Joint Final Rule: Customer Identification Programs for Mutual Funds, Release No. IC (Apr. 29, 2003).

Transcription

1 Legal Alert: SEC Issues Final CIP Rule for Broker/Dealers May 9, 2003 As we have reported previously, the Securities and Exchange Commission ( SEC ) has issued a final rule (the Rule ) implementing Section 326 of the USA PATRIOT Act 1 (also referred to herein as the Act ). 2 The Rule was issued jointly with the Department of the Treasury through the Financial Crimes Enforcement Network ( FinCen ). The substantive requirements of the Rule are to be codified as part of Treasury s Bank Secrecy Act ( BSA ) regulations located in 31 CFR Part 103, specifically at Under SEC Rule 17a-8, broker/dealers are required to comply with all applicable reporting, record keeping and record retention requirements promulgated under the BSA. While the Rule becomes effective 30 days after its publication in the Federal Register, broker/dealers have until October 1, 2003, to fully implement their Customer Identification Programs ( CIPs ). A similar rule applicable to mutual funds was also adopted. 3 No rule applicable to insurance companies has yet been proposed because anti-money laundering regulations pursuant to Section 352 of the USA PATRIOT Act have not yet been issued for insurance companies. Overview The requirements under Section (b) of the Rule, which mirror Section 326 of the Act, fall into three broad categories, and require a broker/dealer to establish, document, and maintain a written CIP appropriate for its size and business that, at a minimum, includes procedures designed to: 1 The term USA PATRIOT Act stands for the Uniting and Strengthening America by Providing Appropriate Tools Required to Intercept and Obstruct Terrorism Act of Joint Final Rule: Customer Identification Programs for Broker-Dealers, Release No (Apr. 29, 2003) (the Adopting Release ). All page citations to the Rule are to the version available on the SEC s website at 3 Joint Final Rule: Customer Identification Programs for Mutual Funds, Release No. IC (Apr. 29, 2003). This article is for informational purposes and is not intended to constitute legal advise. 1

2 1. Verify the identity of any customer opening an account to the extent reasonable and practicable; 2. Maintain records of the information used to verify the person s identity, including name, address, and other identifying information; and 3. Determine whether the person appears on any lists of known or suspected terrorists or terrorist organizations provided to the financial institution by any government agency. Much of the Rule sets forth the elements necessary for a CIP, which must be included as part of the broker/dealer s anti-money laundering compliance program required under the BSA. 4 The Rule also sets forth customer notification procedures, and procedures a broker/dealer must follow if it wishes to rely on another financial institution to carry out any part of its CIP. I. Collecting Information Mandatory Information That Must be Collected from Each Customer. At a minimum, and prior to opening an account, the Rule requires a broker/dealer to collect a customer s name, date of birth (for individuals), address, and identification number (typically a taxpayer identification number, such as a Social Security Number or Employer Identification Number) (b)(2)(i)(A). The Adopting Release indicates that a broker/dealer may request more information if it chooses. Adopting Release at Fn. 59. For individuals without a residential or street address, the Rule permits the use of an Army Post Office or Fleet Post Office box number, or the residential or business street address of a next of kin or another contact individual (b)(2)(i)(A)(3)(ii). For entities, the Rule requires the address to be a principal place of business, local office, or other physical location (b)(2)(i)(A)(3)(iii). Need for Risk-Based Procedures. The Rule provides that a broker/dealer s CIP must include risk-based procedures for verifying the identity of each customer to the extent reasonable and practicable, a process that includes both collection of certain enumerated pieces of information, and verification of the information collected (b)(2). The Rule requires that these procedures enable the broker/dealer to form a reasonable belief that it knows the true identity of each customer. Id. The Adopting Release explains that in establishing its CIP, a broker/dealer should take into account such factors as the types of accounts it offers, the way those accounts are opened (e.g., in face-to-face meetings between registered persons and customers, rather than over the telephone or the Internet), and the types of identifying information about customers that will be available to the broker/dealer. Adopting Release at 10, (b)(2). For example, the risk that a broker/dealer may not know the true identity of its customers is likely different for a firm that opens accounts primarily on the Internet than it is for one that draws its customers from existing clients of an affiliated insurance company U.S.C. 5318(h) This article is for informational purposes and is not intended to constitute legal advise. 2

3 Determining Who is a Customer. Under the Rule, broker/dealers must collect certain information about and verify the identity of each customer (b)(2). A customer is defined as a person (whether natural or not) who opens a new account (the definition of which is discussed below), as well as an individual who opens a new account for a person who either lacks legal capacity (such as a minor), or for an entity that is not a legal person (such as a civic club) (a)(4). The Rule provides several exclusions from the definition of customer, including one for a person who has an existing account with the broker/dealer, so long as the broker/dealer has a reasonable belief that it knows the true identity of the person (a)(4)(ii)(C). Neither the Rule nor the Adopting Release indicates what would constitute such a reasonable belief. Presumably, a reasonable belief would be established utilizing procedures developed in accordance with the same risk-based analysis that underlies the establishment of the CIP. According to the Adopting Release, persons who do not open an account, but simply have authority over the account, will typically not be considered customers. Adopting Release at 7. As a result, the Adopting Release indicates that in determining who is a customer, a broker/dealer normally need not look through a trust, or similar account, to its beneficiaries, nor must it look through an omnibus account to the underlying beneficial owners. Adopting Release at 7. Thus, in the case of a retirement plan established by a plan sponsor (or intermediary ), the Adopting Release indicates that a broker/dealer would not typically consider plan participants (i.e., the underlying beneficial owners ) to be customers for purposes of the rule. See Adopting Release at 7. However, under the Rule, a broker/dealer s CIP must address situations where, based on its risk assessment of a new account opened by a non-natural person, it considers whether additional verification steps should be taken, including obtaining information about individuals with authority or control over the account (b)(2)(ii)(C), Adopting Release at 7. The Rule makes clear that this requirement to obtain information about persons with authority or control over an account arises only where the broker/dealer cannot verify the customer s identity using other methods (b)(2)(ii)(C). It is important to note that even though a person or transaction may not be covered by the identification and verification requirements of a firm s CIP, that same person or transaction may implicate a firm s general anti-money laundering program required under Section 352 of the USA PATRIOT Act. Thus, as the Adopting Release notes, a broker/dealer may, under its antimoney laundering program, need to verify the identity of a customer whose account is transferred even though such verification might not be required under the firm s CIP. Adopting Release at 6. As an example, the Adopting Release indicates that verification would likely be necessary if the accounts were being transferred from a broker/dealer known not to have an adequate CIP. Adopting Release at Fn. 22. Determining What Constitutes an Account. An account is defined to include a formal relationship with a broker/dealer established to effect transactions in securities, and would This article is for informational purposes and is not intended to constitute legal advise. 3

4 not include the broker/dealer s general business dealings (a)(1)(i), Adopting Release at 6. The Rule sets forth several exclusions from the definition, including accounts that a broker/dealer acquires through an acquisition, merger, purchase of assets or assumption of liabilities, or an account opened for the purpose of participating in an employee benefit plan established under the Employee Retirement Income Security Act of (a)(1)(ii)(A,B). It appears likely that the purchase of a mutual fund or variable product on a subscription way basis results in the establishment of an account between the customer and the broker/dealer whose registered person took the initial application. These transactions are not specifically excluded from the definition, and the Adopting Release notes that they can give rise to an account relationship. See Adopting Release at 5 (emphasis added). It is unclear under what circumstances the SEC Staff would conclude that subscription way purchases do or do not establish an account, but absent further guidance it may be prudent for selling firms to treat all such transactions as establishing an account. This topic is addressed again in the discussion of reliance that appears in Section VI of this memorandum. II. Providing Notice to Customers Under the Rule, a broker/dealer s CIP must include procedures for giving customers adequate notice that information is being collected about them in order to verify their identities (b)(5)(i). According to the Rule, a notice, which may be oral or written, will be considered adequate if it generally describes the identification requirements of the Rule, and is provided in a way reasonably designed to ensure the customer can view it, or is otherwise provided, before an account is opened (b)(5)(ii). The sample notice included in the Rule, which may be used if appropriate, has been reproduced as an attachment to this memorandum (b)(5)(iii). III. Verifying the Customer s Identity Once Required Information is Collected As noted above, the Rule requires that a CIP include risk-based procedures for verifying the identity of each customer using the information collected pursuant to the Rule (b)(2)(ii). The Rule permits verification to occur within a reasonable time before or after the account is opened (b)(2)(ii). The Adopting Release explains that what constitutes a reasonable time depends on such factors as whether the customer opens the account in person and the type of identifying information available. Adopting Release at 12. The Adopting Release notes that a broker/dealer may use both documentary and nondocumentary methods of verification, depending on its assessment of relevant risk factors. This article is for informational purposes and is not intended to constitute legal advise. 4

5 Adopting Release at 12. Under the Rule, the CIP must describe when the firm will use documents, non-documentary methods, or a combination of both (b)(2)(ii). In general, documentary procedures involve examination by the broker/dealer of a document or documents presented by the customer, while non-documentary procedures involve reference to information other than what the customer has provided (e.g., information maintained by a credit reporting agency). In either case, the Rule requires that a CIP contain procedures that result in the creation of a record describing the resolution of each substantive discrepancy discovered during verification (b)(3)(i)(D). The Adopting Release indicates that this provision does not apply to minor discrepancies, such as those that could have resulted from a typographical error. Adopting Release at Fn Documentary Procedures. Under the Rule, a broker/dealer s CIP must set forth the documents the firm will use for customer identity verification (b)(2)(ii)(A). The Adopting Release notes that, given the ready availability of fraudulent documents and the pervasiveness of identity theft, firms are encouraged to obtain more than one type of documentary verification to ensure they have established a reasonable belief in the customer s true identity. Adopting Release at 13. Examples of acceptable documents set forth in the Rule include: for individuals, an unexpired government-issued photo identification evidencing nationality or residence (such as a driver s license or passport); and for entities, documents showing the existence of the entity, such as certified articles of incorporation or a government-issued business license (b)(2)(ii)(A). In the absence of obvious indications of fraud, the Adopting Release notes that broker/dealers need not determine whether the document was validly issued. Adopting Release at 13. Non-Documentary Procedures. Under the Rule, broker/dealers relying on nondocumentary procedures must describe them in their CIPs (b)(2)(ii)(B). The Rule provides a number of examples: contacting the customer; independently verifying the customer s identity by comparing information provided by the customer with information available through a consumer reporting agency, public database or other source; checking references with other financial institutions; or obtaining a financial statement (b)(2)(ii)(B)(1). Referring to the inherent limitations of documents as a means of identity verification, the Adopting Release suggests that firms adopt non-documentary methods in addition to This article is for informational purposes and is not intended to constitute legal advise. 5

6 documentary methods in order to establish a reasonable belief in a customer s true identity. Adopting Release at 13, 15. The Rule requires that a broker/dealer s non-documentary procedures address a number of situations, including but not limited to those where an individual: is unable to present an appropriate photo identification; presents identification not familiar to the broker/dealer; opens an account without providing documents or without appearing in person; and where there is otherwise increased risk that the customer s true identity cannot be verified through documents (b)(2)(ii)(B)(2). Under the Rule, the CIP must also address circumstances where the broker/dealer cannot form a reasonable belief as to a customer s identity, whether documentary or non-documentary procedures were employed, including: when an account should be closed after attempts to verify a customer s identity have failed, and when a Suspicious Activity Report should be filed (b)(2)(iii). IV. Record Keeping and Record Retention Content of Records. The Rule provides that a broker/dealer s records must include all identifying information collected from customers pursuant to the Rule (b)(3)(i)(A). The Rule does not require that a copy of documentary evidence be retained (although such a copy would, of course, be an acceptable record). Adopting Release at 17. For example, firms need not retain a copy of a driver s license used to verify a customer s identity. Instead, the Rule permits firms to retain a description of any document relied on for verification that notes the type of document, any identification number contained in the document, the place of issuance, and, if any, the date of issuance and expiration date (b)(3)(i)(B). Similarly, the Rule requires firms to retain a description of the results of any non-documentary methods used to verify a customer s identity (b)(3)(i)(C). The Adopting Release notes that any such records may be maintained electronically. Adopting Release at 17. Retention Requirements. Under the Rule, identifying information collected from a customer (e.g., name and identification number) must be retained for five years after the customer s account is closed (b)(3)(ii). In contrast, the Rule permits information related to verification of a customer s identity to be retained for five years after the record is made. Id. This article is for informational purposes and is not intended to constitute legal advise. 6

7 V. Comparison with Government Lists The Rule requires that a broker/dealer s CIP include procedures for determining whether a customer appears on any list of known or suspected terrorists or terrorist organizations issued by any Federal government agency and designated as such by the Treasury Department (b)(4). The Adopting Release indicates that broker/dealers will not be required to seek out all such lists. Adopting Release at 18. Rather, separate guidance regarding the lists that must be consulted will be forthcoming. Id. Moreover, the Rule requires that the CIP include procedures requiring the firm to follow all federal directives issued in connection with such lists (b)(4). As to timing, the Rule requires a broker/dealer s CIP to require a determination of whether a customer appears on a list within a reasonable period of time after the account is opened, earlier if required by another federal law, regulation or directive (b)(4). The Adopting Release reminds firms that they are subject to similar screening requirements under other laws, such as laws requiring compliance with Treasury s Office of Foreign Assets Control rules, which may require action before a transaction is effected. Adopting Release at Fn VI. Reliance on Other Financial Institutions The Rule permits a broker/dealer to set forth in its CIP procedures indicating when it will rely on another financial institution (including an affiliate) to perform any of its CIP procedures (b)(6). Such reliance is permitted only where a customer of the broker/dealer is opening or has opened an account, or has established a similar relationship with the other financial institution. Id. In addition, the Rule requires that: the reliance must be reasonable under the circumstances; the other financial institution must both be required to have an anti-money laundering compliance program pursuant to the BSA and be regulated by a federal functional regulator; and the broker/dealer must enter into a contract with the other financial institution requiring it to certify annually that it has implemented an anti-money laundering program and will perform (directly or though an agent) the specified provisions of the broker/dealer s CIP (b)(6)(i-iii). If these conditions are met, the Adopting Release indicates that a broker/dealer will not be held responsible for the failure of the other financial institution to adequately fulfill the broker/dealer s responsibilities. Adopting Release at 20. This article is for informational purposes and is not intended to constitute legal advise. 7

8 The Adopting Release notes that the Rule s reliance provisions do not prevent a broker/dealer from contractually delegating the implementation and operation of its CIP to other entities (such as a service provider) in a manner that does not meet the requirements of Section (b)(6). Adopting Release at Fn However, under these circumstances the broker/dealer cannot rely on that other entity and will remain solely responsible for compliance with the Rule. Id. Ability to Rely on Insurance Company Affiliate. The Rule defines a financial institution by reference to the BSA, which explicitly includes insurance companies. 5 However, as noted above, the Rule s reliance provisions also require the financial institution to be regulated by a federal functional regulator, as defined by the Rule. 6 Because insurance companies are not regulated by entities that are included among the federal functional regulators, it appears that a broker/dealer cannot rely on an insurance company to carry out any of the broker/dealer s CIP responsibilities, but it may delegate those responsibilities as described above. Implications for Subscription Way Transactions. While it appears that it is not currently permissible for a broker/dealer to rely on an insurance company to perform any of its CIP procedures, it does appear that a broker/dealer accepting mutual fund or variable product applications on a subscription way basis may rely on, for example, the principal underwriter (which as a broker/dealer is a financial institution regulated by a federal functional regulator) for those products, or on the mutual fund itself, to carry out some of the broker/dealer s CIP responsibilities. Adopting Release at Fn. 15. If you have any questions or would like to discuss this mater further, please contact Susan Krawczyk at , Eric Arnold at , or Holly Smith at Attachment 5 31 U.S.C. 5312(a)(2)(M). 6 See (a)(5). The term federal functional regulator means the Board of Governors of the Federal Reserve System, the Office of the Comptroller of the Currency, the Board of Directors of the Federal Deposit Insurance Corporation, the Office of Thrift Supervision, the National Credit Union Administration, the SEC, or the Commodity Futures Trading Commission. See 103 CFR 120(a)(2). This article is for informational purposes and is not intended to constitute legal advise. 8

9 Sample Notice Provided in Section (b)(5)(iii) of the Rule ** ** ** ** ** ** ** IMPORTANT INFORMATION ABOUT PROCEDURES FOR OPENING A NEW ACCOUNT To help the government fight the funding of terrorism and money laundering activities, Federal law requires all financial institutions to obtain, verify, and record information that identifies each person who opens an account. What this means for you: When you open an account, we will ask for your name, address, date of birth and other information that will allow us to identify you. We may also ask to see your driver s license or other identifying documents. This article is for informational purposes and is not intended to constitute legal advise. 9