Practitioner s Guide for Broker-Dealers

Transcription

1 Practitioner s Guide for Broker-Dealers Chapter 9: Anti-Money Laundering Authored by Betty Santangelo and Sung-Hee Suh, Schulte Roth & Zabel LLP Money laundering has generally been defined as engaging in acts designed to conceal or disguise the true origin of criminally derived proceeds so that the unlawful proceeds appear to have derived from legitimate origins or constitute legitimate assets. 1 It is sometimes useful to think of money laundering as occurring in three stages: (1) placement, when the proceeds of illicit activity enter the financial system through the purchase of monetary instruments, such as money orders or checks, or by being deposited into an account at a financial institution; (2) layering, when the proceeds are moved further away from their criminal origin by being transferred to other accounts or to other financial institutions; and (3) integration, when the proceeds are subsequently used to buy assets or fund other activity. 2 If a broker-dealer becomes involved in money laundering, this can result in significant reputational harm and financial risk -- and possibly even serious criminal or civil charges for facilitating money laundering. A brokerdealer may find itself ensnared in a money laundering case if, for example, one of its brokerage accounts is used by a money launderer to deposit funds that are derived from criminal activity (i.e., placement ), or to transfer those funds to a different account, such as an account in the name of another person or entity located in an offshore secrecy haven (i.e., layering ), or to wire those funds to pay for the down payment on a home, to buy a car, to purchase an investment partnership interest, etc. (i.e., integration ). This is because broker-dealers are subject to the Money Laundering Control Act of 1986, 3 which applies not only to criminals who launder their illgotten gains, but also to any persons or entities that knowingly participate in those transactions. 4 Broker-dealers must therefore be aware of the red flags that indicate that a customer may be engaging or attempting to engage in money laundering activity. In addition, broker-dealers are subject to a host of other antimoney laundering ( AML ) laws, discussed below, designed to prevent and detect money laundering, and may be subject to severe penalties if they do not comply with the requirements of the AML laws. As such, brokerdealers must be aware of their AML obligations and develop and implement policies and procedures for ongoing compliance with the AML laws. This chapter discusses the major provisions of the Bank Secrecy Act of 1970 ( BSA ), 5 as amended by the USA PATRIOT Act of 2001 ( PATRIOT Act ), 6 and the implementing regulations that impose significant AML requirements on broker-dealers. This chapter also summarizes sanctions programs administered by the U.S. 1 Special NASD Notice to Members 02-21, Anti-Money Laundering Notice to Members (April 2002) at 1, available at 2 Id U.S.C and See Rick Morris, Betty Santangelo, and Sung-Hee Suh, Specific Corporate Compliance Challenges by Practice Area: Anti-Money Laundering, Lexis Chapter on Anti-Money Laundering at (forthcoming). 5 Pub. L. No , 84 Stat (1970), 31 U.S.C Uniting and Strengthening America By Providing Appropriate Tools Required to Intercept and Obstruct Terrorism Act of 2001, Pub. L. No

2 Treasury Department s Office of Foreign Assets Control ( OFAC ), which target, among others, terrorists and certain high-level money launderers. The Bank Secrecy Act Under the BSA, financial institutions including broker-dealers have long been subject to reporting and recordkeeping requirements designed to prevent them from being used as intermediaries for money laundering. The paper trail created by the reporting and record-keeping requirements is intended to enable law enforcement to trace money movements through the financial system and thereby identify money laundering and other illegal activity. After September 11, 2001, Congress and financial industry regulators increased their focus on terrorist financing, which led to enactment of the PATRIOT Act on October 26, Title III of the PATRIOT Act, entitled the International Money Laundering Abatement and Anti-Terrorist Financing Act of 2001, amended the BSA to add numerous AML requirements for financial institutions and required the U.S. Treasury Department ( Treasury ) to issue regulations implementing those AML requirements. The regulations implementing the requirements of the BSA and the PATRIOT Act are administered and enforced by various governmental regulators, such as the Financial Crimes Enforcement Network ( FinCEN ) and the Securities and Exchange Commission ( SEC ), and self-regulatory organizations ( SROs ), such as the Financial Industry Regulatory Authority ( FINRA ), among others. The PATRIOT Act While all broker-dealers must comply with the PATRIOT Act and the implementing regulations in 31 C.F.R. Part 103 ( AML Rules ), the application of the AML Rules may vary from firm to firm. For example, the application of certain AML Rules may differ depending on whether a firm is a retail or an institutional broker, and whether a firm is an introducing broker or a clearing broker. 7 AML Program Requirements Section 352 of the PATRIOT Act requires broker-dealers to establish a written AML program that is reasonably designed to achieve and monitor compliance with the requirements of the BSA and its implementing regulations. 8 The AML program must be approved, in writing, by the firm s senior management and must include, at a minimum: (1) the development of internal policies, procedures, and controls; (2) the designation of an AML compliance officer; (3) an ongoing employee training program; and (4) an independent audit function to test the AML program. 9 Brokerage firms are considered to be in compliance with the PATRIOT Act s AML program requirement if they maintain AML programs as required by their respective federal functional regulator or their designated SRO. In this regard, FINRA (previously known as the New York Stock Exchange ( NYSE ) and the National Association of Securities Dealers ( NASD )) and other SROs have issued rules that require members to implement written AML programs that are reasonably designed to achieve and monitor compliance with the requirements of the BSA and incorporate the requirements identified in the PATRIOT Act. 10 When establishing an AML program, a broker-dealer should consider guidance that has been published by FinCEN, the SEC, FINRA and other SROs, the federal banking regulators, and industry associations. 7 For specific information applicable to clearing brokers, see B. Santangelo and H. Davis, Clearing Broker Liability and Responsibilities, Broker-Dealer Regulation, Clifford E. Kirsch ed., Practicing Law Institute U.S.C. 5318(h); 31 C.F.R FINRA Rule FINRA Rule See also American Stock Exchange Rule 432, Chicago Board Options Exchange Rule 4.20, and Philadelphia Stock Exchange Rule

3 Internal Policies, Procedures and Controls A firm s AML program should be risk-based, meaning that the policies, procedures and controls are designed to address the money laundering risks that are specific to the firm. To identify its risks, a firm should conduct a risk assessment of its business, including the types of customers served, location of the customers, and the types of services provided. FINRA recommends that a firm maintain a written analysis of its money laundering risks and how the AML procedures address those risks to demonstrate that the firm has used a reasonable approach in designing its AML program. 11 As part of their risk assessment, firms should pay particular attention to accounts for customers that are located, or incorporated in, certain countries or regions recognized by international organizations, multilateral expert groups or in governmental or industry publications as posing a heightened risk of money laundering or as non-cooperative in the fight against money laundering (an NCCT Jurisdiction ), 12 as well as any countries identified by the Secretary of the Treasury as subject to Section 311 Special Measures (discussed below) or subject to a FinCEN Advisory. AML Compliance Officer A broker-dealer must designate an AML compliance officer who is responsible for the firm s AML program. 13 The firm s AML program should clearly state the duties of and authority vested in the AML compliance officer. The AML compliance officer s duties should include: (1) monitoring the firm s compliance with its AML program; (2) developing communication and training tools for employees; (3) assisting to resolve any due diligence or red flag issues; and (4) ensuring that AML records are maintained and reports, such as Suspicious Activity Reports ( SARs ), are filed in accordance with applicable regulations. 14 The AML compliance officer, either directly or through the designated department, unit, group or committee, should be a central point of contact for communicating with regulatory agencies regarding issues related to the firm s AML program. 15 Pursuant to the relevant applicable SRO rule, a firm must notify its SROs of the identity and contact information of its AML compliance officer. A firm is required to update the AML contact information with any relevant SROs promptly, which generally means within 30 days. 16 Employee Training Program The firm s AML policy (whether it is in a stand-alone document or contained in another document, such as the firm manual or the firm's Code of Ethics or Code of Conduct) should be made available to all new employees. All employees whose responsibilities warrant it should receive AML training annually to ensure that they are knowledgeable about their role in the firm s AML efforts. 17 In addition, the firm should determine which of its employees need to receive additional, specific periodic training relating to money laundering prevention. 18 Generally, business units or areas that may benefit from additional, specific training include Treasury, 11 See FINRA, Small Firm Template, Anti-Money Laundering Program: Compliance and Supervisory Procedures at 1 (Jan. 1, 2010) ( FINRA Small Firm Template ), available at 12 See FATF, Report on Non-Cooperative Countries and Territories, at 2 (Feb. 14, 2000), available at Currently, there are no countries designated as NCCT Jurisdictions. 13 FINRA Rule 3310(d). 14 See generally NASD NTM 02-21, at See id. 16 See e.g., FINRA Rule 3310(d) and (d). FINRA requires members to identify, review, and if necessary, update the contact information for its AML contact in the manner prescribed in NASD Rule 1160, which requires updating the information as necessary within 17 days after the end of each calendar year. See NASD Rule 1160(b). Member firms may use the FINRA Contact System, available on the FINRA website, to facilitate reporting key contacts to FINRA. 17 See NASD NTM 02-21, at See id. 3

4 Operations, Margin, Credit, Corporate Security, Audit, Legal and Compliance. Firms should maintain evidence of their training efforts. 19 FINRA provides a variety of AML education and training programs, including live events, online workshops, webcasts, e-learning courses and phone-in workshops. 20 The Securities Industry and Financial Markets Association ( SIFMA ) also offers industry members opportunities for AML education through conferences, seminars and regular updates. 21 Independent Testing A broker-dealer must conduct independent compliance testing on an annual (i.e., calendar-year) basis, unless the firm falls under an exception set forth in FINRA Rule 3310(c), in which case independent testing is required every two years (on a calendar-year basis). 22 The independent testing program should be designed to ascertain whether those individuals, departments or units that have the primary responsibility for detecting money laundering are in compliance with the firm s AML procedures and to evaluate the effectiveness of the firm s AML program. Independent testing must be performed by a designated person with a working knowledge of applicable requirements under the BSA, the PATRIOT Act, and their implementing regulations. 23 The designated person may not be the designated AML compliance officer, any person who performs the functions being tested, or a person who reports to such persons. 24 The AML program should also include formal mechanisms for the reporting of test results to senior management and/or the internal audit committee, as well as procedures for addressing and rectifying any inadequacies reported. 25 A firm s final written audit report and the firm s response to the report, including how the firm resolved the issues noted in the report or any decisions not to follow the findings of such report, should be maintained by the AML compliance officer or designated person for the firm s records. 26 Tools 1. Chronology of the Effective Dates of AML Rules Applicable to Broker-Dealers. Appendix A 2. FinCEN s homepage for Securities and Futures Firms SEC AML Source Tool for Broker-Dealers FINRA a. AML homepage See id FINRA Rule 3310(c). 23 See FINRA Rule (b). 24 See FINRA Rule (c). 25 See SIFMA, Anti-Money Laundering and Financial Crimes Committee, 2008 Guidance for Deterring Money Laundering and Terrorist Financing Activity (February 2008), at 2, available at 26 See id

5 b. Anti-Money Laundering Frequently Asked Questions 30 c. Small Firm Template 31 d. Notice to Members 06-07, SEC Approves Amendments to Anti-Money Laundering Compliance Program Rule and Adoption of Interpretive Material; Effective Date: March 6, 2006 (Feb. 2006) 32 e. NYSE Regulation Information Memo 06-4, Amendments to Rule 445 ( Anti-Money Laundering Compliance Program) (Feb. 3, 2006) 33 f. NASD Notice to Members 02-21, NASD Provides Guidance to Member Firms Concerning Anti-Money Laundering Compliance Programs Required by Federal Law (April 2002) 34 g. NYSE Regulation Information Memo 02-21, Approval of New Rule 445 ( Anti-Money Laundering Compliance Program) (May 6, 2002) 35 h. FINRA Contact System Web page Securities Industry and Financial Markets Association ( SIFMA ) Website, 37 including the 2008 Guidance for Deterring Money Laundering and Terrorist Financing Activity Federal Financial Institutions Examination Council, Bank Secrecy Act Anti-Money Laundering Examination Manual (2007) Banking Regulators Web Sites a. Board of Governors of the Federal Reserve System 40 b. Office of the Comptroller of the Currency 41 c. Board of Directors of the Federal Deposit Insurance Corporation 42 d. Office of Thrift Supervision

6 e. National Credit Union Administration 44 Customer Identification and Verification CIP Generally Section 326 of the PATRIOT Act requires broker-dealers to implement a customer identification program ( CIP ) with reasonable procedures for: (1) verifying the identity of any person seeking to open an account; (2) maintaining records of the information used to verify the person s identity, including name, address, and other identifying information; and (3) consulting government lists of known or suspected terrorists or terrorist organizations. 45 Broker-dealers must also give adequate notice to their customers of the identification and verification process prior to account opening. 46 Section 326 and the implementing regulations ( CIP Rule ) apply to broker-dealers that are registered, or required to be registered, with the SEC as broker-dealers under the Securities Exchange Act of 1934, except firms that are notice-registered as broker-dealers solely because they effect transactions in security futures products. 47 A broker-dealer s CIP must be approved in writing by senior management. 48 The CIP procedures must be applied to each customer 49 that opens an account 50 with the firm. If a brokerdealer maintains an account for an intermediary financial institution (for example, an omnibus account), it generally can treat the intermediary itself, and not the underlying beneficial owners of the intermediary, as its customer. 51 The CIP Rule excludes from the definition of customer (thereby exempting such persons from the identification and verification requirements): (1) financial institutions regulated by a federal functional regulator; (2) banks regulated by a state bank regulator; (3) certain categories of entities, such as governmental entities and instrumentalities, and the U.S. operations of companies that are publicly traded; and (4) a person that has an existing account with the firm, provided the firm has a reasonable belief that it knows the person s true identity U.S.C. 5318(l) (PATRIOT Act 326); 31 C.F.R U.S.C. 5318(l)(2) C.F.R (a)(2). Futures commission merchants ( FCMs ) and introducing brokers in commodities ( IB-Cs ) that are notice-registered under 15 U.S.C. 78o(b)(11) are subject to the CIP Rule for FCMs and IB-Cs. For information on the CIP requirements for FCMs and IB-Cs, see FinCEN, Frequently Asked Question regarding Customer Identification Programs for Futures Commission Merchants and Introducing Brokers, FIN-2006-G004 (Feb. 14, 2006); Customer Identification Programs for Futures Commission Merchants and Introducing Brokers, Joint Final Rule (May 9, 2003); Guidance From The Staffs Of The U.S. Commodity Futures Trading Commission, Financial Crimes Enforcement Network, and the Department of the Treasury, Questions And Answers Regarding The Customer Identification Program Rule For Futures Commission Merchants And Introducing Brokers (31 CFR ). 48 A firm must have its AML program approved in writing by a member of the firm's senior management pursuant to NYSE Rule 445 and NASD Rule Because the CIP Rule requires a firm to incorporate CIP into its overall AML program, and the CIP would be a material change to the AML program, a firm must also obtain approval in writing for the CIP pursuant to these SRO rules. 49 A customer is a person that opens a new account and an individual who opens a new account for (1) an individual who lacks legal capacity; or (2) an entity that is not a legal person. 31 C.F.R (a)(4)(i). 50 An account is a formal relationship with a broker-dealer established to effect transactions in securities, including, but not limited to, the purchase or sale of securities and securities loaned and borrowed activity, and to hold securities or other assets for safekeeping or as collateral. 31 C.F.R (a)(1)(i). 51 See Preamble to CIP Rule; see also Guidance from the Staff of Treasury and the SEC, Question and Answer Regarding the Broker- Dealer Customer Identification Program Rule (Oct. 1, 2003) C.F.R (a)(4)(ii). 6

7 Excluded from the definition of account is: (1) any account acquired by the broker-dealer through acquisition, merger, purchase of assets or assumption of liabilities; and (2) an account for an ERISA plan, such as a defined contribution plan established pursuant to section 401(k) of the Internal Revenue Code. 53 Information Required The CIP Rule requires broker-dealers to obtain, prior to opening an account, each customer s name, date of birth (for natural persons), address and an identification number. 54 For the identification number, broker-dealers must obtain one or more of the following from a U.S. person: Tax Identification Number ( TIN ), social security number, or employer identification number ( EIN ). For a non-u.s. person, broker-dealers must obtain one or more of the following: TIN, passport number and country of issuance, alien identification card number, or the number and country of issuance of another government-issued document evidencing nationality or residence and bearing a photograph or similar means of authenticating identity. If a foreign business or entity does not have an identification number, broker-dealers must request alternative government-issued documentation certifying the existence of the entity. 55 Verification Broker-dealers must verify the identity of the customer to the extent reasonable and practicable, using documentary and/or non-documentary means. 56 Broker-dealers do not need to verify the accuracy of every element of a customer s identifying information, but they must verify enough information to have a reasonable belief that the customer s true identity is known. 57 The CIP must also include procedures addressing situations in which the broker-dealer cannot form a reasonable belief as to the identity of the customer, such as when the broker-dealer should not open an account or should close it. In addition, the CIP must address situations in which, based on a risk assessment of a new account opened by an entity, the broker-dealer will obtain information about individuals with authority or control over the account. 58 Recordkeeping The CIP Rule requires broker-dealers to maintain records related to customers identifying information for five years after the account is closed. Broker-dealers must also maintain records related to the documents relied on to verify customers identities, descriptions of the methods and measures taken to verify identities, and descriptions of the resolution of each substantive discrepancy discovered when verifying identifying information for five years after the record is made C.F.R (a)(1)(ii) C.F.R (b)(2)(i). 55 See 31 C.F.R (b)(2)(i)(A)(4(ii) note C.F.R (b)(2)(ii). 57 See 68 Fed. Reg. 25,090, 25,099 (May 9, 2003). See also Interagency Interpretive Guidance on Customer Identification Program Requirements under Section 326 of the USA PATRIOT Act, FAQs: Final CIP Rule ( Final CIP Rule FAQs ), issued by the Federal Reserve Board, FDIC, NCUA, OCC, OTS, and FinCEN, at 10, #1 (April 28, 2005), available at C.F.R (b)(2)(ii)(C) C.F.R (b)(3). 7

8 Government Lists Although the CIP Rule requires broker-dealers to have procedures for determining whether a customer appears on any list of known or suspected terrorists or terrorist organizations issued by any federal government agency, 60 the government has not yet issued any such lists for CIP purposes. Reliance Firms are permitted to rely on another financial institution with which it shares an account relationship to undertake CIP procedures, provided that: (1) such reliance is reasonable under the circumstances; (2) the other financial institution is subject to a rule implementing the AML compliance program requirements and is regulated by a federal functional regulator; and (3) the other financial institution enters into a contract with the firm requiring it to certify annually to the firm that it has implemented an AML Program and will perform (or its agent will perform) the specified CIP requirements. 61 As an exception, the SEC, in consultation with FinCEN, has issued a No-Action Letter providing that in certain situations, broker-dealers may treat a registered investment adviser ( IA ) as if it were subject to AML rules for purposes of relying on the IA s performance of CIP, if all other requirements and conditions of the rule are met. 62 Tools 8. FinCEN a. FinCEN, Answers to Frequently Asked Bank Secrecy Act Questions 63 b. FinCEN Ruling, Customer Identification Program Rule Address Confidentiality Programs, FIN R003 (Nov. 3, 2009) 64 c. FinCEN Ruling, Bank Secrecy Act Obligations of a U.S. Clearing Broker-Dealer Establishing a Fully Disclosed Clearing Relationship with a Foreign Financial Institution, FIN-2008-R008 (June 3, 2008) 65 d. FinCEN Guidance, Customer Identification Program Rule No-Action Position Respecting Broker-Dealers Operating Under Fully Disclosed Clearing Agreements According to Certain Functional Allocations, FIN G002 (March 4, 2008) 66 e. FinCEN Guidance, Application of the Customer Identification Program Rule to Futures Commission Merchants Operating as Executing and Clearing Brokers in Give-Up Arrangements, FIN-2007-G001 (April 20, 2007) (joint FinCEN and CFTC guidance) C.F.R (b)(4) C.F.R (b)(6). 62 See the SEC No-Action Letter (Jan. 11, 2010), extending the relief provided in previous letters, with respect to investment advisers, available at see also CFTC Letter No (Mar. 14, 2005), providing no-action relief to futures commission merchants ("FCMs") who rely on commodity trading advisors registered with the CFTC or registered as investment advisers with the SEC for purposes of CIP, available at

9 f. FinCEN Guidance, Frequently Asked Question: Customer Identification Program Responsibilities under the Agency Lending Disclosure Initiative, FIN-2006-G007 (April 25, 2006) (joint SEC and Treasury guidance) 68 g. Customer Identification Programs for Broker-Dealers, Joint Final Rule (May 9, 2003) 69 h. Joint Guidance on Obtaining and Retaining Beneficial Ownership Information, FIN-2010-G001 (March 5, 2010) SEC, Question and Answer Regarding the Broker-Dealer Customer Identification Program Rule (31 CFR ) (October 1, 2003) (joint SEC and Treasury guidance) SEC No-Action Letter to the Securities Industry and Financial Markets Association (Jan. 11, 2010) FINRA a. NASD Notice to Members 03-34, Treasury and SEC Issue Final Rule Regarding Customer Identification Programs for Broker/Dealers; Effective Date: October 1, 2003 (June 2003) 73 b. FINRA Customer Identification Program Notice American Bankers Association Industry Resource Guide: Identification and Verification of Account Holders (Jan. 2002) 75 Special Due Diligence Requirements for Foreign Accounts 76 Section 312 of the PATRIOT Act requires broker-dealers that establish, maintain, administer, or manage a private banking account or correspondent account in the United States for a non-u.s. person to establish appropriate, specific and, where necessary, enhanced due diligence policies, procedures, and controls that are reasonably designed to detect and report money laundering through those accounts. 77 Private Banking Accounts Section 312 requires due diligence on the private banking accounts 78 of non-u.s. persons. 79 It also requires enhanced scrutiny of private banking accounts of senior foreign political figures ( SFPFs ), 80 their immediate PATRIOT Act 312; 31 C.F.R and U.S.C. 5318(i) (PATRIOT Act 312) C.F.R (o). 79 Although private banking account is not a term that historically has been used in the securities industry, the Rules require compliance with this provision by securities broker-dealers. 80 Senior Foreign Political Figure is defined in 31 C.F.R (r). 9

10 family members and their close associates, for the purpose of detecting the proceeds of foreign corruption. 81 Outside of the United States, SFPFs are referred to as Politically Exposed Persons (or PEPs ). 82 At a minimum, a firm must take reasonable steps to: (1) ascertain the identities of all nominal and beneficial owners of a private banking account; (2) determine whether any such owner is an SFPF and therefore subject to enhanced scrutiny; (3) ascertain the source(s) of funds deposited in the private banking account and the purpose and expected use of the account; and (4) review account activity to ensure that it is consistent with the information obtained from the customer regarding source of funds, stated purpose and expected use of account, in order to enable the reporting of suspicious activity. 83 Thus, a firm s due diligence program should include procedures for identifying the nominal owner of an account, as well as procedures for looking through the nominal owner to identify any underlying beneficial owners of the account. 84 There should also be procedures for gathering information on legal entities that are not publicly traded, such as the structure of the entity and the identities of directors, shareholders, persons with control over the account, beneficial owner(s), and, in the case of a trust, which individuals control the funds of the trust, and the source of the funds. 85 With respect to SFPFs, firms should have due diligence procedures to obtain information directly from the client regarding possible SFPF status, to check references, as appropriate, as to whether the individual is currently or was an SFPF or close associate of one, and to make reasonable efforts to review public sources of information. 86 This includes checking the name of the individual against U.S. government databases, major news publications and commercial databases on the Internet, as well as fee-based services. 87 Where the client is a former SFPF, factors to be considered include the length of time the client has been out of office and the size of the account, in addition to the information ordinarily derived through the due diligence process. 88 Correspondent Accounts for Foreign Financial Institutions Section 312 requires due diligence on correspondent accounts 89 and enhanced due diligence on correspondent accounts that are requested or maintained by, or on behalf of, a foreign bank operating under an offshore banking license, under a banking license issued by a foreign country designated as non-cooperative with international AML principles, or under a license issued by a country designated by the Secretary of Treasury as warranting special measures due to money laundering concerns. 90 The correspondent account provisions require a risk-based due diligence program that, at a minimum: (1) determines whether the account is subject to enhanced due diligence; (2) assesses the money laundering risk posed, based on a consideration of relevant risk factors; and (3) applies risk-based policies, procedures and U.S.C. 5318(i)(3)(B). 82 A politically exposed person is a term used for individuals who are or have been entrusted with prominent public functions in a foreign country, for example Heads of State or of government, senior politicians, senior government, judicial or military officials, senior executives of state owned corporations, and important political party officials. Business relationships with family members or close associates of PEPs involve reputational risks similar to those with PEPs themselves. The definition is not intended to cover middle ranking or more junior individuals in these categories. FATF, Key Topics, 40 Recommendations Glossary (2004), available at 9_ _1_1_1_1,00.html# C.F.R (b) Fed. Reg. 496, 508 (Jan. 4, 2006). 85 See id at See id at Id. 88 Id C.F.R (d)(1) C.F.R (c). 10

11 controls in order to detect suspicious transactions. 91 Treasury has explicitly adopted a risk-based approach for applying enhanced due diligence that included the five risk factors listed in (a)(2). 92 For correspondent accounts that require enhanced due diligence, firms must establish procedures that include measures to: (1) conduct enhanced scrutiny to guard against money laundering and to report suspicious activity; (2) ascertain whether the non-u.s. bank provides correspondent accounts to other non-u.s. banks that use in any way the correspondent account, and, if so, conduct appropriate due diligence; and (3) identify the owners of shares in excess of 10% of the non-u.s. bank if the bank is not publicly traded, and the nature and extent of such ownership interest. 93 Tools 13. FinCEN a. Guidance - Application of the Correspondent Account Rule to Executing Dealers Operating in Over-The- Counter Foreign Exchange and Derivatives Markets Pursuant to Prime Brokerage Arrangements, FIN G004 (Sept. 5, 2007) 94 b. Special Due Diligence Programs for Certain Foreign Accounts, Final Rule (Aug. 8, 2007) (regarding enhanced due diligence for correspondent accounts for foreign financial institutions) 95 c. Guidance - Application of the Regulations Requiring Special Due Diligence Programs for Certain Foreign Accounts to Certain Introduced Accounts and Give-Up Arrangements in the Futures Industries, FIN-2006-G011 (June 7, 2006) 96 d. FinCEN Guidance, Application of the Regulations Requiring Special Due Diligence Programs for Certain Foreign Accounts to the Securities and Futures Industries, FIN-2006-G009 (May 10, 2006) 97 e. Special Due Diligence Programs for Certain Foreign Accounts 31 CFR Part 103 (RIN 1506-AA29 71 FR ), Final Rule and Proposed Rule (Jan. 4, 2006) (regarding due diligence for correspondent accounts and private banking accounts for non-u.s. persons) Joint guidance from Treasury, State Department, the Board of Governors of the Federal Reserve System, the Office of the Comptroller of the Currency, the Federal Deposit Insurance Corporation, and the Office of C.F.R (a). FinCEN, "Application of the Regulations Requiring Special Due Diligence Programs for Certain Correspondent Accounts to the Securities and Futures Industries," FIN-2006-G009 (May 10, 2006), available at 92 These five risk factors are: (i) the nature of the foreign financial institution s business and the markets it serves; (ii) the type, purpose, and anticipated activity of such correspondent account; (iii) the nature and duration of the covered financial institution s relationship with the foreign financial institution (and any of its affiliates); (iv) the anti-money laundering and supervisory regime of the jurisdiction that issued the charter or license to the foreign financial institution, and, to the extent that information regarding such jurisdiction is reasonably available, of the jurisdiction in which any company that is an owner of the foreign financial institution is incorporated or chartered; and (v) information known or reasonably available to the covered financial institution about the foreign financial institution s anti-money laundering record. 31 C.F.R (a)(2)(i) (v) C.F.R (b)

12 Thrift Supervision: Guidance on Enhanced Scrutiny for Transactions that May Involve the Proceeds of Foreign Official Corruption (Jan. 2001) Wolfsberg s FAQs on Politically Exposed Persons Basel Committee on Banking Supervision, Customer Due Diligence for Banks at (Oct. 2001) FATF a. Money Laundering and Terrorist Financing in the Securities Sector (Oct. 26, 2009) 102 b. Annual Review of Non-Cooperative Countries and Territories c. Guidance on the Risk-based Approach to Combating Money Laundering and Terrorist Financing (June 2007) 104 d. FATF Guidance 105 and Typologies (e.g., securities industry) 106 e. FATF Public Statement (Feb. 18, 2010) (identifying jurisdictions that pose a risk of money laundering and terrorist financing due to strategic deficiencies) FinCEN Advisories U.S. State Department s International Narcotics Control Strategy Report ( INCSR ) Transparency International s Corruption Perception Index 110 and Bribe Payers Index OECD country reports on bribery Wolfsberg Standards and anti-money laundering guidance 113, including Guidance on a Risk-Based Approach for Managing Money Laundering Risks

13 23. International Monetary Fund, Offshore Financial Centers Assessment Reports U.S. National Money Laundering Strategy Reports 116 Prohibition Against Foreign Shell Banks, Foreign Bank Certification and Record Keeping Under Section 313 of the PATRIOT Act, firms must not establish, maintain, administer or manage a correspondent account in the United States for, or on behalf of, a prohibited foreign shell bank. 117 Section 313 also requires financial institutions to take reasonable steps to ensure that correspondent accounts are not used indirectly to provide banking services to foreign shell banks. 118 Section 319(b) of the PATRIOT Act requires financial institutions that provide correspondent accounts to foreign banks to keep records of the owners of each non-u.s. bank whose shares are not publicly traded and of the non-u.s. bank s agent authorized to accept service of legal process in the United States. 119 Firms are permitted to use a certification form, provided in the implementing regulations, to comply with the shell bank prohibition and the requirement to identify a foreign bank s owners and agent for service of process. 120 Firms have 30 days from when an account is opened to obtain the certification from the foreign bank. 121 A new certification or recertification must be obtained at least once every three years on or before the three-year anniversary of the execution of the initial or previous certification. 122 If a certification or recertification is not obtained within the required time, a broker-dealer must close all correspondent accounts with the foreign bank within a commercially reasonable time. 123 Under Section 319(b) of the PATRIOT Act, financial institutions must respond within seven days to a written request from law enforcement for information concerning the owners or agent of the non-u.s. bank. 124 Tools 25. FinCEN Frequently Asked Questions: Foreign Bank Recertifications under 31 C.F.R , FIN G003 (Feb. 3, 2006) Anti-Money Laundering Requirements -- Correspondent Accounts for Foreign Shell Banks; Recordkeeping and Termination of Correspondent Accounts for Foreign Banks, Final Rule (Sept. 26, 2002) C.F.R., Pt. 103, Subpt. I, App. A (Certification Regarding Correspondent Accounts for Foreign Banks) C.F.R (a) C.F.R (a)(1)(ii) C.F.R (b) C.F.R (b). See also 31 C.F.R., Pt. 103, Subpt. I, App. A (Certification Regarding Correspondent Accounts for Foreign Banks) Fed. Reg , (Sept. 26, 2002). 122 FinCEN Guidance, Frequently Asked Questions Foreign Bank Recertifications Under 31 C.F.R (Feb. 3, 2006), FIN G003 at 2, available at C.F.R (d) U.S.C. 5318(k) (PATRIOT Act 319(b))

14 Special Measures Under Section 311 of the PATRIOT Act, the Secretary of the Treasury, in consultation with other appropriate federal agencies and parties, including, for example, the Secretary of State and the SEC, can issue orders designating certain jurisdictions, foreign financial institutions or groups of transactions or accounts as being of primary money laundering concern and can require financial institutions to institute special measures with respect to those jurisdictions, financial institutions, transactions or accounts. These special measures can include: (1) recordkeeping and reporting of certain financial transactions; (2) collection of information relating to beneficial ownership of any account opened or maintained in the United States by a non-u.s. person; (3) collection of information relating to certain correspondent accounts and payable-through accounts; and (4) prohibitions or conditions on opening or maintaining certain correspondent or payable-through accounts. 128 Treasury has designated a limited number of countries and entities as being of primary money laundering concern. These designations are identified on FinCEN s website. 129 Treasury prohibits financial institutions from establishing or maintaining correspondent accounts on behalf of these financial institutions and jurisdictions. In certain circumstances, firms are also required, under Section 311, to provide notice to certain customers of such designations. It is important for financial institutions to remain aware of these designations and to follow the relevant procedures for each special measure. Tools 28. NASD and NYSE Notice to Members 07-17, Joint Release Regarding Special Measures against Specified Banks Pursuant to Section 311 of the USA PATRIOT Act (April 2007) NASD and NYSE Notice to Members 06-41, Joint Release on Section 311 of the USA PATRIOT Act. Special Measures against Specified Banks Pursuant to Section 311 of the USA PATRIOT Act (Aug. 2006) 131 Suspicious Activity Reports All broker-dealers located within the United States must file Suspicious Activity Reports ( SARs ) pursuant to the rule adopted by Treasury (the SAR Rule ). 132 Treasury created a special SAR form ( SAR-SF ) for brokerdealers and futures commission merchants ( FCMs ). The SAR Rule requires the filing of a SAR-SF for any suspicious transaction relevant to a possible violation of law or regulation. 133 The broker-dealer may also file a SAR-SF concerning any transaction that it believes is relevant to the possible violation of any law or regulation but whose reporting is not required by this section. If more than one broker-dealer is involved in a transaction (for example, an introducing broker and a clearing broker), the brokers may file a single joint SAR-SF, so long as the SAR-SF contains all the relevant facts. 134 The SAR-SF must be filed if the transaction is conducted or attempted to be conducted through a broker-dealer, the transaction involves at least $5,000, and the broker-dealer knows, suspects, or has reason to suspect that the transaction: C.F.R , and C.F.R C.F.R (a)(1) C.F.R (a)(3). 14

15 (1) involves funds derived from illegal activity or is intended or conducted in order to hide or disguise the funds or assets derived from illegal activity, as part of a plan to violate or evade any federal law or regulation, or avoid any transaction reporting requirement under federal law or regulation; (2) is designed to evade any requirements of regulations issued under the BSA; (3) has no business or apparent lawful purpose or is not the kind of transaction in which the customer normally would engage, and for which the broker-dealer knows of no reasonable explanation after further examination ; or (4) involves use of the broker-dealer to facilitate criminal activity. 135 Reporting Exceptions A broker-dealer is not required to report robbery, burglary or lost, missing, counterfeit or stolen securities, so long as they are reported to the appropriate law enforcement authorities. Violations of federal securities laws or SRO rules by a broker-dealer or any of its associated persons do not have to be reported on a SAR-SF, so long as such violation is appropriately reported to the SEC or an SRO (e.g., on Forms RE-3, U-4, or U-5). 136 This exception does not apply if the securities law or SRO rule violation is also a violation of BSA regulations. 137 In such situations, the firm must also report the violation on a SAR-SF. Timing of SARs A broker-dealer must report a suspicious transaction within thirty days of the date of the initial detection of facts that may constitute a basis for filing a SAR. 138 If on that date of detection, no suspect is identified, a brokerdealer can extend filing by an additional thirty days in order to identify a suspect. A broker-dealer must immediately notify an appropriate law enforcement authority by telephone in situations that require immediate attention, such as terrorist financing or ongoing money laundering schemes. 139 In those situations, brokerdealers may also, but are not required to, contact the SEC to report such activities. Record Keeping Copies of the SAR-SF and supporting documentation must be maintained by the filing broker-dealer for five years from the date of filing the SAR-SF. 140 Supporting documentation, which refers to all documents or records C.F.R (a)(2). 136 If a broker-dealer is dually registered as an FCM, the transactions that are the subject of reports made by the broker-dealer, under either the broker-dealer or the FCM SAR rule, fall within the exception when filed with the appropriate regulator or applicable SRO. 68 Fed. Reg , (Nov. 20, 2003). 137 Specifically, this exception does not apply to a BSA violation that is reported to the Commodity Futures Trading Commission ( CFTC ) pursuant to CFTC Rule 42.2, 17 C.F.R See 68 Fed. Reg , & n.29 (Nov. 20, 2003) C.F.R (b)(3). FinCEN has clarified that a financial institution may first need to conduct a review, even over an extended period of time, to determine whether it needs to file a SAR. Thus, the time to file a SAR starts when the organization, in the course of its review or on account of other factors, knows or has reason to suspect that the activity in question meets one or more of the definitions of suspicious activity. FinCEN, The SAR Activity Review - Trends, Tips & Issues, Issue 10 (May 2006) at 47, available at C.F.R (b)(3) C.F.R (d). 15

16 that assisted a financial institution in making the determination that certain activity required a SAR filing, 141 must be identified and maintained as such at the time the SAR is filed. 142 Confidentiality of SARs Section 351 of the PATRIOT Act prohibits any person filing a SAR, whether as required or voluntarily, from disclosing the reporting to anyone involved in the transaction, and prohibits disclosing that a report has been filed, except to FinCEN, the SEC, or another appropriate law enforcement or regulatory agency, or an SRO registered with the SEC conducting an examination of the broker-dealer for compliance with the SAR Rule. 143 A firm otherwise subpoenaed or requested to disclose a SAR-SF or the information contained therein should decline to produce such information and notify FinCEN. 144 Sharing SARs with Controlling Companies A broker-dealer may share a SAR-SF with a parent entity, whether domestic or foreign, and if the corporate structure includes multiple parent entities, the broker-dealer s SAR-SF may be shared with each parent entity, for the purpose of allowing a parent entity to discharge its oversight responsibilities with respect to enterprise-wide risk management and compliance with applicable laws and regulations. 145 Before a broker-dealer may share a SAR-SF with its parent entity, however, the filing firm must have a written confidentiality agreement in place specifying that the parent entity (or entities) must protect the confidentiality of the SAR-SF through appropriate internal controls. 146 If any parent entity is a non-u.s. entity, the confidentiality agreement should address concerns about the ability of the foreign parent entity to protect the SAR-SF in light of possible requests for disclosure abroad that may be subject to foreign law. 147 Safe Harbor Under Section 351, a person making a required or voluntary report of suspicious activity cannot be liable under any law or regulation of the United States, any constitution, law or regulation of any State or any contract or other legally enforceable agreement, including an arbitration agreement, for SAR reporting or failure to disclose to the person who is the subject of the disclosure or to any person identified in the disclosure. 148 Monitoring Account Activity Monitoring accounts and transactions is essential to determining if any particular account or transaction is unusual or suspicious in nature or may be related to money laundering. Higher risk accounts and transactions generally require greater scrutiny. 149 Taking into consideration its specific business and identified risks, a firm 141 FinCEN, "Suspicious Activity Report Supporting Documentation" (June 13, 2007), available at Fed. Reg. 4326, 4330 (Feb. 5, 1996) C.F.R (e). 144 FinCEN has provided guidance for responding to such requests. See BSA Advisory Group, "Section 4 - Issues and Guidance," The SAR Review Trends, Tips & Issue, at 45 (Aug. 2004), available at See FinCEN, "Guidance on Sharing of Suspicious Activity Reports by Securities Broker-Dealers, Futures Commission Merchants, and Introducing Brokers in Commodities" (Jan. 20, 2006), available at Id. 147 Id U.S.C. 53l8(g)(3)(A). 149 FINRA Small Firm Template, at

17 should adopt risk-based procedures setting forth appropriate parameters and methods of monitoring account activity so that unusual or suspicious transactions can be detected. 150 To capture suspicious or unusual activity, a firm must monitor a sufficient amount of activity to permit identification of red flags, such as unusually large or atypical transactions, changes in transaction volume, or transactions involving low-priced securities or high risk jurisdictions, including tax havens and jurisdictions designated as warranting special measures or NCCT jurisdictions. The firm s procedures should explain in specific detail how the firm will conduct the monitoring and identify such red flags. 151 A firm should monitor for suspicious wire transfer activity and securities transfers, and structuring of cash or monetary instrument deposits, among other things. The NASD Special Notice to Members 02-21, 152 FINRA s Small Firm Template, 153 and FATF s typology report, Money Laundering and Terrorist Financing in the Securities Sector, 154 provide helpful (but not exhaustive) lists of red flags describing potential indicators of suspicious activity, which, if unexplained, may evidence money laundering activity. Tools 30. FinCEN a. Suspicious Activity Report by the Securities and Futures Industries (SAR-SF/FinCEN Form 101) 155 b. Regulatory Notice 09-05, Unregistered Resales of Restricted Securities (Jan. 2009) 156 c. FinCEN, Guidance to Financial Institutions on Filing Suspicious Activity Reports Regarding the Proceeds of Foreign Corruption, FIN-2008-G005 (April 17, 2008) 157 d. Suggestions for Addressing Common Errors Noted in Suspicious Activity Reporting (Oct. 10, 2007) 158 e. FinCEN Guidance, Suspicious Activity Report Supporting Documentation, FIN-2007-G003 (June 13, 2007) 159 f. SAR Activity Review Issue 10 (May 2006) (documenting a decision not to file a SAR; grand jury subpoenas and suspicious activity reporting; commencement of the 30-day time period for filing a SAR) See id. See also 67 Fed. Reg , (July 1, 2002). 151 See FINRA Small Firm Template, at 31. See also NASD NTM 02-21, at See FINRA Small Firm Template, at See FATF, Money Laundering and Terrorist Financing in the Securities Sector October 2009, Annex B, available at

18 g. FinCEN, Guidance on Sharing of Suspicious Activity Reports by Securities Broker-Dealers, Futures Commission Merchants, and Introducing Brokers in Commodities (Jan. 20, 2006) 161 h. FinCEN, SAR Activity Review, Trends, Tips & Issues, Issue 8 (April 2005) (National Security Letters and Suspicious Activity Reporting) 162 i. SAR Narrative Guidance (Nov. 2003) (includes Guidance on Preparing a Complete and Sufficient Suspicious Activity Report Narrative, and two PowerPoint presentations: The Suspicious Activity Report (SAR) Form and Keys to Writing a Complete and Sufficient SAR Narrative) 163 j. FinCEN, Preparation Guidelines for Suspicious Activity Report Form (SAR) (July 2003) (Revised Nov. 28, 2006) NASD Notice to Members 02-47, Treasury Issues Final Suspicious Activity Reporting Rule for Broker/Dealers; Effective Date: Transactions After December 30, 2002 (Aug. 2002) 165 Information Sharing Mandatory Information Sharing FinCEN, acting on behalf of a federal, state, local or foreign law enforcement agency 166 that is investigating money laundering or terrorist activity, may require any financial institution, pursuant to Section 314(a) of the PATRIOT Act, to search its records to determine whether the financial institution maintains or has maintained accounts for, or has engaged in transactions with, named individuals, entities, or organizations. 167 In response to such a 314(a) Request, firms must search their account records for any current account and any account maintained during the preceding twelve months for a named suspect. 168 Firms are required to search for transactions that are required to be recorded and that have been conducted during the preceding six months by, or on behalf of, a named suspect. 169 Each firm must designate a person to be the point of contact at the firm for receiving 314(a) Requests from FinCEN, and should notify its primary federal regulator or SRO to update, change, add or delete its point of contact information. 170 A firm may not disclose the fact that it has received a 314(a) Request from FinCEN. 171 Moreover, a firm may not use such a Request for any purpose other than to report matching information to FinCEN, to determine whether Foreign law enforcement agencies must have criminal investigative authority and be from a jurisdiction that is a party to a treaty that provides, or in the determination of FinCEN is from a jurisdiction that otherwise allows, law enforcement agencies in the United States reciprocal access to information comparable to that obtainable under Section 314(a). 75 Fed. Reg. 6560, 6569 (Feb. 10, 2010) (amending 31 C.F.R to expand the information sharing rules to allow certain foreign, state and local law enforcement agencies to submit 314(a) requests). 167 Section 314(a)(l) of the USA PATRIOT Act; 31 C.F.R C.F.R (b)(2(i). 169 Id C.F.R (b)(2(iii); FinCEN, Changing Your Point of Contact for 314(a) (Apr. 10, 2007), available at See generally, FinCEN, Section 314(a) Information Requests, available at (containing 314(a) facts and figures, and other information related to 314(a) Request) C.F.R (b)(2(iv)(B). 18

19 to establish or maintain an account or to engage in a transaction, or to assist the firm in complying with any AML requirement set forth in the regulations that implement the BSA. 172 The firm must establish procedures for maintaining the confidentiality of the request and any responsive information. 173 Voluntary Sharing The final rule for Section 314(b) of the PATRIOT Act permits voluntary information sharing among all institutions defined as financial institutions under the BSA that are required to establish an AML program or are treated under the BSA implementing rules as having satisfied the AML program requirements, including brokerdealers. 174 The rule contains a safe harbor from civil liability for the sharing of information pursuant to section 314(b). 175 A broker-dealer that intends to share information under the rule must file a notice with FinCEN using the form provided by FinCEN, 176 and must submit a new form to FinCEN each year. 177 The firm is also required to take reasonable steps to verify that the institution with which it intends to share information has also filed the required notice with FinCEN. The firm must maintain adequate procedures to safeguard the security and confidentiality of the information it shares, and can only share information in order to detect or report money laundering or terrorist activities, to determine whether to establish or maintain an account or to engage in a transaction, or to comply with BSA requirements. 178 Tools 32. FinCEN a. FinCEN Guidance, Guidance on the Scope of Permissible Information Sharing Covered by Section 314(b) Safe Harbor of the USA PATRIOT Act, FIN-2009-G002 (June 16, 2009) 179 b. FinCEN Guidance Clarifies 314(b) Information Sharing (June 16,2009) 180 c. Interpretive Guidance Sharing Suspicious Activity Reports by Securities Broker-Dealers, Mutual Funds, Futures Commission Merchants, and Introducing Brokers in Commodities with Certain U.S. Affiliates, Proposed Guidance (March 09, 2009) 181 d. Confidentiality of Suspicious Activity Reports, Notice of Proposed Rulemaking (March 09, 2009) 182 e. Interpretive Release No Unitary Filing of Suspicious Activity and Blocking Reports, Final Rule (Dec. 23, 2004) (regarding SAR and OFAC report filing) C.F.R (b)(2(iv)(A) C.F.R (b)(2(iv)(C) C.F.R (a)(2) C.F.R l0(b)(5). 176 FinCEN, Financial Institution Notification Form, On-line 314(b) Registration, available at and 314(b) Fillable Mail In Form, available at C.F.R. l03.110(b)(2) C.F.R (b)(4)

20 f. FinCEN Financial Institution 314(b) Notification Form 184 g. A firm can call FinCEN s Financial Institutions Hotline at (866) for informal guidance regarding the BSA/PATRIOT Act rules and regulations. In addition, a firm can call FinCEN s Financial Institutions Hotline in any situation involving violations that require immediate attention, such as terrorist financing or ongoing money laundering schemes. 33. NASD Notice to Members 02-80, Development Regarding Treasury Information Requests Under Section 314 of the PATRIOT Act (Dec. 2002) 185 Other BSA Reporting and Record-Keeping Requirements Transactions Involving Currency Over $10,000: CTR Reporting Securities firms must file a Currency Transaction Report ( CTR ), FinCEN Form 104, each time a client makes a deposit, withdrawal, exchange of currency or other payment or transfer of more than $10,000 in currency (i.e., more than $10,000 in one transaction or more than $10,000 in multiple transactions by the same person in one business day). 186 Currency includes coins and currency of the United States, or any other currency that circulates and is used as money, but does not include bank checks or other negotiable instruments. CTRs must be filed within 15 days of the transaction. 187 If a transaction meeting the CTR reporting requirements is also considered suspicious, a separate SAR-SF should be filed. FinCEN has advised that, if a currency transaction involves $10,000 or less but is considered suspicious, only a SAR-SF should be filed. 188 Transactions Involving Currency or Monetary Instruments Over $10,000 Transported Into or Outside of the United States: CMIR Reporting Securities firms must also file a Report of International Transportation of Currency or Monetary Instruments ( CMIR ), FinCEN Form 105, with the U.S. Customs Service when they transport or receive currency or monetary instruments exceeding $10,000 at one time into or out of the United States. 189 Monetary instruments include currency, traveler s checks, all negotiable instruments, and securities in bearer form. 190 CMIR reports must be filed at the time of transportation or within 15 days of receipt of the funds or monetary instruments C.F.R See 31 C.F.R (a). See also FinCEN CTR Form 104, General Instructions, When and Where to File at 3 (Dec. 2003), available at See FinCEN SAR-SF Form 101a, Instructions, When to File a Report, 6 (May 2004), available at C.F.R C.F.R (u). 191 See 31 C.F.R (b). See also FinCEN CMIR Form 105, General Instructions, When and Where to File A (July 2003), available at 20