2018-09694. Self-Regulatory Organizations; Financial Industry Regulatory Authority, Inc.; Notice of Filing and Immediate Effectiveness of a Proposed Rule Change Relating to FINRA Rule 3310 to Conform FINRA Rule 3310 to FinCEN's Final Rule on ...

May 2, 2018.

Pursuant to Section 19(b)(1) of the Securities Exchange Act of 1934 (“Act”) ^[1] and Rule 19b-4 thereunder,^[2] notice is hereby given that on April 20, 2018, Financial Industry Regulatory Authority, Inc. (“FINRA”) filed with the Securities and Exchange Commission (“SEC” or “Commission”) the proposed rule change as described in Items I, II, and III below, which Items have been prepared by FINRA. FINRA has designated the proposed rule change as constituting a “non-controversial” rule change under paragraph (f)(6) of Rule 19b-4 under the Act,^[3] which renders the proposal effective upon receipt of this filing by the Commission. The Commission is publishing this notice to solicit comments on the proposed rule change from interested persons.

I. Self-Regulatory Organization's Statement of the Terms of Substance of the Proposed Rule Change

FINRA is proposing to amend FINRA Rule 3310 (Anti-Money Laundering Compliance Program) to reflect the Financial Crimes Enforcement Network's (“FinCEN”) adoption of a final rule on Customer Due Diligence Requirements for Financial Institutions (“CDD Rule”). Specifically, the proposed amendments would conform FINRA Rule 3310 to the CDD Rule's amendments to the minimum regulatory requirements for member firms' anti-money laundering (“AML”) compliance programs by requiring such programs to include risk-based procedures for conducting ongoing customer due diligence. This ongoing customer due diligence element for AML programs includes: (1) Understanding the nature and purpose of customer relationships for the purpose of developing a customer risk profile; and (2) conducting ongoing monitoring to identify and report suspicious transactions and, on a risk basis, to maintain and update customer information.

The text of the proposed rule change is available on FINRA's website at http://www.finra.org,, at the principal office of FINRA and at the Commission's Public Reference Room.

II. Self-Regulatory Organization's Statement of the Purpose of, and Statutory Basis for, the Proposed Rule Change

In its filing with the Commission, FINRA included statements concerning the purpose of and basis for the proposed rule change and discussed any comments it received on the proposed rule change. The text of these statements may be examined at the places specified in Item IV below. FINRA has prepared summaries, set forth in sections A, B, and C below, of the most significant aspects of such statements.

A. Self-Regulatory Organization's Statement of the Purpose of, and Statutory Basis for, the Proposed Rule Change

1. Purpose

a. Background

The Bank Secrecy Act ^[4] (“BSA”), among other things, requires financial institutions,^[5] including broker-dealers, to develop and implement AML programs that, at a minimum, meet the statutorily enumerated “four pillars.” ^[6] These four pillars currently require broker-dealers to have written AML programs that include, at a minimum:

• The establishment and implementation of policies, procedures and internal controls reasonably designed to achieve compliance with the applicable provisions of the BSA and implementing regulations;
• independent testing for compliance by broker-dealer personnel or a qualified outside party;
• designation of an individual or individuals responsible for implementing and monitoring the operations and internal controls of the AML program; and
• ongoing training for appropriate persons.^[7]

In addition to meeting the BSA's requirements with respect to AML programs, broker-dealers must also comply with FINRA Rule 3310, which incorporates the BSA's four pillars, as well as requiring broker-dealers' AML programs to establish and implement policies and procedures that can be reasonably expected to detect and cause the reporting of suspicious transactions.

On May 11, 2016, FinCEN, the bureau of the Department of the Treasury responsible for administering the BSA and its implementing regulations, issued the CDD Rule ^[8] to clarify and strengthen customer due diligence for covered financial institutions,^[9] including broker-dealers. In its CDD Rule, FinCEN identifies four components of customer due diligence: (1) Customer identification and verification; (2) beneficial ownership identification and verification; (3) understanding the nature and purpose of customer relationships; and (4) ongoing monitoring for reporting suspicious transactions and, on a risk basis, maintaining and updating customer information.^[10] As the first component is already required to be part of a broker-dealer's AML program under the BSA, the CDD Rule focuses on the other three components.

Specifically, the CDD Rule focuses particularly on the second component by adding a new requirement that covered financial institutions identify and verify the identity of the beneficial owners of all legal entity customers at the time a new account is opened, subject to certain exclusions and exemptions.^[11] The CDD Rule also addresses the third and fourth components, which FinCEN states “are already implicitly required for covered financial institutions to comply with their suspicious activity reporting requirements,” by amending the existing AML program rules for covered financial institutions to explicitly require these components to be included in AML programs as a new “fifth pillar.” As a result of the CDD Rule, member firms should ensure that their AML programs are updated, as necessary, to comply with the CDD Rule by May 11, 2018.

On November 21, 2017, FINRA published Regulatory Notice 17-40 to provide guidance to member firms regarding their obligations under FINRA Rule 3310 in light of the adoption of FinCEN's CDD Rule. In addition, the Notice summarized the CDD Rule's impact on member firms, including the addition of the new fifth pillar required for member firms' AML programs. This proposed rule change amends FINRA Rule 3310 to incorporate the fifth pillar.

b. FINRA Rule 3310 and Amendment to Minimum Requirements for Member Firms' AML Programs

Section 352 of the USA PATRIOT Act of 2001 ^[12] amended the BSA to require broker-dealers to develop and implement AML programs that include the four pillars mentioned above. Consistent with Section 352 of the PATRIOT Act, and incorporating the four pillars, FINRA Rule 3310 requires each member firm to develop and implement a written AML program reasonably designed to achieve and monitor the member firm's compliance with the BSA and implementing regulations. Among other requirements, FINRA Rule 3310 requires that each member firm, at a minimum: (1) Establish and implement policies and procedures that can be reasonably expected to detect and cause the reporting of suspicious transactions; (2) establish and implement policies, procedures, and internal controls reasonably designed to achieve compliance with the BSA and implementing regulations; (3) provide for annual (on a calendar-year basis) independent testing for compliance to be conducted by member firm personnel or a qualified outside party; ^[13] (4) designate and identify to FINRA an individual or individuals (i.e., AML compliance person(s)) who will be responsible for implementing and monitoring the day-to-day operations and internal controls of the AML program and provide prompt notification to FINRA of any changes to the designation; and (5) provide ongoing training for appropriate persons.

FinCEN's CDD Rule does not change the requirements of FINRA Rule 3310 and member firms must continue to comply with its requirements.^[14] However, FinCEN's CDD Rule amends the minimum regulatory requirements for member firms' AML programs by explicitly requiring such programs to include risk-based procedures for conducting ongoing customer due diligence.^[15] Accordingly, FINRA is proposing to amend FINRA Rule 3310 to incorporate into the Rule this ongoing customer due diligence element, or “fifth pillar” required for AML programs. Thus, proposed Rule 3310(f) would provide that the AML programs required by this Rule shall, at a minimum include appropriate risk-based procedures for conducting ongoing customer due diligence, to include, but not be limited to: (1) Understanding the nature and purpose of customer relationships for the purpose of developing a customer risk profile; and (2) Conducting ongoing monitoring to identify and report suspicious transactions and, on a risk basis, to maintain and update customer information.

As stated in the CDD Rule, these provisions are not new and merely codify existing expectations for firms to adequately identify and report suspicious transactions as required under the BSA and encapsulate practices generally already undertaken by securities firms to know and understand their customers.^[16] The proposed rule change simply incorporates into FINRA Rule 3310 the ongoing customer due diligence element, or “fifth pillar,” required for AML programs by the CDD Rule to aid member firms in complying with the CDD Rule's requirements. However, to the extent that these elements, which are briefly summarized below, are not already included in member firms' AML programs, the CDD Rule requires member firms to update their AML programs to explicitly incorporate them.

c. Summary of Fifth Pillar's Requirements

Understanding the Nature and Purpose of Customer Relationships

FinCEN states in the CDD Rule that firms must necessarily have an understanding of the nature and purpose of the customer relationship in order to determine whether a transaction is potentially suspicious and, in turn, to fulfill their SAR obligations.^[17] To that end, the CDD Rule requires that firms understand the nature and purpose of the customer relationship in order to develop a customer risk profile. The customer risk profile refers to information gathered about a customer to form the baseline against which customer activity is assessed for suspicious transaction reporting.^[18] Information relevant to understanding the nature and purpose of the customer relationship may be self-evident and, depending on the facts and circumstances, may include such information as the type of customer, account or service offered, and the customer's income, net worth, domicile, or principal occupation or business, as well as, in the case of existing customers, the customer's history of activity.^[19] The CDD Rule also does not prescribe a particular form of the customer risk profile.^[20] Instead, the CDD Rule states that depending on the firm and the nature of its business, a customer risk profile may consist of individualized risk scoring, placement of customers into risk categories or another means of assessing customer risk that allows firms to understand the risk posed by the customer and to demonstrate that understanding.^[21]

The CDD Rule also addresses the interplay of understanding the nature and purpose of customer relationships with the ongoing monitoring obligation discussed below. The CDD Rule explains that firms are not necessarily required or expected to integrate customer information or the customer risk profile into existing transaction monitoring systems (for example, to serve as the baseline for identifying and assessing suspicious transactions on a contemporaneous basis).^[22] Rather, FinCEN expects firms to use the customer information and customer risk profile as appropriate during the course of complying with their obligations under the BSA in order to determine whether a particular flagged transaction is suspicious.^[23]

Conducting Ongoing Monitoring

As with the requirement to understand the nature and purpose of the customer relationship, the requirement to conduct ongoing monitoring to identify and report suspicious transactions and, on a risk basis, to maintain and update customer information, merely adopts existing supervisory and regulatory expectations as explicit minimum standards of customer due diligence required for firms' AML programs.^[24] If, in the course of its normal monitoring for suspicious activity, the member firm detects information that is relevant to assessing the customer's risk profile, the member firm must update the customer information, including the information regarding the beneficial owners of legal entity customers.^[25] However, there is no expectation that the member firm update customer information, including beneficial ownership information, on an ongoing or continuous basis.^[26]

FINRA has filed the proposed rule change for immediate effectiveness. The implementation date for the proposed changes will be May 11, 2018 to coincide with the compliance date under the CDD Rule.

2. Statutory Basis

FINRA believes that the proposed rule change is consistent with the provisions of Section 15A(b)(6) of the Act,^[27] which requires, among other things, that FINRA rules must be designed to prevent fraudulent and manipulative acts and practices, to promote just and equitable principles of trade, and, in general, to protect investors and the public interest. FINRA believes the proposed rule change will aid member firms in complying with the CDD Rule's requirement that member firms' AML programs include risk-based procedures for conducting ongoing customer due diligence by also incorporating the requirement into FINRA Rule 3310.

B. Self-Regulatory Organization's Statement on Burden on Competition

FINRA does not believe that the proposed rule change will result in any burden on competition that is not necessary or appropriate in furtherance of the purposes of the Act. The proposed rule change simply incorporates into FINRA Rule 3310 the ongoing customer due diligence element, or “fifth pillar,” required for AML programs by the CDD Rule. Regardless of the proposed rule change, to the extent that the elements of the fifth pillar are not already included in member firms' AML programs, the CDD Rule requires member firms to update their AML programs to explicitly incorporate them by May 11, 2018. In addition, as stated in the CDD Rule, these elements are already implicitly required for covered financial institutions to comply with their suspicious activity reporting requirements. FINRA is not imposing any additional direct or indirect burdens on member firms or their clients through this proposal, and as such the proposal imposes no new burdens on competition.

C. Self-Regulatory Organization's Statement on Comments on the Proposed Rule Change Received From Members, Participants, or Others

Written comments were neither solicited nor received.

III. Date of Effectiveness of the Proposed Rule Change and Timing for Commission Action

Because the foregoing proposed rule change does not: (i) Significantly affect the protection of investors or the public interest; (ii) impose any significant burden on competition; and (iii) become operative for 30 days from the date on which it was filed, or such shorter time as the Commission may designate, it has become effective pursuant to Section 19(b)(3)(A) of the Act ^[28] and Rule 19b-4(f)(6) thereunder.^[29]

At any time within 60 days of the filing of the proposed rule change, the Commission summarily may temporarily suspend such rule change if it appears to the Commission that such action is necessary or appropriate in the public interest, for the protection of investors, or otherwise in furtherance of the purposes of the Act. If the Commission takes such action, the Commission shall institute proceedings to determine whether the proposed rule should be approved or disapproved.

IV. Solicitation of Comments

Interested persons are invited to submit written data, views and arguments concerning the foregoing, including whether the proposed rule change is consistent with the Act. Comments may be submitted by any of the following methods:

Electronic Comments

• Use the Commission's internet comment form (http://www.sec.gov/​rules/​sro.shtml); or
• Send an email to [e-mail]. Please include File Number SR-FINRA 2018-016 on the subject line.

Paper Comments

• Send paper comments in triplicate to Secretary, Securities and Exchange Commission, 100 F Street NE, Washington, DC 20549-1090.

All submissions should refer to File Number SR-FINRA-2018-016. This file number should be included on the subject line if email is used. To help the Commission process and review your comments more efficiently, please use only one method. The Commission will post all comments on the Commission's internet website (http://www.sec.gov/​rules/​sro.shtml). Copies of the submission, all subsequent amendments, all written statements with respect to the proposed rule change that are filed with the Commission, and all written communications relating to the proposed rule change between the Commission and any person, other than those that may be withheld from the public in accordance with the provisions of 5 U.S.C. 552, will be available for website viewing and printing in the Commission's Public Reference Room, 100 F Street NE, Washington, DC 20549, on official business days between the hours of 10:00 a.m. and 3:00 p.m. Copies of such filing also will be available for inspection and copying at the principal office of FINRA. All comments received will be posted without change. Persons submitting comments are cautioned that we do not redact or edit personal identifying information from comment submissions. You should submit only information that you wish to make available publicly. All submissions should refer to File Number SR-FINRA-2018-016 and should be submitted on or before May 29, 2018.

For the Commission, by the Division of Trading and Markets, pursuant to delegated authority.^[30]

Eduardo A. Aleman,

Assistant Secretary.

Footnotes

1.  15 U.S.C. 78s(b)(1).

2.  17 CFR 240.19b-4.

3.  17 CFR 240.19b-4(f)(6).

4.  31 U.S.C. 5311, et seq.

5.  See 31 U.S.C. 5312(a)(2) (defining “financial institution”).

6.  31 U.S.C. 5318(h)(1).

7.  31 CFR 1023.210(b).

8.  FinCEN Customer Due Diligence Requirements for Financial Institutions; CDD Rule, 81 FR 29397 (May 11, 2016) (CDD Rule Release); 82 FR 45182 (September 28, 2017) (making technical correcting amendments to the final CDD Rule published on May 11, 2016). FinCEN is authorized to impose AML program requirements on financial institutions and to require financial institutions to maintain procedures to ensure compliance with the BSA and associated regulations. 31 U.S.C. 5318(h)(2) and (a)(2). The CDD Rule is the result of the rulemaking process FinCEN initiated in March 2012. See 77 FR 13046 (March 5, 2012) (Advance Notice of Proposed Rulemaking) and 79 FR 45151 (Aug. 4, 2014) (Notice of Proposed Rulemaking).

9.  See 31 CFR 1010.230(f) (defining “covered financial institution”).

10.  See CDD Rule Release at 29398.

11.  See 31 CFR 1010.230(d) (defining “beneficial owner”) and 31 CFR 1010.230(e) (defining “legal entity customer”).

12.  Uniting and Strengthening America by Providing Appropriate Tools Required to Intercept and Obstruct Terrorism Act of 2001, Public Law 107-56, 115 Stat. 272 (2001).

13.  If a member firm does not execute transactions for customers or otherwise hold customer accounts or act as an introducing broker with respect to customer accounts (e.g., engages solely in proprietary trading or conducts business only with other broker-dealers), then “independent testing” is required every two years. See FINRA Rule 3310(c). However, a member should conduct more frequent testing than required if circumstances warrant. See Supplementary Material .01(a).

14.  In fact, FinCEN notes that broker-dealers must continue to comply with FINRA Rules, notwithstanding differences between the CDD Rule and FINRA Rule 3310. See CDD Rule Release 29421, n. 85.

15.  See CDD Rule Release at 29420; 31 CFR 1023.210.

16.  See id . at 29419.

17.  See id . at 29421.

18.  See id. at 29422.

19.  See id.

20.  See id.

21.  See id.

22.  See id.

23.  See id.

24.  See id. at 29402.

25.  See id. at 29420-21. See also Regulatory Notice 17-40 (discussing identifying and verifying the identity of beneficial owners of legal entity customers).

26.  See id.

27.  15 U.S.C. 78 o-3(b)(6).

28.  15 U.S.C. 78s(b)(3)(A).

29.  17 CFR 240.19b-4(f)(6).

30.  17 CFR 200.30-3(a)(12).