On New Year’s Day, January 1, 2021, the U.S. Senate voted 81 to 13 to override President Trump’s veto of the National Defense Authorization Act (“NDAA”), thus joining the House of Representatives, which had taken similar action four days earlier 322 to 87, so enacting the NDAA into law. While there are many provisions in the 4,500+ page NDAA, the ones of perhaps the greatest significance for “financial institutions” (as defined in the legislation) are those which impose significant changes to existing anti-money laundering and counter-terrorist financing regulations adopted under the Bank Secrecy Act of 1970 (“BSA”) enhanced by the USA PATRIOT Act of 2001 (“Patriot Act”). The NDAA directs the Treasury to take a variety of steps to impair money-laundering and terrorist financing activities, many of which are to be implemented by the Financial Crime Enforcement Network (“FinCEN”), a special unit of the Department of Treasury.

Anti-Money Laundering

The NDAA incorporates the Anti-Money Laundering (“AML”) Act of 2020, which:

• Requires the Department of the Treasury to conduct certain studies, some of which are specifically to be done by FinCEN

• Requires the establishment of national AML and related “countering the financing of terrorism” (“CFT”) priorities

• Increases whistleblower awards and protections

• Modernizes the definition of “financial institution” to include entities involved in storage and transmission of virtual currency and to include antiques dealers

• Increases penalties for AML and CFT violations

• Streamlines and modernizes AML and CFT requirements and regulations

• Improves information sharing and AML/CFT training among financial institutions

• Improves coordination and cooperation among federal, state, and tribal AML and CFT law enforcement agencies

The NDAA

1. The Treasury is required to head a review of ALL existing BSA regulations. In a related step FinCEN is to review its existing regulations and ALL prior guidance on AML/CFT, as well as existing forms used to monitor activities in these areas, including Suspicious Activity Reports (“SAR”s) and Currency Transmittal Reports (“CTR”s). The Secretary of the Treasury is mandated to report to Congress by January 2, 2022, on the results of these reviews, including administrative and/or legislative recommendations. Similar reviews are to be conducted annually thereafter. In addition, Treasury is directed, as part of this over 200-page part of the NDAA, to conduct studies on:

• Artificial intelligence, blockchain, and other emerging technologies

• Trade-based money laundering

• VERY POINTEDLY, money laundering by the People’s Republic of China

2. The Treasury is required to establish immediately national AML/CFT Priorities, which are to be reviewed and updated at least every four years. Related to this effort, ALL “financial institutions” as defined must incorporate those national Priorities into the AML/CFT compliance programs for their respective institutions. Those institutions will in turn be examined and evaluated based on their compliance programs, both how well those programs are designed AND how well they are implemented.

3. The NDAA expands the existing AML/CFT whistleblower program, including raising the potential awards when monetary sanctions for violations exceed $1 million from the lesser of up to 25% of the collected sanction or $150,000; to, in the case of sanctions over $1 million, 30%. This increase was inspired in part by the success of the SEC whistleblower program. The NDAA also includes enhanced protections for whistleblowers against retaliation. Whistleblowers who believe they have been subjected to retaliation may file a complaint with the U.S. Secretary of Labor. If they prevail, they are eligible for:

• Reinstatement with seniority

• Compensatory damages including litigation expenses

• Two times the amount of back pay owed with interest

• “Any other appropriate remedy”

4. The NDAA modernizes and expands the list of “financial institutions” so that now the list includes:

• Banks, thrifts, credit unions, and other insured depository institutions

• Branches and agencies of foreign banks

• Broker-dealers of securities

• Money services businesses, including money transmitters, issuers of checks, money orders or “similar instruments,” and foreign exchange dealers, including persons engaged in the storage or transmission of virtual currencies

• Nonbank lending companies

• Insurance companies

• Operators of credit card systems

• Mutual funds

• Futures commission merchants

• Travel agencies

• Casinos with annual revenues over $1 million

• Pawnbrokers

• Dealers in precious metals, stones, or jewels

• Persons engaged in the trade of antiques, including an advisor, consultant, or other dealers in antiquities

• Other businesses or agencies designated by the Secretary of the Treasury with activities similar to a financial institution OR whose cash transactions are useful for criminal, tax, or regulatory matters

Related provisions in the NDAA make clear that there is considerable concern about market innovations, specifically including the development of Fin-Tech entities. So, the NDAA requires the Treasury to establish a Subcommittee on Innovation and Technology of the Bank Secrecy Act Advisory Group to advise federal and state regulators on ways to “encourage and support technological innovation in the areas” of AML/CFT and to reduce “obstacles to innovation” caused by BSA regulations. In parallel, FinCEN is to appoint an Innovation Officer to support federal and state enforcement agencies and regulators, and also to support private sector participants with new technologies to assist in complying with the BSA. In addition, the U.S. Government Accountability Office Director MUST study the use of virtual currencies to facilitate drug trafficking and human trafficking in online markets. Not expressly listed as “financial institutions” are securities exchanges, both in the U.S. and overseas, and alternative trading systems, although they potentially offer interesting platforms for “laundering” money. Similarly, art dealers, auction houses, and the like are not on the list.

5. The NDAA significantly increases both the amount and types of sanctions for violations of AML/CFT laws and regulations. The Act adds an additional civil penalty of either three times the profit gained, or loss avoided, by the violative action OR two times the otherwise applicable maximum penalty for the violation. In addition, the BSA is revised to allow the imposition of fines “equal to the profit gained by …[a] person by reason” of the violation. Partners, directors, officers, and employees convicted of violating the BSA are required to repay ANY bonus paid to that person during the year in which the violation occurred or in the following year. Any person found to have committed an “egregious violation” of the BSA is barred for 10 years from serving as a director of a U.S. financial institution, which bar apparently applies to serving as a director of ANY “financial institution” as defined in the NDAA. Finally, the U.S. Department of Justice is required to submit an annual report to Congress for the next five years with a list of deferred prosecution agreements and non-prosecution agreements entered into during the prior year, setting forth the BSA violation involved and the justifications for the agreements.

6. Under the NDAA provisions, including the reviews and studies already mentioned, the AML/CFT regulations and requirements are to be modernized and rationalized, eliminating duplication and aligning critical terms. Specific mention is made of bringing SAR’s and CTR’s up-to-date and simplifying their filing. By January 2, 2022, those forms and the reporting requirements that mandate their filing must be reviewed with a report submitted by the Secretary of the Treasury to Congress, which includes proposed changes to reduce unnecessary burdens on financial institutions while increasing the effectiveness of the reports, including setting appropriate dollar amounts triggering a reporting mandate. A similar review is to be conducted at least once every five years. FinCEN is also instructed to assess whether to establish a “no-action” letter process akin to that long-extant under the SEC, as a means of providing continuing guidance to financial institutions.

7. Under the NDAA annual AML/CFT, training is required for ALL federal bank examiners. Similar required training programs will probably be implemented for regulators of other regulated financial industries, as for example the SEC Division of Examinations, which examines broker-dealers and investment advisers. FinCEN is to establish a FinCEN Exchange as a public-private information sharing partnership among law enforcement agencies and financial institutions to coordinate and combat money laundering and terrorist financing. In that connection, FinCEN is to share threat patterns and trend information with financial institutions. The NDAA also authorizes the establishment of a pilot program under which a financial institution may share SARs and SAR information directly with that financial institution’s foreign branches and affiliates. Currently, that information may be shared only with a foreign affiliate that is a “head office” or “controlling company,” which can slow the flow of information and impede compliance in global financial institutions. The pilot program does not apply in the case of foreign affiliates in China, Russia, and certain other countries.

8. The main focus of the AML/CFT provisions in the NDAA is law enforcement. In keeping with that focus, the Act emphasizes the need for FinCEN to coordinate, on a recurring basis, with other federal, state, local, and tribal law enforcement agencies. The establishment of the FinCEN Exchange, discussed above, is just one manifestation of that emphasis. In addition, FinCEN is given expanded ability to subpoena the records of foreign banks that maintain correspondent accounts in the United States. It is not clear how that authority will extend, if at all, to U.S. accounts of foreign financial institutions. Finally, the Secretary of the Treasury is required to work with foreign counterparts to promote stronger enforcement of AML/CFT laws and regulations. To that end, the NDAA creates a Treasury Attaché program at U.S. embassies overseas, and FinCEN is required to appoint Foreign Financial Intelligence Unit Liaisons at those embassies to work with their foreign counterparts. The Treasury is also required to work with the Financial Action Task Force, International Monetary Fund, and Organization for Economic Cooperation and Development to promote AML/CFT enforcement. In a related move, the Act appropriates approximately $60 million a year for four years to allow the Treasury to provide technical assistance to foreign countries to establish and improve AML/CFT programs.

In Defense of the Realm

The NDAA is intended to strengthen greatly the power and scope of federal jurisdiction to deal with money laundering and terrorist financing. Its ability to realize those goals will depend in large measure on the ability of the Treasury, and especially FinCEN, to craft clear and reasonable regulations, and at the same time to remain a dedicated, conscientious administrator AND enforcer of the law and those regulations. Financial Institutions of “all stripes” had best prepare for the consequences of the increased scrutiny and for the need for continuing self-audit and improvement.