May 11, 2018 Implementation Deadline Looms

Last year, we posted FinCEN’s Beneficial Ownership Rule: A Practical Guide to Being Prepared for Implementation regarding the Customer Due Diligence Requirements for Financial Institutions Rule (the “Beneficial Ownership Rule” or “Rule”) issued by the Financial Crime Enforcement Center (“FinCEN”). With the Rule’s May 11 implementation date only a few weeks away, and with FinCEN recently having published its new and long-awaited FAQs regarding the Rule (FAQs), we thought that the time was right for more practical tips and answers to questions surrounding the Rule.

The Beneficial Ownership Rule states that a covered financial institution must verify and identify each natural person with a 25% or greater equity interest in a legal entity customer. So do we comply if we don’t collect beneficial ownership information at a lower equity interest threshold? 

The answer to this question isn’t as obvious as one might think. Bank regulators previously have suggested that, depending on the risk, a threshold lower than 25% may be warranted, and several financial institutions already collect beneficial ownership at a 10% equity interest threshold.  FinCEN agrees with that prior guidance, stating in response to FAQ 2, “There may be circumstances where a financial institution may determine that collection and verification of beneficial ownership information at a lower threshold may be warranted, based on the financial institution’s own assessment of its risk relating to its customer.”

You’ll need to rely on your risk assessment to make this determination. Do you have high risk customers?  Would the specific risk posed by the customer be mitigated by collecting beneficial ownership data at a lower threshold or provide information that would be useful to you in analyzing the risk?  If so, then your regulator may expect you to collect beneficial ownership information at a lower equity interest threshold, and failure to do so may result in a negative examination finding.

What methods will you use to verify beneficial ownership information?

In its response to FAQ 4, FinCEN reiterated that a financial institution may use documentary or non-documentary methods, or a combination of both methods for identity verification. Further, the Beneficial Ownership Rule expressly authorizes covered financial institutions to use photocopies of identity documents for documentary verification.  FinCEN also listed acceptable types of non-documentary verification, such as “contacting a beneficial owner; independently verifying the beneficial owner’s identity through the comparison of information provided by the legal entity customer (or the beneficial owner, as appropriate) with information obtained from other sources; checking references with other financial institutions; and obtaining a financial statement.”

Of course, you will need to conduct a risk-based analysis to determine the appropriate method of verification and the appropriate documents or copies to accept in order to comply with the Rule’s verification requirement.

If an existing customer is named as a beneficial owner of a new legal entity customer, must a covered financial institution still identify and verify the identity of this individual or may it rely on the CIP identification and verification it previously performed?

In response to FAQ 7, FinCEN explains that the covered financial institution may rely on the Customer Identification Program (“CIP”) steps it previously performed, “provided the existing information is up-to-date, accurate, and the legal entity customer’s representative certifies or confirms (verbally or in writing) the accuracy of the pre-existing CIP information.” If you decide to rely on pre-existing information, your records for the new account should cross-reference the relevant CIP records.  The obvious question is whether you have a way to identify that such a person is an existing customer or whether you will need to include a question regarding this on your beneficial ownership certification form.  For instance, in addition to asking for the requisite information concerning name, SSN, and address of the beneficial owner, you also could ask whether they are an existing customer.

Remember, however, that all identifying information must be maintained for a period of five years after the legal entity’s account is closed. Therefore, if you choose to rely on pre-existing CIP when opening a new account for a legal entity customer, you should maintain the original records, and any updated information, including a record of any verbal or written confirmation of pre-existing information, until five years after the closing of the new account.

If a covered financial institution has a legal entity customer for which it opens multiple accounts, must it identify and verify the customer’s beneficial ownership for each account?

This has been issue of great concern. After all, each of these accounts technically qualifies as a “new account” under the Rule and having to refresh beneficial ownership information repeatedly could burden internal systems and onboarding teams and strain the customer relationship.

In its response to FAQ 10, FinCEN explains that it is not necessary to repeatedly obtain a new certification form. Rather, you may rely on the information already obtained to fulfill the beneficial ownership requirement for subsequent accounts, “provided the customer certifies or confirms (verbally or in writing) that such information is up-to-date and accurate at the time each subsequent account is opened and the financial institution has no knowledge of facts that would reasonably call into question the reliability of such information.”  Of course, you also will need to keep a record of the confirmations you receive.

So how would this play out? You simply could include, as part of your onboarding procedures, a question (either verbal or written) to the effect of: “Has your beneficial ownership information changed since you filled out the certification form?”  Be sure to record the answer.  For verbal confirmations, include in your account notes the name of the person who confirmed the information.

Are financial institutions required to have their legal entity customers certify the beneficial owners for existing customers during the course of a financial product renewal (e.g., a loan renewal or certificate of deposit)?

This is an issue that has been causing concern for some time because, in previous guidance, FinCEN had stated that a new account is established each time a loan is renewed or a CD is rolled over.  But having to collect beneficial ownership each time a renewal or rollover occurs seems unnecessary and unduly onerous.

In its response to FAQ 12, FinCEN acknowledges that each renewal or rollover establishes a new account, but explains that the Rule does not require certification of beneficial ownership in each instance:

For financial services or products established before May 11, 2018, covered financial institutions must obtain certified beneficial ownership information of the legal entity customers of such products and services at the time of the first renewal following that date. At the time of each subsequent renewal, to the extent that the legal entity customer and the financial service or product (e.g., loan or CD) remains the same, the customer certifies or confirms that the beneficial ownership information previously obtained is accurate and up-to-date, and the institution has no knowledge of facts that would reasonably call into question the reliability of the information, the financial institution would not be required to collect the beneficial ownership information again.

FinCEN then explains that in the case of loan renewals and CD rollovers, if at the time the customer first certifies its beneficial ownership information, “it also agrees to notify the financial institution of any change in such information, such agreement can be considered the certification or confirmation from the customer and should be documented and maintained as such, so long as the loan or CD is outstanding.”

As a practical matter, you need to determine how you will get the necessary confirmation from the customer. The simplest way would be to add a statement similar to the following to your beneficial ownership certification form: “Customer agrees to notify bank promptly in writing of any change to the beneficial ownership information contained in this Certification of Beneficial Ownership.”  Of course, if as a result of normal monitoring (or otherwise) you learn of information regarding a customer or account, such as a possible change of beneficial ownership information, you may need to obtain or update beneficial ownership information.

Must you collect or update beneficial ownership information during routine periodic reviews of existing accounts?

In its response to FAQ 14, FinCEN explains that “periodic reviews are not by themselves a trigger to obtain or update beneficial ownership information.” Rather, the obligation to obtain or update information is triggered when, in the course of normal monitoring, a financial institution becomes aware of information, including a change in beneficial ownership information, relevant to assessing or reassessing a customer’s overall risk profile.  Thus, as part of your implementation of the Beneficial Ownership Rule, you must determine, on a risk-based basis, what events will trigger a need to collect or update beneficial ownership information.  Although a simple change in a beneficial owner’s address may require only an update, a change in beneficial owners will trigger a need to collect a new certificate and verify the new owner’s identity.

Must a financial institution proactively cross-check beneficial ownership information to comply with the CTR aggregation requirement?

This is another issue that has caused concern for covered financial institutions, especially those whose systems don’t allow them to perform such cross-checks. Fortunately, in response to FAQ 32, FinCEN explains that, with respect to legal entity customers that share a common owner, no such cross-checking is required.  Instead, “unless there is an affirmative reason to believe otherwise,” you are permitted to “presume that different businesses that share a common owner are operating separately and independently from each other and from the common owner.”  Therefore, you need not aggregate transactions involving those businesses with those of each other or with those of the common owner for purposes of CTR filing.

This post only scratches the surface of the changes you will need to consider implementing in order to be prepared and answers only some of the lingering questions you may have.  There is one bit of good news however – at a recent conference, regulators said they intended to give covered financial institutions a bit of time to get up to speed (perhaps a month or two) before finding non-compliance.  Nonetheless, it is still critical that you comply with the Rule upon its May 11, 2018 compliance date or very soon thereafter.  That does not give you much time.