# FDIC FIL-42-2003: ANTI-MONEY LAUNDERING MEASURES

> Federal · Agency guidance · Superseded

URL: https://www.frixlaw.com/law-library/statutes/FDIC_FIL03042

## Section

- **Citation:** FDIC FIL-42-2003
- **Heading:** ANTI-MONEY LAUNDERING MEASURES
- **Jurisdiction:** Federal
- **Kind:** Agency guidance
- **Status:** Superseded
- **Text as of:** August 14, 2026
- **Source:** Compiled text
- **Location:** FDIC Financial Institution Letters / ANTI-MONEY LAUNDERING MEASURES

## Text

Friday,
May 9, 2003
Part II
Department of the Treasury
31 CFR Part 103
Office of the Comptroller of the
Currency
12 CFR Part 21
Office of Thrift Supervision
12 CFR Part 563
Federal Reserve System
12 CFR Parts 208 and 211
Federal Deposit Insurance
Corporation
12 CFR Part 326
National Credit Union
Administration
12 CFR Part 748
Commodity Futures Trading
Commission
17 CFR Parts 1 and 42
Securities and Exchange
Commission
17 CFR Part 270 and 31 CFR Part 103
Transactions and Customer Identification
Programs; Final Rules and Proposed Rule
VerDate Jan<31>2003
17:31 May 08, 2003
Jkt 200001
PO 00000
Frm 00001
Fmt 4737
Sfmt 4737
E:\FR\FM\09MYR2.SGM
09MYR2

25090
Federal Register / Vol. 68, No. 90 / Friday, May 9, 2003 / Rules and Regulations
1 This definition includes banks, savings
associations, credit unions, Edge Act and
Agreement corporations, and branches and agencies
of foreign banks.
DEPARTMENT OF THE TREASURY
Office of the Comptroller of the
Currency
12 CFR Part 21
[Docket No. 03–08]
RIN 1557–AC06
FEDERAL RESERVE SYSTEM
12 CFR Parts 208 and 211
[Docket No. R–1127]
FEDERAL DEPOSIT INSURANCE
CORPORATION
12 CFR Part 326
DEPARTMENT OF THE TREASURY
Office of Thrift Supervision
12 CFR Part 563
[Docket No. 2003–16]
NATIONAL CREDIT UNION
ADMINISTRATION
12 CFR Part 748
RIN 3133
DEPARTMENT OF THE TREASURY
31 CFR Part 103
RIN 1506–AA31
Customer Identification Programs for
Banks, Savings Associations, Credit
Unions and Certain Non-Federally
Regulated Banks
AGENCIES: The Financial Crimes
Enforcement Network, Treasury; Office
of the Comptroller of the Currency,
Treasury; Board of Governors of the
Federal Reserve System; Federal Deposit
Insurance Corporation; Office of Thrift
Supervision, Treasury; National Credit
Union Administration.
ACTION: Joint final rule
Banks, Savings Associations, Credit
Unions and Certain Non-Federally
Regulated Banks
AGENCIES: The Financial Crimes
Enforcement Network, Treasury; Office
of the Comptroller of the Currency,
Treasury; Board of Governors of the
Federal Reserve System; Federal Deposit
Insurance Corporation; Office of Thrift
Supervision, Treasury; National Credit
Union Administration.
ACTION: Joint final rule.
SUMMARY: The Department of the
Treasury, through the Financial Crimes
Enforcement Network (FinCEN),
together with the Office of the
Comptroller of the Currency (OCC), the
Board of Governors of the Federal
Reserve System (Board), the Federal
Deposit Insurance Corporation (FDIC),
the Office of Thrift Supervision (OTS),
and the National Credit Union
Administration (NCUA) (collectively,
the Agencies), have jointly adopted a
final rule to implement section 326 of
the Uniting and Strengthening America
by Providing Appropriate Tools
Required To Intercept and Obstruct
Terrorism (USA PATRIOT) Act of 2001
(the Act). Section 326 requires the
Secretary of the Treasury (Secretary) to
jointly prescribe with each of the
Agencies, the Securities and Exchange
Commission (SEC), and the Commodity
Futures Trading Commission (CFTC), a
regulation that, at a minimum, requires
financial institutions to implement
reasonable procedures to verify the
identity of any person seeking to open
an account, to the extent reasonable and
practicable; maintain records of the
information used to verify the person’s
identity; and determine whether the
person appears on any lists of known or
suspected terrorists or terrorist
organizations provided to the financial
institution by any government agency.
This final regulation applies to banks,
savings associations, credit unions,
private banks, and trust companies.
DATES: Effective Date: This rule is
effective June 9, 2003.
Compliance Date: Each bank must
comply with this final rule by October
1, 2003
s on any lists of known or
suspected terrorists or terrorist
organizations provided to the financial
institution by any government agency.
This final regulation applies to banks,
savings associations, credit unions,
private banks, and trust companies.
DATES: Effective Date: This rule is
effective June 9, 2003.
Compliance Date: Each bank must
comply with this final rule by October
1, 2003.
FOR FURTHER INFORMATION CONTACT:
OCC: Office of the Chief Counsel at
(202) 874–3295.
Board: Enforcement and Special
Investigations Sections at (202) 452–
5235, (202) 728–5829, or (202) 452–
2961.
FDIC: Special Activities Section,
Division of Supervision and Consumer
Protection, and Legal Division at (202)
898–3671.
OTS: Compliance Policy Division at
(202) 906–6012.
NCUA: Office of General Counsel at
(703) 518–6540; or Office of
Examination and Insurance at (703)
518–6360.
Treasury: Office of the Chief Counsel
(FinCEN) at (703) 905–3590; Office of
the General Counsel (Treasury) at (202)
622–1927; or the Office of the Assistant
General Counsel for Banking & Finance
(Treasury) at (202) 622–0480.
SUPPLEMENTARY INFORMATION:
I. Background
A. Section 326 of the USA PATRIOT Act
On October 26, 2001, President Bush
signed into law the USA PATRIOT Act,
Pub. L. 107–56. Title III of the Act,
captioned ‘‘International Money
Laundering Abatement and Anti-
terrorist Financing Act of 2001,’’ adds
several new provisions to the Bank
Secrecy Act (BSA), 31 U.S.C. 5311 et
seq. These provisions are intended to
facilitate the prevention, detection, and
prosecution of international money
laundering and the financing of
terrorism.
Section 326 of the Act adds a new
subsection (l) to 31 U.S.C
tioned ‘‘International Money
Laundering Abatement and Anti-
terrorist Financing Act of 2001,’’ adds
several new provisions to the Bank
Secrecy Act (BSA), 31 U.S.C. 5311 et
seq. These provisions are intended to
facilitate the prevention, detection, and
prosecution of international money
laundering and the financing of
terrorism.
Section 326 of the Act adds a new
subsection (l) to 31 U.S.C. 5318 of the
BSA that requires the Secretary to
prescribe regulations ‘‘setting forth the
minimum standards for financial
institutions and their customers
regarding the identity of the customer
that shall apply in connection with the
opening of an account at a financial
institution.’’
Section 326 applies to all ‘‘financial
institutions.’’ This term is defined very
broadly in the BSA to encompass a
variety of entities, including commercial
banks, agencies and branches of foreign
banks in the United States, thrifts, credit
unions, private banks, trust companies,
investment companies, brokers and
dealers in securities, futures
commission merchants, insurance
companies, travel agents, pawnbrokers,
dealers in precious metals, check-
cashers, casinos, and telegraph
companies, among many others. See 31
U.S.C. 5312(a)(2) and (c)(1)(A).
For any financial institution engaged
in financial activities described in
section 4(k) of the Bank Holding
Company Act of 1956 (section 4(k)
institutions), the Secretary is required to
prescribe the regulations issued under
section 326 jointly with each of the
Agencies, the SEC, and the CFTC (the
Federal functional regulators)
, among many others. See 31
U.S.C. 5312(a)(2) and (c)(1)(A).
For any financial institution engaged
in financial activities described in
section 4(k) of the Bank Holding
Company Act of 1956 (section 4(k)
institutions), the Secretary is required to
prescribe the regulations issued under
section 326 jointly with each of the
Agencies, the SEC, and the CFTC (the
Federal functional regulators).
Section 326 of the Act provides that
the regulations must require, at a
minimum, financial institutions to
implement reasonable procedures for (1)
verifying the identity of any person
seeking to open an account, to the
extent reasonable and practicable; (2)
maintaining records of the information
used to verify the person’s identity,
including name, address, and other
identifying information; and (3)
determining whether the person appears
on any lists of known or suspected
terrorists or terrorist organizations
provided to the financial institution by
any government agency. In prescribing
these regulations, the Secretary is
directed to take into consideration the
various types of accounts maintained by
various types of financial institutions,
the various methods of opening
accounts, and the various types of
identifying information available.
B. Overview of Comments Received
On July 23, 2002, Treasury and the
Agencies published a joint notice of
proposed rulemaking in the Federal
Register (67 FR 48290) applicable to (a)
any financial institution defined as a
‘‘bank’’ in 31 CFR 103.11(c) 1 and
VerDate Jan<31>2003
17:31 May 08, 2003
Jkt 200001
PO 00000
Frm 00002
Fmt 4701
Sfmt 4700
E:\FR\FM\09MYR2.SGM
09MYR2
nformation available.
B. Overview of Comments Received
On July 23, 2002, Treasury and the
Agencies published a joint notice of
proposed rulemaking in the Federal
Register (67 FR 48290) applicable to (a)
any financial institution defined as a
‘‘bank’’ in 31 CFR 103.11(c) 1 and
VerDate Jan<31>2003
17:31 May 08, 2003
Jkt 200001
PO 00000
Frm 00002
Fmt 4701
Sfmt 4700
E:\FR\FM\09MYR2.SGM
09MYR2

25091
Federal Register / Vol. 68, No. 90 / Friday, May 9, 2003 / Rules and Regulations
2 In the preamble for this proposed rule, Treasury
explained that a single final regulation would be
issued for all financial institutions defined as
‘‘banks’’ under 31 CFR 103.11(c), with
modifications to accommodate certain differences
between Federally regulated and non-Federally
regulated banks. See 67 FR 48299, 48300.
3 At the same time, Treasury also published (1)
together with the SEC, proposed rules for broker-
dealers (67 FR 48306) and mutual funds (67 FR
48318); and (2) together with the CFTC, proposed
rules for futures commission merchants and
introducing brokers (67 FR 48328).
4 See footnote 3, supra.
subject to regulation by one of the
Agencies; and (b) any foreign branch of
an insured bank. On the same date,
Treasury separately published an
identical, proposed rule for credit
unions, private banks, and trust
companies that do not have a Federal
functional regulator (67 FR 48299).2
Treasury and the Agencies proposed
general standards that would require
each bank to design and implement a
customer identification program (CIP)
tailored to the bank’s size, location, and
type of business. The proposed rule also
included certain specific standards that
would be mandated for all banks.3
Treasury and the Agencies
collectively received approximately five
hundred comments in response to these
proposed rules (collectively referred to
as the ‘‘proposal’’ or the ‘‘proposed
rule’’ for ‘‘banks’’), although some
commenters sent copies of the same
letter to Treasury and to each of the
Agencies
ed rule also
included certain specific standards that
would be mandated for all banks.3
Treasury and the Agencies
collectively received approximately five
hundred comments in response to these
proposed rules (collectively referred to
as the ‘‘proposal’’ or the ‘‘proposed
rule’’ for ‘‘banks’’), although some
commenters sent copies of the same
letter to Treasury and to each of the
Agencies. The majority of comments
received by Treasury and the Agencies
were from banks, savings associations,
credit unions, and their trade
associations. Most of these commenters
agreed with the largely risk-based
approach set forth in the proposal that
allowed each bank to develop a CIP
based on its specific operations.
Some commenters, however,
criticized the specific requirements in
the proposed rule and suggested that
Treasury and the Agencies issue a final
rule containing an entirely risk-based
approach without any minimum
identification and verification
requirements. According to some of
these commenters, such a thoroughly
risk-based approach would give banks
appropriate discretion to focus their
efforts and finite resources on specific,
high-risk accounts most likely to be
used by money-launderers and
terrorists.
Other commenters, especially those
representing credit card banks and
credit card issuers, asserted that the
proposed minimum identification and
verification requirements should be
eliminated because they did not take
into account the unique nature of credit
card operations. They warned that these
requirements, if implemented, would
have a chilling effect on credit practices
important to U.S. consumers and would
impose significant compliance costs on
their industry with little benefit to law
enforcement.
By contrast, some smaller banks
criticized the flexibility of the proposal
and stated that a risk-based approach
would leave too much room for
interpretation by the Agencies
hese
requirements, if implemented, would
have a chilling effect on credit practices
important to U.S. consumers and would
impose significant compliance costs on
their industry with little benefit to law
enforcement.
By contrast, some smaller banks
criticized the flexibility of the proposal
and stated that a risk-based approach
would leave too much room for
interpretation by the Agencies. These
commenters urged Treasury and the
Agencies to issue a final rule
establishing more specific requirements.
For example, some commenters
suggested that the rule prescribe risk
assessment levels for each customer
type and type of account, along with a
specific description of acceptable forms
of identification and methods of
verification appropriate for each bank’s
size and location.
While commenters representing
various segments of the industry
differed on the approach that should be
taken in the final rule, the vast majority
concluded that Treasury and the
Agencies had underestimated the
compliance burden that would be
imposed by certain elements of the
proposal. Commenters were especially
concerned about the proposed
requirements that banks verify the
identity of signatories on accounts, keep
copies of documents used to verify a
customer’s identity, and retain identity
verification records for five years after
an account is closed.
Some commenters also suggested that
banks be given greater flexibility when
dealing with established customers and
urged that banks be permitted to rely on
identification and verification of
customers performed by a third party,
including an affiliate. Other commenters
asked for additional guidance regarding
the lists of known and suspected
terrorists and terrorist organizations that
must be checked, and regarding what
will be deemed adequate notice to
customers for purposes of complying
with the final rule
hat banks be permitted to rely on
identification and verification of
customers performed by a third party,
including an affiliate. Other commenters
asked for additional guidance regarding
the lists of known and suspected
terrorists and terrorist organizations that
must be checked, and regarding what
will be deemed adequate notice to
customers for purposes of complying
with the final rule. Many commenters
requested that the final rule contain a
delayed implementation date that
would provide banks with the time
needed to design a customer
identification program, obtain board
approval, alter existing policies and
procedures, forms and software, and
train staff.
Several comments were received from
companies engaged in the sale of
technology or services that could be
used to identify and verify customers,
retain records, and check lists of known
and suspected terrorists and terrorist
organizations. Many of these companies
recommended that the proposed rule be
modified to make clear that use of
specific products and services would be
permissible. Some of these commenters
urged that the rule require banks to
authenticate any documents obtained to
verify the identity of the customer
through the use of automated document
authentication technology.
A small number of comments were
received from individuals. Some of
these individuals criticized the
proposed requirement that banks obtain
a social security number from persons
opening an account as an infringement
upon individual liberty and privacy.
Some individuals were concerned that
this requirement would expose them to
an added risk of identity theft. Other
individuals supported the proposal and
concluded that its verification
requirements might diminish instances
of identity theft and fraud. A few
commenters suggested that the
government develop a separate national
identification number or require that
social security cards bear photographs
and or other safeguards
this requirement would expose them to
an added risk of identity theft. Other
individuals supported the proposal and
concluded that its verification
requirements might diminish instances
of identity theft and fraud. A few
commenters suggested that the
government develop a separate national
identification number or require that
social security cards bear photographs
and or other safeguards.
A variety of commenters applauded
the efforts of Treasury and the Federal
functional regulators to devise a
uniform set of rules that apply to banks,
broker-dealers, mutual funds, futures
commission merchants, and introducing
brokers.4 They noted that, without
uniformity, customers of financial
institutions may seek to open accounts
with institutions that customers
perceive to have less robust customer
identification requirements. These
commenters also suggested revisions
that would enhance the uniformity of
the rules.
Treasury and the Agencies have
modified the proposed rule in light of
the comments received. A discussion of
the comments, and the manner in which
the proposed rule has been modified,
follows in the section-by-section
analysis.
In addition, as suggested by a number
of commenters, Treasury and the
Agencies expect to issue supplementary
guidance following issuance of the final
rule.
C. Joint Issuance by Treasury and the
Agencies
The final rule implementing section
326 is being issued jointly by Treasury,
through FinCEN, and by the Agencies.
It applies to (1) a ‘‘bank,’’ as defined in
31 CFR 103.11(c), that is subject to
regulation by one of the Agencies, and
ers, Treasury and the
Agencies expect to issue supplementary
guidance following issuance of the final
rule.
C. Joint Issuance by Treasury and the
Agencies
The final rule implementing section
326 is being issued jointly by Treasury,
through FinCEN, and by the Agencies.
It applies to (1) a ‘‘bank,’’ as defined in
31 CFR 103.11(c), that is subject to
regulation by one of the Agencies, and
(2) to any non-Federally insured credit
union, private bank or trust company
that does not have a Federal functional
regulator (collectively referred to in the
final rule as ‘‘a bank’’).
VerDate Jan<31>2003
17:31 May 08, 2003
Jkt 200001
PO 00000
Frm 00003
Fmt 4701
Sfmt 4700
E:\FR\FM\09MYR2.SGM
09MYR2

25092
Federal Register / Vol. 68, No. 90 / Friday, May 9, 2003 / Rules and Regulations
5 12 CFR 21.21 (OCC); 12 CFR 208.63, 211.5, and
211.24 (FRB); 12 CFR 326.8 (FDIC); 12 CFR 563.177
(OTS); and 12 CFR 748.2 (NCUA).
6 The definition of ‘‘account’’ in the proposed rule
was based on the statutory definition of ‘‘account’’
that is used in section 311 of the Act.
7 This exclusion is consistent with legislative
history indicating that by referencing the term
‘‘customers,’’ Congress intended ‘‘that the
regulations prescribed by Treasury take an
approach similar to that of regulations promulgated
under title V of the Gramm-Leach-Bliley Act of
1999, where the Federal functional regulators
defined ‘‘customers’’ and ‘‘customer relationship’’
for purposes of the financial privacy rules.’’ H.R.
Rep. No. 107–250, pt. 1, at 62 (2001). The
definitions of ‘‘customer’’ and ‘‘customer
The substantive requirements of this
joint final rule are being codified as part
of Treasury’s BSA regulations located in
31 CFR part 103. In addition, each of the
Agencies is concurrently publishing a
provision in its own regulations 5 to
cross-reference this final rule in order to
clarify the applicability of the final rule
to the banks subject to its jurisdiction
tomer’’ and ‘‘customer
The substantive requirements of this
joint final rule are being codified as part
of Treasury’s BSA regulations located in
31 CFR part 103. In addition, each of the
Agencies is concurrently publishing a
provision in its own regulations 5 to
cross-reference this final rule in order to
clarify the applicability of the final rule
to the banks subject to its jurisdiction.
Regulations governing the
applicability of section 326 to certain
financial institutions that are regulated
by the SEC and the CFTC are the subject
of separate rulemakings. Treasury, the
Agencies, the SEC, and the CFTC
consulted extensively in the
development of all joint rules
implementing section 326 of the Act.
All of the participating agencies intend
the effect of the rules to be uniform
throughout the financial services
industry. Treasury intends to issue
separate rules under section 326 for
certain non-bank financial institutions
that are not regulated by one of the
Federal functional regulators.
The Secretary has determined that the
records required to be kept by section
326 of the Act have a high degree of
usefulness in criminal, tax, or regulatory
investigations or proceedings, or in the
conduct of intelligence or
counterintelligence activities, to protect
against international terrorism.
In addition, Treasury, under its own
authority, is issuing conforming
amendments to 31 CFR 103.34, which
imposes requirements concerning the
identification of bank customers.
D. Compliance Date
Nearly all commenters on the
proposed rule requested that banks be
given adequate time to develop and
implement the requirements of any final
rule implementing section 326 of the
Act
terrorism.
In addition, Treasury, under its own
authority, is issuing conforming
amendments to 31 CFR 103.34, which
imposes requirements concerning the
identification of bank customers.
D. Compliance Date
Nearly all commenters on the
proposed rule requested that banks be
given adequate time to develop and
implement the requirements of any final
rule implementing section 326 of the
Act. These commenters stated that if the
proposed rule were implemented, banks
would be required, among other things,
to revise existing account opening
policies and procedures, obtain board
approval, train staff, update forms,
purchase new or updated software for
customer verification and checking of
government lists, and purchase new
equipment for copying or scanning and
storing records. Commenters requested a
delayed effective or compliance date,
but, given the variety of banks that
would be covered by the final rule, there
was no consensus regarding the amount
of time that would be necessary to
comply with the final rule. The
transition periods suggested by
commenters ranged from 60 days to two
years from the date a final rule is
published.
The final rule modifies various
aspects of the proposal and eliminates
some of the requirements that
commenters identified as being most
burdensome. Nonetheless, Treasury and
the Agencies recognize that some banks
will need time to develop a CIP, obtain
board approval, and implement the CIP,
which will include various measures,
such as training of staff, reprinting
forms, and developing new software.
Accordingly, although this final rule
will be effective 30 days after
publication, banks are provided with a
transition period to implement the rule.
Treasury and the Agencies have
determined that each bank must fully
implement its CIP by October 1, 2003.
II. Section-by-Section Analysis of Final
Rule Implementing Section 326
Section 103.121(a)
Definitions
Section 103.121(a)(1) Account
.
Accordingly, although this final rule
will be effective 30 days after
publication, banks are provided with a
transition period to implement the rule.
Treasury and the Agencies have
determined that each bank must fully
implement its CIP by October 1, 2003.
II. Section-by-Section Analysis of Final
Rule Implementing Section 326
Section 103.121(a)
Definitions
Section 103.121(a)(1) Account. The
proposed rule defined ‘‘account’’ as
each formal banking or business
relationship established to provide
ongoing services, dealings, or other
financial transactions and stated that a
deposit account, transaction or asset
account, and a credit account or other
extension of credit would each
constitute an ‘‘account.’’ 6 The proposal
also explained that the term ‘‘account’’
was limited to formal banking and
business relationships established to
provide ‘‘ongoing’’ services, dealings, or
other financial transactions to make
clear that this term is not intended to
cover infrequent transactions such as
the occasional purchase of a money
order or a wire transfer.
Treasury and the Agencies received a
large number of comments on this
proposed definition. Some commenters
agreed with the proposed definition
though others thought the definition of
‘‘account’’ was either too broad or
needed clarification. Some commenters
suggested that the definition of
‘‘account’’ be narrowed to include only
those relationships that are financial in
nature. A number of commenters urged
that the definition be limited to high-
risk relationships that experts have
identified as actually used by money
launderers and terrorists
thought the definition of
‘‘account’’ was either too broad or
needed clarification. Some commenters
suggested that the definition of
‘‘account’’ be narrowed to include only
those relationships that are financial in
nature. A number of commenters urged
that the definition be limited to high-
risk relationships that experts have
identified as actually used by money
launderers and terrorists. Some of these
commenters suggested that particular
types of accounts, especially those
established as part of employee benefit
plans, be excluded from the definition
of ‘‘account.’’
Most commenters requested that the
final rule provide additional examples
of the relationships that would
constitute an ‘‘account.’’ Many
commenters requested that the rule
clarify the meaning of ‘‘ongoing
services.’’ These commenters asked
whether a person who repeatedly and
regularly purchased a money order,
requested a wire transfer, or cashed a
check on a weekly basis, without any
other relationship with a bank, would
be considered to have an ‘‘account.’’
Many other commenters asked that the
exclusion for transfers of accounts
between banks described in the
preamble for the proposal—which
commenters characterized as the
‘‘transfer exception’’ —be stated
expressly in the regulation and
expanded to cover all loans originated
by a third party and purchased by a
bank, such as mortgages purchased from
non-bank lenders and vehicle loans
purchased from car dealers.
The final rule contains a number of
changes prompted by these comments.
First, the reference to the term ‘‘business
relationship’’ has been deleted from the
definition of ‘‘account.’’ This change is
made to clarify that the regulation
applies to the bank’s provision of
financial products and services, as
opposed to general ‘‘business’’ dealings,
such as those in connection with the
bank’s own operations or premises
mber of
changes prompted by these comments.
First, the reference to the term ‘‘business
relationship’’ has been deleted from the
definition of ‘‘account.’’ This change is
made to clarify that the regulation
applies to the bank’s provision of
financial products and services, as
opposed to general ‘‘business’’ dealings,
such as those in connection with the
bank’s own operations or premises.
Second, the definition now contains
additional, but non-exclusive, examples
of products and services, such as safety
deposit box and other safekeeping
services, cash management, and
custodian and trust services, that
constitute an ‘‘account.’’
The definition of ‘‘account’’ also has
been changed to include a list of
products and services that will not be
deemed an ‘‘account.’’ The preamble for
the proposed rule had used the term
‘‘ongoing services’’ to define accounts
covered by the final rule, and had
referred to the exclusion of ‘‘occasional’’
transactions and ‘‘infrequent’’ purchases
(which arguably would require a bank to
monitor all transactions for repetitive
contacts). By contrast, the final rule
clarifies that ‘‘account’’ excludes
products and services where a formal
banking relationship is not established
with a person, such as check cashing,
wire transfer, or the sale of a check or
money order.7 Treasury and the
VerDate Jan<31>2003
17:31 May 08, 2003
Jkt 200001
PO 00000
Frm 00004
Fmt 4701
Sfmt 4700
E:\FR\FM\09MYR2.SGM
09MYR2
for repetitive
contacts). By contrast, the final rule
clarifies that ‘‘account’’ excludes
products and services where a formal
banking relationship is not established
with a person, such as check cashing,
wire transfer, or the sale of a check or
money order.7 Treasury and the
VerDate Jan<31>2003
17:31 May 08, 2003
Jkt 200001
PO 00000
Frm 00004
Fmt 4701
Sfmt 4700
E:\FR\FM\09MYR2.SGM
09MYR2

25093
Federal Register / Vol. 68, No. 90 / Friday, May 9, 2003 / Rules and Regulations
relationship’’ in the financial privacy rules apply
only to a consumer who has a ‘‘continuing
relationship’’ with a bank, for example, in the form
of a deposit or investment account, or a loan. See
.3(h) and (i) of 12 CFR part 40 (OCC); 12 CFR part
216 (Board); 12 CFR part 332 (FDIC); 12 CFR part
573 (OTS); and 12 CFR part 716 (NCUA).
8 In many cases, these third parties are themselves
‘‘financial institutions’’ for purposes of the BSA.
Treasury anticipates that these third parties
ultimately will be subject to their own customer
identification rules implementing section 326 of the
Act in the event that they are not presently covered
by such a rule.
9 Nevertheless, there may be situations involving
the transfer of accounts where it would be
appropriate for a bank, as part of the customer due
diligence procedures required under existing
regulations requiring banks to have compliance
programs implementing the BSA (BSA compliance
programs), to verify the identity of customers
associated with accounts that it acquires from
another financial institution. Treasury and the
Agencies expect financial institutions to implement
reasonable procedures to detect money laundering
in any account, however acquired.
10 All insured depository institutions currently
must have a BSA compliance program. See 12 CFR
21.21 (OCC); 12 CFR 208.63 (Board); 12 CFR 326.8
(FDIC); 12 CFR 563.177 (OTS); and 12 CFR 748.2
(NCUA). In addition, all financial institutions are
required by section 352 of the Act, 31 U.S.C
itutions to implement
reasonable procedures to detect money laundering
in any account, however acquired.
10 All insured depository institutions currently
must have a BSA compliance program. See 12 CFR
21.21 (OCC); 12 CFR 208.63 (Board); 12 CFR 326.8
(FDIC); 12 CFR 563.177 (OTS); and 12 CFR 748.2
(NCUA). In addition, all financial institutions are
required by section 352 of the Act, 31 U.S.C.
5318(h), to develop and implement an anti-money
laundering program. Treasury issued a regulation
implementing section 352 providing that a financial
institution regulated by a Federal functional
regulator is deemed to satisfy the requirements of
section 5318(h)(1) if it implements and maintains
an anti-money laundering program that complies
with the regulation of its Federal functional
regulator, i.e., the requirement to implement a BSA
compliance program. See 31 CFR 103.120(b); 67 FR
2113 (April 29, 2002). However, Treasury
temporarily deferred subjecting certain non-
Federally regulated banks to the anti-money
laundering program requirements in section 352.
See 67 FR 67547 (November 6, 2002) (corrected 67
FR 68935 (November 14, 2002)).
11 See, e.g., 67 FR 60562, 60565 (Sept. 26, 2002)
(FinCEN’s regulation titled ‘‘Anti-Money
Laundering Requirements ‘‘Correspondent
Accounts for Foreign Shell Banks: Recordkeeping
and Termination of Correspondent Accounts for
Foreign Banks’ implementing sections 313 and
319(b) of the Act).
12 The proposed rule defined ‘‘person’’ by
reference to § 103.11(z). This definition includes
individuals, corporations, partnerships, trusts,
estates, joint stock companies, associations,
syndicates, joint ventures, other unincorporated
organizations or groups, certain Indian Tribes, and
all entities cognizable as legal personalities.
Treasury and the Agencies agree that it is not
necessary to repeat this definition. Therefore, it is
omitted from the final rule
definition includes
individuals, corporations, partnerships, trusts,
estates, joint stock companies, associations,
syndicates, joint ventures, other unincorporated
organizations or groups, certain Indian Tribes, and
all entities cognizable as legal personalities.
Treasury and the Agencies agree that it is not
necessary to repeat this definition. Therefore, it is
omitted from the final rule.
Agencies note that part 103 already
requires verification of identity in
connection with many of these products
and services. See, e.g., 31 CFR 103.29
(purchases of bank checks and drafts,
cashier’s checks, money orders, and
traveler’s checks for $3000 or more); 31
CFR 103.33 (funds transfers of $3000 or
more).
In addition, the final rule codifies and
clarifies the ‘‘transfer exception.’’ Under
the final rule, the definition of
‘‘account’’ excludes accounts that a
bank acquires through an acquisition,
merger, purchase of assets, or
assumption of liabilities from any third
party.8 Treasury and the Agencies note
that the Act provides that the
regulations shall require reasonable
procedures for ‘‘verifying the identity of
any person seeking to open an
account.’’ Because these transfers are
not initiated by customers, these
accounts do not fall within the scope of
section 326.9
Treasury and the Agencies generally
agree with the view expressed by
commenters who suggested that a bank’s
limited resources be focused on
relationships that pose a higher risk of
money laundering and terrorism.
Accordingly, the Agencies have
included an exception to the definition
of ‘‘account’’ for accounts opened for
the purpose of participating in an
employee benefit plan established
pursuant to the Employee Retirement
Income Security Act of 1974
by
commenters who suggested that a bank’s
limited resources be focused on
relationships that pose a higher risk of
money laundering and terrorism.
Accordingly, the Agencies have
included an exception to the definition
of ‘‘account’’ for accounts opened for
the purpose of participating in an
employee benefit plan established
pursuant to the Employee Retirement
Income Security Act of 1974. These
accounts are less susceptible to use for
the financing of terrorism and money
laundering, because, among other
reasons, they are funded through payroll
deductions in connection with
employment plans that must comply
with Federal regulations which impose
various requirements regarding the
funding and withdrawal of funds from
such accounts, including low
contribution limits and strict
distribution requirements.
Section 103.121(a)(2) Bank. The
proposal jointly issued by Treasury and
the Agencies applied to any financial
institution defined as a ‘‘bank’’ in 31
CFR 103.11(c) and subject to regulation
by one of the Agencies, including banks,
savings associations, credit unions, Edge
Act and Agreement corporations, and
branches and agencies of foreign banks.
The proposed definition also included
‘‘any foreign branch of an insured bank’’
to make clear that the procedures
required by the rule would have to be
implemented throughout the bank, no
matter where its offices are located. The
preamble for the proposal explained
that the rule would apply to bank
subsidiaries to the same extent as
existing regulations requiring banks to
have BSA compliance programs.10 As
described above, a second proposal
issued simultaneously by Treasury
applied to certain other financial
institutions defined as a ‘‘bank’’ in 31
CFR 103.11(c), namely, those credit
unions, private banks, and trust
companies that do not have a Federal
functional regulator
to bank
subsidiaries to the same extent as
existing regulations requiring banks to
have BSA compliance programs.10 As
described above, a second proposal
issued simultaneously by Treasury
applied to certain other financial
institutions defined as a ‘‘bank’’ in 31
CFR 103.11(c), namely, those credit
unions, private banks, and trust
companies that do not have a Federal
functional regulator.
Under the final rule, ‘‘bank’’ includes
all financial institutions covered by both
of the proposals described above, except
that ‘‘bank’’ does not include any
foreign branch of an insured U.S. bank.
Several commenters explained that the
proposal to cover foreign branches
might conflict with local laws
applicable to branches of insured banks
operating outside of the United States
and might place U.S. institutions at a
competitive disadvantage. Consistent
with the approach taken with respect to
final regulations implementing other
sections of the Act,11 Treasury and the
Agencies have determined that foreign
branches of insured U.S. banks are not
covered by the final rule. Nevertheless,
Treasury and the Agencies encourage
each bank to implement an effective
CIP, as required by this final rule,
throughout its organization, including
in its foreign branches, except to the
extent that the requirements of the rule
would conflict with local law.
As noted in the preamble for the
proposal, the CIP must be a part of a
bank’s BSA compliance program.
Therefore, it will apply throughout such
a bank’s U.S. operations (including
subsidiaries) in the same way as the
BSA compliance program requirement.
However, all subsidiaries that are in
compliance with a separately
applicable, industry-specific rule
implementing section 326 of the Act
will be deemed to be in compliance
with this final rule.
Section 103.121(a)(3) Customer. The
proposal defined ‘‘customer’’ to mean
any person 12 seeking to open a new
account
ng
subsidiaries) in the same way as the
BSA compliance program requirement.
However, all subsidiaries that are in
compliance with a separately
applicable, industry-specific rule
implementing section 326 of the Act
will be deemed to be in compliance
with this final rule.
Section 103.121(a)(3) Customer. The
proposal defined ‘‘customer’’ to mean
any person 12 seeking to open a new
account. In addition, the proposal
defined a ‘‘customer’’ to include any
signatory on an account. The preamble
for the proposal explained that the term
‘‘customer’’ included a person that
applied to open an account, but not
someone seeking information about an
account, such as rates charged or
interest paid on an account, if the
person did not apply to open an
account. The preamble also stated that
any person seeking to open an account
at a bank, on or after the effective date
of the final rule, would be a ‘‘customer,’’
regardless of whether that person
already had an account at the bank.
This proposed definition prompted a
large number of comments. First, nearly
all commenters recommended that the
Agencies clarify in the text of the final
rule that ‘‘customer’’ does not include a
person who does not receive banking
services, such as a person whose deposit
or loan application is denied. Some of
these commenters suggested that the
rule for banks define ‘‘customer’’ to
mean ‘‘a person who opens a new
account,’’ as did the proposed rules for
broker-dealers, mutual funds, futures
commission merchants and introducing
brokers.
VerDate Jan<31>2003
17:31 May 08, 2003
Jkt 200001
PO 00000
Frm 00005
Fmt 4701
Sfmt 4700
E:\FR\FM\09MYR2.SGM
09MYR2
posit
or loan application is denied. Some of
these commenters suggested that the
rule for banks define ‘‘customer’’ to
mean ‘‘a person who opens a new
account,’’ as did the proposed rules for
broker-dealers, mutual funds, futures
commission merchants and introducing
brokers.
VerDate Jan<31>2003
17:31 May 08, 2003
Jkt 200001
PO 00000
Frm 00005
Fmt 4701
Sfmt 4700
E:\FR\FM\09MYR2.SGM
09MYR2

25094
Federal Register / Vol. 68, No. 90 / Friday, May 9, 2003 / Rules and Regulations
13 Therefore, each person named on a joint
account is a ‘‘customer’’ under this final rule unless
otherwise provided.
14 However, based on a bank’s risk assessment of
a new account opened by a customer that is not an
individual, a bank may need to take additional
steps to verify the identity of the customer by
seeking information about individuals with
ownership or control over the account in order to
identify the customer, as described in
§ 103.121(b)(2)(ii)(C), or may need to look through
the account in connection with the customer due
diligence procedures required under other
provisions of its BSA compliance program.
15 Commenters contended that banks and
individuals would confront numerous practical
problems. Some commenters noted, for example,
that the identification and verification of signatories
could be burdensome for banks because business
accounts might have many signatories and those
signatories would change over time. Some
commenters explained that collecting detailed
information about an employee who is a signatory
would raise privacy concerns for those employees
who would be required to disclose personal
information to their employer’s financial
institutions
of signatories
could be burdensome for banks because business
accounts might have many signatories and those
signatories would change over time. Some
commenters explained that collecting detailed
information about an employee who is a signatory
would raise privacy concerns for those employees
who would be required to disclose personal
information to their employer’s financial
institutions. Other commenters stated that a
signatory rarely is present at the time of account
opening and, consequently, a bank would
encounter substantial obstacles when attempting to
verify the signatory’s identity using any of the most
common methods described in the proposal,
including by examining documents or by obtaining
a credit report. (Under the Fair Credit Reporting Act
(FCRA), a consumer reporting agency generally may
furnish a consumer report in connection with
transactions involving the consumer and no other.
See 15 U.S.C. 1681b. Thus, for example, a bank
would be prohibited from obtaining a credit report
to verify the identity of an authorized user of a
customer’s credit card.)
16 Treasury previously determined that banks
should be exempted from having to file reports of
transactions in currency in connection with these
entities. See 31 CFR 103.22(d)(1).
Treasury and the Agencies agree with
the view expressed by some
commenters that the statute should be
construed to ensure that banks design
procedures to determine the identity of
only those persons who open accounts.
Accordingly, the final rule defines a
‘‘customer’’ as ‘‘a person that opens a
new account.’’ 13 For example, in the
case of a trust account, the ‘‘customer’’
would be the trust. For purposes of this
rule, a bank will not be required to look
through trust, escrow, or similar
accounts to verify the identities of
beneficiaries and instead will only be
required to verify the identity of the
named accountholder.14 In the case of
brokered deposits, the ‘‘customer’’ will
be the broker that opens the deposit
account
a trust account, the ‘‘customer’’
would be the trust. For purposes of this
rule, a bank will not be required to look
through trust, escrow, or similar
accounts to verify the identities of
beneficiaries and instead will only be
required to verify the identity of the
named accountholder.14 In the case of
brokered deposits, the ‘‘customer’’ will
be the broker that opens the deposit
account. A bank will not need to look
through the deposit broker’s account to
determine the identity of each
individual sub-account holder; it need
only verify the identity of the named
accountholder.
Many commenters requested that the
final rule clarify whether ‘‘customer’’
includes a minor child or an informal
group with a common interest, such as
a club account, where there is no legal
entity. The final rule addresses these
comments by providing that ‘‘customer’’
means ‘‘an individual who opens a new
account for (1) an individual who lacks
legal capacity, such as a minor; or (2) an
entity that is not a legal person, such as
a civic club.’’
A few banks stated that defining
‘‘customer’’ to include a signatory was
consistent with their current practice of
verifying the identity of the named
accountholder and any signatory on the
account. However, most commenters
strenuously objected to the inclusion of
a signatory as a customer whose identity
must be verified, and asserted that this
proposed requirement would deviate
significantly from their current business
practices. These commenters stated that
requiring banks to verify signatories on
an account would be enormously
burdensome to the financial institutions
and signatories themselves—many of
whom simply work as employees for
firms with corporate accounts—and
would outweigh any benefit.15 One
commenter asserted that inclusion of
signatories as customers went beyond
the scope of section 326 of the Act
. These commenters stated that
requiring banks to verify signatories on
an account would be enormously
burdensome to the financial institutions
and signatories themselves—many of
whom simply work as employees for
firms with corporate accounts—and
would outweigh any benefit.15 One
commenter asserted that inclusion of
signatories as customers went beyond
the scope of section 326 of the Act.
Although some commenters advocated
that any requirement regarding a
signatory should be omitted altogether,
these commenters generally advocated a
risk-based approach that would give
banks the discretion to determine when
a signatory’s identity should be verified.
Credit card banks, in particular, were
critical of the signatory requirement
because the proposed provision, as
drafted, encompassed all authorized
users of credit cards. These banks
characterized the signatory requirement
as unnecessary in the case of credit card
companies, which, they explained,
already use sophisticated fraud filters to
detect fraud and abnormal use. These
banks also noted that a person need not
be a signatory to use another person’s
credit card, especially when purchasing
products by telephone or over the
Internet. Therefore, the signatory
requirement would not necessarily
ensure that banks would be able to
verify the identity of those using a credit
card account.
After revisiting the issue of whether a
signatory should be a ‘‘customer,’’
Treasury and the Agencies have
determined that requiring a bank to
expend its limited resources on
verifying the identity of all signatories
on accounts could interfere with the
bank’s ability to focus on identifying
customers and accounts that present a
higher risk of not being properly
identified. Accordingly, the proposed
provision defining ‘‘customer’’ to
include a signatory on an account is
deleted
Agencies have
determined that requiring a bank to
expend its limited resources on
verifying the identity of all signatories
on accounts could interfere with the
bank’s ability to focus on identifying
customers and accounts that present a
higher risk of not being properly
identified. Accordingly, the proposed
provision defining ‘‘customer’’ to
include a signatory on an account is
deleted. Instead, the final rule, at
§ 103.121(b)(2)(ii)(C), requires a bank’s
CIP to address situations when the bank
will take additional steps to verify the
identity of a customer that is not an
individual by seeking information about
individuals with authority or control
over the account, including signatories,
in order to verify the customer’s
identity.
In addition to defining who is a
‘‘customer,’’ the final rule contains a list
of entities that will not be deemed
‘‘customers.’’ Many commenters
questioned why a bank should be
required to verify the identity of a
government agency or instrumentality
opening a new account, or of a publicly-
traded company that is subject to SEC
reporting requirements. Consistent with
these and other comments urging that
the final rule focus on requiring
verification of the identity of customers
that present a higher risk of not being
properly identified, the final rule
excludes from the definition of
‘‘customer’’ the following readily
identifiable entities: a financial
institution regulated by a Federal
functional regulator; a bank regulated by
a state bank regulator; and governmental
agencies and instrumentalities, and
companies that are publicly traded
described in § 103.22(d)(2)(ii)–(iv).16
Section 103.22(d)(2)(iv) exempts such
companies only to the extent of their
domestic operations. Accordingly, a
bank’s CIP will apply to any foreign
offices, affiliates, or subsidiaries of such
entities that open new accounts
regulated by
a state bank regulator; and governmental
agencies and instrumentalities, and
companies that are publicly traded
described in § 103.22(d)(2)(ii)–(iv).16
Section 103.22(d)(2)(iv) exempts such
companies only to the extent of their
domestic operations. Accordingly, a
bank’s CIP will apply to any foreign
offices, affiliates, or subsidiaries of such
entities that open new accounts.
A great many commenters also
objected to the requirement in
§ 103.121(b)(2)(ii) of the proposed rule
that a bank verify the identity of an
existing customer seeking to open a new
account unless the bank previously
verified the customer’s identity in
accordance with procedures consistent
with the proposed rule and continues to
have a reasonable belief that it knows
the true identity of the customer. These
commenters asserted that such a
requirement would be burdensome for
the bank and would upset existing
customers. Some commenters
recommended that the rule apply
prospectively to new customers who
previously had no account with the
bank. Many commenters suggested that
the final rule contain a risk-based
approach where verification would not
be required for an existing customer
who opens a new account if the bank
has a reasonable belief that it knows the
identity of the customer, regardless of
the procedures the bank followed to
form this belief.
VerDate Jan<31>2003
17:31 May 08, 2003
Jkt 200001
PO 00000
Frm 00006
Fmt 4701
Sfmt 4700
E:\FR\FM\09MYR2.SGM
09MYR2
nal rule contain a risk-based
approach where verification would not
be required for an existing customer
who opens a new account if the bank
has a reasonable belief that it knows the
identity of the customer, regardless of
the procedures the bank followed to
form this belief.
VerDate Jan<31>2003
17:31 May 08, 2003
Jkt 200001
PO 00000
Frm 00006
Fmt 4701
Sfmt 4700
E:\FR\FM\09MYR2.SGM
09MYR2

25095
Federal Register / Vol. 68, No. 90 / Friday, May 9, 2003 / Rules and Regulations
17 As a foreign branch of an insured U.S. bank is
no longer a ‘‘bank’’ for purposes of this rule, a
customer of a bank’s foreign branch will no longer
be ‘‘a person who has an existing account with the
bank.’’ Therefore, the bank must verify the identity
of a customer of its foreign branch in accordance
with its CIP if such a customer opens a new account
in the U.S.
18 26 U.S.C. 7701(a)(30)(A).
19 See footnote 10, supra.
Treasury and the Agencies
acknowledge that the proposed rule
might have had unintended
consequences for bank-customer
relationships and that the risk-based
approach suggested by commenters
would avoid these consequences.
Accordingly, the final rule excludes
from the definition of ‘‘customer’’ a
person that has an existing account with
the bank, provided that the bank has a
reasonable belief that it knows the true
identity of the person.17
Section 103.121(a)(4) Federal
functional regulator. The proposed rule
defined ‘‘Federal functional regulator’’
by reference to § 103.120(a)(2), meaning
each of the Agencies, the SEC, and the
CFTC. There were no comments on this
definition, and Treasury and the
Agencies have adopted it as proposed.
Section 103.121(a)(5) Financial
institution. The final rule includes a
new definition for the term ‘‘financial
institution’’ that cross-references the
BSA, 31 U.S.C. 5312(a)(2) and (c)(1)
al regulator’’
by reference to § 103.120(a)(2), meaning
each of the Agencies, the SEC, and the
CFTC. There were no comments on this
definition, and Treasury and the
Agencies have adopted it as proposed.
Section 103.121(a)(5) Financial
institution. The final rule includes a
new definition for the term ‘‘financial
institution’’ that cross-references the
BSA, 31 U.S.C. 5312(a)(2) and (c)(1).
This is a more expansive definition of
‘‘financial institution’’ than that in 31
CFR 103.11, and includes entities such
as futures commission merchants and
introducing brokers.
Section 103.121(a)(6) Taxpayer
identification number. The proposed
rule repeated the language from
§ 103.34(a)(4), which states that the
provisions of section 6109 of the
Internal Revenue Code and the
regulations of the Internal Revenue
Service thereunder determine what
constitutes ‘‘a taxpayer identification
number.’’ There were no comments on
this approach, and Treasury and the
Agencies have adopted it substantially
as proposed, with minor technical
modifications.
Section 103.121(a)(7) and (8) U.S.
Person and non-U.S. person. The
proposed rule provided that ‘‘U.S.
person’’ is an individual who is a U.S.
citizen, or an entity established or
organized under the laws of a State or
the United States. A ‘‘non-U.S. person’’
was defined as a person who did not
satisfy either of these criteria.
As described in greater detail below,
a bank is generally required to obtain a
U.S. taxpayer identification number
from a customer who opens a new
account. However, if the customer is a
non-U.S. person and does not have such
a number, the bank may obtain an
identification number from some other
form of government-issued document
evidencing nationality or residence and
bearing a photograph or similar
safeguard.
Several commenters suggested that it
would be less confusing to bankers if
‘‘U.S. person’’ meant both a U.S
ho opens a new
account. However, if the customer is a
non-U.S. person and does not have such
a number, the bank may obtain an
identification number from some other
form of government-issued document
evidencing nationality or residence and
bearing a photograph or similar
safeguard.
Several commenters suggested that it
would be less confusing to bankers if
‘‘U.S. person’’ meant both a U.S. citizen
and a resident alien, consistent with the
definition of this term used in the
Internal Revenue Code (IRS
definition).18 A few commenters
criticized the proposed definition
because it would require banks to
establish whether a customer is or is not
a U.S. citizen.
Treasury and the Agencies believe
that the proposed definition of ‘‘U.S.
person’’ is a better standard for purposes
of this final rule than the IRS definition.
Adoption of the IRS definition of ‘‘U.S.
person’’ would require bank staff to
distinguish among various tax and
immigration categories in connection
with any type of account that is opened.
Under the proposed definition, a bank
will not necessarily need to establish
whether a potential customer is a U.S.
citizen. The bank will have to ask each
customer for a U.S. taxpayer
identification number (social security
number, employer identification
number, or individual taxpayer
identification number). If a customer
cannot provide one, the bank may then
accept alternative forms of
identification. For these reasons, the
definition is adopted as proposed.
Section 103.121(b) Customer
Identification Program: Minimum
Requirements
Section 103.121(b)(1) General Rule.
The proposed rule required each bank to
implement a CIP that is appropriate
given the bank’s size, location, and type
of business. The proposed rule required
a bank’s CIP to contain the statutorily
prescribed procedures, described these
procedures, and detailed certain
minimum elements that each of the
procedures must contain
ram: Minimum
Requirements
Section 103.121(b)(1) General Rule.
The proposed rule required each bank to
implement a CIP that is appropriate
given the bank’s size, location, and type
of business. The proposed rule required
a bank’s CIP to contain the statutorily
prescribed procedures, described these
procedures, and detailed certain
minimum elements that each of the
procedures must contain. In addition,
the proposed rule required that the CIP
be written and that it be approved by
the bank’s board of directors or a
committee of the board.
The proposed rule also stated that the
CIP must be incorporated into the
bank’s BSA 19 compliance program and
should not be a separate program. A
bank’s BSA compliance program must
be written, approved by the board, and
noted in the bank’s minutes. It must
include (1) internal policies,
procedures, and controls to ensure
ongoing compliance; (2) designation of
a compliance officer; (3) an ongoing
employee training program; and (4) an
independent audit function to test
programs. The preamble for the
proposal explained that the CIP should
be incorporated into each of these four
elements of a bank’s BSA program.
Most commenters agreed with the
proposal’s approach of allowing banks
to develop risk-based programs tailored
to their specific operation, though some
of these commenters recommended that
Treasury and the Agencies adopt an
entirely risk-based approach without
any minimum requirements while
others recommended a more
prescriptive approach. Many
commenters suggested that Treasury
and the Agencies clarify the extent to
which a bank could rely on a third
party, especially an affiliate, to perform
some or all aspects of its CIP.
Other commenters focused on the
requirement that a bank’s board of
directors approve the CIP
risk-based approach without
any minimum requirements while
others recommended a more
prescriptive approach. Many
commenters suggested that Treasury
and the Agencies clarify the extent to
which a bank could rely on a third
party, especially an affiliate, to perform
some or all aspects of its CIP.
Other commenters focused on the
requirement that a bank’s board of
directors approve the CIP. These
commenters urged Treasury and the
Agencies to adopt a regulation that
states that the role of a bank’s board of
directors need only be to approve broad
policy rather than the specific methods
or actual procedures that will be a part
of a bank’s CIP. One commenter
recommended that the governing body
of a financial institution be permitted to
delegate its responsibility to approve the
CIP.
The final rule attempts to strike an
appropriate balance between flexibility
and detailed guidance by allowing a
bank broad latitude to design and
implement a CIP that is tailored to its
particular business practices while
providing a framework of minimum
standards for identifying each customer,
as the Act mandates. Following the
description of the procedures and
minimum requirements for each
element of a bank’s CIP (identity
verification, recordkeeping, comparison
with government lists, and customer
notice), the final rule contains a new
section describing the extent to which a
bank may rely on a third party to
perform these elements, described in
detail below.
The final rule removes the
requirement that the bank’s board of
directors or a committee of the board
must approve the bank’s CIP because
this requirement is redundant. A bank’s
BSA compliance program must already
be approved by the board. Treasury and
the Agencies regard the addition of a
CIP to the bank’s BSA compliance
program to be a material change in the
BSA compliance program that will
require board approval
equirement that the bank’s board of
directors or a committee of the board
must approve the bank’s CIP because
this requirement is redundant. A bank’s
BSA compliance program must already
be approved by the board. Treasury and
the Agencies regard the addition of a
CIP to the bank’s BSA compliance
program to be a material change in the
BSA compliance program that will
require board approval. The board of
director’s responsibility to oversee bank
compliance with section 326 of the Act
VerDate Jan<31>2003
17:31 May 08, 2003
Jkt 200001
PO 00000
Frm 00007
Fmt 4701
Sfmt 4700
E:\FR\FM\09MYR2.SGM
09MYR2

25096
Federal Register / Vol. 68, No. 90 / Friday, May 9, 2003 / Rules and Regulations
20 See footnote 10, supra.
21 The final rule therefore provides that until such
time as credit unions, private banks, and trust
companies without a Federal functional regulator
are subject to such a program, their CIPs must be
approved by their boards of directors.
22 Other elements of the bank’s CIP, such as
procedures for recordkeeping or checking of
government lists, are requirements that may not
vary depending on risk factors.
23 H.R. Rep. No. 107–250, pt. 1, at 62 and 63
(2001).
is a part of a board’s conventional
supervisory BSA compliance
responsibilities that cannot be delegated
to bank management. Therefore, a
bank’s board of directors must be
responsible for approving a CIP
described in detail sufficient for the
board to determine that (1) the bank’s
CIP contains the minimum requirements
of this final rule; and (2) the bank’s
identity verification procedures are
designed to enable the bank to form a
reasonable belief that it knows the true
identity of the customer. Nevertheless,
responsibility for the development,
implementation, and day-to-day
administration of the CIP may be
delegated to bank management
etermine that (1) the bank’s
CIP contains the minimum requirements
of this final rule; and (2) the bank’s
identity verification procedures are
designed to enable the bank to form a
reasonable belief that it knows the true
identity of the customer. Nevertheless,
responsibility for the development,
implementation, and day-to-day
administration of the CIP may be
delegated to bank management.
The final rule will apply to some non-
Federally regulated banks that are not
yet subject to an anti-money laundering
compliance program requirement.20
Therefore, the final rule only requires
that the CIP be a part of a bank’s anti-
money laundering program once a bank
becomes subject to an anti-money
laundering compliance program
requirement.21
Section 103.121(b)(2) Identity
Verification Procedures. The proposed
rule provided that each bank must have
a CIP that includes procedures for
verifying the identity of each customer,
to the extent reasonable and practicable,
based on the bank’s assessment of
certain risks. The proposed rule stated
that these procedures must enable the
bank to form a reasonable belief that it
knows the true identity of the customer.
Some commenters recommended that
the identity verification requirement be
waived for new customers that are well
known to a senior officer of the bank.
Some of these commenters endorsed
such a waiver provided that a bank
employee could provide ‘‘an affidavit of
identity’’ on behalf of the customer.
One commenter criticized the
standard requiring a bank to have
identity verification procedures ‘‘that
enable the bank to form a reasonable
belief that it knows the true identity of
the customer’’ as too subjective. This
commenter suggested that a better
standard would be lack of affirmative
notice of deficiency in the identity
process
affidavit of
identity’’ on behalf of the customer.
One commenter criticized the
standard requiring a bank to have
identity verification procedures ‘‘that
enable the bank to form a reasonable
belief that it knows the true identity of
the customer’’ as too subjective. This
commenter suggested that a better
standard would be lack of affirmative
notice of deficiency in the identity
process. Another commenter suggested
that the rule make clear that a bank is
only required to verify a customer’s
identity, to the extent reasonable and
practical, in order to establish that it has
a reasonable basis for knowing the true
identity of its customer.
The final rule provides that a bank’s
CIP must include risk-based procedures
for verifying the identity of each
customer 22 to the extent reasonable and
practicable. The final rule also states
that the procedures must enable the
bank to form a reasonable belief that it
knows the true identity of the customer.
As section 326 of the Act states, a bank’s
affirmative obligation to verify the
identity of its customer applies to ‘‘any
person’’ rather than only to a person
whose identity is suspect, as suggested
by one commenter. Furthermore,
Treasury and the Agencies have
determined that the statutory obligation
to ‘‘verify the identity of any person’’
requires the bank to implement and
follow procedures that allow the bank to
have a reasonable belief that it knows
the true identity of the customer.
Given the flexibility built into the
final rule, Treasury and the Agencies
believe that it is not appropriate to
provide special treatment for new
customers known to bank personnel. In
addition, permitting reliance on bank
personnel to attest to the identity of a
customer may be subject to
manipulation. Accordingly, the final
rule does not establish different rules for
customers who are known to bank
personnel
ilt into the
final rule, Treasury and the Agencies
believe that it is not appropriate to
provide special treatment for new
customers known to bank personnel. In
addition, permitting reliance on bank
personnel to attest to the identity of a
customer may be subject to
manipulation. Accordingly, the final
rule does not establish different rules for
customers who are known to bank
personnel.
The final rule requires the identity
verification procedures to be based
upon relevant risks, including those
presented by the types of accounts
maintained by the bank, the various
methods of opening accounts provided
by the bank, and the types of identifying
information available. In addition to
these risk factors, which are specifically
identified in section 326, the final rule
states that the procedures should take
into account the bank’s size, location,
and type of business or customer base,
additional factors mentioned in the
Act’s legislative history.23
Section 103.121(b)(2)(i) Customer
Information Required. The proposed
rule required that a bank’s CIP must
contain procedures that specify the
identifying information the bank must
obtain from a customer. It stated that, at
a minimum, a bank must obtain from
each customer the following
information prior to opening an
account: (1) Name; (2) address (a
residential and mailing address for
individuals, and principal place of
business and mailing address for a
person other than an individual); (3)
date of birth for individuals; and (4) an
identification number.
Treasury and the Agencies received a
variety of comments criticizing the
requirement that a bank obtain certain
minimum identifying information prior
to opening an account
ress (a
residential and mailing address for
individuals, and principal place of
business and mailing address for a
person other than an individual); (3)
date of birth for individuals; and (4) an
identification number.
Treasury and the Agencies received a
variety of comments criticizing the
requirement that a bank obtain certain
minimum identifying information prior
to opening an account. Some
commenters, including a trade
association representing large financial
institutions, recommended that a bank
be permitted to open an account for a
customer who lacks some of the
minimum identifying information,
provided that the bank has formed a
reasonable belief that it knows the true
identity of the customer. Credit card
banks explained that the minimum
information requirement would create
problems for retailers that offer credit
cards at the point of sale. These
commenters stated that retailers were
not likely to have the means to record
identifying information other than what
is currently collected. They suggested
that when there are systems in place to
identify customers and detect
suspicious transactions, the rule should
require only the collection of
information that the credit card bank or
card issuer deems necessary and
appropriate to identify the customer.
Other commenters stated that the rule
should not require a bank to obtain the
minimum identifying information prior
to account opening in every instance.
Some of these commenters suggested
that a bank be permitted to obtain the
required information within a
reasonable time after the account is
opened. Some commenters suggested
that the rule permit banks to obtain
identifying information from a party
other than the customer. This would
arise, for example, when a bank offers
a credit card based on information
obtained from a credit reporting agency
these commenters suggested
that a bank be permitted to obtain the
required information within a
reasonable time after the account is
opened. Some commenters suggested
that the rule permit banks to obtain
identifying information from a party
other than the customer. This would
arise, for example, when a bank offers
a credit card based on information
obtained from a credit reporting agency.
Other commenters suggested that a bank
also be required to obtain information
about a customer’s occupation,
profession or business, as this
information is needed by a bank that
intends to file a report of transactions in
currency or a suspicious activities
report on the customer.
Consistent with the proposal, the final
rule provides that a bank’s CIP must
contain procedures that specify the
identifying information that the bank
must obtain from each customer prior to
opening an account. In addition, the
rule specifies the four basic categories of
information that a bank must obtain
from the customer prior to opening an
account. Treasury and the Agencies
believe that requiring banks to gather
these standard forms of information
prior to opening an account is not
overly burdensome because such
identifying information is routinely
VerDate Jan<31>2003
17:31 May 08, 2003
Jkt 200001
PO 00000
Frm 00008
Fmt 4701
Sfmt 4700
E:\FR\FM\09MYR2.SGM
09MYR2

25097
Federal Register / Vol. 68, No. 90 / Friday, May 9, 2003 / Rules and Regulations
24 H.R. Rep. No. 107–250, pt. 1, at 63 (2001).
gathered by most banks in the account
opening process and is required by
other sections of 31 CFR part 103. Of
course, based upon an assessment of the
risks described above, a bank may
require a customer to provide additional
information to establish the customer’s
identity
gister / Vol. 68, No. 90 / Friday, May 9, 2003 / Rules and Regulations
24 H.R. Rep. No. 107–250, pt. 1, at 63 (2001).
gathered by most banks in the account
opening process and is required by
other sections of 31 CFR part 103. Of
course, based upon an assessment of the
risks described above, a bank may
require a customer to provide additional
information to establish the customer’s
identity.
Treasury and the Agencies
acknowledge that imposing this
requirement on banks that offer credit
card accounts is likely to alter the
manner in which they do business by
requiring them to gather additional
information beyond that which they
currently obtain directly from a
customer who opens an account at the
point of sale or by telephone. Treasury
and the Agencies are mindful of the
legislative history of section 326, which
indicates that Congress expected the
regulations implementing this section to
be appropriately tailored for accounts
opened in situations where the account
holder is not physically present at the
financial institution and that the
regulations should not impose
requirements that are burdensome,
prohibitively expensive, or
impractical.24
Therefore, Treasury and the Agencies
have included an exception in the final
rule for credit card accounts only,
which would allow a bank broader
latitude to obtain some information
from the customer opening a credit card
account, and the remaining information
from a third party source, such as a
credit reporting agency, prior to
extending credit to a customer. Treasury
and the Agencies recognize that these
practices have produced an efficient and
effective means of extending credit with
little risk that the lender does not know
the identity of the borrower.
Treasury and the Agencies also
received comments on the advisability
of requiring banks to collect the specific
identifying information (name, date of
birth, address, and identification
number), as would have been required
under the proposed rule
have produced an efficient and
effective means of extending credit with
little risk that the lender does not know
the identity of the borrower.
Treasury and the Agencies also
received comments on the advisability
of requiring banks to collect the specific
identifying information (name, date of
birth, address, and identification
number), as would have been required
under the proposed rule. With respect to
obtaining the customer’s name, one
commenter recommended that based on
Texas law and banks’ experience, a bank
should be required to obtain the name
under which the customer is doing
business and the customer’s legal name.
The final rule continues to require that
the bank obtain the customer’s name,
meaning a legal name that can be
verified. As noted above, this is a
minimum requirement, and a bank may
also need to obtain the name under
which a person does business in order
to establish a reasonable belief it knows
the true identity of the customer.
One trade association suggested that
banks be permitted to make a risk-based
determination before requiring a
customer to provide date of birth
because many customers would prefer
not to share this information. One
commenter stated that date of birth is
not an important identifying
characteristic and should be deleted.
Another commenter stated that credit
card issuers do not request this
information because it can raise fair
lending issues. Finally, a few
commenters noted that standardized
mortgage applications require age rather
than date of birth and would have to be
altered.
The final rule provides that a bank
must obtain the date of birth for a
customer who is an individual. Treasury
and the Agencies believe that date of
birth is an important identifying
characteristic and can be used to
provide a bank or law enforcement with
an additional means to distinguish
between customers with identical
names
e rather
than date of birth and would have to be
altered.
The final rule provides that a bank
must obtain the date of birth for a
customer who is an individual. Treasury
and the Agencies believe that date of
birth is an important identifying
characteristic and can be used to
provide a bank or law enforcement with
an additional means to distinguish
between customers with identical
names. However, the required collection
and retention of information about a
customer’s date of birth does not relieve
the bank from its obligations to comply
with anti-discrimination laws or
regulations, such as the prohibition in
the Equal Credit Opportunity Act
against discrimination in any aspect of
a credit transaction on the basis of age
or other prohibited classification. Banks
collecting date of birth from individual
customers should be able to take
reasonable measures to convert this
information into age for purposes of the
forms used in the secondary mortgage
market given the delayed compliance
date for the final rule.
Many commenters criticized the
requirement that a bank obtain both the
customer’s physical and mailing
address, if different. Most commenters
urged Treasury and the Agencies to
eliminate the requirement that the
customer provide a physical address.
Some of these commenters stated that
this requirement could interfere with
the ability of certain segments of the
population to obtain a bank account,
such as members of the military,
persons who reside in mobile homes
with no fixed address, and truck drivers
who do not have a physical address.
Banks that offer credit card accounts
and card issuers stated that the address
requirement would be extremely
burdensome because they would have to
change the manner in which they do
business, and in some cases, credit card
banks currently do not have the capacity
to collect both addresses
reside in mobile homes
with no fixed address, and truck drivers
who do not have a physical address.
Banks that offer credit card accounts
and card issuers stated that the address
requirement would be extremely
burdensome because they would have to
change the manner in which they do
business, and in some cases, credit card
banks currently do not have the capacity
to collect both addresses. Some of these
commenters stated that new credit card
customers are reluctant to give more
than one address and, therefore, it
would be difficult to obtain this
information from customers. A trade
association representing credit card
banks asserted that customers may have
a legitimate reason for handling
correspondence through post office
boxes and should not have to provide a
physical address. This commenter
asserted that requiring the customer to
provide a physical address will
discourage the provision of financial
services to the unbanked and will
prevent a victim of identity theft from
using an alternative to an unsecured
home mailbox. Another commenter
noted that the physical address of a
customer’s principal place of business
may not be relevant if the bank is
working with a customer’s local office.
This commenter recommended that the
rule simply permit the bank to obtain
the customer’s street address. Credit
card banks and issuers urged Treasury
and the Agencies to make the
requirement that a bank obtain the
customer’s physical address optional.
Section 326 of the Act requires
Treasury and the Agencies to prescribe
regulations that require financial
institutions to implement ‘‘reasonable
procedures.’’ Accordingly, under the
final rule, a bank will not be required
to obtain more than a single address for
a customer
rged Treasury
and the Agencies to make the
requirement that a bank obtain the
customer’s physical address optional.
Section 326 of the Act requires
Treasury and the Agencies to prescribe
regulations that require financial
institutions to implement ‘‘reasonable
procedures.’’ Accordingly, under the
final rule, a bank will not be required
to obtain more than a single address for
a customer. Nonetheless, Treasury and
the Agencies believe that the
identification, verification, and
recordkeeping provisions of the Act,
taken together, should provide
appropriate resources for law
enforcement agencies to investigate
money laundering and terrorist
financing. The final rule therefore
provides that a bank generally must
obtain a residential or business street
address for a customer who is an
individual because Treasury and the
Agencies have determined that law
enforcement agencies should be able to
contact an individual customer at a
physical location, rather than solely
through a mailing address. Treasury and
the Agencies recognize that this
provision may be impracticable for
members of the military who cannot
readily provide a physical address, and
other individuals who do not have a
physical address but who reliably can
be contacted. Accordingly, the final rule
provides an exception under these
circumstances that allows a bank to
obtain an Army Post Office or Fleet Post
Office box number, or the residential or
business street address of next of kin or
of another contact individual. For a
customer other than an individual, such
as a corporation, partnership, or trust,
the bank may obtain the address of the
principal place of business, local office,
VerDate Jan<31>2003
17:31 May 08, 2003
Jkt 200001
PO 00000
Frm 00009
Fmt 4701
Sfmt 4700
E:\FR\FM\09MYR2.SGM
09MYR2
e box number, or the residential or
business street address of next of kin or
of another contact individual. For a
customer other than an individual, such
as a corporation, partnership, or trust,
the bank may obtain the address of the
principal place of business, local office,
VerDate Jan<31>2003
17:31 May 08, 2003
Jkt 200001
PO 00000
Frm 00009
Fmt 4701
Sfmt 4700
E:\FR\FM\09MYR2.SGM
09MYR2

25098
Federal Register / Vol. 68, No. 90 / Friday, May 9, 2003 / Rules and Regulations
25 The rule provides this flexibility because there
is no uniform identification number that non-U.S.
persons would be able to provide to a bank. See
Treasury Department, ‘‘A Report to Congress in
Accordance with Section 326(b) of the USA
PATRIOT Act,’’ October 21, 2002.
or other physical location of the
customer. Of course, a bank is free to
obtain additional addresses from the
customer, such as the customer’s
mailing address, to meet its own or its
customer’s business needs.
The proposal required that banks
obtain an identification number from
customers. For U.S. persons, a bank
would have been required to obtain a
U.S. taxpayer identification number. For
non-U.S. persons, a bank would have
been required to obtain a number from
various alternative forms of government-
issued identification.
One commenter stated that this
requirement would not be burdensome.
Commenters representing certain
consumer advocacy groups commended
Treasury and the Agencies for providing
banks with the discretion to accept
alternative forms of identifying
information from non-U.S. citizens.
These commenters stated that this
position would assist low-income
immigrants in gaining financial
stability. By contrast, some commenters
stated that the final rule should not
permit a bank to open an account for a
customer using only a foreign
identification number when the
customer provides a U.S. address
to accept
alternative forms of identifying
information from non-U.S. citizens.
These commenters stated that this
position would assist low-income
immigrants in gaining financial
stability. By contrast, some commenters
stated that the final rule should not
permit a bank to open an account for a
customer using only a foreign
identification number when the
customer provides a U.S. address. Other
commenters asked for guidance on
whether a bank is permitted to accept a
number from the identification
document issued by a foreign
government. A few commenters urged
the government to require a national
identification document for all
individuals.
Other commenters, primarily credit
card banks, stated that the requirement
that a bank obtain a U.S. taxpayer
identification number from U.S. persons
would create considerable hardship.
They stated that new credit card
customers are reluctant to give out their
social security numbers, especially over
the telephone. They urged that banks be
given the discretion to collect
identifying information, other than
social security numbers, when
appropriate in light of consumer privacy
and security concerns. In the
alternative, they recommended that
banks be permitted to obtain a U.S.
taxpayer identification number for U.S.
persons from a trusted third party
source, such as a credit reporting
agency.
Some commenters questioned what
number to use for accounts opened in
the name of a bowling league or class
reunion, or to accept donations for a
special cause. Other commenters
questioned what number could be
obtained from foreign businesses and
enterprises that have no taxpayer
identification number or other
government-issued documentation.
The final rule provides that a bank
must obtain an ‘‘identification number’’
from every customer
ccounts opened in
the name of a bowling league or class
reunion, or to accept donations for a
special cause. Other commenters
questioned what number could be
obtained from foreign businesses and
enterprises that have no taxpayer
identification number or other
government-issued documentation.
The final rule provides that a bank
must obtain an ‘‘identification number’’
from every customer. As discussed
above, under the definition of
‘‘customer,’’ the final rule permits a
bank to obtain the identification number
of the individual who opens an account
in the name of an individual who lacks
legal capacity, such as a minor, or a
civic group, such as a bowling league.
After reviewing the comments,
Treasury and the Agencies have
determined that requiring a bank to
obtain a customer’s identification
number, such as a social security
number, from the customer himself or
herself, in every case, including over the
telephone, would be unreasonable and
impracticable because it would be
contrary to banks’ current practices and
could alienate many potential
customers. Accordingly, Treasury and
the Agencies have adopted an exception
for credit card accounts that will permit
a bank offering such accounts to acquire
information about the customer,
including an identification number,
from a trusted third party source prior
to extending credit to the customer,
rather than having to obtain this
information directly from the customer
prior to opening an account.
The final rule also provides that for a
non-U.S. person, a bank must obtain one
or more of the following: A taxpayer
identification number (social security
number, individual taxpayer
identification number, or employer
identification number); passport number
and country of issuance; alien
identification card number; or number
and country of issuance of any other
government-issued document
evidencing nationality or residence and
bearing a photograph or similar
safeguard
ore of the following: A taxpayer
identification number (social security
number, individual taxpayer
identification number, or employer
identification number); passport number
and country of issuance; alien
identification card number; or number
and country of issuance of any other
government-issued document
evidencing nationality or residence and
bearing a photograph or similar
safeguard. This standard provides a
bank with some flexibility to choose
among a variety of identification
numbers that it may accept from a non-
U.S. person.25 However, the identifying
information the bank accepts must
permit the bank to establish a
reasonable belief that it knows the true
identity of the customer.
Treasury and the Agencies emphasize
that the final rule neither endorses nor
prohibits bank acceptance of
information from particular types of
identification documents issued by
foreign governments. A bank must
decide for itself, based upon appropriate
risk factors, including those discussed
above (the types of accounts maintained
by the bank, the various methods of
opening accounts provided by the bank,
the other types of identifying
information available, and the bank’s
size, location, and customer base),
whether the information presented by a
customer is reliable.
Treasury and the Agencies recognize
that a foreign business or enterprise may
not have a taxpayer identification
number or any other number from a
government-issued document
evidencing nationality or residence and
bearing a photograph or similar
safeguard. Therefore, the final rule notes
that when opening an account for such
a customer, the bank must request
alternative government-issued
documentation certifying the existence
of the business or enterprise.
The proposal also contained a limited
exception to the requirement that a bank
obtain a taxpayer identification number
from a customer opening a new account
tograph or similar
safeguard. Therefore, the final rule notes
that when opening an account for such
a customer, the bank must request
alternative government-issued
documentation certifying the existence
of the business or enterprise.
The proposal also contained a limited
exception to the requirement that a bank
obtain a taxpayer identification number
from a customer opening a new account.
The exception permitted a bank to open
an account for a person other than an
individual (such as a corporation,
partnership, or trust) that has applied
for, but has not received, an employer
identification number (EIN), provided
that the bank obtains a copy of the
application before it opens the account
and obtains the EIN within a reasonable
period of time after the account is
established. The preamble for the
proposed rule explained that this
exception was included for a new
business that might need access to
banking services, particularly a bank
account or an extension of credit, before
it has received an EIN from the Internal
Revenue Service.
Some commenters questioned this
limited exception for certain businesses.
A few commenters suggested expanding
the exception to include individuals
who have applied for, but have not yet
received a taxpayer identification
number. Another commenter stated that
the exception provided no added benefit
and would add to a bank’s
recordkeeping and monitoring burden.
Treasury and the Agencies have
determined that a bank should be
afforded more flexibility in situations
where a person, including an
individual, has applied for, but has not
yet received, a taxpayer identification
number
d a taxpayer identification
number. Another commenter stated that
the exception provided no added benefit
and would add to a bank’s
recordkeeping and monitoring burden.
Treasury and the Agencies have
determined that a bank should be
afforded more flexibility in situations
where a person, including an
individual, has applied for, but has not
yet received, a taxpayer identification
number. Therefore, the final rule states
that instead of obtaining a taxpayer
identification number from a customer
prior to opening an account, the CIP
may include procedures for opening an
account for a customer (including an
individual) that has applied for, but has
not received, a taxpayer identification
VerDate Jan<31>2003
17:31 May 08, 2003
Jkt 200001
PO 00000
Frm 00010
Fmt 4701
Sfmt 4700
E:\FR\FM\09MYR2.SGM
09MYR2

25099
Federal Register / Vol. 68, No. 90 / Friday, May 9, 2003 / Rules and Regulations
26 This position is analogous to that in regulations
issued by the Internal Revenue Service (IRS)
concerning ‘‘awaiting-TIN [taxpayer identification
number] certificates.’’ The IRS permits a taxpayer
to furnish an ‘‘awaiting-TIN certificate’’ in lieu of
a taxpayer identification number to exempt the
taxpayer from the withholding of taxes owed on
reportable payments (i.e., interest and dividends)
on certain accounts. See 26 CFR 31.3406(g)–3.
27 For example, the bank may wish to examine a
copy of the application filed.
28 The preamble for the proposed rule noted that,
although an account may be opened, it is common
practice among banks to place limits on the
account, such as by restricting the number of
transactions or the dollar value of transactions,
until a customer’s identity is verified. Therefore, the
proposed regulation provided the bank with the
flexibility to use a risk-based approach to determine
how soon identity must be verified.
29 It is possible that a bank would, however,
violate other laws by permitting a customer to
transact business prior to verifying the customer’s
identity
nsactions or the dollar value of transactions,
until a customer’s identity is verified. Therefore, the
proposed regulation provided the bank with the
flexibility to use a risk-based approach to determine
how soon identity must be verified.
29 It is possible that a bank would, however,
violate other laws by permitting a customer to
transact business prior to verifying the customer’s
identity. See, e.g., 31 CFR part 500 (regulations of
Treasury’s Office of Foreign Asset Control (OFAC)
prohibiting transactions involving designated
foreign countries or their nationals).
number.26 To lessen the recordkeeping
burden for a bank that elects to use this
exception, the final rule also provides
that the bank’s CIP need only include
procedures requiring the bank to
confirm that the application was filed
before the customer opens the account
and to obtain the taxpayer identification
number within a reasonable period of
time after the account is opened. Thus,
a bank will be able to exercise its
discretion 27 to determine how to
confirm that a customer has filed an
application for a taxpayer identification
number rather than having to keep a
copy of the application on file.
Section 103.121(b)(2)(ii) Customer
Verification. The proposed rule
provided that the CIP must contain risk-
based procedures for verifying the
information that the bank obtains in
accordance with § 103.121(b)(2)(i),
within a reasonable period of time after
the account is opened.28 The proposed
rule also described when a bank is
required to verify the identity of existing
customers.
Several commenters asked Treasury
and the Agencies to underscore that
these verification procedures may be
risk-based by noting that a bank may
verify less than all of the identifying
information provided by the customer.
Many commenters noted that there is
currently no reliable, efficient, or
effective means of verifying a customer’s
social security number
dentity of existing
customers.
Several commenters asked Treasury
and the Agencies to underscore that
these verification procedures may be
risk-based by noting that a bank may
verify less than all of the identifying
information provided by the customer.
Many commenters noted that there is
currently no reliable, efficient, or
effective means of verifying a customer’s
social security number. Some of these
commenters asked the government to
establish a method that would permit
banks to establish the authenticity and
accuracy of a customer’s name and
taxpayer identification number.
Treasury and the Agencies recognize
that there currently is no method that
would permit a bank to verify, for
example, a taxpayer identification,
passport or alien identification number
through an official source. Accordingly,
the final rule provides that a bank’s CIP
must contain procedures for verifying
the identity of the customer, ‘‘using the
information obtained in accordance
with paragraph (b)(2)(i),’’ namely, the
identifying information obtained by the
bank. Thus, a bank need not establish
the accuracy of every element of
identifying information obtained but
must do so for enough information to
form a reasonable belief it knows the
true identity of the customer.
Some commenters stated that they
appreciated the flexibility of the
proposal permitting an institution to
determine how soon identity must be
verified. Other commenters asked
Treasury and the Agencies to clarify
what is a ‘‘reasonable period of time.’’
As stated in the preamble for the
proposal, Treasury and the Agencies
believe that the amount of time it will
take an institution to verify a customer’s
identity may depend upon various
factors, such as the type of account
opened, whether the customer is
physically present when the account is
opened, and the type of identifying
information available
at is a ‘‘reasonable period of time.’’
As stated in the preamble for the
proposal, Treasury and the Agencies
believe that the amount of time it will
take an institution to verify a customer’s
identity may depend upon various
factors, such as the type of account
opened, whether the customer is
physically present when the account is
opened, and the type of identifying
information available. For the same
reasons, the final rule provides banks
with the flexibility necessary to
accommodate a wide range of situations
by stating that the bank must verify the
identifying information within a
reasonable time after the account is
opened.29
As discussed above in the definition
section, many commenters criticized the
proposed approach regarding
verification of existing customers that
open new accounts. The final rule
addresses these concerns by modifying
the definition of ‘‘customer’’ to exclude
a person who has an existing account
with the bank if the bank has a
reasonable belief that it knows the true
identity of the person.
Many commenters urged that the final
rule continue to allow, but not mandate,
documentary verification. A few
commenters requested that the final rule
provide additional guidance on
verification. Some commenters asked
that the final rule clarify that a bank
may choose to use only documentary
methods and may refuse to open an
account using other methods.
The final rule addresses these
comments by stating that a bank’s CIP’s
verification procedures must describe
when the bank will use documents,
non-documentary methods, or a
combination of both methods to verify
a customer’s identity.
Section 103.121(b)(2)(ii)(A)
Verification Through Documents. The
proposed rule provided that the CIP
must contain procedures describing
when the bank will verify identity
through documents and setting forth the
documents that the bank will use for
this purpose
be
when the bank will use documents,
non-documentary methods, or a
combination of both methods to verify
a customer’s identity.
Section 103.121(b)(2)(ii)(A)
Verification Through Documents. The
proposed rule provided that the CIP
must contain procedures describing
when the bank will verify identity
through documents and setting forth the
documents that the bank will use for
this purpose. It then gave examples of
documents that could be used to verify
the identity of individuals and other
persons such as corporations,
partnerships, and trusts.
Most commenters noted that banks do
not have the means to authenticate or
validate documents provided by their
customers and urged Treasury and the
Agencies to clarify that document
authentication is not a CIP requirement.
Treasury and the Agencies wish to
confirm that once a bank has obtained
and verified the identity of the customer
through a document such as a driver’s
license or passport, the bank will not be
required to take steps to determine
whether the document has been validly
issued. A bank generally may rely on
government-issued identification as
verification of a customer’s identity;
however, if a document shows obvious
indications of fraud, the bank must
consider that factor in determining
whether it can form a reasonable belief
that it knows the customer’s true
identity.
Some commenters also asked that
Treasury and the Agencies provide more
examples and discuss appropriate types
of documentary identification in the
final rule or in separate guidance that
banks may easily access. Commenters
asked whether a utility bill, or library
card addressed to the same physical
address and name of the person seeking
the account, or a foreign identification
card, such as a foreign voter registration
card or driver’s license, would be
acceptable. Some commenters
questioned whether copies of
documents would suffice
inal rule or in separate guidance that
banks may easily access. Commenters
asked whether a utility bill, or library
card addressed to the same physical
address and name of the person seeking
the account, or a foreign identification
card, such as a foreign voter registration
card or driver’s license, would be
acceptable. Some commenters
questioned whether copies of
documents would suffice.
Given the recent increases in identity
theft and the availability of fraudulent
documents, Treasury and the Agencies
agree with a commenter who suggested
that the value of documentary
verification is enhanced by redundancy.
The rule gives examples of types of
documents that are considered reliable.
However, a bank is encouraged to obtain
more than one type of documentary
verification to ensure that it has a
reasonable belief that it knows the
customer’s true identity. Moreover,
banks are encouraged to use a variety of
methods to verify the identity of a
customer, especially when the bank
does not have the ability to examine
original documents.
The final rule attempts to strike the
appropriate balance between the
VerDate Jan<31>2003
17:31 May 08, 2003
Jkt 200001
PO 00000
Frm 00011
Fmt 4701
Sfmt 4700
E:\FR\FM\09MYR2.SGM
09MYR2

25100
Federal Register / Vol. 68, No. 90 / Friday, May 9, 2003 / Rules and Regulations
benefits of requiring additional
documentary verification and the
burdens that may arise from such a
requirement by providing that a bank’s
CIP must state the documents that a
bank will use. This will require each
bank to conduct its own risk-based
analysis of the types of documents it
believes will enable it to know the true
identity of its customers.
The final rule continues to provide an
illustrative list of identification
documents. For an individual, these
may include an unexpired government-
issued identification evidencing
nationality or residence and bearing a
photograph or similar safeguard, such as
a driver’s license or passport
is of the types of documents it
believes will enable it to know the true
identity of its customers.
The final rule continues to provide an
illustrative list of identification
documents. For an individual, these
may include an unexpired government-
issued identification evidencing
nationality or residence and bearing a
photograph or similar safeguard, such as
a driver’s license or passport. For a
person other than an individual, these
may include documents showing the
existence of the entity, such as certified
articles of incorporation, a government-
issued business license, a partnership
agreement, or a trust instrument.
Some commenters questioned
whether the examples of identification
documents given for persons other than
individuals would be reliable. One
commenter questioned whether trust
documents alone would be sufficient
verification of identity. Another
commenter suggested allowing banks to
rely on a certification by the trustee, or
an appropriate legal opinion, rather than
the trust instrument to verify the
existence of a trust. Someone else
suggested that banks should be allowed
to rely on documentation consisting of
evidence that a business is either
publicly traded or is authorized to do
business in a state or the United States.
The examples provided in the final
rule were intended only to illustrate the
documents a bank might use to verify
the identity of a customer that is a
corporation, partnership, or trust. A
bank may use other documents,
provided that they allow the bank to
establish that it has a reasonable belief
that it knows the true identity of its
customer. Accordingly, the final rule
makes no significant changes to the
examples.
Section 103.121(b)(2)(ii)(B) Non-
Documentary Verification
bank might use to verify
the identity of a customer that is a
corporation, partnership, or trust. A
bank may use other documents,
provided that they allow the bank to
establish that it has a reasonable belief
that it knows the true identity of its
customer. Accordingly, the final rule
makes no significant changes to the
examples.
Section 103.121(b)(2)(ii)(B) Non-
Documentary Verification. Recognizing
that some accounts are opened by
telephone, by mail, and over the
Internet, the proposed rule provided
that a bank’s CIP also must contain
procedures describing what non-
documentary methods the bank will use
to verify identity and when the bank
will use these methods (whether in
addition to, or instead of, relying on
documents). The preamble for the
proposed rule also noted that even if the
customer presents identification
documents, it may be appropriate to use
non-documentary methods as well.
The proposed rule gave examples of
non-documentary verification methods
that a bank may use, including
contacting a customer after the account
is opened; obtaining a financial
statement; comparing the identifying
information provided by the customer
against fraud and bad check databases to
determine whether any of the
information is associated with known
incidents of fraudulent behavior
(negative verification); comparing the
identifying information with
information available from a trusted
third party source, such as a credit
report from a consumer reporting
agency (positive verification); and
checking references with other financial
institutions. The preamble for the
proposed rule stated that a bank also
may wish to analyze whether there is
logical consistency between the
identifying information provided, such
as the customer’s name, street address,
ZIP code, telephone number, date of
birth, and social security number
(logical verification)
agency (positive verification); and
checking references with other financial
institutions. The preamble for the
proposed rule stated that a bank also
may wish to analyze whether there is
logical consistency between the
identifying information provided, such
as the customer’s name, street address,
ZIP code, telephone number, date of
birth, and social security number
(logical verification).
The proposal required that the
procedures address situations where an
individual, such as an elderly person,
legitimately is unable to present an
unexpired government-issued
identification document that bears a
photograph or similar safeguard; the
bank is not familiar with the documents
presented; the account is opened
without obtaining documents; the
account is not opened in a face-to-face
transaction, for example over the phone,
by mail, or through the Internet; and the
type of account increases the risk that
the bank will not be able to verify the
true identity of the customer through
documents.
Several commenters asked for
additional guidance regarding when
non-documentary verification methods
should be used in addition to
documentary verification methods and
the circumstances in which only one or
all of the non-documentary verification
methods listed are necessary.
Commenters also asked for guidance on
audit methodology, and an explanation
of the due diligence required for
verification of accounts opened by
telephone, mail, and through the
Internet. A few commenters suggested
that reference to verification, where a
bank compares information provided by
the customer with information from
trusted third party sources, be expressly
mentioned in the final rule.
As the large number of comments on
this section illustrates, a rule that
attempted to address every scenario and
combination of risk-factors that a bank
might confront would be extremely
complex and invariably would fail to
address many situations
ank compares information provided by
the customer with information from
trusted third party sources, be expressly
mentioned in the final rule.
As the large number of comments on
this section illustrates, a rule that
attempted to address every scenario and
combination of risk-factors that a bank
might confront would be extremely
complex and invariably would fail to
address many situations. Rather than
adopt a lengthy and potentially
unwieldy rule that still would not
address every situation, Treasury and
the Agencies have concluded that it
would be more effective to adopt
general principles that are fleshed out
through examples. Therefore, the final
rule states that for a bank relying on
non-documentary verification methods,
the CIP must contain procedures that
describe the non-documentary methods
the bank will use.
The final rule generally retains the
illustrative list of non-documentary
methods contained in the proposal.
Treasury and the Agencies have
clarified that one method is
‘‘independently verifying the customer’s
identity through the comparison of
information provided by the customer
with information obtained from a
consumer reporting agency, public
database, or other source,’’ rather than
verifying ‘‘documentary information’’
through such sources.
The final rule also retains the variety
of situations that the procedures must
address that were identified in the
proposal, with the following two
changes. First, because ‘‘transaction’’ is
a defined term in 31 CFR part 103,
instead of using the term ‘‘face-to-face
transaction,’’ the final rule states that
the procedures must address the
situation where a customer opens an
account without appearing in person at
the bank. Second, the final clause of this
provision provides that the CIP must
include procedures to address situations
where the bank is otherwise presented
with circumstances that increase the
risk that the bank will be unable to
verify the true identity of a customer
through documents
ocedures must address the
situation where a customer opens an
account without appearing in person at
the bank. Second, the final clause of this
provision provides that the CIP must
include procedures to address situations
where the bank is otherwise presented
with circumstances that increase the
risk that the bank will be unable to
verify the true identity of a customer
through documents. This clause
acknowledges that there may be
circumstances beyond those specifically
described in this provision when a bank
should use non-documentary
verification procedures.
As stated in the preamble for the
proposed rule, because identification
documents may be obtained illegally
and may be fraudulent, and in light of
the recent increase in identity theft,
Treasury and the Agencies encourage
banks to use non-documentary methods
even when the customer has provided
identification documents.
Section 103.121(b)(2)(ii)(C) Additional
Verification for Certain Customers. As
described above, the proposed rule
required the identification and
verification of each signatory for an
account. Most commenters objected to
this requirement as overly burdensome,
and, upon consideration of the points
raised by the commenters, Treasury and
the Agencies agree that it is appropriate
VerDate Jan<31>2003
17:31 May 08, 2003
Jkt 200001
PO 00000
Frm 00012
Fmt 4701
Sfmt 4700
E:\FR\FM\09MYR2.SGM
09MYR2

25101
Federal Register / Vol. 68, No. 90 / Friday, May 9, 2003 / Rules and Regulations
30 The preamble also explained that there are
some exceptions to this basic rule. For example, a
bank may maintain an account at the direction of
a law enforcement or intelligence agency, even
though the bank does not know the true identity of
the customer.
31 See 12 CFR 202.9(b) (Federal Reserve
Regulation B that prescribes the form of ECOA
notice and statement of specific reasons); 15 U.S.C
The preamble also explained that there are
some exceptions to this basic rule. For example, a
bank may maintain an account at the direction of
a law enforcement or intelligence agency, even
though the bank does not know the true identity of
the customer.
31 See 12 CFR 202.9(b) (Federal Reserve
Regulation B that prescribes the form of ECOA
notice and statement of specific reasons); 15 U.S.C.
1681m (FCRA provision that provides for duties of
users taking adverse actions on the basis of
information contained in consumer reports from
other third parties or affiliates).
to delete it. For the reasons discussed
below, however, the rule does require
that a bank’s CIP address the
circumstances in which it will obtain
information about such individuals in
order to verify the customer’s identity.
Treasury and the Agencies believe that
while the majority of customers may be
verified adequately through the
documentary or non-documentary
verification methods described in
paragraphs (b)(2)(ii)(A) and (B), there
may be instances where this is not
possible. The risk that the bank will not
know the customer’s true identity may
be heightened for certain types of
accounts, such as an account opened in
the name of a corporation, partnership,
or trust that is created or conducts
substantial business in a jurisdiction
that has been designated by the United
States as a primary money laundering
concern or has been designated as non-
cooperative by an international body.
Obtaining sufficient information to
verify a customer’s identity can reduce
the risk that a bank will be used as a
conduit for money laundering and
terrorist financing
ust that is created or conducts
substantial business in a jurisdiction
that has been designated by the United
States as a primary money laundering
concern or has been designated as non-
cooperative by an international body.
Obtaining sufficient information to
verify a customer’s identity can reduce
the risk that a bank will be used as a
conduit for money laundering and
terrorist financing. Treasury and the
Agencies believe that a bank must
identify customers that pose a
heightened risk of not being properly
identified, and a bank’s CIP must
prescribe additional measures that may
be used to obtain information about the
identity of the individuals associated
with the entity in whose name such an
account is opened when standard
documentary and non-documentary
methods prove to be insufficient.
For these reasons, the requirement to
verify the identity of signatories has
been replaced by a new provision in the
final rule that requires that a bank’s CIP
address situations where, based on the
bank’s risk assessment of a new account
opened by a customer that is not an
individual, the bank also will obtain
information about individuals with
authority or control over such account,
including signatories, in order to verify
the customer’s identity. This additional
verification method will only apply
when the bank cannot adequately verify
the customer’s identity using the
documentary and non-documentary
verification methods described in
mer that is not an
individual, the bank also will obtain
information about individuals with
authority or control over such account,
including signatories, in order to verify
the customer’s identity. This additional
verification method will only apply
when the bank cannot adequately verify
the customer’s identity using the
documentary and non-documentary
verification methods described in
(b)(2)(ii)(A) and (B). Moreover, a bank
need not undertake any additional
verification if it chooses not to open an
account when it cannot verify the
customer’s identity using standard
documentary and non-documentary
verification methods.
Section 103.121(b)(2)(iii) Lack of
Verification. The proposed rule stated
that a bank’s CIP must include
procedures for responding to
circumstances in which the bank cannot
form a reasonable belief that it knows
the true identity of a customer. The
preamble for the proposed rule listed
what these procedures should include.
In addition, the proposal stated that a
bank should only maintain an account
for a customer when it can form a
reasonable belief that it knows the
customer’s true identity.30
The final rule retains the general
requirement that a bank’s CIP include
procedures for responding to
circumstances in which the bank cannot
form a reasonable belief that it knows
the true identity of the customer.
However, the rule text itself now states
that the procedures should describe the
following: when a bank should not open
an account for a potential customer; the
terms under which a customer may use
an account while the bank attempts to
verify the customer’s identity; when the
bank should close an account after
attempts to verify a customer’s identity
have failed; and when the bank should
file a Suspicious Activity Report in
accordance with applicable law and
regulation
llowing: when a bank should not open
an account for a potential customer; the
terms under which a customer may use
an account while the bank attempts to
verify the customer’s identity; when the
bank should close an account after
attempts to verify a customer’s identity
have failed; and when the bank should
file a Suspicious Activity Report in
accordance with applicable law and
regulation.
One commenter stated that requiring
a bank to close an account if it cannot
verify a customer’s identity would
conflict with state laws and would
subject the bank to legal liability. The
commenter urged that if this provision
is retained, the final rule also should
shield banks from state regulatory and
borrower liability in these
circumstances. Other commenters asked
that Treasury and the Agencies clarify
that further investigation that results in
failure to open an account will not
trigger adverse action requirements
under the FCRA, 15 U.S.C. 1681 et seq.
or the Equal Credit Opportunity Act
(ECOA), 15 U.S.C. 1691 et seq.
The final rule does not specifically
require a bank to close the account of a
customer whose identity the bank
cannot verify, but instead leaves this
determination to the discretion of the
bank. Treasury and the Agencies have
determined that there is no statutory
basis to create a safe harbor that would
shield banks from state regulatory or
borrower liability if a bank should
choose to close a customer’s account.
Any such closure should be consistent
with the bank’s existing procedures for
closing accounts in accordance with its
risk management practices. Treasury
and the Agencies also note that a bank
must comply with other applicable laws
and regulations, such as the adverse
action provisions under ECOA and the
FCRA, when determining not to open an
account because it cannot establish a
reasonable belief that it knows the true
identity of the customer.31
Section 103.121(b)(3)
Recordkeeping
Section 103.121(b)(3)(i) Required
Records
tices. Treasury
and the Agencies also note that a bank
must comply with other applicable laws
and regulations, such as the adverse
action provisions under ECOA and the
FCRA, when determining not to open an
account because it cannot establish a
reasonable belief that it knows the true
identity of the customer.31
Section 103.121(b)(3)
Recordkeeping
Section 103.121(b)(3)(i) Required
Records. The proposed rule set forth
recordkeeping procedures that must be
included in a bank’s CIP. Under the
proposal, a bank would have been
required to maintain a record of the
identifying information provided by the
customer. Where a bank relies upon a
document to verify identity, the
proposal would have required the bank
to maintain a copy of the document that
the bank relied on that clearly evidences
the type of document and any
identifying information it may contain.
The bank also would have been required
to record the methods and result of any
additional measures undertaken to
verify the identity of the customer. Last,
the bank would have been required to
record the resolution of any discrepancy
in the identifying information obtained.
This section of the proposed rule
prompted the most comment. Though
one commenter felt that the
recordkeeping requirements in the
proposed rule were weak, almost all
other commenters identified the
proposed documentation and record
retention requirements as overly
burdensome. Commenters urged
Treasury and the Agencies to permit a
bank to record the information from the
documents obtained rather than
requiring banks to maintain copies of
these documents for the life of the
account. Commenters generally argued
that it would be difficult and very
burdensome to store and retrieve copies
of documents used to verify the identity
of the customer. In addition, some
commenters noted that many kinds of
identification documents, particularly
some new driver’s licenses, have
security features that prevent them from
being copied legibly
e documents for the life of the
account. Commenters generally argued
that it would be difficult and very
burdensome to store and retrieve copies
of documents used to verify the identity
of the customer. In addition, some
commenters noted that many kinds of
identification documents, particularly
some new driver’s licenses, have
security features that prevent them from
being copied legibly. Other commenters
stated that copies of documents would
be difficult to safeguard and could
facilitate identity theft.
Commenters stated that requiring
banks to keep copies of documents
would substantially deviate from
current banking practice and would
violate certain states’ laws. Banks
offering credit card accounts through
retailers, who require the customer to
VerDate Jan<31>2003
17:31 May 08, 2003
Jkt 200001
PO 00000
Frm 00013
Fmt 4701
Sfmt 4700
E:\FR\FM\09MYR2.SGM
09MYR2

25102
Federal Register / Vol. 68, No. 90 / Friday, May 9, 2003 / Rules and Regulations
32 Nevertheless, the legislative history for this
provision indicates that the lists Congress intended
financial institutions to consult ‘‘are those already
supplied to financial institutions by the Office of
Foreign Asset Control (OFAC), and occasionally by
law enforcement and regulatory authorities, as in
the days immediately following the September 11,
2001, attacks on the World Trade Center and the
Pentagon.’’ H.R. Rep. No. 107–250, pt. 1, at 63
ndicates that the lists Congress intended
financial institutions to consult ‘‘are those already
supplied to financial institutions by the Office of
Foreign Asset Control (OFAC), and occasionally by
law enforcement and regulatory authorities, as in
the days immediately following the September 11,
2001, attacks on the World Trade Center and the
Pentagon.’’ H.R. Rep. No. 107–250, pt. 1, at 63
(2001).
provide identifying documents at the
point of

[Text truncated at 120,000 characters. The full text is on the page linked above.]

## Nearby sections

- [FDIC FIL-1-2002 FOREIGN ASSETS CONTROL ACT](https://www.frixlaw.com/law-library/statutes/FDIC_FIL02001.md)
- [FDIC FIL-1-2010 Employee Compensation Advance Notice of Proposed Rulemaking](https://www.frixlaw.com/law-library/statutes/FDIC_FIL10001.md)
- [FDIC FIL-1-2015 DEPOSITORY INSTITUTION REPORTS](https://www.frixlaw.com/law-library/statutes/FDIC_FIL15001.md)
- [FDIC FIL-1-2018 DEPOSITORY INSTITUTION REPORTS](https://www.frixlaw.com/law-library/statutes/FDIC_FIL18001.md)
- [FDIC FIL-1-2024 Consolidated Reports of Condition and Income for Fourth Quarter 2023](https://www.frixlaw.com/law-library/statutes/FDIC_FIL24001.md)
- [FDIC FIL-2-2019 DEPOSITORY INSTITUTION REPORTS](https://www.frixlaw.com/law-library/statutes/FDIC_FIL19002.md)
- [FDIC FIL-2-2020 Consolidated Reports of Condition and Income for Fourth Quarter 2019](https://www.frixlaw.com/law-library/statutes/FDIC_FIL20002.md)
- [FDIC FIL-3-2017 Community Banking Conference 2016 Highlights](https://www.frixlaw.com/law-library/statutes/FDIC_FIL17003.md)
- [FDIC FIL-4-2015 The FDIC Launches Web Page to Support Marketing of Failing Financial Institutions](https://www.frixlaw.com/law-library/statutes/FDIC_FIL15004.md)
- [FDIC FIL-4-2018 Revisions to the Consolidated Reports of Condition and Income (Call Report) for March and June 2018](https://www.frixlaw.com/law-library/statutes/FDIC_FIL18004.md)
- [FDIC FIL-4-2019 Banker Webinar: Update on the Standardized Export of Imaged Loan Documents Initiative](https://www.frixlaw.com/law-library/statutes/FDIC_FIL19004.md)
- [FDIC FIL-4-2021 Revised Guidelines for Appeals of Material Supervisory Determinations](https://www.frixlaw.com/law-library/statutes/FDIC_FIL21004.md)
- [FDIC FIL-4-2023 Guidance to Help Financial Institutions and Facilitate Recovery in Areas of California Affected by Severe Winter Storms, Flooding, Landslides and Mudslides](https://www.frixlaw.com/law-library/statutes/FDIC_FIL23004.md)
- [FDIC FIL-4-2025 FDIC Statement of Policy on Bank Merger Transactions](https://www.frixlaw.com/law-library/statutes/FDIC_FIL25004.md)

---

Source: Frix Law Library, https://www.frixlaw.com/law-library/statutes/FDIC_FIL03042. Check the current official text before relying on it. Not legal advice.