section 3 – the bank secrecy acttraining.cuna.org/self_study/regtrac/member...mar 01, 2011 ·...

© 2018 CUNA GENERAL OPERATIONS REGULATIONS 3-1

SECTION 3 – THE BANK SECRECY ACT


General Overview

We’ve no doubt all heard the expres-sion: “Crime doesn’t pay.” Indeed, when a perpetrator of crimes is apprehended, indicted, convicted, and sentenced he or she learns that lesson the hard way. Sad but true, however, is the fact that some crime does pay—at least until the bad guys are apprehended. Or, perhaps more accurately, crime reaps payments. And crime doesn’t usually accept credit cards—it takes its payment in cold, hard cash. Whether the crime is blackmail, drug dealing, tax evasion, illegal gam-bling, loan sharking, embezzlement, or a wide range of other types of activity that our laws have defined as criminal, the “successful” (the term is used loosely) criminal eventually winds up, somewhere along the line, with a pile of currency.

But that currency can present a prob-lem for the typical bad guy. In order to put his loot to work for him, a criminal must eventually re-enter that currency into circulation. And for as long as there has been a banking system, the bad guys have sought to use it to “launder” their ill-gotten gains by transforming their dirty money into legitimate sources of funds.

Law enforcement has its hands full tracking various bad actors (there never seems to be a shortage) in a never-ending effort to bring them to justice. Because of the banking system’s large, if unwanted, role in allowing criminals to launder their money, Congress has passed a collection of laws which are

referred to as the “Bank Secrecy Act.” In an effort to provide assistance to law enforcement, “banks” are required to keep certain records and to make certain reports regarding currency (and other) transactions.

The Bank Secrecy Act (BSA) is per-haps misnamed. It applies to much more than just “banks” (as that term is com-monly used), and it has more to do with divulging secrets than keeping them. Be that as it may, “Bank Secrecy Act” is a term now firmly entrenched in the par-lance of the financial services industry, and it is not likely to be changed any time soon.

In this section, we will briefly discuss the various laws that together make up the Bank Secrecy Act. Next we will turn our attention to the NCUA regulation which generally mandates BSA com-pliance for all federally insured credit unions. Finally, we will discuss the particular recordkeeping and reporting requirements that are at the heart of BSA compliance.

When one thinks of regulatory compli-ance the first thing that usually comes to mind is consumer protection. Many of the various statutes and regulations with which financial institutions must comply are ultimately created with that end in mind. The BSA is not, however, about consumer protection — it is a law enforcement tool. Violations of the vari-ous Bank Secrecy Act laws and regula-tions can, consequently, expose credit unions to both civil and criminal penal-

Section 3 – The Bank Secrecy Act



ties. We will address those penalties separately below.

The laws that form the “Bank Secrecy Act”

As mentioned in the introduction, terms like “Bank Secrecy Act,” or “BSA,” are frequently used in connec-tion with the compliance duties of finan-cial institutions, but they do not usually refer to a single statute (although, as we will discuss, there is a federal law called the Bank Secrecy Act). Actually, a number of laws and regulations come into play when discussing BSA compli-ance. Among these laws and regulations are the Anti-Drug Abuse Act of 1986; the Money Laundering Control Act of 1986; the Bank Secrecy Act of 1970; the Currency and Foreign Transactions Reporting Act; US Patriot Act, Title III; NCUA Rules and Regulations Part 748.2; and the Financial Recordkeeping and Reporting of Currency and Foreign Transactions rules developed by the U.S. Treasury Department and found in 31 C.F.R. Part 103.

Anti-Drug Abuse Act of 1986

This law was enacted to help fed-eral law enforcement’s efforts to thwart illicit drug crops, to stop international drug trafficking, to improve the enforce-ment of the antidrug laws already on the books, and to establish more effective drug abuse and prevention programs. Among the antidrug enforcement provi-sions of the Anti-Drug Abuse Act are the provisions which make up the Money Laundering Control Act of 1986.

Money Laundering Control Act of 1986

The Money Laundering Control Act of 1986, part of the Anti-Drug Abuse Act of 1986, made money laundering a federal crime. The Act resulted in the following:

• Criminalized the act of money laundering;

• Prohibited the act of structuring trans-actions to evade currency transaction report (CTR) filings; and Introduced civil and criminal forfeiture for BSA violations.

The penalties for those offenses include imprisonment for a maximum of 20 years, fines up to $500,000 or two times the amount laundered, and forfei-ture of assets.

Bank Secrecy Act of 1970

Perhaps best-known among these various statutes is the Bank Secrecy Act of 1970. This is the federal statute that mandates, among other things, that financial institutions — including credit unions — maintain certain financial records about their members’ and cus-tomers’ transactions and that they report certain transactions in currency which involve more than $10,000.

The Currency and Foreign Transactions Reporting Regulation

This law requires that persons file a Report of International Transportation of Currency or Monetary Instruments (FinCEN Form 105) whenever they send or receive more than $10,000 in cur-rency or monetary instruments out of or into the U.S. As we will discuss later, this statute rarely directly affects credit unions.

http://www.fincen.gov/forms/files/fin105_cmir.pdf



The USA PATRIOT Act, Title III: Inter-national Money Laundering Abatement and Anti-Terrorist Financing Act of 2001

This law amends the Bank Secrecy Act and targets money-laundering issues. One provision of this law will require financial institutions, including credit unions, to have minimum standards to verify the identity of its members when opening accounts. Another provision requires financial institutions to have antimoney-laundering programs in place. NCUA regulations already require feder-ally insured credit unions to have a com-pliance program in place that is similar to the antimoney-laundering programs required by this Act. Therefore, credit unions that are in compliance with these requirements will be in compliance with the antimoney-laundering programs required by this act. Financial institu-tions are required to search their records (if requested by FinCEN) to determine if the financial institution maintains or has maintained accounts for, or has engaged in transactions with, individuals or orga-nizations listed on the request.

NCUA Rules and Regulations §748.2

Although the original Bank Secrecy Act of 1970 applied to credit unions, their compliance with that statute was sparse, at best, for many years. But in 1986, the NCUA adopted a regulation which specifically provided rules that credit unions were required to follow to evidence their compliance with the BSA.

NCUA Rules and Regulations Section 748.2 sets forth those specific require-ments. Under 748.2 all federally insured credit unions must develop and provide for the continued administration of a pro-

gram reasonably designed to assure and monitor compliance with the recordkeep-ing and reporting requirements set forth in the Bank Secrecy Act. NCUA requires that credit unions’ compliance programs adhere to the requirements set forth in 31 C.F.R. Part 103—the BSA regulations adopted by the U.S. Treasury Department with regard to BSA. Each credit union’s plan must be in writing and must be approved by their board of directors.

Section 748.2 requires that the for-mal BSA compliance plan must:

• Provide for a system of internal con-trols to assure ongoing compliance per Section 748.2(c)(1).

• Provide for independent testing for compliance to be conducted by credit union personnel or outside parties per Section 748.2(c)(2).

• Designate an individual responsible for coordinating and monitoring day- to-day compliance per Section 748.2(c)(3).

• Provide training for appropriate per-sonnel per Section 748.2(c)(4).

31 CFR Chapter X

Chapter X of the Code of Federal Regulations contains the nuts and bolts of compliance with credit unions’ and banks’ reporting and recordkeeping requirements under the BSA. These Treasury rules broadly define the term “bank” — and that definition clearly includes all credit unions, both state- and federally chartered.

FinCEN transferred the BSA regulations found in 31 CFR 103 to a new chapter (Chapter X) as of March 1, 2011.



Reporting Requirements

A number of different reporting requirements are set forth in the BSA regulations. For credit unions and other traditional financial institutions, the Currency Transaction Report (FinCEN Form 104, or CTR) is far and away the most familiar of these reports. Other reports required under the regulations include Suspicious Activity Reports and Reports of International Transportation of Currency or Monetary Instruments. As of April 2013, credit unions must use the Financial Crimes Enforcement Network (FinCEN) reports available only electronically through the e-filing system.

Currency Transaction Reports

The Currency Transaction Report (FinCEN Form 104 or CTR) is a corner-stone of BSA compliance. In general, a

credit union must complete and submit a CTR each time it takes a deposit, gives a withdrawal, or exchanges currency if the transaction involves currency of more than $10,000 per Section 1010.311.

In addition, multiple same-day trans-actions which are completed at any branch of a credit union must be treated as a single transaction if the credit union has knowledge that those transactions are by or on behalf of the same individ-ual. If those multiple transactions result in total cash into or out of the credit union in excess of $10,000, a CTR must be filed. In addition, deposits made at night or over a weekend or holiday must be treated as if they were made on the next business day following the deposit. (Section 1010.313(b).)

It is worth considering a couple of points with respect to the general rule. First, no CTR is ever required unless the transaction or transactions amount to

Figure 3.1

CTR or No CTR?

Q. A member deposits a check made out to cash for $15,000 and deposits it into her credit union account. Must a CTR be filed?

A. No. A check — even one made payable to cash — is not currency.

Q. A member deposits $10,000 worth of $100 bills into his credit union account. Must a CTR be filed?

A. No. Although the transaction is in currency, it does not exceed $10,000.

Q. A member withdraws $9,000 in currency in the morning from her credit union account. Later that day her teller discovers the same member withdrew $3,000 in currency that same day at another branch of the same credit union. Must a CTR be filed?

A. Yes. Same-day withdrawals are aggregated.

Q. A member deposits $9,000 in currency in the morning to his credit union account. Later that day his teller discovers the same member withdrew $3,000 in currency that same day at another branch of the same credit union. Must a CTR be filed?

A. No. Same-day deposits and withdrawals are not aggregated with each other (although same-day multiple withdraw-als are aggregated and same-day multiple deposits are aggregated among themselves).



more than $10,000 in currency com-ing into or going out of the credit union. Thus, a cash deposit of $10,000 on the nose would not trigger CTR filing. Figure 3.1 lists a few examples of transactions and describes whether or not a CTR would be required.

Next, the transaction must be in cur-rency to be reportable. “Currency” is defined in the BSA regulations to include the coin and paper money of the U.S., as well as the coin and paper money of any other country that is designated as legal tender. (Section 1010.100(m).) Currency includes U.S. silver certificates, U.S. notes and Federal Reserve notes, and official foreign notes that are cus-tomarily used and accepted as a medium of exchange in a foreign country.

Reportable CTR transactions must be filed by the credit union within 15 days following the date of the transaction. CTRs must be filed electronically. You can access the BSA E-Filing website at http://bsaefiling.fincen.treas.gov/main .html.

Under the BSA regulations, credit unions have an affirmative duty to verify and record the name and address of a member presenting a transaction that will be reportable on a CTR, along with the identity, account number, and Social Security or taxpayer identification number of the person on whose behalf a reportable transaction is to be made. (Section 1010.312.) If the individual claims to be an alien or not a resident of the U.S., the credit union must verify his or her identification by reviewing a pass-port, alien identification card, or other official document evidencing nationality or residence.

Exemptions

Recognizing that not all transactions involving more than $10,000 in cur-rency are likely to have value in assisting law enforcement officials investigating potential criminal activity, the BSA regu-lations allow credit unions to exempt certain transactions from the general CTR reporting requirements. A credit union is not required to file a CTR with respect to a transaction completed by an exempt person, provided the transaction falls within the exempt person’s stated limits. There are two categories (Phase I and Phase II) of potential “exempt persons” listed in the BSA regulations. (Section 1020.315(b).) Under the Phase I designation, transactions in excess of $10,000 in currency made by certain entities are eligible for exemp-tion. FinCEN identifies two categories of Phase I exempt persons:

• Any entity (other than a credit union or bank) whose common stock is listed on the New York, American or NASDAQ stock exchanges (with some excep-tions) e.g., public or listed entities.

• Any subsidiary (other than a credit union or bank) of any “listed entity” that is organized under U.S. law and at least 51 percent of its stock is owned by the listed entity.

FinCEN issued a final rule in December 2008 that simplified the Phase I CTR exemption process. Before the final rule, credit unions were required to complete either currency transaction reports or file a Phase I exemption for triggering transactions between itself and another depository institution, U.S. or State governments or entities acting with governmental

http://bsaefiling.fincen.treas.gov/main.html


https://www.fincen.gov/sites/default/files/shared/frnCTRExemptions.pdf

https://www.fincen.gov/sites/default/files/shared/frnCTRExemptions.pdf



authority. This required credit unions to file CTRs or file an exemption form for operating cash transfers between the credit union and another institution act-ing in a “credit union’s credit union” capacity. This is no longer the case. Most important, transactions between a credit union and any of these parties would receive an automatic exemption from CTR filing — similar to that granted to transactions between a credit union and one of the twelve Federal Reserve Banks.

FinCEN identifies two categories of Phase II exempt persons:

• A business—other than a publicly list-ed corporation or subsidiary as listed above—that has maintained a trans-action account with the credit union for at least 2 months; “frequently” (at least five per year) engages in transac-tions in currency with the credit union in excess of $10,000; and is organized or incorporated under the law of the U.S. or a state. (Section 1020.315(b)referred to in the regulation as “non-listed businesses”).

• A person or business that has main-tained a transaction account with the credit union for at least 2 months; operates a firm that regularly with-draws more than $10,000 (in curren-cy) in order to pay its employees; and is incorporated or organized under the laws of the U.S. or a state. (Section 1020.315(b) referred to in the regula-tion as “payroll customers”).

Alternatively, the rule gives a credit union the ability to forego the 2 month waiting period (normally required before a Phase II exemption is granted) and enables the credit union to make a risk-

based determination of whether or not the exemption is appropriate.

Credit unions are expected to per-form an annual review of its exemptions (Phase I and II) to determine whether or not the exemption is still appropri-ate. There is no longer a requirement to biannually renew or report any change of control for Phase II exemptions. Credit unions used to be required to renew Phase II exemptions every two years and report any changes in the control of its Phase II exemption members.

To apply for CTR exemption, credit unions must complete the “Designation of Exempt Person Form” (FinCEN form 110) within 30 days of the triggering transaction. Until the exemption has been filed, the credit union would be required to complete CTR forms for each applicable transaction.

A number of businesses are ineli-gible under BSA regulations to receive “exempt person” status. A business is ineligible if it is engaged in one or more of the following activities (Section 1020.315):

• Service as financial institutions or agents of financial institutions of any type (examples of financial institutions that are not banks include securities brokers, check cashers, sellers or trav-eler’s checks, or telegraph companies that wire funds).

• Purchase or sale to customers of motor vehicles of any kind, vessels, aircraft, farm equipment, or mobile homes.

• The practice of law, accountancy, or medicine.

• The auctioning of goods.



• The chartering or operation of ships, buses, or aircraft.

• Gaming of any kind except licensed parimutuel betting at race tracks.

• Investment advisory services or invest-ment banking services.

• Real estate brokerage.

• Pawn brokerage.

• Title insurance and real estate closing.

• Trade union activities.

• Any other activities that may be specified by the Financial Crimes Enforcement Network (FinCEN) — the division of the U.S. Treasury charged with BSA enforcement.

The method by which a credit union designates a member as an “exempt per-son” was substantially revised in 1998. Under the regulations prior to 1998, credit unions were permitted to grant exemptions to various types of members by having the member sign—under pen-alty of perjury— a request for exemption that listed the reasons the exemption was sought and that was retained on file by the credit union. Credit unions were also required to maintain a cen-tralized “Exempt Transactions Log” which included all those members who were exempted from CTR require-ments. Credit unions had until July 1, 2000, to designate those members as “exempt persons” under the new rules (for example, by completing a CTR as described above). If those members who were exempt under the old rules were not redesignated as “exempt persons” under the new rules by the appointed

time, credit unions were required to file CTRs with regard to transactions in cur-rency exceeding $10,000 completed by those members.

It is important to note that even though a credit union might designate a member as an “exempt person” under these rules, it still has an obligation to file Suspicious Activity Reports (as discussed below) when circumstances dictate. FinCEN can revoke the status of a member as an “exempt person” upon written notice.

Geographic targeting

From time to time, FinCEN may determine reasonable grounds exist for requiring additional recordkeeping and/or reporting requirements under the BSA regulations within a certain geographical area. (Section 1010.370 (a).) In these cases, the Secretary of the Treasury is empowered to issue an order requiring any domestic financial institution or a group of financial institutions in a geo-graphic area to file CTRs for specially described dollar thresholds. For exam-ple, the Secretary could issue an order for all financial institutions in a given area to file CTRs for cash transactions which exceed, say, $6,000 in currency, as opposed to the usual $10,000.

Section 1010.370 describes a spe-cial order of this nature will be directed to the chief executive officer of an affected credit union, and it will clearly describe the types of transactions that must be reported, including the follow-ing:

• Dollar amount of transactions subject to special reporting.

• Type of transactions subject to or



exempt from special reporting.

• Appropriate form to use if filing special reports.

• Address to which special reports must be filed or which they will be picked up.

• Starting and ending dates by which such transactions are to be reported.

• Name of a Treasury official to be con-tacted for any additional information or questions.

• Amount of time reports and records of reports generated in response to the order will have to be retained by the financial institution.

These special orders may not last more than 60 days unless they are renewed in exactly the same fashion as described above. (Section 1010.370.) Unless directed otherwise, a credit union that receives an order of this nature may continue to use the exemp-tions it has already granted members as discussed above.

Suspicious Activity Reports

A Suspicious Activity Report (SAR) (Section 1020.320) must be filed with regard to any transaction that involves or aggregates more than $5000 when the credit union knows, suspects, or has rea-son to suspect that the transaction...”

• Involves funds derived from illegal activities, is intended or conducted in order to hide or disguise funds or assets derived from illegal activities as part of a plan to violate or evade any Federal law or regulation, or to avoid any CTR requirement.

• Transaction is designed to evade any requirements of any regulations set forth under the Bank Secrecy Act.

• Offers no business or apparent law-ful purpose or is not the sort in which the particular member would normally be expected to engage, and the credit union knows of no reasonable explana-tion for the transaction after examining the available facts including the back-ground and possible purpose of the transaction.

These provisions make it illegal to “structure” a transaction — that is, to break up a single transaction above the reporting threshold into two or more separate transactions — if the purpose in structuring the transaction is to evade the reporting requirement. It is a crimi-nal violation to “willfully violate” the antistructuring provisions of the BSA. In 1993 the United States Supreme Court held that in order to convict a defendant accused of structuring transactions, the prosecution must prove the defendant acted with knowledge that the structur-ing he or she undertook was unlawful, not simply that the defendant’s purpose was to circumvent the financial insti-tution’s reporting requirement. (See Ratzlaf v. United States, 510 U.S. 135, 114 S. Ct. 655.)

A SAR must generally be filed within 30 days of the time in which the credit union is aware of the facts that might constitute a basis for filing the form. If no suspect was identified at the time the credit union first discovered facts which might lead to the filing of an SAR, the filing can be delayed up to an additional 30 days. (Section 1020.320.)

In addition to the rules in Chapter X



regarding SAR filing, the NCUA requires that credit unions file an SAR in the fol-lowing situations (NCUA Final Rule No. 06-RA-07, 12 CFR Part 748):

• Whenever any known or suspected criminal violation has been committed against a credit union regardless of the amount of money involved if the credit union believes the violation was com-mitted by an “insider” — for example, a director, officer, employee, agent, or other institution-affiliated party.

• Whenever any known or suspected criminal violation has been commit-ted against a credit union involving $5,000 or more, if the credit union can identify a possible suspect who is not an insider.

• Whenever there are transactions aggre-gating $5,000 or more that involve potential money laundering or viola-tions of the Bank Secrecy Act.

• Whenever any known or suspected criminal violation has been commit-ted against a credit union involving $25,000 or more regardless whether any suspects have been identified.

The SAR must be filed electronically with FinCEN through the BSA E-Filing system. Supporting documentation is not to be filed with the SAR. Instead the credit union must maintain records of all SAR supporting documentation for five years from the filing date. (Section 1020.320.)

FinCEN issued guidance (FIN-2007- G003), which clarified how credit unions should handle requests for supporting documentation related to a previously filed suspicious activity report (SAR). According to FinCEN, financial institu-

tions must provide all documentation supporting the filing of a SAR upon request by FinCEN, appropriate law enforcement, or a supervisory agency. The guidance makes clear that no legal process is required for such a request. In other words, the Right to Financial Privacy Act requirements (subpoena, summons, search warrant, etc.) aren’t applicable if: (i) such a request is made by FinCEN or a supervisory agency dur-ing the exercise of its “supervisory, regulatory, or monetary functions” or (ii) FinCEN, an appropriate agency, or law enforcement requests a copy of the SAR or supporting documentation underlying a SAR filing.

So, what is “supporting documenta-tion”? This refers to all documents or records that assisted a financial insti-tution in determining that the activity in question warranted a SAR filing. Examples include account transac-tion records, new account information, e-mail communication, and written cor-respondence. Supporting documentation varies in each situation. Note, however, that if the information requested goes beyond the scope of what was detailed in the SAR or the SAR’s supporting documentation, the Right to Financial Privacy Act protections apply.

A credit union need not file an SAR for a robbery or burglary committed or attempted as long as that robbery or burglary is reported to appropriate law enforcement authorities. When complet-ing the SAR, credit unions should be sure to indicate whether the underly-ing cause of the criminal activity is the result of identity theft, pretext calling, or computer intrusion.



https://www.fincen.gov/sites/default/files/shared/Supporting_Documentation_Guidance.pdf

https://www.fincen.gov/sites/default/files/shared/Supporting_Documentation_Guidance.pdf



SAR confidentiality

FinCEN recently updated the BSA regulations to further clarify its expecta-tion with regard to SAR confidentiality. Under the previous regulation, a credit union and its officers, directors, employ-ees, etc. were prohibited from notify-ing any person involved in a suspicious transaction that was the subject of a SAR report. To further clarify the scope of confidentiality surrounding SAR reports, FinCEN issued a final rule and accompanying guidance clarifying SAR confidentiality. According to the final rule, credit unions are not to disclose the SAR or any information revealing the existence of a SAR to parties other than those authorized to receive this informa-tion such as appropriate law enforce-ment, regulators, etc. FinCEN notes that it was important to clarify the scope of the confidentiality provision due to the potentially serious consequences of an unauthorized disclosure. Guidance on SAR confidentiality may be found at https://www.gpo.gov/fdsys/pkg/FR-2010-12-03/pdf/2010-29869.pdf.

A credit union that files a SAR may not notify any person involved in the reported transaction. And, should an individual inquire of the credit union about whether a SAR has been filed, the credit union is required to report this inquiry to FinCEN. (Section 1020.320.)

In December 2006, NCUA issued a final rule (12 CFR Part 748) that now requires credit union management to “promptly” notify its board of directors (or designated committee) of any SAR filings. Notification must be at least monthly (usually at the monthly board meeting), unless the activity is serious enough to warrant immediate notifica-

tion. In instances where the target of a SAR filing is a board member or desig-nee, the credit union must not notify the SAR target. However, the credit union is expected to notify the remaining direc-tors or designees who are not suspects. Finally, the final rule does not specify a particular format and credit unions have ample flexibility in tailoring a for-mat that suits their particular needs. The Federal Financial Institutions Examination Council’s (FFIEC) Bank Secrecy Act/Anti-Money Laundering (BSA/AML) Examination Manual gives a number of reporting options such as pro-viding the actual SAR documents (which CUNA does not recommend), providing a report that summarizes the SAR filings, providing tables of SARs filed for spe-cific violation types, etc.

Report of International Transportation of Currency or Monetary Instruments

BSA regulations also require that a Report of International Transportation of Currency or Monetary Instruments (FinCEN form 105) be filed whenever a person sends or receives more than $10,000 in currency or monetary instruments (checks, money orders, traveler’s checks, etc.) into or out of the U.S. A credit union must file a FinCEN form 105:

• When the credit union physically trans-ports, mails, or ships currency and/or monetary instruments in excess of $10,000 at one time into, or out of, the U.S. per Section 1010.340; or

• When the credit union receives cur-rency and/or monetary instruments

http://www.ncua.gov/Legal/Documents/Regulatory%20Alerts/RA2006-07.pdf

http://www.ffiec.gov/bsa_aml_infobase/pages_manual/manual_online.htm

https://www.fincen.gov/resources/filing-information



in excess of $10,000 at one time, which has been transported, mailed, or shipped to it by a member from some-where outside the U.S. per Section 1010.340.

It is important to note that a credit union does not “receive” the currency or monetary instruments from outside the U.S. if a member deposits the cur-rency or instruments into a credit union account even if the credit union knows that the currency or instruments were received or transported from a place outside the U.S. In such a case, the member would have the duty to file the report, assuming the member was the person who transported, shipped, or received the currency and monetary instruments. The credit union has no duty to inform the member of its duty to file the report, but FinCEN asks that the credit union do so.

FinCEN Form 114

Although beyond the scope of this book, there is one more reporting requirement under the BSA. Those cred-it unions that have financial account relationships outside the U.S. that exceed $10,000 are required to file a FinCEN Form 114 on an annual basis. Credit unions that have such foreign accounts should call FinCEN at 212-901-5265 for more information about this form.

Filing forms electronically

The Financial Crimes Enforcement Network (FinCEN) provides credit unions access to the BSA E-Filing system (go to bsaefiling.fincen.treas.gov/main.html.) The system supports secure electronic filing of Bank Secrecy Act (BSA) forms (either singly or in batches) such as Currency Transaction Reports (CTRs), Suspicious Activity Reports (SARs) and Designation of Exempt Person forms (DEP). In addition, institutions can use this system to send secure messages to FinCEN and receive responses, when appropriate. Finally, FinCEN can use the BSA E-Filing system to issue advisories and BSA E-Filing system updates to the user community.

Recordkeeping Requirements

Part of the initial purpose behind the various BSA statutes and regulations was the fact that, until the original Bank Secrecy Act was passed in 1970, law enforcement officials were frequently frustrated in their attempts to convict perpetrators of financial crimes due to the lax recordkeeping practices of many banks. As such, a great deal of the BSA compliance burden lies in its recordkeeping requirements. A number of specific records that must be retained by financial institutions are listed in the regulations, all of which must be retained for five years. The good news from the standpoint of compliance bur-dens, is that these types of records are now commonplace for financial institu-tions. Each of the specific recordkeeping

https://www.efilefbar.com/?gclid=CIHvttrNutICFYS1wAod3MsO

bsaefiling.fincen.treas.gov/main.html



requirements will be discussed in the following paragraphs. Credit unions are required to retain either the original, or a microfilm, or other copy of each of them for at least the five-year period.

Filed reports

Records of any report filed pursu-ant to the BSA regulations—Currency Transaction Reports, Suspicious Transaction Reports, or Reports of International Transportation of Currency or Monetary Instruments—must be retained on file for at least five years.

Certain credit extensions

Records of each extension of credit in an amount that exceeds $10,000 must be maintained, unless the credit is secured by real property. These records must include the name and address of the borrower, the amount of the loan, the nature or purpose of the loan, and the date of the loan per Section 1010.410.

Certain transfers of currency or monetary instruments

Credit unions must maintain either the original or some reproduced form of each advice, request, or instruction received or given regarding any transac-tion resulting in the transfer of currency or other monetary instruments, funds, checks, investment securities, or credit of more than $10,000 to or from any person, account, or place outside the United States. Credit unions are also required to maintain records of similar cancelled requests, advice, instructions, etc., per Section 1010.410.

Records regarding a geographic targeting order

As was discussed earlier, there may be instances when the Secretary of Treasury will require a financial institu-tion or a group of financial institutions within a geographic area to maintain special records with respect to cur-rency transactions. The BSA regulations require that any such records—including any CTRs filed under such an order—must be retained for as long as is speci-fied in the corder. This record retention period may not exceed five year per Section 1010.410.

Sales of certain monetary instruments in amounts between $3,000 and $10,000

If a credit union sells a draft, cashier’s check, teller’s check, money order, or other monetary instrument to a person and the purchase is made in cur-rency, it must maintain certain records with regard to such sales. The specific requirements depend on whether a credit union sells such instruments to a member or a nonmember. (Section 1010.415.) If a credit union sells one of these instruments to a member in an amount of $3,000 to $10,000, it must maintain a record of:

• The member’s name.

• The date of purchase.

• The type of instrument purchased.

• The serial number of the instrument purchased.

• The dollar amount of the transaction.



When a nonmember makes such a purchase, the credit union is required to retain a record of the above informa-tion and the purchaser’s address, Social Security Number (or alien identifica-tion number), and date of birth. Credit unions are free to implement policies by which they require a member who wishes to purchase one of these mon-etary instruments in cash to first deposit the cash into his account (completing the actual purchase of the instrument via a debit to that account). This is per-missible as long as the credit union’s policy in this regard is written, includes formal procedures for implementation, and applies to all deposit account hold-ers without exception. However, the implementation of such a policy does not eliminate the record keeping require-ments for such purchases. According to the Financial Crime Enforcement Network’s (FinCEN) November 2002 guidance on this issue, credit unions are still subject to the record keeping require ments under Section 1010.415. As a practical matter, however, credit unions will typically not have any dif-ficulty retaining a record of the name, date of purchase, type of instrument purchased, and the dollar amount of the transaction.

Note: When this recordkeeping requirement was first mandated by Congress in 1988, it included a require-ment that credit unions and other finan-cial institutions retain a centralized log which contained records of these sales of monetary instruments for cash in amounts of $3,000 to $10,000. In 1994, this centralized log requirement was eliminated.

Certain wire transfers

In mid-1996, new rules took effect under BSA regulations that mandate the retention of certain wire transfer records. The records recorded under these new rules are to be retained for five years as is the case with all other BSA record-keeping requirements.

Records of wire transfers for less than $3,000 are exempt from these recordkeeping requirements as are records of wired transfers governed by the Electronic Fund Transfer Act and Regulation E and those made through an automated clearinghouse, automated teller machine, or point of sale system.

Under these rules, recordkeep-ing requirements differ depending on whether the credit union is the “originat-ing bank” or the “beneficiary bank” in a wire transfer.

When a credit union acts as an origi-nating bank, it executes a wire transfer on behalf of its member. In this case, the credit union must retain a record of:

• The originator’s name and address.

• The amount, date, and payment instructions received.

• The beneficiary bank identification.

• The beneficiary’s name and address or the beneficiary’s account number if received with the payment order.

When a credit union serves as the beneficiary bank in a wire transfer, it is required to keep a copy of each payment order received.

Under these wire transfer recordkeep-ing requirements, if the beneficiary is not an “established customer” of the credit union, the credit union must verify



his or her name and address and retain a record of the means used to identify the person (for example, driver’s license, passport, etc.), and a record of the ben-eficiary’s Social Security number, alien identification number, or employer iden-tification number. An “established cus-tomer” is a person with an account with the credit union or a person from whom the credit union has obtained and main-tains on file the person’s name, address, and taxpayer identification per Section 1020.410.

There are additional identity verifica-tion rules with respect to individuals who are not “established customers,” but because credit unions have histori-cally limited wire transfers to members or joint owners, many credit unions may not be familiar with these additional procedures. However, credit unions that intend to offer limited services to certain nonmembers (in light of authority to offer such services under the 2006 Regulatory Relief Act) should familiarize themselves with these additional procedures.

When these rules regarding records of wire transfers were first introduced, there was widespread concern that cred-it unions would have to invest in sophis-ticated software through which they could instantaneously retrieve records of wire transfers which fall within the scope of these rules. However, Section 1020.410 makes clear that the required records must be retrievable by reference to the name and or account number of the member who originated the transfer or who was the beneficiary of the trans-fer within a reasonable period of time.

Other Bank Secrecy Act requirements

Credit unions are required to retain either the original records or copies of all of the following records with respect to any account:

• The signature card.

• Each statement or other record for each deposit or share account, show-ing each transaction made on the account.

• Each check, draft, or money order for more than $100 drawn on the credit union or issued and payable by it.

• Each debit of each member’s account in excess of $100.

• Each check, draft, or transfer of credit of more than $10,000 remitted or transferred to a person, account, or place outside of the U.S.

• Each check, draft, or transfer of credit for more than $10,000 received directly from a bank, broker or dealer in foreign currency exchange outside the U.S.

• Each receipt of currency, other mon-etary instruments, investment securi-ties or checks, and each transfer of funds or credit of more than $10,000 received on any one occasion from a bank, broker, or dealer in foreign cur-rency exchange outside the U.S.

• Records in the ordinary course of busi-ness which would be needed for the credit union to reconstruct a transac-tion (checking) account and to trace a check in excess of $100 deposited in such account through its domestic pro-



cessing system or to supply a descrip-tion of a deposited check in excess of $100.

• A record containing the name, address, and TIN, if available, of the purchaser of each term share certificate along with a description of the certificate, a notation of the method of payment, and the date of the transaction.

• A record containing the name, address, and TIN, if available, of any person presenting a term share certifi-cate for payment along with a descrip-tion of the certificate and the date of the transaction.

• Each deposit slip or credit ticket reflecting a transaction, wire transfer deposit, or other direct deposit which exceeds $100.

For extensions of credit (not secured by real property) in excess of $10,000, a credit union must also retain record of:

• Name of the borrower

• Address of borrower

• Amount of credit extended

• Nature or purpose of the loan

• Date of the loan

While these record-retention require-ments amount to a rather lengthy list, it is difficult to imagine a credit union not retaining all of these records, regardless of the regulatory requirement to do so. As with all other recordkeeping require-ments under Bank Secrecy Act regula-tions, these records must be maintained for at least five years.

Information Sharing

The USA PATRIOT Act of 2001 encourages information sharing among financial institutions for purposes of identifying and reporting activities that may involve terrorist acts or money-laundering activities. Credit unions and associations of financial institutions may share information with other financial institutions after they provide notice to FinCEN and agree to maintain adequate procedures to protect the security and confidentiality of the information that is shared.

In order to share information (as allowed by the USA PATRIOT Act and FinCEN) with other financial institu-tions, credit unions must provide an annual notice to Treasury. A new notice must be completed each year.

The notification requires credit unions to provide:

• Federal ID number;

• Primary Federal Regulator;

• Mailing address;

• Contact person’s name;

• Contact person’s title;

• Contact person’s e-mail, telephone, and facsimile number.

Once the notification is submitted to FinCEN, credit unions may share infor-mation (regarding money laundering and terrorist financing only) with other financial institutions and not be liable to anyone for this type of information shar-ing. The notification may be revoked or suspended by NCUA.

If there are any suspicious transac-tions relating to money laundering or



terrorist activity, credit unions may vol-untarily report that information to law enforcement by completing the SAR and calling FinCEN’s Financial Institution’s Hotline for terrorist activity at 866-556-3974.

The information sharing regulations also require credit unions to expeditious-ly search their records when they receive a request from FinCEN. FinCEN will act on behalf of federal law enforcement agencies investigating money laundering or terrorist activity. FinCEN may require any credit union to search its records to determine whether the credit union maintains an account for or has main-tained an account during the preced-ing 12 months for anyone listed in the request. The credit union also needs to determine if it has engaged in transac-tions conducted by, and funds transfers involving, a named suspect during the preceding six months that is required under law or regulation to be recorded by the credit union or is recorded and main-tained electronically by the institution.

Each credit union is required to sign up in order to receive the FinCEN information requests. Signing up for a FinCEN request is done with NCUA as part of the Form 5300 call report. Section 314(a) contact information was added to the March 31, 2003, call report, so every credit union will have registered a contact person. If a credit union needs to change or update its contact information, it should do so on the next call report. If changes occur between cycles, the changes or updates need to be given to the appropriate regional office or NCUA examiner. Credit unions can have more than one contact person and should add the information

of a second contact person by sending an e-mail or fax to NCUA or FinCEN, if privately insured.

The Financial Crimes Enforcement Network (FinCEN) implemented its Web-based USA Patriot Act Section 314(a) secure communication system in March 2005. The system provides FinCEN with the ability to issue secure delivery of Section 314(a) subject infor-mation to financial institutions via the web. Credit unions who receive Section 314(a) requests electronically should have already completed the registration process.

When a credit union receives a request, it must expeditiously search its records to determine whether it main-tains or has maintained any account for, or has engaged in any transaction with any individual, entity, or organi-zation named in the FinCEN request during the time period specified. If the credit union has any questions relating to the scope or terms of the request, it should contact the Federal law enforce-ment agency directly. However, if the credit union identifies a matching account or transaction, it must report to FinCEN—not the Federal law enforce-ment agency—the name or account number of each individual as well as a Social Security number, date of birth, or other similar identifying informa-tion that was provided by the member or organization when the account was opened or transaction conducted.

https://www.ncua.gov/regulation-supervision/Pages/regulatory-reporting/cu-online.aspx



USA PATRIOT Act’s Customer Identification Program Requirements

The USA PATRIOT Act of 2001 requires the U.S. Treasury Department to issue regulations setting forth mini-mum standards for financial institutions to identify and verify any person who opens an account.

CIP Requirements

Section 326 of the USA PATRIOT Act requires financial institutions to:

• Implement reasonable procedures to verify the identity of any person seek-ing to open an account, to the extent reasonable and practicable.

• Maintain records of the information used to verify the person’s identity.

• Determine whether the person appears on any lists of known or suspected terrorists or terrorist organizations pro-vided to the financial institution by any government agency.

• Provide the customer opening a new account with notice of the information collection requirement.

The Treasury Department, National Credit Union Administration, and other federal agencies issued final regula-tions implementing Section 326 of the USA PATRIOT Act in 2003. The aim of the final rule is to protect the U.S. financial system from money laundering and terrorist financing. According to the regulators, this rule will have the added benefit of helping to protect consumers

against various forms of fraud, including the growing incidence of identity theft involving new accounts.

The final regulation requires all finan-cial institutions, including credit unions, to implement a “Customer Identification Program” or “CIP” that requires them to have procedures in place to get identify-ing information from anyone opening an account and to verify that informa-tion. The CIP procedures must enable the credit union to form a reasonable belief that it knows the true identity of the accountholder. The CIP is supposed to be risk based. This means that the final regulations do not impose specific requirements but only minimum stan-dards, and a credit union must tailor its CIP based on its size, location, and membership base.

A credit union must apply its CIP to each person establishing a new account relationship. This includes not only members but joint accountholders, co-borrowers, and businesses.

Required information

The final regulation requires credit unions to get at least four pieces of information from each new member/cus-tomer. At a minimum, the credit union must obtain the person’s:

1. Name

2. Date of birth (for an individual)

3. Address

• Credit unions must get a residen-tial or business street address. P.O. Boxes are not acceptable. In those instances where a member has to be contacted by a government investi-gator of some sort, there is a physi-cal address on file.



• If the prospective individual mem-ber or customer is unable to pro-vide a residential or business street address, the credit union may accept an address of a friend or relative, or an Army Post Office (APO) or Fleet Post Office (FPO) box number.

• If the member is participating in an address confidentiality program, the credit union can take the street address of the ACP office that is assisting the member.

• The address for a business can be either the principal place of busi-ness, local office, or other physical location of the business.

• The credit union, of course, can get additional addresses, such as a mailing address, to meet its own or the member’s needs.

4. Identification number

• For a U.S. person this means a Social Security number (SSN) for an individual or an employer identifica-tion number (EIN) for a business. The definition of U.S. person is a U.S. citizen or a business, part-nership, or other legal entity that is established or organized under federal or state law. Note that this definition of U.S. person is different than the one used by the IRS which includes resident aliens.

• For any non-U.S. person which is simply any person or entity not qualifying as a U.S. person, the credit union has more flexibility. It can obtain:

1. a Social Security number from a resident alien;

2. an individual taxpayer identification number (ITIN);

3. a passport number and the country of issuance;

4. an alien identification card number; or

5. a number and country of issuance on any other foreign government-issued document evidencing nationality or residence and bearing a photograph or similar safeguard (perhaps a “similar safeguard” may be looking down the pike whereby technology readily exists to identify thumbprints or eye scans).

• If someone has applied for a tax-payer identification number but has not yet received it, the credit union can still open an account as long as it confirms that the TIN applica-tion was filed before the member/customer opens an account, and the credit union gets the TIN within a reasonable period of time after the account is opened.

Beneficial Owner Rule

Effective May 11, 2018, credit unions will be required to collect the required CIP information for individuals that are considered a beneficial owner of a legal entity that is opening a new account. A legal entity includes:

• corporations,

• imited liability companies,

• other entities that are created by filing a public document with a Secretary of State or similar office, and



• general partnerships or any similar business entities formed in the US or a foreign country.

The new rule does not apply to:

• sole proprietorships,

• unincorporated associations (youth sports leagues), or

• natural persons opening accounts on their own behalf.

There is a two prong test in determin-ing if someone is a beneficial owner of a legal entity. The first is “owner-ship”. Each individual, if any, that owns 25% or more of the equity interest of the entity is considered an “owner” in regard to the rule. This can be direct or indirect ownership. The second test is “control”. This is an individual with significant responsibility for managing the legal entity. For example, CEO, COO, President, etc. Based off the two prongs here, the number of individuals that meet this definition could be anywhere from 1 to 5. That means you will always have one person defined under the “con-trol” prong, and could have up to four under the “ownership” prong.

The rule requires that you collect the information on a form that properly documents that the individuals meet the above requirements. FinCEN created a form that credit unions can use for col-lecting this information. It can be found under Appendix A of the rule. Once the beneficial owners have been identified, you would follow your standard CIP pro-cess.

Identity verificationOnce the credit union gets all the

required information from the member/customer, it must verify identity enough to establish a reasonable belief that it knows the true identity of the person. Credit unions have the flexibility to determine when verification will be done and what methods it will use. Credit unions should assess their membership base and the methods used to open accounts to determine how they will verify identity.

There are two methods credit unions can use to verify identity: through docu-ments or nondocumentary methods. Documents are generally any unexpired government-issued identification evi-dencing nationality or residence and bearing a photograph or similar safe-guard such as a driver’s license or pass-port. Once the credit union verifies the member/customer through a document, it does not have to take steps to deter-mine whether the document is valid (unless it’s obviously fraudulent).

If a credit union chooses this method, its CIP must specify the documents it will use. This will require the credit union to conduct a risk-based analysis of the types of documents it believes will enable it to know the true identity of its members.

The credit union can also rely on nondocumentary methods of verifying the identity of its members/customers. Nondocumentary methods can be things like independently verifying the mem-ber’s identity by comparing information provided by the member/customer with information obtained from a consumer reporting agency, public database, or other source, checking references with

https://www.drinkerbiddle.com/-/media/files/insights/publications/2016/06/fincen-amlduediligenceappendix.pdf?la=en



other financial institutions, or obtaining a financial statement.

Nondocumentary methods are those actions that enable a credit union to form a reasonable belief that it knows the true identity of the member/custom-er by relying on something other than an unexpired government-issued iden-tification. These terms can be tricky because nondocumentary methods can include things that would typically be called documents like a financial statement. Just keep in mind that as a general rule for individuals, a documen-tary method of verification is relying on government-issued documents (such as a driver’s license or passport) while a nondocumentary method is relying on something that is not a government-issued document.

The nondocumentary method will probably be used to verify the identity of anyone applying for membership through the mail, Internet, or fax. If the credit union relies on nondocumentary methods, its CIP must have procedures that describe the nondocumentary meth-ods the credit union will use.

Member/customer due diligence

NCUA, along with the joint banking agencies, released the Bank Secrecy Act/Anti-Money Laundering (BSA/AML) Examination Manual. The manual is intended to provide comprehensive guid-ance to examiners and financial insti-tutions regarding BSA/AML regulatory requirements and best practices.

According to the manual, financial institutions (including credit unions) are expected to develop and maintain member/customer due diligence poli-

cies. These policies would require credit unions to collect additional member information (beyond CIP requirements) during account opening, which would give the credit union an indication of the types of transactions a member is likely to engage in. In addition, the Beneficial Owner Rule added a requirement that credit unions should also create a risk profile for all members. The manual emphasizes the importance of such poli-cies in aiding in the detection of unusual or suspicious activity and suggests that member/customer due diligence policies be applied to all members. This includes the ongoing monitoring of members, as well as maintaining updated member information.

Enhanced due diligence procedures should be applied to members and products/services that present a higher risk for money laundering and terrorist activity. The type and degree of informa-tion sought will vary based on the risks presented by a particular member and the products/services provided. Credit unions should consider collecting the following information when opening higher-risk accounts: purpose of account; source of funds and wealth; beneficial owners of the accounts (if applicable); member’s occupation or type of business; etc. For additional guidance, see “Core Overview —Customer Due Diligence,” in the BSA/AML Examination Manual.

Checking government lists

Credit unions must have procedures in place for determining whether a member/customer appears on any list of known or suspected terrorists or terrorist organizations. Currently, no

https://www.ffiec.gov/bsa_aml_infobase/pages_manual/manual_online.htm



http://www.ffiec.gov/bsa_aml_infobase/documents/BSA_AML_Man_2010.pdf

http://www.ffiec.gov/bsa_aml_infobase/documents/BSA_AML_Man_2010.pdf



additional guidance had been issued on this USA PATRIOT Act requirement. Note, these lists are separate and dis-tinct from the Office of Foreign Assets and Control (OFAC) list.

Record retention

Credit unions are required to make and maintain a record of all the informa-tion they receive from their member. This includes name, address, date of birth, and identification number. These records must be retained for five years after the date the account is closed.

A credit union’s records must also include a description or copy (depending on if permitted by state law) of any docu-ment the credit union relied on. This will be the information it records when veri-fying a member’s identity and it must be kept for five years after the record is made. The credit union must keep:

• A description of any document that was relied on to verify the member’s identity;

• Any identification number in the document;

• The place the document was issued; and

• The date of issuance and expiration, if any.

The credit union must also keep a description of the methods and the results of any measures that were taken to verify the member’s identity and a description of the resolution of any substantive discrepancy that was dis-covered when verifying the information received from its member. These records must also be kept for five years after the

record is made.

Notice requirements

A credit union must provide adequate notice to its members that it is request-ing information to verify identities. A notice is adequate if the credit union generally describes the identification requirements of the final rule and pro-vides notice in a manner designed to make sure that a member views the notice, or is otherwise given notice, before opening an account.

This means that depending on the way in which an account is opened, the credit union can provide notice by post-ing the notice in the lobby or on its Web site including the notice on its account application or using any other form of written or oral notice. The regulation provides sample language that the credit union can use in its notice.

Penalties for Noncompliance

Credit unions, as corporate entities, as well as individuals (classified as “institution-affiliated parties”) can be subject to a wide range of penalties for BSA violations. For example, if a CTR is incomplete or inaccurate, a credit union can be fined $500. If it appears that a pattern of negligent violations has devel-oped, the credit union can be fined up to $50,000. In addition, a credit union convicted of money-laundering crimes or willful evasion of currency-transaction reporting laws can be put into receiver-ship or conservatorship by NCUA (and state-chartered credit unions can lose



their share insurance coverage).“Institution-affiliated parties” (a

term which includes credit union direc-tors, officers, employees, agents, and even, in some situations, independent contractors like attorneys, appraisers, or accountants) can be suspended if they are charged with a violation of the BSA, and permanently removed if the Treasury Department finds that the indi-vidual intentionally violated BSA regu-lations or knew that another individual violated BSA regulations. In addition to suspension or removal, an individual could be subjected to a number of civil penalties. Depending on the type of vio-lation, a person could face a minimum fine of $1,000, up to a maximum fine of $100,000. Finally, individuals convict-ed of violating the BSA can face crimi-nal penalties of up to $250,000 and/or imprisonment for up to five years unless the amount of illegal activity involves more than $100,000 in a 12-month period. In that case, the individual can be subject to a fine of up to $500,000 and/or 10 years in prison.

As the reader can see by the range of penalties, violations of the BSA can be severe and thus credit unions are well-advised to make BSA compliance a top priority.

Products and Services Affected by the Bank Secrecy Act

As mentioned above, one of the requirements of the NCUA’s rules regarding BSA compliance is that the credit union’s compliance program pro-vide for training of appropriate person-nel. Appropriate personnel include the BSA Compliance Officer, all tellers, the BSA auditor (if the credit union meets its annual audit requirement by utilizing credit union personnel), and any front-line staff who handle member’s trans-actions (for example, member service representatives). The BSA Compliance Officer should document all training and retain training records for at least five years.

http://www.irs.gov/irm/part4/irm_04-026-007.html



The Bank Secrecy Act

Quiz/Study Guide

1. What triggers the filing requirements for the Currency Transaction Report (CTR) and what is the time frame for filing the report?

_____________________________________________________________________

_____________________________________________________________________

_____________________________________________________________________

2. The BSA allows credit unions to exempt certain transactions from the general CTR reporting requirements. These transactions generally have little value in assisting law enforcement investigations. List the categories of potential “exempt persons” listed in the Act.

_____________________________________________________________________

_____________________________________________________________________

_____________________________________________________________________

_____________________________________________________________________

_____________________________________________________________________

_____________________________________________________________________

3. From time to time, FinCEN may determine that circumstances warrant additional recordkeeping and reporting requirements under the BSA within a certain geographic area. This is called “geographic targeting.” What are some of the special reporting requirements that might be involved as part of this special order?

_____________________________________________________________________

_____________________________________________________________________

_____________________________________________________________________

_____________________________________________________________________



4. What does BSA require credit unions to do when a member purchases cashier’s checks, teller’s checks, money orders, or other monetary instruments in amounts of $3,000 to $10,000 if the purchase is made in currency?

_____________________________________________________________________

_____________________________________________________________________

_____________________________________________________________________

_____________________________________________________________________

5. The BSA specifically excluded certain businesses from qualifying for exempt person status if they engage in certain business activities. List five of these business activities.

_____________________________________________________________________

_____________________________________________________________________

_____________________________________________________________________

6. Under the USA PATRIOT Act, what form must be filed with FinCEN before a credit union can share information with another financial institution?

_____________________________________________________________________

_____________________________________________________________________

_____________________________________________________________________

7. NCUA requires all federally insured credit unions to have a written Bank Secrecy Act compliance plan that has been approved by the board of directors. This plan must include four separate items. List three of those requirements.

_____________________________________________________________________

_____________________________________________________________________

_____________________________________________________________________

8. What four pieces of personal information must be collected from a member opening their first account with the credit union?

_____________________________________________________________________

_____________________________________________________________________

_____________________________________________________________________



9. The credit union is only required to verify the new member’s identity to the extent that it forms a “reasonable belief that it knows the true identity of the person.”

p True p False

10. After the person’s identity has been verified, are there any other requirements of the CIP rules?

_____________________________________________________________________

_____________________________________________________________________

_____________________________________________________________________

11. Posting a notice of the identity verification requirements in the credit union lobby is all the regulation requires.

p True p False



The Bank Secrecy Act

Answer Key

1. A credit union must complete and submit a CTR each time it takes a deposit, gives a withdrawal, or exchanges currency if the transaction involves currency of more than $10,000. Also, if multiple same-day transactions result in total cash into or out of the credit union in excess of $10,000, a CTR must be filed. (Page 3-5)

The report must be filed within 15 days after the transaction takes place. (Page 3-6)

2. Potential exempt persons categories: 1) Any entity (other than a credit union or bank) whose common stock is listed on the New York, American or NASDAQ stock exchanges (with some exceptions) i.e., “public” or “listed entities”; 2) Any subsidiary (other than a credit union or bank) of any “listed entity” that is organized under U.S. law and at least 51 percent of its stock is owned by the listed entity; 3) A business—other than a publicly listed corporation or subsidiary as listed above—that has maintained a transaction account with the credit union for at least 2 months; “frequently” (at least five per year) engages in transactions in currency with the credit union in excess of $10,000; and is organized or incorporated under the law of the U.S. or a state. (Section 1020.315 referred to in the regulation as “non-listed businesses);” 4) A person or business that has maintained a transaction account with the credit union for at least 2 months; operates a firm that regularly withdraws more than $10,000 in order to pay its employees in currency; and is incorporated or organized under the laws of the U.S. or state. (Section 1020.315 referred to in the regulation as “payroll customers”). (Page 3-6 to 3-7)

3. The credit union will receive a special order clearly describing the transactions to be reported as well as: 1) dollar amount of transactions subject to the special reporting; 2) types of transactions subject to the special reporting; 3) use of special forms for filing the reports; 4) the address to send the reports to; 5) starting and ending dates for reporting the transactions; 6) name of a Treasury official to contact with questions; and 7) the length of time to retain the information and reports generated. (Pages 3-8 to 3-9)

4. The credit union must maintain a record of: 1) the member’s name; 2) the date of purchase; 3) the type of instrument purchased; 4) the serial number of the instrument; and 5) the dollar amount of the transaction. (Page 3-14)



5. Groups engaged in the following businesses are ineligible for exempt person status: 1) service as a nonbank financial institution or agents of nonbank financial institutions; 2) purchase or sale to customers of motor vehicles of any kind, vessels, aircraft, farm equipment, or mobile homes; 3) the practice of law, accountancy, or medicine; 4) auctioning of goods; 5) chartering or operation of ships, buses, or aircraft; 6) gaming of any kind except licensed parimutuel betting at race tracks; 7) investment advisory or investment banking services; 8) real estate brokerage; 9) pawn brokerage; 10) title insurance and real estate closing; 11) trade union activities; and 12) any other activities that may be specified by FinCEN. (Page 3-7 to 3-8)

6. An annual notification. (Page 3-16)

7. The Bank Secrecy Act plan must include: 1) a system of internal controls to ensure continuing compliance, 2) provide for independent testing for compliance by either credit union personnel or outside parties, 3) designate an individual to coordinate and monitor daily compliance, and 4) provide training for appropriate personnel. (Page 3-4)

8. The credit union must collect: 1) name, 2) date of birth (for an individual), 3) a residential or business street address, 4) identification number (SSN, EIN, ITIN, passport number, etc.) (Page 3-19)

9. True (Page 3-20)

10. Yes. The name must be checked against government lists. (Page 3-21)

11. False. The notice must be placed or given so that members opening accounts through the various methods the credit union offers see the notice prior to opening the account. (Page 3-22)