As of September 22, 2023, FinCEN released new guidance regarding beneficial ownership information (BOI) reporting which will take effect January 1, 2024. All covered entities must report BOI directly to FinCEN by January 1, 2025, if the entity was created before January 1, 2024. When it comes to reporting companies created after January 1, 2024, they currently will have 30 days after creation to report BOI to FinCEN. However, FinCEN just released a Notice of Proposed Rulemaking to extend the deadline for entities created after January 1, 2024, from 30 days to 90 days.   

What Beneficial Ownership Changes Should Financial Institutions Focus On
At this point financial institutions and BSA Departments specifically should familiarize themselves with the BOI rules as they apply to entities. Financial institutions should consider how much assistance will be provided to reporting companies with the new BOI reporting process. FinCEN’s website can be utilized as a great reference for entity customers looking for guidance on complying with the BOI rule. However, it’s important to remember that the beneficial ownership rules as they currently apply to financial institutions have not changed and will most likely not change until January 2025.  In other words, financial institutions should continue to obtain beneficial ownership information as they have since May 2018 until the new Customer Due Diligence (CDD) rules are effective.

There are two additional rules that have to become final before we all know how the rules will fully apply to financial institutions. First, the Access Rule is expected to be final in late September or October 2023 based on FinCEN’s rulemaking agenda.  This rule will hopefully spell out who can access FinCEN’s BOI records and how that process works. Second is the CDD Rule which will restructure the requirements for financial institutions relative to beneficial ownership.  The CDD Rule is expected to be proposed in November 2023 with an expected final rule effective date of January 2025. The CDD Rule will have to work out the differences between the current beneficial ownership rule for financial institutions and the entity requirements under the new beneficial ownership information (BOI) reporting rule as differences currently exist with the definition of “control” and numerous other areas.

For more information about reporting BOI, if a company is exempt or not exempt, how to get the FinCEN identifier, and more information, please visit the links below.

News Release: https://www.fincen.gov/news/news-releases/fincen-issues-compliance-guide-help-small-businesses-report-beneficial-ownership
​
Small Entity Compliance Guide:
https://www.fincen.gov/sites/default/files/shared/BOI_Small_Compliance_Guide_FINAL_Sept_508C.pdf

FAQs: https://www.fincen.gov/boi-faqs

FinCEN’s BOI Webpage: https://www.fincen.gov/boi

Authors: Jeremy Clifton CRCM CAMS, Nick Milcarek

Authors: Jeremy Clifton, CRCM, CAMS and Nick Milcarek 

On September 8, 2023, FinCEN issued an alert regarding the fraud scheme known as “pig butchering”. Pig butchering is a form of fraud that involves victims (the pigs) giving money to foreign actors who operate under the guise of a successful money manager involved in crypto currency (virtual currency) trading. Once the perpetrator is satisfied with the amount the victim has given, they drain the entire “account” of funds from that victim (the butchering). Many of these scammers are victims of labor trafficking directed by large crime syndicates in Southeast Asia who reach out to millions of people around the world. These scammers usually reach out to the victims through social media, email, or text to persuade them into buying into this supposed “high return investment”. The fraudster will leverage high pressure sales tactics such as them missing out on a potential lucrative opportunity to further convince them into action. Once the victim begins to trust the supposed “investor”, they are directed to use a fraudulent website most likely controlled by the scammer. Note that this can also include trusted third-party applications. The aggressor may also demand remote access to the victim’s devices to create accounts via virtual asset service providers (VASP). Many victims are also asked to purchase multiple pre-paid cards or make large wire transfers to unknown entities. Unfortunately, victims have been known to take out money from tax advantage accounts, take on a second mortgage, or a home equity line just to put money into the scheme. Recent incidents have shown more successful scammers even inviting whole families and friend groups to join in. After the victim starts to buy in, the perpetrator must maintain legitimacy by fabricating high returns and even allowing the victim to take small amounts out of the “fund”. This builds confidence and reassures the victim that the investment is real. If the fraudster starts to believe that the victim is losing confidence in them and the investment, they become more aggressive by developing reasons to stay in and pressuring them to not miss out on the opportunity. If that does not work, the perpetrator pulls out all the money from the account and eliminates any contact with the victim(s).

One more interesting comment that FinCEN noted in this FIN is that financial institutions should “When requested to provide supporting documentation, financial institutions should take special care to verify that a requestor of information is, in fact, a representative of FinCEN or an appropriate law enforcement or supervisory agency. A financial institution should incorporate procedures for such verification into its BSA compliance or AML program. These procedures may include, for example, independent employment verification with the requestor’s field office or face-to-face review of the requestor’s credentials.” If your bank does not already have such a procedure in your written BSA program, it’s a good idea to do so now.
​
There are many red flags that can indicate a possible pig butchering scheme. Financial institutions should analyze multiple factors associated with historical financial activity, transactions in line with business practices, and whether the customer shows signs of multiple red flags. Red flags, and the formal alert by FinCEN can be found here: FinCEN_Alert_Pig_Butchering_FINAL_508c.pdf

Authors: Jeremy Clifton, CRCM, CAMS and Nick Milcarek

On March 30, 2023, FinCEN issued an alert regarding a concerning increase in business email compromise (BEC) in the real estate sector and how the Rapid Response Program (RRP) can help combat this issue. Recent analysis of data has shown that homebuyers have been disproportionately affected by fraudsters gaining unauthorized access into supposedly secure networks and stealing important information from home buyers, title agents, attorneys, and/or others involved in the loan closing processes. According to FinCEN, about 88% of the fraudsters initially transfer the stolen money into a domestic U.S account first before it is transferred elsewhere which may involve foreign transfers and/or cryptocurrency.

How RRP Works
Problems like these highlight the importance of FinCEN’s Rapid Response Program, (RRP) which works in tandem with federal and local law enforcement agencies to help victims identify losses and freeze compromised accounts. Since inception in 2014, the program has aided victims in identifying and freezing over $1.3 billion. To begin the RRP, law enforcement must be contacted immediately. The FBI’s Internet Crime Complaint Center (IC3) or the nearest secret service office are the best avenues for this approach (Secret Service contact information below). It is important to note that while recovery of the stolen amount is not guaranteed, reporting the crime within 72 hours gives FinCEN and law enforcement the greatest chance of financial recovery for the victim. After consent is given to law enforcement for access, FinCEN may freeze all related accounts to stop any other fraudulent transactions. If the fraudster’s account is domestic, FinCEN and law enforcement work quickly to contact the beneficiary’s financial institution and pinpoint the stolen funds. If stolen funds were found to be transferred to an international account, FinCEN reaches out to that jurisdiction to initiate the financial fraud kill chain (FFCK) and assist the foreign government with the status and information gathering regarding the stolen money.  There are some identification factors that are crucial for financial institutions to relay when reporting theft via the RRP; however, time is of the essence to recover funds so institutions should not delay in activating the RRP.

It is a good idea to establish a relationship with your local FBI office and Secret Service office before you need them in an emergency situation as that may help speed up the process.  Also, if your institution ends up filing a SAR after utilizing the RRP, that information would need to be included on your SAR form along with the RRP case number if provided.
For more information and guidance on BEC and RRP, see the links below.

BEC in Real Estate Financial Trend Analysis from FinCEN: Financial_Trend_Analysis_BEC_FINAL.pdf (fincen.gov)

BEC FinCEN alert: FinCEN Analysis of Business Email Compromise in the Real Estate Sector Reveals Threat Patterns and Trends | FinCEN.gov

Rapid Response Program FACT SHEET: RRP Fact Sheet Notice FINAL 508.pdf (fincen.gov)

Secret Service Offices: http://www.secretservice.gov/field_offices.shtml

Author: R. Matthew Waters, CRCM

On August 31, 2023, the FDIC announced an update to the Equal Housing Lender (EHL) poster requirements that were previously addressed in April 2023. This update clarifies the specific name, physical address, and web address that should be used for all FDIC institution’s EHL posters with an effective date of June 23, 2023.  The EHL posters should provide the following contact information:

National Center for Consumer and Depositor Assistance
Federal Deposit Insurance Corporation
1100 Walnut Street, Box #11
Kansas City, MO 64106
https://ask.fdic.gov/fdicinformationandsupportcenter

FDIC institutions should review EHL posters at all branches to ensure compliance with this update. As provided in the Financial Institution Letter, “Institutions are expected to make good-faith efforts to update the EHL posters as soon as reasonably practicable.” FDIC institutions may, but are not required to, request compliant EHL posters through https://www.fdicconnect.gov/index.asp.

To see the full article, click the following link: https://www.fdic.gov/news/financial-institution-letters/2023/fil23047.html.