I. INTRODUCTION
In November of 2008, the Federal Reserve Board (Board) and the Department of the Treasury announced a joint final rule (Regulation GG) to implement the Unlawful Internet Gambling Enforcement Act (Act) of 2006. The final rule applies to financial firms that participate in designated payment systems and requires these firms to establish and implement policies and procedures that are reasonably designed to prevent payments to gambling businesses in connection with unlawful Internet gambling. The primary focus of the policies and procedures should be directed at establishing a due diligence process to ensure commercial customers are not engaged in unlawful Internet gambling activities.
Participants in designated payments systems must establish and implement written policies and procedures reasonably designed to identify and block or otherwise prevent restricted transactions. Participants with particular roles in a payment system may be exempt from the regulation’s requirement to establish written policies and procedures because, in these roles, it is impractical for the participant to identify or block prohibited unlawful Internet gambling transactions. The final rule provides a list of exempt entities and transactions. The final rule also provides a non-exclusive sample list of possible policies and procedures reasonably designed to prevent restricted transactions. These include due diligence procedures in establishing new commercial customer accounts and relationships, implementing a mandatory transaction code system that may be used to identify restricted transactions, and establishing procedures to ensure compliance with the Act upon receiving actual knowledge that a customer has engaged in an Internet gambling transaction.
The final regulations became effective January 19, 2009, and financial intermediaries subject to the Act were required to be in compliance by June 1, 2010.
II. KEY DEFINITIONS
Key definitions under the final rule include:
III. EXEMPTIONS
The regulation exempts many participants in four of the five categories of designated payment systems from the requirement for establishing written policies and procedures reasonably designed to prevent or prohibit restricted transactions with respect to that transaction. In the case of ACH, check collection, and wire transfer systems, the regulation applies only to those participants that possess customer relationships with Internet gambling businesses (the depository financial institution receiving an ACH credit transaction or originating an ACH debit transaction, the depository bank in the case of a check collection transaction, or the beneficiary’s bank in the case of a wire transfer) and those engaged in certain cross-border transactions.
IV. REQUIRED POLICIES AND PROCEDURES
All non-exempt participants in designated payment systems must establish and implement written policies and procedures reasonably designed to identify and block or otherwise prevent or prohibit restricted transactions associated with commercial accounts. A non-exempt financial transaction provider participant in a designated payment system is considered to be in compliance with the policy and procedure requirements if: (1) it relies on and complies with the written policies and procedures of the designated payment system that are reasonably designed to: (a) identify and block restricted transactions; or (b) otherwise prevent or prohibit the acceptance of the products or services of the designated payment system or participant in connection with restricted transactions; and (2) such policies and procedures of the designated payment system comply with the requirements of the regulation.
A participant in a designated payment system may rely on a written statement or notice by the operator of that designated payment system to its participants that states that the operator has designed or structured the system’s policies and procedures for identifying and blocking or otherwise preventing or prohibiting restricted transactions to comply with the requirements of this regulation as conclusive evidence that the system’s policies and procedures are in compliance, unless the participant is notified otherwise by its federal functional regulator or the Federal Trade Commission.
V. NON-EXCLUSIVE EXAMPLES OF POLICIES AND PROCEDURES
A. Due Diligence
The regulations provide a detaileddescription of the kind of “flexible, risk-based” due diligence in account opening and maintenance that the regulations contemplate:
This due diligence – which may be performed in combination with other customer due diligence required by the Bank Secrecy Act and other federal laws – is expected to form the primary policy and procedure for non-exempt participants in ACH, check collection, and wire transfer systems.
With respect to card systems, however, the regulations generally anticipate that, as an alternative to the “risk-based” due diligence framework, participants will develop or use existing transaction coding mechanisms to identify and block suspected unlawful Internet gambling transactions in real time. In this regard, non-operator participants in an “operator-driven” designated payment system such as a card system may rely on and comply with policies and procedures adopted by the operator, in which case they need not separately adopt their own policies and procedures. The participant need not independently verify compliance of the operator’s policies and procedures with the regulations, and may rely on the operator’s written notice to its participants that it has adopted policies and procedures to comply with the regulations, unless federal regulators have given notice that such policies and procedures are non-compliant.
Banks should contact their card networks to learn more about the policies and procedures that will be implemented and to obtain copies of those procedures well in advance of the December 1, 2009, implementation date.
VI. POLICIES AND PROCEDURES WHEN RESTRICTED TRANSACTIONS ARE KNOWN
Every financial institution that is a non-exempt participant must establish written policies and procedures describing remedial actions it will take if it discovers that a commercial account is processing restricted transactions. The final rule does not mandate any specific actions that must be taken, but relies on each participant to have established policies and procedures in place.
The final rule clarifies the obligations that a non-exempt participant in a designated payment system must adhere to when it gains “actual knowledge” that a commercial account has processed restricted transactions.
According to the final rule, actual knowledge is gained when an entity knows or receives a report from a governmental entity such as a law enforcement or regulatory agency that a commercial account is processing restricted transactions. A financial institution that merely has suspicions of restricted transactions, but does not know for certain, is not obligated to initiate the policies and procedures.
When the “actual knowledge” threshold is met, the final rule does not provide participants with a set of standard actions to implement. The overview discussion notes that it will be left to the participant’s “business judgment” whether it is appropriate to deny the commercial customer access to a particular payment system or to close the account entirely or to take some other action.
If a non-exempt participant gains actual knowledge that one of its commercial customers is operating as an Internet gambling business, they are obligated to initiate the proper due diligence to determine if the account holder has the legal authority to do so. This applies to customer accounts opened before or after December 1, 2009. The commercial account should be required to provide evidence that it is operating with legal authority (state or tribal license or reasoned legal opinion) and that it has the proper safeguards in place to prevent minors and those in more restrictive jurisdictions from placing unlawful wagers.
VII. COMMERCIAL ACCOUNT NOTICE
The final rule requires that banks communicate to their commercial customers that restricted transactions are prohibited under the Act. However, the regulation is flexible regarding how the communication is made. It may be made through a revised commercial account agreement for new customers, pursuant to a notice sent to established commercial customers, or possibly even through some other methods including a notice on the bank’s Web site as long as the commercial account holders are reasonably likely to receive it. Banks are not required to update account agreements or provide notice with a periodic statement to comply with this requirement of the Act.
The final rule does not provide model language for the required disclosure. Banks are not obligated to explain the requirements of the Act or to instruct commercial account holders on the differences between lawful and unlawful gambling. The requirement is simply to inform commercial customers that transactions that are restricted under the Act are prohibited and should not be processed through these accounts.