[Federal Register Volume 75, Number 232 (Friday, December 3, 2010)]
[Rules and Regulations]
[Pages 75607-75610]
From the Federal Register Online via the Government Publishing Office [www.gpo.gov]
[FR Doc No: 2010-29884]


-----------------------------------------------------------------------

DEPARTMENT OF THE TREASURY

31 CFR Part 103

[Docket Number: Treas-FinCEN-2008-0022]


Notice of Availability of Final Interpretative Guidance--Sharing 
Suspicious Activity Reports by Depository Institutions and Securities 
Broker-Dealers, Mutual Funds, Futures Commission Merchants, or 
Introducing Brokers in Commodities With Certain U.S. Affiliates

AGENCY: Financial Crimes Enforcement Network (``FinCEN''), Treasury.

ACTION: Interpretive guidance.

-----------------------------------------------------------------------

SUMMARY: By this notice, FinCEN announces the availability of two 
related pieces of guidance that apply to depository institutions and to 
securities broker-dealers, mutual funds, futures commission merchants, 
and introducing brokers in commodities (collectively referred to as 
``final guidance'') interpreting the final rule published elsewhere in 
this part of today's Federal Register. Among other things, the final 
rule clarifies the scope of the statutory prohibition on the disclosure 
by a financial institution of a report of a suspicious transaction set 
forth in the Bank Secrecy Act (``BSA'') by stating that the 
confidentiality provision does not apply when a depository institution, 
securities broker-dealer, mutual fund, futures commission merchant, or 
introducing broker in commodities (hereafter, ``an authorized 
institution'') shares a suspicious activity report (``SAR''), or any 
information that would reveal the existence of a SAR, within its 
corporate organizational structure for purposes consistent with Title 
II of the BSA, as determined by regulation or guidance. The final 
guidance interprets this provision to permit an authorized institution 
to share a SAR, or information that would reveal the existence of a SAR 
(collectively, ``SAR information''), with certain affiliates.

DATES: This final guidance is effective January 3, 2011.

ADDRESSES: The final guidance is available in the U.S. Government's 
electronic docket site at http://www.regulations.gov under the under 
docket number TREAS-2008-0022 and on FinCEN's Web site at http://www.fincen.gov.

FOR FURTHER INFORMATION CONTACT: FinCEN's Regulatory Helpline, (800) 
949-2732.

SUPPLEMENTARY INFORMATION: 

I. Background

    FinCEN, through its authority under the BSA, as delegated by the 
Secretary of the Treasury, may require financial institutions to keep 
records and file reports that FinCEN determines have a high degree of 
usefulness in criminal, tax, or regulatory investigations or 
proceedings, or for intelligence or counter-intelligence activities to 
protect against international terrorism. In particular, the BSA and its 
implementing regulations require financial institutions in certain 
industries \1\ to file a SAR when they detect a known or suspected 
violation of Federal law or regulation, or a suspicious activity 
related to money laundering, terrorist financing, or other criminal 
activity.\2\
---------------------------------------------------------------------------

    \1\ FinCEN has implemented regulations for suspicious activity 
reporting at 31 CFR 103.15 (for mutual funds); 31 CFR 103.16 (for 
insurance companies); 31 CFR 103.17 (for futures commission 
merchants and introducing brokers in commodities); 31 CFR 103.18 
(for banks); 31 CFR 103.19 (for broker-dealers in securities); 31 
CFR 103.20 (for money services businesses); 31 CFR 103.21 (for 
casinos).
    \2\ The Annunzio-Wylie Anti-Money Laundering Act of 1992 (the 
Annunzio-Wylie Act), amended the BSA and authorized the Secretary of 
the Treasury to require financial institutions to report suspicious 
transactions relevant to a possible violation of law or regulation. 
See Public Law 102-550, Title XV, Sec.  1517(b), 106 Stat. 4055, 
4058-9 (1992); 31 U.S.C. 5318(g)(1).
---------------------------------------------------------------------------

II. The Notice of Proposed Guidance and Related Actions

    On March 9, 2009, FinCEN published in the Federal Register a notice 
of proposed rulemaking (``the proposed rule'') and two separate notices 
and requests for comment on proposed guidance (``the proposed 
guidance'') (collectively, ``the notices''). In the proposed rule, 
FinCEN proposed amendments to each of FinCEN's SAR rules \3\ to include 
key changes that would, among other things, clarify the scope of the 
statutory prohibition against the disclosure by a financial institution 
of a SAR.
---------------------------------------------------------------------------

    \3\ FinCEN's SAR rules include 31 CFR 103.15 (for mutual funds); 
31 CFR 103.16 (for insurance companies); 31 CFR 103.17 (for futures 
commission merchants and introducing brokers in commodities); 31 CFR 
103.18 (for banks); 31 CFR 103.19 (for broker-dealers in 
securities); 31 CFR 103.20 (for money services businesses); 31 CFR 
103.21 (for casinos).

---------------------------------------------------------------------------

[[Page 75608]]

    In separate but contemporaneous rulemakings, some of the Federal 
bank regulatory agencies \4\ proposed amending their SAR rules to 
incorporate comparable provisions to FinCEN's proposed rules, and 
amending their information disclosure regulations \5\ to clarify that 
the exclusive standard governing the release of a SAR, or any 
information that would reveal the existence of a SAR, is set forth in 
the confidentiality provisions of their respective SAR rules.
---------------------------------------------------------------------------

    \4\ The Federal Bank Regulatory Agencies include the Board of 
Governors of the Federal Reserve (``FRB''), the Office of the 
Comptroller of the Currency (``OCC''), the Federal Deposit Insurance 
Corporation (``FDIC''), the Office of Thrift Supervision (``OTS''), 
and the National Credit Union Administration (``NCUA'').
    \5\ Generally, these regulations are known as ``Touhy 
regulations,'' after the Supreme Court's decision in United States 
ex rel. Touhy v. Ragen, 340 U.S. 462 (1951). In that case, the 
Supreme Court held that an agency employee could not be held in 
contempt for refusing to disclose agency records or information when 
following the instructions of his or her supervisor regarding the 
disclosure. As such, an agency's Touhy regulations are the 
instructions agency employees must follow when those employees 
receive requests or demands to testify or otherwise disclose agency 
records or information.
---------------------------------------------------------------------------

    The proposed rule included a provision which states that the 
confidentiality provision does not apply when a bank shares a SAR, or 
any information that would reveal the existence of a SAR, within its 
corporate organizational structure for purposes consistent with Title 
II of the BSA, as determined by regulation or guidance. The proposed 
guidance interpreted this provision to permit a bank to share a SAR 
with certain affiliates, subject to certain qualifications.
    The notices and related Federal bank regulatory agency actions were 
published in their own separate part of the Federal Register to 
encourage commenters to take into account all relevant provisions.

III. Comments

    The comment period for the notices ended on June 8, 2009. We 
received a total of 26 submissions from 25 distinct entities.\6\ Of 
these, 15 were submitted by trade groups or associations, four were 
submitted by individual financial institutions, three were submitted by 
Federal, tribal, or foreign government agencies, three were submitted 
by consultants or attorneys not affiliated with a specific financial 
institution, and one was submitted by a self regulatory organization 
(``SRO''). The comments generally supported the proposed rules \7\ 
while requesting the broadening of the proposed sharing guidance.
---------------------------------------------------------------------------

    \6\ All comments to the notices are available for public viewing 
at http://www.regulations.gov or http://www.fincen.gov/statutes_regs/bsa/regs_proposal_comment.html.
    \7\ Comments about the proposed rules are addressed separately 
in the related Final Rule published by FinCEN in today's Federal 
Register.
---------------------------------------------------------------------------

A. Definition of ``Affiliate''

    FinCEN did not receive any comments that were critical of its 
proposed definition of ``affiliate.'' One commenter, however, did ask 
FinCEN to treat all of the subsidiaries of a bank holding company not 
as affiliates, but as the same legal entity, for purposes of SAR 
confidentiality. The commenter believed this would authorize the entire 
corporate family held by a bank holding company to share SAR 
information with each other. Due to the impropriety of arbitrarily 
creating such a provision for bank holding companies only, and the 
imprecise legal construct the commenter has conceived, FinCEN is not 
compelled to accommodate this request. Accordingly, FinCEN is adopting 
as proposed the definition of affiliate.\8\
---------------------------------------------------------------------------

    \8\ To accommodate specific industry terms and practices, the 
definition in the guidance for banks contains slight differences 
from the definition in the guidance for the securities broker-
dealers, mutual funds, futures commission merchants, and introducing 
brokers in commodities.
---------------------------------------------------------------------------

B. The Universe of Entities To Whom the Final Guidance is Applicable

    Multiple commenters requested the expansion of the SAR sharing 
authority to all industries that currently have a FinCEN SAR 
requirement, not just to the authorized institutions proposed. These 
commenters suggested that institutions and the government would benefit 
from such expansion by increasing efficiency, cutting costs, and 
enhancing the detection and reporting of suspicious activity. FinCEN 
recognizes the importance of a robust and efficient enterprise-wide 
compliance function, and is committed to facilitating such through 
rulemaking and guidance whenever possible. Most commenters, however, 
failed to sufficiently address how they would mitigate effectively the 
risk of unauthorized disclosure of SAR information if the sharing 
authority was expanded to the extent requested.
    FinCEN is particularly concerned about unauthorized disclosure of 
SAR information due to the disparity in regulatory oversight between 
those industries with a primary Federal functional regulator \9\ 
(industries to whom the proposed rules granted the authority to share, 
and for whom the guidance was proposed) and those without. Were the 
guidance expanded to include all industries, FinCEN would be unable to 
ensure, in the absence of regular examination of all institutions 
within those industries, that SAR information was being disclosed in 
accordance with the final rule and final guidance. Due to the 
particular sensitivities associated with SAR information, and the 
potentially grave consequences of inappropriate disclosure,\10\ FinCEN 
does not believe that the potential benefits of expanding the guidance 
to additional industries warrant such an expansion at this time.\11\
---------------------------------------------------------------------------

    \9\ For purposes of this guidance, primary Federal functional 
regulator includes the Federal bank regulatory agencies, the 
Securities and Exchange Commission (``SEC''), and the Commodity 
Futures Trading Commission (``CFTC'').
    \10\ For a more complete discussion of the importance of SAR 
confidentiality, and the potential consequences of lapses in such, 
see the relevant discussion in the final rule preamble published in 
this same part of today's Federal Register.
    \11\ Institutions are reminded that the final rule, published in 
this same part of today's Federal Register, contains a rule of 
construction for all industries authorizing the disclosure of 
``underlying facts, transactions, and documents upon which a SAR is 
based.'' Therefore, although FinCEN is not authorizing SAR sharing 
with affiliates for all industries at this time, FinCEN has 
recognized an alternative vehicle to accomplishing many enterprise-
wide compliance functions.
---------------------------------------------------------------------------

    To facilitate a potential future expansion of the guidance, 
however, FinCEN is taking a phased approach in the final rule and final 
guidance to granting additional industries the ability to share within 
their corporate organizational structure. In the final rule text 
published separately in today's Federal Register, we included for all 
industries the rule of construction for sharing within an institution's 
corporate organizational structure. We are not expanding the final 
guidance at this time, however, to include additional industries 
without a primary Federal functional regulator.\12\ This phased 
approach establishes the regulatory framework for those industries 
potentially to share SAR information within their corporate structure 
in the future, as prescribed by FinCEN in regulation or guidance, 
without necessarily requiring an amendment to the SAR confidentiality 
provision in each industry's SAR rules.
---------------------------------------------------------------------------

    \12\ For similar reasons, we are also not expanding the 2006 
guidance on sharing with head offices, controlling company, or 
parent entities to additional industries at this time.
---------------------------------------------------------------------------

    Some commenters also asked FinCEN to authorize ``two-way sharing,'' 
a concept they described as an affiliate of an authorized institution 
(i.e., a party to which the authorized institution could share SAR 
information) being able to share SAR information with the authorized 
institution. Under the final

[[Page 75609]]

guidance, such sharing would be permitted only when both affiliated 
institutions are either a depository institution, a securities broker-
dealer, a mutual fund, a futures commission merchant, or an introducing 
broker in commodities. Based on FinCEN's determination not to expand 
the final guidance to authorize additional industries to share SAR 
information with affiliates, ``two-way sharing'' is not permissible by 
an affiliate that is not an authorized institution, even if the 
affiliate intends to share SAR information only with authorized 
institutions.
    Commenters also asked that an affiliate of an authorized 
institution that receives shared SAR information be authorized to 
further share that SAR information with its affiliates. FinCEN cannot 
comply with this request, noting that the guidance only authorizes an 
institution ``that has filed a SAR [to] share the SAR, or any 
information that would reveal the existence of the SAR, with certain 
affiliates.'' Because a receiving affiliate is not the filing 
institution, it may not further share received SAR information. 
Additionally, in cases where there is no affiliate relationship between 
the authorized institution and its affiliate's affiliate, further 
sharing by the receiving affiliate would indirectly cause SAR 
information to be shared outside of the filing institution's corporate 
organizational structure, as defined in the guidance.

C. The Universe of Entities to Whom a SAR May Be Shared

    Several commenters asked FinCEN to expand the scope of the guidance 
to include additional parties to whom SAR information may be shared. 
For example, several commenters asked FinCEN to allow unrestricted 
sharing with all affiliates within an institution's corporate 
organizational structure by removing the limitation on sharing only 
with affiliates subject to a SAR requirement. One of these commenters 
suggested that institutions should be able to share with any affiliates 
at least as much information as unaffiliated institutions are 
authorized to share under Section 314(b) information sharing 
authorities.\13\ FinCEN notes that the final rule may permit the 
disclosure of such information to any affiliate financial institution, 
apart from this final guidance, under the rule of construction 
regarding disclosures of underlying facts, transactions, and documents 
upon which a SAR is based. However, FinCEN cautions institutions that 
sharing between affiliates of such information outside the 314(b) 
process would not be afforded the relevant 314(b) safe harbor. 
Similarly, when sharing underlying facts, transactions, and documents 
there would be no SAR safe harbor, which applies only to disclosures 
(SAR filings) made to the government and to the refusal to disclose SAR 
information to an inappropriate party.
---------------------------------------------------------------------------

    \13\ Section 314(b) of the USA PATRIOT Act authorized the 
sharing of information relating to suspected terrorist or money 
laundering activities between financial institutions, and created a 
safe harbor for such sharing. Neither Section 314(b) nor its 
implementing regulation at 31 CFR 103.110 explicitly authorizes the 
sharing of a SAR, or information that would reveal the existence of 
a SAR.
---------------------------------------------------------------------------

    Other commenters supporting the removal of the requirement that an 
authorized institution share only with affiliates subject to a SAR 
stated that institutions could ensure the confidentiality of SAR 
information once shared with an affiliate not subject to a SAR rule 
through confidentiality agreements or other security controls. FinCEN 
does not agree. Given the potentially significant consequences of 
unauthorized disclosure by an entity in possession of a SAR that is not 
subject to a SAR rule, the lack of oversight and enforcement powers of 
FinCEN with respect to such parties, and the significant exposure to 
liability to which the sharing institution could be exposed, FinCEN 
believes that authorizing sharing with affiliates without a SAR 
requirement at this time would be inconsistent with the purposes of the 
BSA.
    Multiple commenters, including some trade organizations, also 
objected to the requirement that affiliates be subject to a SAR 
requirement, as this precludes the sharing of SAR information with 
foreign affiliates that are within an institution's corporate 
organizational structure. Commenters reasoned that since FinCEN's 2006 
Guidance permitted sharing with a foreign head office, controlling 
company, or parent entity despite concerns that the SAR could become 
discoverable under the laws of a foreign jurisdiction, sharing with a 
foreign affiliate should also be permitted despite such concerns. 
FinCEN disagrees. A foreign head office, controlling company, or parent 
entity may have oversight responsibilities with respect to enterprise-
wide risk management and compliance with laws and regulations. These 
responsibilities may include a valid need to review compliance by U.S.-
based financial institutions with legal requirements to identify and 
report suspicious activity.
    FinCEN believes that the responsibilities of the foreign head 
office, controlling company, or parent entity in certain jurisdictions 
may outweigh concerns of a SAR becoming subject to the laws of that 
jurisdiction,\14\ and that in such circumstances the sharing of SARs is 
consistent with the purposes of the BSA. The same circumstances do not 
yet apply to foreign affiliates. FinCEN believes that the need to 
prevent a SAR from becoming subject to the laws of a foreign 
jurisdiction significantly outweighs any limited need for a foreign 
affiliate to obtain SAR information. Furthermore, nothing in this 
guidance or the final rule prevents an authorized institution from 
sharing underlying facts, transactions, and documents upon which the 
SAR is based with foreign affiliates, provided that neither the SAR, 
nor information that would reveal the existence of a SAR, is disclosed. 
Accordingly, the final guidance does not permit the sharing of SAR 
information, even by authorized institutions, with their foreign 
affiliates at this time.
---------------------------------------------------------------------------

    \14\ Accordingly, the 2006 guidance authorized the sharing of a 
SAR with such foreign entities, while clarifying that depository and 
securities/futures institutions may be liable for direct or indirect 
disclosure by the foreign head office, controlling company, or 
parent entity. The guidance also required that depository or 
securities/futures institutions must protect the confidentiality of 
the SAR and obtain written confidentiality agreements to ensure the 
confidentiality of the SAR is protected by the foreign recipient of 
the SAR.
---------------------------------------------------------------------------

    For similar reasons, FinCEN is not incorporating into the final 
guidance another commenter's suggestion that a bank be authorized to 
share SAR information with its foreign branches. FinCEN believes that 
neither a U.S. bank, nor its foreign branch, has sufficient need to 
share or receive SAR information that would outweigh concerns over SAR 
information becoming subject to the laws of a foreign jurisdiction and 
that sharing in such circumstances, at this time, is inconsistent with 
the purposes of the BSA.
    One commenter, perhaps anticipating our reluctance to authorize the 
international sharing of SAR information, encouraged FinCEN to work 
with other jurisdictions to ensure equal SAR sharing capabilities for 
financial institutions in those jurisdictions, and between financial 
institutions in the United States and financial institutions in foreign 
jurisdictions. The commenter suggested FinCEN seek to harmonize its SAR 
rules, and relevant confidentiality authorities, with the rules and 
provisions of foreign jurisdictions. FinCEN engages regularly with 
foreign jurisdictions on these issues, and has been vocal about its 
efforts to promote an international regulatory climate

[[Page 75610]]

under which the authority for financial institutions to share SAR 
information could be broadened significantly.

D. Confidentiality Agreements

    Multiple commenters questioned the need to have a written 
confidentiality agreement in place between sharing affiliates. The 
proposed guidance included a provision that stated that sharing 
affiliates should have written confidentiality agreements in place. 
Commenters noted that they should be able to utilize or modify their 
existing confidentiality processes and procedures for sensitive 
information, and that requiring ``written agreements'' unnecessarily 
burdened financial institutions by being overly prescriptive with 
respect to an objective that could be accomplished through various 
means. FinCEN believes that this is a reasonable request, particularly 
since the final guidance allows sharing only with affiliates subject to 
a SAR rule. The existing confidentiality requirements prescribed in 
those rules significantly mitigates the risk of a recipient of shared 
SAR information further disclosing that information. Therefore, the 
final guidance has been amended to state that an institution, ``as part 
of its internal controls, should have policies and procedures to ensure 
that its affiliates protect the confidentiality of a SAR.'' \15\
---------------------------------------------------------------------------

    \15\ This in no way alters the confidentiality agreement 
requirement imposed in FinCEN's January 20, 2006 ``Interagency 
Guidance on Sharing Suspicious Activity Reports with Head Offices 
and Controlling Companies'' and the ``Guidance on Sharing of 
Suspicious Activity Reports by Securities Broker-Dealers, Futures 
Commission Merchants, and Introducing Brokers in Commodities.'' 
FinCEN notes that entities to which an institution is authorized to 
share in the 2006 guidance may not be subject to a SAR rule. 
Accordingly, a depository or securities/futures institution that 
shares a SAR, or information that would the reveal the existence of 
a SAR to a head office, controlling company, or parent entity must 
have a confidentiality agreement in place.
---------------------------------------------------------------------------

E. Consistency With the Final Rule Language

    As discussed in more detail in the final rule published elsewhere 
in today's Federal Register, FinCEN made several changes to the 
proposed rule based on the comments received. In several instances, the 
proposed guidance quoted or referenced language from the proposed 
rules. In the final guidance, we are making comporting changes to 
ensure consistency with the final rule. None of these changes 
substantively impact the authority to share SAR information with 
affiliates.

F. Guidance

    Excluding those changes specifically referenced in the above 
preamble to this notice of availability of guidance, the final guidance 
is being adopted, as proposed. FinCEN is making this final guidance 
available on its Web site today.\16\
---------------------------------------------------------------------------

    \16\ Initially, the final guidance will appear under the What's 
New tab. Institutions can also find the final guidance under the 
Guidance Section of the Financial Industry tab or under the 
appropriate Industry tab.

    Dated: November 22, 2010.
James H. Freis, Jr.,
Director, Financial Crimes Enforcement Network.
[FR Doc. 2010-29884 Filed 12-2-10; 8:45 am]
BILLING CODE 4810-02-P