Notice to Members 03-34

Treasury and SEC Issue Final Rule Regarding Customer Identification Programs for Broker/Dealers

Published Date:

INFORMATIONAL

Anti-Money Laundering Customer Identification Programs for Broker/Dealers

Effective Date: October 1, 2003

SUGGESTED ROUTING

KEY TOPICS

Legal & Compliance
Operations
Registration
Senior Management

Anti-Money Laundering
Compliance Programs

Executive Summary

On April 30, 2003, the Department of Treasury (Treasury) and the Securities and Exchange Commission (SEC or Commission) jointly issued a final rule to implement Section 326 of the USA PATRIOT Act (PATRIOT Act).1 Section 326 provides that Treasury and SEC issue a rule that, at a minimum, requires broker/dealers to implement reasonable procedures to: (1) verify the identity of any person seeking to open an account, to the extent reasonable and practicable; (2) maintain records of the information used to verify the person's identity; and (3) determine whether the person appears on any lists of known or suspected terrorists or terrorist organizations provided to brokers or dealers by any government agency. The final rule requires each broker/dealer to establish a written Customer Identification Program (CIP) to verify the identity of each customer who opens an account. The written CIP must also include recordkeeping procedures and procedures for providing customers with notice that the broker/dealer is requesting information to verify their identity. Broker/dealers must fully implement their CIPs by October 1, 2003.

Questions/Further Information

Questions regarding this Notice to Members may be directed to Kyra Armstrong, at (202) 728-6962, or Vicky Berberi-Doumar, at (202) 728-8905, both of the Department of Member Regulation; or Nancy Libin, at (202) 728-8835, or Grace Yeh, at (202) 728-6939, both of the Office of General Counsel, NASD Regulatory Policy and Oversight.

Background

On October 26, 2001, President Bush signed into law the PATRIOT Act. Title III of the PATRIOT Act imposed obligations on broker/dealers under new anti-money laundering (AML) provisions and amendments to the Bank Secrecy Act (BSA) in an effort to make it easier to prevent, detect, and prosecute money laundering and the financing of terrorism. Among these obligations, broker/dealers were required to have an AML compliance program in place as of April 24, 2002. Consistent with this requirement under the PATRIOT Act, NASD Rule 3011 requires each member, to develop and implement a written AML program reasonably designed to achieve and monitor the member's compliance with the requirements of the BSA and the implementing regulations.

On July 23, 2002, Treasury and the SEC jointly proposed a rule to implement Section 326 of the PATRIOT Act with respect to broker/dealers. The SEC received 20 comment letters in response to the proposal. Members of the industry questioned, among other things, the proposed rule's definition of "customer," which included persons with trading authority over an account. Others expressed concern about the verification and recordkeeping requirements. The final rule addresses many of the comments.

Description of Final Rule

Relevant Definitions

The final rule provides several definitions, which, among other things, assist members in determining who are the relevant persons whose identities need to be verified.

1. Account. The final rule defines an "account" as a formal relationship with a broker/dealer established to effect transactions in securities, including, but not limited to, the purchase or sale of securities, securities loaned and borrowed activity, and the holding of securities or other assets for safekeeping or as collateral.2

Importantly, the final rule contains two exclusions from the definition of "account." The definition excludes: (a) an account that the broker/dealer acquires through any acquisition, merger, purchase of assets, or assumption of liabilities;3 and (b) an account opened for the purpose of participating in an employee benefit plan established under the Employee Retirement Income Security Act of 1974 ("ERISA").4

The Adopting Release explains that in acquisitions, mergers, purchases of assets, or assumptions of liabilities, customers do not initiate these transfers and, therefore, the accounts do not fall within the scope of Section 326 of the PATRIOT Act.5

In addition, transfers of accounts that result from an introducing broker/dealer changing its clearing firm would fall within this exclusion.6

As initially proposed, the definition of "account" contained several examples of types of accounts that would be covered including cash accounts, margin accounts, prime brokerage accounts, and accounts established to engage in securities repurchase transactions. The Adopting Release notes that these types of accounts remain "accounts" for purposes of the final rule, but the final rule does not specifically include them as examples to clarify that the list is not exhaustive.
2. Broker/dealer. "Broker/dealer" is defined as a person registered or required to be registered as a broker or dealer with the Commission under the Securities Exchange Act of 1934 (Exchange Act) except persons who are required to be registered solely because they effect transactions in security futures products.7
3. Customer. The final rule defines "customer" as: (a) a person that opens a new account; and (b) an individual who opens a new account for an individual who lacks legal capacity or for an entity that is not a legal person.8

Under this definition, "customer" does not refer to persons who fill out account opening paperwork or who provide information necessary to set up an account, if such persons are not the accountholder as well.

In addition, the Adopting Release addresses concerns about identity verification in situations involving trust and omnibus accounts. The release explains that a broker/dealer is not required to look through a trust or similar account to its beneficiaries, and is required only to verify the identity of the named accountholder.9 Similarly, with respect to an omnibus account established by an intermediary, a broker/dealer is not required to look through the intermediary to the underlying beneficial owners, if the intermediary is identified as the accountholder.10

As noted above, the proposed rule required that the broker/dealer verify the identity of those with trading authority over an account. The final rule, however, does not include persons with trading authority over accounts in the definition of "customer." Accordingly, the broker/dealer does not have to verify those individuals' identities. However, the final rule recognizes that situations may arise where a broker/dealer will have to take extra steps to verify the identity of those with trading authority. In these instances, a CIP is required to address situations where the broker/dealer will take additional steps to verify the identity of a customer that is not an individual by seeking information about individuals with authority or control over the account in order to verify the customer's identity.11

The final rule's definition also contains additional exclusions. The following entities are excluded from the definition of "customer":
 

 

  • A person that has an existing account with the broker/dealer, provided the broker/dealer has a reasonable belief that it knows the true identity of the person;



    •  
  • A financial institution regulated by a Federal functional regulator (the definitions of which are discussed below in numbers 4 and 5 of this section);



    •  
  • Banks regulated by a state bank regulator;



    •  
  • A department or agency of the United States, of any State, or of any political subdivision of any State;



    •  
  • Any entity established under the laws of the United States, of any state, or of any political subdivision of any state, or under an interstate compact between two or more states, that exercises governmental authority on behalf of the United States or any such state or political subdivision; or



    •  
  • Any entity, other than a bank, whose common stock or analogous equity interests are listed on the New York Stock Exchange or the American Stock Exchange or whose common stock or analogous equity interests have been designated as a NASDAQ National Market Security listed on The NASDAQ Stock Market (except stock or interests listed under the separate "NASDAQ Small-Cap Issues" heading), provided that, for purposes of this provision, a person that is a financial institution, other than a bank, is an exempt person only to the extent of its domestic operations.

 

4. Federal functional regulator. "Federal functional regulator" is defined as: the SEC; the Commodity Futures Trading Commission; the Board of Governors of the Federal Reserve System; the Office of the Comptroller of the Currency; the Board of Directors of the Federal Deposit Insurance Corporation; the Office of Thrift Supervision; or the National Credit Union Administration.12
5. Financial Institution. "Financial Institution" is defined to include: an insured bank (as defined in section 3(h) of the Federal Deposit Insurance Act (12 U.S.C. 1813(h))); a commercial bank or trust company; a private banker; an agency or branch of a foreign bank in the United States; an insured institution (as defined in section 401(a) of the National Housing Act, 12 U.S.C. 1724(a)); a thrift institution; a broker or dealer registered with the SEC under the Exchange Act; a broker or dealer in securities or commodities; an investment banker or investment company; a currency exchange; an issuer, redeemer, or cashier of travelers' checks, checks, money orders, or similar instruments; an operator of a credit card system; an insurance company; a dealer in precious metals, stones, or jewels; a pawnbroker; a loan or finance company; a travel agency; a licensed sender of money; a telegraph company; a business engaged in vehicle sales, including automobile, airplane, and boat sales; persons involved in real estate closings and settlements; the United States Postal Service; an agency of the United States Government or of a state or local government carrying out a duty or power of a business described in this paragraph; a casino, gambling casino, or gaming establishment with an annual gaming revenue of more than $1,000,000 which is licensed as a casino, gambling casino, or gaming establishment under the laws of any State or any political subdivision of any State; or is an Indian gaming operation conducted under or pursuant to the Indian Gaming Regulatory Act other than an operation which is limited to class I gaming (as defined in section 4(6) of such Act); any business or agency which engages in any activity which the Secretary of the Treasury determines, by regulation, to be an activity which is similar to, related to, or a substitute for any activity in which any business described in this paragraph is authorized to engage; or any other business designated by the Secretary whose cash transactions have a high degree of usefulness in criminal, tax, or regulatory matters.13
6. Taxpayer identification number. "Taxpayer identification number" has the same meaning as determined under the provisions of Section 6109 of the Internal Revenue Code and the regulations of the Internal Revenue Service thereunder (e.g., social security number or employer identification number).14
7. U.S. person. "U.S. person" means a United States citizen or a person other than an individual (such as a corporation, partnership or trust) that is established or organized under the laws of a State or the United States.15
8. Non-U.S. person. "Non-U.S. person" means a person that is not a U.S. person.16

Customer Identification Program

Minimum Requirements

The final rule requires that broker/dealers establish, document, and maintain a written CIP. This program must be appropriate for the firm's size and business, be part of the firm's anti-money laundering compliance program, and, at a minimum, must contain procedures for the following: identity verification, recordkeeping, comparison with government lists, and providing customer notice.17

Required Customer Information

A broker/dealer's CIP must contain procedures for opening an account that specifies the identifying information that will be obtained from each customer. The minimum identifying information that must be obtained from each customer prior to opening an account is:

 

 

  • A name;



    •  
  • A date of birth, for an individual;



    •  
  • An address, which will be:
     

     

     

    • For an individual, a residential or business street address;



      •  
    • For an individual who does not have a residential or business street address, an Army Post Office (APO) or Fleet Post Office (FPO) box number, or the residential or business street address of a next of kin or another contact individual; or



      •  
    • For a person other than an individual (such as a corporation, partnership, or trust), a principal place of business, local office, or other physical location; and



      •  
    • An identification number, which will be:



      •  
    • For a U.S. person, a taxpayer identification number; or



      •  
    • For a non-U.S. person, one or more of the following:
      • a taxpayer identification number;



        •  
      • a passport number and country of issuance;



        •  
      • an alien identification card number; or



        •  
      • the number and country of issuance of any other government-issued document evidencing nationality or residence and bearing a photograph or similar safeguard.18

 

Treasury and the SEC adopted the required customer information provisions substantially as proposed with changes to accommodate individuals who may not have physical addresses. The Adopting Release notes that the minimum required information is collected by most broker/dealers already, is necessary for the verification process, and serves an important law enforcement function. With respect to non-U.S. persons, the final rule contains some flexibility in the identification number requirement because a firm can choose from a variety of information numbers to accept from a non-U.S. person. In this regard, the Adopting Release states that there is no uniform identification number that non-U.S. persons would be able to provide to a broker/dealer. Nevertheless, whatever identifying information the firm does accept must enable the firm to form a reasonable belief that it knows the true identity of a customer.19

Exception for Persons Applying for a Taxpayer Identification Number

The proposed rule allowed broker/dealers to open an account for a new business that applied for, but had not received, a taxpayer identification number. The final rule expanded the exception in the proposed rule to include natural persons who have applied for, but not received, a taxpayer identification number. Therefore, instead of obtaining a taxpayer identification number from a customer (either natural or non-natural) prior to opening an account, a CIP may include procedures for opening an account for a customer that has applied for, but has not received, a taxpayer identification number. In this case, the CIP must include procedures to confirm that the application was filed before the customer opens the account and to obtain the taxpayer identification number within a reasonable period of time after the account is opened.20

Identity Verification Procedures

A CIP must include risk-based procedures for verifying the identity of each customer to the extent reasonable and practicable. The procedures must enable the broker/dealer to form a reasonable belief that it knows the true identity of each customer. The procedures must be based on the broker/dealer's assessment of the relevant risks, including those presented by the:

 

  • types of accounts maintained by the broker/dealer;



    •  
  • methods of opening accounts provided by the broker/dealer;



    •  
  • types of identifying information available; and



    •  
  • broker/dealer's size, location, and customer base.21

 

Customer Verification

A CIP must contain procedures for verifying the identity of each customer, using the required information described above, within a reasonable time before or after the customer's account is opened.22

The final rule and Adopting Release do not define "reasonable time." The Adopting Release states that "[t]he amount of time may depend on the type of account opened, whether the customer opens the account in-person, and the type of identifying information available."23

A broker/dealer's CIP is required to include procedures that describe when the broker/dealer will use documentary methods, non-documentary methods, or a combination of both methods to verify customers' identities. For example, depending on the type of customer, the method of opening an account, and the type of identifying information available, it may be more appropriate to use either documentary or non-documentary methods, and in some cases it may be appropriate to use both methods. These procedures should be based on the firm's assessment of the relevant risk factors discussed above.24

Verification through documents

The final rule requires that a CIP contain procedures that describe the documents the broker/dealer will use for verification.25 Each broker/dealer must conduct its own risk-based analysis of the types of documents that it believes will enable it to verify the true identities of customers. Examples of documents that firms may use for verification include:

 

  • For an individual, an unexpired government-issued identification evidencing nationality or residence and bearing a photograph or similar safeguard, such as a driver's license or passport; and



    •  
  • For a person other than an individual (such as a corporation, partnership, or trust), documents showing the existence of the entity, such as certified articles of incorporation, a government-issued business license, a partnership agreement, or a trust instrument.26

 

These documents are merely examples of reliable documents. A firm may use other documents for verification provided that the documents allow a firm to establish a reasonable belief that it knows the true identity of the customer.

The Adopting Release encourages firms to obtain more than one type of documentary verification to ensure that they have a reasonable belief that they know their customers' true identities. This will increase the likelihood of finding inconsistencies if a person is attempting to provide false information. Also firms should use a variety of methods to verify the identity of a customer, especially when the broker/dealer does not have the ability to examine the original documents.27

The final rule generally does not require a firm to ensure the validity of documents.28 The Adopting Release explains that, once a firm obtains and verifies the identity of a customer through a document, such as a driver's license or passport, a firm is not required to take steps to determine whether the document has been validly issued. A firm may rely on a governmentissued identification as verification of a customer's identity. If, however, a firm notes that the document shows some obvious form of fraud, the firm must consider that factor in determining whether it can form a reasonable belief that it knows the customer's true identity.29

Verification through non-documentary methods

The final rule requires a CIP to contain procedures that describe the nondocumentary methods the broker/dealer will use for verification.30 Examples of non-documentary methods of verification include:

 

  • Contacting a customer;



    •  
  • Independently verifying the customer's identity through the comparison of information provided by the customer with information obtained from a consumer reporting agency, public database,31 or other source;



    •  
  • Checking references with other financial institutions; or



    •  
  • Obtaining a financial statement.32

 

Treasury and the SEC recommend that firms analyze whether there is a logical consistency between the identifying information provided, such as the customer's name, street address, zip code, telephone number (if provided), date of birth, and Social Security number (e.g., zip code and city/state are consistent).

The final rule requires that a broker/dealer's CIP address the following circumstances where non-documentary procedures must be used:

 

  • An individual is unable to present an unexpired government-issued identification document that bears a photograph or similar safeguard;



    •  
  • The broker/dealer is not familiar with the documents presented;



    •  
  • The account is opened without obtaining documents;



    •  
  • The customer opens the account without appearing in person at the broker/dealer; and



    •  
  • Where the broker/dealer is otherwise presented with circumstances that increase the risk that the broker/dealer will be unable to verify the true identity of a customer through documents.33

 

Due to the prevalence of identity theft and because identification documents may be obtained illegally and be fraudulent, firms are encouraged to use non-documentary methods even when a customer has provided identification documents.34

Additional Verification for Certain Customers

Treasury and the SEC added a new provision to the final rule regarding additional verification for certain customers. The Adopting Release explains that, while firms may be able to verify the majority of customers adequately through documentary and nondocumentary methods, there may be instances where those methods are inadequate.35 The risk that a firm may not know the customer's true identity may be heightened for certain types of accounts, such as an account opened in the name of a corporation, partnership, or trust that is created or conducts substantial business in a jurisdiction that has been designated by the U.S. as a primary money laundering concern or has been designated as non-cooperative by an international body.36 Treasury and the SEC emphasize that a firm must take further steps to identify customers that pose a heightened risk of not being properly identified. A firm's CIP must prescribe additional measures that may be used to obtain information about the identity of the individuals associated with the customer when standard documentary methods prove to be insufficient.37

Therefore, the final rule requires that a CIP address situations where, based on the broker/dealer's risk assessment of a new account opened by a customer that is not an individual, the broker/dealer will obtain information about individuals with authority or control over such account. This verification method applies only when the broker/dealer cannot verify the customer's true identity using documentary and non-documentary verification methods.38

Lack of Verification

A CIP must include procedures for responding to circumstances in which a broker/dealer cannot form a reasonable belief that it knows the true identity of a customer.39 These procedures should describe:

 

  • When the broker/dealer should not open an account;



    •  
  • The terms under which a customer may conduct transactions while the broker/dealer attempts to verify the customer's identity;



    •  
  • When the broker/dealer should close an account after attempts to verify a customer's identity fail; and



    •  
  • When the broker/dealer should file a Suspicious Activity Report (Form SAR-SF) in accordance with applicable law and regulation.40

 

Recordkeeping

Required records

A CIP must include procedures for making and maintaining a record of all information obtained to verify a customer's identity.41 At a minimum, the record must include all identifying information about a customer obtained to verify a customer's identity.

With regard to verification, a firm's records must contain a description of any document that was relied on to verify the customer's identity, noting the type of document, any identification number contained in the document, the place of issuance, and, if any, the date of issuance and expiration date. This differs from the proposed rule, which required that firms keep copies of verification documents.

With respect to non-documentary verification, the final rule requires that records contain a description of the methods and the results of any measures undertaken to verify the identity of a customer.

Finally, the final rule requires, with respect to any method of verification chosen, a description of the resolution of each substantive discrepancy discovered when verifying the identifying information obtained.42

Retention of records

A broker/dealer must retain records of all of the identification information obtained from the customer for five yearsafter the account is closed.43 In addition, records made about information that verifies a customer's identity only have to be retained for five years after the record is made. In all other respects, the records must be maintained pursuant to the provisions of SEC Rule 17a-4.44

Comparison with Government Lists

A CIP must include procedures for determining whether a customer appears on any list of known or suspected terrorists or terrorist organizations issued by any Federal government agency and designated as such by Treasury in consultation with the Federal functional regulators.45 The procedures must require that the broker/dealer make such a determination within a reasonable period of time after the account is opened, or earlier if required by another Federal law or regulation or Federal directive issued in connection with the applicable list. The procedures also must require that the broker/dealer follow all Federal directives issued in connection with such lists.46

The Adopting Release notes that Treasury and the Federal functional regulators have not yet designated any government lists. The Adopting Release also notes that firms do not have an affirmative duty to seek out all lists of known or suspected terrorists or terrorist organizations compiled by the federal government. Instead, firms will receive notification from the federal government regarding the lists that they must consult for purposes of this provision.

The Adopting Release also cautions that this does not mean that firms do not have obligations under other laws to screen their customer against government lists. It mentions, as an example, compliance with the OFAC rules prohibiting transactions with certain foreign countries and nationals. Firms must check the OFAC List to ensure that potential customers and existing customers, on an ongoing basis, are not prohibited persons or entities and are not from embargoed countries or regions before transacting any business with them.47

Customer Notice

A CIP must include procedures "for providing customers with adequate notice that the broker/dealer is requesting information to verify their identities."48 Notice must occur before the account is opened. Notice is adequate if the broker/dealer generally describes the identification requirements of the final rule and provides such notice in a manner reasonably designed to ensure that a customer is able to view the notice, or otherwise given notice, before opening an account.49 For example, depending upon the manner in which the account is opened, a broker/dealer may post a notice in the lobby or on its Web site, include the notice on its account applications, or use any other form of oral or written notice.

Sample Notice

The final rule provides the following sample language for notice to be provided to a firm's customers, if appropriate:50

Important Information About Procedures for Opening a New Account

To help the government fight the funding of terrorism and money laundering activities, Federal law requires all financial institutions to obtain, verify, and record information that identifies each person who opens an account.

What this means for you: When you open an account, we will ask for your name, address, date of birth and other information that will allow us to identify you. We may also ask to see your driver's license or other identifying documents.

Reliance on Another Financial Institution

The final rule acknowledges that there may be circumstances in which a firm may be able to rely on the performance by another financial institution of some or all of the elements of a firm's CIP.51 Therefore, the final rule provides that a CIP may include procedures specifying when the broker/dealer will rely on the performance by another financial institution (including an affiliate) of any procedures of the broker/dealer's CIP, with respect to any customer of the broker/dealer that is opening an account or has established an account or similar business relationship with the other financial institution to provide or engage in services, dealings, or other financial transactions.

In order for a broker/dealer to rely on another financial institution, the following requirements must be met:

 

  • Reliance must be reasonable under the circumstances;



    •  
  • The other financial institution must be subject to a rule implementing the anti-money laundering compliance program requirements of the PATRIOT Act and be regulated by a Federal functional regulator; and



    •  
  • The other financial institution must enter into a contract requiring it to certify annually to the broker/dealer that it has implemented its antimoney laundering program, and that it will perform (or its agent will perform) specified requirements of the broker/dealer's CIP.

 

The Adopting Release notes that the contract and certification will provide a standard means for a firm to demonstrate the extent to which it is relying on another financial institution to perform its CIP, and that the other institution has agreed to perform those functions.52 If it is not clear from these documents, a broker/dealer must be able to otherwise demonstrate when it is relying on another financial institution to perform its CIP with respect to a particular customer. A broker/dealer will not be held responsible for the failure of the other financial institution to fulfill adequately the broker/dealer's CIP responsibilities, provided that the broker/dealer can establish that its reliance was reasonable and that it has obtained the requisite contracts and certifications.53 Treasury and the SEC emphasize that the broker/dealer and the other financial institution upon which it relies must satisfy all of the conditions set forth in this final rule. If they do not, then the broker/dealer remains solely responsible for applying its own CIP to each customer in accordance with the rule.54

1 68 Fed. Reg. 25,113 (May 9, 2003) ("Adopting Release").

2 31 C.F.R. § 103.122(a)(1).

3 Broker/dealers are advised to consider situations when it may be appropriate to verify the identity of customers associated with transferred accounts in developing and implementing the required anti-money laundering compliance program. 68 Fed. Reg. 25,113, 25,115.

4 The Adopting Release discusses why these accounts are excluded from the definition of "account." Such accounts are less susceptible to be used for the financing of terrorism and money laundering because, among other things, they are funded through payroll deductions in connection with employment plans that must comply with federal regulations. These regulations impose, among other requirements, low contribution limits and strict distribution requirements. 68 Fed. Reg. 25,113, 25,115.

5 68 Fed. Reg. 25,113, 25,115.

6 However, the introducing firm and the clearing firm would need to meet the requirements for reliance on another financial institution (as discussed supra on page 355) such as entering into a contract and providing certifications to the extent that they intend to rely on each other to undertake CIP requirements with respect to customers that open accounts after the transfer. 68 Fed. Reg. 25,113, 25,115, fn. 20.

7 31 C.F.R. § 103.122(a)(2).

8 31 C.F.R. § 103.122(a)(4).

9 68 Fed. Reg. 25,113, 25,116. However, a broker/dealer, based on its risk-assessment of anew account, may need to take additional steps to verify the identity of a customer that is not an individual, such as obtaining information about persons with control over the account. In addition, the due diligence procedures required under other provisions of the BSA or securities laws may require broker/dealers to look through to owners of certain types of accounts. Id. at 25,115, fn. 30.

10 The final rule does not affect any requirements under SEC Rule 17a-3(a)(9) to make records with respect to the beneficial owners of certain accounts. 68 Fed. Reg. 25,113, 25,116, fn. 31.

11 68 Fed. Reg. 25,113, 25,116. See discussion supra at page 353.

12 31 C.F.R. § 103.122(a)(5).

13 31 C.F.R. § 103.122(a)(6).

14 31 C.F.R. § 103.122(a)(7).

15 31 C.F.R. § 103.122(a)(8).

16 31 C.F.R. § 103.122(a)(9).

17 31 C.F.R. § 103.122(b)(1). The Adopting Release notes that the provision permitting broker/dealers to rely on the performance of another financial institution for some or all of the elements of a firm's CIP (as discussed supra on page 355) is not specified as a minimum CIP requirement because any such reliance is optional. 68 Fed. Reg. 25,113, 25,117, fn. 48.

18 31 C.F.R. § 103.122(b)(2)(i)(A). The Treasury and the SEC recognize that a foreign business or enterprise may not have an identification number. The Adopting Release states that when a firm is opening an account for a foreign business or enterprise that does not have an identification number, the broker/dealer must request alternative government-issued documentation certifying the existence of the business or enterprise. 68 Fed. Reg. 25,113, 25,118, fn. 65.

19 68 Fed. Reg. 25,113, 25,118, fn. 65. The Adopting Release emphasizes that the rule neither endorses nor prohibits a broker/dealer from accepting information from particular types of identification documents issued by foreign governments. The broker/dealer must determine, based upon appropriate risk factors, including those discussed on page 351 (under "Identity Verification Procedures"), whether the information presented by a customer is reliable.

20 31 C.F.R. § 103.122(b)(2)(i)(B).

21 31 C.F.R. § 103.122(b)(2).

22 31 C.F.R. § 103.122(b)(2)(ii). The Adopting Release notes that it is possible, however, that a firm would violate other laws by permitting a customer to transact business prior to verifying the customer identity. See, e.g., 31 C.F.R. Part 500 (regulations of Treasury's Office of Foreign Asset Control (OFAC)). Firms are prohibited from doing business with those persons and organizations listed on the OFAC Web Site as well as with the listed embargoed countries and regions. 68 Fed. Reg, 25,113, 25,119, (fn. 79).

23 68 Fed. Reg. 25,113, 25,119.

24 68 Fed. Reg. 25,113, 25,119.

25 31 C.F.R. § 103.122(b)(2)(ii)(A).

26Id.

27 68 Fed. Reg. 25,113, 25,119.

28Id.

29Id. at 25,119-25,220.

30 31 C.F.R. § 103.122(b)(2)(ii)(B).

31 The Adopting Release does not list the specific types of databases that would be suitable for verification. It will depend on the circumstances and the firm's assessment of relevant risk factors. 68 Fed. Reg. 25,113, 25,120, fn. 95.

32 31 C.F.R. § 103.122(b)(2)(ii)(B)(1).

33 31 C.F.R. § 103.122(b)(2)(ii)(B)(2). The Adopting Release notes that there may be circumstances other than those described when a firm should use non-documentary verification procedures. 68 Fed. Reg. 25,113, 25,120, fn. 98.

34 68 Fed. Reg. 25,113, 25,120.

35 31 C.F.R. § 103.122(b)(2)(ii)(C).

36See, e.g., the list of non-cooperative countries and territories published by the Financial Action Task Force on Money Laundering (FATF) at www1.oecd.org/fatf/NCCT_en.htm. The FATF is an intergovernmental body whose purpose is the development and promotion of policies to combat money laundering.

37 68 Fed. Reg. 25,113, 25,121.

38Id.

39 31 C.F.R. § 103.122(b)(2)(iii).

40 68 Fed. Reg. 25,113, 25,121. For more information regarding the filing of Form SAR-SFs, see NASD Notice to Members 02-47, Treasury Issues Final Suspicious Activity Reporting Rule for Broker/Dealers; Effective Date: Transactions After December 30, 2002, www.nasdr.com/pdf-text/0247ntm.pdf.

41 31 C.F.R. § 103.122(b)(3).

42 The Adopting Release notes that the requirement was limited to substantive discrepancies to make clear that records would not have to be made in the case of minor discrepancies, such as those caused by typographical error. 68 Fed. Reg. 25,113, 25,121, fn. 111.

43 31 C.F.R. § 103.122(b)(3)(ii).

44Id.

45 31 C.F.R. § 103.122(b)(4).

46Id.

47See, infra endnote 22; 68 Fed. Reg. 25,113, 25,122, fn. 120.

48 31 C.F.R. § 103.122(b)(5)(i).

49 31 C.F.R. § 103.122(b)(5)(ii).

50 31 C.F.R. § 103.122(b)(5)(iii).

51 31 C.F.R. § 103.122(b)(6).

52 68 Fed. Reg. 25,113, 25,123.

53Id.

54Id.