SUPPLEMENTARY INFORMATION:

I. Background

The Attorney General is responsible for enforcing the Gun Control Act (“GCA”), as amended, and the National Firearms Act (“NFA”), as amended. This responsibility includes the authority to promulgate regulations necessary to enforce the provisions of the GCA and NFA.^[1] See18 U.S.C. 926(a); 26 U.S.C. 7801(a)(2)(A)(ii), 7805(a). Congress and the Attorney General have delegated the responsibility for administering and enforcing the GCA and NFA to the Director of ATF (“Director”), subject to the direction of the Attorney General and the Deputy Attorney General. See28 U.S.C. 599A(b)(1), (c)(1); 28 CFR 0.130(a)(1)-(2); Treas. Order No. 221(2)(a), (d), 37 FR 11696-97 (June 10, 1972); 26 U.S.C. 7801(a)(2).^[2] Accordingly, the Department and ATF have promulgated regulations implementing both the GCA and the NFA in 27 CFR parts 478 and 479.

FFLs are subject to record-keeping requirements under the GCA and NFA and their implementing regulations. See, e.g.,18 U.S.C. 923(g); 27 CFR 478.121, 479.131. ATF regulations require that FFLs maintain these records as a bound paper record. See, e.g.,27 CFR 478.125. However, over the years, ATF has authorized individual variances for electronic record-keeping for “good cause,” in accordance with the regulation. 27 CFR 478.22(a)(1). As electronic record-keeping became more prevalent within industry business practices during the past 15 years, ATF issued blanket rulings to permit licensees to generate and store some required records in electronic form, including acquisition and disposition records (“A&D records”), and ATF Forms 5300.9, Firearm Transaction Records (“Form 4473”).^[3] ATF also issued rulings that permitted licensees to file ATF Forms 5320.1, 5320.2, 5320.3, 5320.4, 5320.5, 5320.9, and 5320.10, related to NFA firearms, ATF Forms 5330.3A and 5330.3C, related to importing firearms, and ATF Form 5300.11, related to firearms manufacturing and exporting, electronically using the ATF eForms system.^[4]

II. Proposed Rule

In response to the need to incorporate existing rulings into ATF's regulations, ATF is proposing to revise its regulations to specifically authorize ( printed page 25211) electronic records for firearms transactions. As ATF codifies these rulings, ATF also proposes to simplify and modernize the requirements and establish a set of common standards. This rule proposes to allow FFLs to electronically generate, maintain, and store all records required by the GCA, the NFA, and their implementing regulations, and to identify minimum requirements for electronic record-keeping systems so that records are readily accessible and securely maintained. The rule's proposed revisions would also consolidate ATF's policies for electronically generating, maintaining, and storing records, simplify minimum standards for such electronic record-keeping, and focus on electronic record-keeping goals—easily accessing and reviewing required information; ensuring sufficient data integrity; and securely storing information over time to combat loss, theft, and accidental destruction—while providing more clarity and choice for the licensee.

The proposed rule would allow licensees more flexibility in choosing a record-keeping system, particularly as it relates to storing electronic records. This flexibility would give licensees freedom to modernize business practices, reduce costs, repurpose space previously used for storing hard-copy records, and create data-driven business decisions based on analyses of their electronic records. The proposed rule would create efficiencies for licensees and for ATF, as compliance inspections utilizing electronic records are faster. And if licensees use an electronic record-keeping program that flags missing information or potential regulatory violations, licensees would have fewer compliance issues and reduced risk of prohibited sales.

The proposed rule would permit licensees to remotely store their electronic data at a site they own or contracted/leased by the licensee through a host facility ( e.g., remote server or cloud storage provider), provided that the licensee's server is located within the United States or its territories, or if a host facility is used, that facility must have a business premises within the United States or its territories, and must be subject to U.S. legal process.

Finally, ATF has not included in this proposed rule certain detailed requirements that were in earlier ATF rulings, such as the number of terminals needed for compliance inspections based on the volume of firearms records the licensee generates. Previous ATF rulings enacted this requirement to alleviate concerns regarding access to records during the inspection process.^[5] ATF wanted to avoid inconveniencing licensees during the inspection process and thus required a specific number of terminals based on the volume of transactions to ensure each FFL could access terminals to conduct business during the course of an inspection. While the proposed rule requires only one terminal for inspectors to use, ATF notes it could still be useful for high-volume dealers to have multiple terminals available to both ensure their ability to assist customers and increase the speed and efficiency of inspections. ATF therefore still recommends that FFLs provide multiple terminals to ease any impact of an ATF inspection.

As a result of these considerations, ATF proposes to create a new regulatory section in 27 CFR part 478 specifically on electronic record-keeping. This new § 478.130 would authorize licensees to electronically create, maintain, and store all records required under the GCA, NFA, and implementing regulations, provided the electronic record-keeping system meets the minimum requirements of this section.

As noted above, the proposed minimum requirements relate to the key goals of electronic record-keeping—easily accessing and reviewing required information; ensuring sufficient data integrity; and securely storing information over time to combat loss, theft, and accidental destruction—while providing more clarity and choice for licensees. The proposed requirements are divided into categories to make it easier for licensees to find information on specific topics. These categories are: records content, format, and searchability; automatically capturing and populating data; data integrity and audit trails; storing electronic records; data back-ups, temporary unavailability of electronic record-keeping system; ATF access and licensee responsibilities; discontinuing business operations; record-keeping in a single medium ( i.e., not mixing paper and electronic record-keeping); old records in paper form; and in accord with law and regulation. Specifically, pursuant to the proposed rule:

Records format, content, and searchability. An electronic record-keeping system maintained in conformity with the proposed regulations would contain all information required by applicable law, be formatted to ensure printouts are identical to paper copies of the relevant ATF forms, and not be freely alterable without using a separate entry to log the alteration. If a record requires supplemental documentation, such documentation would be maintained in the same file as the primary record. The records would be searchable by key terms; sortable either alphabetically (by name of purchaser), chronologically (by date of disposition), or numerically (by transaction number); and have the capacity to toggle between at least two types of records. For example, they would have the capacity to toggle between and to view the acquisition and disposition records and a specific Form 4473 for a given firearm. The sortable and searchable requirements mirror current paper storage standards at § 478.124.

Auto-populating data. The regulation permits software that allows most data to populate automatically. ATF is concurrently publishing a proposed rule that proposes amendments to 27 CFR 478.124(c)(2) to permit persons and licensees to auto-populate information for the Form 4473, Firearms Transaction Record. These amendments to § 478.124(c)(2) would also apply to all required licensee records.

Data integrity and audit trails. Data integrity is essential to electronic record-keeping, and audit trails support data integrity. A compliant electronic record-keeping system would generate audit trails, retain error corrections and other record modifications as new log entries, and document when and by whom each modification was made. This is necessary to ensure that forms cannot be improperly or accidentally altered during the course of business. Audit trails capture details like who accessed the system, from where, when, and what actions they performed ( e.g., viewing, modifying, deleting).

Storing electronic records. Records would be stored securely to prevent data loss and breaches. Records for each license cannot be intermingled with records for any other license. Electronic records would be stored at the business location or remotely at a host storage facility. If stored remotely, the licensee would notify ATF of the storage location within 30 days of storing one or more records at the remote facility. The host facility would have to be subject to U.S. legal process as discussed above. If licensees change the host facility at which they store records, and the new host facility is incapable of storing prior ( printed page 25212) records, the licensees must download and maintain a digital copy of the old records at their licensed premises and maintain it in accordance with these regulations.

Data back-ups. Licensees would perform incremental back-ups of changes to the system at least once every 24 hours, and a full system back-up at least once per month, in a manner selected by the licensee, except for Forms 4473, which would require daily back-ups, including pending and incomplete forms (this requirement for Forms 4473 is included in the corresponding proposed rule on revisions to the Form 4473 regulations at § 478.124). These recurring back-ups could be overwritten by the subsequent back-up of the same kind. In addition, licensees would be required to perform a single, full annual back-up to a physical storage medium, such as an external hard drive. Such annual back-ups would not be overwritten and would be kept for the records retention period specified in § 478.129 to ensure that records are available in the event of an outage or a dispute with the storage provider. Certain licensees ( i.e., those with a large volume of transactions, and who maintain a sophisticated, secure electronic record-keeping system employing redundant data storage mechanisms) could request a variance from the annual download requirement. The proposed rule does not contain a requirement to print records.

Temporary unavailability of electronic record-keeping system. Licensees would use paper forms if the electronic record-keeping system were unavailable for ten or fewer calendar days. In such a situation, the paper records would be maintained according to existing ATF regulations on record-keeping, and the licensee would document and maintain paper records of the service disruption. If the system is down for more than ten calendar days, the licensee would contact the ATF area office for guidance. Licensees would also use paper records if the electronic system will not permit them to properly complete a document. For example, the software may have a bug preventing them from properly completing the document. Or there might be some unusual transactions for which the electronic system is not configured to accept the user inputs as complete and correct, even though they are. If the electronic system will not permit the document to be completed as required, licensees would revert to paper forms for those transactions. Licensees would note that the form could not be completed electronically. If reasonably feasible, licensees would contact the software developer or vendor to report the problem. This will put developers on notice of errors that require FFLs to fill out paper forms, with the expectation that the developers will fix such problems in future iterations of the program. But the “if reasonably feasible” language also makes clear that FFLs are not required to report bugs if they would incur significant burdens (whether cost or time) in doing so or if the developer has gone out of business.

ATF access and licensee responsibilities. The electronic records would have to be made available to ATF officers for compliance inspection or law enforcement purposes as required by the GCA, 18 U.S.C. 923(g)(1)(B)-(C). Licensees would have to be able to download or print the electronic records at their business premises and have a computer terminal available during a compliance inspection. As noted above, ATF would not require a specific number of terminals, but ATF does recommend that licensees with high-volume records have multiple computer terminals to avoid interruptions and delays during the inspection.

Discontinuing business operations. Before submitting records to ATF's National Tracing Center (“NTC”) Out-of-Business Records Center (“OOBRC”), the licensee would do a full system back-up of all electronically stored firearms records. Records would then be downloaded to a physical storage medium (such as a hard drive or a USB device) and labeled with the FFL number and the records' date range. Records would be submitted to the OOBRC in an imageable format with the search feature disabled to facilitate NTC's ability to convert these records into static image files not searchable by name. Records would be submitted within 30 calendar days from the end of operations, as required by 18 U.S.C. 923(g)(4).

Record-keeping in a single medium. Licensees would not be required to maintain records in an electronic format. However, if the licensee chose to maintain electronic records, all records would be kept electronically, except for those produced during a temporary system outage or because of a software problem. Persons with multiple federal firearms licenses may choose whether one or more licenses maintain electronic records. However, the medium chosen for each license must be consistent. For example, an FFL with two licenses may maintain electronic records for license 1 while maintaining paper records for license 2. The FFL would need to maintain electronic records for all of license 1's records while maintaining all paper records for license 2.

Older records in paper form. Licensees would be permitted to scan older paper records to incorporate into their electronic record-keeping system. However, they would have to verify that the records are complete (including all supplemental documents and pages) and are exact images of the originals and would have to retain the records in accordance with the other requirements of § 478.130. Once verified in those ways, the licensee could destroy the original paper versions.

In accord with law and regulation. This section would not apply to records for which any law or regulation expressly disallows electronic records.

III. Statutory and Executive Order Review

A. Executive Orders 12866 and 13563

Executive Order 12866 (Regulatory Planning and Review) directs agencies to assess the costs and benefits of available regulatory alternatives and, if regulation is necessary, to select regulatory approaches that maximize net benefits.

Executive Order 13563 (Improving Regulation and Regulatory Review) emphasizes the importance of agencies quantifying both costs and benefits, reducing costs, harmonizing rules, and promoting public flexibility.

This proposed rule would amend 27 CFR part 478 to allow electronic record-keeping for all records that licensees must generate, maintain, and store under the GCA, NFA, and implementing regulations. This proposed rule would incorporate (and would rescind) Rulings 2012-3, 2013-1, 2016-1, 2016-2, and 2022-1, thereby allowing licensees to electronically complete and store Forms 4473 and A&D records.

The Office of Management and Budget (“OMB”) has determined that this proposed rule would not be a “significant regulatory action” under Executive Order 12866 as it would not impose any costs or savings. This proposed rule would only incorporate electronic records options that ATF has permitted for several years and that align with standard business operations in the industry. The proposed rule also does not require persons to maintain records electronically; it just allows that option.

This proposed rule incorporates Ruling 2016-1 and Ruling 2022-1, which currently allow FFLs to maintain electronic Forms 4473 and A&D records. Since these options have been available to the industry since 2016 and 2022, and because savings calculated in the ( printed page 25213) final rule titled “Definition of Frame or Receiver and Identification of Firearms” accounted for the costs and savings generated from allowing electronic records for both A&D records and Forms 4473,^[6] this proposed rule does not identify savings since this is incorporating existing industry standards.

ATF acknowledges that some of the anticipated cost savings may be offset should a licensee need to purchase a new electronic records system, but licensees are able to meet the requirements with inexpensive versions of existing modifiable software. And, again, this is purely optional.

B. Executive Order 14192

Executive Order 14192 (Unleashing Prosperity Through Deregulation) requires an agency, unless prohibited by law, to identify at least ten existing regulations to be repealed or revised when the agency publicly proposes for notice and comment or otherwise promulgates a new regulation that qualifies as an Executive Order 14192 regulatory action (defined in OMB Memorandum M-25-20 as a final significant regulatory action under section 3(f) of Executive Order 12866 that imposes total costs greater than zero). In furtherance of this requirement, section 3(c) of Executive Order 14192 requires that any new incremental costs associated with such new regulations must, to the extent permitted by law, also be offset by eliminating existing costs associated with at least ten prior regulations. However, this proposed rule would not be an Executive Order 14192 regulatory action because it is not a significant regulatory action as defined by Executive Order 12866 and because it would not impose total costs greater than zero. ATF therefore expects this rule, if finalized as proposed, to qualify as an Executive Order 14192 deregulatory action (defined in OMB Memorandum M-25-20 as a final action that imposes total costs less than zero).

C. Executive Order 14294

Executive Order 14294 (Fighting Overcriminalization in Federal Regulations) requires agencies promulgating regulations with criminal regulatory offenses potentially subject to criminal enforcement to explicitly describe the conduct subject to criminal enforcement, the authorizing statutes, and the mens rea standard applicable to each element of those offenses. This proposed rule would not create a criminal regulatory offense and is thus exempt from Executive Order 14294 requirements.

D. Executive Order 13132

This proposed rule would not have substantial direct effects on the states, the relationship between the federal government and the states, or the distribution of power and responsibilities among the various levels of government. Therefore, in accordance with section 6 of Executive Order 13132 (Federalism), the Director has determined that this proposed rule would not impose substantial direct compliance costs on state and local governments, preempt state law, or meaningfully implicate federalism. It thus does not warrant preparing a federalism summary impact statement.

E. Executive Order 12988

This proposed rule meets the applicable standards set forth in sections 3(a) and 3(b)(2) of Executive Order 12988 (Civil Justice Reform).

F. Regulatory Flexibility Act

Under the Regulatory Flexibility Act, 5 U.S.C. 601-612, agencies are required to conduct a regulatory flexibility analysis of any proposed rule subject to notice-and-comment rulemaking requirements unless the agency head certifies, including a statement of the factual basis, that the proposed rule would not have a significant economic impact on a substantial number of small entities. Small entities include certain small businesses, small not-for-profit organizations that are independently owned and operated and are not dominant in their fields, and governmental jurisdictions with populations of less than 50,000.

The Director certifies, after consideration, that this proposed rule would not have a significant economic impact on a substantial number of small entities. This proposed rule would allow businesses the option of creating and maintaining records electronically, which could represent significant savings in paper printing, mailing, transportation, and storage costs, and is likely to increase convenience and operating efficiency, even if offset in some circumstances and to some degree by the decision to purchase a new records management system. This proposed rule therefore would not impose a significant economic impact on small businesses or the industry as a whole.

G. Unfunded Mandates Reform Act of 1995

This proposed rule does not include a federal mandate that might result in the expenditure by state, local, and tribal governments, in the aggregate, or by the private sector, of $100 million or more in any one year, and it would not significantly or uniquely affect small governments. Therefore, ATF has determined that no actions are necessary for purposes of the Unfunded Mandates Reform Act of 1995.

H. Paperwork Reduction Act of 1995

Under the Paperwork Reduction Act (“PRA”), 44 U.S.C. 3501-3521, agencies are required to submit to OMB, for review and approval, any information collection requirements a rule creates or any impacts it has on existing information collections. An information collection includes any reporting, record-keeping, monitoring, posting, labeling, or other similar actions an agency requires of the public. See5 CFR 1320.3(c). This proposed rule would not create any new information collection requirements, or impact any existing ones, covered by the PRA.

I. Congressional Review Act

This proposed rule would not be a major rule as defined by the Congressional Review Act, 5 U.S.C. 804.

IV. Public Participation

A. Comments Sought

ATF requests comments on the proposed rule from all interested persons. ATF specifically requests comments on the clarity of this proposed rule and how it may be made easier to understand. In addition, ATF requests comments on the costs or benefits of the proposed rule and on the appropriate methodology and data for calculating those costs and benefits.

All comments must reference this document's RIN 1140-AA94 and, if handwritten, must be legible. If submitting by mail, you must also include your complete first and last name and contact information. If submitting a comment through the federal e-rulemaking portal, as described in section IV.C of this preamble, you should carefully review and follow the website's instructions on submitting comments. Whether you submit comments online or by mail, ATF will post them online. If submitting online as an individual, any information you provide in the online fields for city, state, zip code, and phone will not be publicly viewable when ATF publishes the comment on https://www.regulations.gov. However, if you ( printed page 25214) include such personally identifying information (“PII”) in the body of your online comment, it may be posted and viewable online. Similarly, if you submit a written comment with PII in the body of the comment, it may be posted and viewable online. Therefore, all commenters should review section IV.B of this preamble, “Confidentiality,” regarding how to submit PII if you do not want it published online. ATF may not consider, or respond to, comments that do not meet these requirements or comments containing excessive profanity. ATF will retain comments containing excessive profanity as part of this rulemaking's administrative record but will not publish such documents on https://www.regulations.gov. ATF will treat all comments as originals and will not acknowledge receipt of comments. In addition, if ATF cannot read your comment due to handwriting or technical difficulties and cannot contact you for clarification, ATF may not be able to consider your comment.

ATF will carefully consider all comments, as appropriate, received on or before the closing date.

B. Confidentiality

ATF will make all comments meeting the requirements of this section, whether submitted electronically or on paper, and except as provided below, available for public viewing on the internet through the federal e-rulemaking portal, and subject to the Freedom of Information Act (5 U.S.C. 552). Commenters who submit by mail and who do not want their name or other PII posted on the internet should submit their comments with a separate cover sheet containing their PII. The separate cover sheet should be marked with “CUI//PRVCY” at the top to identify it as protected PII under the Privacy Act. Both the cover sheet and comment must reference this RIN 1140-AA94. For comments submitted by mail, information contained on the cover sheet will not appear when posted on the internet but any PII that appears within the body of a comment will not be redacted by ATF and may appear on the internet. Similarly, commenters who submit through the federal e-rulemaking portal and who do not want any of their PII posted on the internet should omit such PII from the body of their comment and any uploaded attachments. However, PII entered into the online fields designated for name, email, and other contact information will not be posted or viewable online.

A commenter may submit to ATF information identified as proprietary or confidential business information by mail. To request that ATF handle this information as controlled unclassified information (“CUI”), the commenter must place any portion of a comment that is proprietary or confidential business information under law or regulation on pages separate from the balance of the comment, with each page prominently marked “CUI//PROPIN” at the top of the page.

ATF will not make proprietary or confidential business information submitted in compliance with these instructions available when disclosing the comments that it receives, but will disclose that the commenter provided proprietary or confidential business information that ATF is holding in a separate file to which the public does not have access. If ATF receives a request to examine or copy this information, it will treat it as any other request under the Freedom of Information Act (5 U.S.C. 552). In addition, ATF will disclose such proprietary or confidential business information to the extent required by other legal process.

C. Submitting Comments

Submit comments using either of the two methods described below (but do not submit the same comment multiple times or by more than one method). Hand-delivered comments will not be accepted.

• Federal e-rulemaking portal: ATF recommends that you submit your comments to ATF via the federal e-rulemaking portal at https://www.regulations.gov and follow the instructions. Comments will be posted within a few days of being submitted. However, if large volumes of comments are being processed simultaneously, your comment may not be viewable for up to several weeks. Please keep the comment tracking number that is provided after you have successfully uploaded your comment.
• Mail: Send written comments to the address listed in the ADDRESSES section of this document. Written comments must appear in minimum 12-point font size, include the commenter's first and last name and full mailing address, and may be of any length. See also section IV.B of this preamble, “Confidentiality.”

D. Request for Hearing

Any interested person who desires an opportunity to comment orally at a public hearing should submit his or her request, in writing, to the Director within the 90-day comment period. The Director, however, reserves the right to determine, in light of all circumstances, whether a public hearing is necessary.

Disclosure

Copies of this proposed rule and the comments received in response to it are available through the federal e-rulemaking portal, at https://www.regulations.gov (search for RIN 1140-AA94).

Severability

Consistent with the Administrative Procedure Act, the issues raised in this proposed rule may be finalized, or not, independently of each other, after consideration of comments received. ATF has determined that this proposed rule implements and is fully consistent with governing law. However, in the event this proposed rule is finalized, if any provision of that final rule, an amendment or revision made by that rule, or the application of such provision or amendment or revision to any person or circumstance, is held to be invalid or unenforceable by its terms, the remainder of that final rule, the amendments or revisions made by that rule, and application of the provisions of the rule to any person or circumstance shall not be affected and shall be construed so as to give them the maximum effect permitted by law.

For the reasons discussed in the preamble, ATF proposes to amend 27 CFR part 478 as follows:

1. The authority citation for 27 CFR part 478 continues to read as follows:

Authority: 5 U.S.C. 552(a); 18 U.S.C. 847, 921-931; 44 U.S.C. 3504(h).

2. Add a new § 478.130 to read as follows:

91 FR 25210