E8-27181. Prohibition on Funding of Unlawful Internet Gambling

AGENCIES:

Board of Governors of the Federal Reserve System and Departmental Offices, Department of the Treasury.

ACTION:

Final rule.

SUMMARY:

This document is published jointly by the Departmental Offices of the Department of the Treasury (the “Treasury”) and the Board of Governors of the Federal Reserve System (the “Board”) (collectively, the “Agencies”) to adopt a final rule to implement applicable provisions of the Unlawful Internet Gambling Enforcement Act of 2006 (the “Act”). The final rule sets out definitions for terms used in the regulation; designates payment systems that could be used by participants in connection with, or to facilitate, a restricted transaction; exempts certain participants in certain designated payment systems from the requirement of the regulation; requires the participants performing non-exempt functions in a designated payment system to establish and implement policies and procedures reasonably designed to prevent or prohibit restricted transactions, such as by identifying and blocking such transactions; provides non-exclusive examples of policies and procedures for non-exempt participants in each designated payment system; and sets out the regulatory enforcement framework. In developing this rule, the Agencies have consulted with the Department of Justice, as required by the Act, and have taken into consideration all comments received on the proposed rule issued in October 2007.

DATES:

Final rule is effective January 19, 2009. The incorporation by reference of the publication listed in the final rule is approved by the Director of the Federal Register as of January 19, 2009. However, compliance by non-exempt participants in designated payment systems is not required until December 1, 2009.

FOR FURTHER INFORMATION CONTACT:

Board: Christopher W. Clubb, Senior Counsel (202/452-3904), Legal Division; Jeffrey S. Yeganeh, Manager, or Joseph Baressi, Financial Services Project Leader (202/452-3959), Division of Reserve Bank Operations and Payment Systems; for users of Telecommunication Devices for the Deaf (TDD) only, contact 202/263-4869.

Treasury: Charles Klingman, Director, Office of Critical Infrastructure Protection and Compliance Policy; or Steven D. Laughton, Senior Counsel, Office of the Assistant General Counsel (Banking & Finance), 202/622-9209.

SUPPLEMENTARY INFORMATION:

I. Background

Unlawful Internet Gambling Enforcement Act

The Act prohibits any person engaged in the business of betting or wagering (as defined in the Act) from knowingly accepting payments in connection with the participation of another person in unlawful Internet gambling. Such transactions are termed “restricted transactions.” The Act generally defines “unlawful Internet gambling” as placing, receiving, or otherwise knowingly transmitting a bet or wager by any means which involves the use, at least in part, of the Internet where such bet or wager is unlawful under any applicable Federal or State law in the State or Tribal lands in which the bet or wager is initiated, received, or otherwise made. The Act states that its provisions should not be construed to alter, limit, or extend any Federal or State law or Tribal-State compact prohibiting, permitting, or regulating gambling within the United States.^[1] The Act does not spell out which activities are legal and which are illegal, but rather relies on the underlying substantive Federal and State laws.^[2]

The Act requires the Agencies (in consultation with the U.S. Attorney General) to designate payment systems that could be utilized in connection with or to facilitate restricted transactions. Such a designation makes the payment system, and financial transaction providers participating in the system, subject to the requirements of the regulations. The Act further requires the Agencies (in consultation with the U.S. Attorney General) to prescribe regulations requiring designated payment systems and financial transaction providers participating in each designated payment system to establish policies and procedures reasonably designed to identify and block or otherwise prevent or prohibit restricted transactions. The regulations must identify types of policies and procedures that would be deemed to be reasonably designed to achieve this objective, including non-exclusive examples. The Act also requires the Agencies to exempt certain restricted transactions or designated payment systems from any requirement imposed by the regulations if the Agencies jointly determine that it is not reasonably practical to identify and block, or otherwise prevent or prohibit the acceptance of, such transactions.

Overview of the Proposed Rule

In October 2007, the Agencies jointly issued, and requested public comment on, a Notice of Proposed Rulemaking (“NPRM”) to implement the Act.^[3] The proposed rule provided definitions of terms used in the regulation, many of which followed or referred to definitions set out in the Act or other existing regulatory or statutory definitions. The proposed rule did not attempt to further define gambling-related terms because the Act itself does not specify which gambling activities are legal or illegal and relies on prohibitions contained in statutes that are not under the jurisdiction of the Agencies. Application of some of the terms used in the Act may depend significantly on the facts of specific transactions such that general regulatory definitions would not be appropriate.

The proposed rule designated the following payment systems as payment systems that could be used in connection with unlawful Internet gambling transactions restricted by the Act: Automated clearing house systems; card systems; check collection systems; money transmitting businesses; and wire transfer systems. The proposed rule required participants in these designated payment systems to establish and implement written policies and procedures reasonably designed to identify and block or otherwise prevent or prohibit transactions in connection with unlawful Internet gambling.

The proposed rule also exempted from the requirements to establish such policies and procedures all participants in the automated clearing house systems, check collection systems, and wire transfer systems, except for the participant that possesses the customer relationship with the Internet gambling business (and certain participants that receive certain cross-border transactions from, or send certain such transactions to, foreign payment service providers) because the Agencies believed that it was not reasonably practical for those participants to identify and block, or otherwise prevent or prohibit, unlawful Internet gambling transactions restricted by the Act. The Agencies intended that the participant with the customer relationship with the Internet gambling business would have the responsibility in the ACH systems, check collection systems, or wire transfer systems to prevent or prohibit restricted transactions from being credited to the account of the gambling business through that particular payment system.

Finally, the proposed rule described types of policies and procedures that non-exempt participants in each type of designated payment system could adopt in order to comply with the Act and included non-exclusive examples of policies and procedures that would be deemed to be reasonably designed to prevent or prohibit restricted transactions. The non-exclusive examples included special procedures for cross-border transactions in ACH systems, check collection systems, and wire transfer systems.

The Agencies requested comment on all aspects of the proposed rule, as well as detailed questions regarding specific aspects of the rule within each section.

Overview of Public Comments

The Agencies received comments from about 225 members of the public, including approximately 125 consumers, 40 depository institutions and associations thereof, 20 gambling-related entities, 10 public-policy advocacy groups, 10 payment system operators and money transmitters, and 20 others, including Federal agencies and members of Congress.^[4] In addition to the following overview, specific comments are discussed in more detail in the portions of the section-by-section analysis that describe particular provisions.

Comments related to the Act. About 65 commenters directly addressed the Act itself. Of these, approximately 35 commenters, almost all consumers, expressed disapproval of the Act. Consumers generally thought that the Act represents an inappropriate governmental intrusion into the personal choices that individuals make and that the government should not devote resources attempting to prevent Internet gambling. A portion of these commenters further noted that the government might wish to legalize, regulate, and tax Internet gambling, thereby helping provide appropriate safeguards and protections for consumers while also potentially increasing the government's revenues. Conversely, about 20 commenters, about evenly split between consumers and public-policy advocacy groups, expressed support for the Act on the grounds that gambling causes harm. These commenters noted that gambling via the Internet is of particular concern because it is anonymous and can be done within the home at any time of day or night. Additionally, about 10 commenters expressed concern that the Act will exacerbate the U.S.'s difficulties with the World Trade Organization (WTO) related to Internet gambling, and suggested that the Agencies refrain from implementing the Act until the related WTO matter is resolved.^[5] The Agencies believe that these comments relate to the public policy issue of the merits of the Act itself and are outside the rulemaking process. The Agencies' duty is to carry out their responsibilities to promulgate implementing regulations required by the Act and that is the focus of this rulemaking.

Comments related to the proposed rule. About 20 commenters, almost all of them depository institutions and associations of depository institutions, noted that notwithstanding the Agencies' efforts to craft a reasonable rule, the proposed regulation would be unduly burdensome and would result in compliance costs greater than any offsetting societal benefit. Several of these commenters stated that the rule would adversely affect the competitiveness of the U.S. payments system, and that the Agencies should be cognizant of the potential for the Act and similar laws to cumulatively cause capital flight and erode the U.S. dollar's status as the world's reserve currency. More broadly, these commenters also questioned whether the payments system is the appropriate mechanism by which to enforce prohibitions on Internet gambling. Some of these commenters argued that the responsibility for enforcing gambling laws should lie with Federal and State law enforcement authorities and that, operationally, the preferable way to prevent unlawful Internet gambling may be for the government to work with telecommunications providers to impede gambling Web sites' access to the Internet.

About 50 commenters, primarily consumers and gambling-related entities, expressed concern regarding the rule's applicability to poker and similar games. These commenters referred to the definition of “bet or wager,” and argued that poker is a game predominantly of skill and should be excluded from the scope of the definition.

About 30 commenters, primarily depository institutions and associations thereof, as well as a few members of Congress and gambling-related entities, expressed concern regarding the proposed rule's definition of “unlawful Internet gambling.” Banks stated that the definition's lack of specificity would result in higher costs associated with complying with the rule. Some members of Congress and gambling-related interests found the vagueness of the definition to be so problematic as to raise free-speech, fundamental-fairness, and Administrative Procedure Act concerns.

About 40 commenters responded to the Agencies' request for comment on whether to incorporate within the rule a list of unlawful Internet gambling businesses. About 35 commenters of various types—depository institutions and associations thereof, payment system operators and money transmitters, as well as public-policy groups—expressed support for such a list, generally on the grounds that it would reduce the cost of complying with the rule, but some of these commenters noted that the list might not prevent restricted transactions. About five commenters, all of which were payment system participants or associations thereof, opposed a list on the grounds that it would not be effective.

II. Final Rule

Overview

After carefully considering the comments, the Agencies have adopted a final rule to implement the Act. In accordance with the Act, the Agencies have consulted with the Department of Justice during the development of the final rule. The Agencies also conducted further outreach to gather information on the issues raised in the public comments.

The final rule shares some fundamental characteristics with the approach presented in the proposed rule. First, for example, the final rule retains the focus on a due diligence process in establishing and maintaining a commercial customer relationship as the core policy and procedure that the participants in designated payment systems other than card systems can choose to prevent or prohibit restricted transactions. As noted in the proposal, card systems are the only designated payment systems that use a merchant and transaction coding framework that permits participants to identify and block, during processing, transactions with indicia of being restricted transactions. The other designated payment systems could choose to conduct due diligence in account-opening procedures designed to ensure that the commercial customer does not originate or receive restricted transactions through the customer relationship. The final rule also continues to place the responsibility for such due diligence on the participant that is establishing or maintaining the customer relationship with the commercial customer. In response to comments on the proposed rule, as discussed in more detail below, a new subsection __.6(b) of the final rule provides additional guidance on due diligence steps participants can take for commercial customers to have reasonably designed policies and procedures to prevent or prohibit restricted transactions.

The Act requires the Agencies to provide non-exclusive examples of reasonably designed policies and procedures to prevent restricted transactions, rather than establishing an absolute prohibition on processing any restricted transactions. The Agencies recognize the challenge that participants in designated payments systems will face in trying to prevent restricted transactions without unduly burdening their processing of lawful transactions, which make up the vast majority of payments processed. The Agencies believe that flexible, risk-based due diligence procedures at account opening, such as those set out in the final rule, present the best option for balancing these two interests.

Similar to the proposed rule, the final rule does not contemplate that the Agencies, other government agencies, or any other entity will establish or publish a list of businesses known to be involved in unlawful Internet gambling. Although the Act does not require creation of a list of unlawful Internet gambling businesses, some commenters have suggested that the Agencies should create such a list and make it available to designated payment systems and their participants in order to permit them to block payments destined to those entities.^[6]

After carefully considering the public comments on this issue, the Agencies have concluded that such a list would not be effective or efficient. The first step in including a business on such a list would be to ensure that the particular business was, in fact, engaged in activities deemed to be unlawful Internet gambling under the Act. The Act, however, does not set out the precise activities that are covered by the term, but refers to activities that are unlawful under other Federal or State gambling laws for such determinations. Creating such a list would require the Agencies to formally interpret those laws that are written and enforced by other entities, such as State legislatures and law enforcement agencies. Accordingly, interpretations by the Agencies in these areas may not be determinative in defining the Act's legal coverage and could set up conflicts or confusion with interpretations by the entities that actually enforce those laws. In addition, the Agencies do not believe that a list of businesses that engage in unlawful Internet gambling would necessarily be effective or efficient in preventing unlawful activity because the payment transactions would not necessarily be made payable to the business's listed name.^[7] Even where the business's listed name is used on the transaction, some payment systems do not process the transaction based on the payee name.^[8] Also, to the extent that Internet gambling businesses can change their payments information with relative ease and speed, such a list would be outdated quickly. Finally, the Agencies believe that appropriate due diligence conducted by participants opening accounts would be the most effective method for preventing unlawful Internet gambling businesses from gaining access to the payment system directly through U.S. accounts. The suggested due diligence procedures discussed in this final rule are designed to target that relationship.

Moreover, the Act already provides for a course of action if government entities are aware of an unlawful Internet gambling Web site. The Act provides a procedure pursuant to which the U.S. Attorney General, State attorneys general, or other appropriate State officials may institute proceedings to have an unlawful Internet gambling Web site removed by the interactive computer service that provides access to that Web site.^[9] Accordingly, if government entities are aware of an unlawful Internet gambling Web site, the procedure provided by the Act for denying access to the Web site in its entirety could be used, rather than permitting access to the unlawful Internet gambling Web site to continue without interruption, while relying on the designated payment systems and their participants to block every transaction destined for the Internet gambling business operating the Web site.

Finally, the final rule, like the proposed rule, does not define “unlawful Internet gambling” beyond the Act's definition. Numerous commenters addressed the implementation and compliance problems created by the Act's definition of “unlawful Internet gambling” and requested that the Agencies provide greater clarity regarding this term.^[10] The Agencies carefully considered these comments, as well as the challenges of creating a regulatory definition of a term encompassing the various Federal and State laws affecting Internet gambling. After consulting with the Department of Justice and representatives from the offices of several State attorneys general regarding this issue, the Agencies have determined that a single, regulatory definition of “unlawful Internet gambling” would not be practical.^[11] The Act's definition of “unlawful Internet gambling” relies on underlying Federal and State gambling laws. The States have taken different approaches to the regulation of gambling within their jurisdictions and the structure of State gambling law varies widely, as do the activities that are permitted in each State. Accordingly, the underlying patchwork legal framework does not lend itself to a single regulatory definition of “unlawful Internet gambling.” The Agencies have attempted to address the payments industry's desire for more certainty that would result from a precise regulatory definition of “unlawful Internet gambling” through the due diligence guidance provided in __.6(b). The suggested due diligence process relies on State regulation of Internet gambling and imposes the burden of proof of legality of Internet gambling activities on the gambling business, rather than the designated payment systems and their participants.

As discussed in detail below, the Agencies have modified the rules in various respects in response to the comments received. Identical sets of the final rules are being adopted by the Board, to be published in Title 12 of the Code of Federal Regulations, and by the Treasury, to be published in Title 31 of the Code of Federal Regulations.^[12] The section numbers used in the analysis below have not changed from the proposed rule, but the subsection numbers may have changed because subsections have been added, deleted, or rearranged in response to public comments.

Effective Date

In the NPRM, the Agencies proposed that the final rule should take effect six months after the joint final rule was published, and requested comment on whether this period was reasonable. Some commenters, representing members of Congress, sports leagues, or gambling-related entities, suggested that six months was either an adequate implementation period or was too long. One or more of these commenters stated that they did not understand why participants would not be able to implement the final rule promptly, expressed concern about the harm a delayed effective date would have on certain gambling interests, and referenced the statutory deadline for the promulgation of a rule.^[13] Most commenters representing the financial industry suggested that this period was insufficient for financial transaction providers to develop and implement the necessary policies and procedures. In designated payment systems with operators, such as the ACH systems and the card systems, commenters were concerned that participants would have to wait until the operators developed and announced their policies and procedures before developing their own policies and procedures.^[14] These commenters suggested various periods for an adequate implementation period, ranging from 12 months to 24 months.

The Agencies have reviewed these comments and the concerns expressed about a delayed effective date, as well as the reasons given for the need for additional time. In response, the Agencies have decided to make the final rule effective approximately 60 days from the date of publication of the final rule in the Federal Register, and to establish a compliance date approximately 12 months from publication of the final rule.^[15]

Given the changes in the non-exclusive examples of policies and procedures which, if followed, would result in a reduction of compliance burden from the proposed rule to the final rule, the Agencies believe that non-exempt participants in designated payment systems certainly should not require more than 12 months to design and implement the necessary policies and procedures.^[16] The Agencies also believe, however, that the commenters have adequately demonstrated that six months may not be sufficient time for complying with the final rule. Accordingly, the final rule includes a compliance date of December 1, 2009, approximately 12 months from the date of publication of the final rule in the Federal Register.

Section-by-Section Analysis

§ __.1 Authority, Purpose, and Incorporation by Reference

The Agencies did not receive any comments that explicitly requested changes to this section; however, the final rule does include three changes. First, subsection __.1(a) has been revised to clarify that the final rule, consistent with the Act, is not intended to affect or interpret the interaction between existing Federal or State statutes, such as the Interstate Horseracing Act of 1978 (15 U.S.C. 3001 et seq.) (IHA), and other Federal statutes. Specifically, as set out in subsection __.1(a), the Act states that none of its provisions shall be construed as altering, limiting, or extending any Federal or State law or Tribal-State compact prohibiting, permitting, or regulating gambling within the United States.^[17] In addition, the Act states that its provisions are not intended to change the existing relationship between the IHA and other Federal statutes in effect on October 13, 2006, the date of the Act's enactment, and are not intended to resolve any existing disagreements over how to interpret the relationship between the IHA and other Federal statutes.^[18] The final rule is intended to be consistent with these provisions and should not be construed to affect or interpret the interaction between the various underlying Federal and State statutes or Tribal-State compacts.

Second, a new subsection __.1(c) has been added and states that requirements for the collection of information in the final rule have been approved under the Paperwork Reduction Act for the Department of the Treasury by the Office of Management and Budget (OMB) and by the Board pursuant to authority delegated to the Board by OMB. Finally, the reference to the automated clearing house rules incorporated by reference into the final rule has been updated to reflect the 2008 rules published by the National Automated Clearing House Association (NACHA). For purposes of this final rule, there are no material differences between the 2008 NACHA rules and the 2007 NACHA rules that were incorporated by reference in the proposed rule. The Agencies will continue to update the reference to new rules issued by NACHA as appropriate if there are changes in the rules that are material to application of the final rule.

§ __.2 Definitions

In general. In response to comments, the final rule contains several new or modified defined terms. As an initial matter, lead-in language for the entirety of § __.2 was added to clarify that the definitions set out in the final rule are intended for use only with respect to the final rule and are not intended to be used in other contexts.

§ __.2(a) Actual knowledge. The proposed rule included examples of remedial actions that a non-exempt participant could choose to take if it “becomes aware” that a commercial customer received restricted transactions through the participant's facilities or a foreign counterparty “is found to have” processed restricted transactions through the participant's facilities. Commenters objected to these terms as too vague to provide a basis for compliance programs and suggested that they should be replaced with more precise terms that could be implemented by compliance personnel and examined by regulators.^[19] In response to these comments, a new definition for the term “actual knowledge” was added for use in the remedial action provisions of § __.6. As described in more detail below, the Agencies revised the remedial action examples to include an “actual knowledge” standard similar to what some commenters suggested.^[20] As used in the final rule, the term “actual knowledge” includes information regarding a particular transaction or commercial customer that is known by or brought to the attention of compliance personnel of the participant responsible for that transaction or customer (which may be below officer level) or any officer of the participant. The Agencies expect that an employee at the officer level of a participant should be responsible for forwarding the information to the proper personnel within the organization.

§ __.2(c) Bet or wager. The proposed rule contained a definition of the term “bet or wager” which followed the definition for that term contained in the Act.^[21] Specifically, the proposed rule defined the term, in pertinent part, to mean the staking or risking by any person of something of value upon the outcome of, among other things, “a game subject to chance, upon an agreement or understanding that the person or another person will receive something of value in the event of a certain outcome.” ^[22] Similar to the Act, the proposed rule did not define gambling-related terms such as “game subject to chance.” The Agencies explained in the proposed rule that it was their preliminary view that issues regarding the scope of gambling-related terms should be resolved by reference to the underlying substantive State and Federal gambling laws and not by a general regulatory definition. The Agencies received about 40 comments related to the meaning of the term “game subject to chance.”

Commenters requested that the Agencies clarify that Congress did not intend for the Act to block lawful gaming transactions such as skill games, that the definition of “unlawful Internet gambling” does not include skill games, and that the system designed to stop the flow of funds to unlawful Internet gambling operations does not include businesses operating skill games on the Internet.^[23] Commenters also suggested application of a dominant factor test as a means of distinguishing a skill game from a game subject to chance.^[24] Commenters asserted that, under the dominant factor test, a game whose outcome is determined predominantly by chance would be a game subject to chance, and a game whose outcome is determined predominantly by skill would be a skill game not covered by the Act or the regulation.^[25] Commenters also stated that “subject to chance” is meant to cover games like roulette or slots where persons bet against the “house” and success is determined entirely by chance as opposed to games where individuals compete against one another with success over time being determined by skill.^[26] Commenters also asserted that poker is a game of skill and not of chance.^[27] Other commenters asserted that games like traditional poker and bridge are games subject to chance based on the “luck of the draw” via the random shuffling and dealing of cards.^[28] These commenters asserted that unlike traditional poker and bridge, games like duplicate poker and duplicate bridge are skill games, because the luck of the draw is completely eliminated.

The Agencies believe that the characterization of each of the activities discussed above depends on the specific facts and circumstances. As noted above, the Agencies believe that questions regarding what constitutes unlawful Internet gambling should be resolved pursuant to the applicable Federal and State gambling laws. While there may be some games or contests conducted over the Internet that are not “games subject to chance” and, thus, not subject to the Act and the final rule, the Agencies believe that such issues are more appropriately resolved pursuant to the various underlying gambling laws than with a single regulatory definition.

The Agencies note, however, that a careful reading of the statutory language of the Act may be instructive in discerning Congressional intent regarding what constitutes a “game subject to chance.” The Act defines the term “bet or wager” as including a “game subject to chance.” ^[29] However, the Act also defines the term “bet or wager” as including the purchase of a chance or opportunity to win a lottery or other prize (which opportunity to win is predominantly subject to chance).” ^[30] The fact that Congress used “subject to chance” in one paragraph and “predominantly subject to chance” in the next paragraph in the same subsection suggests that Congress intended the element of chance in “game subject to chance” to be less than predominant. The Agencies believe that if Congress had intended chance to be the predominant factor in determining the outcome of a “game subject to chance,” Congress would have inserted the word “predominantly” as it did subsequently in the same section. Therefore, even if chance is not the predominant factor in the outcome of a game, but was still a significant factor, the game could still be deemed to be a “game subject to chance” under a plain reading of the Act.

One commenter suggested that the Agencies consider developing a procedural mechanism by which Internet gambling businesses may apply for and obtain a certification from the Agencies that the Internet gambling businesses are engaged in lawful Internet gambling under applicable Federal and/or State law.^[31] The Agencies have decided against implementing such a certification process. Instead, the nonexclusive policies and procedures contained in the final rule and discussed further below provide for an analogous procedural mechanism whereby the responsibility of determining which gambling activities are lawful is retained with the authorities enforcing the underlying gambling laws. Specifically, participants in designated payment systems may choose to follow the due diligence process in § __.6(b) of the final rule's non-exclusive examples whereby they can rely on licenses issued by the appropriate gambling authorities as evidence that a commercial customer's Internet gambling activities are lawful. If a commercial customer does not have such a license, the participant may request that the unlicensed Internet gambling business provide a reasoned legal opinion that it does not engage in restricted transactions. If a participant has questions or concerns regarding the reasoned legal opinion, it should verify (or have the commercial customer verify) the conclusions presented in the reasoned legal opinion with the appropriate licensing authority.

§ __.2(d) Block. A new definition for the term “block” was added to the final rule in response to comments that suggested that there was confusion among participants over the meaning of the term.^[32] This term is used in the Act and the proposed rule imported it from the statutory language. As defined in the final rule, the term “block” means to reject a transaction before or during processing and is not intended to require freezing the funds. The funds would remain in or be returned to the original account and could be accessed by the accountholder for other purposes.

§ __.2(f) Card system. The final rule includes revisions to the definition of “card system” included in the proposed rule in response to a comment that requested that the definition be clarified to cover both a card system model in which the merchant acquirer, the card network, and the card issuer are separate entities, as well as a model in which one company (such as American Express) owns the card processing network and is responsible for two or more major functions involved in issuing cards and acquiring merchants to accept the cards.^[33] The NPRM discussed both card system models and the proposed rule made no distinction between the two.^[34] In order to remove any ambiguity, the final rule clarifies that both models are covered by the term “card system” in the final rule.

§ __.2(i) Commercial customer. A new definition for the term “commercial customer” was added to the final rule in response to comments that suggested that the final rule should clarify that the regulation was focused on due diligence procedures relating to commercial customers, rather than consumer accounts.^[35] As noted above, other than for payment systems with a transaction coding functionality, the Agencies are suggesting that the efforts of participants in designated payment systems be focused on preventing restricted transactions primarily through due diligence on commercial customers. The Agencies have revised the provisions of the regulation to provide more clarity on this point. To facilitate this, a definition of the term “commercial customer” was added to the final rule.

§ __.2(o) Foreign banking office. A new definition of the term “foreign banking office” was included in the final rule for use in the remedial action provisions in § __.6 for cross-border transactions. The definition clarifies that a foreign office of a U.S. bank and a non-U.S. office of a foreign banking organization are both considered a “foreign banking office” for purposes of the final rule. The non-exclusive examples of reasonably designed policies and procedures include special provisions with respect to transactions and relationships between a U.S. office of a participant in a designated payment system and a foreign banking office. The new term for “foreign banking office” was included to facilitate those provisions.

§ __.2(r) Internet gambling business. The final rule includes a new definition of the term “Internet gambling business” to facilitate use of the expanded example of due diligence of commercial customers. (Under the due diligence example, a participant would assess the risk of a customer being engaged in an “Internet gambling business” and would take certain steps based on that assessment.) The term contains elements of the Act's definition of the term “unlawful Internet gambling,” but includes both lawful and unlawful activities. The new term excludes the customary activities of a financial transaction provider, or any interactive computer service or telecommunications service, similar to the Act's exclusions from the term “business of betting or wagering.”

§ __.2(v) Operator. Some commenters requested clarification of the exemptions and responsibilities of different participants in a payment system under the examples of reasonably designed policies and procedures to prevent restricted transactions.^[36] The final rule defines the term “operator” of a designated payment system to mean an entity that provides centralized clearing and delivery services between participants in the designated payment system and maintains the operational framework for the system and includes an ACH operator as defined in the NACHA rules. This definition works in conjunction with the clarifying changes to the exemptions and revisions, discussed below. For example, the operator of a money transmitting business is responsible for establishing the policies and procedures, while in an ACH system, the operator is generally granted an exemption.

§ __.2(x) Reasoned legal opinion. The final rule includes a new definition for the term “reasoned legal opinion” to facilitate use of the expanded due diligence guidance that has been added to § __.6(b). As explained in more detail below, in certain situations, a participant may ask a commercial customer for a “reasoned legal opinion” that its Internet gambling business does not involve restricted transactions. The Agencies added this term to provide more guidance on the type of legal opinion that would be considered adequate. The definition is based in part on the American Bar Association standards for a legal opinion.^[37]

§ __.2(y) Restricted transaction. Several commenters asked the Agencies to clarify that the definition of “restricted transaction” would not apply to funds going to a consumer (i.e., a gambler), as opposed to funds going to a commercial customer (i.e., an Internet gambling business).^[38] The Act defines “restricted transaction” in § 5362(7) as “any transaction * * * which the recipient is prohibited from accepting under section 5363.” In turn, § 5363 provides that “[n]o person engaged in the business of betting or wagering may knowingly accept” a payment “in connection with the participation of another person in unlawful Internet gambling.” Under the final rule, the term “restricted transaction” would not include funds going to a gambler, and would only include funds going to an Internet gambling business.

§ __.2(aa) Third party processor. A new definition for the term “third party processor” was added to the final rule in response to comments that suggested the final rule should clarify the responsibilities of processors under the Act.^[39] The new definition clarifies that a processor with a direct customer relationship with the originator of a debit transfer transaction or the receiver of a credit transfer transaction, and which acts as an intermediary between the originator (or receiver) and the depository institution is a “third party processor” and covered by the regulation. A processor providing back-office support to a depository institution is not covered by the final rule, but the depository institution should ensure that such a processor complies with the depository institution's policies. The term “third party processor” has also been added to the definition of “participant in a designated payment system” and, as discussed in § __.6, “third party processors” are responsible for establishing reasonably designed policies and procedures in certain circumstances.

§ __.3 Designated Payment Systems

The final rule's list of designated payment systems subject to the regulation differs from the list presented in the proposed rule only with respect to the designation for money transmitting businesses. The proposed rule included the definitions of “money transmitting business” and “money transmitting service” set out in the Act. The proposed rule designated “money transmitting businesses” as payment systems subject to the regulation. Commenters noted that, as defined in the Act, “money transmitting business” included check cashers, currency exchangers or entities which issue or redeem money orders or travelers checks.^[40] For purposes of the Act, the Agencies do not believe that entities should be brought under the final rule's designation of “money transmitting business” and become subject to the final rule's provisions solely by virtue of engaging in check cashing, currency exchange, or the issuance or redemption of money orders, travelers' checks, and other similar instruments. Such activities could not be used for Internet gambling on an efficient basis. Accordingly, in order to address this comment, the Agencies revised the designation to read money transmitting businesses solely to the extent that they “engage in the transmission of funds, which does not include check cashing, currency exchange, or the issuance or redemption of money orders, travelers' checks, and other similar instruments.” Entities that would be included in the statutory term “money transmitting business” solely by virtue of engaging in check cashing, currency exchange, or the issuance or redemption of money orders, travelers' checks, and other similar instruments, but without engaging in the transmission of funds, would not be a participant in a designated payment system under the final rule.

After reviewing comments and conducting further outreach, the Agencies have also revised the designation to include only those money transmitting businesses that engage in the transmission of funds and permit customers to initiate money transmission transactions remotely from a location other than a physical office of the money transmitting business.^[41] Money transmitting businesses that require senders to come to a physical office location to initiate transactions would not be attractive payment arrangements through which Internet businesses, including Internet gambling businesses, could obtain payments from the general public. The Agencies do not believe that such arrangements could reasonably be used for Internet gambling on a scale that would be useful or efficient for the Internet gambling business due to their lack of broad public accessibility. The Agencies believe that money transmitting businesses that do not permit remote initiation of transactions, such as through a website, are primarily focused on serving a narrow population or geographic area, such as would be the case in arrangements where a particular population in the United States is sending money to relatives in their home country.

A few commenters cited “900-number” payment schemes, and, while not providing any information regarding how these schemes work, requested that the Agencies look into them and ensure they are covered by the regulation as appropriate.^[42] The Agencies have researched these schemes and believe that the schemes would fit the Act's and rule's definition of a money transmitting business if located within the United States. Operators of the 900-number schemes appear to use either a card payment or an ACH debit to obtain funds from the payor (the caller) and, separately, to use either a check or an ACH credit to send funds to the payee (the merchant that subscribes to the 900-number service, i.e., the entity receiving the 900-number call). The model appears analogous to that employed by PayPal (which identifies itself as a money transmitting service, and has obtained numerous Federal and State licenses in that regard), except that the operator of the 900-number scheme uses the phone network instead of the Internet for communications purposes, and uses phone numbers instead of email addresses to identify payors and payees using the system. Accordingly, such schemes located in the United States would be included in the money transmitting business designated payment system set forth in § __.3(d) of the rule, and non-exempt participants in these systems, such as the operator, would be expected to adopt policies and procedures reasonably designed to prevent or prohibit restricted transactions if located in the United States.

§ __.4 Exemptions

In general. Under the proposed rule, in designated payment systems other than card systems, the primary responsibility for establishing reasonably designed policies and procedures to prevent restricted transactions was placed on the participant that established and maintained the customer relationship with the commercial recipient of the funds (i.e., the Internet gambling business). The proposed rule provided exemptions for other specified participants in the ACH, check clearing, and wire transfer systems. Commenters noted that, while listing the exempt participants in each designated payment system may be the functional equivalent of exempting all participants except for the participant with the customer relationship with the Internet gambling business, it could define the exempt participants too narrowly.^[43] In a payment transaction, there may be numerous intermediary servicers that do not have access to information on the commercial recipient and should be exempted. In addition, as commenters noted, as payment systems evolve, new intermediary participants could enter the transaction stream, but not be exempted because they were not specifically listed in § __.4. Commenters recommended reworking the text of § __.4 to make it clear that all participants in designated payment systems are exempt, except for the participant that possesses the customer relationship with the Internet gambling business. In response to these comments, § __.4 has been revised to exempt every participant in a designated payment system, except the participants that have specific responsibilities in the non-exclusive examples in § __.6, which, in most cases, will be the participant with the relationship with the commercial customer.^[44] Various participants would have responsibilities under the non-exclusive examples for card systems in § __.6 if card systems and their participants choose to adopt them.

§ __.4(a), (b), and (d) Exemptions for ACH, check, and wire systems. Some commenters suggested that the final rule should provide a blanket exemption for ACH, check collection, and wire transfer systems in their entirety because these systems, unlike card systems, do not have the functionality necessary to code transactions and merchants.^[45] While such an approach would certainly reduce the burden of the rule, it would substantially undermine the efficacy of the rule and the Act. Moreover, the final rule's non-exclusive examples for ACH, check collection, and wire transfer systems do not contemplate that non-exempt participants would identify individual transactions as restricted transactions. Rather, the final rule's non-exclusive examples contemplate that a participant would conduct risk-based due diligence of commercial customers at account opening, and when it has actual knowledge that a commercial customer is engaged in an Internet gambling business, to determine the risk the commercial customer presents of engaging in restricted transactions.^[46] The Agencies believe that this approach is reasonably practical for non-exempt participants in the ACH, check collection, and wire transfer systems and, accordingly, that a blanket exemption for these systems in their entirety would not be appropriate under the Act.

Some commenters suggested exempting all U.S. participants processing cross-border transactions, because these participants do not have a direct customer relationship with Internet gambling businesses located abroad.^[47] The final rule exempts U.S. participants processing outbound cross-border credit transactions (i.e., ACH credits and wire transfers) because there are no reasonably practical steps that a U.S. participant could take to prevent their consumer customers from sending restricted transactions cross-border.^[48] Specifically, the automated systems associated with ACH credit and wire transfers do not typically include information that would allow U.S. participants to identify and block restricted transactions. The Agencies also considered a process described in the NPRM that would involve customers describing the nature of the transaction and/or stating whether the transaction involves Internet gambling. However, the Agencies determined that such a process would be unduly burdensome for U.S. participants with little corresponding benefit because U.S. customers may mischaracterize the nature of the transaction and the participant would generally be unable to determine whether the customer's characterization of the transaction is accurate. As discussed in greater detail below, however, the final rule does not exempt U.S. participants receiving cross-border debit transactions (i.e., ACH debits and check collections). Also, there are no exemptions for cross-border transactions in card systems.

Exemptions for certain card systems. One commenter suggested that the final rule should exempt gift cards entirely from the regulation and exempt stored-value cards or, at a minimum, exempt stored value cards below a threshold amount.^[49] The commenter stated that such cards have not previously been subject to government regulation and such card systems do not have policies and procedures in place to track or limit the type of use of the card by the purchaser.^[50] The commenter also stated that the burden of imposing a new regulation on entities acting as a card system operator, a merchant acquirer, or a card issuer is likely to be substantial. The Agencies considered this comment, but determined that the concerns were addressed by the final rule. The final rule's non-exclusive examples for card systems are based on coding frameworks that have already been instituted by the operators of the major “open” card systems, such as Visa, MasterCard, and American Express. If a card system is a “closed loop” system, the cards can only be used at the merchants belonging to the “closed loop” system. So long as Internet gambling businesses cannot accept these cards, the burden of this rule would be minimal, although the non-exempt participants in these systems would still have to comply with the rule's requirement to have reasonably designed policies and procedures in place. Accordingly, the Agencies determined that a blanket exemption for stored value products and gift cards was not appropriate.

Another commenter questioned the application of the proposed rule to co-branded cards, where a depository institution issues the card, but a non-depository institution, such as a securities firm, has its name on the card.^[51] According to the commenter, the cards are usually issued to customers of the non-depository institution, but, in some co-branded card arrangements, the non-depository institution may assist the card issuer in certain aspects of the program, such as performing sub-accounting, issuing statements and providing authorization services, under a servicing contract with the card issuer. The commenter argued that a securities firm should not be regarded as a participant in the card system simply because its name appears on the card or the securities firm provides services to the card issuer in support of the program. The Agencies believe that the final rule's non-exclusive examples for card systems address these types of situations. The non-exclusive examples for card systems contemplate the implementation of a code system, such as transaction codes and merchant/business category codes to accompany the authorization request for a transaction. The code system should provide the operational functionality to enable the card system operator or the card issuer to reasonably identify and deny authorization for a transaction that the coding procedure indicates may be a restricted transaction.

With respect to the commenter's question regarding the responsibilities of the co-branding securities firm under the non-exclusive examples for card systems in § __.6, the answer would depend on the facts presented. If the card issuing bank receives the transaction authorization request with the required codes, it should implement its policies and procedures to deny authorization for a transaction with codes that indicate it may be a restricted transaction, without any involvement by the non-depository institution with its name on the card. If the card issuing bank has contracted with the co-branding non-depository institution to process authorization requests, the card issuing bank is responsible for ensuring that the co-branding non-depository institution is properly following the card issuing bank's policies and procedures regarding restricted transactions.

§ __.4(c) Money transmitting business. The proposed rule did not contain any exemptions for participants in a money transmitting business. Commenters suggested that “send” agents of money transmitting businesses should be exempted from the rule's requirements because, like the originating institution in an ACH credit or a wire transfer, the “send” agent does not have a direct relationship with the commercial customer receiving the funds transmission and would not be in a position to collect information to identify restricted transactions.^[52] In response to these comments, the Agencies have determined to exempt all send agents in a money transmitting business. In fact, the final rule includes an exemption for all participants in a money transmitting business, except for the operator. If an entity acted as both a send agent and the operator in a money transmitting business, the entity would not be exempted from the final rule by virtue of acting as the operator.

§ __.5 Policies and Procedures Required

§ __.5 Section title. In the proposed rule, the title of § __.5 was “Processing of restricted transactions prohibited.” One commenter suggested that the title of § __.5 in the proposed rule be revised to more accurately reflect what the section actually does.^[53] In fact, the requirement in § __.5 is to establish and implement reasonably designed policies and procedures to identify and block or otherwise prevent or prohibit restricted transactions, rather than impose a strict liability standard. The title of § __.5 in the final rule has been revised accordingly to read “Policies and procedures required.”

§ __.5(b) Reliance on system policies and procedures. The proposed rule incorporated the Act's provisions permitting a participant in a designated payment system to comply with the Act's requirement to establish policies and procedures by relying on and complying with the policies and procedures of the designated payment system if the system's policies and procedures complied with the requirements of the regulation. This would likely be applicable to operator-driven systems, such as card systems. The Act does not indicate how a participant is to determine whether a system's policies and procedures comply with the regulation, and yet, makes such a determination a requirement for compliance under this provision. Commenters noted the significant problems and burden that would be imposed on participants in determining whether a system's policies and procedures complied with the regulation in order to rely on them.^[54]

In response to these comments and to provide participants with a bright-line standard for knowing when they could rely on this provision for compliance with the regulation, the Agencies revised the rule to expressly permit participants in a designated payment system to rely on a written statement or notice by the operator of the designated payment system to its participants that states that the operator has designed or structured its policies and procedures to comply with the regulation. Such a statement or notice will be deemed to provide a justifiable basis for the participant to assume that the system's policies and procedures comply with the requirements of the final rule, unless and until the participant is notified otherwise by the Federal agency that has enforcement authority over that participant under § __.7. The Agencies anticipate that such a statement or notice will provide a common understanding for all parties (i.e., the system operator, the other participants, and the regulator) that the Federal functional regulators will review the operator's policies and procedures and that the participants, many of which may be small businesses, will not be criticized by the regulators if they comply with the operator's policies and procedures, even though the regulators may subsequently deem the operator's policies and procedures to be deficient. If, upon review, the regulators determine that the operator's policies and procedures are deficient under the regulation, the Agencies expect that the regulators will work with the operator to correct the deficiency. If the operator is unable or unwilling to correct the deficiency, the Agencies expect that the regulators or the system operator would notify the participants that they can no longer rely on the operator's policies and procedures.

§ __.5(d) Liability protection. As noted in the NPRM, the proposed rule imported the Act's provisions protecting persons from liability for identifying and blocking, preventing or prohibiting the acceptance of its products or services in connection with a transaction, or otherwise refusing to honor a transaction if (i) the transaction is a restricted transaction, (ii) such person reasonably believed the transaction to be a restricted transaction, or (iii) the person is a participant in a designated payment system and prevented the transaction in reliance on the policies and procedures of a designated payment system, in an effort to comply with the regulation. Some commenters suggested that the final rule expand these provisions to provide protection from liability in specific scenarios.^[55] The Agencies considered these comments, but do not believe that expanding the liability protections in the regulation is appropriate. The Act's liability protection provisions address liability to a counterparty that may arise under other statutes (such as State commercial laws) from the failure of a participant in a designated payment system to complete a transaction. The Agencies do not believe that the Act authorizes them to expand or modify, by regulation, the scope of the protection from liability that the Act itself provides with respect to these other statutes.^[56] The liability protection provisions in the final rule are limited to application of the final rule. The scope of the Act's liability protection with respect to other statutes should be determined by the entities that enforce those statutes. Accordingly, the final rule retains the scope of the liability protection provisions from the proposed rule.

§ __.5(e) Overblocking. The Act requires that the Agencies ensure that transactions in connection with any activity excluded from the Act's definition of “unlawful Internet gambling” are not blocked or otherwise prevented or prohibited by the prescribed regulations (the “overblocking provision”).^[57] As noted in the NPRM, the proposed rule implemented this provision by making clear that nothing in the regulation requires or is intended to suggest that participants should block or otherwise prevent or prohibit any transaction in connection with any activity that is excluded from the definition of “unlawful Internet gambling” in the Act. In the NPRM, the Agencies noted that they believed that the Act does not provide the Agencies with the authority to require designated payment systems or participants therein to process any gambling transactions if the system or participant decides for business reasons not to process such transactions.

Some commenters agreed with the Agencies' approach to the overblocking provision presented in the proposed rule.^[58] One commenter noted that any regulation that would require participants in designated payment systems to process certain types of transactions would “significantly alter the business practices of many financial transaction providers—including the issuers of significant numbers of payment cards who currently routinely decline authorization for all transactions on U.S.-issued cards coded as Internet gambling transactions.” ^[59] Conversely, some commenters representing gambling interests argued that the final rule should clarify that transactions related to interstate pari-mutuel wagering are not unlawful and need not be blocked.^[60] Some commenters suggested that the final rule should require designated payment systems to create a new merchant category code specifically for gambling transactions that are not prohibited by the Act.^[61]

The Agencies continue to believe that the Act does not provide them with the authority to require designated payment systems or participants therein to engage in any particular line of business or process any particular transactions.^[62] While card system operators certainly may create new merchant category codes that are useful for specific transactions and industries, that is a business decision that those operators must make. Accordingly, the Agencies continue to believe that the proposed rule's language adequately addressed the Act's overblocking provision and that language has been retained in the final rule.

§ __.5(g) U.S. offices. Some commenters requested that the Agencies clarify that the scope of any final rule is limited to United States offices of participants in designated payment systems.^[63] The Agencies believe that the Act's restrictions apply only to transactions that are unlawful under applicable U.S. Federal or State law. The Act's definition of “unlawful Internet gambling” clearly states that it refers to a bet or wager that “is unlawful under any applicable Federal or State law in the State or Tribal land in which the bet or wager is initiated, received, or otherwise made.” ^[64] Transactions that are wholly outside the United States (i.e., when all parties and financial transaction providers to the transaction are outside the United States) would not violate such laws. As discussed below, while the Agencies expect U.S. participants to implement policies and procedures for certain cross-border transactions, the responsibility for implementing those policies and procedures would fall on the U.S. institution that handles the cross-border transaction. In order to provide the clarification requested by the comments, the final rule includes a new § __.5(g) that states that the regulation's requirement to establish and implement reasonably designed policies and procedures applies only to the U.S. offices of participants in designated payment systems.

§ __.6 Non-Exclusive Examples

Several commenters suggested that the final rule should clarify the Agencies' intent that the non-exclusive examples provided in the proposed rule were focused on relationships with commercial customers and not with respect to consumer accounts.^[65] The Agencies recognize the problems with designing and implementing procedures focused on consumer accounts. For example, except for card systems, a participant would generally not know the purpose of a consumer transaction and often the payee information on a transaction, such as a check, is not in automated form. In response to the comments requesting clarification on this point, as a general matter, the non-exclusive examples in § __.6 have been revised to make it clear in each instance that the policies and procedures to be implemented to prevent restricted transactions are with respect to commercial customer accounts only.

§ __. 6(b) Due diligence. As noted above and in the NPRM, most designated payment systems do not use formats that would permit participants to identify and block restricted transactions during payment processing.^[66] Accordingly, the proposed rule adopted the approach of using flexible, risk-based due diligence in the participants' account-opening and account-maintenance procedures for commercial customers to reduce the risk that the commercial customer would originate or receive restricted transactions through its commercial relationship with the participant. The proposed rule also suggested that participants could include as a term of a commercial customer agreement that the customer may not engage in restricted transactions.

Commenters raised several issues regarding these provisions. Commenters expressed concern that the guidance provided was not detailed enough.^[67] Commenters requested that the flexible risk-based due diligence approach described in the preamble to the NPRM be included in the final rule to facilitate participant compliance.^[68] Commenters also expressed concerns with including a term in a commercial customer agreement prohibiting restricted transactions because the commercial customer may not have the information necessary to determine whether a transaction is a restricted transaction. These commenters stated that revising millions of commercial customer agreements to include such a provision would be burdensome and impractical.^[69] Commenters suggested that commercial customers engaged in an Internet gambling business should demonstrate to their financial transaction providers that the commercial customers are not engaged in unlawful Internet gambling in order to shift the burden of distinguishing lawful from unlawful Internet gambling from the financial transaction providers to the Internet gambling businesses.^[70]

In order to provide more guidance on the due diligence procedures that the Agencies would deem reasonably designed, the final rule includes a new § __.6(b) that sets out a specific process that a non-exempt participant could choose to follow to conduct adequate due diligence of commercial customers with respect to the risk of unlawful Internet gambling. The non-exclusive examples for each designated payment system include a reference to the general due diligence provisions in this new section. The Agencies also believe that this due diligence process will help alleviate some of the concerns regarding the Act's definition of “unlawful Internet gambling.” While the process set out in § __.6(b) may still require some judgment on the part of participants opening new accounts for commercial customers, the process would leave the primary responsibility for determining what is lawful and unlawful gambling activity with the State gambling commissions and other gambling licensing authorities.

As noted in the NPRM, the Agencies anticipate that participants could choose to use a flexible, risk-based approach in their due diligence procedures in that the level of due diligence performed would match the level of risk posed by the commercial customer, and new § __.6(b) includes specific references to this type of approach. In addition, the most efficient way for participants to implement the due diligence procedures would be to incorporate them into existing account-opening due diligence procedures (such as those required of depository institutions under Federal banking agencies' anti-money laundering compliance program requirements).^[71]

As set out in new § __.6(b), the participant could choose to conduct due diligence at account opening and determine the risk of a commercial customer engaging in an Internet gambling business. The participant should have a basic understanding of a new commercial customer's business, based on normal account-opening procedures. The vast majority of commercial customers will not have any involvement in an Internet gambling business. If, based on its initial due diligence, the participant determines that the prospective commercial customer presents only a minimal risk of engaging in an Internet gambling business, the participant could open the account for the commercial customer without further action under § __.6(b).

One commenter suggested that the Agencies consider whether there are low-risk relationships for which due diligence would not be necessary.^[72] New subsection __.6(b)(4) states that a participant may deem the following commercial customers as presenting a minimal risk of engaging in an Internet gambling business without further investigation: (i) Entities that are directly supervised by the Federal functional regulators that are responsible for enforcing the Act; and (ii) agencies, departments, or divisions of the Federal government or a State government. With respect to supervised entities, the Federal functional regulators already review the activities of such entities and additional due diligence by participants in designated payment systems would be redundant.^[73] With respect to the activities of the Federal or State governments, participants should be able to assume that their activities are lawful.

Depository institutions that are non-exempt participants in designated payment systems and have commercial customers that are money transmitting businesses should apply their due diligence procedures to those customers. However, under the final rule, the money transmitting businesses would themselves be responsible for implementing their own policies and procedures with respect to their commercial customers. The depository institutions providing financial transaction services to the money transmitting businesses would not be responsible for assessing the risk that the money transmitting business's commercial customers engage in an Internet gambling business.

Under § __.6(b), the Agencies contemplate that a U.S. participant establishing a correspondent account for a foreign respondent would conduct appropriate, risk-based due diligence on the foreign respondent as a commercial customer to determine the risk the foreign respondent presents of engaging in an Internet gambling business. The Agencies expect that a participant would likely choose to incorporate such due diligence in its normal correspondent account opening procedures.^[74] For the purposes of the final rule, the Agencies would not expect U.S. participants to conduct due diligence on its foreign respondent's commercial customers. If a U.S. participant obtained actual knowledge that a foreign respondent's commercial customer processed restricted transaction through the U.S. participant's facilities, the Agencies expect that the U.S. participant would follow the applicable procedures for cross-border transactions discussed below.

If the commercial customer's description of its business or other factors cause the participant to suspect that it may present more than a minimal risk of engaging in an Internet gambling business (for example, the commercial customer offers games or contests over the Internet), the participant should ask for further documentation from the commercial customer. Certification from the commercial customer that it does not engage in an Internet gambling business would address factual questions regarding the commercial customer's business. If the commercial customer engages in an Internet gambling business, the participant should obtain further documentation to show that the Internet gambling business is lawful. The non-exclusive policies and procedures also provide for a participant to obtain a written commitment from a commercial customer to notify the participant of any changes in its legal authority to engage in its Internet gambling business. If a commercial customer has a license that expressly authorizes the customer to engage in the Internet gambling business issued by the appropriate State or Tribal authority, the participant should be able to rely on that State agency's ability to implement its own gambling laws in a manner that does not violate the law of another State or Federal law.

If the commercial customer does not have such a license, the Agencies expect that the participant would obtain from the commercial customer a reasoned legal opinion by the customer's counsel that demonstrates that the commercial customer's Internet gambling business does not involve restricted transactions. If a participant has questions regarding the permissibility of a commercial customer's activities, the participant should consult with (or have the commercial customer obtain confirmation from) the applicable licensing authority.^[75] In addition, the suggested due diligence process in § __.6(b) includes a third-party certification that the commercial customer's systems for engaging in the Internet gambling business are reasonably designed to ensure that the commercial customer's Internet gambling business will remain within the licensed or otherwise lawful limits, including with respect to age and location verification.

The Agencies expect that this provision will not only provide additional guidance to participants on an adequate due diligence process, but also will permit the entities that license gambling activities to retain the primary responsibility for determining which activities are permissible under U.S. law. The Agencies have designed the example of due diligence procedures to enable designated payment systems and their participants to rely on government licensing and enforcement agencies to determine whether a commercial customer's Internet gambling activities are lawful rather than trying to make that determination themselves. The designated payment systems and their participants should, however, obtain appropriate documentation from those entities regarding the legality of the Internet gambling activities of its prospective commercial customers.

The final rule retains the concept that participants in designated payment systems could communicate to their commercial customers that restricted transactions are prohibited. However, rather than suggesting that the only way to accomplish this goal is to include such a prohibition in the commercial customer agreement, the final rule provides that a participant could notify all of its commercial customers that restricted transactions are prohibited through a term in the commercial customer agreement, a simple notice sent to the customer, or through some other method.

§ __.6(d) and (f) Monitoring the Internet. As an example of reasonably designed policies and procedures for card systems and money transmitting businesses, the proposed rule included monitoring the Internet to detect unauthorized use of the relevant designated payment system, including its trademarks.^[76] The Agencies' intent with this example was to incorporate the existing practice of some participants in designated payment systems to proactively search (or retain a contractor to search) the Internet for unauthorized use of their trademarks, including by Internet gambling Web sites.^[77] When unauthorized use of a trademark was discovered, the payment system or participant could choose to take steps to seek its removal from the gambling Web site, including legal action if available.

While some payment industry commenters recognized the value of monitoring the Internet for abuse of trademarks, they also reported that reasonable efforts to protect their trademarks are not always successful.^[78] In addition, payment industry commenters objected to the proposed rule converting the right to protect a trademark “into an obligation under the Act.” ^[79] Commenters noted that legal action to protect trademarks can be costly and ultimately unsuccessful and criticized the proposed rule because it implied that such action was required.^[80] The Agencies believe that monitoring the Internet for unauthorized use of a payment system's trademark by Internet gambling businesses is a good practice and can be useful in preventing restricted transactions. However, the Agencies agree that designated payment systems and their participants should make a business decision on whether to pursue this activity and how to respond to discovered unauthorized use of their trademarks. Accordingly, in order to avoid confusion, the Agencies have deleted from the final rule the language regarding monitoring the Internet for unauthorized use of trademarks of designated payment systems or non-exempt participants. Of course, the examples in the rule are non-exclusive, and a system or participant may choose to include trademark monitoring in its policies and procedures where appropriate.

§ __.6(c), (d) and (f) Fines. In the non-exclusive examples of reasonably designed policies and procedures for ACH systems, card systems, and money transmitting businesses, the proposed rule included the imposition of fines if the participant becomes aware that restricted transactions had been processed. The Agencies' intent in including this provision was to suggest imposing fines on participants that violated system rules regarding unlawful Internet gambling.^[81] The proposed rule did not, however, adequately explain the specific functions that should be carried out by specific participants in a system, including how fines should be imposed.

The lack of specificity caused some confusion among commenters who suggested that the provision be dropped or that the terminology be revised.^[82] In the final rule, as a general matter, the Agencies have attempted to provide greater clarity to the specific procedures in the non-exclusive examples that are intended to apply to particular parties in the designated payment system. With respect to fines, the Agencies have deleted this provision from the final rule as potentially confusing, given the different relationships between parties within each designated payment system. As the examples in the rule are non-exclusive, a system or participant may choose to include fines in its policies and procedures where appropriate.

§ __.6(d) Card system examples. The proposed rule included as part of its non-exclusive examples of reasonably designed policies and procedures for card systems due diligence in establishing commercial customer accounts designed to ensure that the merchant will not receive restricted transaction through the card system, similar to provisions included in the non-exclusive examples for the other designated payment systems. The proposed rule's card system examples also included establishing transaction codes and merchant/business category codes that accompany the authorization request for a transaction and creating the operational functionality to enable the card system or the card user to identify and deny authorization for a restricted transaction. One card system commenter suggested that card systems should be permitted to comply with the Act through the use of either due diligence on merchants or coding to identify and block restricted transactions, but not necessarily both.^[83] The commenter cited the language of the Act that specifically identifies policies and procedures that allow a designated payment system and its participants “to identify restricted transactions by means of codes in authorization messages or by other means” and to block such transactions, as one of the acceptable ways that a payment system can comply with the Act.^[84]

The Agencies expect that a coding system to identify and block restricted transactions will be the method of choice for the vast majority of card system participants to comply with the Act. In addition, the Agencies note that most Internet gambling businesses that use card systems for funding do so through non-U.S. merchant acquirers that are not subject to the Act or the final rule and likely would not conduct due diligence regarding Internet gambling on their merchants. However, the final rule retains a due diligence example for closed loop card systems in the United States where the card can only be used for a single merchant or a limited group of identified merchants, such as merchants operating in a particular shopping mall. Section __.6(d) includes both the coding and due diligence examples for card systems as alternatives and contemplates that a card system and its participants could adopt either approach. Moreover, it is important to note that the examples in § __.6 are non-exclusive and a card system could adopt policies and procedures other than the coding and due diligence examples presented and still comply with the final rule's requirement to adopt reasonably designed policies and procedures to prevent or prohibit restricted transactions.

In addition, some commenters suggested that the final rule's non-exclusive examples should include a provision by which credit card companies would create a particular merchant category code that would be limited to those types of Internet gambling that are specifically excluded from the definition of the term “unlawful Internet gambling” in § __.2(cc)—intrastate transactions, intratribal transactions, and any activity that may be allowed under the Interstate Horseracing Act.^[85] While card system operators may choose to create new codes for such transactions, the Agencies believe that the establishment of codes for particular merchant transactions is a business decision for the card system operators and their participants. Accordingly, the final rule does not specify the establishment of such codes in the coding example for card systems.

§ __.6(c) and (e) Cross-border transactions. For the reasons discussed in the NPRM and above, the Agencies believe that it is very difficult, if not impossible, for a participant in the designated payment systems (other than card systems) to identify restricted transactions while they are being processed. As a result, the Agencies determined that the most efficient way to implement the Act for the systems other than card systems was through adequate due diligence by participants when opening accounts for commercial customers to reduce the risk that a commercial customer will introduce restricted transactions into the payment system in the first place.

With respect to cross-border transactions, however, the institution that opens the account for an Internet gambling business likely will be located outside the United States and not be subject to the Act. Accordingly, no U.S. participant would be able to conduct due diligence at account opening for the foreign commercial customer. The proposed rule provided examples of special procedures for participants in ACH, check collection, and wire transfer systems that received cross-border transactions from foreign counterparties, such as including as a term in its agreement with a foreign counterparty a requirement that the foreign counterparty have reasonably designed policies and procedures in place to ensure that the commercial relationship would not be used to process restricted transactions.^[86]

Commenters objected to the cross-border examples in the proposed rule on numerous grounds.^[87] Some commenters stated that including a term in agreements with foreign banks regarding restricted transactions was not practicable because it was unrealistic to expect foreign institutions to be willing or able to make specific representations with respect to restricted transactions, given the uncertain definition of “unlawful Internet gambling.” ^[88] In addition, commenters noted that the foreign correspondent with which the U.S. participant has a contractual relationship may itself be a correspondent several steps removed from the institution that has the customer relationship with the Internet gambling business and that it would be unrealistic to expect a provision in the cross-border agreement would be able to prevent restricted transactions.^[89] Commenters suggested that cross-border transactions conducted through correspondent relationships be entirely exempt from the regulation, or that notice to customers that the relevant payment system may not be used to engage in restricted transactions should be deemed a reasonably designed policy and procedure.^[90]

The comment letters illustrated many of the challenges in identifying and preventing particular types of transactions in the modern, global payment system. The Agencies agree that, with the complex framework of gambling laws in the United States, institutions in other countries will not reasonably be able to determine which transactions are unlawful under applicable U.S. law. Moreover, given the numerous intermediaries involved with a typical cross-border payment transaction, there will likely be many cases where the foreign correspondent from which a U.S. participant receives a cross-border debit transaction does not have a customer relationship with the Internet gambling business.

In response to the comments on the various cross-border transaction provisions, the Agencies have made revisions to the cross-border provisions in the final rule. First, the final rule contains non-exclusive examples with respect only to cross-border debit transactions (i.e., ACH debits and check collections) because there are no reasonably practical steps that a foreign counterparty could take to prevent a U.S. institution from sending a restricted transaction to the foreign counterparty, short of severing the relationship altogether. Second, the final rule contemplates that if a U.S. participant is notified by a U.S. government entity (such as its regulator or law enforcement) that it has been sent cross-border restricted transactions by a particular foreign respondent, the participant would be expected to notify its foreign respondent of the restricted transaction.^[91] The Agencies have included a model notice in the appendix to the regulation.

§ __.6 Remedial Action

Commenters urged the Agencies to provide more detailed guidance as to when non-exempt participants should take remedial action against their commercial customers for processing restricted transactions. These commenters stated that the proposed rule gave no specifics about what types of penalties are appropriate under particular circumstances.^[92] The Agencies considered these comments and determined that a non-exempt participant's decision on when to deny a commercial customer access to a particular payment system or when to close the account of such customer for processing restricted transactions is fact-specific and a matter of business judgment. As a result, the final rule does not contain thresholds specifying when it would be appropriate to take certain types of remedial action. When restricted transactions are discovered, the Agencies expect that a participant's regulator will review the remedial actions taken by the participant and come to a judgment as to whether the participant took appropriate action under the circumstances.

§ __.7 Regulatory Enforcement

The proposed rule essentially reiterated the regulatory enforcement framework from the Act. Some commenters urged that the financial regulators develop a uniform approach for enforcing the rule.^[93] The Act does not modify the statutory enforcement mechanisms of the agencies charged with enforcing the Act with respect to the institutions that are within their jurisdiction. The Federal agencies charged with regulatory enforcement authority for the final rule have different enforcement authorities and use different regulatory tools for fulfilling their supervisory responsibilities, so the Agencies do not believe that it is appropriate to mandate a particular uniform regulatory enforcement approach in the final rule. Moreover, the Board expects that examiner guidance will be developed among the Federal depository institution regulatory agencies responsible for enforcing the final rule, however, that process would occur separately from this rulemaking.

Another commenter noted that the Act's regulatory enforcement framework reflected in the proposed rule would subject money service businesses (MSBs) to the jurisdiction of two different agencies—the Federal Trade Commission for enforcement of the Act and the Internal Revenue Service, which elsewhere has been delegated authority to examine for compliance with the Bank Secrecy Act (BSA).^[94] The commenter suggested that the Agencies could determine that MSBs should be subject to the authority of only one regulator. The Agencies do not believe that the Act provides the Agencies with the authority to modify the regulatory authority of Federal agencies pursuant to the Act or any other statute.

After considering the public comments received on the proposed rule, the Agencies have not modified § __.7 from the proposed rule, other than technical conforming changes.

III. Administrative Law Matters

A. Executive Order 12866

It has been determined that this regulation is an economically significant regulatory action as defined in section 3(f)(1) of E.O. 12866, as amended. Accordingly, this final rule has been reviewed by the Office of Management and Budget. The reasons for this determination are explained in more detail in the Small Business Regulatory Enforcement Fairness Act Section B. The Regulatory Assessment prepared by the Treasury for this regulation is provided below.

1. Description of Need for the Regulatory Action

The rulemaking is required by the Act, the applicable provisions of which are designed to interdict the flow of funds from gamblers to unlawful Internet gambling businesses. To accomplish this, the Act requires the Agencies, in consultation with the U.S. Attorney General, to jointly prescribe regulations requiring designated payment systems (and their participants) to establish policies and procedures that are reasonably designed to identify and block or otherwise prevent or prohibit unlawful Internet gambling transactions restricted by the Act.

In accordance with the Act, section 3 of the final rule designates five payment systems that could be used in connection with, or to facilitate, unlawful Internet gambling transactions. The five designated payment systems are the same payment systems designated in the proposed rule, except that the Agencies have narrowed the designation of money transmitting businesses to cover only those money transmitting businesses that permit their customers to initiate fund transfers remotely from a location other than a physical office of the money transmitting business. As explained above, the Agencies' view is that money transmitting businesses that do not permit their customers to initiate remote funds transfers, such as through a Web site, could not reasonably be used for Internet gambling because of the lack of broad public accessibility. The Agencies believe that the narrowing of the money transmitting business designation will significantly reduce the number of money transmitting businesses affected by the final rule. The Agencies estimated in the proposed rule that the number of money transmitting businesses affected would be 253,208. The Agencies estimate that the number of money transmitting businesses affected by the final rule with the narrower designation and with the exemption described below will be 16, resulting in an estimated reduction of 253,192 money transmitting businesses affected by the final rule.

In accordance with the Act, section 5 of the final rule requires designated payment systems and participants in those designated payment systems to establish and implement written policies and procedures reasonably designed to identify and block or otherwise prevent or prohibit unlawful Internet gambling transactions restricted by the Act. In accordance with the Act, section 4 of the final rule exempts certain participants in designated payment systems from the requirement to establish and implement policies and procedures, because the Agencies believe that it is not reasonably practical for those participants to identify and block or otherwise prevent or prohibit unlawful Internet gambling transactions restricted by the Act. As explained earlier, the Agencies have expanded the exemptions in the final rule. For example, the proposed rule did not contain any exemptions for money transmitting businesses. At least one commenter recommended that the Agencies exempt “send” agents of money transmitting businesses by analogizing such “send” agents to the originating depository institutions for ACH credit and wire transfers which the Agencies exempted in the proposed rule. The final rule exempts all participants in money transmitting businesses, including “send” agents, except for the operator. In accordance with the Act, section 6 of the final rule contains a “safe harbor” provision by including non-exclusive examples of policies and procedures which would be deemed to be reasonably designed to identify and block or otherwise prevent or prohibit unlawful Internet gambling transactions restricted by the Act.

2. Assessment of Potential Benefits and Costs

a. Potential Benefits

Congress determined that Internet gambling is a growing cause of debt collection problems for insured depository institutions and the consumer credit industry.^[95] Further, Congress determined that there is a need for new mechanisms for enforcing Internet gambling laws because traditional law enforcement mechanisms are often inadequate for enforcing gambling prohibitions or regulations on the Internet, especially where such gambling crosses State or national borders.^[96] Section 5 of the final rule addresses this by requiring participants in designated payment systems, which include insured depository institutions and other participants in the consumer credit industry, to establish and implement reasonably designed policies and procedures to identify and block or otherwise prevent or prohibit unlawful Internet gambling transactions in order to stop the flow of funds to unlawful Internet gambling businesses. This funds flow interdiction is designed not only to inhibit the accumulation of consumer debt but also to reduce debt collection problems for insured depository institutions and the consumer credit industry. Treasury believes that the reduction of debt collection problems through the final rule's funds flow interdiction process will yield important benefits for insured depository institutions and consumers given the recent turmoil in the financial markets that is causing liquidity problems for insured depository institutions and constraining the availability of consumer credit. Moreover, the final rule carries out the Act's goal of implementing new mechanisms for enforcing Internet gambling laws. The final rule will likely provide other benefits. Specifically, the final rule could restrict excesses related to unlawful Internet gambling by underage or compulsive gamblers.

b. Potential Costs

Treasury believes that the costs of implementing the Act and the final rule are lower than they would be if the Act and the final rule were to require a prescriptive, one-size-fits-all approach with regard to regulated entities. First, section 5 of the final rule provides that a financial transaction provider shall be considered to be in compliance with the regulation if it relies on and complies with the written policies and procedures of the designated payment system of which it is a participant. This means that the regulated entities will not be required to establish their own policies and procedures but can instead follow the policies and procedures of the designated payment system, thereby resulting in lower costs. Based on public comments received, the Agencies have made it easier for regulated entities to choose to follow the policies and procedures of a designated payment system. Specifically, the proposed rule incorporated the Act's provision permitting regulated entities to rely on the policies and procedures of a designated payment system if the system's policies and procedures comply with the requirements of the regulation. In their comments, regulated entities expressed concern about the significant burden that would be imposed on them in determining whether a designated payment system's policies and procedures complied with the regulation, particularly when the payment system has thousands of participants and no single participant has any significant leverage with the payment system.^[97] In order to eliminate this burden and the associated costs, the final rule specifically states that regulated entities may rely on and treat as conclusive evidence a written statement or notice from a designated payment system that the system's policies and procedures comply with the final rule, unless such regulated entities are specifically notified otherwise by the appropriate Federal agency.

Second, with regard to regulated entities that choose to establish their own policies and procedures, sections 5 and 6 of the final rule provide maximum flexibility. Specifically, the final rule contains neither design standards (such as requiring the use of a specific technology) nor performance standards but instead requires, consistent with the Act, that the policies and procedures be “reasonably designed” to identify and block or otherwise prevent or prohibit unlawful Internet gambling. In addition, the final rule expressly authorizes each regulated entity to design and implement policies and procedures that are “tailored to its business,” which will enable it to craft policies and procedures based on individual circumstances. The flexibility the final rule affords regulated entities that establish their own policies and procedures should result in lower costs than if the final rule took a prescriptive one-size-fits-all approach.

Third, the “safe harbor” provision, with its nonexclusive examples of policies and procedures deemed to be “reasonably designed,” provides regulated entities with specific guidance on how to structure the policies and procedures required by the Act and the final rule. As a result, costs associated with formulating policies and procedures should be lower because the safe harbor provision provides guidance on how to so structure the policies and procedures. The Agencies also revised the nonexclusive due diligence examples contained in section 6 of the final rule to reduce potential costs for regulated entities. Specifically, the proposed rule contained nonexclusive due diligence examples which generally placed the burden of distinguishing lawful versus unlawful Internet gambling on regulated entities. As noted earlier, public commenters suggested that commercial customers engaged in an Internet gambling business should demonstrate to their financial transaction providers that the commercial customers are not engaged in unlawful Internet gambling in order to shift the burden of distinguishing lawful versus unlawful Internet gambling from regulated entities to the Internet gambling businesses. Based on these comments, the Agencies revised the nonexclusive due diligence examples contained in the final rule by shifting the burden of distinguishing lawful versus unlawful Internet gambling from regulated entities to the Internet gambling businesses. Treasury believes that this shifting of the burden will result in lower costs for regulated entities that choose to follow the final rule's nonexclusive due diligence examples.

Treasury received two comments expressing concern that the Regulatory Assessment in the proposed rule only addressed the potential recordkeeping costs on regulated entities but did not include an analysis of the full potential costs to participants to establish and implement the policies and procedures, including legal, management and operational costs.^[98] In the proposed rule, Treasury explained that it did not have sufficient information to quantify reliably the costs of developing specific policies and procedures, and it solicited information and comment on any costs or compliance requirements. Because the final rule provides maximum flexibility to regulated entities that establish their own policies and procedures by allowing them to tailor their policies and procedures to their business, including the use of different policies and procedures with respect to different business lines or different parts of the organization, Treasury does not have sufficient information to quantify reliably the costs of developing and implementing specific policies and procedures.

It is estimated that the recordkeeping burden for regulated entities will be approximately one million hours in order to develop and establish the policies and procedures required by the Act and this final rule. Using a reasonable estimate of average wages to monetize the opportunity cost of this time, which is explained in more detail in the Paperwork Reduction Act section below, yields a combined recordkeeping burden of approximately $88.5 million. We estimate this potential impact will be born during the first year this rule is in effect, in anticipation of the compliance date 12 months after publication of the final rule. In addition, it is estimated that the recordkeeping requirement required by the Act and the final rule will take approximately 8 hours per recordkeeper per year to maintain the policies and procedures required by this rulemaking. It is estimated that the total annual cost to regulated entities to maintain the policies and procedures will be approximately $3,337,200.^[99]

3. Interference With State, Local, and Tribal Governments

The Act does not alter State, local or Tribal gaming law.^[100] The Act exempts from the definition of the term “unlawful Internet gambling,” intrastate, intratribal, and intertribal transactions.^[101] Because the final rule does not alter these defined terms, it avoids undue interference with State, local, and tribal governments in the exercise of governmental functions. In addition, the final rule's non-exclusive due diligence examples contained in § __.6 accord deference to State and Tribal authorities. Specifically, the final rule's due diligence examples provide that a regulated entity may accept as evidence of a commercial customer's legal authority to engage in an Internet gambling business, a license issued by an appropriate State or Tribal authority that expressly allows the regulated entity's commercial customer to engage in the Internet gambling business.

B. Small Business Regulatory Enforcement Fairness Act of 1996

As discussed elsewhere, the total recordkeeping costs alone imposed on regulated entities exceed $88.5 million. Treasury does not have adequate information to quantify the impact of other compliance requirements, such as the implementation of any due diligence policies and procedures for commercial customers during the first year of this rule. These unquantified costs that are necessary to meet compliance obligations include burdens related to management, clerical, technical, training, auditing, and legal expertise that are necessary to implement the policies and procedures set forth in this final rule. Therefore, Treasury believes it is reasonable to assume the total compliance costs of this final rule will exceed $100 million in the first year. Considering the final rule's quantified and unquantified costs, and the fact that costs are likely to constitute a major increase in costs for an individual industry (depository institutions), it is a major rule as defined by section 804 of the Small Business Regulatory Enforcement Fairness Act of 1996.

C. Unfunded Mandates Reform Act (Sec. 202, Pub. L. 104-4; 2 U.S.C. 1532)

Treasury has concluded this rule does not contain a Federal mandate that may result in the expenditure by State, local and Tribal governments, in aggregate, or by the private sector, of $100 million or more (adjusted for inflation) in any one year. The threshold after adjustment for inflation is $130 million, using the most current (2007) Implicit Price Deflator for the Gross Domestic Product. However, Treasury believes the analyses provided in the Executive Order, Regulatory Flexibility Act, and Paperwork Reduction Act sections provide the analysis required by the Unfunded Mandates Reform Act.

D. Final Regulatory Flexibility Analysis

An initial regulatory flexibility analysis (IRFA) was included in the NPRM in accordance with the Regulatory Flexibility Act (RFA).^[102] In the IRFA, the Agencies specifically solicited comment, including from small entities, on whether the proposed rule would have a significant economic impact on a substantial number of small entities. No small entities submitted comments regarding quantification of their projected costs. The Agencies expect this rule to affect a number of small entities; however, the direct cost this rule imposes does not appear to have a significant economic impact on a substantial number of small entities, within the meaning of the RFA. Specifically, as discussed below, the proposed rule estimated that approximately 253,368 small entities would be subject to the rule. The Agencies estimate that the number of small entities subject to the final rule will be approximately 12,267 or less than five percent of the total number of small entities estimated in the proposed rule. The Agencies thus believe that the final rule will not affect a substantial number of small entities. Moreover, as noted below, in response to public comments on the proposed rule and on the IRFA, the Agencies have made a number of changes in the final rule that will reduce its economic impact. Even though this rule does not appear to have a significant economic impact on a substantial number of small entities, the Agencies have not formally certified the rule as not having a “significant economic impact on a substantial number of small entities,” as provided under section 605(b) of the RFA. Instead, the Agencies have prepared a Final Regulatory Flexibility Analysis as described in the RFA, 5 U.S.C. 604.^[103]

The RFA requires each FRFA to contain:

• A succinct statement of the need for, and objectives of, the rule;
• A summary of the significant issues raised by the public comments in response to the initial regulatory flexibility analysis, a summary of the assessment of the agency of such issues, and a statement of any changes made in the proposed rule as a result of such comments;
• A description of and an estimate of the number of small entities to which the rule will apply or an explanation of why no such estimate is available;
• A description of the projected reporting, recordkeeping and other compliance requirements of the rule, including an estimate of the classes of small entities which will be subject to the requirement and the type of professional skills necessary for preparation of the report or record; and
• A description of the steps the agency has taken to minimize the significant economic impact on small entities consistent with the stated objectives of applicable statutes, including a statement of the factual, policy, and legal reasons for selecting the alternative adopted in the final rule and why each one of the other significant alternatives to the rule considered by the agency which affect the impact on small entities was rejected.^[104]

1. Statement of the Need for, and Objectives of, the Final Rule

The Agencies jointly are adopting this final rule to implement the Act, as required by the Act. As noted above, the Act prohibits any person in the business of betting or wagering (as defined in the Act) from knowingly accepting payments in connection with the participation of another person in unlawful Internet gambling. The Act requires the Agencies jointly (in consultation with the U.S. Attorney General) to designate payment systems that could be used in connection with, or to facilitate, restricted transactions and to prescribe regulations requiring designated payment systems, and financial transaction providers participating in each designated payment system, to establish policies and procedures reasonably designed to identify and block or otherwise prevent or prohibit restricted transactions.^[105] The final rule sets out necessary definitions, designates payment systems that could be used in connection with restricted transactions, exempts participants performing certain functions in designated payment systems from the requirement imposed by the final rule, provides nonexclusive examples of policies and procedures reasonably designed to identify and block, or otherwise prevent and prohibit, restricted transactions, and reiterates the enforcement regime set out in the Act for designated payment systems and non-exempt participants therein. The Agencies believe that the final rule implements Congress's requirement that the Agencies prescribe regulations that carry out the purposes of the Act and provide guidance to designated payment systems and participants therein with respect to policies and procedures reasonably designed to identify and block, or otherwise prevent or prohibit, transactions in connection with unlawful Internet gambling.

2. Significant Issues Raised by Comments in Response to the IRFA

The Agencies have carefully considered the comment letters received in response to the proposed rule. The preamble above provides a general overview of the comments and the preamble's section-by-section analysis discusses the significant issues raised by the comments. The following is a summary of significant issues raised by commenters regarding the IRFA. The Agencies also have considered the comments received from small entities and associations that represent such small entities, even though the comments did not specifically refer to the RFA.

The Agencies received several comments directly related to the IRFA, including from the Office of Advocacy (Advocacy) of the U.S. Small Business Administration.^[106] The most common concern expressed in these comments was that the IRFA did not provide sufficient information about the nature of the impact of the proposed rule on small entities or that the burdens were not adequately estimated. Advocacy stated that, while it appreciated the fact that the Agencies may need to obtain information on the impact on small entities and commended the Agencies for soliciting additional information from the public, it was concerned that the Agencies were not providing all available information. Advocacy referenced the Board's “Supporting Statement for Recordkeeping Requirements” (Supporting Statement) associated with the proposed rule that was submitted to the Office of Management and Budget and published on the Board's website. The Supporting Statement included an estimate of the proposed rule's total recordkeeping cost to the public of just under $20 million. The Supporting Statement was created in compliance with the Paperwork Reduction Act (PRA), which requires a specific, objectively supported estimate of burden.^[107] Conversely, the RFA authorizes agencies to provide general descriptive statements of the effects of a proposed rule, in lieu of a quantifiable or numerical description, if quantification is not practicable or reliable.^[108] The Agencies stated in the NPRM that they did not have sufficient information to quantify reliably the effects the Act and the proposed rule would have on small entities. The Agencies specifically requested public comment on any costs, compliance requirements, or changes in operating procedures arising from the application of the proposed rule and the extent to which those costs, requirements, or changes are in addition to, or different from, those arising from the application of the Act generally.^[109] Because of the different standards contained in the PRA and the RFA and the differing types of costs assessed under these two statutes, the Agencies did not believe that Board's PRA estimates constituted a useful proxy for purposes of the RFA. Accordingly, to avoid confusion by providing inappropriate data, the Agencies did not include the Board's PRA cost estimates in the IRFA.

Advocacy also expressed concern that the Agencies did not put forward a meaningful discussion of alternatives to the proposed rule. The only actual requirement in the proposed rule, which is mandated by the Act, was that all non-exempt participants in designated payment systems establish and implement policies and procedures reasonably designed to identify and block or otherwise prevent or prohibit restricted transactions.^[110] The proposed rule made clear that the examples of reasonably designed policies and procedures set out in § __.6 are non-exclusive and that a participant in a designated payment system may design and use other policies and procedures that are specific to its business and may use different policies and procedures with respect to different types of restricted transactions. With respect to the non-exclusive examples provided in § __.6 of the proposed rule, the NPRM went into considerable detail describing how the Agencies anticipated that such policies and procedures would operate, including risk-based due diligence at account opening and remedial actions if a participant discovered that a customer processed restricted transactions through the participant's facilities.

The NPRM went into detail in discussing alternatives considered and the reasoning behind the alternatives selected for the proposed rule, particularly with respect to exemptions for certain participants in designated payment systems and non-exclusive examples of procedures for each designated payment system. For example, the NPRM discussed alternatives that the Agencies included in the proposed rule (such as due diligence at account opening, remedial action, and transaction coding), and alternatives that the Agencies considered but rejected for the proposed rule (such as a list of unlawful Internet gambling businesses). With respect to small entities, the Agencies considered exempting all small entities from coverage of the rule.^[111] As noted in the IRFA, the Agencies proposed that the requirements in the proposed rule be applicable to all entities subject to the Act, as implemented, regardless of their size because an exemption for small entities would significantly diminish the usefulness of the policies and procedures required by the Act by permitting unlawful Internet gambling operations to evade the requirements by using small financial transaction providers.^[112]

The Agencies also considered as a significant alternative the use of performance rather than design standards and the simplification of compliance requirements.^[113] As noted in the NPRM, the proposed rule was designed to provide maximum flexibility. The Act does not contain specific performance (much less design) standards, but instead requires that the policies and procedures be “reasonably designed” to prevent or prohibit unlawful Internet gambling. The proposed rule preserved this flexibility. In addition, the proposed rule simplified compliance requirements by expressly authorizing each regulated entity to use policies and procedures that are “specific to its business” to enable it to efficiently tailor its policies and procedures to its needs.^[114]

The IRFA referred back to the extensive discussion of alternatives in the NPRM when it stated that “other than as noted above” the Agencies were unaware of any significant alternatives to the proposed rule. Accordingly, the Agencies believe that the IRFA addressed this requirement of the RFA.

Advocacy also suggested that the Agencies had not identified Federal rules that duplicate, overlap, or conflict with the proposed rule, as required by the RFA. The IRFA expressly stated that the Agencies had not identified any Federal rules that duplicated, overlapped, or conflicted with the proposed rule. As with all other aspects of the proposed rule, the Agencies sought public comment regarding whether any commenter believed there were any Federal rules that duplicated, overlapped, or conflicted with the proposed rule. Advocacy apparently interpreted these statements as an attempt by the Agencies to shift the obligation for identifying such rules to small entities. The Agencies intended its statement to mean that the Agencies had researched the issue and found no Federal rules that duplicated, overlapped, or conflicted with the proposed rule. Accordingly, the Agencies believe that the IRFA addressed this requirement of the RFA.

Advocacy also suggested that the Agencies consider (i) exempting small money transmitters from the proposed rule and (ii) exempting the send agents in a money transmitting business. As noted above in the section-by-section analysis, other commenters raised similar issues and the Agencies have made revisions in the final rule to address these concerns, including exempting all send agents in a money transmitting business. However, the Agencies decided against exempting all small money transmitting businesses. Specifically, the Agencies do not believe that the Act's standard for granting exemptions would be met with regard to such a wholesale exemption, and such wholesale exemption would substantially undermine the purpose of the Act by allowing unlawful Internet gambling businesses to evade the restrictions contained in the Act and the final rule by using small money transmitting businesses.^[115]

Advocacy recommended that the Agencies prepare a revised initial regulatory flexibility analysis to address its concerns. The Agencies believe that the IRFA met the requirements of the RFA and a revised initial regulatory flexibility analysis is not warranted. In addition, after considering this and other comments, the Agencies determined that the issues raised by Advocacy have been addressed in the final rule or would not be resolved by an additional initial regulatory flexibility analysis.

One commenter suggested that the Agencies extend the comment period to allow the Agencies to gather additional information on the impact the proposed rule would have on regulated small entities, including through use of the procedures described in the RFA, which includes direct notification of interested small entities.^[116] The commenter stated that an extension of the comment period is warranted because many small money transmitting businesses may not be part of a trade association that is familiar with the federal regulatory process and may not use English as their primary language, so they are in particular need of outreach. In the NPRM, the Agencies stated that they anticipated contacting trade groups representing participants that qualify as small entities and encouraging them to provide comments during the comment period in order to ascertain the costs imposed on regulated small entities. Within a week of publication of the proposed rule in the Federal Register, Board staff sent electronic notices to money transmitter associations in over a dozen States, including New York, New Jersey, California, Illinois, Georgia, Florida, Washington, Colorado and Ohio, notifying them of the issuance of the proposed rule and encouraging the associations to provide comments on all aspects of the proposed rule, but, in particular, the costs that may be imposed on small entities. A commenter, which received one of the electronic notices and which represents small- and medium-sized money transmitters, suggested that send agents in money transmitting businesses should be exempted and noted that these send agents “are predominantly small entities.” ^[117] As noted above, the Agencies exempted send agents from the requirement of the final rule. In addition, under the final rule, the only non-exempt participants in a money transmitting business are the operators that permit customers to initiate transmission of funds transactions remotely from a location other than a physical office of the money transmitting business. The Agencies believe that the public comment period was sufficient and that further extension of the comment period is not warranted.

One commenter stated that the Agencies should determine how many small entities will be affected by the rule in connection with their participation in card systems, particularly gift card and stored-value card systems.^[118] The number of small entities involved with card systems that would be subject to the final rule is estimated below, but the Agencies do not believe that attempting to break out the number of small entities involved specifically with gift cards or stored value cards is relevant to the analysis.^[119]

Based on information the Agencies had regarding the size of the entities that commented, the Agencies have identified only one comment letter received from a depository institution that qualifies as a “small entity” under regulations promulgated by the U.S. Small Business Administration (SBA).^[120] The Agencies also received comment letters from several trade associations whose membership could include small entities affected by the rule.^[121] These comments raised issues generally similar to those discussed above in the section-by-section analysis, such as defining gambling-related terms, providing guidance on adequate due diligence, creating a list of unlawful Internet gambling businesses, and the burden of modifying customer agreements.

3. Description and estimate of classes of small entities affected by the final rule

The majority of small non-exempt participants in the five designated payment systems (ACH systems, card systems, check collection systems, money transmitting businesses, and wire transfer systems) that would be affected by the rule are depository institutions. Pursuant to the SBA size standards defining small entities, a commercial bank, savings association, or credit union is considered a “small entity” if it has assets of $175 million or less.^[122] Based on call report data for June 30, 2008, the Agencies estimate that 4,564 small banks (out of a total of 7,699 banks), 412 small savings associations (out of a total of 829), and 7,281 small credit unions (out of a total of 8,136), for a total of 12,257 small depository institutions, will be directly affected by the final rule.^[123]

Under the same SBA regulation, small money transmitting businesses are those with assets of $7.0 million or less. Based in part on information obtained from a Government Accountability Office report, the Agencies estimate that there are approximately 253,208 money transmitting businesses in the United States,^[124] and that 240,547 are small entities as defined above.^[125] Section __.3(d) of the final rule states that only those money transmitting businesses that (1) engage in the transmission of funds, which does not include check cashing, currency exchange, or the issuance or redemption of money orders, travelers' checks, and other similar instruments; and (2) permit customers to initiate transmission of funds remotely from a location other than a physical office of the money transmitting business, would be subject to the rule. Moreover, § __.4(c) of the rule exempts all participants in such a money transmitting business, except for the operator of the system.^[126] Accordingly, only money transmitting business operators that permit customers to initiate transactions remotely must establish and implement written policies and procedures reasonably designed to identify and block or otherwise prevent or prohibit restricted transactions.

Based on consultations with representatives of the money transmitting industry, the Agencies believe that most small money transmitting business operators do not permit customers to initiate transmissions of funds remotely from a location other than a physical office of the money transmitting business.^[127] Moreover, those operators that do permit customers to initiate transactions remotely—for example Western Union, MoneyGram, and PayPal—generally have asset sizes that are above the “small entity” definition under the SBA regulations. As a result, the Agencies estimate that of the estimated 240,547 small money transmitting businesses, no more than 10 consist of operators that permit customers to initiate transmission of funds transactions remotely. The Agencies thus estimate that only 10 small money transmitting business operators will be affected by the final rule.

The Agencies thus estimate that approximately 12,267 small entities will be subject to the final rule. When compared to the estimate contained in the proposed rule of 253,368 small entities, the Agencies believe that under the final rule approximately 241,101 fewer small entities will have to comply with the final rule.

4. Recordkeeping, Reporting and Other Compliance Requirements

The extent to which small entities will be affected by the final rule depends on several variables, including which designated payment systems they participate in, the composition of their customer base, and whether the entities are able to rely on policies and procedures established and implemented by the designated payment system. The final rule (as mandated by the Act) requires all non-exempt participants to establish and implement written policies and procedures reasonably designed to identify and block or otherwise prevent or prohibit restricted transactions. The final rule contains non-exclusive examples of reasonably designed policies and procedures for participants in each designated payment system; however, the final rule expressly permits non-exempt participants to design and implement policies and procedures tailored to their business that may be different than the examples provided in the final rule.

The Agencies believe that most small entities participating in ACH systems, card systems, check collection systems and wire transfer systems will be small depository institutions, including credit unions. If a small depository institution chooses to follow the final rule's non-exclusive examples for ACH, check collection, and wire transfer systems set out in § __.6, they should develop policies and procedures for conducting due diligence of commercial customers to determine the risk the commercial customer presents of engaging in an Internet gambling business. The due diligence examples in the final rule also suggest that non-exempt participants notify all commercial customers, through the account agreement or other means available, that restricted transactions are prohibited from being processed through the account or relationship. Developing such conforming policies and procedures would likely require input from legal counsel and management familiar with the small entity's existing account-opening, account maintenance and due diligence procedures. The small entity's senior management also would likely need to be involved in developing the policies and procedures to ensure they are compatible with the company's business plans.

In addition to policies and procedures for due diligence, the final rule's non-exclusive examples also suggest including remedial action procedures to be followed in situations where the participant has actual knowledge that a commercial customer has processed restricted transactions through the participant's facilities. Developing such procedures would likely require input from legal counsel and compliance personnel to integrate these procedures into the institution's existing compliance program.

After the policies and procedures are designed and in place, the Agencies anticipate that the actual implementation burden would be shifted more toward the management, clerical, and technical functions of the institution that would be interfacing directly with the commercial customers. Training in the new policies and procedures would be necessary for customer relations staff. In addition, involvement of audit and compliance personnel would be necessary for audit and testing of the new policies and procedures. Legal counsel, management, and compliance personnel may be required to address issues that arise with commercial customers that due diligence indicates may be engaged in an Internet gambling business.

The Agencies anticipate that a depository institution that qualifies as a small entity and participates in ACH, check, and wire-transfer systems would be able to establish and implement the same due diligence policies and procedures for commercial customers across all three of those systems for purposes of the final rule. The institution will not need to establish and implement separate policies and procedures for each of these designated payment systems. Additionally, credit unions, which constitute the majority of depository institutions that qualify as small entities, generally have few, if any, commercial customers because of the nature of their business. The final rule's due diligence examples only apply to commercial customers, so an institution with few or no commercial customer accounts would have relatively minimal implementation burden. Further, even if a depository institution that qualifies as a small entity does have such customers, the vast majority of commercial customers will not present more than a minimal risk of engaging in an Internet gambling business, so the due diligence burden would be minimal.

A small entity that participates in a card system and chooses to follow the card system examples in the final rule should largely be able to rely on the policies and procedures established by the operator of the card system, such as Visa or MasterCard.^[128] In general, such small depository institutions will rely on the transaction coding of the card system to determine whether to authorize or deny authorization for a transaction that the card system's coding procedure indicates may be a restricted transaction. Many small depository institutions had already made the business decision, prior to the Act and this rule's effective date, to implement these processes, such that this rule may impose only minimal additional burden in this respect. Moreover, a small depository institution may agree to have the card system operator or a third-party processor make transaction authorization decisions on its behalf as its agent. Following the card system example in the final rule may require a small entity participant to seek input from legal counsel and technical personnel familiar with the coding framework and transaction authorization process used by the card system in which the small entity participates, although, based on comments received, the Agencies believe that many card issuing banks and card systems already have such procedures in place.^[129]

Small entities in money transmitting businesses would, to a large extent, be “send” or “receive” agents that participate in systems operated by Western Union, MoneyGram, or similar entities. The final rule provides exemptions for all participants in a money transmitting business, except for the operator. The Agencies anticipate that these exemptions will completely eliminate the burden for such small entities. In addition, the final rule extends only to those money transmitting business operators that permit customers to initiate money transmission transactions remotely from a location other than a physical location of the money transmitting business. As noted earlier, the National Money Transmitters Association (NMTA), a trade association representing small- to medium-sized money transmitting organizations, indicated that most smaller money transmitting organizations do not allow Internet-initiated transactions and require a customer to visit an agent location in person in order to initiate a transaction.^[130]

For those few small money transmitting business operators subject to the final rule which choose to follow the final rule's examples, the operator would need to design and implement policies and procedures for conducting due diligence on its commercial customers at the establishment of the account or relationship similar to the due diligence described above for ACH, check collection, and wire transfer systems. The final rule's examples also suggest that the operator notify all commercial customers, through the account agreement or other means available, that restricted transactions are prohibited from being processed through the account or relationship. Developing such conforming policies and procedures would likely require input from legal counsel and management as described above for ACH, check collection, and wire transfer systems. Implementation of due diligence and remedial action policies and procedures would also require input from legal counsel, management, technical, audit, and compliance personnel similar to that required for the ACH, check collection, and wire transfer systems.

In addition, the final rule's money transmitting business examples suggest that an operator's policies and procedures should include procedures regarding ongoing monitoring or testing to detect potential restricted transactions, such as monitoring and analyzing payment patterns to detect suspicious payment volumes to any recipient. Such procedures would likely be facilitated by technical expertise and software from an outside vendor; however, the final rule's examples do not require using a vendor. In fact, the NMTA indicated that the smallest money transmitting organizations are sometimes the best at spotting anomalous transactions, even without computers. The NMTA stated that such businesses keep detailed records and tend to know all of their customers, and thus can quickly spot anomalous transactions.^[131]

5. Steps Taken To Minimize the Economic Impact on Small Entities

As discussed in the preamble to this final rule, the Agencies considered many approaches to minimize the burden of the rule on non-exempt participants, including small entities, while carrying out the mandates of the Act. Consistent with the Act, the final rule has been designed for maximum flexibility with respect to non-exempt participants, including small entities. First, the final rule only requires non-exempt participants to establish and implement reasonably designed policies and procedures. The final rule does not prescribe any design standards (such as requiring the use of a specific technology) or performance standards for such policies and procedures. Second, the examples of reasonably designed policies and procedures provided in § __.6 of the final rule are non-exclusive and non-prescriptive. Specifically, a non-exempt participant, including a small entity, is permitted to design and implement policies and procedures tailored to its business that may be different than the examples provided in the final rule. Participants may also tailor different policies and procedures with respect to different business lines or different parts of its organization. Third, the Agencies have made a number of changes in the final rule in response to public comments on the proposed rule in order to reduce the burden the Act and the rule impose on payment system participants, including small entities.

The proposed rule designated money transmitting businesses as a payment system subject to the rule and did not provide any exemptions for particular participants in a money transmitting business. Commenters suggested that the Agencies consider exempting small money transmitters or, at a minimum, send agents of money transmitting businesses from the rule.^[132] In addition, commenters suggested that the designation of money transmitting businesses in the proposed rule was too broad and included entities that were not intended to be included by the Act.^[133] As discussed above, the final rule's listing of money transmitting businesses as a designated payment system subject to the rule has been narrowed to include only those money transmitting businesses that (1) engage in the transmission of funds, which does not include check cashing, currency exchange, or the issuance or redemption of money orders, travelers' checks, and other similar instruments; and (2) permit customers to initiate transmission of funds remotely from a location other than a physical office of the money transmitting business. Based on comments from the NMTA, these changes would exclude most small money transmitting businesses. Moreover, the final rule provides an exemption for all participants in a designated money transmitting business except for the operator. As noted above, the Agencies believe that almost all of the estimated 240,547 small participants in money transmitting businesses are participants other than operators. Accordingly, these small entities will not be affected by the rule.

The proposed rule reiterated the Act's provision that permits participants in a designated payment system to comply with the rule's requirement to establish and implement reasonably designed policies and procedures by relying on and complying with the policies and procedures of the designated payment system if, among other things, such policies and procedures complied with the requirements of the proposed rule. Commenters expressed concern, however, with the value of this provision if a participant was unsure whether the designated payment system's policies and procedures complied with the rule and the Act.^[134] This issue would be particularly relevant to small entities that would be more likely to be participants in a designated payment system than an operator and would be more likely to take advantage of this authority to rely on the system's policies and procedures, rather than incurring the cost of designing and implementing their own policies and procedures. The Agencies addressed this concern in the final rule by permitting a participant to rely on the policies and procedures of its designated payment system if the operator of that system has stated to its participants that the operator has designed or structured the system's policies and procedures to comply with the requirements of the final rule, unless the participant is notified otherwise by its Federal functional regulator or, in the case of participants that are not directly supervised by a Federal functional regulator, the Federal Trade Commission.

The proposed rule's non-exclusive examples also indicated that non-exempt participants in designated payment systems should conduct due diligence in “establishing or maintaining” a commercial customer relationship to ensure that the customer does not process restricted transactions. Commenters noted the significant burden that would be imposed by reviewing all of an institution's existing commercial customer accounts to ensure that they did not process restricted transactions.^[135] The final rule's examples for ACH, check collection, and wire transfer systems recommends that non-exempt participants conduct due diligence at the establishment of the commercial account or relationship. If a non-exempt participant has actual knowledge that an existing commercial customer engages in an Internet gambling business, the final rule's non-exclusive policies and procedures suggest that the participant conduct due diligence on that customer similar to what is contemplated for new customers. Commenters also suggested that the final rule provide more guidance on the due diligence that would be deemed sufficient.^[136] In response to these comments, the final rule provides detailed steps that a participant can choose to take to conduct reasonable risk-based due diligence as contemplated by the final rule's examples.

The proposed rule's designated payment system examples also suggested including as a term of commercial customer agreements that the customer may not engage in restricted transactions through the participant's facilities. Numerous commenters stated that such a requirement to modify existing agreements would be unduly burdensome.^[137] In addition, commenters noted that typical customer agreements already include a prohibition against unlawful transactions, so modifying the agreement to specifically include restricted transactions in this prohibition would be unnecessary.^[138] Based on the comments, the final rule does not contemplate that non-exempt participants in designated payment systems will modify their account agreements with existing commercial customers, but instead contemplates that participants will notify commercial customers that the participant's facilities may not be used to process restricted transactions. Such notification could be accomplished through a term in the commercial customer agreements, through a notice sent to the customer, or through some other method.

The NPRM also set forth a proposed effective date for the final rule of six months after its publication. Many commenters stated that this was insufficient time to implement the rule. A longer period would be particularly relevant for small entities because they would most likely be participants in a designated payment system, rather than an operator. Commenters stated that designated payment systems must first develop their policies and procedures before participants will be able to conform their policies and procedures.^[139] As explained above in the preamble, the Agencies have established a compliance date for the final rule 12 months from its publication. This longer period will give small entities more time to establish and implement policies and procedures reasonably designed to identify and block or otherwise prevent restricted transactions, and may thereby reduce small entities' costs of complying with the rule.

Commenters also recommended some significant alternatives to approaches adopted in the proposed rule that the Agencies have not adopted in the final rule. Some of these suggestions may have reduced the burden imposed by the rule on some small entities, but were rejected by the Agencies for factual, policy, or legal reasons. For example, the final rule does not contemplate that any government entity will create, publish, and maintain a list of unlawful Internet gambling businesses. Several commenters indicated that such a list would assist financial institutions in identifying Internet gambling operations.^[140] After carefully considering this issue, including the numerous comments both for and against such a list, for the reasons discussed at length above, the Agencies have concluded that such a list would not be effective or efficient. In addition, the final rule's non-exclusive due diligence policies and procedures shift the burden of distinguishing lawful from unlawful Internet gambling from participants in designated payment systems to the Internet gambling businesses.

Some commenters also suggested that the Agencies exempt from the rule all participants in the ACH, check, and wire-transfer systems or exclude such systems from the list of designated payment systems.^[141] While such an approach would reduce the burden of the rule on small depository institutions, it would also substantially undermine the efficacy of the rule. Section 5364(b)(3) of the Act states that the Agencies shall exempt certain restricted transactions or designated payment systems from the rule if the Agencies jointly find that it is not reasonably practical to identify and block or otherwise prevent or prohibit restricted transactions. The Agencies believe that it is reasonably practical for participants in designated payment systems, including small entities, to implement certain policies and procedures, such as those contained in § __.6 of the final rule, that will constitute policies and procedures reasonably designed to prevent or prohibit restricted transactions. Accordingly, the Agencies have determined that blanket exemptions for the ACH, check, and wire-transfer systems would not be appropriate given the standard for an exemption set forth in section 5364(b)(3) of the Act.

E. Paperwork Reduction Act Analysis

In accordance with the Paperwork Reduction Act of 1995 (44 U.S.C. 3506; 5 CFR 1320 Appendix A.1), the Board has reviewed the final rule. The collection of information contained in the Treasury's final rule has been reviewed and approved by OMB in accordance with the requirements of the Paperwork Reduction Act of 1995 (44 U.S.C. 3507(d)). The Agencies may not conduct or sponsor, and an organization is not required to respond to, a collection of information unless it displays a currently valid OMB control number. The OMB control numbers are 1505-0204 for the Treasury and 7100-0317 for the Board.

The collection of information that is required by this final rulemaking is found in sections 5 and 6. This collection of information is required by section 802 of the Act, which requires the Agencies to prescribe joint regulations requiring each designated payment system, and all participants in such systems, to identify and block or otherwise prevent or prohibit restricted transactions through the establishment of policies and procedures reasonably designed to prevent or prohibit restricted transactions. The final rule implements this requirement by requiring all non-exempt participants in designated payment systems to establish and implement written policies and procedures reasonably designed to identify and block or otherwise prevent or prohibit restricted transactions.

The recordkeepers are businesses or other for-profit and not-for-profit organizations that include depository institutions (commercial banks, savings associations, and credit unions), third-party processors, and card system operators, and money transmitting business operators. The final rule does not include a specific time period for record retention; however, non-exempt participants would be required to maintain the policies and procedures for a particular designated payment system as long as they participate in that system.

The Agencies collectively received seven comment letters (from a law firm, a depository institution, a member of Congress, an individual, a government agency, and two business/trade associations) that addressed the paperwork issues. Five comment letters specifically addressed the burden estimates, one letter stated that the Agencies could provide more rigorous burden estimates, and one letter questioned the Board's monetized cost to the public as provided in its OMB Supporting Statement posted on the Board's public Web site. Broadly, all commenters stated that the paperwork burden estimates were too low; therefore, the Agencies have substantially increased the burden estimates.

Additionally, some of these commenters stated that the Agencies did not adequately identify the number of entities that would incur paperwork burden under the rule.^[142] The Agencies continue to believe that their methodology for estimating the number of regulated entities is generally accurate. The Board's and Treasury's burden estimates (as provided in each Agency's OMB supporting statements for this rulemaking) each reflect only about half of the rulemaking's burden on regulated entities. The Agencies have agreed to split equally the total number of recordkeepers not subject to examination and supervision by either the Board or the Treasury's Office of the Comptroller of the Currency and Office of Thrift Supervision.

The final rule provides exemptions for all participants in a money transmitting business, except for the operator. Small entities in money transmitting businesses would, to a large extent, be send or receive agents that participate in systems operated by Western Union, MoneyGram, or similar entities. Accordingly, they are exempt from the final rule and are not included in the estimated number of recordkeepers below. Also, the Agencies clarified in the final rule that money transmitting businesses are subject to the rule solely to the extent they engage in the transmission of funds, which does not include check cashing, currency exchange, or the issuance or redemption of money orders, travelers' checks, and other similar instruments. This change would reduce the number of money transmitting businesses that are subject to the recordkeeping requirements. Also, in the final rule, the Agencies clarified that the requirement to establish and implement written policies and procedures applies only to U.S. offices of participants in designated payment systems.

Depository institutions are the primary non-exempt participants for the ACH, card, check collection, and wire transfer systems subject to the rule. Accordingly, non-exempt depository institutions in such designated payment systems would be subject to the recordkeeping requirement of establishing and implementing written policies and procedures reasonably designed to prevent or prohibit restricted transactions to the extent that they participate in such systems.

Respondent burden:

For the purpose of estimating burden and accounting for it with OMB, the total number of depository institutions listed for each Agency includes the number of entities regulated by the Agency and half of the remaining depository institutions and third-party processors. Each Agency is also accounting for the burden for half of the card system operators and money transmitting business operators to which the Agencies estimate the final rule applies.

Federal Reserve:

Estimated number of recordkeepers: 3,459 commercial banks, 4,068 credit unions, 3 card system operators, and 8 money transmitting business operators.

Estimated average annual burden hours per recordkeeper: One-time burden 100 hours for commercial banks and card system operators, 20 hours for credit unions, and 120 hours for money transmitting business operators. Ongoing annual burden of 8 hours per recordkeeper.

Estimated frequency: Annually.

Estimated total annual recordkeeping burden: One-time burden, 428,520 hours and ongoing burden, 60,304 hours.

Treasury:

Estimated number of recordkeepers: 4,240 commercial banks, 829 savings associations, 4,068 credit unions, 3 card system operators, and 8 money transmitting business operators.

Estimated average annual burden hours per recordkeeper: One-time burden of 100 hours for commercial banks, savings associations and card system operators; 20 hours for credit unions; and 120 hours for money transmitting business operators. Ongoing annual burden of 8 hours per recordkeeper.

Estimated frequency: Annually.

Estimated total annual recordkeeping burden: One-time burden, 589,520 hours and ongoing burden, 73,184 hours.

Based on these estimates, the PRA burden for regulated entities is approximately one million hours:

	Number of recordkeepers	Number of hours spent (one-time burden)
Treasury	9,148	143 varies	589,520
Federal Reserve	7,538	144 varies	428,520
Total PRA Burden Hours for All Regulated Entities			1,018,040

The one-time burden imposed by the Act requires non-exempt participants to establish policies and procedures. The Agencies estimate that this initial burden will average 100 hours per commercial bank, savings association, and card system operator, 20 hours per credit union, and 120 hours per money transmitting business operator. The Agencies also estimate that the ongoing burden of maintaining the policies and procedures once they are established will be 8 hours per recordkeeper.

The Agencies further estimate (as provided in each Agency's OMB Supporting Statement) the total start-up cost for the banking, card system, and money transmitting industries to be $88,518,578.^[145]

The total estimated recordkeeping cost for all regulated entities is over $88.5 million:

Total PRA burden hours	1,018,040
Average adjusted rate of avg. wage for recordkeeping	$86.95
Total PRA Cost to Regulated Entities	$88,518,578

Because the records would be maintained at the institutions and notices are not provided to the Agencies, no issue of confidentiality under the Freedom of Information Act arises. The Agencies have a continuing interest in the public's opinion of our collections of information. At any time, comments regarding the burden estimate, or any other aspect of this collection of information, including suggestions for reducing the burden may be sent to: Office of Critical Infrastructure Protection and Compliance Policy, Department of the Treasury, Main Treasury Building, Room 1327, 1500 Pennsylvania Avenue, NW., Washington, DC 20220 ; Secretary, Board of Governors of the Federal Reserve System, 20th and C Streets, NW., Washington, DC 20551; and to the Office of Management and Budget, Paperwork Reduction Project (1505-0204 for Treasury or 7100-0317 for the Board), Washington, DC 20503.

F. Plain Language

Each Federal banking agency, such as the Board, is required to use plain language in all proposed and final rulemakings published after January 1, 2000. 12 U.S.C. 4809. In addition, in 1998, the President issued a memorandum directing each agency in the Executive branch, such as Treasury, to use plain language for all new proposed and final rulemaking documents issued on or after January 1, 1999. The Agencies have sought to present the final rule, to the extent possible, in a simple and straightforward manner.

IV. Statutory Authority

Pursuant to the authority set out in the Act and particularly section 802 (codified at 31 U.S.C. 5361 et seq.), the Board amends Chapter II of Title 12 of the Code of Federal Regulations and the Treasury amends Chapter I of Title 31 of the Code of Federal Regulations by adding the common rules set out below.

V. Text of Final Rules

List of Subjects

12 CFR Part 233

• Banks
• Banking
• Electronic funds transfers
• Incorporation by reference
• Internet gambling
• Payments
• Recordkeeping

31 CFR Part 132

• Banks
• Banking
• Electronic funds transfers
• Incorporation by reference
• Internet gambling
• Payments
• Recordkeeping

Federal Reserve System

Authority and Issuance

For the reasons set forth in the preamble, the Board amends Title 12, Chapter II of the Code of Federal Regulations by adding a new part 233 as set forth under Common Rules at the end of this document:

PART 233—PROHIBITION ON FUNDING OF UNLAWFUL INTERNET GAMBLING (REGULATION GG)

233.1

Authority, purpose, and incorporation by reference.

233.2

Definitions.

233.3

Designated payment systems.

233.4

Exemptions.

233.5

Policies and procedures required.

233.6

Non-exclusive examples of policies and procedures.

233.7

Regulatory enforcement.

Appendix A to Part 233—Model Notice

Authority: 31 U.S.C. 5364.

Department of the Treasury

Authority and Issuance

For the reasons set forth in the preamble, Treasury amends Title 31, Chapter I of the Code of Federal Regulations by adding a new part 132 as set forth under Common Rules at the end of this document:

PART 132—PROHIBITION ON FUNDING OF UNLAWFUL INTERNET GAMBLING

132.1

Authority, purpose, and incorporation by reference.

132.2

Definitions.

132.3

Designated payment systems.

132.4

Exemptions.

132.5

Policies and procedures required.

132.6

Non-exclusive examples of policies and procedures.

132.7

Regulatory enforcement.

Appendix A to Part 132—Model Notice

Authority: 31 U.S.C. 321 and 5364.

Common Rules

The common rules added by the Board as part 233 of Title 12, Chapter II of the Code of Federal Regulations and by Treasury as part 132 of Title 31, Chapter I of the Code of Federal Regulations follow:

§ __.1

Authority, purpose, collection of information, and incorporation by reference.

(a) Authority. This part is issued jointly by the Board of Governors of the Federal Reserve System (Board) and the Secretary of the Department of the Treasury (Treasury) under section 802 of the Unlawful Internet Gambling Enforcement Act of 2006 (Act) (enacted as Title VIII of the Security and Accountability For Every Port Act of 2006, Pub. L. No. 109-347, 120 Stat. 1884, and codified at 31 U.S.C. 5361-5367). The Act states that none of its provisions shall be construed as altering, limiting, or extending any Federal or State law or Tribal-State compact prohibiting, permitting, or regulating gambling within the United States. See 31 U.S.C. 5361(b). In addition, the Act states that its provisions are not intended to change which activities related to horseracing may or may not be allowed under Federal law, are not intended to change the existing relationship between the Interstate Horseracing Act of 1978 (IHA) (15 U.S.C. 3001 et seq.) and other Federal statutes in effect on October 13, 2006, the date of the Act's enactment, and are not intended to resolve any existing disagreements over how to interpret the relationship between the IHA and other Federal statutes. See 31 U.S.C. 5362(10)(D)(iii). This part is intended to be consistent with these provisions.

(b) Purpose. The purpose of this part is to issue implementing regulations as required by the Act. The part sets out necessary definitions, designates payment systems subject to the requirements of this part, exempts certain participants in designated payment systems from certain requirements of this part, provides nonexclusive examples of policies and procedures reasonably designed to identify and block, or otherwise prevent and prohibit, restricted transactions, and sets out the Federal entities that have exclusive regulatory enforcement authority with respect to the designated payments systems and non-exempt participants therein.

(c) Collection of information. The Office of Management and Budget (OMB) has approved the collection of information requirements in this part for the Department of the Treasury and assigned OMB control number 1505-0204. The Board has approved the collection of information requirements in this part under the authority delegated to the Board by OMB, and assigned OMB control number 7100-0317.

(d) Incorporation by reference—relevant definitions from ACH rules.

(1) This part incorporates by reference the relevant definitions of ACH terms as published in the “2008 ACH Rules: A Complete Guide to Rules & Regulations Governing the ACH Network” (the “ACH Rules”). The Director of the Federal Register approves this incorporation by reference in accordance with 5 U.S.C. 552(a) and 1 CFR part 51. Copies of the “2008 ACH Rules” are available from the National Automated Clearing House Association, Suite 100, 13450 Sunrise Valley Drive, Herndon, Virginia 20171, http://nacha.org, [phone]. Copies also are available for public inspection at the Department of Treasury Library, Room 1428, Main Treasury Building, 1500 Pennsylvania Avenue, NW., Washington, DC 20220, and the National Archives and Records Administration (NARA). Before visiting the Treasury library, you must call [phone] for an appointment. For information on the availability of this material at NARA, call [phone], or go to: http://www.archives.gov/​federal_​register/​code_​of_​federal_​regulations/​ibr_​locations.html 20002.

(2) Any amendment to definitions of the relevant ACH terms in the ACH Rules shall not apply to this part unless the Treasury and the Board jointly accept such amendment by publishing notice of acceptance of the amendment to this part in the Federal Register. An amendment to the definition of a relevant ACH term in the ACH Rules that is accepted by the Treasury and the Board shall apply to this part on the effective date of the rulemaking specified by the Treasury and the Board in the joint Federal Register notice expressly accepting such amendment.

§ __.2

Definitions.

The following definitions apply solely for purposes of this part:

(a) Actual knowledge with respect to a transaction or commercial customer means when a particular fact with respect to that transaction or commercial customer is known by or brought to the attention of:

(1) An individual in the organization responsible for the organization's compliance function with respect to that transaction or commercial customer; or

(2) An officer of the organization.

(b) Automated clearing house system or ACH system means a funds transfer system, primarily governed by the ACH Rules, which provides for the clearing and settlement of batched electronic entries for participating financial institutions. When referring to ACH systems, the terms in this regulation (such as “originating depository financial institution,” “operator,” “originating gateway operator,” “receiving depository financial institution,” “receiving gateway operator,” and “third-party sender”) are defined as those terms are defined in the ACH Rules.

(c) Bet or wager:

(1) Means the staking or risking by any person of something of value upon the outcome of a contest of others, a sporting event, or a game subject to chance, upon an agreement or understanding that the person or another person will receive something of value in the event of a certain outcome;

(2) Includes the purchase of a chance or opportunity to win a lottery or other prize (which opportunity to win is predominantly subject to chance);

(3) Includes any scheme of a type described in 28 U.S.C. 3702;

(4) Includes any instructions or information pertaining to the establishment or movement of funds by the bettor or customer in, to, or from an account with the business of betting or wagering (which does not include the activities of a financial transaction provider, or any interactive computer service or telecommunications service); and

(5) Does not include—

(i) Any activity governed by the securities laws (as that term is defined in section 3(a)(47) of the Securities Exchange Act of 1934 (15 U.S.C. 78c(a)(47)) for the purchase or sale of securities (as that term is defined in section 3(a)(10) of that act (15 U.S.C. 78c(a)(10));

(ii) Any transaction conducted on or subject to the rules of a registered entity or exempt board of trade under the Commodity Exchange Act (7 U.S.C. 1 et seq.);

(iii) Any over-the-counter derivative instrument;

(iv) Any other transaction that—

(A) Is excluded or exempt from regulation under the Commodity Exchange Act (7 U.S.C. 1 et seq.); or

(B) Is exempt from State gaming or bucket shop laws under section 12(e) of the Commodity Exchange Act (7 U.S.C. 16(e)) or section 28(a) of the Securities Exchange Act of 1934 (15 U.S.C. 78bb(a));

(v) Any contract of indemnity or guarantee;

(vi) Any contract for insurance;

(vii) Any deposit or other transaction with an insured depository institution;

(viii) Participation in any game or contest in which participants do not stake or risk anything of value other than—

(A) Personal efforts of the participants in playing the game or contest or obtaining access to the Internet; or

(B) Points or credits that the sponsor of the game or contest provides to participants free of charge and that can be used or redeemed only for participation in games or contests offered by the sponsor; or

(ix) Participation in any fantasy or simulation sports game or educational game or contest in which (if the game or contest involves a team or teams) no fantasy or simulation sports team is based on the current membership of an actual team that is a member of an amateur or professional sports organization (as those terms are defined in 28 U.S.C. 3701) and that meets the following conditions:

(A) All prizes and awards offered to winning participants are established and made known to the participants in advance of the game or contest and their value is not determined by the number of participants or the amount of any fees paid by those participants.

(B) All winning outcomes reflect the relative knowledge and skill of the participants and are determined predominantly by accumulated statistical results of the performance of individuals (athletes in the case of sports events) in multiple real-world sporting or other events.

(C) No winning outcome is based—

(1) On the score, point-spread, or any performance or performances of any single real-world team or any combination of such teams, or

(2 ) Solely on any single performance of an individual athlete in any single real-world sporting or other event.

(d) Block means to reject a particular transaction before or during processing, but it does not require freezing or otherwise prohibiting subsequent transfers or transactions regarding the proceeds or account.

(e) Card issuer means any person who issues a credit card, debit card, pre-paid card, or stored value card, or the agent of such person with respect to such card.

(f) Card system means a system for authorizing, clearing and settling transactions in which credit cards, debit cards, pre-paid cards, or stored value cards (such cards being issued or authorized by the operator of the system), are used to purchase goods or services or to obtain a cash advance. The term includes systems both in which the merchant acquirer, card issuer, and system operator are separate entities and in which more than one of these roles are performed by the same entity.

(g) Check clearing house means an association of banks or other payors that regularly exchange checks for collection or return.

(h) Check collection system means an interbank system for collecting, presenting, returning, and settling for checks or intrabank system for settling for checks deposited in and drawn on the same bank. When referring to check collection systems, the terms in this regulation (such as “paying bank,” “collecting bank,” “depositary bank,” “returning bank,” and “check”) are defined as those terms are defined in 12 CFR 229.2. For purposes of this part, “check” also includes an electronic representation of a check that a bank agrees to handle as a check.

(i) Commercial customer means a person that is not a consumer and that contracts with a non-exempt participant in a designated payment system to receive, or otherwise accesses, payment transaction services through that non-exempt participant.

(j) Consumer means a natural person.

(k) Designated payment system means a system listed in § __.3.

(l) Electronic fund transfer has the same meaning given the term in section 903 of the Electronic Fund Transfer Act (15 U.S.C. 1693a), except that such term includes transfers that would otherwise be excluded under section 903(6)(E) of that act (15 U.S.C. 1693a(6)(E)), and includes any funds transfer covered by Article 4A of the Uniform Commercial Code, as in effect in any State.

(m) Financial institutio n means a State or national bank, a State or Federal savings and loan association, a mutual savings bank, a State or Federal credit union, or any other person that, directly or indirectly, holds an account belonging to a consumer. The term does not include a casino, sports book, or other business at or through which bets or wagers may be placed or received.

(n) Financial transaction provider means a creditor, credit card issuer, financial institution, operator of a terminal at which an electronic fund transfer may be initiated, money transmitting business, or international, national, regional, or local payment network utilized to effect a credit transaction, electronic fund transfer, stored value product transaction, or money transmitting service, or a participant in such network, or other participant in a designated payment system.

(o) Foreign banking office means:

(1) Any non-U.S. office of a financial institution; and

(2) Any non-U.S. office of a foreign bank as described in 12 U.S.C. 3101(7).

(p) Interactive computer service means any information service, system, or access software provider that provides or enables computer access by multiple users to a computer server, including specifically a service or system that provides access to the Internet and such systems operated or services offered by libraries or educational institutions.

(q) Internet means the international computer network of interoperable packet switched data networks.

(r) Internet gambling business means the business of placing, receiving or otherwise knowingly transmitting a bet or wager by any means which involves the use, at least in part, of the Internet, but does not include the performance of the customary activities of a financial transaction provider, or any interactive computer service or telecommunications service.

(s) Intrastate transaction means placing, receiving, or otherwise transmitting a bet or wager where—

(1) The bet or wager is initiated and received or otherwise made exclusively within a single State;

(2) The bet or wager and the method by which the bet or wager is initiated and received or otherwise made is expressly authorized by and placed in accordance with the laws of such State, and the State law or regulations include—

(i) Age and location verification requirements reasonably designed to block access to minors and persons located out of such State; and

(ii) Appropriate data security standards to prevent unauthorized access by any person whose age and current location has not been verified in accordance with such State's law or regulations; and

(3) The bet or wager does not violate any provision of—

(i) The Interstate Horseracing Act of 1978 (15 U.S.C. 3001 et seq.);

(ii) 28 U.S.C. chapter 178 (professional and amateur sports protection);

(iii) The Gambling Devices Transportation Act (15 U.S.C. 1171 et seq.); or

(iv) The Indian Gaming Regulatory Act (25 U.S.C. 2701 et seq.).

(t) Intratribal transaction means placing, receiving or otherwise transmitting a bet or wager where—

(1) The bet or wager is initiated and received or otherwise made exclusively—

(i) Within the Indian lands of a single Indian tribe (as such terms are defined under the Indian Gaming Regulatory Act (25 U.S.C. 2703)); or

(ii) Between the Indian lands of two or more Indian tribes to the extent that intertribal gaming is authorized by the Indian Gaming Regulatory Act (25 U.S.C. 2701 et seq.);

(2) The bet or wager and the method by which the bet or wager is initiated and received or otherwise made is expressly authorized by and complies with the requirements of—

(i) The applicable tribal ordinance or resolution approved by the Chairman of the National Indian Gaming Commission; and

(ii) With respect to class III gaming, the applicable Tribal-State compact;

(3) The applicable tribal ordinance or resolution or Tribal-State compact includes—

(i) Age and location verification requirements reasonably designed to block access to minors and persons located out of the applicable Tribal lands; and

(ii) Appropriate data security standards to prevent unauthorized access by any person whose age and current location has not been verified in accordance with the applicable tribal ordinance or resolution or Tribal-State Compact; and

(4) The bet or wager does not violate any provision of—

(i) The Interstate Horseracing Act of 1978 (15 U.S.C. 3001 et seq.);

(ii) 28 U.S.C. chapter 178 (professional and amateur sports protection);

(iii) The Gambling Devices Transportation Act (15 U.S.C. 1171 et seq.); or

(iv) The Indian Gaming Regulatory Act (25 U.S.C. 2701 et seq.).

(u) Money transmitting business has the meaning given the term in 31 U.S.C. 5330(d)(1) (determined without regard to any regulations prescribed by the Secretary of the Treasury thereunder).

(v) Operator of a designated payment system means an entity that provides centralized clearing and delivery services between participants in the designated payment system and maintains the operational framework for the system. In the case of an automated clearinghouse system, the term “operator” has the same meaning as provided in the ACH Rules.

(w) Participant in a designated payment system means an operator of a designated payment system, a financial transaction provider that is a member of, or has contracted for financial transaction services with, or is otherwise participating in, a designated payment system, or a third-party processor. This term does not include a customer of the financial transaction provider, unless the customer is also a financial transaction provider otherwise participating in the designated payment system on its own behalf.

(x) Reasoned legal opinion means a written expression of professional judgment by a State-licensed attorney that addresses the facts of a particular client's business and the legality of the client's provision of its services to relevant customers in the relevant jurisdictions under applicable federal and State law, and, in the case of intratribal transactions, applicable tribal ordinances, tribal resolutions, and Tribal-State compacts. A written legal opinion will not be considered “reasoned” if it does nothing more than recite the facts and express a conclusion.

(y) Restricted transaction means any of the following transactions or transmittals involving any credit, funds, instrument, or proceeds that the Act prohibits any person engaged in the business of betting or wagering (which does not include the activities of a financial transaction provider, or any interactive computer service or telecommunications service) from knowingly accepting, in connection with the participation of another person in unlawful Internet gambling—

(1) Credit, or the proceeds of credit, extended to or on behalf of such other person (including credit extended through the use of a credit card);

(2) An electronic fund transfer, or funds transmitted by or through a money transmitting business, or the proceeds of an electronic fund transfer or money transmitting service, from or on behalf of such other person; or

(3) Any check, draft, or similar instrument that is drawn by or on behalf of such other person and is drawn on or payable at or through any financial institution.

(z) State means any State of the United States, the District of Columbia, or any commonwealth, territory, or other possession of the United States, including the Commonwealth of Puerto Rico, the Commonwealth of the Northern Mariana Islands, American Samoa, Guam, and the Virgin Islands.

(aa) Third-party processor means a service provider that—

(1) In the case of a debit transaction payment, such as an ACH debit entry or card system transaction, has a direct relationship with the commercial customer that is initiating the debit transfer transaction and acts as an intermediary between the commercial customer and the first depository institution to handle the transaction;

(2) In the case of a credit transaction payment, such as an ACH credit entry, has a direct relationship with the commercial customer that is to receive the proceeds of the credit transfer and acts as an intermediary between the commercial customer and the last depository institution to handle the transaction; and

(3) In the case of a cross-border ACH debit or check collection transaction, is the first service provider located within the United States to receive the ACH debit instructions or check for collection.

(bb) Unlawful Internet gambling means to place, receive, or otherwise knowingly transmit a bet or wager by any means which involves the use, at least in part, of the Internet where such bet or wager is unlawful under any applicable Federal or State law in the State or Tribal lands in which the bet or wager is initiated, received, or otherwise made. The term does not include placing, receiving, or otherwise transmitting a bet or wager that is excluded from the definition of this term by the Act as an intrastate transaction or an intra-tribal transaction, and does not include any activity that is allowed under the Interstate Horseracing Act of 1978 (15 U.S.C. 3001 et seq.; see § __.1(a)). The intermediate routing of electronic data shall not determine the location or locations in which a bet or wager is initiated, received, or otherwise made.

(cc) Wire transfer system means a system through which an unconditional order to a bank to pay a fixed or determinable amount of money to a beneficiary upon receipt, or on a day stated in the order, is transmitted by electronic or other means through the network, between banks, or on the books of a bank. When referring to wire transfer systems, the terms in this regulation (such as “bank,” “originator's bank,” “beneficiary's bank,” and “intermediary bank”) are defined as those terms are defined in 12 CFR part 210, appendix B.

§ __.3

Designated payment systems.

The following payment systems could be used by participants in connection with, or to facilitate, a restricted transaction:

(a) Automated clearing house systems;

(b) Card systems;

(c) Check collection systems;

(d) Money transmitting businesses solely to the extent they

(1) Engage in the transmission of funds, which does not include check cashing, currency exchange, or the issuance or redemption of money orders, travelers' checks, and other similar instruments; and

(2) Permit customers to initiate transmission of funds transactions remotely from a location other than a physical office of the money transmitting business; and

(e) Wire transfer systems.

§ __.4

Exemptions.

(a) Automated clearing house systems. The participants processing a particular transaction through an automated clearing house system are exempt from this regulation's requirements for establishing written policies and procedures reasonably designed to prevent or prohibit restricted transactions with respect to that transaction, except for—

(1) The receiving depository financial institution and any third-party processor receiving the transaction on behalf of the receiver in an ACH credit transaction;

(2) The originating depository financial institution and any third-party processor initiating the transaction on behalf of the originator in an ACH debit transaction; and

(3) The receiving gateway operator and any third-party processor that receives instructions for an ACH debit transaction directly from a foreign sender (which could include a foreign banking office, a foreign third-party processor, or a foreign originating gateway operator).

(b) Check collection systems. The participants in a particular check collection through a check collection system are exempt from this regulation's requirements for establishing written policies and procedures reasonably designed to prevent or prohibit restricted transactions with respect to that check collection, except for the depositary bank.

(c) Money transmitting businesses. The participants in a money transmitting business are exempt from this regulation's requirements for establishing written policies and procedures reasonably designed to prevent or prohibit restricted transactions, except for the operator.

(d) Wire transfer systems. The participants in a particular wire transfer through a wire transfer system are exempt from this regulation's requirements for establishing written policies and procedures reasonably designed to prevent or prohibit restricted transactions with respect to that transaction, except for the beneficiary's bank.

§ __.5

Policies and procedures required.

(a) All non-exempt participants in designated payment systems shall establish and implement written policies and procedures reasonably designed to identify and block or otherwise prevent or prohibit restricted transactions.

(b) A non-exempt financial transaction provider participant in a designated payment system shall be considered to be in compliance with the requirements of paragraph (a) of this section if—

(1) It relies on and complies with the written policies and procedures of the designated payment system that are reasonably designed to—

(i) Identify and block restricted transactions; or

(ii) Otherwise prevent or prohibit the acceptance of the products or services of the designated payment system or participant in connection with restricted transactions; and

(2) Such policies and procedures of the designated payment system comply with the requirements of this part.

(c) For purposes of paragraph (b)(2) in this section, a participant in a designated payment system may rely on a written statement or notice by the operator of that designated payment system to its participants that states that the operator has designed or structured the system's policies and procedures for identifying and blocking or otherwise preventing or prohibiting restricted transactions to comply with the requirements of this part as conclusive evidence that the system's policies and procedures comply with the requirements of this part, unless the participant is notified otherwise by its Federal functional regulator or, in the case of participants that are not directly supervised by a Federal functional regulator, the Federal Trade Commission.

(d) As provided in the Act, a person that identifies and blocks a transaction, prevents or prohibits the acceptance of its products or services in connection with a transaction, or otherwise refuses to honor a transaction, shall not be liable to any party for such action if—

(1) The transaction is a restricted transaction;

(2) Such person reasonably believes the transaction to be a restricted transaction; or

(3) The person is a participant in a designated payment system and blocks or otherwise prevents the transaction in reliance on the policies and procedures of the designated payment system in an effort to comply with this regulation.

(e) Nothing in this part requires or is intended to suggest that designated payment systems or participants therein must or should block or otherwise prevent or prohibit any transaction in connection with any activity that is excluded from the definition of “unlawful Internet gambling” in the Act as an intrastate transaction, an intratribal transaction, or a transaction in connection with any activity that is allowed under the Interstate Horseracing Act of 1978 (15 U.S.C. 3001 et seq.; see § __ .1(a)).

(f) Nothing in this part modifies any requirement imposed on a participant by other applicable law or regulation to file a suspicious activity report to the appropriate authorities.

(g) The requirement of this part to establish and implement written policies and procedures applies only to the U.S. offices of participants in designated payment systems.

§ __ .6

Non-exclusive examples of policies and procedures.

(a) In general. The examples of policies and procedures to identify and block or otherwise prevent or prohibit restricted transactions set out in this section are non-exclusive. In establishing and implementing written policies and procedures to identify and block or otherwise prevent or prohibit restricted transactions, a non-exempt participant in a designated payment system is permitted to design and implement policies and procedures tailored to its business that may be different than the examples provided in this section. In addition, non-exempt participants may use different policies and procedures with respect to different business lines or different parts of the organization.

(b) Due diligence. If a non-exempt participant in a designated payment system establishes and implements procedures for due diligence of its commercial customer accounts or commercial customer relationships in order to comply, in whole or in part, with the requirements of this regulation, those due diligence procedures will be deemed to be reasonably designed to identify and block or otherwise prevent or prohibit restricted transactions if the procedures include the steps set out in paragraphs (b)(1), (b)(2), and (b)(3) of this section and subject to paragraph (b)(4) of this section.

(1) At the establishment of the account or relationship, the participant conducts due diligence of a commercial customer and its activities commensurate with the participant's judgment of the risk of restricted transactions presented by the customer's business.

(2) Based on its due diligence, the participant makes a determination regarding the risk the commercial customer presents of engaging in an Internet gambling business and follows either paragraph (b)(2)(i) or (b)(2)(ii) of this section.

(i) The participant determines that the commercial customer presents a minimal risk of engaging in an Internet gambling business.

(ii) The participant cannot determine that the commercial customer presents a minimal risk of engaging in an Internet gambling business, in which case it obtains the documentation in either paragraph (b)(2)(ii)(A) or (b)(2)(ii)(B) of this section—

(A) Certification from the commercial customer that it does not engage in an Internet gambling business; or

(B) If the commercial customer does engage in an Internet gambling business, each of the following—

(1) Evidence of legal authority to engage in the Internet gambling business, such as—

(i) A copy of the commercial customer's license that expressly authorizes the customer to engage in the Internet gambling business issued by the appropriate State or Tribal authority or, if the commercial customer does not have such a license, a reasoned legal opinion that demonstrates that the commercial customer's Internet gambling business does not involve restricted transactions; and

(ii) A written commitment by the commercial customer to notify the participant of any changes in its legal authority to engage in its Internet gambling business.

(2) A third-party certification that the commercial customer's systems for engaging in the Internet gambling business are reasonably designed to ensure that the commercial customer's Internet gambling business will remain within the licensed or otherwise lawful limits, including with respect to age and location verification.

(3) The participant notifies all of its commercial customers, through provisions in the account or commercial customer relationship agreement or otherwise, that restricted transactions are prohibited from being processed through the account or relationship.

(4) With respect to the determination in paragraph (b)(2)(i) of this section, participants may deem the following commercial customers to present a minimal risk of engaging in an Internet gambling business—

(i) An entity that is directly supervised by a Federal functional regulator as set out in § __ .7(a); or

(ii) An agency, department, or division of the Federal government or a State government.

(c) Automated clearing house system examples.

(1) The policies and procedures of the originating depository financial institution and any third party processor in an ACH debit transaction, and the receiving depository financial institution and any third party processor in an ACH credit transaction, are deemed to be reasonably designed to identify and block or otherwise prevent or prohibit restricted transactions if they—

(i) Address methods to conduct due diligence in establishing a commercial customer account or relationship as set out in § __ .6(b);

(ii) Address methods to conduct due diligence as set out in § __ .6(b)(2)(ii)(B) in the event that the participant has actual knowledge that an existing commercial customer of the participant engages in an Internet gambling business; and

(iii) Include procedures to be followed with respect to a commercial customer if the originating depository financial institution or third-party processor has actual knowledge that its commercial customer has originated restricted transactions as ACH debit transactions or if the receiving depository financial institution or third-party processor has actual knowledge that its commercial customer has received restricted transactions as ACH credit transactions, such as procedures that address—

(A) The circumstances under which the commercial customer should not be allowed to originate ACH debit transactions or receive ACH credit transactions; and

(B) The circumstances under which the account should be closed.

(2) The policies and procedures of a receiving gateway operator and third-party processor that receives instructions to originate an ACH debit transaction directly from a foreign sender are deemed to be reasonably designed to prevent or prohibit restricted transactions if they include procedures to be followed with respect to a foreign sender if the receiving gateway operator or third-party processor has actual knowledge, obtained through notification by a government entity, such as law enforcement or a regulatory agency, that such instructions included instructions for restricted transactions. Such procedures may address sending notification to the foreign sender, such as in the form of the notice contained in appendix A to this part.

(d) Card system examples. The policies and procedures of a card system operator, a merchant acquirer, third-party processor, or a card issuer, are deemed to be reasonably designed to identify and block or otherwise prevent or prohibit restricted transactions, if the policies and procedures—

(1) Provide for either—

(i) Methods to conduct due diligence—

(A) In establishing a commercial customer account or relationship as set out in § __ .6(b); and

(B) As set out in § __ .6(b)(2)(ii)(B) in the event that the participant has actual knowledge that an existing commercial customer of the participant engages in an Internet gambling business; or

(ii) Implementation of a code system, such as transaction codes and merchant/business category codes, that are required to accompany the authorization request for a transaction, including—

(A) The operational functionality to enable the card system operator or the card issuer to reasonably identify and deny authorization for a transaction that the coding procedure indicates may be a restricted transaction; and

(B) Procedures for ongoing monitoring or testing by the card system operator to detect potential restricted transactions, including—

(1) Conducting testing to ascertain whether transaction authorization requests are coded correctly; and

(2) Monitoring and analyzing payment patterns to detect suspicious payment volumes from a merchant customer; and

(2) For the card system operator, merchant acquirer, or third-party processor, include procedures to be followed when the participant has actual knowledge that a merchant has received restricted transactions through the card system, such as—

(i) The circumstances under which the access to the card system for the merchant, merchant acquirer, or third-party processor should be denied; and

(ii) The circumstances under which the merchant account should be closed.

(e) Check collection system examples.

(1) The policies and procedures of a depositary bank are deemed to be reasonably designed to identify and block or otherwise prevent or prohibit restricted transactions, if they—

(i) Address methods for the depositary bank to conduct due diligence in establishing a commercial customer account or relationship as set out in § __ .6(b);

(ii) Address methods for the depositary bank to conduct due diligence as set out in § __ .6(b)(2)(ii)(B) in the event that the depositary bank has actual knowledge that an existing commercial customer engages in an Internet gambling business; and

(iii) Include procedures to be followed if the depositary bank has actual knowledge that a commercial customer of the depositary bank has deposited checks that are restricted transactions, such as procedures that address—

(A) The circumstances under which check collection services for the customer should be denied; and

(B) The circumstances under which the account should be closed.

(2) The policies and procedures of a depositary bank that receives checks for collection from a foreign banking office are deemed to be reasonably designed to identify and block or otherwise prevent or prohibit restricted transactions if they include procedures to be followed by the depositary bank when it has actual knowledge, obtained through notification by a government entity, such as law enforcement or a regulatory agency, that a foreign banking office has sent checks to the depositary bank that are restricted transactions. Such procedures may address sending notification to the foreign banking office, such as in the form of the notice contained in the appendix to this part.

(f) Money transmitting business examples. The policies and procedures of an operator of a money transmitting business are deemed to be reasonably designed to identify and block or otherwise prevent or prohibit restricted transactions if they—

(1) Address methods for the operator to conduct due diligence in establishing a commercial customer relationship as set out in § __ .6(b);

(2) Address methods for the operator to conduct due diligence as set out in § __ .6(b)(2)(ii)(B) in the event that the operator has actual knowledge that an existing commercial customer engages in an Internet gambling business;

(3) Include procedures regarding ongoing monitoring or testing by the operator to detect potential restricted transactions, such as monitoring and analyzing payment patterns to detect suspicious payment volumes to any recipient; and

(4) Include procedures when the operator has actual knowledge that a commercial customer of the operator has received restricted transactions through the money transmitting business, that address—

(i) The circumstances under which money transmitting services should be denied to that commercial customer; and

(ii) The circumstances under which the commercial customer account should be closed.

(g) Wire transfer system examples. The policies and procedures of the beneficiary's bank in a wire transfer are deemed to be reasonably designed to identify and block or otherwise prevent or prohibit restricted transactions if they—

(1) Address methods for the beneficiary's bank to conduct due diligence in establishing a commercial customer account as set out in § __ .6(b);

(2) Address methods for the beneficiary's bank to conduct due diligence as set out in § __ .6(b)(2)(ii)(B) in the event that the beneficiary's bank has actual knowledge that an existing commercial customer of the bank engages in an Internet gambling business;

(3) Include procedures to be followed if the beneficiary's bank obtains actual knowledge that a commercial customer of the bank has received restricted transactions through the wire transfer system, such as procedures that address

(i) The circumstances under which the beneficiary bank should deny wire transfer services to the commercial customer; and

(ii) The circumstances under which the commercial customer account should be closed.

§ __ .7

Regulatory enforcement.

The requirements under this part are subject to the exclusive regulatory enforcement of—

(a) The Federal functional regulators, with respect to the designated payment systems and participants therein that are subject to the respective jurisdiction of such regulators under section 505(a) of the Gramm-Leach-Bliley Act (15 U.S.C. 6805(a)) and section 5g of the Commodity Exchange Act (7 U.S.C. 7b-2); and

(b) The Federal Trade Commission, with respect to designated payment systems and participants therein not otherwise subject to the jurisdiction of any Federal functional regulators (including the Commission) as described in paragraph (a) of this section.

Appendix A to Part __—Model Notice

[Date]

[Name of foreign sender or foreign banking office]

[Address]

Re: U.S. Unlawful Internet Gambling Enforcement Act Notice

Dear [Name of foreign counterparty]:

On [date], U.S. government officials informed us that your institution processed payments through our facilities for Internet gambling transactions restricted by U.S. law on [dates, recipients, and other relevant information if available].

We provide this notice to comply with U.S. Government regulations implementing the Unlawful Internet Gambling Enforcement Act of 2006 (Act), a U.S. federal law. Our policies and procedures established in accordance with those regulations provide that we will notify a foreign counterparty if we learn that the counterparty has processed payments through our facilities for Internet gambling transactions restricted by the Act. This notice ensures that you are aware that we have received information that your institution has processed payments for Internet gambling restricted by the Act.

The Act is codified in subchapter IV, chapter 53, title 31 of the U.S. Code (31 U.S.C. 5361 et seq.). Implementing regulations that duplicate one another can be found at part 233 of title 12 of the U.S. Code of Federal Regulations (12 CFR part 233) and part 132 of title 31 of the U.S. Code of Federal Regulations (31 CFR part 132).

By order of the Board of Governors of the Federal Reserve System, November 12, 2008.

Robert deV. Frierson,

Deputy Secretary of the Board.

Dated: November 10, 2008.

By the Department of the Treasury.

Taiya Smith,

Executive Secretary.

Footnotes

1.  31 U.S.C. 5361(b).

2.  See H. Rep. No. 109-412 (pt. 1) p. 10.

3.  72 FR 56680 (Oct. 4, 2007).

4.  The comment letters and conference call summaries cited herein are available on the Board's public Web site at: http://www.federalreserve.gov/​generalinfo/​foia/​index.cfm?​doc_​id=​R%2D1298&​doc_​ver=​1.

5.  See, e.g., comment letter from David S. Orkin (Dec. 2, 2007) p. 1.

6.  See, e.g., comment letter from Members of Congress of the United States (Sen. Kyl et al.) (Dec. 12, 2007) (hereinafter “Kyl letter”) p. 2. See also H. Rep. No. 109-412, Part 1, p. 11.

7.  See, e.g., comment letter from MoneyGram Int'l (Dec. 11, 2007) (herein “neyGram letter”) p.3 (Internet gambling Web sites may direct payments to an individual, rather than the business's corporate name, and change these names frequently).

8.  For example, the automated processing equipment used to clear checks does not read the payee line on a typical consumer check.

9.  31 U.S.C. 5365(c).

10.  See, e.g., comment letter from the American Bankers Association (Dec. 12, 2007) (hereinafter “ABA letter”), pp. 5-6.

11.  See summary of conference call with representatives of various State Attorneys General (call date July 9, 2008) p. 1.

12.  The final rules adopted by the Board and the Treasury within their respective titles of the Code of Federal Regulations (12 CFR Part 233 for the Board and 31 CFR Part 132 for the Treasury) are identically numbered from § __.1 to § __.7. For ease of reference, the single set of final rules adopted by each Agency is referred to in this release as Section __, excluding title and part designations. A similar format is used to refer to the single set of proposed rules issued by the Agencies.

13.  See, e.g., Kyl letter, supra note 6, at 2.

14.  See, e.g., comment letter from The Clearing House Assoc. LLC and its affiliates, The Clearing House Payments Co. LLC (Dec. 12, 2007) (hereinafter “The Clearing House letter”) p. 14.

15.  The “effective date” is the date that the regulation affects or is added to the Code of Federal Regulations. The “compliance date” is the date that regulated entities must be in compliance with the regulation. National Archives and Records Administration, Federal Register Document Drafting Handbook, pp. 2-10 and 2-11 (Oct. 1998 rev.).

16.  For example, the Agencies believe that the shifting of the burden of establishing whether an Internet gambling business is engaged in restricted transactions from the financial transaction providers to the Internet gambling businesses will minimize burden for participants.

17.  31 U.S.C. 5361(b).

18.  31 U.S.C. 5362(10)(D)(iii).

19.  See, e.g., comment letter from Wells Fargo & Company (Dec. 12, 2007) (hereinafter “Wells Fargo letter”), pp. 15-16.

20.  Id. at 21-22.

21.  31 U.S.C. 5362(1).

22.  NPRM, 72 FR at 56695.

23.  See e.g., comment letter from the Interactive Skill Games Association (Dec. 12, 2007), pp. 1 and 3.

24.  See e.g., comment letter from the Poker Players Alliance (Dec. 12, 2007) (hereinafter “PPA letter”), p. 2.

25.  Id.

26.  See e.g., comment letter from Daniel W. Johnson (Oct. 16, 2007), p. 1.

27.  See e.g., PPA letter, supra note 24, at 2.

28.  See e.g., comment letter from Nelson Mullins Riley & Scarborough LLP (Dec. 12, 2007) (hereinafter “Nelson Mullins letter”) pp. 2-3.

29.  31 U.S.C. 5362(1)(A).

30.  31 U.S.C. 5362(1)(B) (emphasis added).

31.  Nelson Mullins letter, supra note 28, at 2 and 6.

32.  See, e.g., The Clearing House letter, supra note 14, at 13.

33.  See, e.g., comment letter from Bank of America (Dec. 12, 2007) pp. 2-3.

34.  NPRM, 72 FR 56680, 56684 n.10.

35.  See, e.g., comment letter from Howrey, LLP, on behalf of The Money Services Round Table (Dec. 6, 2007) (hereinafter “TMSRT letter”) pp. 5-6.

36.  See, e.g., ABA letter, supra note 10, at 3-4.

37.  See “Third-Party Legal Opinion Report, Including the Legal Opinion Accord, of the Section of Business Law,” American Bar Association, 47 Bus. Law. 167 (1991).

38.  See, e.g., comment letter from the National Automated Clearing House Association (Dec. 13, 2007) (hereinafter “NACHA letter”), p. 2.

39.  See, e.g., comment letter from U.S. Central Federal Credit Union (Dec. 6, 2007) p. 3.

40.  E.g., TMSRT letter, supra note 35, at 2; see also Wells Fargo letter, supra note 19, at 24-25.

41.  See summary of conference call with The National Money Transmitters Assoc. (call date June 3, 2008) (hereinafter “NMTA call summary”), p. 1.

42.  See, e.g., comment letter from the National Football League, Major League Baseball, National Basketball Association, National Hockey League, and National Collegiate Athletic Association (Dec. 12, 2007) (hereinafter “NFL letter”), p. 5.

43.  See, e.g., ABA letter, supra note 10, at 3.

44.  Some commenters suggested that even an exempt participant should be required to block a transaction in cases where the participant has actual knowledge that it is a restricted transaction. E.g., NFL letter, supra note 42, at 5. In an automated payment system, it is unclear how an exempt participant would have actual knowledge that a particular transaction is a restricted transaction while in process. In addition, the final rule expressly states that it does not modify any requirement imposed on a participant by other applicable law or regulation to file a suspicious activity report to the appropriate authorities. If any participant suspects that a customer is processing illegal transactions, including restricted transactions, through the participant's facilities, the participant should file a suspicious activity report with the appropriate authorities.

45.  E.g., comment letter from Manufacturers and Traders Trust Co. (M&T Bank) (Dec. 11, 2007) (hereinafter “M&T Bank letter”), p. 4. Some commenters similarly suggested that ACH, check collection, and wire transfer systems should not be listed as designated payment systems for similar reasons. See, e.g., Wells Fargo letter, supra note 19, at 7.

46.  One commenter acknowledged that a bank could perhaps identify customers engaged in illegal Internet gambling by conducting enhanced due diligence at account opening, but stated that having to conduct enhanced due diligence at each account opening would be a significant burden on banks and customers alike. See comment letter from Compass Bank (Dec. 6, 2007), pp. 4-5.

47.  See e.g., ABA letter, supra note 10 at 4.

48.  The final rule does not exempt the operator of a money transmitting business with respect to cross-border transactions, another form of credit transaction, because the operator of the system typically signs up commercial customers and can perform due diligence on those customers.

49.  See comment letter from Alston & Bird LLP (Dec. 12, 2007) (hereinafter “Alston & Bird letter”), pp. 14-17.

50.  The commenter also questions whether the proposed rule required issuers, seller, and redeemers of gift cards to have reasonably designed policies and procedures to prevent restricted transactions. Id. at 15. As explained above, the only participants in card systems that are contemplated by the final rule's non-exclusive examples to have policies and procedures are the operator, card issuer, third-party processor, and merchant acquirer. Retailers that may sell pre-paid gift cards or stored value products of other issuers, such as grocery stores or convenience stores that sell gift cards for book stores, are not participants in a designated payment system, as defined by the final rule, and thus are not covered by the final rule.

51.  Comment letter from the Securities Industry and Financial Markets Association (Dec. 12, 2007), pp. 3-4.

52.  See, e.g., TMSRT letter, supra note 35, at 3.

53.  See, e.g., comment letter from MasterCard Worldwide (Dec. 12, 2007) (hereinafter “MasterCard letter”) p. 2.

54.  See, e.g., comment letter from the Office of the Comptroller of the Currency (Dec. 12, 2007) (hereinafter “Comptroller letter”) pp. 2-3.

55.  See, e.g., comment letter from First Data Corporation (Dec. 12, 2007) p. 3.

56.  A commenter also requested that the Agencies include the Act's liability protection provisions verbatim from the statutory language. See MasterCard letter, supra note 53, at 3. The commenter was unclear as to whether the liability protection in the proposed rule matched the breadth of content of the Act's provision. As noted above, the Agencies intended to import the Act's liability protections from the Act and only modified the language for grammatical purposes to insert into the regulation.

57.  31 U.S.C. 5364(b)(4).

58.  See, e.g., comment letter from Visa U.S.A. Inc. (Dec. 12, 2007) (hereinafter “Visa letter”) p. 3; see also ABA letter, supra note 10, at 5.

59.  See MasterCard letter, supra note 53, at 4.

60.  See, e.g., comment letter from American Greyhound Racing, Inc. (Nov. 26, 2007), p. 2.

61.  See, e.g., comment letter from the National Thoroughbred Racing Association (Dec. 11, 2007), p. 2.

62.  A principle of statutory construction is that a statute ought to be construed so that, if it can be prevented, no clause, sentence, or word shall be superfluous, void, or insignificant. As noted above, § 5364(b)(4) of the Act directs the Agencies to ensure that transactions excluded from the Act's definition of “unlawful Internet gambling” are not blocked or otherwise prevented or prohibited “by the prescribed regulations.” To interpret that provision as a requirement that designated payment systems and participants therein must process all transactions excluded from the definition of “unlawful Internet gambling,” even though they have made business decisions not to process such transactions, would render the words “by the prescribed regulations” meaningless.

63.  See, e.g., Visa letter, supra note 58, at 4.

64.  31 U.S.C. 5362(10).

65.  See, e.g., ABA letter, supra note 10, at 4.

66.  See, e.g., Wells Fargo letter, supra note 19, at 8.

67.  See, e.g., comment letter from Branch Banking and Trust Company (Dec. 12, 2007) (hereinafter “BB&T letter”), p. 2.

68.  See, e.g., comment letter from the Independent Community Bankers of America (Dec. 12, 2007) (hereinafter “ICBA letter”), p. 8.

69.  See, e.g., MasterCard letter, supra note 53, at 6.

70.  See NFL letter, supra note 42, at 3; see also undated comment letter from Members of Congress of the United States (Rep. Pitts et al.) p. 1.

71.  See, e.g., 12 CFR 208.63.

72.  See Comptroller letter, supra note 54, at 2.

73.  For a general discussion in this regard, see the comment letter from The Depository Trust & Clearing Corporation (Dec. 10, 2007).

74.  Many U.S. institutions are already required to conduct due diligence of foreign financial institutions pursuant to Section 312 of the USA PATRIOT Act. 31 U.S.C. 5318(i); 31 CFR 103.176.

75.  The receipt of a reasoned legal opinion pursuant to a due diligence process under § .__6(b) is solely for purposes of compliance with implementing regulations under the Act and does not necessarily constitute compliance with, or provide protection from liability under, any other applicable Federal or State laws.

76.  Monitoring the Internet for unauthorized use of a trademark is distinct from monitoring and analyzing payment patterns to detect suspicious patterns of payments to a recipient. Monitoring and analyzing payment patterns continues to be included in the non-exclusive examples for card systems and money transmitting businesses.

77.  See, e.g., MoneyGram letter, supra note 7, at 2.

78.  Id.

79.  See comment letter from PayPal (Dec. 12, 2007), p. 2; see also MasterCard letter, supra note 53, at 8.

80.  See PayPal letter, supra note 79, at 2 and MasterCard letter, supra note 53, at 8. None of the rule's examples of reasonably designed policies and procedures are “required.” As noted in § __.6(a) of both the proposed rule and the final rule, the examples provided in § __.6 are non-exclusive and designated payment systems and participants therein are permitted to design and implement policies and procedures that may be different than the examples.

81.  See, e.g., National Automated Clearing House Association, 2007 ACH Rules, Operating Rules Appendix XI (The National System of Fines).

82.  See, e.g., The Clearing House letter, supra note 14, at 11.

83.  See Visa letter, supra note 58, at 2.

84.  See 31 U.S.C. 5364(a).

85.  See, e.g., comment letter from the American Horse Council (Dec. 12, 2007), pp. 3-4; see also comment letter from the North American Association of State & Provincial Lotteries (Dec. 11, 2007), p 3.

86.  The Agencies do not believe that special cross-border procedures are necessary for card systems, which generally have the same coding system for transactions regardless of where they are initiated.

87.  See, e.g., ABA letter, supra note 10, at 7.

88.  See, e.g., The Clearing House letter, supra note 14, at 9.

89.  See, e.g., ABA letter, supra note 10, at 8.

90.  Id.; see also The Clearing House letter, supra note 14, at 9.

91.  The Agencies expect that the notice would contain enough detail (including identifying intermediaries) to permit the U.S. participant to describe the transaction's path to its foreign counterparty.

92.  See e.g., NFL letter, supra note 42, at 4; see also comment letter from Christian Coalition of America (Dec. 7, 2007), p.2.

93.  See, e.g., comment letter from Credit Union National Association (Dec. 12, 2007) p. 5; see also comment letter from The Financial Services Roundtable and BITS (Dec. 12, 2007), pp. 6-7.

94.  See Alston & Bird letter, supra note 49, at 23. See also, 31 CFR 103.56(b)(8) where the regulations of the Financial Crimes Enforcement Network (“FinCEN”) clarify the examination authority of the IRS.

95.  31 U.S.C. 5361(a)(3).

96.  31 U.S.C. 5361(a)(4).

97.  See e.g., comment letter from The Huntington National Bank (Dec. 12, 2007) p. 3.

98.  See e.g., comment letter from the California and Nevada Credit Union Leagues (Dec. 12, 2007) p.4.

99.  This estimate is based on an estimate of 16,686 recordkeepers. The hourly cost of the individual who would be responsible for maintaining the policies and procedures is estimated to be $25 per hour (which is an average based on data contained in the U.S. Department of Labor, Bureau of Labor Statistics' occupational employment statistics for office and administrative support occupations, dated May 2007).

100.  Specifically, the Act defines the term “unlawful Internet gambling” as a bet or wager, which involves at least in part the use of the Internet, where such bet or wager is unlawful under any applicable Federal or State law in the State or Tribal lands in which the bet or wager is initiated, received, or otherwise made. 31 U.S.C. 5362(10)(A).

101.  31 U.S.C. 5362(10)(B) and (C).

102.  5 U.S.C. 601 et seq.

103.  When promulgating a final rule, the RFA requires agencies to prepare a FRFA unless the agency finds that the final rule will not, if promulgated, have a significant economic impact on a substantial number of small entities. 5 U.S.C. 604(a) and 605(b).

104.  5 U.S.C. 604(a).

105.  31 U.S.C. 5364(a).

106.  E.g., comment letters were received from the Office of Advocacy of the U.S. Small Business Administration (Dec. 12, 2007) (hereinafter “Advocacy letter”); the Center for Regulatory Effectiveness (Nov. 15, 2007) (hereinafter “CRE letter”);, M&T Bank, supra note 45; TMSRT, supra note 35; Alston & Bird, supra note 49;, and J. Schmit, an individual (Dec. 8, 2007).

107.  44 U.S.C. 3506(c)(1)(A)(iv) and 5 CFR 1320.8(a)(4).

108.  5 U.S.C. 607.

109.  NPRM, 72 FR at 56693.

110.  This requirement is set out in § __.5(a) of the proposed rule and is required by section 5364(a) of the Act.

111.  See 5 U.S.C. 603(c)(4).

112.  NPRM, 72 FR at 56693.

113.  See 5 U.S.C. 603(c)(2) and (3).

114.  Treasury noted in its discussion of Executive Order 12866 in the NPRM that providing this flexibility for regulated entities by allowing them to tailor their policies and procedures to their individual circumstances should result in lower costs than if the Act and the proposed rule took a prescriptive one-size-fits-all approach. NPRM, 72 FR at 56692.

115.  See 31 U.S.C. 5364(b)(3). As noted above, the final rule does, however, include a revised designation for money transmitting businesses as including only those money transmitting businesses that engage in the transmission of funds and permit customers to initiate money transmission transactions remotely from a location other than a physical office of the money transmitting business (such as through the Internet). The Agencies believe that this designation revised along functional lines, rather than by size, may also exclude a significant number of small money transmitting businesses.

116.  See CRE letter, supra note 106, at 5-6. The RFA section can be found at 5 U.S.C. 609.

117.  See TMSRT letter, supra note 35 at 3-4.

118.  See Alston & Bird letter, supra note 49, at 22-23.

119.  Card systems basically operate the same way for purposes of the Act and the rule, regardless of whether the particular card involved is a credit card, debit card, pre-paid card, or stored-value product. With respect to implementing the final rule's non-exclusive examples for card systems, the relevant entities are the card system operator, merchant acquirer bank, and the card issuer bank. Retailers that may sell pre-paid gift cards or stored-value products, such as grocery stores or convenience stores, are not participants in a designated payment system, as defined by the final rule, and thus are not covered by the final rule.

120.  Comment letter from First National Bank of Morgan (Nov. 30, 2007), which questioned the public policy of imposing burden on participants in designated payment systems to prevent Internet gambling when other forms of gambling are permitted, such as State lotteries and casinos. The SBA size standards to define small business concerns in credit intermediation and related activities are located at 13 CFR 121.201 (subsector 522).

121.  E.g., ICBA letter, supra note 67; comment letter from the Consumer Bankers Assoc. (Dec. 12, 2007) (hereinafter “CBA letter”).

122.  13 CFR 121.201.

123.  Call report data include information submitted by depository institutions on the following forms: Consolidated Reports of Condition and Income for a Bank with Domestic and Foreign Offices (FFIEC Form 031) and Consolidated Reports of Condition and Income for a Bank with Domestic Offices Only (FFIEC Form 041), Thrift Financial Report (OTS Form 1313), and NCUA Call Report (NCUA Form 5300).

124.  U.S. Government Accountability Office, “Bank Secrecy Act: FinCEN and IRS Need to Improve and Better Coordinate Compliance and Data Management Efforts,” GAO-07-212 (Dec. 2006). The Agencies note that this report took information from multiple studies, some of which focused on the number of “money services businesses” subject to FinCEN regulation. The term “money services business,” by virtue of thresholds and other criteria in FinCEN's definition, applies to a different scope of entities than does the statutory term “money transmitting business.” See 31 CFR 103.11(uu).

125.  The estimate of 240,547 small money transmitting businesses is the same estimate that is contained in the NPRM. The Agencies expressly solicited comment in the NPRM on the number of small entities to which the proposed rule would apply. The Agencies did not receive any comments during the comment period disputing the Agencies' specific estimates and providing an explanation of why the estimates were being disputed.

126.  The proposed rule designated money transmitting businesses as a payment system subject to the rule and did not provide any exemptions for participants in a money transmitting business.

127.  See summary of conference call with the National Money Transmitters Association (call date June 3, 2007) (hereinafter “NMTA call summary”) p.1. (“The business of most smaller [money transmitter organizations] is person-to-person remittances. Furthermore, most smaller MTOs do not allow Internet-initiated transactions—a customer is usually required to visit an agent location in person in order to perform a transaction.”)

128.  The Agencies have added a new § __.5(c) to the rule stating that a participant in a designated payment system, such as a small depository institution participating in a card system, may rely on a written statement or notice by the operator of that system that the system's policies and procedures comply with the requirements of this rule.

129.  See, e.g., MasterCard letter, supra note 53, at 3.

130.  NMTA call summary, supra note 41, at 1.

131.  NMTA call summary, supra note 41, at 1-2.

132.  E.g. Advocacy letter, supra note 106 at 4; see also TMSRT letter, supra note 35 at 3-4.

133.  E.g., TMSRT letter, supra note 35 at 2.

134.  E.g., CBA letter, supra note 121, at 4.

135.  E.g., BB&T letter, supra note 67, at 2.

136.  See, e.g., comment letter from the State Dept. Federal Credit Union (Dec. 13, 2007) p. 2.

137.  See, e.g., comment letter from the Electronic Check Clearing House Organization (Dec. 10, 2007) p. 3.

138.  See, e.g., The Clearing House letter, supra note 14, at 9.

139.  See, e.g., NACHA letter, supra note 38, at 5.

140.  E.g., Wells Fargo letter, supra note 19, at 23-24.

141.  See, e.g., M&T Bank letter, supra note 45, at 4.

142.  One commenter expressed concern specifically regarding the number of entities involved in stored value cards and gift cards that would be subject to the rule's recordkeeping requirements. See Alston & Bird letter, supra note 49, at 23 With respect to implementing the final rule's non-exclusive examples for card systems, the relevant entities are the card system operators, merchant acquirers, and the card issuers. Retailers, such as grocery stores or convenience stores, are not participants in a designated payment system, as defined by the final rule, by virtue of their selling pre-paid gift cards or stored value products and thus are not covered by the final rule.

143.  The one-time burden hours for the 4,240 commercial banks, 829 savings associations, and 3 card system operators is 100 hours each. The one-time burden for 4,068 credit unions is 20 hours each. The one-time burden for 8 money transmitting business operators is 120 hours each.

144.  The one-time burden hours for the 3,459 commercial banks and 3 card system operators is 100 hours each. The one-time burden for 4,068 credit unions is 20 hours each. The one-time burden for 8 money transmitting business operators is 120 hours each.

145.  Total cost to the banking, card system, and money transmitting industries was estimated using the following formula. Percent of staff time, multiplied by annual burden hours, multiplied by hourly rate: 20% Clerical @ $25, 25% Managerial or Technical @ $55, 25% Senior Management @ $100, and 30% Legal Counsel @ $144. Hourly rate estimates for each occupational group are averages using data from the Bureau of Labor and Statistics, Occupational Employment and Wages, news release.