Your credit union may occasionally receive a request from law enforcement or an appropriate (state or federal) agency to search your records or to produce information and documents related to a member account. Knowing how to handle these requests in a timely manner is as important as ensuring procedures are in place to properly maintain documentation.

You can find details about what examiners might be looking for in the FFIEC BSA manual chapter on Information Sharing.

314(a) Requests

Section 314(a) of the USA PATRIOT Act authorizes law enforcement to communicate with financial institutions about specific individuals. Requests come to credit unions via email every two weeks asking that you search your records and report back to FinCEN if a named subject maintained an account with you in the previous 12 months or conducted transactions within the last six months. A reply is sent to FinCEN only when and if your credit union has a positive match, and they are very rare. 

The requests are specific to the names and entities FinCEN includes, and names on the list should never be used for any other purpose. Documentation should be kept to show the search was done in a timely manner. Knowing who receives the 314(a) search request at your credit union is a good question to ask. It is also a good process to include a second person as a backup to prevent gaps in searching and responding timely, when appropriate. 

314(b) Voluntary Information Sharing 

Section 314(b) is a process that allows two or more entities, including financial institutions, to register with FinCEN and "provides financial institutions with the ability to share information with one another, under a safe harbor that offers protections from liability, in order to better identify and report activities that may involve money laundering or terrorist activities." The sharing is voluntary and includes a safe harbor from liability for information shared under the program. It can also be done quickly at the time it is needed or requested, so ongoing filing and renewal may not be necessary. This infographic shows the increase and types of SAR filings that result from the process.

In December 2020, FinCEN's (then) Director Kenneth Blanco discussed the importance of the process and released an updated fact sheet detailing the program. It rescinded the agency's 2009 guidance on the scope of permissible 314(b) sharing activities and expanded on an administrative ruling that defines "associations of financial institutions." It even notes that a joint SAR could be filed if two entities felt it was appropriate and explains that the process can involve investment firms, insurance companies, casinos, or other appropriate non-financial institutions.

We have had a couple examples of credit unions in Montana that were either contacted for a 314(b) discussion or needed to engage in one. Two of these scenarios led to uncovering elder financial exploitation, and another allowed a credit union to confirm that a CTR was filed by the other institution after a series of deposits at the Montana credit union's ATM triggered filing for a non-member. The ability to discuss particulars with another financial institution can be invaluable to investigating possible money laundering activity. It may also call attention to activity that was not on your radar.

In July 2023, the OCC announced a $15M civil money penalty against American Express National Bank for failure to govern a third-party affiliate relationship.

The press release noted that oversight of a third-party affiliate was not sufficient to collect necessary consumer information and that American Express failed to "properly maintain and produce records to show compliance with Customer Identification Program regulations."

The example is a reminder that BSA requirements can extend beyond your credit union walls and that oversight of third-party relationships involving collection of member data should be part of your audit process.

FinCEN announced the assessment of a $100 million penalty in 2021 against BitMEX, one of the oldest and largest convertible virtual currency exchanges.

Details describe a failure to implement a compliance AML and customer identification program, leading to a lack of SAR filings.

FinCEN AML priorities, announced in 2021, included "Cybercrime, including Relevant Cybersecurity and Virtual Currency Considerations." The agency has promised "regulations at a later date that will specific how financial institutions should incorporate these Priorities into their risk-based AML programs." We also anticipate a continued focus on virtual and digital currencies.

Donya Parrish, VP Risk Management | donya@mcun.coop | 406-459-3497