Compliance Blog

We’re well into January 2021 now, but there were a few developments relating to the Bank Secrecy Act (BSA) that snuck in around the holidays at the end of 2020. Let’s look back at two of them:

FinCEN’s Notice on Vaccine Scams

On December 28, 2020, the Financial Crimes Enforcement Network (FinCEN) issued a notice to financial institutions regarding possible fraud and other criminal activity relating to a COVID-19 vaccine. The FBI and other federal agencies had previously warned the public about vaccine-related scams, including possible indicators of fraudulent activity.

The FinCEN notice warns about a host of potential illegal activity, including:

• Sales of unapproved vaccines;
• Sales of counterfeit versions of the approved vaccines;
• Fraudulent schemes that purport to offer early access to the vaccines;
• Ransomware targeting vaccine distribution efforts and the supply chain used to manufacture the vaccines; and
• Phishing schemes that lure victims with fraudulent vaccine information.

FinCEN identifies SAR filing as a crucial step in identifying and stopping fraud. The notice provides guidance on how a credit union should fill out a SAR for a vaccine-related suspicious transaction,  including:

• Field 2 of the SAR (Filing Institution Note to FinCEN) should reference the notice (FIN-2020-NTC4);
• Field 34(z) (Fraud – Other) should be selected as the suspicious activity type. The notice also says the credit union should reference the type of scam (i.e. “vaccine scam”) or product in this field; and
• Credit unions should provide detailed information in the SAR narrative, including how the scammers contacted the victim, how the victim attempted to provide payment, and IP addresses or phone numbers used in the scam.

NCUA Proposed Rule on SAR Exemptions

On December 23, 2020, the NCUA board approved a notice of proposed rulemaking. The proposed rule  would amend section 748.1 of the NCUA regulations, which contains its requirements for SAR reporting. A new section would be added to the regulation, which would allow the NCUA to exempt any federally insured credit union (FICU) from the SAR reporting requirements of section 748.1(c). The proposed rule specifically cites encouraging innovation in SAR reporting as one goal that may warrant an exemption.

FICUs would apply to NCUA for the exemption. The proposed rule notes NCUA “will determine whether the exemption is consistent with safe and sound practices, and may consider other appropriate factors.” Additionally, NCUA may consult with FinCEN regarding whether the requested exemption would be consistent with the purposes of the Bank Secrecy Act (BSA). NCUA will provide a written response regarding the exemption request.

Based on the wording of the proposed rule, each exemption could be uniquely tailored to its specific circumstances and may have a number of limitations:

“The exemption shall be applicable only as expressly stated in the exemption, may be conditional or unconditional, may apply to particular persons or to classes of persons, and may apply to transactions or classes of transactions.”

The length of the exemption is yet another area where NCUA may have some flexibility, as the proposed rule states “[a] federally insured credit union that has received an exemption… may rely on the exemption for a period of time to be communicated by the NCUA in its granting of the exemption, which may [be] indefinite.”

This leaves a lot to the imagination – an exemption could theoretically be a broad exemption that is indefinite, unconditional, and applicable to an entire class of transactions. On the other hand, an exemption could be a narrowly-focused exemption that is temporary, subject to certain conditions, and applicable only to a specific transaction. Or it could fall anywhere on the spectrum between those extremes.

The proposed rule also explains NCUA may choose, at its sole discretion, to extend or revoke exemptions. Some exemptions could potentially be revoked if facts or circumstances change after the exemption was granted.

Finally, the exemption only applies to the NCUA’s SAR reporting requirements in section 748.1, and the proposed rule is careful to note “…any NCUA-issued exemptions from its SAR regulation would not relieve the FICU from independent obligation to comply with FinCEN’s SAR regulations, if applicable.” Thus, FICUs that receive a NCUA-issued SAR-filing exemption may still be subject to FinCEN’s SAR reporting requirements contained in section 1020.320. However, the proposed rule does state NCUA will coordinate with FinCEN when handling parallel exemptions and will seek FinCEN’s concurrence for exemption requests that would require exemption from FinCEN’s regulations.

NCUA requested comments on the proposal, with a comment period open for 30 days from the date the proposed rule is published in the Federal Register.

Programming Note: The NAFCU offices will be closed on Monday, January 18^th and Wednesday, January 20^th, for Martin Luther King Jr. day and Inauguration Day, respectively. The NAFCU Compliance Blog will not publish on those days, and will resume publication on Friday, January 22^nd.