the proposal—which

commenters characterized as the

‘‘transfer exception’’ —be stated

expressly in the regulation and

expanded to cover all loans originated

by a third party and purchased by a

bank, such as mortgages purchased from

non-bank lenders and vehicle loans

purchased from car dealers.

The final rule contains a number of

changes prompted by these comments.

First, the reference to the term ‘‘business

relationship’’ has been deleted from the

definition of ‘‘account.’’ This change is

made to clarify that the regulation

applies to the bank’s provision of

financial products and services, as

opposed to general ‘‘business’’ dealings,

such as those in connection with the

bank’s own operations or premises

mber of

changes prompted by these comments.

First, the reference to the term ‘‘business

relationship’’ has been deleted from the

definition of ‘‘account.’’ This change is

made to clarify that the regulation

applies to the bank’s provision of

financial products and services, as

opposed to general ‘‘business’’ dealings,

such as those in connection with the

bank’s own operations or premises.

Second, the definition now contains

additional, but non-exclusive, examples

of products and services, such as safety

deposit box and other safekeeping

services, cash management, and

custodian and trust services, that

constitute an ‘‘account.’’

The definition of ‘‘account’’ also has

been changed to include a list of

products and services that will not be

deemed an ‘‘account.’’ The preamble for

the proposed rule had used the term

‘‘ongoing services’’ to define accounts

covered by the final rule, and had

referred to the exclusion of ‘‘occasional’’

transactions and ‘‘infrequent’’ purchases

(which arguably would require a bank to

monitor all transactions for repetitive

contacts). By contrast, the final rule

clarifies that ‘‘account’’ excludes

products and services where a formal

banking relationship is not established

with a person, such as check cashing,

wire transfer, or the sale of a check or

money order.7 Treasury and the

VerDate Jan<31>2003

17:31 May 08, 2003

Jkt 200001

PO 00000

Frm 00004

Fmt 4701

Sfmt 4700

E:\FR\FM\09MYR2.SGM

09MYR2

for repetitive

contacts). By contrast, the final rule

clarifies that ‘‘account’’ excludes

products and services where a formal

banking relationship is not established

with a person, such as check cashing,

wire transfer, or the sale of a check or

money order.7 Treasury and the

VerDate Jan<31>2003

17:31 May 08, 2003

Jkt 200001

PO 00000

Frm 00004

Fmt 4701

Sfmt 4700

E:\FR\FM\09MYR2.SGM

09MYR2

25093

Federal Register / Vol. 68, No. 90 / Friday, May 9, 2003 / Rules and Regulations

relationship’’ in the financial privacy rules apply

only to a consumer who has a ‘‘continuing

relationship’’ with a bank, for example, in the form

of a deposit or investment account, or a loan. See

.3(h) and (i) of 12 CFR part 40 (OCC); 12 CFR part

216 (Board); 12 CFR part 332 (FDIC); 12 CFR part

573 (OTS); and 12 CFR part 716 (NCUA).

8 In many cases, these third parties are themselves

‘‘financial institutions’’ for purposes of the BSA.

Treasury anticipates that these third parties

ultimately will be subject to their own customer

identification rules implementing section 326 of the

Act in the event that they are not presently covered

by such a rule.

9 Nevertheless, there may be situations involving

the transfer of accounts where it would be

appropriate for a bank, as part of the customer due

diligence procedures required under existing

regulations requiring banks to have compliance

programs implementing the BSA (BSA compliance

programs), to verify the identity of customers

associated with accounts that it acquires from

another financial institution. Treasury and the

Agencies expect financial institutions to implement

reasonable procedures to detect money laundering

in any account, however acquired.

10 All insured depository institutions currently

must have a BSA compliance program. See 12 CFR

21.21 (OCC); 12 CFR 208.63 (Board); 12 CFR 326.8

(FDIC); 12 CFR 563.177 (OTS); and 12 CFR 748.2

(NCUA). In addition, all financial institutions are

required by section 352 of the Act, 31 U.S.C

itutions to implement

reasonable procedures to detect money laundering

in any account, however acquired.

10 All insured depository institutions currently

must have a BSA compliance program. See 12 CFR

21.21 (OCC); 12 CFR 208.63 (Board); 12 CFR 326.8

(FDIC); 12 CFR 563.177 (OTS); and 12 CFR 748.2

(NCUA). In addition, all financial institutions are

required by section 352 of the Act, 31 U.S.C.

5318(h), to develop and implement an anti-money

laundering program. Treasury issued a regulation

implementing section 352 providing that a financial

institution regulated by a Federal functional

regulator is deemed to satisfy the requirements of

section 5318(h)(1) if it implements and maintains

an anti-money laundering program that complies

with the regulation of its Federal functional

regulator, i.e., the requirement to implement a BSA

compliance program. See 31 CFR 103.120(b); 67 FR

2113 (April 29, 2002). However, Treasury

temporarily deferred subjecting certain non-

Federally regulated banks to the anti-money

laundering program requirements in section 352.

See 67 FR 67547 (November 6, 2002) (corrected 67

FR 68935 (November 14, 2002)).

11 See, e.g., 67 FR 60562, 60565 (Sept. 26, 2002)

(FinCEN’s regulation titled ‘‘Anti-Money

Laundering Requirements ‘‘Correspondent

Accounts for Foreign Shell Banks: Recordkeeping

and Termination of Correspondent Accounts for

Foreign Banks’ implementing sections 313 and

319(b) of the Act).

12 The proposed rule defined ‘‘person’’ by

reference to § 103.11(z). This definition includes

individuals, corporations, partnerships, trusts,

estates, joint stock companies, associations,

syndicates, joint ventures, other unincorporated

organizations or groups, certain Indian Tribes, and

all entities cognizable as legal personalities.

Treasury and the Agencies agree that it is not

necessary to repeat this definition. Therefore, it is

omitted from the final rule

definition includes

individuals, corporations, partnerships, trusts,

estates, joint stock companies, associations,

syndicates, joint ventures, other unincorporated

organizations or groups, certain Indian Tribes, and

all entities cognizable as legal personalities.

Treasury and the Agencies agree that it is not

necessary to repeat this definition. Therefore, it is

omitted from the final rule.

Agencies note that part 103 already

requires verification of identity in

connection with many of these products

and services. See, e.g., 31 CFR 103.29

(purchases of bank checks and drafts,

cashier’s checks, money orders, and

traveler’s checks for $3000 or more); 31

CFR 103.33 (funds transfers of $3000 or

more).

In addition, the final rule codifies and

clarifies the ‘‘transfer exception.’’ Under

the final rule, the definition of

‘‘account’’ excludes accounts that a

bank acquires through an acquisition,

merger, purchase of assets, or

assumption of liabilities from any third

party.8 Treasury and the Agencies note

that the Act provides that the

regulations shall require reasonable

procedures for ‘‘verifying the identity of

any person seeking to open an

account.’’ Because these transfers are

not initiated by customers, these

accounts do not fall within the scope of

section 326.9

Treasury and the Agencies generally

agree with the view expressed by

commenters who suggested that a bank’s

limited resources be focused on

relationships that pose a higher risk of

money laundering and terrorism.

Accordingly, the Agencies have

included an exception to the definition

of ‘‘account’’ for accounts opened for

the purpose of participating in an

employee benefit plan established

pursuant to the Employee Retirement

Income Security Act of 1974

by

commenters who suggested that a bank’s

limited resources be focused on

relationships that pose a higher risk of

money laundering and terrorism.

Accordingly, the Agencies have

included an exception to the definition

of ‘‘account’’ for accounts opened for

the purpose of participating in an

employee benefit plan established

pursuant to the Employee Retirement

Income Security Act of 1974. These

accounts are less susceptible to use for

the financing of terrorism and money

laundering, because, among other

reasons, they are funded through payroll

deductions in connection with

employment plans that must comply

with Federal regulations which impose

various requirements regarding the

funding and withdrawal of funds from

such accounts, including low

contribution limits and strict

distribution requirements.

Section 103.121(a)(2) Bank. The

proposal jointly issued by Treasury and

the Agencies applied to any financial

institution defined as a ‘‘bank’’ in 31

CFR 103.11(c) and subject to regulation

by one of the Agencies, including banks,

savings associations, credit unions, Edge

Act and Agreement corporations, and

branches and agencies of foreign banks.

The proposed definition also included

‘‘any foreign branch of an insured bank’’

to make clear that the procedures

required by the rule would have to be

implemented throughout the bank, no

matter where its offices are located. The

preamble for the proposal explained

that the rule would apply to bank

subsidiaries to the same extent as

existing regulations requiring banks to

have BSA compliance programs.10 As

described above, a second proposal

issued simultaneously by Treasury

applied to certain other financial

institutions defined as a ‘‘bank’’ in 31

CFR 103.11(c), namely, those credit

unions, private banks, and trust

companies that do not have a Federal

functional regulator

to bank

subsidiaries to the same extent as

existing regulations requiring banks to

have BSA compliance programs.10 As

described above, a second proposal

issued simultaneously by Treasury

applied to certain other financial

institutions defined as a ‘‘bank’’ in 31

CFR 103.11(c), namely, those credit

unions, private banks, and trust

companies that do not have a Federal

functional regulator.

Under the final rule, ‘‘bank’’ includes

all financial institutions covered by both

of the proposals described above, except

that ‘‘bank’’ does not include any

foreign branch of an insured U.S. bank.

Several commenters explained that the

proposal to cover foreign branches

might conflict with local laws

applicable to branches of insured banks

operating outside of the United States

and might place U.S. institutions at a

competitive disadvantage. Consistent

with the approach taken with respect to

final regulations implementing other

sections of the Act,11 Treasury and the

Agencies have determined that foreign

branches of insured U.S. banks are not

covered by the final rule. Nevertheless,

Treasury and the Agencies encourage

each bank to implement an effective

CIP, as required by this final rule,

throughout its organization, including

in its foreign branches, except to the

extent that the requirements of the rule

would conflict with local law.

As noted in the preamble for the

proposal, the CIP must be a part of a

bank’s BSA compliance program.

Therefore, it will apply throughout such

a bank’s U.S. operations (including

subsidiaries) in the same way as the

BSA compliance program requirement.

However, all subsidiaries that are in

compliance with a separately

applicable, industry-specific rule

implementing section 326 of the Act

will be deemed to be in compliance

with this final rule.

Section 103.121(a)(3) Customer. The

proposal defined ‘‘customer’’ to mean

any person 12 seeking to open a new

account

ng

subsidiaries) in the same way as the

BSA compliance program requirement.

However, all subsidiaries that are in

compliance with a separately

applicable, industry-specific rule

implementing section 326 of the Act

will be deemed to be in compliance

with this final rule.

Section 103.121(a)(3) Customer. The

proposal defined ‘‘customer’’ to mean

any person 12 seeking to open a new

account. In addition, the proposal

defined a ‘‘customer’’ to include any

signatory on an account. The preamble

for the proposal explained that the term

‘‘customer’’ included a person that

applied to open an account, but not

someone seeking information about an

account, such as rates charged or

interest paid on an account, if the

person did not apply to open an

account. The preamble also stated that

any person seeking to open an account

at a bank, on or after the effective date

of the final rule, would be a ‘‘customer,’’

regardless of whether that person

already had an account at the bank.

This proposed definition prompted a

large number of comments. First, nearly

all commenters recommended that the

Agencies clarify in the text of the final

rule that ‘‘customer’’ does not include a

person who does not receive banking

services, such as a person whose deposit

or loan application is denied. Some of

these commenters suggested that the

rule for banks define ‘‘customer’’ to

mean ‘‘a person who opens a new

account,’’ as did the proposed rules for

broker-dealers, mutual funds, futures

commission merchants and introducing

brokers.

VerDate Jan<31>2003

17:31 May 08, 2003

Jkt 200001

PO 00000

Frm 00005

Fmt 4701

Sfmt 4700

E:\FR\FM\09MYR2.SGM

09MYR2

posit

or loan application is denied. Some of

these commenters suggested that the

rule for banks define ‘‘customer’’ to

mean ‘‘a person who opens a new

account,’’ as did the proposed rules for

broker-dealers, mutual funds, futures

commission merchants and introducing

brokers.

VerDate Jan<31>2003

17:31 May 08, 2003

Jkt 200001

PO 00000

Frm 00005

Fmt 4701

Sfmt 4700

E:\FR\FM\09MYR2.SGM

09MYR2

25094

Federal Register / Vol. 68, No. 90 / Friday, May 9, 2003 / Rules and Regulations

13 Therefore, each person named on a joint

account is a ‘‘customer’’ under this final rule unless

otherwise provided.

14 However, based on a bank’s risk assessment of

a new account opened by a customer that is not an

individual, a bank may need to take additional

steps to verify the identity of the customer by

seeking information about individuals with

ownership or control over the account in order to

identify the customer, as described in

§ 103.121(b)(2)(ii)(C), or may need to look through

the account in connection with the customer due

diligence procedures required under other

provisions of its BSA compliance program.

15 Commenters contended that banks and

individuals would confront numerous practical

problems. Some commenters noted, for example,

that the identification and verification of signatories

could be burdensome for banks because business

accounts might have many signatories and those

signatories would change over time. Some

commenters explained that collecting detailed

information about an employee who is a signatory

would raise privacy concerns for those employees

who would be required to disclose personal

information to their employer’s financial

institutions

of signatories

could be burdensome for banks because business

accounts might have many signatories and those

signatories would change over time. Some

commenters explained that collecting detailed

information about an employee who is a signatory

would raise privacy concerns for those employees

who would be required to disclose personal

information to their employer’s financial

institutions. Other commenters stated that a

signatory rarely is present at the time of account

opening and, consequently, a bank would

encounter substantial obstacles when attempting to

verify the signatory’s identity using any of the most

common methods described in the proposal,

including by examining documents or by obtaining

a credit report. (Under the Fair Credit Reporting Act

(FCRA), a consumer reporting agency generally may

furnish a consumer report in connection with

transactions involving the consumer and no other.

See 15 U.S.C. 1681b. Thus, for example, a bank

would be prohibited from obtaining a credit report

to verify the identity of an authorized user of a

customer’s credit card.)

16 Treasury previously determined that banks

should be exempted from having to file reports of

transactions in currency in connection with these

entities. See 31 CFR 103.22(d)(1).

Treasury and the Agencies agree with

the view expressed by some

commenters that the statute should be

construed to ensure that banks design

procedures to determine the identity of

only those persons who open accounts.

Accordingly, the final rule defines a

‘‘customer’’ as ‘‘a person that opens a

new account.’’ 13 For example, in the

case of a trust account, the ‘‘customer’’

would be the trust. For purposes of this

rule, a bank will not be required to look

through trust, escrow, or similar

accounts to verify the identities of

beneficiaries and instead will only be

required to verify the identity of the

named accountholder.14 In the case of

brokered deposits, the ‘‘customer’’ will

be the broker that opens the deposit

account

a trust account, the ‘‘customer’’

would be the trust. For purposes of this

rule, a bank will not be required to look

through trust, escrow, or similar

accounts to verify the identities of

beneficiaries and instead will only be

required to verify the identity of the

named accountholder.14 In the case of

brokered deposits, the ‘‘customer’’ will

be the broker that opens the deposit

account. A bank will not need to look

through the deposit broker’s account to

determine the identity of each

individual sub-account holder; it need

only verify the identity of the named

accountholder.

Many commenters requested that the

final rule clarify whether ‘‘customer’’

includes a minor child or an informal

group with a common interest, such as

a club account, where there is no legal

entity. The final rule addresses these

comments by providing that ‘‘customer’’

means ‘‘an individual who opens a new

account for (1) an individual who lacks

legal capacity, such as a minor; or (2) an

entity that is not a legal person, such as

a civic club.’’

A few banks stated that defining

‘‘customer’’ to include a signatory was

consistent with their current practice of

verifying the identity of the named

accountholder and any signatory on the

account. However, most commenters

strenuously objected to the inclusion of

a signatory as a customer whose identity

must be verified, and asserted that this

proposed requirement would deviate

significantly from their current business

practices. These commenters stated that

requiring banks to verify signatories on

an account would be enormously

burdensome to the financial institutions

and signatories themselves—many of

whom simply work as employees for

firms with corporate accounts—and

would outweigh any benefit.15 One

commenter asserted that inclusion of

signatories as customers went beyond

the scope of section 326 of the Act

. These commenters stated that

requiring banks to verify signatories on

an account would be enormously

burdensome to the financial institutions

and signatories themselves—many of

whom simply work as employees for

firms with corporate accounts—and

would outweigh any benefit.15 One

commenter asserted that inclusion of

signatories as customers went beyond

the scope of section 326 of the Act.

Although some commenters advocated

that any requirement regarding a

signatory should be omitted altogether,

these commenters generally advocated a

risk-based approach that would give

banks the discretion to determine when

a signatory’s identity should be verified.

Credit card banks, in particular, were

critical of the signatory requirement

because the proposed provision, as

drafted, encompassed all authorized

users of credit cards. These banks

characterized the signatory requirement

as unnecessary in the case of credit card

companies, which, they explained,

already use sophisticated fraud filters to

detect fraud and abnormal use. These

banks also noted that a person need not

be a signatory to use another person’s

credit card, especially when purchasing

products by telephone or over the

Internet. Therefore, the signatory

requirement would not necessarily

ensure that banks would be able to

verify the identity of those using a credit

card account.

After revisiting the issue of whether a

signatory should be a ‘‘customer,’’

Treasury and the Agencies have

determined that requiring a bank to

expend its limited resources on

verifying the identity of all signatories

on accounts could interfere with the

bank’s ability to focus on identifying

customers and accounts that present a

higher risk of not being properly

identified. Accordingly, the proposed

provision defining ‘‘customer’’ to

include a signatory on an account is

deleted

Agencies have

determined that requiring a bank to

expend its limited resources on

verifying the identity of all signatories

on accounts could interfere with the

bank’s ability to focus on identifying

customers and accounts that present a

higher risk of not being properly

identified. Accordingly, the proposed

provision defining ‘‘customer’’ to

include a signatory on an account is

deleted. Instead, the final rule, at

§ 103.121(b)(2)(ii)(C), requires a bank’s

CIP to address situations when the bank

will take additional steps to verify the

identity of a customer that is not an

individual by seeking information about

individuals with authority or control

over the account, including signatories,

in order to verify the customer’s

identity.

In addition to defining who is a

‘‘customer,’’ the final rule contains a list

of entities that will not be deemed

‘‘customers.’’ Many commenters

questioned why a bank should be

required to verify the identity of a

government agency or instrumentality

opening a new account, or of a publicly-

traded company that is subject to SEC

reporting requirements. Consistent with

these and other comments urging that

the final rule focus on requiring

verification of the identity of customers

that present a higher risk of not being

properly identified, the final rule

excludes from the definition of

‘‘customer’’ the following readily

identifiable entities: a financial

institution regulated by a Federal

functional regulator; a bank regulated by

a state bank regulator; and governmental

agencies and instrumentalities, and

companies that are publicly traded

described in § 103.22(d)(2)(ii)–(iv).16

Section 103.22(d)(2)(iv) exempts such

companies only to the extent of their

domestic operations. Accordingly, a

bank’s CIP will apply to any foreign

offices, affiliates, or subsidiaries of such

entities that open new accounts

regulated by

a state bank regulator; and governmental

agencies and instrumentalities, and

companies that are publicly traded

described in § 103.22(d)(2)(ii)–(iv).16

Section 103.22(d)(2)(iv) exempts such

companies only to the extent of their

domestic operations. Accordingly, a

bank’s CIP will apply to any foreign

offices, affiliates, or subsidiaries of such

entities that open new accounts.

A great many commenters also

objected to the requirement in

§ 103.121(b)(2)(ii) of the proposed rule

that a bank verify the identity of an

existing customer seeking to open a new

account unless the bank previously

verified the customer’s identity in

accordance with procedures consistent

with the proposed rule and continues to

have a reasonable belief that it knows

the true identity of the customer. These

commenters asserted that such a

requirement would be burdensome for

the bank and would upset existing

customers. Some commenters

recommended that the rule apply

prospectively to new customers who

previously had no account with the

bank. Many commenters suggested that

the final rule contain a risk-based

approach where verification would not

be required for an existing customer

who opens a new account if the bank

has a reasonable belief that it knows the

identity of the customer, regardless of

the procedures the bank followed to

form this belief.

VerDate Jan<31>2003

17:31 May 08, 2003

Jkt 200001

PO 00000

Frm 00006

Fmt 4701

Sfmt 4700

E:\FR\FM\09MYR2.SGM

09MYR2

nal rule contain a risk-based

approach where verification would not

be required for an existing customer

who opens a new account if the bank

has a reasonable belief that it knows the

identity of the customer, regardless of

the procedures the bank followed to

form this belief.

VerDate Jan<31>2003

17:31 May 08, 2003

Jkt 200001

PO 00000

Frm 00006

Fmt 4701

Sfmt 4700

E:\FR\FM\09MYR2.SGM

09MYR2

25095

Federal Register / Vol. 68, No. 90 / Friday, May 9, 2003 / Rules and Regulations

17 As a foreign branch of an insured U.S. bank is

no longer a ‘‘bank’’ for purposes of this rule, a

customer of a bank’s foreign branch will no longer

be ‘‘a person who has an existing account with the

bank.’’ Therefore, the bank must verify the identity

of a customer of its foreign branch in accordance

with its CIP if such a customer opens a new account

in the U.S.

18 26 U.S.C. 7701(a)(30)(A).

19 See footnote 10, supra.

Treasury and the Agencies

acknowledge that the proposed rule

might have had unintended

consequences for bank-customer

relationships and that the risk-based

approach suggested by commenters

would avoid these consequences.

Accordingly, the final rule excludes

from the definition of ‘‘customer’’ a

person that has an existing account with

the bank, provided that the bank has a

reasonable belief that it knows the true

identity of the person.17

Section 103.121(a)(4) Federal

functional regulator. The proposed rule

defined ‘‘Federal functional regulator’’

by reference to § 103.120(a)(2), meaning

each of the Agencies, the SEC, and the

CFTC. There were no comments on this

definition, and Treasury and the

Agencies have adopted it as proposed.

Section 103.121(a)(5) Financial

institution. The final rule includes a

new definition for the term ‘‘financial

institution’’ that cross-references the

BSA, 31 U.S.C. 5312(a)(2) and (c)(1)

al regulator’’

by reference to § 103.120(a)(2), meaning

each of the Agencies, the SEC, and the

CFTC. There were no comments on this

definition, and Treasury and the

Agencies have adopted it as proposed.

Section 103.121(a)(5) Financial

institution. The final rule includes a

new definition for the term ‘‘financial

institution’’ that cross-references the

BSA, 31 U.S.C. 5312(a)(2) and (c)(1).

This is a more expansive definition of

‘‘financial institution’’ than that in 31

CFR 103.11, and includes entities such

as futures commission merchants and

introducing brokers.

Section 103.121(a)(6) Taxpayer

identification number. The proposed

rule repeated the language from

§ 103.34(a)(4), which states that the

provisions of section 6109 of the

Internal Revenue Code and the

regulations of the Internal Revenue

Service thereunder determine what

constitutes ‘‘a taxpayer identification

number.’’ There were no comments on

this approach, and Treasury and the

Agencies have adopted it substantially

as proposed, with minor technical

modifications.

Section 103.121(a)(7) and (8) U.S.

Person and non-U.S. person. The

proposed rule provided that ‘‘U.S.

person’’ is an individual who is a U.S.

citizen, or an entity established or

organized under the laws of a State or

the United States. A ‘‘non-U.S. person’’

was defined as a person who did not

satisfy either of these criteria.

As described in greater detail below,

a bank is generally required to obtain a

U.S. taxpayer identification number

from a customer who opens a new

account. However, if the customer is a

non-U.S. person and does not have such

a number, the bank may obtain an

identification number from some other

form of government-issued document

evidencing nationality or residence and

bearing a photograph or similar

safeguard.

Several commenters suggested that it

would be less confusing to bankers if

‘‘U.S. person’’ meant both a U.S

ho opens a new

account. However, if the customer is a

non-U.S. person and does not have such

a number, the bank may obtain an

identification number from some other

form of government-issued document

evidencing nationality or residence and

bearing a photograph or similar

safeguard.

Several commenters suggested that it

would be less confusing to bankers if

‘‘U.S. person’’ meant both a U.S. citizen

and a resident alien, consistent with the

definition of this term used in the

Internal Revenue Code (IRS

definition).18 A few commenters

criticized the proposed definition

because it would require banks to

establish whether a customer is or is not

a U.S. citizen.

Treasury and the Agencies believe

that the proposed definition of ‘‘U.S.

person’’ is a better standard for purposes

of this final rule than the IRS definition.

Adoption of the IRS definition of ‘‘U.S.

person’’ would require bank staff to

distinguish among various tax and

immigration categories in connection

with any type of account that is opened.

Under the proposed definition, a bank

will not necessarily need to establish

whether a potential customer is a U.S.

citizen. The bank will have to ask each

customer for a U.S. taxpayer

identification number (social security

number, employer identification

number, or individual taxpayer

identification number). If a customer

cannot provide one, the bank may then

accept alternative forms of

identification. For these reasons, the

definition is adopted as proposed.

Section 103.121(b) Customer

Identification Program: Minimum

Requirements

Section 103.121(b)(1) General Rule.

The proposed rule required each bank to

implement a CIP that is appropriate

given the bank’s size, location, and type

of business. The proposed rule required

a bank’s CIP to contain the statutorily

prescribed procedures, described these

procedures, and detailed certain

minimum elements that each of the

procedures must contain

ram: Minimum

Requirements

Section 103.121(b)(1) General Rule.

The proposed rule required each bank to

implement a CIP that is appropriate

given the bank’s size, location, and type

of business. The proposed rule required

a bank’s CIP to contain the statutorily

prescribed procedures, described these

procedures, and detailed certain

minimum elements that each of the

procedures must contain. In addition,

the proposed rule required that the CIP

be written and that it be approved by

the bank’s board of directors or a

committee of the board.

The proposed rule also stated that the

CIP must be incorporated into the

bank’s BSA 19 compliance program and

should not be a separate program. A

bank’s BSA compliance program must

be written, approved by the board, and

noted in the bank’s minutes. It must

include (1) internal policies,

procedures, and controls to ensure

ongoing compliance; (2) designation of

a compliance officer; (3) an ongoing

employee training program; and (4) an

independent audit function to test

programs. The preamble for the

proposal explained that the CIP should

be incorporated into each of these four

elements of a bank’s BSA program.

Most commenters agreed with the

proposal’s approach of allowing banks

to develop risk-based programs tailored

to their specific operation, though some

of these commenters recommended that

Treasury and the Agencies adopt an

entirely risk-based approach without

any minimum requirements while

others recommended a more

prescriptive approach. Many

commenters suggested that Treasury

and the Agencies clarify the extent to

which a bank could rely on a third

party, especially an affiliate, to perform

some or all aspects of its CIP.

Other commenters focused on the

requirement that a bank’s board of

directors approve the CIP

risk-based approach without

any minimum requirements while

others recommended a more

prescriptive approach. Many

commenters suggested that Treasury

and the Agencies clarify the extent to

which a bank could rely on a third

party, especially an affiliate, to perform

some or all aspects of its CIP.

Other commenters focused on the

requirement that a bank’s board of

directors approve the CIP. These

commenters urged Treasury and the

Agencies to adopt a regulation that

states that the role of a bank’s board of

directors need only be to approve broad

policy rather than the specific methods

or actual procedures that will be a part

of a bank’s CIP. One commenter

recommended that the governing body

of a financial institution be permitted to

delegate its responsibility to approve the

CIP.

The final rule attempts to strike an

appropriate balance between flexibility

and detailed guidance by allowing a

bank broad latitude to design and

implement a CIP that is tailored to its

particular business practices while

providing a framework of minimum

standards for identifying each customer,

as the Act mandates. Following the

description of the procedures and

minimum requirements for each

element of a bank’s CIP (identity

verification, recordkeeping, comparison

with government lists, and customer

notice), the final rule contains a new

section describing the extent to which a

bank may rely on a third party to

perform these elements, described in

detail below.

The final rule removes the

requirement that the bank’s board of

directors or a committee of the board

must approve the bank’s CIP because

this requirement is redundant. A bank’s

BSA compliance program must already

be approved by the board. Treasury and

the Agencies regard the addition of a

CIP to the bank’s BSA compliance

program to be a material change in the

BSA compliance program that will

require board approval

equirement that the bank’s board of

directors or a committee of the board

must approve the bank’s CIP because

this requirement is redundant. A bank’s

BSA compliance program must already

be approved by the board. Treasury and

the Agencies regard the addition of a

CIP to the bank’s BSA compliance

program to be a material change in the

BSA compliance program that will

require board approval. The board of

director’s responsibility to oversee bank

compliance with section 326 of the Act

VerDate Jan<31>2003

17:31 May 08, 2003

Jkt 200001

PO 00000

Frm 00007

Fmt 4701

Sfmt 4700

E:\FR\FM\09MYR2.SGM

09MYR2

25096

Federal Register / Vol. 68, No. 90 / Friday, May 9, 2003 / Rules and Regulations

20 See footnote 10, supra.

21 The final rule therefore provides that until such

time as credit unions, private banks, and trust

companies without a Federal functional regulator

are subject to such a program, their CIPs must be

approved by their boards of directors.

22 Other elements of the bank’s CIP, such as

procedures for recordkeeping or checking of

government lists, are requirements that may not

vary depending on risk factors.

23 H.R. Rep. No. 107–250, pt. 1, at 62 and 63

(2001).

is a part of a board’s conventional

supervisory BSA compliance

responsibilities that cannot be delegated

to bank management. Therefore, a

bank’s board of directors must be

responsible for approving a CIP

described in detail sufficient for the

board to determine that (1) the bank’s

CIP contains the minimum requirements

of this final rule; and (2) the bank’s

identity verification procedures are

designed to enable the bank to form a

reasonable belief that it knows the true

identity of the customer. Nevertheless,

responsibility for the development,

implementation, and day-to-day

administration of the CIP may be

delegated to bank management

etermine that (1) the bank’s

CIP contains the minimum requirements

of this final rule; and (2) the bank’s

identity verification procedures are

designed to enable the bank to form a

reasonable belief that it knows the true

identity of the customer. Nevertheless,

responsibility for the development,

implementation, and day-to-day

administration of the CIP may be

delegated to bank management.

The final rule will apply to some non-

Federally regulated banks that are not

yet subject to an anti-money laundering

compliance program requirement.20

Therefore, the final rule only requires

that the CIP be a part of a bank’s anti-

money laundering program once a bank

becomes subject to an anti-money

laundering compliance program

requirement.21

Section 103.121(b)(2) Identity

Verification Procedures. The proposed

rule provided that each bank must have

a CIP that includes procedures for

verifying the identity of each customer,

to the extent reasonable and practicable,

based on the bank’s assessment of

certain risks. The proposed rule stated

that these procedures must enable the

bank to form a reasonable belief that it

knows the true identity of the customer.

Some commenters recommended that

the identity verification requirement be

waived for new customers that are well

known to a senior officer of the bank.

Some of these commenters endorsed

such a waiver provided that a bank

employee could provide ‘‘an affidavit of

identity’’ on behalf of the customer.

One commenter criticized the

standard requiring a bank to have

identity verification procedures ‘‘that

enable the bank to form a reasonable

belief that it knows the true identity of

the customer’’ as too subjective. This

commenter suggested that a better

standard would be lack of affirmative

notice of deficiency in the identity

process

affidavit of

identity’’ on behalf of the customer.

One commenter criticized the

standard requiring a bank to have

identity verification procedures ‘‘that

enable the bank to form a reasonable

belief that it knows the true identity of

the customer’’ as too subjective. This

commenter suggested that a better

standard would be lack of affirmative

notice of deficiency in the identity

process. Another commenter suggested

that the rule make clear that a bank is

only required to verify a customer’s

identity, to the extent reasonable and

practical, in order to establish that it has

a reasonable basis for knowing the true

identity of its customer.

The final rule provides that a bank’s

CIP must include risk-based procedures

for verifying the identity of each

customer 22 to the extent reasonable and

practicable. The final rule also states

that the procedures must enable the

bank to form a reasonable belief that it

knows the true identity of the customer.

As section 326 of the Act states, a bank’s

affirmative obligation to verify the

identity of its customer applies to ‘‘any

person’’ rather than only to a person

whose identity is suspect, as suggested

by one commenter. Furthermore,

Treasury and the Agencies have

determined that the statutory obligation

to ‘‘verify the identity of any person’’

requires the bank to implement and

follow procedures that allow the bank to

have a reasonable belief that it knows

the true identity of the customer.

Given the flexibility built into the

final rule, Treasury and the Agencies

believe that it is not appropriate to

provide special treatment for new

customers known to bank personnel. In

addition, permitting reliance on bank

personnel to attest to the identity of a

customer may be subject to

manipulation. Accordingly, the final

rule does not establish different rules for

customers who are known to bank

personnel

ilt into the

final rule, Treasury and the Agencies

believe that it is not appropriate to

provide special treatment for new

customers known to bank personnel. In

addition, permitting reliance on bank

personnel to attest to the identity of a

customer may be subject to

manipulation. Accordingly, the final

rule does not establish different rules for

customers who are known to bank

personnel.

The final rule requires the identity

verification procedures to be based

upon relevant risks, including those

presented by the types of accounts

maintained by the bank, the various

methods of opening accounts provided

by the bank, and the types of identifying

information available. In addition to

these risk factors, which are specifically

identified in section 326, the final rule

states that the procedures should take

into account the bank’s size, location,

and type of business or customer base,

additional factors mentioned in the

Act’s legislative history.23

Section 103.121(b)(2)(i) Customer

Information Required. The proposed

rule required that a bank’s CIP must

contain procedures that specify the

identifying information the bank must

obtain from a customer. It stated that, at

a minimum, a bank must obtain from

each customer the following

information prior to opening an

account: (1) Name; (2) address (a

residential and mailing address for

individuals, and principal place of

business and mailing address for a

person other than an individual); (3)

date of birth for individuals; and (4) an

identification number.

Treasury and the Agencies received a

variety of comments criticizing the

requirement that a bank obtain certain

minimum identifying information prior

to opening an account

ress (a

residential and mailing address for

individuals, and principal place of

business and mailing address for a

person other than an individual); (3)

date of birth for individuals; and (4) an

identification number.

Treasury and the Agencies received a

variety of comments criticizing the

requirement that a bank obtain certain

minimum identifying information prior

to opening an account. Some

commenters, including a trade

association representing large financial

institutions, recommended that a bank

be permitted to open an account for a

customer who lacks some of the

minimum identifying information,

provided that the bank has formed a

reasonable belief that it knows the true

identity of the customer. Credit card

banks explained that the minimum

information requirement would create

problems for retailers that offer credit

cards at the point of sale. These

commenters stated that retailers were

not likely to have the means to record

identifying information other than what

is currently collected. They suggested

that when there are systems in place to

identify customers and detect

suspicious transactions, the rule should

require only the collection of

information that the credit card bank or

card issuer deems necessary and

appropriate to identify the customer.

Other commenters stated that the rule

should not require a bank to obtain the

minimum identifying information prior

to account opening in every instance.

Some of these commenters suggested

that a bank be permitted to obtain the

required information within a

reasonable time after the account is

opened. Some commenters suggested

that the rule permit banks to obtain

identifying information from a party

other than the customer. This would

arise, for example, when a bank offers

a credit card based on information

obtained from a credit reporting agency

these commenters suggested

that a bank be permitted to obtain the

required information within a

reasonable time after the account is

opened. Some commenters suggested

that the rule permit banks to obtain

identifying information from a party

other than the customer. This would

arise, for example, when a bank offers

a credit card based on information

obtained from a credit reporting agency.

Other commenters suggested that a bank

also be required to obtain information

about a customer’s occupation,

profession or business, as this

information is needed by a bank that

intends to file a report of transactions in

currency or a suspicious activities

report on the customer.

Consistent with the proposal, the final

rule provides that a bank’s CIP must

contain procedures that specify the

identifying information that the bank

must obtain from each customer prior to

opening an account. In addition, the

rule specifies the four basic categories of

information that a bank must obtain

from the customer prior to opening an

account. Treasury and the Agencies

believe that requiring banks to gather

these standard forms of information

prior to opening an account is not

overly burdensome because such

identifying information is routinely

VerDate Jan<31>2003

17:31 May 08, 2003

Jkt 200001

PO 00000

Frm 00008

Fmt 4701

Sfmt 4700

E:\FR\FM\09MYR2.SGM

09MYR2

25097

Federal Register / Vol. 68, No. 90 / Friday, May 9, 2003 / Rules and Regulations

24 H.R. Rep. No. 107–250, pt. 1, at 63 (2001).

gathered by most banks in the account

opening process and is required by

other sections of 31 CFR part 103. Of

course, based upon an assessment of the

risks described above, a bank may

require a customer to provide additional

information to establish the customer’s

identity

gister / Vol. 68, No. 90 / Friday, May 9, 2003 / Rules and Regulations

24 H.R. Rep. No. 107–250, pt. 1, at 63 (2001).

gathered by most banks in the account

opening process and is required by

other sections of 31 CFR part 103. Of

course, based upon an assessment of the

risks described above, a bank may

require a customer to provide additional

information to establish the customer’s

identity.

Treasury and the Agencies

acknowledge that imposing this

requirement on banks that offer credit

card accounts is likely to alter the

manner in which they do business by

requiring them to gather additional

information beyond that which they

currently obtain directly from a

customer who opens an account at the

point of sale or by telephone. Treasury

and the Agencies are mindful of the

legislative history of section 326, which

indicates that Congress expected the

regulations implementing this section to

be appropriately tailored for accounts

opened in situations where the account

holder is not physically present at the

financial institution and that the

regulations should not impose

requirements that are burdensome,

prohibitively expensive, or

impractical.24

Therefore, Treasury and the Agencies

have included an exception in the final

rule for credit card accounts only,

which would allow a bank broader

latitude to obtain some information

from the customer opening a credit card

account, and the remaining information

from a third party source, such as a

credit reporting agency, prior to

extending credit to a customer. Treasury

and the Agencies recognize that these

practices have produced an efficient and

effective means of extending credit with

little risk that the lender does not know

the identity of the borrower.

Treasury and the Agencies also

received comments on the advisability

of requiring banks to collect the specific

identifying information (name, date of

birth, address, and identification

number), as would have been required

under the proposed rule

have produced an efficient and

effective means of extending credit with

little risk that the lender does not know

the identity of the borrower.

Treasury and the Agencies also

received comments on the advisability

of requiring banks to collect the specific

identifying information (name, date of

birth, address, and identification

number), as would have been required

under the proposed rule. With respect to

obtaining the customer’s name, one

commenter recommended that based on

Texas law and banks’ experience, a bank

should be required to obtain the name

under which the customer is doing

business and the customer’s legal name.

The final rule continues to require that

the bank obtain the customer’s name,

meaning a legal name that can be

verified. As noted above, this is a

minimum requirement, and a bank may

also need to obtain the name under

which a person does business in order

to establish a reasonable belief it knows

the true identity of the customer.

One trade association suggested that

banks be permitted to make a risk-based

determination before requiring a

customer to provide date of birth

because many customers would prefer

not to share this information. One

commenter stated that date of birth is

not an important identifying

characteristic and should be deleted.

Another commenter stated that credit

card issuers do not request this

information because it can raise fair

lending issues. Finally, a few

commenters noted that standardized

mortgage applications require age rather

than date of birth and would have to be

altered.

The final rule provides that a bank

must obtain the date of birth for a

customer who is an individual. Treasury

and the Agencies believe that date of

birth is an important identifying

characteristic and can be used to

provide a bank or law enforcement with

an additional means to distinguish

between customers with identical

names

e rather

than date of birth and would have to be

altered.

The final rule provides that a bank

must obtain the date of birth for a

customer who is an individual. Treasury

and the Agencies believe that date of

birth is an important identifying

characteristic and can be used to

provide a bank or law enforcement with

an additional means to distinguish

between customers with identical

names. However, the required collection

and retention of information about a

customer’s date of birth does not relieve

the bank from its obligations to comply

with anti-discrimination laws or

regulations, such as the prohibition in

the Equal Credit Opportunity Act

against discrimination in any aspect of

a credit transaction on the basis of age

or other prohibited classification. Banks

collecting date of birth from individual

customers should be able to take

reasonable measures to convert this

information into age for purposes of the

forms used in the secondary mortgage

market given the delayed compliance

date for the final rule.

Many commenters criticized the

requirement that a bank obtain both the

customer’s physical and mailing

address, if different. Most commenters

urged Treasury and the Agencies to

eliminate the requirement that the

customer provide a physical address.

Some of these commenters stated that

this requirement could interfere with

the ability of certain segments of the

population to obtain a bank account,

such as members of the military,

persons who reside in mobile homes

with no fixed address, and truck drivers

who do not have a physical address.

Banks that offer credit card accounts

and card issuers stated that the address

requirement would be extremely

burdensome because they would have to

change the manner in which they do

business, and in some cases, credit card

banks currently do not have the capacity

to collect both addresses

reside in mobile homes

with no fixed address, and truck drivers

who do not have a physical address.

Banks that offer credit card accounts

and card issuers stated that the address

requirement would be extremely

burdensome because they would have to

change the manner in which they do

business, and in some cases, credit card

banks currently do not have the capacity

to collect both addresses. Some of these

commenters stated that new credit card

customers are reluctant to give more

than one address and, therefore, it

would be difficult to obtain this

information from customers. A trade

association representing credit card

banks asserted that customers may have

a legitimate reason for handling

correspondence through post office

boxes and should not have to provide a

physical address. This commenter

asserted that requiring the customer to

provide a physical address will

discourage the provision of financial

services to the unbanked and will

prevent a victim of identity theft from

using an alternative to an unsecured

home mailbox. Another commenter

noted that the physical address of a

customer’s principal place of business

may not be relevant if the bank is

working with a customer’s local office.

This commenter recommended that the

rule simply permit the bank to obtain

the customer’s street address. Credit

card banks and issuers urged Treasury

and the Agencies to make the

requirement that a bank obtain the

customer’s physical address optional.

Section 326 of the Act requires

Treasury and the Agencies to prescribe

regulations that require financial

institutions to implement ‘‘reasonable

procedures.’’ Accordingly, under the

final rule, a bank will not be required

to obtain more than a single address for

a customer

rged Treasury

and the Agencies to make the

requirement that a bank obtain the

customer’s physical address optional.

Section 326 of the Act requires

Treasury and the Agencies to prescribe

regulations that require financial

institutions to implement ‘‘reasonable

procedures.’’ Accordingly, under the

final rule, a bank will not be required

to obtain more than a single address for

a customer. Nonetheless, Treasury and

the Agencies believe that the

identification, verification, and

recordkeeping provisions of the Act,

taken together, should provide

appropriate resources for law

enforcement agencies to investigate

money laundering and terrorist

financing. The final rule therefore

provides that a bank generally must

obtain a residential or business street

address for a customer who is an

individual because Treasury and the

Agencies have determined that law

enforcement agencies should be able to

contact an individual customer at a

physical location, rather than solely

through a mailing address. Treasury and

the Agencies recognize that this

provision may be impracticable for

members of the military who cannot

readily provide a physical address, and

other individuals who do not have a

physical address but who reliably can

be contacted. Accordingly, the final rule

provides an exception under these

circumstances that allows a bank to

obtain an Army Post Office or Fleet Post

Office box number, or the residential or

business street address of next of kin or

of another contact individual. For a

customer other than an individual, such

as a corporation, partnership, or trust,

the bank may obtain the address of the

principal place of business, local office,

VerDate Jan<31>2003

17:31 May 08, 2003

Jkt 200001

PO 00000

Frm 00009

Fmt 4701

Sfmt 4700

E:\FR\FM\09MYR2.SGM

09MYR2

e box number, or the residential or

business street address of next of kin or

of another contact individual. For a

customer other than an individual, such

as a corporation, partnership, or trust,

the bank may obtain the address of the

principal place of business, local office,

VerDate Jan<31>2003

17:31 May 08, 2003

Jkt 200001

PO 00000

Frm 00009

Fmt 4701

Sfmt 4700

E:\FR\FM\09MYR2.SGM

09MYR2

25098

Federal Register / Vol. 68, No. 90 / Friday, May 9, 2003 / Rules and Regulations

25 The rule provides this flexibility because there

is no uniform identification number that non-U.S.

persons would be able to provide to a bank. See

Treasury Department, ‘‘A Report to Congress in

Accordance with Section 326(b) of the USA

PATRIOT Act,’’ October 21, 2002.

or other physical location of the

customer. Of course, a bank is free to

obtain additional addresses from the

customer, such as the customer’s

mailing address, to meet its own or its

customer’s business needs.

The proposal required that banks

obtain an identification number from

customers. For U.S. persons, a bank

would have been required to obtain a

U.S. taxpayer identification number. For

non-U.S. persons, a bank would have

been required to obtain a number from

various alternative forms of government-

issued identification.

One commenter stated that this

requirement would not be burdensome.

Commenters representing certain

consumer advocacy groups commended

Treasury and the Agencies for providing

banks with the discretion to accept

alternative forms of identifying

information from non-U.S. citizens.

These commenters stated that this

position would assist low-income

immigrants in gaining financial

stability. By contrast, some commenters

stated that the final rule should not

permit a bank to open an account for a

customer using only a foreign

identification number when the

customer provides a U.S. address

to accept

alternative forms of identifying

information from non-U.S. citizens.

These commenters stated that this

position would assist low-income

immigrants in gaining financial

stability. By contrast, some commenters

stated that the final rule should not

permit a bank to open an account for a

customer using only a foreign

identification number when the

customer provides a U.S. address. Other

commenters asked for guidance on

whether a bank is permitted to accept a

number from the identification

document issued by a foreign

government. A few commenters urged

the government to require a national

identification document for all

individuals.

Other commenters, primarily credit

card banks, stated that the requirement

that a bank obtain a U.S. taxpayer

identification number from U.S. persons

would create considerable hardship.

They stated that new credit card

customers are reluctant to give out their

social security numbers, especially over

the telephone. They urged that banks be

given the discretion to collect

identifying information, other than

social security numbers, when

appropriate in light of consumer privacy

and security concerns. In the

alternative, they recommended that

banks be permitted to obtain a U.S.

taxpayer identification number for U.S.

persons from a trusted third party

source, such as a credit reporting

agency.

Some commenters questioned what

number to use for accounts opened in

the name of a bowling league or class

reunion, or to accept donations for a

special cause. Other commenters

questioned what number could be

obtained from foreign businesses and

enterprises that have no taxpayer

identification number or other

government-issued documentation.

The final rule provides that a bank

must obtain an ‘‘identification number’’

from every customer

ccounts opened in

the name of a bowling league or class

reunion, or to accept donations for a

special cause. Other commenters

questioned what number could be

obtained from foreign businesses and

enterprises that have no taxpayer

identification number or other

government-issued documentation.

The final rule provides that a bank

must obtain an ‘‘identification number’’

from every customer. As discussed

above, under the definition of

‘‘customer,’’ the final rule permits a

bank to obtain the identification number

of the individual who opens an account

in the name of an individual who lacks

legal capacity, such as a minor, or a

civic group, such as a bowling league.

After reviewing the comments,

Treasury and the Agencies have

determined that requiring a bank to

obtain a customer’s identification

number, such as a social security

number, from the customer himself or

herself, in every case, including over the

telephone, would be unreasonable and

impracticable because it would be

contrary to banks’ current practices and

could alienate many potential

customers. Accordingly, Treasury and

the Agencies have adopted an exception

for credit card accounts that will permit

a bank offering such accounts to acquire

information about the customer,

including an identification number,

from a trusted third party source prior

to extending credit to the customer,

rather than having to obtain this

information directly from the customer

prior to opening an account.

The final rule also provides that for a

non-U.S. person, a bank must obtain one

or more of the following: A taxpayer

identification number (social security

number, individual taxpayer

identification number, or employer

identification number); passport number

and country of issuance; alien

identification card number; or number

and country of issuance of any other

government-issued document

evidencing nationality or residence and

bearing a photograph or similar

safeguard

ore of the following: A taxpayer

identification number (social security

number, individual taxpayer

identification number, or employer

identification number); passport number

and country of issuance; alien

identification card number; or number

and country of issuance of any other

government-issued document

evidencing nationality or residence and

bearing a photograph or similar

safeguard. This standard provides a

bank with some flexibility to choose

among a variety of identification

numbers that it may accept from a non-

U.S. person.25 However, the identifying

information the bank accepts must

permit the bank to establish a

reasonable belief that it knows the true

identity of the customer.

Treasury and the Agencies emphasize

that the final rule neither endorses nor

prohibits bank acceptance of

information from particular types of

identification documents issued by

foreign governments. A bank must

decide for itself, based upon appropriate

risk factors, including those discussed

above (the types of accounts maintained

by the bank, the various methods of

opening accounts provided by the bank,

the other types of identifying

information available, and the bank’s

size, location, and customer base),

whether the information presented by a

customer is reliable.

Treasury and the Agencies recognize

that a foreign business or enterprise may

not have a taxpayer identification

number or any other number from a

government-issued document

evidencing nationality or residence and

bearing a photograph or similar

safeguard. Therefore, the final rule notes

that when opening an account for such

a customer, the bank must request

alternative government-issued

documentation certifying the existence

of the business or enterprise.

The proposal also contained a limited

exception to the requirement that a bank

obtain a taxpayer identification number

from a customer opening a new account

tograph or similar

safeguard. Therefore, the final rule notes

that when opening an account for such

a customer, the bank must request

alternative government-issued

documentation certifying the existence

of the business or enterprise.

The proposal also contained a limited

exception to the requirement that a bank

obtain a taxpayer identification number

from a customer opening a new account.

The exception permitted a bank to open

an account for a person other than an

individual (such as a corporation,

partnership, or trust) that has applied

for, but has not received, an employer

identification number (EIN), provided

that the bank obtains a copy of the

application before it opens the account

and obtains the EIN within a reasonable

period of time after the account is

established. The preamble for the

proposed rule explained that this

exception was included for a new

business that might need access to

banking services, particularly a bank

account or an extension of credit, before

it has received an EIN from the Internal

Revenue Service.

Some commenters questioned this

limited exception for certain businesses.

A few commenters suggested expanding

the exception to include individuals

who have applied for, but have not yet

received a taxpayer identification

number. Another commenter stated that

the exception provided no added benefit

and would add to a bank’s

recordkeeping and monitoring burden.

Treasury and the Agencies have

determined that a bank should be

afforded more flexibility in situations

where a person, including an

individual, has applied for, but has not

yet received, a taxpayer identification

number

d a taxpayer identification

number. Another commenter stated that

the exception provided no added benefit

and would add to a bank’s

recordkeeping and monitoring burden.

Treasury and the Agencies have

determined that a bank should be

afforded more flexibility in situations

where a person, including an

individual, has applied for, but has not

yet received, a taxpayer identification

number. Therefore, the final rule states

that instead of obtaining a taxpayer

identification number from a customer

prior to opening an account, the CIP

may include procedures for opening an

account for a customer (including an

individual) that has applied for, but has

not received, a taxpayer identification

VerDate Jan<31>2003

17:31 May 08, 2003

Jkt 200001

PO 00000

Frm 00010

Fmt 4701

Sfmt 4700

E:\FR\FM\09MYR2.SGM

09MYR2

25099

Federal Register / Vol. 68, No. 90 / Friday, May 9, 2003 / Rules and Regulations

26 This position is analogous to that in regulations

issued by the Internal Revenue Service (IRS)

concerning ‘‘awaiting-TIN [taxpayer identification

number] certificates.’’ The IRS permits a taxpayer

to furnish an ‘‘awaiting-TIN certificate’’ in lieu of

a taxpayer identification number to exempt the

taxpayer from the withholding of taxes owed on

reportable payments (i.e., interest and dividends)

on certain accounts. See 26 CFR 31.3406(g)–3.

27 For example, the bank may wish to examine a

copy of the application filed.

28 The preamble for the proposed rule noted that,

although an account may be opened, it is common

practice among banks to place limits on the

account, such as by restricting the number of

transactions or the dollar value of transactions,

until a customer’s identity is verified. Therefore, the

proposed regulation provided the bank with the

flexibility to use a risk-based approach to determine

how soon identity must be verified.

29 It is possible that a bank would, however,

violate other laws by permitting a customer to

transact business prior to verifying the customer’s

identity

nsactions or the dollar value of transactions,

until a customer’s identity is verified. Therefore, the

proposed regulation provided the bank with the

flexibility to use a risk-based approach to determine

how soon identity must be verified.

29 It is possible that a bank would, however,

violate other laws by permitting a customer to

transact business prior to verifying the customer’s

identity. See, e.g., 31 CFR part 500 (regulations of

Treasury’s Office of Foreign Asset Control (OFAC)

prohibiting transactions involving designated

foreign countries or their nationals).

number.26 To lessen the recordkeeping

burden for a bank that elects to use this

exception, the final rule also provides

that the bank’s CIP need only include

procedures requiring the bank to

confirm that the application was filed

before the customer opens the account

and to obtain the taxpayer identification

number within a reasonable period of

time after the account is opened. Thus,

a bank will be able to exercise its

discretion 27 to determine how to

confirm that a customer has filed an

application for a taxpayer identification

number rather than having to keep a

copy of the application on file.

Section 103.121(b)(2)(ii) Customer

Verification. The proposed rule

provided that the CIP must contain risk-

based procedures for verifying the

information that the bank obtains in

accordance with § 103.121(b)(2)(i),

within a reasonable period of time after

the account is opened.28 The proposed

rule also described when a bank is

required to verify the identity of existing

customers.

Several commenters asked Treasury

and the Agencies to underscore that

these verification procedures may be

risk-based by noting that a bank may

verify less than all of the identifying

information provided by the customer.

Many commenters noted that there is

currently no reliable, efficient, or

effective means of verifying a customer’s

social security number

dentity of existing

customers.

Several commenters asked Treasury

and the Agencies to underscore that

these verification procedures may be

risk-based by noting that a bank may

verify less than all of the identifying

information provided by the customer.

Many commenters noted that there is

currently no reliable, efficient, or

effective means of verifying a customer’s

social security number. Some of these

commenters asked the government to

establish a method that would permit

banks to establish the authenticity and

accuracy of a customer’s name and

taxpayer identification number.

Treasury and the Agencies recognize

that there currently is no method that

would permit a bank to verify, for

example, a taxpayer identification,

passport or alien identification number

through an official source. Accordingly,

the final rule provides that a bank’s CIP

must contain procedures for verifying

the identity of the customer, ‘‘using the

information obtained in accordance

with paragraph (b)(2)(i),’’ namely, the

identifying information obtained by the

bank. Thus, a bank need not establish

the accuracy of every element of

identifying information obtained but

must do so for enough information to

form a reasonable belief it knows the

true identity of the customer.

Some commenters stated that they

appreciated the flexibility of the

proposal permitting an institution to

determine how soon identity must be

verified. Other commenters asked

Treasury and the Agencies to clarify

what is a ‘‘reasonable period of time.’’

As stated in the preamble for the

proposal, Treasury and the Agencies

believe that the amount of time it will

take an institution to verify a customer’s

identity may depend upon various

factors, such as the type of account

opened, whether the customer is

physically present when the account is

opened, and the type of identifying

information available

at is a ‘‘reasonable period of time.’’

As stated in the preamble for the

proposal, Treasury and the Agencies

believe that the amount of time it will

take an institution to verify a customer’s

identity may depend upon various

factors, such as the type of account

opened, whether the customer is

physically present when the account is

opened, and the type of identifying

information available. For the same

reasons, the final rule provides banks

with the flexibility necessary to

accommodate a wide range of situations

by stating that the bank must verify the

identifying information within a

reasonable time after the account is

opened.29

As discussed above in the definition

section, many commenters criticized the

proposed approach regarding

verification of existing customers that

open new accounts. The final rule

addresses these concerns by modifying

the definition of ‘‘customer’’ to exclude

a person who has an existing account

with the bank if the bank has a

reasonable belief that it knows the true

identity of the person.

Many commenters urged that the final

rule continue to allow, but not mandate,

documentary verification. A few

commenters requested that the final rule

provide additional guidance on

verification. Some commenters asked

that the final rule clarify that a bank

may choose to use only documentary

methods and may refuse to open an

account using other methods.

The final rule addresses these

comments by stating that a bank’s CIP’s

verification procedures must describe

when the bank will use documents,

non-documentary methods, or a

combination of both methods to verify

a customer’s identity.

Section 103.121(b)(2)(ii)(A)

Verification Through Documents. The

proposed rule provided that the CIP

must contain procedures describing

when the bank will verify identity

through documents and setting forth the

documents that the bank will use for

this purpose

be

when the bank will use documents,

non-documentary methods, or a

combination of both methods to verify

a customer’s identity.

Section 103.121(b)(2)(ii)(A)

Verification Through Documents. The

proposed rule provided that the CIP

must contain procedures describing

when the bank will verify identity

through documents and setting forth the

documents that the bank will use for

this purpose. It then gave examples of

documents that could be used to verify

the identity of individuals and other

persons such as corporations,

partnerships, and trusts.

Most commenters noted that banks do

not have the means to authenticate or

validate documents provided by their

customers and urged Treasury and the

Agencies to clarify that document

authentication is not a CIP requirement.

Treasury and the Agencies wish to

confirm that once a bank has obtained

and verified the identity of the customer

through a document such as a driver’s

license or passport, the bank will not be

required to take steps to determine

whether the document has been validly

issued. A bank generally may rely on

government-issued identification as

verification of a customer’s identity;

however, if a document shows obvious

indications of fraud, the bank must

consider that factor in determining

whether it can form a reasonable belief

that it knows the customer’s true

identity.

Some commenters also asked that

Treasury and the Agencies provide more

examples and discuss appropriate types

of documentary identification in the

final rule or in separate guidance that

banks may easily access. Commenters

asked whether a utility bill, or library

card addressed to the same physical

address and name of the person seeking

the account, or a foreign identification

card, such as a foreign voter registration

card or driver’s license, would be

acceptable. Some commenters

questioned whether copies of

documents would suffice

inal rule or in separate guidance that

banks may easily access. Commenters

asked whether a utility bill, or library

card addressed to the same physical

address and name of the person seeking

the account, or a foreign identification

card, such as a foreign voter registration

card or driver’s license, would be

acceptable. Some commenters

questioned whether copies of

documents would suffice.

Given the recent increases in identity

theft and the availability of fraudulent

documents, Treasury and the Agencies

agree with a commenter who suggested

that the value of documentary

verification is enhanced by redundancy.

The rule gives examples of types of

documents that are considered reliable.

However, a bank is encouraged to obtain

more than one type of documentary

verification to ensure that it has a

reasonable belief that it knows the

customer’s true identity. Moreover,

banks are encouraged to use a variety of

methods to verify the identity of a

customer, especially when the bank

does not have the ability to examine

original documents.

The final rule attempts to strike the

appropriate balance between the

VerDate Jan<31>2003

17:31 May 08, 2003

Jkt 200001

PO 00000

Frm 00011

Fmt 4701

Sfmt 4700

E:\FR\FM\09MYR2.SGM

09MYR2

25100

Federal Register / Vol. 68, No. 90 / Friday, May 9, 2003 / Rules and Regulations

benefits of requiring additional

documentary verification and the

burdens that may arise from such a

requirement by providing that a bank’s

CIP must state the documents that a

bank will use. This will require each

bank to conduct its own risk-based

analysis of the types of documents it

believes will enable it to know the true

identity of its customers.

The final rule continues to provide an

illustrative list of identification

documents. For an individual, these

may include an unexpired government-

issued identification evidencing

nationality or residence and bearing a

photograph or similar safeguard, such as

a driver’s license or passport

is of the types of documents it

believes will enable it to know the true

identity of its customers.

The final rule continues to provide an

illustrative list of identification

documents. For an individual, these

may include an unexpired government-

issued identification evidencing

nationality or residence and bearing a

photograph or similar safeguard, such as

a driver’s license or passport. For a

person other than an individual, these

may include documents showing the

existence of the entity, such as certified

articles of incorporation, a government-

issued business license, a partnership

agreement, or a trust instrument.

Some commenters questioned

whether the examples of identification

documents given for persons other than

individuals would be reliable. One

commenter questioned whether trust

documents alone would be sufficient

verification of identity. Another

commenter suggested allowing banks to

rely on a certification by the trustee, or

an appropriate legal opinion, rather than

the trust instrument to verify the

existence of a trust. Someone else

suggested that banks should be allowed

to rely on documentation consisting of

evidence that a business is either

publicly traded or is authorized to do

business in a state or the United States.

The examples provided in the final

rule were intended only to illustrate the

documents a bank might use to verify

the identity of a customer that is a

corporation, partnership, or trust. A

bank may use other documents,

provided that they allow the bank to

establish that it has a reasonable belief

that it knows the true identity of its

customer. Accordingly, the final rule

makes no significant changes to the

examples.

Section 103.121(b)(2)(ii)(B) Non-

Documentary Verification

bank might use to verify

the identity of a customer that is a

corporation, partnership, or trust. A

bank may use other documents,

provided that they allow the bank to

establish that it has a reasonable belief

that it knows the true identity of its

customer. Accordingly, the final rule

makes no significant changes to the

examples.

Section 103.121(b)(2)(ii)(B) Non-

Documentary Verification. Recognizing

that some accounts are opened by

telephone, by mail, and over the

Internet, the proposed rule provided

that a bank’s CIP also must contain

procedures describing what non-

documentary methods the bank will use

to verify identity and when the bank

will use these methods (whether in

addition to, or instead of, relying on

documents). The preamble for the

proposed rule also noted that even if the

customer presents identification

documents, it may be appropriate to use

non-documentary methods as well.

The proposed rule gave examples of

non-documentary verification methods

that a bank may use, including

contacting a customer after the account

is opened; obtaining a financial

statement; comparing the identifying

information provided by the customer

against fraud and bad check databases to

determine whether any of the

information is associated with known

incidents of fraudulent behavior

(negative verification); comparing the

identifying information with

information available from a trusted

third party source, such as a credit

report from a consumer reporting

agency (positive verification); and

checking references with other financial

institutions. The preamble for the

proposed rule stated that a bank also

may wish to analyze whether there is

logical consistency between the

identifying information provided, such

as the customer’s name, street address,

ZIP code, telephone number, date of

birth, and social security number

(logical verification)

agency (positive verification); and

checking references with other financial

institutions. The preamble for the

proposed rule stated that a bank also

may wish to analyze whether there is

logical consistency between the

identifying information provided, such

as the customer’s name, street address,

ZIP code, telephone number, date of

birth, and social security number

(logical verification).

The proposal required that the

procedures address situations where an

individual, such as an elderly person,

legitimately is unable to present an

unexpired government-issued

identification document that bears a

photograph or similar safeguard; the

bank is not familiar with the documents

presented; the account is opened

without obtaining documents; the

account is not opened in a face-to-face

transaction, for example over the phone,

by mail, or through the Internet; and the

type of account increases the risk that

the bank will not be able to verify the

true identity of the customer through

documents.

Several commenters asked for

additional guidance regarding when

non-documentary verification methods

should be used in addition to

documentary verification methods and

the circumstances in which only one or

all of the non-documentary verification

methods listed are necessary.

Commenters also asked for guidance on

audit methodology, and an explanation

of the due diligence required for

verification of accounts opened by

telephone, mail, and through the

Internet. A few commenters suggested

that reference to verification, where a

bank compares information provided by

the customer with information from

trusted third party sources, be expressly

mentioned in the final rule.

As the large number of comments on

this section illustrates, a rule that

attempted to address every scenario and

combination of risk-factors that a bank

might confront would be extremely

complex and invariably would fail to

address many situations

ank compares information provided by

the customer with information from

trusted third party sources, be expressly

mentioned in the final rule.

As the large number of comments on

this section illustrates, a rule that

attempted to address every scenario and

combination of risk-factors that a bank

might confront would be extremely

complex and invariably would fail to

address many situations. Rather than

adopt a lengthy and potentially

unwieldy rule that still would not

address every situation, Treasury and

the Agencies have concluded that it

would be more effective to adopt

general principles that are fleshed out

through examples. Therefore, the final

rule states that for a bank relying on

non-documentary verification methods,

the CIP must contain procedures that

describe the non-documentary methods

the bank will use.

The final rule generally retains the

illustrative list of non-documentary

methods contained in the proposal.

Treasury and the Agencies have

clarified that one method is

‘‘independently verifying the customer’s

identity through the comparison of

information provided by the customer

with information obtained from a

consumer reporting agency, public

database, or other source,’’ rather than

verifying ‘‘documentary information’’

through such sources.

The final rule also retains the variety

of situations that the procedures must

address that were identified in the

proposal, with the following two

changes. First, because ‘‘transaction’’ is

a defined term in 31 CFR part 103,

instead of using the term ‘‘face-to-face

transaction,’’ the final rule states that

the procedures must address the

situation where a customer opens an

account without appearing in person at

the bank. Second, the final clause of this

provision provides that the CIP must

include procedures to address situations

where the bank is otherwise presented

with circumstances that increase the

risk that the bank will be unable to

verify the true identity of a customer

through documents

ocedures must address the

situation where a customer opens an

account without appearing in person at

the bank. Second, the final clause of this

provision provides that the CIP must

include procedures to address situations

where the bank is otherwise presented

with circumstances that increase the

risk that the bank will be unable to

verify the true identity of a customer

through documents. This clause

acknowledges that there may be

circumstances beyond those specifically

described in this provision when a bank

should use non-documentary

verification procedures.

As stated in the preamble for the

proposed rule, because identification

documents may be obtained illegally

and may be fraudulent, and in light of

the recent increase in identity theft,

Treasury and the Agencies encourage

banks to use non-documentary methods

even when the customer has provided

identification documents.

Section 103.121(b)(2)(ii)(C) Additional

Verification for Certain Customers. As

described above, the proposed rule

required the identification and

verification of each signatory for an

account. Most commenters objected to

this requirement as overly burdensome,

and, upon consideration of the points

raised by the commenters, Treasury and

the Agencies agree that it is appropriate

VerDate Jan<31>2003

17:31 May 08, 2003

Jkt 200001

PO 00000

Frm 00012

Fmt 4701

Sfmt 4700

E:\FR\FM\09MYR2.SGM

09MYR2

25101

Federal Register / Vol. 68, No. 90 / Friday, May 9, 2003 / Rules and Regulations

30 The preamble also explained that there are

some exceptions to this basic rule. For example, a

bank may maintain an account at the direction of

a law enforcement or intelligence agency, even

though the bank does not know the true identity of

the customer.

31 See 12 CFR 202.9(b) (Federal Reserve

Regulation B that prescribes the form of ECOA

notice and statement of specific reasons); 15 U.S.C

The preamble also explained that there are

some exceptions to this basic rule. For example, a

bank may maintain an account at the direction of

a law enforcement or intelligence agency, even

though the bank does not know the true identity of

the customer.

31 See 12 CFR 202.9(b) (Federal Reserve

Regulation B that prescribes the form of ECOA

notice and statement of specific reasons); 15 U.S.C.

1681m (FCRA provision that provides for duties of

users taking adverse actions on the basis of

information contained in consumer reports from

other third parties or affiliates).

to delete it. For the reasons discussed

below, however, the rule does require

that a bank’s CIP address the

circumstances in which it will obtain

information about such individuals in

order to verify the customer’s identity.

Treasury and the Agencies believe that

while the majority of customers may be

verified adequately through the

documentary or non-documentary

verification methods described in

paragraphs (b)(2)(ii)(A) and (B), there

may be instances where this is not

possible. The risk that the bank will not

know the customer’s true identity may

be heightened for certain types of

accounts, such as an account opened in

the name of a corporation, partnership,

or trust that is created or conducts

substantial business in a jurisdiction

that has been designated by the United

States as a primary money laundering

concern or has been designated as non-

cooperative by an international body.

Obtaining sufficient information to

verify a customer’s identity can reduce

the risk that a bank will be used as a

conduit for money laundering and

terrorist financing

ust that is created or conducts

substantial business in a jurisdiction

that has been designated by the United

States as a primary money laundering

concern or has been designated as non-

cooperative by an international body.

Obtaining sufficient information to

verify a customer’s identity can reduce

the risk that a bank will be used as a

conduit for money laundering and

terrorist financing. Treasury and the

Agencies believe that a bank must

identify customers that pose a

heightened risk of not being properly

identified, and a bank’s CIP must

prescribe additional measures that may

be used to obtain information about the

identity of the individuals associated

with the entity in whose name such an

account is opened when standard

documentary and non-documentary

methods prove to be insufficient.

For these reasons, the requirement to

verify the identity of signatories has

been replaced by a new provision in the

final rule that requires that a bank’s CIP

address situations where, based on the

bank’s risk assessment of a new account

opened by a customer that is not an

individual, the bank also will obtain

information about individuals with

authority or control over such account,

including signatories, in order to verify

the customer’s identity. This additional

verification method will only apply

when the bank cannot adequately verify

the customer’s identity using the

documentary and non-documentary

verification methods described in

mer that is not an

individual, the bank also will obtain

information about individuals with

authority or control over such account,

including signatories, in order to verify

the customer’s identity. This additional

verification method will only apply

when the bank cannot adequately verify

the customer’s identity using the

documentary and non-documentary

verification methods described in

(b)(2)(ii)(A) and (B). Moreover, a bank

need not undertake any additional

verification if it chooses not to open an

account when it cannot verify the

customer’s identity using standard

documentary and non-documentary

verification methods.

Section 103.121(b)(2)(iii) Lack of

Verification. The proposed rule stated

that a bank’s CIP must include

procedures for responding to

circumstances in which the bank cannot

form a reasonable belief that it knows

the true identity of a customer. The

preamble for the proposed rule listed

what these procedures should include.

In addition, the proposal stated that a

bank should only maintain an account

for a customer when it can form a

reasonable belief that it knows the

customer’s true identity.30

The final rule retains the general

requirement that a bank’s CIP include

procedures for responding to

circumstances in which the bank cannot

form a reasonable belief that it knows

the true identity of the customer.

However, the rule text itself now states

that the procedures should describe the

following: when a bank should not open

an account for a potential customer; the

terms under which a customer may use

an account while the bank attempts to

verify the customer’s identity; when the

bank should close an account after

attempts to verify a customer’s identity

have failed; and when the bank should

file a Suspicious Activity Report in

accordance with applicable law and

regulation

llowing: when a bank should not open

an account for a potential customer; the

terms under which a customer may use

an account while the bank attempts to

verify the customer’s identity; when the

bank should close an account after

attempts to verify a customer’s identity

have failed; and when the bank should

file a Suspicious Activity Report in

accordance with applicable law and

regulation.

One commenter stated that requiring

a bank to close an account if it cannot

verify a customer’s identity would

conflict with state laws and would

subject the bank to legal liability. The

commenter urged that if this provision

is retained, the final rule also should

shield banks from state regulatory and

borrower liability in these

circumstances. Other commenters asked

that Treasury and the Agencies clarify

that further investigation that results in

failure to open an account will not

trigger adverse action requirements

under the FCRA, 15 U.S.C. 1681 et seq.

or the Equal Credit Opportunity Act

(ECOA), 15 U.S.C. 1691 et seq.

The final rule does not specifically

require a bank to close the account of a

customer whose identity the bank

cannot verify, but instead leaves this

determination to the discretion of the

bank. Treasury and the Agencies have

determined that there is no statutory

basis to create a safe harbor that would

shield banks from state regulatory or

borrower liability if a bank should

choose to close a customer’s account.

Any such closure should be consistent

with the bank’s existing procedures for

closing accounts in accordance with its

risk management practices. Treasury

and the Agencies also note that a bank

must comply with other applicable laws

and regulations, such as the adverse

action provisions under ECOA and the

FCRA, when determining not to open an

account because it cannot establish a

reasonable belief that it knows the true

identity of the customer.31

Section 103.121(b)(3)

Recordkeeping

Section 103.121(b)(3)(i) Required

Records

tices. Treasury

and the Agencies also note that a bank

must comply with other applicable laws

and regulations, such as the adverse

action provisions under ECOA and the

FCRA, when determining not to open an

account because it cannot establish a

reasonable belief that it knows the true

identity of the customer.31

Section 103.121(b)(3)

Recordkeeping

Section 103.121(b)(3)(i) Required

Records. The proposed rule set forth

recordkeeping procedures that must be

included in a bank’s CIP. Under the

proposal, a bank would have been

required to maintain a record of the

identifying information provided by the

customer. Where a bank relies upon a

document to verify identity, the

proposal would have required the bank

to maintain a copy of the document that

the bank relied on that clearly evidences

the type of document and any

identifying information it may contain.

The bank also would have been required

to record the methods and result of any

additional measures undertaken to

verify the identity of the customer. Last,

the bank would have been required to

record the resolution of any discrepancy

in the identifying information obtained.

This section of the proposed rule

prompted the most comment. Though

one commenter felt that the

recordkeeping requirements in the

proposed rule were weak, almost all

other commenters identified the

proposed documentation and record

retention requirements as overly

burdensome. Commenters urged

Treasury and the Agencies to permit a

bank to record the information from the

documents obtained rather than

requiring banks to maintain copies of

these documents for the life of the

account. Commenters generally argued

that it would be difficult and very

burdensome to store and retrieve copies

of documents used to verify the identity

of the customer. In addition, some

commenters noted that many kinds of

identification documents, particularly

some new driver’s licenses, have

security features that prevent them from

being copied legibly

e documents for the life of the

account. Commenters generally argued

that it would be difficult and very

burdensome to store and retrieve copies

of documents used to verify the identity

of the customer. In addition, some

commenters noted that many kinds of

identification documents, particularly

some new driver’s licenses, have

security features that prevent them from

being copied legibly. Other commenters

stated that copies of documents would

be difficult to safeguard and could

facilitate identity theft.

Commenters stated that requiring

banks to keep copies of documents

would substantially deviate from

current banking practice and would

violate certain states’ laws. Banks

offering credit card accounts through

retailers, who require the customer to

VerDate Jan<31>2003

17:31 May 08, 2003

Jkt 200001

PO 00000

Frm 00013

Fmt 4701

Sfmt 4700

E:\FR\FM\09MYR2.SGM

09MYR2

25102

Federal Register / Vol. 68, No. 90 / Friday, May 9, 2003 / Rules and Regulations

32 Nevertheless, the legislative history for this

provision indicates that the lists Congress intended

financial institutions to consult ‘‘are those already

supplied to financial institutions by the Office of

Foreign Asset Control (OFAC), and occasionally by

law enforcement and regulatory authorities, as in

the days immediately following the September 11,

2001, attacks on the World Trade Center and the

Pentagon.’’ H.R. Rep. No. 107–250, pt. 1, at 63

ndicates that the lists Congress intended

financial institutions to consult ‘‘are those already

supplied to financial institutions by the Office of

Foreign Asset Control (OFAC), and occasionally by

law enforcement and regulatory authorities, as in

the days immediately following the September 11,

2001, attacks on the World Trade Center and the

Pentagon.’’ H.R. Rep. No. 107–250, pt. 1, at 63

(2001).

provide identifying documents at the

point of sale, strenuously opposed this

requirement if it were interpreted to

cover documents presented to the

merchant. These commenters stated that

copy machines are not usually available

at the point of sale, and that the rule as

proposed would require merchants to

purchase large numbers of additional

copy machines. The commenters also

anticipated that consumers would be

greatly inconvenienced by this

requirement and might have to endure

lengthy waits during any busy shopping

season. These commenters questioned

whether the risks of money-laundering

and the financing of terrorism through

retail store credit cards, which generally

have relatively low credit limits,

restrictions on pre-payment, and other

features to detect fraud, warrant the

imposition of these additional costs.

Other commenters stated that

requiring banks to keep copies of

documents that have pictures, such as

driver’s licenses, could expose the bank

to allegations of unlawful

discrimination, even if the retention of

this information were not prohibited

under ECOA. Some banks objected to

this requirement on the grounds that it

directly conflicted with the position that

the Agencies have traditionally taken on

this issue, including the criticism of

banks that have retained such

information in their files when

extending credit

he bank

to allegations of unlawful

discrimination, even if the retention of

this information were not prohibited

under ECOA. Some banks objected to

this requirement on the grounds that it

directly conflicted with the position that

the Agencies have traditionally taken on

this issue, including the criticism of

banks that have retained such

information in their files when

extending credit.

Other commenters asked that a bank

be permitted to record the processes and

procedures generally used for

verification rather than being required

to keep records of the methods used and

the resolution for each and every

account, especially where the bank uses

standardized procedures for all

customers and could demonstrate that

these procedures were applied. Some

commenters suggested that the final rule

permit banks to use a risk-based

approach for recordkeeping.

In light of the comments received,

Treasury and the Agencies have

reconsidered and modified the

recordkeeping requirements of the

proposed rule. The final rule provides

that a bank’s CIP must include

procedures for making and maintaining

a record of all information obtained

under the procedures implementing the

requirement that a bank develop and

implement a CIP. However, the final

rule affords banks significantly more

flexibility than did the recordkeeping

provisions contained in the proposal.

Under the final rule, a bank’s records

are to include ‘‘a description,’’ rather

than a copy, of any document upon

which the bank relied in order to verify

the identity of the customer, noting the

type of document, any identification

number contained in the document, the

place of issuance, and, if any, the date

of issuance and expiration date

dkeeping

provisions contained in the proposal.

Under the final rule, a bank’s records

are to include ‘‘a description,’’ rather

than a copy, of any document upon

which the bank relied in order to verify

the identity of the customer, noting the

type of document, any identification

number contained in the document, the

place of issuance, and, if any, the date

of issuance and expiration date. The

final rule also clarifies that the record

must include ‘‘a description’’ of the

methods and results of any measures

undertaken to verify the identity of the

customer, and of the resolution of any

‘‘substantive’’ discrepancy discovered

when verifying the identifying

information obtained, rather than any

documents generated in connection

with these measures.

As Treasury and the Agencies

indicated in the preamble for the

proposal, nothing in the rule modifies,

limits, or supersedes section 101 of the

Electronic Signatures in Global and

National Commerce Act, Pub. L. 106–

229, 114 Stat. 464 (15 U.S.C. 7001) (E-

Sign Act). Thus, a bank may use

electronic records to satisfy the

requirements of this final rule, as long

as the records are accurate and remain

accessible in accordance with 31 CFR

103.38(d).

Section 103.121(b)(3)(ii)

Retention of

Records

The proposal required a bank to retain

all of the records specified in the

recordkeeping provision for five years

after the date the account is closed.

This requirement prompted strenuous

objections. Assuming that copies of the

documents used to verify the identity of

the customer would have to be retained,

commenters asserted that retaining

records until five years after the account

is closed would be very burdensome.

Some commenters noted that imaging is

not a routine practice for community

banks and could be costly. Banks

offering credit card accounts stated that

the record retention requirement would

require a change in forms, processes,

and systems, while also increasing

storage costs

commenters asserted that retaining

records until five years after the account

is closed would be very burdensome.

Some commenters noted that imaging is

not a routine practice for community

banks and could be costly. Banks

offering credit card accounts stated that

the record retention requirement would

require a change in forms, processes,

and systems, while also increasing

storage costs. As credit cards do not

have a specific term, commenters noted

that banks would be required to keep

these records forever, unless they are

culled manually. Some commenters

suggested that the retention period be

shortened, with suggestions ranging

from one to three years after the account

is closed, while other commenters

suggested that the period be shortened

to five years from when the account is

opened. Many commenters stated that

two years from when the information is

obtained would be consistent with other

regulatory requirements, such as the

record retention requirements for an

application for an extension of credit

subject to ECOA (12 CFR 202.12(b)).

By eliminating the requirement that a

bank retain copies of the documents

used to verify the identity of the

customer, Treasury and the Agencies

believe that the final rule largely

addresses the main concern of these

commenters. However, Treasury and the

Agencies also have determined that,

while the identifying information

provided by the customer should be

retained, there is little value in requiring

banks to retain the remaining records for

five years after an account is closed

because this information is likely to

have become stale. Therefore, the final

rule now prescribes a bifurcated record

retention schedule that is consistent

with the general five-year retention

requirement in 31 CFR 103.38

ormation

provided by the customer should be

retained, there is little value in requiring

banks to retain the remaining records for

five years after an account is closed

because this information is likely to

have become stale. Therefore, the final

rule now prescribes a bifurcated record

retention schedule that is consistent

with the general five-year retention

requirement in 31 CFR 103.38. First, the

bank must retain the information

referenced in paragraph (b)(3)(i)(A) (that

is, information obtained about a

customer), for five years after the date

the account is closed or, in the case of

credit card accounts, five years after the

account is closed or becomes dormant.

Second, the bank need only retain the

records that it must make and maintain

under the remaining parts of the

recordkeeping provision, paragraphs

(b)(3)(i)(B), (C), and (D) (that is,

information that verifies a customer’s

identity) for five years after the record

is made.

Section 103.121(b)(4) Comparison

with Government Lists. The proposed

rule required a bank to have procedures

for determining whether the customer

appears on any list of known or

suspected terrorists or terrorist

organizations provided to the bank by

any Federal government agency. In

addition, the proposal stated that the

procedures must ensure that the bank

follows all Federal directives issued in

connection with such lists.

Most commenters were concerned

about how a bank would be able to

determine what lists should be checked

for purposes of this provision and how

these lists would be made available.

Some commenters asked that the final

rule confirm that a bank will not have

an affirmative duty to seek out all lists

compiled by the Federal government

and would only be required to check

lists provided to it by the Federal

government

rned

about how a bank would be able to

determine what lists should be checked

for purposes of this provision and how

these lists would be made available.

Some commenters asked that the final

rule confirm that a bank will not have

an affirmative duty to seek out all lists

compiled by the Federal government

and would only be required to check

lists provided to it by the Federal

government. Some commenters noted

that lists published by OFAC are

published but are not provided to

financial institutions.32 Many

commenters urged that all lists within

the meaning of section 326 of the Act,

VerDate Jan<31>2003

17:31 May 08, 2003

Jkt 200001

PO 00000

Frm 00014

Fmt 4701

Sfmt 4700

E:\FR\FM\09MYR2.SGM

09MYR2

25103

Federal Register / Vol. 68, No. 90 / Friday, May 9, 2003 / Rules and Regulations

be centralized, issued by a single

designated government agency, and

provided to financial institutions in a

commonly used electronic format. Some

of these commenters suggested that

instead of providing multiple lists, the

government set up a single Web site that

would permit a bank to search for a

name alphabetically, similar to the

OFAC list. Other commenters asked

Treasury and the Agencies to clarify

what action a bank should take when a

customer appears on a list.

Commenters also asked for guidance

regarding the timing of when the

comparison must be performed and

asked whether the lists could be

checked after an account is opened.

Some commenters stated that there is no

practical way for a financial institution

to check lists prior to opening an

account.

The final rule states that a bank’s CIP

must include procedures for

determining whether the customer

appears on any list of known or

suspected terrorists or terrorist

organizations issued by any Federal

government agency and designated as

such by Treasury in consultation with

the Federal functional regulators

al way for a financial institution

to check lists prior to opening an

account.

The final rule states that a bank’s CIP

must include procedures for

determining whether the customer

appears on any list of known or

suspected terrorists or terrorist

organizations issued by any Federal

government agency and designated as

such by Treasury in consultation with

the Federal functional regulators.

Because Treasury and the Federal

functional regulators have not yet

designated any such lists, the final rule

cannot be more specific with respect to

the lists banks must check in order to

comply with this provision. However,

banks will not have an affirmative duty

under this regulation to seek out all lists

of known or suspected terrorists or

terrorist organizations compiled by the

Federal government. Instead, banks will

receive notification by way of separate

guidance regarding the lists that must be

consulted for purposes of this provision.

Treasury and the Agencies have

modified this provision to give guidance

as to when a bank must consult a list of

known or suspected terrorists or

terrorist organizations. The final rule

states that the CIP’s procedures must

require the bank to make a

determination regarding whether a

customer appears on a list ‘‘within a

reasonable period of time’’ after the

account is opened, or earlier if required

by another Federal law or regulation or

by a Federal directive issued in

connection with the applicable list.

The final rule provides that a bank’s

CIP must contain procedures requiring

the bank to follow all Federal directives

issued in connection with such lists.

Again, because there are no lists that

have been designated under this

provision as yet, the final rule cannot

provide more guidance in this area.

Section 103.121(b)(5) Customer

Notice. The proposed rule would have

required a bank’s CIP to include

procedures for providing bank

customers with adequate notice that the

bank is requesting information to verify

their identity

ith such lists.

Again, because there are no lists that

have been designated under this

provision as yet, the final rule cannot

provide more guidance in this area.

Section 103.121(b)(5) Customer

Notice. The proposed rule would have

required a bank’s CIP to include

procedures for providing bank

customers with adequate notice that the

bank is requesting information to verify

their identity. The preamble for the

proposal stated that a bank could satisfy

that notice requirement by generally

notifying its customers about the

procedures the bank must comply with

to verify their identities. It stated that

the bank could post a notice in its lobby

or on its Internet website, or provide

customers with any other form of

written or oral notice.

Treasury and the Agencies received a

large number of comments on this

provision. Some commenters did not

agree that section 326 of the Act

requires notice to bank customers. Some

of these commenters suggested that a

bank’s request for identifying

information should be considered

adequate notice. Other commenters did

not question this requirement and stated

that they appreciated the flexibility of

this provision. However, a great many

commenters asked for additional

guidance on the content and timing of

the notice and specifically requested

that the final rule provide model

language so that all institutions

represent the requirements of section

326 in the same manner and the

adequacy of notice is not left to the

interpretation of individual examiners.

Section 326 provides that the

regulations issued ‘‘shall, at a minimum,

require financial institutions to

implement, and customers (after being

given adequate notice) to comply with

reasonable procedures’’ that satisfy the

statute. Based upon this statutory

requirement, the final rule requires a

bank’s CIP to include procedures for

providing bank customers with

adequate notice that the bank is

requesting information to verify their

identities

at a minimum,

require financial institutions to

implement, and customers (after being

given adequate notice) to comply with

reasonable procedures’’ that satisfy the

statute. Based upon this statutory

requirement, the final rule requires a

bank’s CIP to include procedures for

providing bank customers with

adequate notice that the bank is

requesting information to verify their

identities. However, the final rule

provides additional guidance regarding

what constitutes adequate notice and

the timing of the notice requirement.

The final rule states that notice is

adequate if the bank generally describes

the identification requirements of the

final rule and provides notice in a

manner reasonably designed to ensure

that a customer views the notice, or is

otherwise given notice, before opening

an account. The final rule also states

that depending upon the manner in

which an account is opened, a bank may

post a notice in the lobby or on its

website, include the notice on its

account applications, or use any other

form of oral or written notice. In

addition, the final rule includes sample

language that, if appropriate, will be

deemed adequate notice to a bank’s

customers when provided in accordance

with the requirements of this final rule.

Section 103.121(b)(6) Reliance on

Another Financial Institution. Many

commenters urged that the final rule

permit a bank to rely on a third party

to perform elements of the bank’s CIP.

For example, some commenters asked

that the final rule clarify that a bank

may use a third party service provider

to perform tasks and keep records. Other

commenters recommended that the rule

should permit a third party to verify the

identity of the bank’s customer in

indirect lending arrangements, for

example, where a car dealer acting as

agent of the bank extends a loan to a

customer or where a mortgage broker

acts on a bank’s behalf

rule clarify that a bank

may use a third party service provider

to perform tasks and keep records. Other

commenters recommended that the rule

should permit a third party to verify the

identity of the bank’s customer in

indirect lending arrangements, for

example, where a car dealer acting as

agent of the bank extends a loan to a

customer or where a mortgage broker

acts on a bank’s behalf. Some

commenters urged that the final rule be

modified to more broadly permit

financial institutions to share customer

identification and verification duties

with other financial institutions so as to

avoid each institution having to

undertake duplicative customer

identification efforts. Some of these

commenters suggested that a bank be

permitted to allocate its responsibility to

verify the customer’s identity by

contract with another financial

institution as permitted in the proposed

rule for broker-dealers.

Other commenters requested that the

final rule permit the CIP obligations to

be performed initially by only one

financial institution if a customer has

different accounts with different

affiliates. These commenters noted that

it is common for a customer to maintain

several different accounts with a

financial institution and its affiliates.

The same customer, for example, may

have a credit card account with one

affiliate, a home mortgage with another

affiliate, and a brokerage account with a

broker-dealer affiliate. The commenters

urged that a bank be permitted to rely

on customer identification and

verification performed by an affiliate

because it would be superfluous and

unnecessarily burdensome to subject the

same customer to substantially similar

customer identification and verification

procedures on multiple occasions

th another

affiliate, and a brokerage account with a

broker-dealer affiliate. The commenters

urged that a bank be permitted to rely

on customer identification and

verification performed by an affiliate

because it would be superfluous and

unnecessarily burdensome to subject the

same customer to substantially similar

customer identification and verification

procedures on multiple occasions.

Furthermore, those commenters urged

Treasury and the Agencies to allow a

bank to rely on an affiliate in order to

reduce the substantial costs of

maintaining duplicative records

regarding identity verification under the

recordkeeping provisions of the rule.

Treasury and the Agencies recognize

that there may be circumstances where

a bank should be able to rely on the

performance by another financial

institution of some or all of the elements

of the bank’s CIP. Therefore, the final

rule provides that a bank’s CIP may

VerDate Jan<31>2003

17:31 May 08, 2003

Jkt 200001

PO 00000

Frm 00015

Fmt 4701

Sfmt 4700

E:\FR\FM\09MYR2.SGM

09MYR2

25104

Federal Register / Vol. 68, No. 90 / Friday, May 9, 2003 / Rules and Regulations

33 Because it lacks the specific statutory authority

to regulate and examine service providers, NCUA,

as a matter of safety and soundness, will require

credit unions to document that their service

providers fully comply with this regulation and

with the credit union’s customer identification

program.

include procedures specifying when the

bank will rely on the performance by

another financial institution (including

an affiliate) of any procedures of the

bank’s CIP and thereby satisfy the

bank’s obligations under the rule.

Reliance is permitted if a customer of

the bank is opening, or has opened, an

account or has established a similar

banking or business relationship with

the other financial institution to provide

or engage in services, dealings, or other

financial transactions

stitution (including

an affiliate) of any procedures of the

bank’s CIP and thereby satisfy the

bank’s obligations under the rule.

Reliance is permitted if a customer of

the bank is opening, or has opened, an

account or has established a similar

banking or business relationship with

the other financial institution to provide

or engage in services, dealings, or other

financial transactions.

In order for a bank to rely on the other

financial institution, such reliance must

be reasonable under the circumstances,

and the other financial institution must

be subject to a rule implementing the

anti-money laundering compliance

program requirements of 31 U.S.C.

5318(h) and be regulated by a Federal

functional regulator. The other financial

institution also must enter into a

contract requiring it to certify annually

to the bank that it has implemented its

anti-money laundering program and that

it will perform (or its agent will

perform) the specified requirements of

the bank’s CIP. The contract and

certification will provide a standard

means for a bank to demonstrate the

extent to which it is relying on another

institution to perform its CIP, and that

the institution has in fact agreed to

perform those functions. If it is not clear

from these documents, a bank must be

able to otherwise demonstrate when it is

relying on another institution to perform

its CIP with respect to a particular

customer.

The bank will not be held responsible

for the failure of the other financial

institution to adequately fulfill the

bank’s CIP responsibilities, provided the

bank can establish that its reliance was

reasonable and that it has obtained the

requisite contracts and certifications.

Treasury and the Agencies emphasize

that the bank and the other financial

institution upon which it relies must

satisfy all of these conditions set forth

in the rule. If they do not, then the bank

remains solely responsible for applying

its own CIP to each customer in

accordance with this regulation

iance was

reasonable and that it has obtained the

requisite contracts and certifications.

Treasury and the Agencies emphasize

that the bank and the other financial

institution upon which it relies must

satisfy all of these conditions set forth

in the rule. If they do not, then the bank

remains solely responsible for applying

its own CIP to each customer in

accordance with this regulation.

All of the Federal functional

regulators are adopting comparable

provisions in their respective

regulations to permit such reliance.

Furthermore, the Federal functional

regulators expect to share information

and to cooperate with each other to

determine whether the institutions

subject to their jurisdiction are in

compliance with the conditions of the

reliance provision of this final rule.

The final rule issued here does not

affect a bank’s authority to contract for

services to be performed by a third party

either on or off the bank’s premises.

Thus, for example, a bank may contract

with a third party service provider to

keep its records even when the bank

does not act under the reliance

provision set forth in the regulation.

However, Treasury and the Agencies

note that the performance of these

services for Federally regulated banks 33

will be subject to regulation and

examination by the Agencies under

other applicable laws and regulations.

See, e.g., 12 U.S.C. 1867.

The final rule also does not alter a

bank’s authority to use an agent to

perform services on its behalf.

Therefore, a bank is permitted to arrange

for a car dealer or mortgage broker,

acting as its agent in connection with a

loan, to verify the identity of its

customer. However, as with any other

responsibility performed by an agent,

and in contrast to the reliance provision

in the rule, the bank ultimately is

responsible for that agent’s compliance

with the requirements of this final rule.

Section 103.121(c) Exemptions

to arrange

for a car dealer or mortgage broker,

acting as its agent in connection with a

loan, to verify the identity of its

customer. However, as with any other

responsibility performed by an agent,

and in contrast to the reliance provision

in the rule, the bank ultimately is

responsible for that agent’s compliance

with the requirements of this final rule.

Section 103.121(c) Exemptions. The

proposed rule provided that the

appropriate Federal functional

regulator, with the concurrence of

Treasury, may by order or regulation

exempt any bank or type of account

from the requirements of this section.

The proposal stated that, in issuing such

exemptions, the Federal functional

regulator and Treasury shall consider

whether the exemption is consistent

with the purposes of the BSA,

consistent with safe and sound banking,

and in the public interest. The proposal

stated that the Federal functional

regulator and Treasury also may

consider other necessary and

appropriate factors.

There were a number of comments

suggesting that various types of

accounts be exempted from the final

rule. For example, several commenters

suggested that accounts of Federal, state,

and local governmental entities, public

companies, and correspondent banks be

exempted from the final rule. One

commenter suggested that student loan

programs be exempted from the rule

because current safeguards are sufficient

to verify the identity of student loan

borrowers. Another commenter

suggested that small trust companies

and limited purpose banks that provide

trust services be exempted from the

rule, because such entities are more

local in operation, would be burdened

by the rule, and have fewer employees

to ensure compliance. Yet another

commenter suggested that the NCUA

exempt credit unions from the CIP

requirements

tity of student loan

borrowers. Another commenter

suggested that small trust companies

and limited purpose banks that provide

trust services be exempted from the

rule, because such entities are more

local in operation, would be burdened

by the rule, and have fewer employees

to ensure compliance. Yet another

commenter suggested that the NCUA

exempt credit unions from the CIP

requirements.

Any suggested exemptions that

Treasury and the Agencies have

determined to be appropriate are

incorporated into the definitions of

‘‘account’’ and ‘‘customer’’ for the

reasons described above. The exemption

provision of the final rule is essentially

adopted as proposed with respect to

banks that have a Federal functional

regulator. Because the final rule will

also apply to certain banks that do not

have a Federal functional regulator, a

new provision has been added to make

clear that Treasury alone will make all

determinations regarding exemptions

for these institutions.

Section 103.121(d) Other Information

Requirements Unaffected. The proposal

provided that nothing in § 103.121 shall

be construed to relieve a bank of its

obligations to obtain, verify, or maintain

information in connection with an

account or transaction that is required

by another provision in part 103. For

example, if an account is opened with

a deposit of more than $10,000 in cash,

the bank opening the account must

comply with the customer identification

requirements in § 103.121, as well as

with the provisions of § 103.22, which

require that certain information

concerning the transaction be reported

by filing a Currency Transaction Report

(CTR). There were no comments on this

provision

example, if an account is opened with

a deposit of more than $10,000 in cash,

the bank opening the account must

comply with the customer identification

requirements in § 103.121, as well as

with the provisions of § 103.22, which

require that certain information

concerning the transaction be reported

by filing a Currency Transaction Report

(CTR). There were no comments on this

provision. Therefore, Treasury and the

Agencies have adopted this provision

generally as proposed, except that it has

been clarified to provide that nothing in

§ 103.121 should be construed to relieve

a bank of any of its obligations,

including its obligations to obtain,

verify, or maintain information in

connection with an account or

transaction that is required by another

provision in part 103.

III. Conforming Amendments to 31 CFR

103.34

Section 103.34(a) sets forth customer

identification requirements when

certain types of deposit accounts are

opened. Together with the proposed

rule implementing section 326,

Treasury, on its own authority,

proposed deleting 31 CFR 103.34(a) for

the following reasons.

First, the preamble for the proposal

explained that Treasury regards the

requirements of §§ 103.34(a)(1) and (2)

as inconsistent with the intent and

purpose of section 326 of the Act and

incompatible with proposed section

103.121. Generally §§ 103.34(a)(1) and

(2) require a bank, within 30 days after

VerDate Jan<31>2003

17:31 May 08, 2003

Jkt 200001

PO 00000

Frm 00016

Fmt 4701

Sfmt 4700

E:\FR\FM\09MYR2.SGM

09MYR2

he proposal

explained that Treasury regards the

requirements of §§ 103.34(a)(1) and (2)

as inconsistent with the intent and

purpose of section 326 of the Act and

incompatible with proposed section

103.121. Generally §§ 103.34(a)(1) and

(2) require a bank, within 30 days after

VerDate Jan<31>2003

17:31 May 08, 2003

Jkt 200001

PO 00000

Frm 00016

Fmt 4701

Sfmt 4700

E:\FR\FM\09MYR2.SGM

09MYR2

25105

Federal Register / Vol. 68, No. 90 / Friday, May 9, 2003 / Rules and Regulations

34 The exemption applies to (i) agencies and

instrumentalities of Federal, State, local, or foreign

governments; (ii) judges, public officials, or clerks

of courts of record as custodians of funds in

controversy or under the control of the court; (iii)

aliens who are ambassadors; ministers; career

diplomatic or consular officers; naval, military, or

other attaches of foreign embassies and legations;

and members of their immediate families; (iv) aliens

who are accredited representatives of certain

international organizations, and their immediate

families; (v) aliens temporarily residing in the

United States for a period not to exceed 180 days;

(vi) aliens not engaged in a trade or business in the

United States who are attending a recognized

college or university, or any training program

supervised or conducted by an agency of the

Federal Government; (vii) unincorporated

subordinate units of a tax exempt central

organization that are covered by a group exemption

letter; (viii) a person under 18 years of age, with

respect to an account opened as part of a school

thrift savings program, provided the annual interest

is less than $10; (ix) a person opening a Christmas

club, vacation club, or similar installment savings

program, provided the annual interest is less than

$10; and (x) non-resident aliens who are not

engaged in a trade or business in the United States

i) a person under 18 years of age, with

respect to an account opened as part of a school

thrift savings program, provided the annual interest

is less than $10; (ix) a person opening a Christmas

club, vacation club, or similar installment savings

program, provided the annual interest is less than

$10; and (x) non-resident aliens who are not

engaged in a trade or business in the United States.

35 Appropriate conforming amendments are made

to §§ 103.34(b)(11) and (12) to add a cross-reference

to the Internal Revenue Code regarding the rules for

determining what constitutes a taxpayer

identification number.

36 The RFA defines the term ‘‘small entity’’ in 5

U.S.C. 601 by reference to the definitions published

by the Small Business Administration (SBA). The

SBA has defined a ‘‘small entity’’ for banking

purposes as a bank or savings institution with less

than $150 million in assets. See 13 CFR 121.201.

The NCUA defines ‘‘small credit union’’ as those

under $1 million in assets. Interpretive Ruling and

Policy Statement No. 87–2, Developing and

Reviewing Government Regulations (52 FR 35231,

September 18, 1987).

certain deposit accounts are opened, to

secure and maintain a record of the

taxpayer identification number of the

customer involved. If the bank is unable

to obtain the taxpayer identification

number within 30 days (or a longer time

if the person has applied for a taxpayer

identification number), it need take no

further action under § 103.34

concerning the account if it maintains a

list of the names, addresses, and

account numbers of the persons for

which it was unable to secure taxpayer

identification numbers, and provides

that information to Treasury upon

request. In the case of a non-resident

alien, the bank is required to record the

person’s passport number or a

description of some other government

document used to determine

identification

nt if it maintains a

list of the names, addresses, and

account numbers of the persons for

which it was unable to secure taxpayer

identification numbers, and provides

that information to Treasury upon

request. In the case of a non-resident

alien, the bank is required to record the

person’s passport number or a

description of some other government

document used to determine

identification. These requirements

conflicted with those in proposed

§ 103.121 which required a bank to

obtain the name, address, date of birth

and an identification number from any

person seeking to open a new account.

Second, § 103.34(a)(3) currently

provides that a bank need not obtain a

taxpayer identification number with

respect to specified categories of

persons 34 opening certain deposit

accounts. Proposed § 103.121 did not

exempt any persons from the CIP

requirements. Treasury requested

comment on whether any of the

exemptions in § 103.34(a)(3) should

apply in light of the intent and purpose

of section 326 of the Act and the

requirements of proposed § 103.121.

Third, § 103.34(a)(4) also provides

that IRS rules shall determine whose

number shall be obtained in the case of

multiple account holders. In the

preamble that accompanied its proposal,

Treasury stated that this provision is

inconsistent with section 326 of the Act,

which requires that banks verify the

identity of ‘‘any’’ person seeking to open

an account.

In addition, Treasury proposed

deleting § 103.34(b)(1) which requires a

bank to keep ‘‘any notations, if such are

normally made, of specific identifying

information verifying the identity of the

signer [who has signature authority over

an account] (such as a driver’s license

number or credit card number).’’

Treasury stated that the quoted language

in § 103.34(b)(1) is inconsistent with the

proposed requirements of § 103.121. For

this reason, Treasury, under its own

authority, proposed to delete the quoted

language

of specific identifying

information verifying the identity of the

signer [who has signature authority over

an account] (such as a driver’s license

number or credit card number).’’

Treasury stated that the quoted language

in § 103.34(b)(1) is inconsistent with the

proposed requirements of § 103.121. For

this reason, Treasury, under its own

authority, proposed to delete the quoted

language.

Few comments were received

regarding the proposed deletion of these

provisions. Some commenters agreed

that § 103.34(a) should be deleted if

proposed § 103.121 were adopted. One

commenter suggested that § 103.34(a)

should be revised to achieve the

objectives of the section 326 of the Act.

One commenter representing a military

bank requested continuance of the

exemption for agencies and

instrumentalities of the Federal

government that will permit exemption

of commissaries, exchanges and various

military organizations. Another

commenter requested maintenance of

the exemption for government entities,

court funds, unincorporated units of

tax-exempt organizations, and school

thrift programs.

Treasury has determined that given

the more comprehensive requirements

of the final version of § 103.121, there is

no longer a need for § 103.34 (a). A

number of the exemptions formerly in

§ 103.34(a) have now been added to

§ 103.121. Other exemptions conflict

with the language and intent of section

326 of the Act and thus were not

adopted in the final rule. While

§ 103.34(a) will no longer be needed

once the final rule is fully effective,

withdrawing the provision before

October 1, 2003, would create a gap

period

This text is long and has been trimmed here. Open the source document for the complete record.