USA Patriot Act

The USA PATRIOT Act is the US law enacted on 26 October 2001 as Public Law 107-56, whose Title III rewrote the Bank Secrecy Act into the AML regime that US financial institutions operate under today. The official title for the USA Patriot Act is “Uniting and Strengthening America by Providing Appropriate Tools Required to Intercept and Obstruct Terrorism (USA PATRIOT) Act of 2001.”

FinCEN describes the Act’s purpose as deterring and punishing terrorist acts in the United States and around the world and widening law enforcement investigatory tools, and names four aims that fall directly on the financial services industry.

• Strengthening the US measures to prevent, detect, and prosecute international money laundering and financing of terrorism.
• Requiring relevant parts of the financial services industry to report potential money laundering.
• Applying special scrutiny to foreign jurisdictions, foreign financial institutions, and classes of international transactions open to criminal abuse.
• Stopping corrupt foreign officials from using the US financial system for personal gain, and returning stolen assets to the citizens of the countries they belong to.

What the USA PATRIOT Act covers

The Act itself is far wider than financial crime. It runs to ten titles and around 156 sections. 

• Title I, domestic security against terrorism
• Title II, surveillance procedures
• Title III, international money laundering and terrorist financing
• Title IV, border protection and immigration
• Title V, removing obstacles to investigating terrorism
• Title VI, victims of terrorism and public safety officers
• Title VII, information sharing for critical infrastructure
• Title VIII, criminal laws against terrorism
• Title IX, intelligence
• Title X, miscellaneous

Only Title III reaches financial institutions. It has a total of 46 sections, split into three subtitles that cover international counter-money laundering measures, Bank Secrecy Act Amendments, and currency crimes. 

Relationship between the PATRIOT Act and the Bank Secrecy Act (BSA): 

The Bank Secrecy Act (BSA) was passed in 1970. It established the recordkeeping and the reporting requirements that actually became the foundation of the US anti-money laundering framework. Later, these amendments added further obligations, including suspicious activity reporting, before the PATRIOT Act existed. 

The PATRIOT Act did not replace it. Title III strengthened and expanded the existing framework, including Section 326’s customer identification requirements. The Treasury, through FinCEN and working with other federal regulators where required, translated these provisions into the detailed rules. That is why the two names often appear together. For the financial institutions, many PATRIOT Act requirements form part of the broader BSA and AML compliance programme. The examiners also assess compliance against the applicable legal and regulatory requirements that include FinCEN’s rules and those of the institution’s banking regulator. 

Section 326: The Customer Identification Program (CIP) Requirement

Section 326 Customer Identification Program is the part that made identity checks a legal duty. It requires the Treasury to set up a minimum standard for identifying the customer before opening an account, and fixed the floor for those rules at three things: verifying identity, keeping records of the information that is being used, and consulting government terrorist lists. 

Treasury passed that job to FinCEN. FinCEN keeps its rules in one rulebook, 31 CFR Chapter X, and that rulebook has a separate section for each kind of business. So FinCEN wrote the same identity rule four times and put one copy in each of four sections. 

• If a bank, savings association, or credit union, the rule is 31 CFR 1020.220
• If a broker or dealer in securities, it is 31 CFR 1023.220
• If you run a mutual fund, it is 31 CFR 1024.220 
• If a futures commission merchant or introducing broker, it is 31 CFR 1026.220 

The CIP has to be written down, sized according to a business, and built into a wider AML  program rather than run alongside it. 

Customer information required at account opening: 

The information required by the customer prior to opening an account is

• Name 
• Date of Birth, for individual customers only
• Address, a residential or business street address for an individual. A principal place of business or other physical location for a company or trust.
• Identification number, a taxpayer identification number for a US person. For a non US person, either a Taxpayer Identification Number (TIN), a passport number with its country of issuance, an alien identification card number, or another government-issued document showing nationality or residence and carrying a photograph 

Identification Methods: 

The rules name example documents but mandate none of them. Verification can run through documents, through non-documentary methods, or both, and it has to be completed within a reasonable time after the account opens. Non-documentary methods include contacting the customer, checking their details against a credit bureau or public database, or asking another institution for a reference. The procedures must specifically handle the customer who never appears in person, which for a digital business is every customer. The CIP also needs to address in advance when an account will be declined, and what a customer may do with an account while verification is still running. 

Recordkeeping, government lists, and customer notice: 

There are three duties that are to be followed along with the verification process: 

• Records: Identifying information is kept for five years after the account closes. Descriptions of the documents relied on, the methods and results of any non-documentary check, and how a discrepancy was resolved are kept for five years from the date of the record.
• Government Lists: The customer is checked against federal lists of known or suspected terrorists within a reasonable time of account opening.
• Notice: Customers are told the information is being collected to verify their identity. A line on the application form or on the website is enough.

Section 352: The four pillars of an AML Program

Section 352 rewrote the AML compliance program requirement so that every financial institution must have one. It includes the following programs that each financial institution has to follow: 

• the development of internal policies, procedures, and controls
• the designation of a compliance officer
• an ongoing employee training program
• an independent audit function to test programs

A fifth element arrived later and came from FinCEN rather than the Act. The 2016 customer due diligence rule added risk-based ongoing due diligence and beneficial ownership checks on company customers.