Government Crime Prevention Regulations. Richard Fraher VP & Counsel to the Retail Payments Office Federal Reserve Bank of Atlanta

Transcription

1 Government Crime Prevention Regulations Richard Fraher VP & Counsel to the Retail Payments Office Federal Reserve Bank of Atlanta

2 The Big Disclaimers The views expressed in this presentation are those of the individual speaker, not those of the Federal Reserve Bank of Atlanta, the Board of Governors of the Federal reserve, or of any federal agency. The content of this presentation is for general informational and instructional purposes and may not be relied upon as legal advice with respect to any specific issue or situation.

3 Learning Objectives Focus on major provisions of government crime prevention rules and regulations Understand which entities or parties are covered by the rules/regulations Understand how the rules/regulations relate to various payment channels

4 What we are going to cover The Bank Secrecy Act and its evolution The USA Patriot Act as BSA Plus Purposes and policies: AML/CTF/PEP/CIP Requirements for the payments business The Office of Foreign Assets Control (OFAC) Purposes and authority; payments issues FinCEN and federal law enforcement UIGEA and Reg GG Fraud and ways to combat it

5 The Bank Secrecy Act Banks must have a BSA program The elements a program including officer, policy, procedures; transactional due diligence; testing; training Transactional due diligence: CTR logs and reports; suspicious activity reporting Customer due diligence: CIP Cooperation with law enforcement: SARs Training Testing The glue: appropriate risk identification/management

6 The Expanding Scope of Coverage BSA was first aimed at core financial services providers, including banks, and using those financial services providers to carry out AML and anti crime policy logs, CTR reports, and SARs Over time, the scope of coverage has gotten broad. Basically, any commercial entity that accepts cash payments has becomes a financial institution for the purposes of US Treasury regs. So, federally insured FIs get BSA and OFAC compliance requirements incorporated into the bank examination process MSBs, money changers, check cashers, and informal banks are subject to BSA/OFAC compliance and state regulatory regimes

7 The USA Patriot Act Section 311: Special Measures for Entities/Transactions of Primary Concern Section 312: Special Due diligence for correspondent accounts and private banking accounts Section 313: Prohibition on accounts with foreign shell banks Section 314: Cooperative information sharing

8 USA Patriot Act Section 319(b): US authority to reach records of foreign banks that maintain correspondent accounts in the US Section 328: Customer Identification Verification Section 352: AML Program Requirements Section 359: Extends BSA definition of money transmitter to reach informal banks Section 362: FinCEN communication with FIs

9 Implementing BSA/USA Patriot Act Treasury Regulations 31 CFR Part 1010: Generally applicable provisions of AML/CTF laws 31CFR Part 1020: Bank specific provisions FFIEC Examination Manual Examiners will look for program components Then they will look at how your bank is actually doing the compliance work Enforcement: who is looking at what?

10 OFAC What is OFAC, and what does it do? Sanctions regimes Lists and more lists Who is subject to OFAC compliance rules? OFAC and the payments business Due diligence, screening, blocking, freezing OFAC due diligence and domestic ACH items OFAC due diligence and wires OFAC due diligence and international ACH

11 Due Diligence: Screening and Resolving What is a bank s legal obligation with respect to a prohibited transaction? The law technically requires that a financial institution not carry out a prohibited transaction Practically speaking, this turns into a due diligence effort In the real world, due diligence = screening + resolving Using automated IT to detect possible prohibited accounts or transactions Striking a balance how many false positives? Resolving hits

12 Rejecting, Blocking, and Freezing OFAC regulations are different for different countries, entities, and individuals some lead to a blocking requirement, others can be rejected What is blocking? Identify a prohibited account/transaction, sequester the funds, hold in a blocked account, notify OFAC Why not just reject prohibited transactions?

13 OFAC and Domestic ACH Items OFAC has recognized that domestic ACH processing is low risk and is based on the economies of processing and settling payments in batches ODFI is responsible for its originators but is not responsible for unbatching ACH transactions if it receives the items batched from the originator RDFI is responsible for its receivers Practically, many banks have not done transaction screening on domestic ACH payments, but have relied on doing OFAC screening at the originator/receiver account level It might be better practice to screen ACH items at the transactions processing stage, but it is very hard to resolve hits that involve parties who are not the DI s customers ACH operators are not required to perform OFAC screening on domestic ACH batches

14 OFAC and Wires OFAC has approached wires differently from domestic ACH items Essentially, every bank that touches a wire is supposed to perform due diligence for OFAC compliance Why? Batched ACH v. single payment wire schemes Perceived difference in risk Different data sets wire is subject to the travel rule, domestic ACH is not

15 OFAC and International ACH Items The OFAC Guidance before IATs IATs, the travel rule, and OFAC due diligence When the US ACH moved away from the old CBR/PBR format to the new IAT format, the NACHA rules were amended to mirror the so called travel rule Travel rule requires full originator and receiver information to travel with a payment from end to end of processing OFAC requires US ODFI that sends an IAT to perform due diligence with respect to all the data in each IAT item OFAC requires US RDFI that receives an IAT to perform due diligence with respect to all the data in each IAT item OFAC requires FedGlobal Gateway to screen and identify possible hits in inbound IATs only Fed flags the hits for RDFIs and reports those hits to OFAC

16 IRS Interest in Foreign Account Holders The IRS has been cracking down on US citizens and US based entities that hide assets and income abroad to escape US taxes US taxpayers are now required to identify foreign accounts to the IRS Foreign Dis are required under FATCA to report US account holders to the IRS If you have depositors who appear to be running money from accounts at your DI to their own foreign accounts, you may want to bring it to your compliance officer s attention as an AML concern

17 Foreign Compliance Regimes FATF and UN Sanctions Lists, not OFAC lists Currency control regimes Non convertible currencies Currency restriction regimes U.S. based evasive maneuvers US accounts for foreign nationals Pass through accounts Double blind accounts Payment scheme rules SEPA s leg in ban What does this stuff mean for a US DI?

18 UIGEA and Reg GG The Unlawful Internet Gambling Enforcement Act prohibits any person from accepting payments in connection with unlawful internet gambling Payments resulting from unlawful gambling are restricted transactions UIGEA requires the Treasury and the Fed by regulation to (i) designate payment systems that could be used to facilitate restricted transactions, and (ii) require those systems and institutions that participate in those systems, unless exempted, to establish policies and procedures designed to prevent, or detect and block, restricted transactions

19 The Structure of Reg GG Unless exempted by the Reg, any person or entity that participates in one of the designated payments systems is required to have policies and procedures designed to prevent or detect and block restricted transactions The five systems: ACH, card, check collection, money transmission, wire Important Note: The exemptions do all the work of allocating the UIGEA burden for ACH, check, wire, and money transmitter businesses

20 Who is exempt? In ACH, every participant except: The ODFI with respect to debit transactions The RDFI and any third party payment processor with respect to credit transactions In check collection, every participant except: The depositary bank In wire, every participant except: The beneficiary s bank In money transmission businesses, the operator is not exempt In international ACH and international check clearing: The receiving gateway operator, and any third party processor, that receives a debit entry directly from a foreign sender

21 UIGEA As Applied to Non Exempt Persons Reg GG does not prohibit participants from processing restricted transactions or face potential liability (unlike the way OFAC rules are written) Reg GG requires payment system participants to Perform due diligence at account opening to ascertain whether a depositor poses minimal risk with respect to restricted transactions, and Perform additional due diligence if the minimal risk determination cannot be made; and Block restricted transactions with respect to its account holder if the bank obtains actual knowledge that its depositor is sending or receiving restricted transactions

22 The Participants in Card Systems are Not Exempt Why are card systems different? Data in card transactions is more likely to include indications that a transaction resulted from unlawful gambling How is responsibility actually allocated? Participants in any payment system are allowed to rely on payment system rules and operational methods to assure that restricted transactions are appropriately identified and blocked In card, this can mean that an issuing bank or an acquiring bank may be able to rely on the card network operator to identify restricted transactions but the banks must adopt and implement risk appropriate policies and procedures, which might include account opening due diligence with respect to the bank s own account holders.

23 Fraud: Prevention, Detection, Prosecution Allocation of risk in payments laws: Unauthorized payments Check: the rule of Price v. Neil But beware deposits of RCCs, which shift this risk to BOFD ACH: the ODFI bears the risk of unauthorized items Wire: 4A 202 and 203 FFIEC s Guidance on Authentication (May, 2011) Consumer fraud: the payment order was authorized, but the transaction was bad

24 Law Enforcement v. Fraud SARs FinCEN, ICE, FBI, DOJ/USAOs FTC and consumer fraud (RCPOs ) Prosecution v. civil actions: restitution Cooperating with law enforcement Your bank faces some privacy/confidentiality constraints Right to Financial Privacy Act State statutes and common law of banking confidentiality When your bank divulges information, you should do so using a safe harbor in the law Cooperating with other banks if your DI is party to a fraudulent transaction, the DI has a right to investigate and resolve with other parties to that transaction

25 Fraud and the Payments Business The intrinsic risk of handling payments, and the mitigants Enhanced risk businesses Large dollar check deposits large dollar items or large volumes of small dollar items Checks not issued by the account holder Known scams: cashier s checks; tax refunds ACH debit origination International payments

26 Recent and Emerging Threats Cashier s checks Falsification/fabrication known target of large $ fraud After C21, double presentment of large $ checks Tax fraud identity theft, fraudulent claims for tax refunds, and risk to the bank that handles the payment What can/should your bank do? Enhanced due diligence? Account takeovers The government will pay your bills scams Cyber threats data hacks and DDOS attacks

27 The Data Security Environment Your bank is on the web all the time With your depositors/customers With your vendors With your employees contacts With hackers, fraudsters, terrorists, and Advanced Persistent Threats Sophisticated malware defeats multifactor authentication Sophisticated bad guys may not just want your money. The legal risk is shifting in your direction What should your bank do? Take another look at the FFIEC s May 2011 Guidance, and think seriously about rapid implementation Read President Obama s Executive Order and do your part Think about contingency plans to respond to new threats