I just read about FinCEN's position on the subject of customers who are participants in Address Confidentiality Programs (ACP) and how firms can comply with CIP 'street address' rules for these customers.
To back up: right now, if you're meeting CIP requirements for a new customer, you are gathering a residential or business street address for that person; if the person gives you a P.O. Box, you kindly ask for a street address for the records, but promise to use the P.O. Box for mailing and other business purposes. That's great.
But what if your customer informs you that s/he is participating in an ACP in order to protect his/her confidentiality? These programs are State-run and help to protect victims of domestic violence, sexual assault or stalking. The customer gives you only a P.O. Box address, in keeping with ACP standards. What do you do? You have to comply with CIP rules and your firm's internal procedures, but you want to honor your customer's right to self-protection.
Well, your answer comes in FinCEN Ruling FIN-2009-R003. In this Ruling, FinCEN explains that CIP rules allow customers who do not have street addresses to provide a "residential or business street address of next of kin or of another contact individual." In this case, however, the customer does have a street address, but s/he is keeping it a secret on purpose. What FinCEN has done is made an exception to the CIP rule in this instance. They will treat the ACP participant as not having a street address. In our example above, you would record the P.O. Box of the customer and also collect the street address of the ACP sponsoring agency (such as the Secretary of State or other state agency administering the ACP). That street address will meet the CIP requirement. In essence, the entity administering the ACP will serve as the agent of the customer for CIP purposes.
Obviously, you are required to reasonably believe that you know the true identity of your new customer: if the person gives you an ACP address, risk-based thinking will compel you to check on that address, just in case. Not all states offer these programs--I found this table, which has updated information through Jan. 2009: States with ACP's .
**********
One more thing: I have seen examiners looking for OFAC checks on new associated persons. I haven't researched the rule calling for this, but it may be a good idea to incorporate this procedure in your hiring/registration practices. Run the check, put the results in the personnel file.
Showing posts with label Customer Identification Program. Show all posts
Showing posts with label Customer Identification Program. Show all posts
Thursday, January 14, 2010
Tuesday, March 4, 2008
No CIP for clearing firms...but not vice versa
I remember the moment in Miss Anita's 5th grade class when she taught us the definition of vice versa...she used the example, "Jimmy has a crush on Sharon and vice versa." The color I turned!...a lovely shade of bright red. Well here's an announcement that will tickle clearing firms pink.
Fresh off the press: FinCEN has released a no-action position relating to CIP requirements of clearing firms. In summary, if the clearing firm has a written agreement with its introducing firm, and that agreement exclusively allocates to the introducing firm the functions of opening and approving customer accounts and directly receiving and accepting orders from introduced customers, then ONLY the introducing firm must comply with the CIP requirements for BD's. FinCEN has stated in this release that it will not take action against clearing firms in this situation. Of course, the written agreement must be clear in its allocation of duties.
Small introducing firms oftentimes express frustration with CIP rules and state their belief that, since the clearing firm has to ultimately accept the account and since it is the clearing firm that maintains the customer's securities accounts, why does it have to meet CIP rules--why not the clearing firm instead? I think it's interesting that this FinCEN release does not include a vice versa clause...that is, it doesn't offer no-action to introducing firms if the clearing agreement allocates exclusive final account approval to the clearing firm, instead. This clearly codifies the practical understanding of CIP rules: it's the front line that matters. The process of opening accounts and taking orders for transactions is an important first step to AML awareness and compliance. While the clearing firm has credit risk and handles the funds, it's the Rep-Customer relationship that counts when detecting and deterring illegal activities. I'm not saying clearing firms don't have AML obligations in this instance--they do, any many of them, as reiterated in FinCEN's release--but CIP, the cornerstone of a broker-dealer's AML compliance practices, is squarely in the hands of the introducing firms.
I have to be thorough by noting one point: an introducing firm may, indeed, be relieved of some or all of its CIP duties, but only if this arrangement is reasonable, in writing and renewed annually, and the CIP duties are performed by a federally-regulated entity subject to AML regulations. So the clearing firm can, in the end, perform CIP for its introducing firms, but that arrangement must be subject to an iron-clad agreement and is not something that can be inferred based on loose allocation language in a clearing agreement. Most clearing firms do not include CIP agreements in their clearing agreements. Other note: if your firm wants to rely on an SEC-registered IA firm to do CIP for you, it can under a 2004 SEC no-action letter that has been extended to be effective through January 12, 2010. But again, reliance is subject to strict conditions. See: SEC's no-action relief January 2008 .
Here's the link to FinCEN's no-action release: FinCEN's CIP no-action position .
And for the record, Miss Anita was right.
Fresh off the press: FinCEN has released a no-action position relating to CIP requirements of clearing firms. In summary, if the clearing firm has a written agreement with its introducing firm, and that agreement exclusively allocates to the introducing firm the functions of opening and approving customer accounts and directly receiving and accepting orders from introduced customers, then ONLY the introducing firm must comply with the CIP requirements for BD's. FinCEN has stated in this release that it will not take action against clearing firms in this situation. Of course, the written agreement must be clear in its allocation of duties.
Small introducing firms oftentimes express frustration with CIP rules and state their belief that, since the clearing firm has to ultimately accept the account and since it is the clearing firm that maintains the customer's securities accounts, why does it have to meet CIP rules--why not the clearing firm instead? I think it's interesting that this FinCEN release does not include a vice versa clause...that is, it doesn't offer no-action to introducing firms if the clearing agreement allocates exclusive final account approval to the clearing firm, instead. This clearly codifies the practical understanding of CIP rules: it's the front line that matters. The process of opening accounts and taking orders for transactions is an important first step to AML awareness and compliance. While the clearing firm has credit risk and handles the funds, it's the Rep-Customer relationship that counts when detecting and deterring illegal activities. I'm not saying clearing firms don't have AML obligations in this instance--they do, any many of them, as reiterated in FinCEN's release--but CIP, the cornerstone of a broker-dealer's AML compliance practices, is squarely in the hands of the introducing firms.
I have to be thorough by noting one point: an introducing firm may, indeed, be relieved of some or all of its CIP duties, but only if this arrangement is reasonable, in writing and renewed annually, and the CIP duties are performed by a federally-regulated entity subject to AML regulations. So the clearing firm can, in the end, perform CIP for its introducing firms, but that arrangement must be subject to an iron-clad agreement and is not something that can be inferred based on loose allocation language in a clearing agreement. Most clearing firms do not include CIP agreements in their clearing agreements. Other note: if your firm wants to rely on an SEC-registered IA firm to do CIP for you, it can under a 2004 SEC no-action letter that has been extended to be effective through January 12, 2010. But again, reliance is subject to strict conditions. See: SEC's no-action relief January 2008 .
Here's the link to FinCEN's no-action release: FinCEN's CIP no-action position .
And for the record, Miss Anita was right.
Wednesday, January 9, 2008
Post Primary Thoughts on AML
Hello from NH, where today, at last, we are free of pollsters, campaigners and political junk mail! Quick note: Chris Matthews said we lied to pollsters. We did not. The difference in the numbers was the weather. But we'll let him figure that out...
http://www.finra.org/web/groups/educ_progs/documents/education_programs/p037702.pdf
This is a link to Mary Shapiro's recent webcast text on what to expect in an exam, re: AML compliance. I wanted to comment on two things: independent annual exams and CIP for friends and relatives.
The Independent Exam Quandary
Independent exams must happen every year for almost all firms. If your BD is nothing but a prop desk, it can be every two years. For firms that have anything to do with customers and securities transactions (and yes, you private placement firms out there now know that your are, indeed, conducting securities business), audits of AML programs must take place once/calendar year. FINRA, back in early 2006, clarified this and also what it meant to be independent; they also offered exceptions to the independence standard. That's the background.
What I'd like to comment on is that, if a firm uses an outside party to do the audit, and that same party provided template language for the firm's AML program--but does not otherwise implement or control the firm's AML compliance process in any way--that outside party in my opinion is independent for the purposes of meeting FINRA's expectations. My belief is that, if you look at their exceptions for in-house auditors who are not independent, and imagine a scenario whereby a firm relies on those exceptions (for instance, trains some staff person to do AML testing and has that person report the results to someone other than the AML compliance officer), in most cases, the testing will not be sophisticated enough or adequate to detect important deficiencies. In that scenario, the tester will apply his/her limited knowledge of applicable regulation to broadly review evidence of compliance. This will not result in effective testing and the firm, if failing to comply with the more esoteric or topical requirements, will continue to do so, given the lack of focused and informed reviews.
The other scenario, where an outside consultant who has provided template language--either originally or on an on-going, update basis--and who is engaged daily in the business of compliance; that is, who spends his or her time researching new rules, interpretations and guidance put out by securities or federal regulators, and who visits clients once a year to ensure, in a lengthy and thorough examination process, all aspects of AML compliance, is bound to be more effective than the in-house model. That was a long sentence--my apologies. Remember too that many of these firms who may rely on the in-house model are those who downloaded FINRA's AML template and just barely customized it. The outside consultant procedures+audit model has to be preferable to the FINRA template+in-house audit model, in my opinion. Better to have expertise than confusion.
If your firm runs into an examiner who expresses displeasure with your outside AML auditor because that same auditor provided update language to your written program, you may want to use my argument to defend your choice. Or rely on the the Rule itself, which requires that, in summary, the tester should neither be one who performs the AML functions being tested, nor any designated AML compliance person or a person who reports to either one. You will be meeting this restriction and should be confident about doing so.
CIP for Friends and Relatives
Oh, my second point. In the recent guidance, Ms. Shapiro reiterates what was included in last year's online workshop--that you have to ID your own mother-in-law. Well, here's the exact quote: "Be sure to note that just because a customer is a registered representative’s personal acquaintance, this does not satisfy CIP verification requirements. But, the risk-based approach is flexible enough to make identity verification for personal acquaintances as unobtrusive as possible. For example, if the customer is a relative or a close personal friend of the registered
representative, the firm may not require more than the minimum verification required by the rules, such as checking her driver’s license. However, the verification that is undertaken must still be documented."
You see, the requirement to verify the identities of customers is so bound up in legalese and paranoid FederalSpeak, that broker-dealers cannot be trusted to vouch for the identities of their own family members. Crazy, huh? I'm sure the folks at FINRA hate enforcing this and also find it ludicrous, but as they always say, it's not their Rules, it's the government's. With that sad excuse in mind, don't forget to check your brother's driver's license next time he opens an account--just to be sure he really is your brother.
http://www.finra.org/web/groups/educ_progs/documents/education_programs/p037702.pdf
This is a link to Mary Shapiro's recent webcast text on what to expect in an exam, re: AML compliance. I wanted to comment on two things: independent annual exams and CIP for friends and relatives.
The Independent Exam Quandary
Independent exams must happen every year for almost all firms. If your BD is nothing but a prop desk, it can be every two years. For firms that have anything to do with customers and securities transactions (and yes, you private placement firms out there now know that your are, indeed, conducting securities business), audits of AML programs must take place once/calendar year. FINRA, back in early 2006, clarified this and also what it meant to be independent; they also offered exceptions to the independence standard. That's the background.
What I'd like to comment on is that, if a firm uses an outside party to do the audit, and that same party provided template language for the firm's AML program--but does not otherwise implement or control the firm's AML compliance process in any way--that outside party in my opinion is independent for the purposes of meeting FINRA's expectations. My belief is that, if you look at their exceptions for in-house auditors who are not independent, and imagine a scenario whereby a firm relies on those exceptions (for instance, trains some staff person to do AML testing and has that person report the results to someone other than the AML compliance officer), in most cases, the testing will not be sophisticated enough or adequate to detect important deficiencies. In that scenario, the tester will apply his/her limited knowledge of applicable regulation to broadly review evidence of compliance. This will not result in effective testing and the firm, if failing to comply with the more esoteric or topical requirements, will continue to do so, given the lack of focused and informed reviews.
The other scenario, where an outside consultant who has provided template language--either originally or on an on-going, update basis--and who is engaged daily in the business of compliance; that is, who spends his or her time researching new rules, interpretations and guidance put out by securities or federal regulators, and who visits clients once a year to ensure, in a lengthy and thorough examination process, all aspects of AML compliance, is bound to be more effective than the in-house model. That was a long sentence--my apologies. Remember too that many of these firms who may rely on the in-house model are those who downloaded FINRA's AML template and just barely customized it. The outside consultant procedures+audit model has to be preferable to the FINRA template+in-house audit model, in my opinion. Better to have expertise than confusion.
If your firm runs into an examiner who expresses displeasure with your outside AML auditor because that same auditor provided update language to your written program, you may want to use my argument to defend your choice. Or rely on the the Rule itself, which requires that, in summary, the tester should neither be one who performs the AML functions being tested, nor any designated AML compliance person or a person who reports to either one. You will be meeting this restriction and should be confident about doing so.
CIP for Friends and Relatives
Oh, my second point. In the recent guidance, Ms. Shapiro reiterates what was included in last year's online workshop--that you have to ID your own mother-in-law. Well, here's the exact quote: "Be sure to note that just because a customer is a registered representative’s personal acquaintance, this does not satisfy CIP verification requirements. But, the risk-based approach is flexible enough to make identity verification for personal acquaintances as unobtrusive as possible. For example, if the customer is a relative or a close personal friend of the registered
representative, the firm may not require more than the minimum verification required by the rules, such as checking her driver’s license. However, the verification that is undertaken must still be documented."
You see, the requirement to verify the identities of customers is so bound up in legalese and paranoid FederalSpeak, that broker-dealers cannot be trusted to vouch for the identities of their own family members. Crazy, huh? I'm sure the folks at FINRA hate enforcing this and also find it ludicrous, but as they always say, it's not their Rules, it's the government's. With that sad excuse in mind, don't forget to check your brother's driver's license next time he opens an account--just to be sure he really is your brother.
Subscribe to:
Posts (Atom)
