U.S. Bank Reporting Obligations Regarding Their Non-U.S. Correspondent Accounts

October 17, 2011 U.S. Bank Reporting Obligations Regarding Their Non-U.S. Correspondent Accounts

FinCEN Adopts Final Rules to Implement CISADA Section 104(e): Upon Request, U.S. Banks Must Request Information on Financial Ties to Iran from Non-U.S. Banks for Which a Correspondent Account is Maintained, and Report to FinCEN

SUMMARY On October 11, 2011, final rules issued by the Financial Crimes Enforcement Network (“FinCEN”) of the Department of the Treasury (“Treasury”) to implement Section 104(e) of the Comprehensive Iran Sanctions, Accountability, and Divestment Act of 2010 (“CISADA”) became effective. The rules create a mechanism whereby FinCEN can, upon written request, require that a U.S. bank (including a U.S. branch of a non-U.S. bank) make certain inquiries of specified non-U.S. banks for which the U.S. institution maintains a correspondent account, and report information obtained from the non-U.S. banks to FinCEN, along with other information about the non-U.S. banks’ correspondent accounts. In particular, FinCEN may require U.S. institutions to inquire of a specified non-U.S. bank client whether that non-U.S. bank: (1) maintains a correspondent account for an Iranian-linked financial institution designated under the International Emergency Economic Powers Act (“IEEPA”), as identified on the List of Specially Designated Nationals and Blocked Persons (“SDN List”) maintained by Treasury’s Office of Foreign Assets Control (“OFAC”); (2) has processed one or more funds transfers, within the preceding 90 calendar days, for or on behalf of, directly or indirectly, such an Iranian-linked financial institution; or (3) has processed one or more funds transfers within the preceding 90 calendar days for or on behalf of, directly or indirectly, Iran’s Islamic Revolutionary Guard Corps (“IRGC”) or its agents or affiliates, as identified on OFAC’s SDN List. The U.S. bank would be required to submit a report to FinCEN in response to FinCEN’s original request, generally within 45 days. The final rules are very similar to those contained in FinCEN’s proposal, although a few modifications were made in response to public comments.

New York Washington, D.C. Los Angeles Palo Alto London Paris Frankfurt Tokyo Hong Kong Beijing Melbourne Sydney

www.sullcrom.com

CISADA SECTION 104 Signed by President Obama on July 1, 2010, CISADA, among other things, sought to present “foreign banks doing business with blacklisted Iranian entities a stark choice—cease [their] activities or be denied critical access to America’s financial system.”1 Section 104(c) of CISADA required Treasury to prohibit, or strictly limit, the opening or maintenance in the United States of a “correspondent” or “payable-through” account by any “foreign financial institution” that engages in certain prohibited activities, including facilitation of a “significant transaction” or provision of “significant financial services” for the IRGC, any of its agents and affiliates, or any financial institution whose property or interests in property are blocked under OFAC sanctions programs. OFAC has adopted regulations, titled the Iranian Financial Sanctions Regulations (“IFSR”), to implement these requirements.2

Section 104(e) of CISADA complements Section 104(c) by directing Treasury to implement regulations that establish requirements for U.S. financial institutions that open and maintain correspondent accounts for non-U.S. banks, including requirements to obtain and report information about the use of those correspondent accounts, which may assist Treasury in monitoring the use of those accounts and detecting activities that could implicate the Section 104(c) activity triggers.3 On April 27, 2011, FinCEN issued a notice of proposed rulemaking under Section 104(e), and invited public comment.4 FinCEN’s final rules, although substantially similar to the proposal, contain a few modifications in response to comments. They will be codified at 31 C.F.R. Part 1060.

THE FINAL RULES A. DUTY OF INQUIRY

U.S. banks (including U.S. branches of foreign banks)5 that maintain a correspondent account6 for a foreign bank are required, upon receiving a written request from FinCEN, to ask that foreign bank to certify whether it:

 maintains a correspondent account for an “Iranian-linked financial institution designated under IEEPA”;  has processed any transfer of funds, within the preceding 90 calendar days,7 for or on behalf of, directly or indirectly, an Iranian-linked financial institution designated under IEEPA, other than through a correspondent account;  has processed any transfer of funds, within the preceding 90 calendar days, for or on behalf of, directly or indirectly, an “IRGC-linked person designated under IEEPA.”8

These inquiries are to be made of the foreign bank by the U.S. bank in the form of a certification that is published in the adopting release and that will be made available by FinCEN on its website. The certification asks the foreign bank to check a series of boxes and to provide narrative responses as appropriate. The certification then must be signed, dated, and returned to the U.S. bank.

-2- U.S. Bank Reporting Obligations Regarding Their Non-U.S. Correspondent Accounts October 17, 2011

Along with these specific inquiries, a U.S. bank must also request that the foreign bank agree to notify it if the foreign bank subsequently establishes a new correspondent account for an Iranian-linked financial institution designated under IEEPA within 365 calendar days from the date of the foreign bank’s initial response to the inquiry. This aspect of the rules is limited to Iranian-linked financial institution correspondent accounts and there is no additional requirement regarding subsequently opened accounts for an IRGC-linked person. A foreign bank is asked to provide any such notification in writing within 30 calendar days of establishment of the new correspondent account.

For purposes of the rule, the term “Iranian-linked financial institution designated under IEEPA” means any entity listed on OFAC’s SDN List with the tag “[IFSR]” appearing next to its name. Similarly, the term “IRGC-linked person designated under IEEPA” means the IRGC and any agent or affiliate thereof, as listed on OFAC’s SDN List with the tag “[IRGC]” appearing next to the name.9

According to FinCEN, it intends to send requests for information under these rules to U.S. banks, or U.S. branches of foreign banks, only in situations where, based on all available information, FinCEN believes that the institution maintains a correspondent account on behalf of the specific foreign bank that is the subject of FinCEN’s request. However, FinCEN maintains discretion to disseminate requests more broadly, and the number of U.S. banks that receive a written request may vary from case to case.10

B. REPORTING REQUIREMENTS

A U.S. bank that receives a written request from FinCEN is required to report back to FinCEN within 45 calendar days from the time of its receipt of the written request from FinCEN, an increase from 30 calendar days as originally proposed. The report is required even if the foreign bank has not yet responded to the U.S. bank’s inquiries or provided the requested certification. In the adopting release, FinCEN acknowledges that there may be situations in which additional time is needed for a foreign bank to respond. Accordingly, in these situations, a second report from the U.S. bank would be due within ten calendar days of receiving the foreign bank’s response.

If a foreign bank provides a subsequent notification to the U.S. bank that it has established a new correspondent account for an Iranian-linked financial institution designated under IEEPA, the U.S. bank must provide a report within ten calendar days of its receipt of the notification from the foreign bank.

As for the content of reports, the rules require the U.S. bank to provide various information about any bank that has engaged in activities that could implicate CISADA Section 104(c)(2), including: (1) the name of the foreign bank that has a correspondent account with the U.S. bank; (2) the name of any Iranian-linked financial institution designated under IEEPA that holds a correspondent account with such foreign bank, along with correspondent account information, such as account number and whether the account has been restricted, and the value of transactions processed through such account within the past 90 calendar days; and (3) whether the foreign bank has processed funds transfers within the past 90 calendar days for any Iranian-linked financial institution designated under IEEPA, other than transfers -3- U.S. Bank Reporting Obligations Regarding Their Non-U.S. Correspondent Accounts October 17, 2011

from a correspondent account, or funds transfers for any IRGC-linked person designated under IEEPA, including those made through a correspondent account, and, if so, provide the names of the parties in interest along with account and value information. These reports would be based largely on the foreign bank’s certification, and a U.S. bank would not be required to independently verify the information provided by a foreign bank in response to the inquiry. Nevertheless, FinCEN clarifies in the adopting release that it expects that a U.S. bank could have knowledge of these matters based on the monitoring it already conducts to comply with OFAC and Bank Secrecy Act11 requirements regarding due diligence over foreign correspondent accounts. Accordingly, FinCEN states that it does expect a bank to report if it has information that is inconsistent with the foreign bank’s certification.12 If not, the U.S. bank would be required to certify that it does not have any information that is inconsistent with the foreign bank’s disclosures.13

If the foreign bank certifies that it has no correspondent account for an Iranian-linked financial institution designated under IEEPA and, to its knowledge, has not engaged in the targeted funds transfers, that fact would be reported to FinCEN. If the foreign bank fails to respond to the inquiries, or fails to certify its response, the U.S. bank would report that it is unable to determine the information. If the U.S. bank does not maintain a correspondent account for the foreign bank(s) specified in FinCEN’s written notice, and, FinCEN specifically requests in its written notice that the U.S. bank report that information, then the U.S. bank would be required to provide a confirmation that it has no such accounts to FinCEN.

C. RECORD RETENTION

A bank is required to maintain for five years a copy of any report filed and the original or any business record equivalent of any supporting documentation for a report, including a foreign bank’s certification or other responses to an inquiry under the rules.14

D. PENALTIES

U.S. banks that fail to comply with these rules will be subject to the civil and criminal penalties applicable to U.S. banks that fail to comply with similar reporting requirements under Title III of the USA PATRIOT Act, as set forth in 31 U.S.C. §§ 5321(a) and 5322.

Although not strictly penalties, the information included in the reports could lead to immediate action under Section 104(c) of CISADA to prohibit or strictly condition the maintenance of a foreign bank’s correspondent account in the United States or, short of that, lead to consultation with, or investigation of, a foreign bank’s activities.

The foreign bank’s failure to respond would not be subject to penalties under the rules but presumably could lead to consequences under CISADA Section 104(c).

ENDNOTES 1 Comprehensive Iran Sanctions, Accountability and Divestment Act of 2010, H.R. Rep. No 111- 512, at 43 (2010) (Conf. Rep.). 2 See 31 C.F.R. Part 561. 3 CISADA Section 104(e)(1) authorizes Treasury to require U.S. financial institutions that maintain a correspondent or payable-through account for a foreign financial institution to do one or more of the following: (A) perform an audit of activities described in CISADA Section 104(c)(2) that the foreign financial institution may carry out; (B) report to Treasury on transactions or other financial services provided with respect to activities described in CISADA Section 104(c)(2); (C) certify, to the best of its knowledge, that the foreign financial institution is not knowingly engaging in CISADA Section 104(c)(2) activities; or (D) establish due diligence policies, procedures, and controls reasonably designed to detect whether Treasury has found the foreign financial institution to be knowingly engaged in CISADA Section 104(c)(2) activities. 4 Comprehensive Iran Sanctions, Accountability, and Divestment Act of 2010 (“CISADA”) Reporting Requirements Under Section 104(e), 76 Fed. Reg. 24,410 (May 2, 2011). 5 The rules do not require reporting by non-depository financial institutions, and with respect to institutions that have both depository and non-depository institutions within the same bank holding company, the rules only require reporting from the depository institution. Comprehensive Iran Sanctions, Accountability, and Divestment Reporting Requirements, 76 Fed. Reg. 62,608, 62,617 (Oct. 11, 2011) (“Adopting Release”). 6 For purposes of the rule, a “correspondent account” means an account established by a U.S. bank, or U.S. branch of a foreign bank, for a foreign bank to receive deposits from, or to make payments or other disbursements on behalf of the foreign bank, or to handle other financial transactions related to the foreign bank. According to the adopting release accompanying the rule, “payable-through” accounts, as that term is used in CISADA Section 104, are subsumed within the definition of a “correspondent account” for purposes of the rule. See 31 C.F.R. § 1060.300(a)(1); see also 31 C.F.R. § 1010.605(c)(1)(ii). 7 The rules do not specifically state whether the 90-day look-back period starts on the date of FinCEN’s request to the U.S. bank, the U.S. bank’s inquiry of the foreign financial institution that holds a correspondent account, or the date of the foreign financial institution’s response. 8 In the context of the request that the foreign bank certify whether it has processed one or more transfers of funds within the proceeding 90 calendar days, the proposed rule required a foreign bank to certify as to transfers that were “related to” an Iranian-linked institution designated under the IEEPA or an IRGC-linked person designated under the IEEPA. However, several commenters expressed concern that a foreign bank may be unable to reasonably determine whether such designated entities were “related to” a party of the transaction. As a result, FinCEN replaced “related to” with “for or on behalf of, directly or indirectly”, in order to more clearly indicate its intent to exclude situations where the foreign bank could not reasonably determine whether such designated entities were a party to a transaction, but at the same time include situations where the foreign bank has knowledge that a party to a funds transfer had a relationship with a designated entity. Adopting Release, 76 Fed. Reg. at 62,613. 9 The list of IFSR-designated entities includes the following 22 entities (“also known as” and “formerly known as” identifications not repeated here), not all based in Iran: Ansar Bank; Arian Bank; Banco Internacional de Desarrollo, C.A.; Bank of Industry and Mine (of Iran); Bank Kargoshaee; Bank Mellat; Bank Melli; Bank Refah Kargaran; Bank Saderat Iran; Bank Sepah; Bank Sepah International PLC; Europaeisch-Iranische Handelsbank AG; Export Development Bank of Iran; First East Export Bank, P.L.C.; Future Bank B.S.C.; Mehr Bank; Mellat Bank SB CJSC; Melli Bank PLC; Mir Business Bank ZAO; Moallem Insurance Company; Persia International Bank PLC; and Post Bank of Iran. The list is subject to change and updated from -5- U.S. Bank Reporting Obligations Regarding Their Non-U.S. Correspondent Accounts October 17, 2011

ENDNOTES (CONTINUED) time-to-time by OFAC. OFAC maintains a special list of individuals and entities designated under either tag, at: http://www.treasury.gov/resource-center/sanctions/Programs/Documents/irgc_ifsr.pdf. 10 Adopting Release, 76 Fed. Reg. at 62,609. 11 31 U.S.C. §§ 5311–22 (2010). 12 An example provided in the release of a situation in which information is inconsistent with the certification is a scenario where a U.S. bank’s transaction-monitoring software recently blocked a transaction on behalf of a certain foreign bank, but that foreign bank does not include this transaction in its report provided to the U.S. bank. Adopting Release, 76 Fed. Reg. at 62,615. 13 As proposed, the rules would have required the U.S. bank to certify that it did not know, suspect, or have reason to suspect that the foreign bank’s information was incorrect; in the final rules the “no inconsistent information” standard replaced this proposed language in response to comments and to further clarify that FinCEN does not otherwise expect the U.S. bank to verify the information reported by the foreign bank. Adopting Release, 76 Fed. Reg. at 62,615. 14 31 C.F.R. § 1060.300(d).

-6- U.S. Bank Reporting Obligations Regarding Their Non-U.S. Correspondent Accounts October 17, 2011

ABOUT SULLIVAN & CROMWELL LLP Sullivan & Cromwell LLP is a global law firm that advises on major domestic and cross-border M&A, finance, corporate and real estate transactions, significant litigation and corporate investigations, and complex restructuring, regulatory, tax and estate planning matters. Founded in 1879, Sullivan & Cromwell LLP has more than 800 lawyers on four continents, with four offices in the United States, including its headquarters in New York, three offices in Europe, two in Australia and three in Asia.

CONTACTING SULLIVAN & CROMWELL LLP This publication is provided by Sullivan & Cromwell LLP as a service to clients and colleagues. The information contained in this publication should not be construed as legal advice. Questions regarding the matters discussed in this publication may be directed to any of our lawyers listed below, or to any other Sullivan & Cromwell LLP lawyer with whom you have consulted in the past on similar matters. If you have not received this publication directly from us, you may obtain a copy of any past or future related publications from Jennifer Rish (+1-212-558-3715; [email protected]) or Alison Alifano (+1-212- 558-4896; [email protected]) in our New York office.

CONTACTS New York Elizabeth T. Davy +1-212-558-7257 [email protected] Kelly Helt +1-212-558-4639 [email protected] Washington, D.C. Andrew S. Baer +1-202-956-7680 [email protected] Eric J. Kadel, Jr. +1-202-956-7640 [email protected] Andrea R. Tokheim +1-202-956-7015 [email protected]

-7- U.S. Bank Reporting Obligations Regarding Their Non-U.S. Correspondent Accounts October 17, 2011 SC1:3125183.2