DATE:            April 2002                                       NO:     02-RA-02

TO:                 All Federally-Insured Credit Unions

SUBJECT:   Patriot Act Regulation to Improve Information Sharing

ENCL:           Federal Registry Interim Rule No.  31 CFR Part 103

The Department of the Treasury recently announced the issuance of an interim final regulation implementing a provision of the USA PATRIOT Act.  It was published in the Federal Register on March 4, 2002. 

The interim final regulation, effective March 4, 2002, permits certain financial institutions to share information amongst themselves for the purpose of identifying and reporting suspected terrorism and money laundering.  Financial institutions must notify Treasury’s Financial Crimes Enforcement Network (FinCEN) of their intent to share information and ensure adequate steps to maintain confidentiality. 

Enclosed is the interim final regulation.

                                                                        Sincerely,

                                                                          /S/

                                                                        Dennis Dollar
                                                                        Chairman

Enclosure

---

[Federal Register: March 4, 2002 (Volume 67, Number 42)]
[Rules and Regulations]
[Page 9873-9878]
From the Federal Register Online via GPO Access [wais.access.gpo.gov]
[DOCID:fr04mr02-12]


[[Page 9873]]

-----------------------------------------------------------------------

Part III





Department of the Treasury





-----------------------------------------------------------------------



31 CFR Part 103



Financial Crimes Enforcement Network; Special Information Sharing
Procedures To Deter Money Laundering and Terrorist Activity; Final Rule
and Proposed Rule


[[Page 9874]]


-----------------------------------------------------------------------

DEPARTMENT OF THE TREASURY

31 CFR Part 103

RIN 1506-AA26


Financial Crimes Enforcement Network; Special Information Sharing
Procedures to Deter Money Laundering and Terrorist Activity

AGENCY: Financial Crimes Enforcement Network (FinCEN), Treasury.

ACTION: Interim rule.

-----------------------------------------------------------------------

SUMMARY: FinCEN, a bureau of the Treasury Department, is issuing
regulations to implement the provision in the Uniting and Strengthening
America by Providing Appropriate Tools Required to Intercept and
Obstruct Terrorism (USA PATRIOT) Act of 2001 that encourages
information sharing among financial institutions for purposes of
identifying and reporting activities that may involve terrorist acts or
money laundering activities.

DATES: This rule is effective March 4, 2002.

FOR FURTHER INFORMATION CONTACT: Judith R. Starr, Chief Counsel
(FinCEN), (703) 905-3590; William Langford, Senior Counsel for
Financial Crimes, Office of the Assistant General Counsel
(Enforcement), (202) 622-1932; or Gary W. Sutton, Senior Banking
Counsel, Office of the Assistant General Counsel (Banking & Finance),
(202) 622-1976 (not toll-free numbers). Financial institutions with
questions about their coverage or compliance obligations under this
rule should contact their appropriate federal regulator.

SUPPLEMENTARY INFORMATION:

I. Background

On October 26, 2001, the President signed into law the USA PATRIOT
Act of 2001 (Public Law 107-56) (the Act). Of the Act's many goals, the
facilitation of information sharing among governmental entities and
financial institutions for the purpose of combating terrorism and money
laundering is of paramount importance. Section 314 of the Act furthers
this goal by providing for the sharing of information between the
government and financial institutions, and among financial institutions
themselves. As with many other provisions of the Act, Congress has
charged Treasury with developing regulations to implement these
information-sharing provisions.
Section 314(b) of the Act permits financial institutions, upon
providing notice to Treasury, to share information with one another in
order to better identify and report to the federal government
concerning activities that may involve money laundering or terrorist
activities. This interim rule implements section 314(b). The Congress
authorized financial institutions to share information to assist in the
identification of suspected terrorists and money launderers only after
providing notice to Treasury. The notice provision outlined below--a
yearly certification to FinCEN that information will be shared and
protected from inappropriate disclosure--combined with the requirement
that any money laundering or terrorist activities uncovered be reported
to FinCEN or other law enforcement, will allow for the sharing of
information while protecting the privacy interests of customers of
financial institutions.
Published elsewhere in this issue of the Federal Register is a
notice of proposed rulemaking that solicits comments on proposed
provisions that are identical to this interim rule, as well as proposed
regulations to implement the provisions of section 314(a) the Act,
which concerns enhanced cooperation between financial institutions and
federal law enforcement agencies to detect terrorist and money
laundering activities. Please refer to the notice of proposed
rulemaking for instructions for submitting comments on the proposed
provisions that are identical to this interim rule.

II. Analysis of the Interim Rule

A. General Definitions

Section 103.90--Definitions
As noted above, section 314(b) of the Act permits financial
institutions, upon providing notice to Treasury, to share information
with one another in order to identify and report to the federal
government activities that may involve money laundering or terrorist
activity. Although section 314 does not define ``money laundering'' or
``terrorist activity,'' each of these terms has well-established
definitions. Accordingly, and consistent with the broad intent
underlying section 314(b), section 103.90(a) defines ``money
laundering'' to mean any activity described in section 1956 or 1957 of
title 18, United States Code. Similarly, section 103.90(b) defines
``terrorist activity'' to mean an act of domestic terrorism or
international terrorism as defined in section 2331 of title 18, United
States Code.

B. Information Sharing Among Financial Institutions

Section 103.110--Voluntary Information Sharing Among Financial
Institutions
The Act does not define the term ``financial institution'' for
purposes of the information sharing provisions of 314(b). Under the
Bank Secrecy Act (BSA), which is concerned with information reporting
to detect and prevent financial crimes, the term ``financial
institution'' is defined broadly.\1\ Unlike section 314(a), which
involves financial institutions responding to requests for information
from federal law enforcement agencies,\2\ section 314(b) involves the
sharing of information among financial institutions and raises issues
concerning information privacy.\3\ For these reasons, Treasury and
FinCEN believe that it is appropriate to define the term ``financial
institution'' for purposes of section 314(b) in a manner that is most
likely to further the identification of terrorist and money laundering
activities while minimizing the likelihood that information sharing
will inappropriately intrude on the privacy interests of the customers
of those institutions. Accordingly, section 103.110(a)(2) defines
``financial institution'' for purposes of section 314(b) to mean (1) a
financial institution that is subject to SAR reporting that is not a
money services business, which includes banks, savings associations,
and credit unions; (2) a broker or dealer registered with the
Securities and Exchange Commission under the Securities Exchange Act of
1934 (15 U.S.C. 78a et seq.); (3) an issuer of traveler's checks or
money orders, (4) a registered money transmitter, or (5) an operator of
a credit card system that is not a money services business. Treasury
and FinCEN specifically request comment, in connection with the
proposed rule published elsewhere in this issue of the Federal
Register, concerning whether these entities should be included within
the definition for purposes of section 314(b) of the Act and regulation
section 103.110, and whether the definition should be expanded to
include other categories of BSA financial institutions.
---------------------------------------------------------------------------

\1\ See 31 U.S.C. 5312(a)(2).
\2\ Treasury and FinCEN are proposing to apply section 314(a) to
all BSA financial institutions. See the proposed rule implementing
section 314(a) published elsewhere in this issue of the Federal
Register.
\3\ See Act sections 314(b) and (c), which provide protections
from federal and State prohibitions on the disclosure of information
to financial institutions that engage in information sharing
consistent with the requirements of section 314(b) and its
implementing regulations.

---------------------------------------------------------------------------

[[Page 9875]]

Section 103.110(b) provides that upon providing the appropriate
certification to Treasury, as described below, a financial institution
may share information with other financial institutions regarding
individuals, entities, organizations, and countries for purposes of
detecting, identifying, or reporting activities that the financial
institution or association suspects may involve money laundering or
terrorist activity. Because associations of such financial institutions
can enhance the sharing of information among its members, this section
also permits these associations to participate in the information
sharing process.
Prior to engaging in information sharing, a financial institution
or association of financial institutions must submit to FinCEN a
certification described in new Appendix B to 31 CFR part 103, that
confirms: the name of the financial institution or association of
financial institutions; that the financial institution is a financial
institution as defined in section 103.110(a), or in the case of an
association, that the association's members that intend to engage in
information sharing are financial institutions as defined in section
103.110(a); that the institution or association will maintain adequate
procedures to protect the security and confidentiality of such
information; that the institution or association will not use any
shared information for any purpose other than as authorized in section
103.110; and the identity of a contact person at the financial
institution or association for matters pertaining to information
sharing.
To streamline the certification process, FinCEN has established a
special page on its existing Internet website, http://frwebgate.access.gpo.gov/cgi-bin/leaving.cgi?from=leavingFR.html&log=linklog&to=http://www.treas.gov/fincen, where financial institutions can enter the appropriate
information. If a financial institution or association does not have
access to the Internet, the certification may be mailed to FinCEN at
the address specified in the rule.
By requiring notice to Treasury before information is shared among
financial institutions, Congress has injected Treasury into what would
otherwise be a purely private communication. The statute did not
indicate clearly whether prior notice to Treasury was required before
each individual communication or whether a general notice would be
sufficient. After considering both the need for flexibility for
financial institutions as well as the need to ensure that the right to
share information under this section is not being used improperly,
Treasury and FinCEN determined that the certification should be
effective for a one-year period beginning on the date of the
certification. A re-certification, provided to FinCEN in the same
manner, is required if a financial institution or association intends
to continue to share information. An annual certification will help
Treasury determine which financial institutions are sharing
information, and it will reinforce the need for financial institutions
to protect information shared under this section. Treasury and FinCEN
balanced the minimal burden associated with completing the brief
electronic or paper certification against its role in protecting the
privacy interests of customers of financial institutions.
Section 103.110(c) requires each financial institution or
association of financial institutions that engages in the sharing of
information to maintain adequate procedures to protect the security and
confidentiality of such information. This section also provides that
information received by a financial institution or association of
financial institutions pursuant to this section shall only be used for
identifying and reporting on activities that may involve terrorist or
money laundering activities, or determining whether to close or
maintain an account, or to engage in a transaction. A financial
institution that fails to comply with these restrictions on the use of
shared information may have its certification revoked or suspended. See
103.110(g).
Section 103.110(d) provides that a financial institution or
association of financial institutions that engages in the sharing of
information and that complies with sections 103.110(b) and (c) shall
not be liable to any person under any law or regulation of the United
States, under any constitution, law, or regulation of any State or
political subdivision thereof, or under any contract or other legally
enforceable agreement (including any arbitration agreement), for such
sharing, or for any failure to provide notice of such sharing, to an
individual, entity, or organization that is the subject of such
sharing.
Section 103.110(e) provides a means for financial institutions to
voluntarily report information to law enforcement concerning suspicious
transactions that may relate to money laundering or terrorist activity
that may come to the financial institution's attention as a result of
discussions with other financial institutions, or otherwise. In order
to accord the highest priority to suspected terrorist activity, a
financial institution should report such information to FinCEN by
calling the Financial Institutions Hotline (1-866-556-3974). The
purpose of the Financial Institutions Hotline is to facilitate the
immediate transmittal of this information to law enforcement. Financial
institutions identifying other suspicious transactions should report
such transactions by promptly filing a SAR in accordance with
applicable regulations, even if they provide information over the
Financial Institutions Hotline. The Financial Institutions Hotline is
intended to provide to law enforcement and other authorized recipients
of SAR information the essence of the suspicious activity in an
expedited fashion. Use of the Financial Institutions Hotline is
voluntary and does not affect an institution's responsibility to file a
SAR in accordance with applicable regulations.
Section 103.110(f) clarifies that voluntary reporting under section
103.110 does not relieve a financial institution from any obligation it
may have to file a Suspicious Activity Report pursuant to a regulatory
requirement, or to otherwise directly contact a federal agency
concerning individuals, entities, or organizations suspected of
engaging in money laundering or terrorist activities.
Section 103.110(g) provides that a federal regulator of a financial
institution, or FinCEN in the case of a financial institution that does
not have a federal regulator, may revoke or suspend a certification
provided by a financial institution under this section if the regulator
or FinCEN determines that the financial institution has failed to
comply with the requirements of paragraph (c) of this section. Treasury
and FinCEN believe this provision is necessary to preclude further
participation in information sharing under the authority of section
103.110 by a financial information that fails to accord confidentiality
to shared information, or uses that information for purposes other than
as permitted by section 103.110(c). A financial institution with
respect to which a certification has been revoked or suspended may not
engage in information sharing under this section during the period of
such revocation or suspension.

III. Administrative Procedure Act

In Executive Order 13224 (September 23, 2001), the President found
that the continuing and immediate threat of further attacks on the
United States constitutes an unusual and extraordinary threat to the
national security, foreign policy, and economy of the United States.
The interim rule implements statutory provisions intended to prevent
terrorist activity by

[[Page 9876]]

uncovering and disrupting the financing of terrorist acts. In light of
the exigent circumstances described in Executive Order 13224, Treasury
has determined, pursuant to 5 U.S.C. 553(b), that it would be contrary
to the public interest to delay the publication of this rule in final
form during the pendency of an opportunity for public comment. For the
same reason, pursuant to 5 U.S.C. 553(d), it has been determined that
there is good cause for the interim rule to become effective
immediately upon publication.

IV. Regulatory Flexibility Act

The provisions of the Regulatory Flexibility Act, 5 U.S.C. 601 et
seq., do not apply to this interim rule because a notice of proposed
rulemaking is not required under 5 U.S.C. 553 or any other law.

V. Paperwork Reduction Act

The requirement in section 103.110(b)(2), concerning notification
to FinCEN that a financial institution that intends to engage in
information sharing, and the accompanying certification in Appendix B
to 31 CFR part 103, do not constitute a collection of information for
purposes of the Paperwork Reduction Act. See 5 CFR 1320.3(h)(1).
The collection of information contained in section 103.110(e),
concerning reports to the federal government as a result of information
sharing among financial institutions, will necessarily involve the
reporting of a subset of information currently contained in a
Suspicious Activity Report (SAR). SAR reporting has been previously
reviewed and approved by the Office of Management and Budget (OMB)
pursuant to the Paperwork Reduction Act and assigned OMB Control No.
1506-0001. An agency may not conduct or sponsor, and a person is not
required to respond to, a collection of information unless it displays
a currently valid OMB control number.

VI. Executive Order 12866

This interim rule is not a ``significant regulatory action'' for
purposes of Executive Order 12866. Accordingly, a regulatory assessment
is not required.

List of Subjects in 31 CFR Part 103

Authority delegations (Government agencies), Banks and banking,
Currency, Investigations, Law enforcement, Reporting and recordkeeping
requirements.

Dated: February 26, 2002.
James F. Sloan,
Director, Financial Crimes Enforcement Network.

Authority and Issuance

For the reasons set forth in the preamble, 31 CFR part 103 is
amended as follows:

PART 103--FINANCIAL RECORDKEEPING AND REPORTING OF CURRENCY AND
FOREIGN TRANSACTIONS

1. The authority citation for part 103 is revised to read as
follows:

Authority: 12 U.S.C. 1829b and 1951-1959; 31 U.S.C. 5311-5331;
title III, sec. 314, Pub. L. 107-56, 115 Stat. 307.


2. Add new subpart H to part 103 to read as follows:
Subpart H--Special Information Sharing Procedures To Deter Money
Laundering and Terrorist Activity
Sec.
103.90 Definitions.
103.100 Information sharing with federal law enforcement agencies.
[Reserved]
103.110 Voluntary information sharing among financial institutions.

Subpart H--Special Information Sharing Procedures To Deter Money
Laundering and Terrorist Activity


Sec. 103.90 Definitions.

For purposes of this subpart, the following definitions apply:
(a) Money laundering means an activity described in 18 U.S.C. 1956
or 1957.
(b) Terrorist activity means an act of domestic terrorism or
international terrorism as those terms are defined in 18 U.S.C. 2331.


Sec. 103.100 Information sharing with federal law enforcement
agencies. [Reserved]


Sec. 103.110 Voluntary information sharing among financial
institutions.

(a) Definitions. For purposes of this section:
(1) The definitions in Sec. 103.90 apply;
(2) The term financial institution means any financial institution
described in 31 U.S.C. 5312(a)(2) that:
(i) Is subject to a suspicious activity reporting requirement of
subpart B of this part and is not a money services business, as defined
in Sec. 103.11(uu);
(ii) Is a broker or dealer in securities, as defined in
Sec. 103.11(f);
(iii) Is an issuer of traveler's checks or money orders, as defined
in Sec. 103.11(uu)(3);
(iv) Is a money transmitter, as defined in Sec. 103.11(uu)(5), and
is required to register as such pursuant to Sec. 103.41; or
(v) Is an operator of a credit card system and is not a money
services business, as defined in Sec. 103.11(uu); and
(3) The term association of financial institutions means a group or
organization the membership of which is comprised entirely of financial
institutions as defined in paragraph (a)(2) of this section.
(b) Information sharing among financial institutions--(1) In
general. Subject to paragraphs (b)(2) and (g) of this section, a
financial institution or an association of financial institutions may
engage in the sharing of information with any other financial
institution (as defined in paragraph (a)(2) of this section) or
association of financial institutions (as defined in paragraph (a) (3)
of this section) regarding individuals, entities, organizations, and
countries for purposes of detecting, identifying, or reporting
activities that the financial institution or association suspects may
involve possible money laundering or terrorist activities.
(2) Notice requirement--(i) Certification. A financial institution
or association of financial institutions that intends to engage in the
sharing of information as described in paragraph (b)(1) of this section
shall submit to FinCEN a certification described in Appendix B of this
part.
(ii) Address. Completed certifications may be submitted to FinCEN:
(A) By accessing FinCEN's Internet website, http://frwebgate.access.gpo.gov/cgi-bin/leaving.cgi?from=leavingFR.html&log=linklog&to=http://www.treas.gov/fincen, and entering the appropriate information as directed; or
(B) If a financial institution does not have Internet access, by
mail to: FinCEN, PO Box 39, Mail Stop 100, Vienna, VA 22183.
(iii) One year duration of certification. Each certification
provided pursuant to paragraph (b)(2)(i) of this section shall be
effective for the one year period beginning on the date of the
certification. In order to continue to engage in the sharing of
information after the end of the one year period, a financial
institution or association of financial institutions must submit a new
certification.
(c) Security and confidentiality of information--(1) Procedures
required. Each financial institution or association of financial
institutions that engages in the sharing of information pursuant to
this section shall maintain adequate procedures to protect the security
and confidentiality of such information.
(2) Use of information. Information received by a financial
institution or association of financial institutions pursuant to this
section shall not be used for any purpose other than:

[[Page 9877]]

(i) Detecting, identifying and reporting on activities that may
involve terrorist or money laundering activities; or
(ii) Determining whether to establish or maintain an account, or to
engage in a transaction.
(d) Safe harbor from certain liability--(1) In general. A financial
institution or association of financial institutions that engages in
the sharing of information pursuant to this section shall not be liable
to any person under any law or regulation of the United States, under
any constitution, law, or regulation of any State or political
subdivision thereof, or under any contract or other legally enforceable
agreement (including any arbitration agreement), for such sharing, or
for any failure to provide notice of such sharing, to an individual,
entity, or organization that is identified in of such sharing.
(2) Limitation. Paragraph (d)(1) of this section shall not apply to
a financial institution or association of financial institutions to the
extent such institution or association fails to comply with paragraph
(b) or (c) of this section.
(e) Information sharing between financial institutions and the
federal government--(1) Terrorist activity. If, as a result of
information sharing pursuant to this section, a financial institution
suspects that an individual, entity, or organization is involved in, or
may be involved in terrorist activity, such information should be
reported to FinCEN:
(i) By calling the toll-free Financial Institutions Hotline (1-866-
556-3974); and
(ii) If appropriate, by filing a Suspicious Activity Report
pursuant to subpart B of this part or other applicable regulations.
(2) Money laundering. If as a result of information sharing
pursuant to this section, a financial institution suspects that an
individual, entity, or organization is involved in, or may be involved
in money laundering, such information should generally be reported by
filing a Suspicious Activity Report in accordance with subpart B of
this part or other applicable regulations. If circumstances indicate a
need for the expedited reporting of this information, a financial
institution may use the Financial Institutions Hotline (1-866-556-
3974).
(f) No limitation on financial institution reporting obligations.
Nothing in this subpart affects the obligation of a financial
institution to file a Suspicious Activity Report pursuant to subpart B
of this part or any other applicable regulations, or to otherwise
directly contact a federal agency concerning individuals or entities
suspected of engaging in money laundering or terrorist activities.
(g) Revocation or suspension of certification--(1) Authority of
federal regulator or FinCEN. Notwithstanding any other provision of
this section, a federal regulator of a financial institution, or FinCEN
in the case of a financial institution that does not have a federal
regulator, may revoke or suspend a certification provided by a
financial institution pursuant to paragraph (b)(2) of this section if
the concerned federal regulator or FinCEN, as appropriate, determines
that the financial institution has failed to comply with the
requirements of paragraph (c) of this section. Nothing in this
paragraph (g)(1) shall be construed to affect the authority of any
federal regulator with respect to any financial institution.
(2) Effect of revocation or suspension. A financial institution
with respect to which a certification has been revoked or suspended may
not engage in information sharing under the authority of this section
during the period of such revocation or suspension.


3. The Appendix to part 103 is redesignated as Appendix A to part
103 and the heading is revised to read as follows:

Appendix A to Part 103--Administrative Rulings

* * * * *


4. Appendix B is added to part 103 to read as follows:

Appendix B to Part 103--Certification for Purposes of Section
314(b) of the USA Patriot Act and 31 CFR 103.110

BILLING CODE 4810-02-P

[[Page 9878]]

[GRAPHIC] [TIFF OMITTED] TR04MR02.026

[FR Doc. 02-5006 Filed 3-1-02; 8:45 am]
BILLING CODE 4810-02-C