Publications

Patriot Act Impacts Small Businesses

By Ben Currier

Most Americans think new federal anti-terrorism laws don’t affect them. But owners of some small businesses are learning the hard way that they may indeed have obligations under the news laws' anti-money laundering and other provisions.

On October 26, 2001, President Bush signed into law the Uniting and Strengthening America by Providing Appropriate Tools Required to Intercept and Obstruct Terrorism Act, commonly known as the USA Patriot Act. This Act has created a number of regulations that have been implemented to govern how companies control and protect their business systems. Essentially, the Act seeks to improve the way data is managed and protected within information systems, and to provide notice to the company and the government of who the company is doing business with. Not only must a company make certain disclosures of cash purchases and other investments, customers and business transactions, the Patriot Act now requires companies to report “suspicious transactions.”

What are “Banking” Businesses?
Unfortunately, while there is very little to no precedent defining how these provisions of the Act are applied in the real world, or anthe exact definition of what constitutes “suspicious,” the easiest action to take is to know whom you and your business does business with and to maintain records of all business dealings. Within the Act, “banking” businesses—which include but are not limited to banks, credit unions, futures commission merchants, futures-introducing merchants, mutual funds, thrifts, trusts and securities dealers—are regulated as “financial institutions.”

The Patriot Act requires these “banking” businesses to verify the identity of any new customer seeking to open an account. An existing customer is required to verify his or her identify if it is not “reasonably” known. Further, the Act requires that financial institutions need to have in place a system for customer identification, verification, record keeping, customer notice, and data list screening. The Act also requires that the businesses check 12 different lists retained by nine federal agencies—including the Denied Parties, Embargoed Countries and International Traffic in Arms Debarment lists—to determine the identity of customers. The Denied Parties list (Specially Designated Nationals List) can be found on the Department of Treasury website, Officer of Foreign Assets Control (www.treas.gov/offices/enforcement/ofac/sdn/index.html).

“Banking” businesses, as defined above, should designate a compliance officer to assure the business is complying with federal laws. Then the business must take the following steps with all new customers:

     • Take reasonable steps to verify the customer’s identity, such as
         obtaining a copy of a valid driver’s license, passport or other form of
         government–issued identification to ensure a customer’s identity
     • File the verification documents with the business and if necessary
         with local and federal law enforcement.
     • Check the customer’s and the customer’s organization’s name
         (if relevant) against a list of known and suspected terrorist
         organizations. This can be done by reviewing the law enforcement
         lists mentioned above, especially the Denied persons list published
         by the Treasury Department.
     • If a match occurs, the compliance officer has a duty to report
          the person or organization to local and federal law enforcement.

High-Value Cash Deals Also Affected
The Act also focuses on cash and wire transfers. Every business that handles a single cash transaction in excess of $10,000 must report the transaction to government officials. This reporting is done on regular reports found on the Treasury Department's website. Additionally, the Treasury Department has extended anti–money laundering rules to jewel traders and opened discussions on applying them to auto dealers and travel businesses, all industries that handle large monetary transactions. As such, these businesses all need to follow the reporting rules as required by the federal government. In order to maintain compliance with the regulations, training is important on the technical aspects of identifying “suspicious activity.”

Automobile dealerships, insurance companies and jewelers who buy and sell in excess of $50,000 also have responsibilities under the Patriot Act. Auto dealerships must search for and turn over any records relating to an account held by the individual or entity with the past year. In essence, auto dealers must review their customer lists, and previous business transactions in an attempt to identify whether the dealership has done business with any individuals listed on the published watch lists or denied persons lists. In addition, the dealership must produce any transactions made with the individual or entity within the past six months. Entities such as the jewelers and the insurance companies are required to establish anti-money laundering programs.

Generally, all business could now fall under the Patriot Act reporting requirements whether they are understood to fall within the definition of “financial institution,” as all businesses ultimately transacts money with people and other businesses. As such, whether explicit in the Act or definitional section, each and every business should assess what it needs to do to comply with the Act.

Act Provides for Large Penalties for Noncompliance
Penalties for non-compliance with the Act’s requirements are severe. The federal government may assess companies criminal penalties of up to $1 million per incident. Civil fines of $250,000 per incident may be assessed as well. Further, executives may be fined and even imprisoned depending on the severity of the violations. Forfeiture of accounts and other assets in question is another possible penalty. While these penalties are extremely severe, the negative publicity of having violated the Patriot Act may be the worst penalty yet.

Compliance with the Act is now an essential aspect of doing business. All businesses should have mechanisms in place to identify and properly report “suspicious transactions,” currency transactions in excess of $10,000, and people or entities listed on any of the “watch lists.” With the proper training, advice and procedures, compliance with these required acts should become a normal and easy part of doing business in today’s business environment.

This article is based upon and is a general summary of portions of the article The Patriot Act—An Impact Analysis, by Dr. Paul Jorgensen, et. al. (December 11, 2003).