- Key insight: The USA Patriot Act marked a major shift for banks, requiring strict verification of customer identities and the monitoring of suspicious activities.
- What's at stake: Critics contend that after 25 years, compliance with anti-money-laundering rules has become a costly "box-checking" exercise.
- Forward look: Deregulatory changes under the Trump administration include the permanent elimination of beneficial ownership reporting for U.S. companies and individuals.
Immediately after the Sept. 11 terrorist attacks, Congress moved quickly to close financial loopholes by revamping how U.S. banks detect money laundering and terrorist financing.
It was one of the biggest overhauls of bank regulation in recent history. Yet 25 years later, it's been so thoroughly integrated into the regulatory system, the details have been largely forgotten.
The USA Patriot Act of 2001 was enacted just 45 days after the 9/11 attacks. Its primary purpose was to strengthen the U.S. government's ability to combat terrorism, organized crime, and international money laundering by requiring that banks verify the identities of their customers.
"After 9/11, anti-money laundering was something banks had to take seriously," said David Zaring, the Elizabeth F. Putzel professor of legal studies and business ethics at the University of Pennsylvania's Wharton School.
Back then, many lawmakers believed that stricter compliance with the Bank Secrecy Act might have prevented the terrorist attacks.
Eighteen of the 19 hijackers on 9/11 had obtained U.S. identification documents that allowed them to take flying lessons, rent cars and open bank accounts. The terrorists reportedly used ordinary bank wire transfers to move hundreds of thousands of dollars between accounts in Saudi Arabia, Germany and the U.S. without triggering suspicious activity reports.
The Patriot Act passed with overwhelming bipartisan support — a 98-1 vote in the Senate — and fundamentally redefined the day-to-day priorities of bank compliance officers. It also vastly expanded the government's powers to access bank records and intercept communications to track terrorist financing.
"It definitely drove the adoption of better [know your customer] practices and all the terrorism financing work they implemented afterwards," Zaring said.
But today, some banking experts are highly critical of the post-9/11 anti-money-laundering regulatory framework, saying it has devolved into an expensive "box-checking" exercise. Banks have long claimed that they struggle under rigid and costly compliance rules.
While the Trump administration has not implemented a wholesale reversal of the Patriot Act's banking provisions, it has
Some experts say the change will weaken anti-money-laundering efforts by reducing the amount of information that can be used by law enforcement.
But some of those same experts also say that the original purpose of the 56-year-old Bank Secrecy Act, which was a relatively minor part of bank regulation prior to 9/11, has been lost over the last quarter-century.
"If you go back to the original purpose of the Bank Secrecy Act, which is to provide information and reports that are highly useful to law enforcement, criminal investigations, and tax investigations, that original purpose has been lost or de-emphasized at least, and the focus has tended to be more on technical compliance with rules," said Dan Stipano, a partner at the law firm Davis Polk & Wardwell and a former regulator at the Office of the Comptroller of the Currency.
Under the Patriot Act, banks must obtain, verify and record information that identifies every person opening a bank account, including tax identification numbers, dates of birth and physical addresses. Financial institutions must monitor transactions and file reports with the Treasury Department's Financial Crimes Enforcement Network for any activity that might be an indication of money laundering or terrorist financing.
Read more of American Banker's 9/11 anniversary coverage:
After 9/11, banks and the financial system as a whole became a key partner in helping law enforcement "reconstruct the terrorists' activities" and understand how money moved through the banking system, said Anne Balcer, general counsel for the Independent Bankers Association of Texas and principal at Community Bank Advisory Services.
"That experience demonstrated that banks serve as a powerful source of information for law enforcement," Balcer said. "But somewhere along the way following the aftermath of 9/11, BSA/AML evolved well beyond its original purpose, and banks are increasingly asked to do the work of law enforcement."
Balcer said banks now "are required to monitor, investigate and make judgments about customers and activities based on information that the government itself often has far greater ability to obtain and analyze."
That broad scope has meant that banks have had to perform ongoing due diligence, including being able to identify the owners of legal entities.
"Before 2001, the Bank Secrecy Act was mostly about filing reports," said Chris Friedman, a partner at Husch Blackwell. "Title III of the Patriot Act required every bank to identify and verify each customer at account opening, and required every financial institution to maintain a formal AML program, and gave the government and banks new channels to share information."
Trump administration's changes
Some banking experts say the Trump administration's major change to the current AML framework regarding shell companies could expose the country to security risks.
In a turnabout, the Trump administration decided in August to
Fincen's reporting requirements now apply only to foreign entities registered to do business in the U.S.
"The original design of the Corporate Transparency Act was to create this centralized, national registry of beneficial owners for the benefit of law enforcement," said Davis Polk's Stipano. "By making this change, the registry that's left will be of very little value to law enforcement."
Because criminal organizations and money launderers use shell companies to move money around, Stipano said, bad actors can avoid the reporting requirement by simply forming a U.S. limited liability company.
The change by Fincen superseded
"This is unfortunate because the U.S. government spent many years trying to get Congress to pass a law to create this registry, and they finally got it over the finish line six years ago," Stipano said. "It's like Lucy pulling the football away from Charlie Brown. It has a real-world impact on law enforcement's ability to investigate financial crimes."
Treasury Secretary Scott Bessent
Carlin A. McCrory, a financial services attorney at Troutman Pepper Locke, said one benefit of the change is that financial institutions can target their resources toward actual threats.
"Financial institutions generally felt they were doing a lot of check-the-box work," McCrory said. "Fincen wants to empower financial institutions to direct attention to higher-risk customers and activities, by focusing the attention where it needs to go and resources are appropriately allocated."
Since 9/11, each successive administration has changed its approach depending on which "bad guys" they were targeting, said Aaron Klein, the Miriam K. Carliner Chair in Economic Studies at the Brookings Institution and a former Senate Banking Committee staffer who was in the Capitol on 9/11.
Starting with the Bank Secrecy Act of 1970, the government "had two groups of bad guys in mind: the mafia and tax cheats," Klein said.
Since then, each administration has used the same tools to catch different types of criminals, he said.
"You build one system to try to catch an international cocaine syndicate growing cocaine in Colombia, and that's a very different AML regime than to try to catch Al Qaeda training suicide bombers in the United States," Klein said.
The Trump administration's approach is a stark departure from congressional intent, Klein said
"It used to be that Congress dictated the bad guys, and then the Treasury Department used the authorities, with some discretion on the hierarchy of bad guys," Klein said. "Now the Treasury Department is just saying, 'We're not going to collect the information that Congress required under law.'"
Many aspects of the AML/BSA regime have not changed under Trump. Banks are still examined for compliance on the same schedule, and customer-identification requirements are still in the regulations, with the same suspicious activity report obligations. Enforcement also has continued.
"The government has trimmed the paperwork, particularly on beneficial ownership," said Friedman at Husch Blackwell. "But the examination and enforcement infrastructure the Patriot Act built is still standing, and banks are still enforcing it against their partners."
