TREASURY ADOPTS RULES REQUIRING BROKER-DEALERS TO VERIFY CUSTOMER IDENTITY

T O O U R F R I E N D S A N D C L I E N T S May 9, 2003 TREASURY ADOPTS RULES REQUIRING BROKER-DEALERS TO VERIFY CUSTOMER IDENTITY INTRODUCTION On April 29, 2003, the Department of Treasury ( Treasury ), through the Financial Crimes Enforcement Network ( FinCEN ), adopted rules that require certain broker-dealers to verify the identity of their customers. 1 By adopting these rules, Treasury has addressed Section 326 of the PATRIOT Act, which requires the Secretary of the Treasury to adopt regulations that set minimum standards regarding the steps to be taken by financial institutions to verify the identity of customers in connection with the opening of an account. 2 EXECUTIVE SUMMARY Pursuant to Treasury s newly adopted rules, broker-dealers that open accounts on behalf of customers are required to adopt written procedures for verifying the identity of their customers. Broker-dealers must amend their Anti- Money Laundering ( AML ) compliance programs to incorporate their customer identity verification procedures no later than October 1, 2003. The rules adopted by Treasury provide that the customer identification procedures adopted by broker-dealers should be risk based. Notwithstanding this broad requirement, Treasury also identified a long list of explicit minimum requirements for such procedures. In particular, a broker-dealer s procedures must specify when it is appropriate to use documents, non-documentary methods, or a combination of both methods to verify a customer s identity. Treasury did not, however, impose a requirement that customers open accounts in person so 1 See Financial Crimes Enforcement Network; Customer Identification Programs for Broker-Dealers, 68 Fed. Reg. 25113, (May 9, 2003) (to be codified at 31 C.F.R. pt. 103.122) [hereinafter Adopting Release]. 2 Pub. L. No. 107-56, 326, 115 Stat. 272 (2001). A Partnership Including Professional Corporations New York One New York Plaza New York, NY 10004 212.859.8000 Washington, DC 1001 Pennsylvania Avenue, NW Washington, DC 20004 202.639.7000 Los Angeles 250 South Grand Avenue Los Angeles, CA 90071 213.473.2000 London 99 City Road London EC1Y 1AX England 44.20.7972.9600 Paris 5, boulevard de la Tour Maubourg 75007 Paris France 33.140.62.22.00 www.friedfrank.com Copyright May 9, 2003 Fried, Frank, Harris, Shriver & Jacobson

that broker-dealers can verify that the customer is the person who appears on any identification provided by the customer. Treasury specified certain information that broker-dealers must collect regarding their customers, and identified certain records that broker-dealers must make and retain demonstrating that each customer s identity has been verified. Broker-dealers also are required to notify each customer that it is collecting information to verify the customer s identity and are required to determine whether customers are on lists of suspected terrorists. Finally, Treasury identified certain conditions that broker-dealers must meet before they may rely upon another financial institution to perform one or more steps to verify a customer s identity. BROKER-DEALERS MUST AMEND THEIR AML COMPLIANCE PROGRAMS Under the rules adopted by Treasury, a broker-dealer that opens accounts on behalf of customers is required to establish, document, and maintain written procedures for verifying customer identity, and to incorporate such procedures into its AML compliance program no later than October 1, 2003. Compliance Points: Broker-dealers that do not open accounts for customers are not required to adopt procedures for verifying customer identity. Treasury defined the term account for these purposes to mean a formal relationship with a brokerdealer established to effect transactions in securities, including, but not limited to, the purchase or sale of securities and securities loaned and borrowed activity, and to hold securities or other assets for safekeeping or as collateral. In addition, Treasury excluded from the definition of account: (1) accounts acquired through any acquisition, merger, purchase of assets, or assumption of liabilities; or (2) accounts opened for the purpose of participating in an employee benefit plan established under the Employee Retirement Income Security Act of 1974. Treasury defined the term customer to mean [a] person that opens a new account and [a]n individual who opens a new account for: (1) an individual who lacks legal capacity; or (2) an entity that is not a legal person. Treasury excluded from the definition of customer existing customers and certain financial institutions and public companies. Treasury stated that the customer, except in the case of minors and non-legal entities, is the person identified as the accountholder. Consequently, broker-dealers are not required to look through the accountholder and verify the identities of the beneficial owners of an account. For example in the case of a trust, or similar account, a brokerdealer is not required to verify the identity of the trust s beneficiaries. This also applies to omnibus accounts established by intermediaries provided the account is in the name of the intermediary. Fried, Frank, Harris, Shriver & Jacobson 2 May 9, 2003

Pursuant to NASD Rule 3011 and NYSE Rule 445 a broker-dealer s senior management must approve its AML Compliance Program. As a result, senior management should approve any amendments to such program to incorporate a broker-dealer s procedures for verifying its customers identity. RISK BASED PROCEDURES FOR VERIFYING CUSTOMER IDENTITY Instead of prescribing a rigid set of procedures that broker-dealers must follow when verifying a customer s identity, the rules require a broker-dealer to adopt risk-based procedures for verifying the identity of each customer to the extent reasonable and practicable. In addition, the procedures must enable the broker-dealer to form a reasonable belief that it knows the true identity of each customer. Treasury stated that a broker-dealer should consider the risks presented by the various types of accounts maintained by the broker-dealer, the various methods employed by the broker-dealer to open accounts, the various types of identifying information available and the broker-dealer s size, location and customer base. Treasury also identified the following minimum elements that must be included in a broker-dealer s procedures. Required Customer Information. Broker-dealers are required to adopt procedures that identify the specific information that must be collected from each customer prior to the opening of an account. At a minimum, these procedures must require the broker-dealer to obtain the following: Name; Date of birth; Residential or business street address for an individual; 3 Principal place of business, local office or other physical location for a person other than an individual (e.g., corporation, partnership or trust); Taxpayer identification number for a U.S. person; 4 and 3 For those individuals who do not have a residential or business street address, the brokerdealer must obtain either (1) an Army Post Office (APO) or Fleet Post Office (FPO) box number, or (2) the residential or business street address of a next of kin or another contact individual. 4 In the event that a person has applied for, but has not received, its taxpayer identification number, a broker-dealer may open an account after it confirms that the application to obtain the identification number has been filed and the broker-dealer obtains the taxpayer identification number within a reasonable period of time after the account is opened. Fried, Frank, Harris, Shriver & Jacobson 3 May 9, 2003

For a non-u.s. person, one or more of the following: a taxpayer identification number, a passport number and country of issuance, an alien identification card number, or the number and country of issuance of any other government-issued document evidencing nationality or residence and bearing a photograph or similar safeguard. 5 Compliance Point: These minimum information requirements should not present a significant burden for broker-dealers as they are required to collect much of this information pursuant to SRO and SEC rules. For example, as of May 2, 2003, a broker-dealer is required, pursuant to Rule 17a-3(a)(17), 6 to collect the name, date of birth, address and taxpayer identification number for each customer. Documentary and Non-Documentary Methods. A broker-dealer must adopt procedures that identify when and how a customer s identity is to be verified using the above described information. 7 In addition, the procedures must specify when the broker-dealer will use documents, non-documentary methods, or a combination of both methods to verify a customer s identity. For a broker-dealer relying on documents to verify a customer s identity, the procedures must identify the documents the broker-dealer will use. For example, when verifying the identity of an individual, a broker-dealer may rely upon an unexpired government-issued identification evidencing nationality or residence and bearing a photograph or similar safeguard, such as a driver s license or passport. When verifying the identity of a corporation, partnership or trust, a broker-dealer may rely upon documents showing the existence of the entity, such as certified articles of incorporation, a government-issued business license, a partnership agreement, or a trust instrument. For a broker-dealer relying on non-documentary methods to verify a customer s identity, the procedures must specify the non-documentary methods to be used. For example, a broker-dealer may require that each customer be contacted by phone to verify information regarding the customer. In addition, a broker-dealer may seek to verify information provided by a customer by comparing that information to information obtained from a consumer reporting 5 For those non-u.s. persons that are a business or enterprise that does not have an identification number, the broker-dealer must request alternative government-issued documentation certifying the existence of the business or enterprise. 6 17 C.F.R 240.17a-3(17). 7 A customer s identity must be verified no later than a reasonable time after the customer s account is opened. Fried, Frank, Harris, Shriver & Jacobson 4 May 9, 2003

agency, public database, or other source. Finally, a broker-dealer may want to check references with other financial institutions; or obtain a financial statement. Compliance Point: Treasury stated broker-dealers generally may rely on government issued identification as verification of a customer s identity and that a broker-dealer is not required to take steps to determine whether the identification has been validly issued, absent obvious indications of fraud. Treasury also stated that in determining whether to rely solely upon documents to verify identity, broker-dealers should consider the problems of authenticating documents and the inherent limitations of documents as a means of identity verification and that these limitations may make it necessary to use non-documentary methods in addition to documents to verify a customer s identity. Additional verification for certain customers. A broker-dealer is required to adopt procedures to obtain information about individuals who are associated with a customer that is not an individual and who have authority or control over the customer s account when the broker-dealer can not verify the identity of such customer. A broker-dealer is also required to adopt procedures to deal with a situation where the broker-dealer cannot form a reasonable belief that it knows the true identity of a customer. These procedures should address when an account should not be opened and when an account that has already been opened should be closed. In addition, the procedures should address the terms under which a customer may conduct transactions while the broker-dealer attempts to verify the customer s identity and when a Suspicious Activity Report should be filed. COMPARISON WITH GOVERNMENT LISTS Broker-dealers must adopt procedures to determine, within a reasonable period of time after opening an account, whether a customer appears on any list of known or suspected terrorists or terrorist organizations issued by any Federal government agency and designated as such by Treasury in consultation with the Federal functional regulators. Fried, Frank, Harris, Shriver & Jacobson 5 May 9, 2003

Compliance Points: To date, Treasury has not designated any list of known or suspected terrorists or terrorist organizations. In addition, Treasury has stated that this provision does not impose an affirmative obligation on a broker-dealer to seek out all lists of known or suspected terrorists or terrorist organizations compiled by the federal government. Treasury stated that broker-dealers will be notified as to the list(s) that they must consult. Finally, this provision does not affect a broker-dealer s existing obligations under the regulations issued by the Office of Foreign Asset Control ( OFAC ) to not conduct business with certain persons and countries or the need to check the list of Specially Designated Nationals and Blocked Persons located at: http://www.treas.gov/offices/enforcement/ofac/sdn/t11sdn.pdf. CUSTOMER NOTICE Broker-dealers are required to adopt procedures for notifying their customers that the broker-dealer is requesting information to verify their identities. Such notice must generally describe the identification requirements of Rule 103.122 and must be provided to customers before opening an account. Treasury provided the following sample notice for use by broker-dealers: IMPORTANT INFORMATION ABOUT PROCEDURES FOR OPENING A NEW ACCOUNT To help the government fight the funding of terrorism and money laundering activities, Federal law requires all financial institutions to obtain, verify, and record information that identifies each person who opens an account. What this means for you: When you open an account, we will ask for your name, address, date of birth and other information that will allow us to identify you. We may also ask to see your driver s license or other identifying documents. RECORDKEEPING A broker-dealer must adopt procedures for making and maintaining a record of the information obtained, and the steps taken, to verify a customer s identity. Specifically, such records must include (1) customer identifying information, (2) a description of any document relied upon to verify a customer s identity (including the type of document, identification number, the place of issuance, and the issuance and expiration dates, if any; (3) a description of any non documentary methods used to verify a customer s identity and the results of Fried, Frank, Harris, Shriver & Jacobson 6 May 9, 2003

applying such methods; and (4) a description of how any discrepancies in customer information were resolved. Depending on the record, the required retention period is five years, beginning either at the time the record is made or at the time the customer s account is closed. All records are required to be maintained pursuant to Rule 17a- 4. 8 RELIANCE ON OTHER FINANCIAL INSTITUTIONS Subject to certain conditions, a broker-dealer is permitted to rely upon another financial institution to perform one or more steps to verify a customer s identity with respect to a customer that is opening an account or has established an account or similar business relationship with the other financial institution. This provision was originally proposed to address the introducing/clearing firm relationship, but was broadened by Treasury to accommodate other relationships between financial institutions. A broker-dealer is required to adopt written procedures specifying when reliance on another financial institution is permissible. In addition, the other financial institution must be subject to a rule requiring it to adopt an AML Compliance Program, and must be regulated by a Federal functional regulator. Finally, the broker-dealer and the other financial institution are required to enter into a contract requiring the other financial institution to certify annually that it has implemented its anti-money laundering program, and that it will perform specified customer identity verification procedures on behalf of the broker-dealer. Compliance Points: Treasury stated in the Adopting Release that a broker-dealer will not be held liable if the other financial institution fails to perform the required customer identity verification procedures, provided the broker-dealer satisfies all of the conditions set forth in the rule, its reliance on the other financial institution was reasonable and that it has obtained the required contract and certifications. 8 17 C.F.R. 240.17a-4. Fried, Frank, Harris, Shriver & Jacobson 7 May 9, 2003

A broker-dealer is also permitted to contractually delegate to a third party service provider, that does not meet the above requirements, the responsibility for performing its customer identity verification procedures. However, the broker-dealer remains solely responsible for ensuring that each customer s identity is properly verified. As a result, a broker-dealer should adopt procedures to actively monitor its third party service provided. * * * * * For additional information, please contact in Washington, DC: Mark J. Dorsey 202.639.7173 dorsema@ffhsj.com Christopher M. Salter 202.639.7037 saltech@ffhsj.com Fried, Frank, Harris, Shriver & Jacobson 8 May 9, 2003