Keeping the industry safe

Anti-money laundering (AML)

Anti-money laundering (AML) rules come from the Bank Secrecy Act (BSA), as amended by the Uniting and Strengthening America by Providing Appropriate Tools Required to Intercept and Obstruct Terrorism Act - better known as the USA PATRIOT Act. The purpose of the act, as clearly demonstrated by its timing after September 11, 2001, was to find and stop terrorists and terroristic threats. Since most terrorism requires money, the parts of the act we’re most concerned about focus on anti-money laundering: helping prevent criminals from using our financial system.

Office of Foreign Assets Control (OFAC)

An office of the Treasury that administers and enforces certain economic and trade sanctions against specified nations, entities, individuals, or similar. In normal world parlance, these are referred to as “sanctions”. North Korea is sanctioned, and on the list that OFAC enforces.

Specially Designated Nationals and Blocked Persons (SDN)

The list that OFAC creates of persons and organizations, that US citizens and persons are prohibited from doing business with.

AML reports

When we refer to “cash” for a CTR, we mean currency: coins and paper money, U.S. or foreign. Money orders, travelers checks, and cashier’s checks are monetary instruments, not currency, so they don’t count toward the CTR threshold, and neither does a bank check from another bank. Any of them can still be part of suspicious activity.

There are 3 primary monetary values of concern in AML procedures;

• $3,000 - For wire transfers of at least $3,000, the firm must keep on its files information about the transfer: the sender’s name and address, the amount, the date, any payment instructions, the recipient’s financial institution, and whatever details about the recipient came with the order. If the sender isn’t an established customer, the firm also records the name, address, and taxpayer identification number of the person placing the order, and if the order is placed in person, it first verifies that person’s identity and records the ID document it reviewed.
• $5,000 - A Suspicious Activity Report (SAR) must be filed with FinCEN (the Financial Crimes Enforcement Network, the Treasury bureau that administers the BSA) for “suspicious” transactions of $5,000 or more, within 30 calendar days of initial detection of the suspicious activity. They will be rather specific, but if clients don’t care about risk, don’t care about your advice, make trades with seeming no concern for mounting commission costs, and things like that; things that aren’t normal for an investor, but might be normal for a criminal trying to cover the origins of the transactions, by doing so many so fast. It is illegal to inform the client that it is being filed.
• $10,000 - For transactions over $10,000 (not at least but over $10k), a Currency Transaction Report (CTR) must be filed with FinCEN. This form must be filed within 15 days. A SAR doesn’t mean a crime was committed, and a CTR implies even less: it is purely a routine report of cash in or out of more than $10,000 in a single business day, with no suggestion of wrongdoing. Breaking up cash into amounts at or below $10,000 to keep it from being reported is structuring, which federal rules prohibit in any amount, even when no single day’s cash tops $10,000. A firm that knows or suspects structuring involving at least $5,000 must file a SAR.

$10,000 appears in other aspects of financial rules too, including the International Transportation of Currency and Monetary Instruments Report (CMIR), which requires reporting when more than $10,000 in cash or monetary instruments is physically transported into or out of the US.

AML compliance program

All firms must establish a written anti-money laundering compliance program and policies to verify. Minimally, the program must include;

• Ongoing employee training, often through links on the company’s employee portal.
• Independent audits to verify compliance with the program, and compliance all rules and regulations around it.
• Policies and procedures to deter money laundering activities, and to find them if any are attempted.
• A compliance officer is designated as being responsible for the firm’s AML program, and identified to FINRA.
• Risk-based customer due diligence: understanding the nature and purpose of each customer relationship, and ongoing monitoring to identify and report suspicious transactions and keep customer information current.

The customer identification program (CIP)

As part of the regulations created under the USA PATRIOT Act, we must have proper identification for the client, and verify they are not on OFAC’s SDN list of people we are prohibited from doing business with. To comply with this provision, we must collect the customer’s name, date of birth, address, and identification number, and then verify their identity. The most common way is a non-expired government issued photographic ID, such as a driver license, non-drivers photo ID, passport, or military ID. The firm records a description of the document (type, ID number, place of issuance, and dates), not necessarily a copy, and it may verify identity through non-documentary methods instead, like checking a consumer reporting agency or public database.

If a person refuses to provide the identifying information needed to verify their identity, the firm won’t open the account. Clients must provide this information. You will even see this now when people create new crypto wallets.

For corporate accounts, there is no photo-id. A firm verifying a corporation, partnership, or trust through documents uses ones showing that the entity exists, such as certified articles of incorporation, a government-issued business license, a partnership agreement, or a trust instrument. The names of the people authorized to trade for the entity are a separate account record, required by FINRA Rule 4512.

Tax-payer IDs are required for most accounts, but the firm can waive them provided they have evidence one has been applied for. The application for the tax-payer ID must have been filed, and the firm will keep a copy of the application, until the final ID comes in.

Numbered accounts are a weird thing, where a client is actually listed as a number, not by their name. In many cases, students who are not prepared, cannot imagine that those are legal to do in the US. In the Swiss banks in movies, sure, but not in the US. Actually, it is perfectly legal in the US, with 1 major caveat; the clients actual name, the identified person, is listed as owning that specified number account, in at least one location at the firm. They cannot be truly anonymous. The person opening the account still provides ID, but a coworker walking by might see you placing orders for client 24601 without knowing who that is.

Violations

Violating AML rules are costly. Registered representatives found guilty of facilitating or in any way assisting/not reporting money laundering could face both serious criminal and civil penalties. Criminal penalties include up to 20 years in jail. Criminal fines run up to $500,000 per transaction, or 2 times the value of the property involved, whichever is greater. Civil penalties run up to the value of the property involved, or $10,000, whichever is greater.

Most modern firms don’t take cash, and if you aren’t taking cash, then there really isn’t a lot of ways clients can launder money through your firm.

Securities investor protection corporation (SIPC)

Formed under the Securities Investor Protection Act of 1970, SIPC is effectively an insurance company for broker-dealers: if a firm goes out of business or has some other severe issue, investors have a certain amount of protection from losing their assets in the firm’s bankruptcy. SIPC does not protect against a security falling in value or against an issuer that can’t pay: it works to return the cash and securities that were in the account when the firm failed, whatever those securities are then worth.

One of the key things to recognize is how securities can be registered. They can be registered directly in the name of the customer - held by the customer, in a safety deposit box, or at a similar secure location - or they can be held in street name, meaning the securities are registered to the broker-dealer on the customer’s behalf.

Securities registered directly in the customer’s name are never at risk in the broker-dealer’s bankruptcy; they belong to the customer outright, so SIPC doesn’t need to cover them. Securities held in street name are the ones that matter for SIPC: because they’re registered to the broker-dealer rather than the customer, they’re exactly what a bankrupt firm’s creditors could otherwise reach, and SIPC exists to protect customers against that loss, up to its coverage limits.

Mutual funds and government treasuries can be registered either way. A client can hold them directly - through the fund’s transfer agent, or through TreasuryDirect for treasuries - in which case they’re never at risk in a broker-dealer’s bankruptcy. Or a client can hold them in a brokerage account in street name, in which case they’re SIPC-covered like any other street-name security. Most securities today are held in street name because it’s simpler to buy and sell; you don’t need to personally sign and deliver a certificate if it isn’t directly registered to you.

SIPC primarily covers cash accounts (accounts that are 100% owned) and the equity in margin accounts. Everything in a cash account can be covered up to the maximum, but only the equity of a margin account counts - not commodities, futures, or similar positions.

SIPC coverage is up to $500,000 per customer, per separate capacity (registration), at each firm. Customers can have multiple accounts at different brokerages, each with its own $500,000 coverage. Within a single firm, coverage is separate for each distinct capacity: Jamie’s individual cash account, Quinn’s individual cash account, the Jamie and Quinn joint account, and an account where Jamie is custodian for Robin would each be a separate covered account, even though Jamie is married to Quinn.

Of that $500,000, only $250,000 can be in cash. Most modern cash accounts use a feature called a sweep money market: uninvested cash - received dividends, interest, other distributions, or sale proceeds waiting to be reinvested - is periodically swept into a money market fund, which is a security. On the exam, you might see a cash account with $500,000 in it: $200,000 in securities and $300,000 in cash. That account would have SIPC protection of $450,000 - the full $200,000 in securities, plus $250,000 of the $300,000 in cash (coverage is capped at $250,000 in cash, not the full $300,000).

Brokerage at a bank, and SIPC signage

Customers can confuse a bank’s FDIC insurance with SIPC protection, so the rules require signs and disclosures that keep them apart. A member firm that offers brokerage services on the premises of a bank or other financial institution, under a networking arrangement, must (FINRA Rule 3160):

• Be clearly identified as the firm providing the brokerage services, and work in an area that clearly displays the firm’s name, physically separate from where the bank takes retail deposits wherever practicable.
• Disclose to each customer in writing when the account is opened, and orally if it is opened at the bank, that the services are provided by the firm and not the bank, and that the securities are not FDIC insured, are not deposits of or guaranteed by the bank, and can lose value, including the principal invested.
• Show that the firm provides the services on every confirmation and account statement. Retail communications about the bank location carry the same disclosures, often as the legend “Not FDIC Insured - No Bank Guarantee - May Lose Value.”

Separately, every SIPC member must display the official SIPC symbol prominently at its main office and at each branch office, with narrow exceptions (SIPC Bylaws, Article 10), and must tell new customers in writing, and all customers at least once a year, that information about SIPC, including its brochure, is available from SIPC, with SIPC’s website and phone number (FINRA Rule 2266).