COMPLIANCE CORNER The IBA Law Department
QUESTION
We are a small bank, and several of our employees have been diagnosed with COVID-19. We have two employees on site who are maintaining daily operations and addressing customer needs, but they may have been exposed to the disease. We have been in contact with the FDIC and IDFPR regarding the circumstances, and the IDFPR has advised us of the necessary steps to make an emergency proclamation request and temporarily close our bank. We would be able to process our daily cash letter, as our correspondent bank handles those operational duties. Are there any other requirements or regulations we should be aware of in the event of a closure, such as any Uniform Commercial Code (UCC) considerations?
ANSWER If your bank must close due to a large portion of your employees being diagnosed with COVID-19, we believe you would be excused from meeting the time limits imposed by the UCC, provided your bank exercises diligence in taking the necessary action as soon as it is able. Delays by collecting banks and paying banks beyond the UCC’s time limits may be excused if the delay is caused by emergency conditions or other circumstances beyond the bank’s control — provided “the bank exercises such diligence as the circumstances require.” The commentary to the UCC notes that this exception also applies to time limits “imposed by special instructions, by
agreement or by Federal regulations or operating circulars, clearinghouse rules or the like.” We believe a closure due to a large portion of your employees being infected with COVID-19 would constitute an emergency condition beyond your bank’s control, as courts have stated that situations that may excuse delay include “abnormal operating conditions such as . . . substantial shortage of personnel during . . . emergency situations.” Similarly, Regulation CC provides that if “a bank is delayed in acting beyond the time limits” set forth in the regulation due to emergency conditions or other circumstances beyond its control, “its time for
acting is extended for the time necessary to complete the action, if it exercises such diligence as the circumstances require.” Regarding other considerations related to closures, we recommend reviewing the FDIC’s FAQs for Financial Institutions Affected by COVID-19. The FAQs provide that financial institutions should contact their regional FDIC office (which your bank has done already) if they are unable to comply with regulatory reporting requirements. The FAQs also provide that financial institutions affected by COVID-19 should contact FinCEN and their regulators as soon as practicable about any potential delays in their ability to file required Bank Secrecy Act reports.
QUESTION
After filing a suspicious activity report (SAR) on FinCEN’s website, we were contacted by someone asking for supporting documentation related to the SAR. This person has an email address indicating they work for the Department of Homeland Security, and they appear to be knowledgeable about the facts in the SAR, but they asked for the requested information to be sent to their email address rather than through a secure platform. Is this proper procedure for submitting supporting documentation related to a SAR?
ANSWER We recommend reviewing your Bank Secrecy Act (BSA) compliance and anti-money laundering program for procedures related to verifying the identity of requestors of supporting documentation before deciding whether and how to submit the requested documentation. While we are not aware of any laws or guidance outlining any specific procedures required for submitting supporting documentation, FinCEN has issued
•6•
• March-April 2021
guidance stating that financial institutions should “take special care to verify that a requestor of information is, in fact, a representative of FinCEN or an appropriate law enforcement or supervisory agency” and incorporate procedures related to such verification into its BSA compliance or anti-money laundering program. FinCEN goes on to explain in its guidance that such procedures could
include independent employment verification with the requestor’s field office or face-to-face review of the requestor’s credentials. We believe that requesting independent verification of the requestor’s identity, as well as a secure delivery method that ensures that the verified requestor is the one actually receiving the supporting documentation, would be a reasonable procedure under these circumstances.
