2023-19815. Privacy Act of 1974; Proposed Rule Exempting a System of Records From Certain Provisions of the Privacy Act of 1974

AGENCY:

Financial Crimes Enforcement Network (FinCEN), Treasury.

ACTION:

Notice of proposed rulemaking (NPRM).

SUMMARY:

In accordance with the requirements of the Privacy Act of 1974, as amended, FinCEN gives notice of a proposed amendment to exempt a new system of records, entitled “FinCEN .004—Beneficial Ownership Information System,” from certain provisions of the Privacy Act. The Beneficial Ownership Information (BOI) System is being established to implement the beneficial ownership information reporting and access requirements set out in the Corporate Transparency Act (CTA), which was enacted on January 1, 2021, as part of the Anti-Money Laundering Act of 2020. The exemptions are intended to increase the value of the system for law enforcement purposes and to comply with the CTA's prohibitions against unauthorized disclosure of certain information. Public comments are invited.

DATES:

Comments on this document must be received by October 16, 2023.

ADDRESSES:

Written comments on this document may be submitted electronically through the Federal Government eRulemaking portal at https://www.regulations.gov. Electronic submission of comments allows the commenter maximum time to prepare and submit a comment, ensures timely receipt, and enables the Department of the Treasury (Treasury) to make the comments available to the public. Please note that comments submitted through https://www.regulations.gov will be public and can be viewed by members of the public.

In general, Treasury will post all comments to https://www.regulations.gov without change, including any business or personal information provided, such as names, addresses, email addresses, or telephone numbers. All comments received, including attachments and other supporting material, will be part of the public record and subject to public disclosure. You should submit only information that you wish to make publicly available.

FOR FURTHER INFORMATION CONTACT:

For questions about this document and privacy issues, contact: Deputy Assistant Secretary for Privacy, Transparency, and Records at U.S. Department of the Treasury, 1500 Pennsylvania Avenue NW, Washington, DC 20220; telephone: [phone].

SUPPLEMENTARY INFORMATION:

Background

In a separate notice published on September 14, 2023, FinCEN is proposing to establish a system of records for information that the bureau will collect pursuant to the CTA, which was enacted into law as part of the Anti-Money Laundering Act of 2020.^[1] The CTA requires “reporting companies”—certain corporations, limited liability companies, and other entities created in or registered to do business in the United States—to report to FinCEN identifying information associated with the entities themselves, their beneficial owners, and their company applicants (together, beneficial ownership information or BOI). The CTA establishes that beneficial ownership information (BOI) is “sensitive information” and imposes strict confidentiality and security restrictions on the storage, access, and use of that information.^[2]

On September 30, 2022, FinCEN issued the final rule establishing BOI reporting requirements (the Reporting Rule).^[3] The Reporting Rule requires reporting companies to report BOI to FinCEN. Reporting companies will provide this information to FinCEN by submitting a Beneficial Ownership Information Report (BOIR). An initial BOIR must include the following BOI about the reporting company's beneficial owners and company applicants (if the reporting company is required to report company applicant information): full legal name; date of birth; complete current address; and unique identifying number and issuing jurisdiction from an acceptable non-expired identification document ( i.e., a passport issued by the U.S. government, a document issued by a State,^[4] local government, or Indian tribe for the purposes of identifying the individual, a driver's license issued by a State, or a passport issued by a foreign government if the individual does not possess any of the other documents described). Additionally, an image of the identification document must be included in the BOIR. Reporting companies must file an updated BOIR to reflect any changes to required information previously submitted to FinCEN.

An individual or a reporting company may obtain a FinCEN identifier (FinCEN ID) by providing certain information to FinCEN. A FinCEN ID is unique to each such individual or reporting company. The FinCEN ID associated with an individual can be used in lieu of the information required to be reported about that individual. An individual may request and obtain a FinCEN ID by submitting an application containing the information described above in connection with a reporting company's beneficial owner or company applicant. Information provided to FinCEN to obtain a FinCEN ID will be disclosed to authorized recipients for authorized purposes—in the same way and to the same extent as BOI. The effective date of the Reporting Rule is January 1, 2024.

In addition to imposing reporting requirements, the CTA also authorizes FinCEN to disclose BOI to five categories of authorized recipients, subject to strict security, confidentiality, and use protocols. Those categories include foreign and domestic law enforcement agencies, but do not include disclosures to beneficial owners, company applicants, or individuals who have obtained FinCEN IDs.

To collect, maintain, and provide access to BOI, FinCEN is developing the Beneficial Ownership Information System (the BOI System). The CTA dictates that the BOI System should be “highly useful” to its authorized users, including law enforcement agencies.^[5] Indeed, the information to be collected by FinCEN is intended to assist law enforcement in: anti-money laundering, tax, and other financial investigations; advance counterterrorism, counter-proliferation, and broader national security and intelligence interests; help prevent evasion of financial sanctions; and facilitate tax compliance.

Privacy Act

The Privacy Act contains certain requirements regarding the maintenance and disclosure of a system of records. Those requirements may differ from, or conflict with, the comprehensive requirements for maintaining and disclosing BOI specified in the CTA. For example, while the Privacy Act provides for access to records by certain individuals upon request, the CTA prohibits disclosure of BOI except as authorized in five enumerated categories, none of which include disclosure to such individuals under the Privacy Act.^[6] The CTA, therefore, expressly prohibits certain disclosures that would otherwise be required under the more general provisions of the Privacy Act. In this and any other case where the CTA conflicts with the Privacy Act, FinCEN believes that the more detailed, specific provisions of the CTA supersede any contrary provisions in the Privacy Act. Nevertheless, to the extent certain provisions of the Privacy Act were to apply, and without conceding that they do, FinCEN is publishing this proposed rule pursuant to 5 U.S.C. 552(j) and (k), to exempt FinCEN .004—Beneficial Ownership Information System from those provisions.

Under 5 U.S.C. 552a(j)(2), the head of a Federal agency may promulgate rules to exempt a system of records from certain provisions of 5 U.S.C. 552a if the system of records is “maintained by an agency or component thereof which performs as its principal function any activity pertaining to the enforcement of criminal laws, including police efforts to prevent, control, or reduce crime or to apprehend criminals, and the activities of prosecutors, courts, correctional, probation, pardon or parole authorities, and which consists of (A) information compiled for the purpose of identifying individual criminal offenders and alleged offenders and consisting only of identifying data and notations of arrests, the nature and disposition of criminal charges, sentencing, confinement, release, and parole and probation status; (B) information compiled for the purpose of a criminal investigation, including reports of informants and investigators, and associated with an identifiable individual; or (C) reports identifiable to an individual compiled at any stage of the process of enforcement of the criminal laws from arrest or indictment through release from supervision.”

Under 5 U.S.C. 552a(k)(2), the head of a Federal agency may promulgate rules to exempt a system of records from certain provisions of 5 U.S.C. 552a if the system of records is “investigatory material compiled for law enforcement purposes, other than material within the scope of subsection (j)(2) of this section.”

FinCEN is hereby giving notice of a proposed rule to exempt the BOI System from certain provisions of the Privacy Act pursuant to 5 U.S.C. 552a(j)(2) and (k)(2) and the authority vested in the Secretary of the Treasury by 31 CFR 1.23(c). The reasons for exempting the system of records from sections (c)(3), (c)(4), (d)(1), (d)(2), (d)(3), (d)(4), (e)(1), (e)(2), (e)(4)(G), (e)(4)(H), (e)(5), (e)(8), (f) and (g) of the Privacy Act are as follows:

(1) 5 U.S.C. 552a(d)(1), (e)(4)(H) and (f)(2), (f)(3) and (f)(5) grant individuals access to records containing information about them. An exemption from these provisions is appropriate because the CTA prohibits FinCEN from disclosing BOI except to five categories of authorized recipients; ^[7] these categories do not include beneficial owners, company applicants, or individuals who have obtained FinCEN IDs. Because individuals who are the subject of the records in the BOI System are not included in any of those categories, the application of 5 U.S.C. 552a(d)(1), (e)(4)(H) and (f)(2), (f)(3) and (f)(5) to the BOI System would contravene the CTA's disclosure restrictions.

(2) 5 U.S.C. 552a(e)(4)(G) and (f)(1) enable individuals to inquire whether a system of records contains records about them. An exemption from these provisions is appropriate because allowing individuals involved in illegal activity to learn that FinCEN has information concerning those individuals that could lead to them being identified for investigation could undercut the CTA mandate that the BOI System be “highly useful” to law enforcement agencies. For instance, such notice could prompt individuals engaged in illegal activity to: (a) take steps to avoid detection; (b) begin, continue, or resume illegal conduct upon learning that they are not identified in the system of records; or (c) destroy evidence needed to prove the violation.

(3) 5 U.S.C. 552a(d)(2), (d)(3) and (d)(4), (e)(4)(H) and (f)(4) permit individuals to request amendment of a record pertaining to them and require the agency either to amend the record or note the disputed portion of the record and, if the agency refuses to amend the record, to provide a copy of the individual's statement of disagreement with the agency's refusal, to persons or other agencies to whom the record is thereafter disclosed. Because these provisions depend on individuals having access to their records, and since this rule proposes to exempt the BOI System from the provisions of 5 U.S.C. 552a relating to access to records for the reasons set forth above, these provisions would not apply to the BOI System. Furthermore, an exemption from this requirement is appropriate because allowing individuals to amend certain records that pertain to them would conflict with the mechanism for reporting and updating beneficial ownership information provided for in the CTA.

(4) 5 U.S.C. 552a(c)(4) requires an agency to inform any person or other agency about any correction or notation of dispute that the agency made in accordance with 5 U.S.C. 552a(d) to any record that the agency disclosed to the person or agency, if an accounting of the disclosure was made. Because this provision depends on individuals having access to and an opportunity to request amendment of records pertaining to them, and because this rule proposes to exempt the BOI System from the provisions of 5 U.S.C. 552a relating to access to and amendment of records for the reasons set forth above, this provision would not apply to the BOI System.

(5) 5 U.S.C. 552a(c)(3) requires an agency to make any accounting of disclosures of records required by 5 U.S.C. 552a(c)(1) available to the individual named in the record upon his or her request. Any such accounting must state the date, nature, and purpose of each disclosure of the record and the name and address of the recipient. Applying this provision would impair the effective use of information collected in the BOI System. Making an accounting of disclosures available to the subject of an investigation would alert them that another agency is investigating their criminal activities and could reveal the geographic location of the other agency's investigation, the nature and purpose of that investigation, and the dates on which that investigation was active. Violators possessing such knowledge would be able to take measures to avoid detection or apprehension by: (a) altering their operations; (b) transferring their criminal activities to other geographical areas, legal entities, or ostensible beneficial owners; or (c) destroying or concealing evidence that would form the basis for arrest. Moreover, providing an accounting to the subjects of investigations would alert them to the fact that FinCEN has information relevant to their suspected criminal activities. Access to such information, together with other available information, could reveal the operation of the information-gathering and analysis systems of FinCEN and other BOI System users, and permit violators to take steps to avoid detection or apprehension.

(6) 5 U.S.C. 552a(e)(1) requires an agency to maintain in its records only such information about an individual as is relevant and necessary to accomplish a purpose of the agency required to be accomplished by statute or executive order. Maintenance of information, as defined in 5 U.S.C. 552a(a)(3), includes the collection and dissemination of information. An exemption from this provision is therefore appropriate because its application would require FinCEN to make determinations at the time of collection about the relevance and necessity of collected information. Speculative determinations about the relevance and necessity of collected information could negatively impact the quality of information available to law enforcement in future investigations, which would undermine the mandate in the CTA that the BOI System be “highly useful” to law enforcement.

(7) 5 U.S.C. 552a(e)(2) requires an agency to collect information to the greatest extent practicable directly from the subject individual when the information may result in adverse determinations about an individual's rights, benefits, and privileges under Federal programs. To the extent information in the BOI System might result in such an adverse determination, applying this provision would contravene the requirement in the CTA that FinCEN collect BOI from reporting companies.

(8) 5 U.S.C. 552a(e)(5) requires an agency to maintain all records it uses in making any determination about any individual with such accuracy, relevance, timeliness, and completeness as is reasonably necessary to assure fairness to the individual in the determination. Because 5 U.S.C. 552a(a)(3) defines “maintain” as including “collect” and “disseminate,” applying this provision to the BOI System would hinder timely dissemination of BOI, and by extension hinder law enforcement efforts dependent upon such information. Information in the BOI System is filed by reporting companies and individual FinCEN ID applicants, and it is not possible at the time of collection to determine whether the information in such records is accurate, relevant, timely, and complete.

(9) 5 U.S.C. 552a(e)(8) requires an agency to make reasonable efforts to serve notice on an individual when the agency makes any record on the individual available to any person under compulsory legal process when such process becomes a matter of public record. Exemption from this requirement is appropriate because applying the requirement to the BOI System could reveal to the subject of a law enforcement investigation or action that a law enforcement agency used BOI in the investigation or action, thereby revealing the agency's investigative techniques and procedures.

(10) 5 U.S.C. 552a(g) provides an individual with civil remedies when: (a) an agency wrongfully refuses to amend a record or to review a request for amendment; (b) an agency wrongfully refuses to grant access to a record; (c) any determination relating to an individual is based on records that are not accurate, relevant, timely and complete; and (d) an agency fails to comply with any other provision of 5 U.S.C. 552a so as to adversely affect the individual. The BOI System should be exempted from this provision to the extent that the civil remedies relate to the provisions of 5 U.S.C. 552a from which the prior paragraphs of this section exempt the BOI System. There should be no civil remedies for failure to comply with provisions from which this system of records is exempted. Exemption from this provision will also protect FinCEN from baseless civil court actions that might hamper its ability to collate, analyze and disseminate data.

Any information from a system of records for which an exemption is claimed under 5 U.S.C. 552a(j)(2) or (k)(2) which is also included in another system of records retains the same exempt status such information has in the system of records for which such exemption is claimed.

Regulatory Analysis

This proposed rule is not a “significant regulatory action” under Executive Order 12866.

Pursuant to the requirements of the Regulatory Flexibility Act (RFA), 5 U.S.C. 601 et seq., it is hereby certified that this proposed rule will not have a significant economic impact on a substantial number of small entities. The proposed regulation, issued under sections (j)(2) and (k)(2) of the Privacy Act, is to exempt certain information maintained by Treasury in the above-referenced systems of records from certain provisions of the Privacy Act. Small entities, as defined in the RFA, are not provided rights under the Privacy Act and are outside the scope of this regulation.

In accordance with the provisions of the Paperwork Reduction Act of 1995, 44 U.S.C. 3501 et seq., FinCEN has determined that this proposed rule will not impose new record keeping, reporting, or other types of information collection requirements.

Lists of Subjects in 31 CFR Part 1

• Privacy

For the reasons stated in the preamble, part 1 of title 31 of the Code of Federal Regulations is proposed to be amended as follows:

PART 1—DISCLOSURE OF RECORDS

1. The authority citation for part 1 continues to read as follows:

Authority: 5 U.S.C. 301, 552, 552a, 553; 31 U.S.C. 301, 321; 31 U.S.C. 3717.

2. Amend § 1.36 by adding, in alphanumeric order, an entry for “FinCEN .004” in table 7 to paragraph (c)(1)(vii) and table 17 to paragraph (g)(1)(ix) to read as follows:

§ 1.36

Systems exempt in whole or in part from provisions of the Privacy Act and this part.

* * * * *

(c) * * *

(1) * * *

(vii) * * *

Table 7 to Paragraph (c)(1)(vii)

No.	Name of system
*         *         *         *         *         *         *
FinCEN .004	Beneficial Ownership Information System (not exempt from 5 U.S.C. 552a(e)(3) and 5 U.S.C. 552a(e)(4)(I)).

* * * * *

(g) * * *

(1) * * *

(ix) * * *

Table 17 to Paragraph (g)(1)(ix)

No.	Name of system
*         *         *         *         *         *         *
FinCEN .004	Beneficial Ownership Information System (not exempt from 5 U.S.C. 552a(e)(3) and 5 U.S.C. 552a(e)(4)(I)).

* * * * *

Ryan Law,

Deputy Assistant Secretary Privacy, Transparency, and Records, U.S. Department of the Treasury.

Footnotes

1.  The CTA is Title LXIV of the William M. (Mac) Thornberry National Defense Authorization Act for Fiscal Year 2021, Public Law 116–283 (Jan. 1, 2021) (the NDAA). Division F of the NDAA is the Anti-Money Laundering Act of 2020 (AML Act), which includes the CTA.

2.   See CTA, section 6402(6), (7).

3.  FinCEN, Beneficial Ownership Information Reporting Requirements,87 FR 59498 (Sept. 30, 2022), available at https://www.federalregister.gov/​documents/​2022/​09/​30/​2022-21020/​beneficial-ownership-information-reporting-requirements.

4.  The term “State” means any State of the United States, the District of Columbia, or any commonwealth, territory, or possession of the United States. See31 U.S.C. 5336(a)(12).

5.   See CTA, section 6402(8)(C).

6.   Compare5 U.S.C. 552a(d) with CTA, section 6402(c)(2).

7.  31 U.S.C. 5337(c)(2).