SUPPLEMENTARY INFORMATION:

I. Statutory and Regulatory Provisions

The legislative framework generally referred to as the BSA consists of the Currency and Foreign Transactions Reporting Act of 1970,^[1] as amended by the Uniting and Strengthening America by Providing Appropriate Tools Required to Intercept and Obstruct Terrorism Act of 2001 (USA PATRIOT Act),^[2] and other legislation, including the Anti-Money Laundering Act of 2020 (AML Act).^[3] The BSA is codified at 12 U.S.C. 1829b, and 1951-1960, and 31 U.S.C. 5311-5314 and 5316-5336, and includes notes thereto; with implementing regulations at 31 CFR chapter X.

The BSA authorizes the Secretary of the Treasury (Secretary) to, inter alia, require financial institutions to keep records and file reports that are determined to have a high degree of usefulness in criminal, tax, or regulatory matters, risk assessments or proceedings, or in intelligence or counter-intelligence activities, including analysis, to protect against terrorism, and to implement anti-money laundering/countering the financing of terrorism (AML/CFT) programs and compliance procedures.^[4] The Secretary has delegated to the Director of FinCEN (Director) the authority to administer the BSA.^[5]

The USA PATRIOT Act charged the Department of the Treasury (Treasury) with developing regulations to facilitate information sharing among government entities and financial institutions for the purpose of combatting terrorism and money laundering. In 2002, FinCEN published a final rule implementing the authority contained in section 314(a) of the USA PATRIOT Act (the Section 314(a) Rule).^[6] The rule required financial institutions, upon FinCEN's request (Section 314(a) Request), to search their records to determine whether they have maintained an account or conducted a transaction with a specified individual, entity, or organization that a Federal law enforcement agency has certified is suspected, based on credible evidence, of engaging in terrorist activity or money laundering. The rule was expanded in 2010 to enable certain agencies other than Federal law enforcement agencies to initiate Section 314(a) Requests. As amended, the rule enables certain foreign law enforcement agencies, state and local law enforcement agencies, and FinCEN itself, on its own behalf and on behalf of appropriate components of Treasury, to initiate Section 314(a) Requests.^[7] Before processing a request, FinCEN requires the requesting agency to certify that, in the case of money laundering, the matter is significant, and that the requesting agency has been unable to locate the information sought through traditional methods of investigation and analysis. The regulations implementing the rules are found at 31 CFR 1010.520.

The requesting governmental entity must generally certify that each individual, entity, or organization about which the governmental entity is seeking information is engaged in, or is reasonably suspected based on credible evidence of engaging in, terrorist activity or money laundering. The requesting governmental entity must also provide FinCEN with information identifying each subject of a Section 314(a) Request, such as a name, date of birth (for an individual), address, and taxpayer identification number (TIN), or for an individual, social security number (SSN), or for an entity, employer identification number (EIN). The requesting governmental agency must also provide a point-of-contact (POC) who can be contacted by FinCEN or a financial institution in case there are any questions relating to the Section 314(a) Request.

Upon receiving a 314(a) Request, a financial institution is generally only required to search its records for: (i) any current account maintained for a named subject; (ii) any account maintained for a named subject during the preceding ( printed page 47126) twelve months from the date of the Section 314(a) Request; and (iii) any transaction conducted by or on behalf of a named subject, or any transmittal of funds conducted in which a named subject was either the transmittor or the recipient, during the preceding six months from the date of the Section 314(a) Request, that is required under law or regulation to be recorded by the financial institution or is recorded and maintained electronically by the institution.

A financial institution must report any matches to FinCEN, in the manner and in the timeframe specified in the Section 314(a) Request, and, as available, the following information: (i) the name of the match, such as the name of the individual, entity, or organization; (ii) the account number, or in the case of a transaction, the date and type of each such transaction; and (iii) any TIN information, passport number, date of birth, address, or other similar identifying information provided by the individual, entity, or organization when each such account was opened or each such transaction was conducted.

The Section 314(a) Rule also requires a financial institution, upon receiving a Section 314(a) Request, to provide to FinCEN a POC to receive future Section 314(a) Requests.^[8] Financial institutions must promptly notify FinCEN of any changes to such information.

II. Paperwork Reduction Act of 1995 (PRA) ^[9]

Title: Information sharing between government agencies and financial institutions (31 CFR 1010.520).

OMB Control Number: 1506-0049.

Form Number: Not applicable.

Abstract: FinCEN is issuing this notice to renew the OMB control number for regulations requiring information sharing between government agencies and financial institutions.

Affected Public: Businesses or other for-profit and non-profit institutions.

Type of Review: Renewal without change of a currently approved information collection.

Frequency: As required.

Estimated Number of Potential Respondents: 575,873 financial institutions.

As set forth in 31 CFR 1010.520(a)(1), the information collection required under the Section 314(a) Rule, as described in this notice, pertains to an entity defined as a financial institution in 31 U.S.C. 5312(a)(2) but not necessarily defined as such in the regulations generally implementing the BSA.^[10] FinCEN may contact any financial institution so defined in carrying out a Section 314(a) Request. An estimate of the total potentially affected population of these respective institutions is provided in Table 1.

Estimated Number of Expected Respondents: 12,726 financial institutions, per year, on average.^[11]

While all the entities in Table 1 are required to respond to a Section 314(a) Request upon receipt, FinCEN generally only transmits a Section 314(a) Request to a limited subset of those financial institutions in any given year. Historically, the proportion of potentially affected financial institutions required to provide a response in a given year has remained below three percent. In 2024, for example, of the estimated 575,873 potential respondents, FinCEN transmitted Section 314(a) Requests to only 12,839 financial institutions, approximately 2.2 percent of the potentially affected population.

Of these respondents in 2024, approximately one third were banks or credit unions, nearly 15 percent were broker-dealers or mutual funds, and the remaining half were other types of covered financial institutions. This industry composition of respondent financial institutions (“Respondent FIs”) is broadly consistent with the distribution of estimated respondents at the time of the previous renewal which comprised “14,960 financial institutions, consisting of certain commercial banks, savings associations, and credit unions, broker or dealers in securities, future commission merchants, trust companies, life insurance companies, mutual funds and money services businesses.” ^[12]

Estimated Total Annual Responses: 7,381,080 responses, per year, on average.^[13]

Over the period between 2023 and 2025, FinCEN sent, on behalf of itself or state and local or foreign law enforcement,^[14] approximately 116 Section 314(a) Requests per year to 12,726 total respondents per year, on average.^[15] These requests had an average of approximately five subjects.^[16] In the most recent full calendar year, the corresponding figures are 122 total Section 314(a) Requests ^[17] to 12,839 total Respondent FIs, averaging approximately six subjects ^[18] per request. As the three-year average number of required responses per Respondent FI (approximately 580) is lower than the analogous value in the most recently completed year (approximately 732), it is possible that FinCEN's proposed PRA estimates are conservatively low.

Table 2 provides a summary of requests and responses by the number of affected financial institutions since the last OMB control number renewal. The scope of new data used to update PRA estimates begins with calendar year 2023,^[19] the year in which FinCEN transitioned from a paper-only process for law enforcement agencies (LEAs) to initiate requests to an exclusively electronic filing process. In general, the number of Section 314(a) Requests and number of subjects per Section 314(a) Request has increased over time and are expected to continue doing so as a result of activities FinCEN has undertaken to enhance the usability of the Section 314(a) Program.^[20]

( printed page 47128)

Estimated Reporting and Recordkeeping Burden:

Despite certain changes to its methodological approach in this notice, FinCEN results are broadly consistent with the previous ^[21] method of estimating response burden, maintaining the estimate of approximately four minutes per response,^[22] per respondent, per year, on average. In this OMB control number renewal, FinCEN has expanded the scope of its estimates in an effort to more comprehensively articulate the full PRA burden of the Section 314(a) Program as incurred by respondents. Where applicable, FinCEN's assignment of PRA burden estimates associated with 31 CFR 1010.520 have been itemized, per regulatory component in the more detailed discussion below. Where FinCEN has not assigned or estimated a burden ^[23] or is considering further revisions or refinements to current estimates,^[24] a brief explanation is provided, and public comment is invited.^[25]

The analysis also briefly reviews where changes in the mechanisms and processes by which the Section 314(a) Program operates that have become standard practice since prior OMB control number renewals are expected to affect anticipated burdens. Furthermore, consistent with the purposes of the PRA,^[26] FinCEN is providing additional description of the agency's continuing efforts to reduce the reporting and recordkeeping burdens covered by this notice.

(1) General Section 314(a) Program Components

31 CFR 1010.520 includes subsections that FinCEN does not expect to impose PRA reporting or recordkeeping burdens despite being integral to the overall design and operations of the Section 314(a) Program. These include subsections 1010.520(a)(1)-(2), (b)(2), (b)(3)(iv)(B)(1)-(2), (b)(3)(v), and (b)(4)-(5). Public response is invited to the extent that commenters believe additional burden accrues because of these provisions, and should be included in future renewals.

(2) Components Applicable to Parties Initiating a Section 314(a) Request

31 CFR 1010.520 sets forth the requirements for parties that would initiate a Section 314(a) Request. Table 3 ^[27] only presents data on requests from LEAs that are not part of the Federal government because PRA considerations do not apply to Section 314(a) Requests from Federal government agencies.^[28] The Table provides FinCEN historical data and near-term projected population estimates of requests from these parties as well as FinCEN.^[29]

31 CFR 1010.520(b)(1)—Section 314(a) Requests Initiated by an LEA

31 CFR 1010.520(b)(1) details the expectations of, and obligations accruing to, an LEA that wants FinCEN to distribute a Section 314(a) Request on its behalf, including (1) the certification, (2) the list of subjects and associated information, and (3) the designation of an LEA POC.

FinCEN believes all the information included in the certification set forth in 31 CFR 1010.520(b)(1) is not subject to the PRA, but even if some of it were, the incremental PRA burden of providing such information on affected LEAs is de minimis. For those reasons, FinCEN has not previously included a PRA burden estimate associated with completing the certification in OMB control number renewals and is not doing so in this renewal. However, FinCEN is seeking public comment regarding whether the PRA burden on affected LEAs is more than de minimis.

(3) Components Applicable to Parties Receiving a Section 314(a) Request 31 CFR 1010.520(b)(3)(i)—Search

As set forth in 31 CFR 1010.520(b)(3)(i), a Respondent FI, when searching for an account matching a named suspect, need only search for any current account maintained by a named suspect and any account maintained for a named suspect within the last preceding twelve months.^[30] Similarly, when searching for a matching transaction, a Respondent FI need only search for any transaction conducted by or on behalf of a named suspect, or any transmittal of funds conducted in which a named suspect was either the transmittor or the recipient, during the preceding six months that is required under law or regulation to be recorded by the institution or is recorded and maintained electronically by the institution.^[31]

When a Respondent FI receives a Section 314(a) Request, it is provided a list of subjects identified by name,^[32] address, and as much additional identifying data as possible.^[33] Respondent FIs can retrieve the files in .csv, .txt, and .doc format to allow for ingestion into various software that financial institutions use to run searches against their systems. Providing downloads in a variety of formats is intended to reduce burden on financial institutions by allowing them to automate their records search in a format that is compatible with their existing software and systems.

To prepare a response, Respondent FIs must search their records for data matches, including accounts maintained by the named subject(s) during the preceding 12 months and non-account-related transactions conducted within the past 6 months. FinCEN expects that executing this may involve two types of activity: automated search and manual review. FinCEN presumes that all Respondent FIs first conduct an automated search by querying their records for positive matches to accounts maintained or transactions conducted with the subject(s) of a Section 314(a) Request. If that search yields records that appear to match, additional manual review is conducted to verify that identified matches are correct and that in each case the automated query has not identified a false positive match.

FinCEN expects that there may be substantial variation in the search time associated with the subject(s) of a Section 314(a) Request depending on the quality of the identified match. In cases where automated search results are relatively unambiguous,^[34] search time may range from two to five minutes per subject on average. Alternatively, in cases where a match is more ambiguous, verifying a positive match could require lengthier manual review and, in some instances, necessitate communication with the Section 314(a) Request's LEA or FinCEN point of contact. FinCEN expects that in these cases, where verifying a positive match is more labor-intensive, search time may range from 15 minutes to two hours and fifteen minutes, on average. Based on observed response data, FinCEN estimates that the weighted average search time ^[35] per subject in a Section 314(a) Request is approximately three and a half minutes.

31 CFR 1010.520(b)(3)(ii)—Report to FinCEN

31 CFR 1010.520(b)(3)(ii) delineates the required response if a Respondent FI identifies a matching account or transaction. To minimize burden on financial institutions, financial institutions only must confirm with FinCEN that they have a positive match to the subject of a Section 314(a) Request.^[36] This is in contrast to the detailed information a financial institution would otherwise be required to report under 31 CFR 1010.520(b)(3)(ii). Financial institutions do not need to reply to a Section 314(a) Request if the search does not uncover any match to accounts or transactions.

Responses to Section 314(a) Requests are expected to occur within two ( printed page 47130) weeks ^[37] from the posting date of the initial Section 314(a) Request. Responses to Section 314(a) Requests are filed electronically via a FinCEN secure portal where a Respondent FI, presented with a list of one or more subjects per Section 314(a) Request, need only check the box next to any subject for which it can confirm a positive match in its records and click “submit.” FinCEN estimates that in addition to conducting the search activities necessary for a response, this reporting activity imposes an additional 30 second time burden per subject, per Section 314(a) Request, per Respondent FI.

FinCEN is not assigning a recordkeeping burden to this provision because financial institutions are not required to maintain records related to Section 314(a) Requests. Nevertheless, some Respondent FIs may choose to maintain records as part of their broader compliance program to demonstrate that all required searches have been performed and positive matches reported. Respondent FIs who wish to do so may obtain an activity report via FinCEN's secure portal, which provides download and response history. To the extent that burden is incurred by these activities, FinCEN expects that this would be captured by the recordkeeping burden hours assigned to 31 CFR 1010.520(b)(3)(iv)(A) as described below.

31 CFR 1010.520(b)(3)(iii)—Contact Person(s)

As previously described,^[38] 31 CFR 1010.520 requires that a Respondent FI must designate a Section 314(a) POC and both provide, maintain, and update the required contact information for that person as necessary. FinCEN is assigning a one-hour per year per Respondent FI reporting and recordkeeping cost to this provision.

31 CFR 1010.520(b)(3)(iv)(A)

31 CFR 1010.520(b)(3)(iv)(A) provides that Respondent FIs may not use information obtained by a Section 314(a) Request for purposes other than responding to FinCEN's request ^[39] and to determine whether to establish or maintain an account or engage in a transaction or assist the institution in complying with another requirement in Chapter X.^[40] FinCEN is assigning a four hour per respondent, per year ^[41] recordkeeping burden to account for a Respondent FI's need to document how it reviewed and incorporated Section 314(a) Request information into its broader compliance with AML/CFT program requirements, including the development of any policies and procedures or internal processes related to compliance and/or risk management.

31 CFR 1010.520(b)(3)(iv)(C)

31 CFR 1010.520(b)(3)(iv)(C) provides that a Respondent FI shall maintain adequate procedures to protect the security and confidentially of Section 314(a) Requests. To account for this and other technology and data security costs associated with a Respondent FI's Section 314(a) program, FinCEN is assigning a $0.10 non-labor cost to each response.

Estimated Burden Hours Per Respondent:  ^[42] approximately 44 ^[43] hours annually, on average.

The estimated burden per respondent includes the time associated with responding to Section 314(a) Requests (approximately 39 hours per respondent, on average) ^[44] and recordkeeping associated with the operation and maintenance of the Respondent FI's 314(a) program (5 hours per respondent, on average).^[45]

Estimated Total Annual Burden Hours: 555,702 hours per year, on average.

Estimated Total Annual Cost: $67,461,247.⁴⁶ ( printed page 47131)

Under the PRA, FinCEN as a Federal agency may not conduct or sponsor, and a person is not required to respond to, a collection of information unless the collection of information displays a valid OMB control number. Records required to be retained under the BSA must be retained for five years.

General Request for Comment: Comments submitted in response to this notice will be summarized and/or included in the request for OMB approval. All comments will become a matter of public record. Comments are invited on: (1) whether the collection of information is necessary for the proper performance of the functions of the agency, including whether the information shall have practical utility; (2) the accuracy of FinCEN's estimates of the burden of the collection of information; (3) ways to enhance the quality, utility, and clarity of the information to be collected; (4) ways to minimize the burden of the collection of information on respondents, including through the use of automated collection techniques or other forms of information technology; and (5) estimates of capital or start-up costs and costs of operation, maintenance, and purchase of services to provide information.

III. Additional Request for Comments

In connection with a variety of initiatives FinCEN is undertaking to implement the AML Act, FinCEN intends to conduct, in the future, additional assessments of the PRA burden associated with BSA requirements. To assist with those activities, FinCEN is also requesting comments in response to the following additional questions:

1. FinCEN invites comment on its analytical approach in this OMB control number renewal. Does the new structure of the analysis more accurately reflect the experiences and costs incurred by participants in the Section 314(a) Program? Should alternative approaches be considered? If so, please describe.

2. FinCEN Section 314(a) Program burden estimates do not currently include an itemized consideration of information collections or reporting costs to State, local, and foreign law enforcement when originating Section 314(a) Requests because FinCEN believes the costs are de minimis. Should FinCEN include an itemized burden estimate and is there readily generalizable data or qualitative information that could establish that these costs are not de minimis ?

3. Are there start-up technology costs, such as costs to extend or further customize existing electronic records systems, that a potentially affected financial institution would need to incur as new respondents that FinCEN should separately itemize as an expected Section 314(a) Program cost? If so, please describe.

4. To what extent can a financial institution that would newly become a respondent be able to rely on third-party services, existing software, or other products to receive and process Section 314(a) Requests?

5. On average, how long does it take to ingest or otherwise upload a Section 314(a) Request to a Respondent FI's automated system and perform an electronic query for its subjects? Approximately how long does it take per subject? Are there meaningful differences in automated search time depending on subject type ( i.e., individual, entity, or organization)?

6. In what proportion do query results from a Respondent FI's automated search identify a potential match to a Section 314(a) Request subject that is ultimately determined to be a false positive? Are there ever instances where an automated search does not yield a match but a Respondent FI identifies this as a false negative?

7. What steps are taken, once an automated system generates a match, to determine if it is an actual match or a false positive? Approximately how much time is required, on average, to make a determination? Are there meaningful differences in time expended by outcome? By subject type?

8. What type of records are produced to document the results of this type of research? What type of records are maintained to document that a Section 314(a) Request search has been conducted? Are there meaningful differences in the time cost of recordkeeping that depend on the results of the search ( i.e., when a search results in no matches versus when at least one confirmed, positive match occurs)?

9. In practice, are there any cases where non-electronic records are searched or reviewed in connection with a Section 314(a) Request? If so, please describe the general frequency and nature of these instances.

10. 31 CFR 1010.520(b)(3)(i) provides that a Respondent FI may contact a Section 314(a) Request's designated Requestor POC if they have questions about the scope or terms or the request. What proportion of requests and what proportion of subjects necessitate such contact? In each case, how many times is contact typically required? How much time is spent on communications with this contact, per instance and per 314(a) request? Is this outreach usually part of the research activities specifically related to ambiguous query search results or to other aspects of the request?

11. Is it reasonable to assume that the average financial institution that is, or becomes, a respondent employs more than one person, or relies on employees in more than one occupational category, to conduct and review Section 314(a) Request searches?

12. This analysis uses a standard index wage rate that accounts for multiple occupational roles involved in reporting and recordkeeping activities. To what extent does this approach reflect how financial institutions conduct Section 314(a) Request-related activities? Do these activities generally involve several occupational roles, or would a single wage rate be more appropriate? If the work involves more ( printed page 47132) than one occupational role, how is the total work divided between the roles involved?

13. What is the typical occupation of an individual assigned by a financial institution to serve as their Section 314(a) POC? Approximately how much of their total labor is allocated to this function? Approximately what proportion of potentially affected financial institutions that have never been a Respondent FI have assigned a Section 314(a) POC in advance?

14. FinCEN's use of an index wage rate to estimate time costs assumes senior management participates in Section 314(a) Program activities. How often and to what extent do such persons typically review the search results for subjects of Section 314(a) Requests? How often and to what extent do such persons typically review their financial institution's Section 314(a) Program policies and procedures?

15. Does senior management typically evaluate policies, procedures, and activities related to the privacy and security of Section 314(a) Program-related data as a standalone activity or as part of broader review of their financial institution's data privacy and security practices?

90 FR 47125