2023-25681. Privacy Act of 1974; Exemptions

AGENCY:

Financial Crimes Enforcement Network (FinCEN), Treasury.

ACTION:

Final rule.

SUMMARY:

In accordance with the requirements of the Privacy Act of 1974, as amended, Treasury is issuing a final rule, exempting a new system of records, entitled “FinCEN .004—Beneficial Ownership Information System,” from certain provisions of the Privacy Act. The Beneficial Ownership Information (BOI) System is being established to implement the beneficial ownership information reporting and access requirements set out in the Corporate Transparency Act (CTA), which was enacted on January 1, 2021, as part of the Anti-Money Laundering Act of 2020. The exemptions are intended to increase the value of the system for law enforcement purposes and to comply with the CTA's prohibitions against unauthorized disclosure of certain information.

DATES:

This rule is effective January 1, 2024.

FOR FURTHER INFORMATION CONTACT:

For questions about this document and privacy issues, contact: Ryan Law, Deputy Assistant Secretary for Privacy, Transparency, and Records at U.S. Department of the Treasury, 1500 Pennsylvania Avenue NW, Washington, DC 20220; telephone: [phone].

SUPPLEMENTARY INFORMATION:

Background

On September 14, 2023, Treasury published a notice of proposed rulemaking (the “NPRM”) in the Federal Register , 88 FR 63039, proposing to exempt a system of records, FinCEN .004—Beneficial Ownership Information System (the “BOI System”), from provisions of the Privacy Act. Pursuant to the CTA, starting on January 1, 2024, FinCEN will use the BOI System to maintain BOI submitted to FinCEN by certain corporations, limited liability companies, and other entities created in or registered to do business in the United States (“reporting companies”). BOI includes identifying information associated with the reporting companies themselves, their beneficial owners, and their company applicants. The BOI System will also maintain information about individuals who apply to FinCEN for FinCEN identifiers, which beneficial owners and company applicants will be able to use in lieu of the information required to be reported about them by reporting companies.^[1] Information provided to FinCEN to obtain a FinCEN identifier will be disclosed to authorized recipients for authorized purposes in the same way and to the same extent as BOI. The CTA authorizes FinCEN to disclose BOI to five categories of authorized recipients that include foreign and domestic law enforcement agencies, but do not include beneficial owners, company applicants, or individuals who have obtained FinCEN identifiers.

The Privacy Act contains certain requirements regarding the maintenance and disclosure of a system of records. Those requirements may differ from, or conflict with, the comprehensive requirements for maintaining and disclosing BOI specified in the CTA. In any case where the CTA conflicts with the Privacy Act, FinCEN believes that the more detailed, specific provisions of the CTA supersede any contrary provisions in the Privacy Act. Nevertheless, to the extent certain provisions of the Privacy Act were to apply, and without conceding that they do, Treasury is publishing this final rule pursuant to 5 U.S.C. 552a(j) and (k), to exempt the BOI System from those provisions.

Under 5 U.S.C. 552a(j)(2), the head of a Federal agency may promulgate rules to exempt a system of records from certain provisions of 5 U.S.C. 552a if the system of records is maintained by an agency or component thereof that performs as its principal function any activity pertaining to the enforcement of criminal laws, including police efforts to prevent, control, or reduce crime or to apprehend criminals, and the activities of prosecutors, courts, correctional, probation, pardon, or parole authorities and which consists of (a) information compiled for the purpose of identifying individual criminal offenders and alleged offenders and consisting only of identifying data and notations of arrests, the nature and disposition of criminal charges, sentencing, confinement, release, and parole and probation status; (b) information compiled for the purpose of a criminal investigation, including reports of informants and investigators, and associated with an identifiable individual; or (c) reports identifiable to an individual compiled at any stage of the process of enforcement of the criminal laws from arrest or indictment through release from supervision.

Under 5 U.S.C. 552a(k)(2), the head of a Federal agency may promulgate rules to exempt a system of records from certain provisions of 5 U.S.C. 552a if the system of records is “investigatory material compiled for law enforcement purposes, other than material within the scope of subsection (j)(2) of this section.”

The reasons for exempting the BOI System from sections (c)(3), (c)(4), (d)(1), (d)(2), (d)(3), (d)(4), (e)(1), (e)(2), (e)(4)(G), (e)(4)(H), (e)(5), (e)(8), (f), and (g) of the Privacy Act are as follows:

(1) 5 U.S.C. 552a(d)(1), (e)(4)(H) and (f)(2), (f)(3), and (f)(5) grant individuals access to records containing information about them. An exemption from these provisions is appropriate because the CTA prohibits FinCEN from disclosing BOI except to five categories of authorized recipients; ^[2] these categories do not include beneficial owners, company applicants, or individuals who have obtained FinCEN identifiers. Because individuals who are the subject of the records in the BOI System are not included in any of those categories, the application of 5 U.S.C. 552a(d)(1), (e)(4)(H) and (f)(2), (f)(3), and (f)(5) to the BOI System would contravene the CTA's disclosure restrictions.

(2) 5 U.S.C. 552a(e)(4)(G) and (f)(1) enable individuals to inquire whether a system of records contains records about them. An exemption from these provisions is appropriate because allowing individuals involved in illegal activity to learn that FinCEN has information concerning those individuals that could lead to them being identified for investigation could undercut the CTA mandate that the BOI System be “highly useful” to law enforcement agencies. For instance, such notice could prompt individuals engaged in illegal activity to: (a) take steps to avoid detection; (b) begin, continue, or resume illegal conduct upon learning that they are not identified in the system of records; or (c) destroy evidence needed to prove the violation.

(3) 5 U.S.C. 552a(d)(2), (d)(3) and (d)(4), (e)(4)(H), and (f)(4) permit individuals to request amendment of a record pertaining to them and require the agency either to amend the record or note the disputed portion of the record and, if the agency refuses to amend the record, to provide a copy of the individual's statement of disagreement with the agency's refusal, to persons or other agencies to whom the record is thereafter disclosed. Because these provisions depend on individuals having access to their records, and since this rule exempts the BOI System from the provisions of 5 U.S.C. 552a relating to access to records for the reasons set forth above, these provisions do not apply to the BOI System. Furthermore, an exemption from this requirement is appropriate because allowing individuals to amend certain records that pertain to them would conflict with the mechanism for reporting beneficial ownership information provided for in the CTA.

(4) 5 U.S.C. 552a(c)(4) requires an agency to inform any person or other agency about any correction or notation of dispute that the agency made in accordance with 5 U.S.C. 552a(d) to any record that the agency disclosed to the person or agency, if an accounting of the disclosure was made. Because this provision depends on individuals having access to and an opportunity to request amendment of records pertaining to them, and because this rule exempts the BOI System from the provisions of 5 U.S.C. 552a relating to access to and amendment of records for the reasons set forth above, this provision does not apply to the BOI System.

(5) 5 U.S.C. 552a(c)(3) requires an agency to make the accounting of any disclosures of records required by 5 U.S.C. 552a(c)(1) available to the individual named in the record upon his or her request. The accounting must state the date, nature, and purpose of each disclosure of the record and the name and address of the recipient. Applying this provision would impair the effective use of information collected in the BOI System. Making an accounting of disclosures available to the subject of an investigation would alert them that another agency is investigating their criminal activities and could reveal the geographic location of the other agency's investigation, the nature and purpose of that investigation, and the dates on which that investigation was active. Violators possessing such knowledge would be able to take measures to avoid detection or apprehension by: (a) altering their operations; (b) transferring their criminal activities to other geographical areas, legal entities, or ostensible beneficial owners; or (c) destroying or concealing evidence that would form the basis for arrest. Moreover, providing an accounting to the subjects of investigations would alert them to the fact that FinCEN has information relevant to their criminal activities. Access to such information, together with other available information, could reveal the operation of the information-gathering and analysis systems of FinCEN and other BOI System users, and permit violators to take steps to avoid detection or apprehension.

(6) 5 U.S.C. 552a(e)(1) requires an agency to maintain in its records only such information about an individual as is relevant and necessary to accomplish a purpose of the agency required to be accomplished by statute or Executive order. Maintenance of information, as defined in 5 U.S.C. 552a(a)(3), includes the collection and dissemination of information. An exemption from this provision is therefore appropriate because its application would require FinCEN to make determinations at the time of collection about the relevance and necessity of collected information. Speculative determinations about the relevance and necessity of collected information could negatively impact the quality of information available to law enforcement in future investigations, which would undermine the mandate in the CTA that the BOI System be “highly useful” to law enforcement.

(7) 5 U.S.C. 552a(e)(2) requires an agency to collect information to the greatest extent practicable directly from the subject individual when the information may result in adverse determinations about an individual's rights, benefits, and privileges under Federal programs. If such a program exists, an exemption to this provision is appropriate because applying it to the BOI System would contravene the requirement in the CTA that FinCEN collect BOI from reporting companies.

(8) 5 U.S.C. 552a(e)(5) requires an agency to maintain all records it uses in making any determination about any individual with such accuracy, relevance, timeliness, and completeness as is reasonably necessary to assure fairness to the individual in the determination. Because 5 U.S.C. 552a(a)(3) defines “maintain” as including “collect” and “disseminate,” applying this provision to the BOI System would hinder timely dissemination of BOI, and by extension hinder law enforcement efforts dependent upon such information. Information in the BOI System is filed by reporting companies and individual FinCEN identifier applicants, and it is not possible at the time of collection to determine whether the information in such records is accurate, relevant, timely, and complete.

(9) 5 U.S.C. 552a(e)(8) requires an agency to make reasonable efforts to serve notice on an individual when the agency makes any record on the individual available to any person under compulsory legal process when such process becomes a matter of public record. Exemption from this requirement is appropriate because applying the requirement to the BOI System could reveal to the subject of a law enforcement investigation or action that a law enforcement agency used BOI in the investigation or action, thereby revealing the agency's investigative techniques and procedures.

(10) 5 U.S.C. 552a(g) provides an individual with civil remedies when: (a) an agency wrongfully refuses to amend a record or to review a request for amendment; (b) an agency wrongfully refuses to grant access to a record; (c) any determination relating to an individual is based on records that are not accurate, relevant, timely and complete; and (d) an agency fails to comply with any other provision of 5 U.S.C. 552a so as to adversely affect the individual. The BOI System is exempt from this provision to the extent that the civil remedies relate to the provisions of 5 U.S.C. 552a from which the prior paragraphs of this section exempt the BOI System. Exemption from this provision is appropriate because there should be no civil remedies for failure to comply with provisions from which the BOI System is exempt. Exemption from this provision will also protect FinCEN from baseless civil court actions that might hamper its ability to collate, analyze, and disseminate data.

Any information from a system of records for which an exemption is claimed under 5 U.S.C. 552a(j)(2) or (k)(2) which is also included in another system of records retains the same exempt status such information has in the system of records for which such exemption is claimed.

Public Comments

Treasury received two comments on the NPRM. The first expressed support for the proposed rule, noting its “import[ance] for protecting an individual's privacy, while also increasing the value of the [BOI System] for law enforcement purposes.”

The second addresses the proposal to exempt the BOI System from the requirements of 5 U.S.C. 552a(c)(3) and suggests a potential alternative approach. As explained above, that provision of the Privacy Act requires an agency to make the accounting of any disclosures of records required by 5 U.S.C. 552a(c)(1) available to the individual named in the record upon his or her request. The comment's author argues that fully exempting the BOI System from these requirements “would make the [] audit trail required by the CTA meaningless” and that “[a]llowing for an accounting of disclosures to be made to the public would help ensure that the right to privacy would not be violated through unauthorized disclosures.” The commenter suggests that the BOI System should be only partially exempt from 5 U.S.C. 552a(c)(3) and that FinCEN should establish procedures under 5 U.S.C. 552a(f)(2) that would make accountings of disclosures available to requesters after some specified amount of time has passed (the commenter proposes one year).

FinCEN carefully considered this comment, particularly the commenter's claim that exempting the BOI System from the requirements of 5 U.S.C. 552a(c)(3) would make the system's audit trails meaningless. FinCEN interpreted this comment as asserting that BOI System audit trails would constitute “accountings of disclosures” that would only be meaningful if individuals about whom the system contains records have access to them. However, FinCEN disagrees with this view.

In its “Sense of Congress,” the CTA directs the Secretary of the Treasury to “take all steps, including regular auditing, to ensure that government authorities accessing beneficial ownership information do so only for authorized purposes consistent with [the CTA] . . . .” ^[3] Accordingly, FinCEN will use the BOI System's audit trails to identify potential instances of improper access to BOI by authorized system users. The audit trails will also support other aspects of the CTA compliance and enforcement regime, including the imposition of penalties, which will further help to ensure that BOI is accessed and used appropriately.

Separately, for the reasons set out in the NPRM and reiterated above regarding the potential adverse impact on law enforcement investigations, Treasury declines to adopt the suggestion to make accountings of disclosures available to requesters after a specified period of time. Law enforcement investigations may span years and share common individuals of interest with concurrent investigations of equally varying durations. Revealing information about BOI disclosures to the subjects of those disclosures—even after a seemingly lengthy delay—could put those activities at risk of disruption and jeopardize the effective use of the BOI System for law enforcement purposes. Furthermore, a delay in making an accounting of disclosures available would not address the concern that such access could reveal information about the operation of the information-gathering and analysis systems utilized by FinCEN and other BOI System users. The resulting effect would be to postpone, rather than prevent, foreseeable harms to the law enforcement activities that Congress intended the BOI System to support. Such a result would contradict the purpose of the CTA and, therefore, Treasury will adopt the rule as proposed.

Regulatory Analysis

This rule is not a “significant regulatory action” under Executive Order 12866, as amended.

Pursuant to the requirements of the Regulatory Flexibility Act (RFA), 5 U.S.C. 601 et seq., it is hereby certified that this rule will not have a significant economic impact on a substantial number of small entities. The rule, issued under sections (j)(2) and (k)(2) of the Privacy Act, exempts certain information maintained by Treasury in the above-referenced systems of records from certain provisions of the Privacy Act. Small entities, as defined in the RFA, are not provided rights under the Privacy Act and are outside the scope of this regulation.

In accordance with the provisions of the Paperwork Reduction Act of 1995, 44 U.S.C. 3501 et seq., FinCEN has determined that this rule will not impose new recordkeeping, reporting, or other types of information collection requirements.

Lists of Subjects in 31 CFR Part 1

• Privacy

For the reasons stated in the preamble, part 1 of title 31 of the Code of Federal Regulations is amended as follows:

PART 1—DISCLOSURE OF RECORDS

1. The authority citation for part 1 continues to read as follows:

Authority: 5 U.S.C. 301, 552, 552a, 553; 31 U.S.C. 301, 321; 31 U.S.C. 3717.

2. Amend § 1.36 by adding, in alphanumeric order, an entry for “FinCEN .004” in table 7 to paragraph (c)(1)(vii) and table 17 to paragraph (g)(1)(ix) to read as follows:

§ 1.36

Systems exempt in whole or in part from provisions of the Privacy Act and this part.

* * * * *

(c) * * *

(1) * * *

(vii) * * *

Table 7 to Paragraph ( c )(1)( vii )

No.	Name of system
*         *         *         *         *         *         *
FinCEN .004	Beneficial Ownership Information System (not exempt from 5 U.S.C. 552 a(e)(3) and 5 U.S.C. 552a(e)(4)(I)).

* * * * *

(g) * * *

(1) * * *

(ix) * * *

Table 17 to paragraph ( g )(1)( ix )

No.	Name of system
*         *         *         *         *         *         *
FinCEN .004	Beneficial Ownership Information System (not exempt from 5 U.S.C. 552a(e)(3) and 5 U.S.C. 552a(e)(4)(I)).

* * * * *

Ryan Law,

Deputy Assistant Secretary Privacy, Transparency, and Records, U.S. Department of the Treasury.

Footnotes

1.  Reporting companies will not use the FinCEN identifier application to request a FinCEN identifier but instead will request a FinCEN identifier when they submit a BOI report.

2.  31 U.S.C. 5337(c)(2).

3.  CTA, section 6402(7)(B).