The Unlawful Internet Gambling Enforcement Act (UIGEA) was enacted into law in 2006. The proposed rule implementing the legislation was published for comment in October 2007. The Final Rule was issued on November 12, 2008.
When does my bank have to be in compliance with the Final Rule?
The Final Rule becomes effective on January 19th, 2009, but the more important date is December 1, 2009 when compliance becomes mandatory.
What will my bank have to do to comply with the Final Rule?
In general, the Final Rule imposes certain responsibilities on banks to demonstrate through written policies and procedures that they are taking precautions when opening commercial accounts that may operate as illegal Internet gambling entities (casinos). If illegal Internet casinos are denied the opportunity to open a bank account, they will be denied the opportunity to make and receive payments. It also requires that banks have policies and procedures that would prevent credit and debit card transactions from being made to Internet casinos for unlawful Internet gambling by any of its customers, including individual, non-commercial account holders. For these card transactions, banks may rely on the policies and procedures established by the card networks and do not have to create a separate process.
Does my bank have to monitor my customers' accounts to make sure that they are not gambling illegally on the Internet?
No. Your bank must "...establish and implement written policies and procedures reasonably designed to identify and block or otherwise prevent or prohibit restricted transactions." Under the final rule this means:
1. Your bank must establish written policies and procedures to screen unlawful Internet gambling businesses (casinos) from opening an account at your bank. Lawful Internet gambling businesses will be required to provide extensive documentation at account opening. Robust written policies and procedures will allow your bank to meet the Final Rule's requirements. The Final Rule focuses on screening for unlawful Internet gambling businesses at the time of account opening. If unlawful Internet gambling businesses are prevented from accessing the banking system, then they will not be able to make or receive payments using checks, wires, or ACH payments.
2. Your bank is not required to monitor or determine whether its customer is a gambler except that it must ensure that unlawful credit and debit card transactions are blocked. It is the responsibility of the card network to establish policies and procedures to identify and block unlawful transactions. The bank may rely on a written notice from the network (****/**********) stating that the policies and procedures that are in place meet the UIGEA Final Rule requirements. Banks are not required to validate this claim. The networks may meet this threshold by conducting suitable due diligence checks on commercial accounts or through establishing a code system that would allow card issuers to identify and deny transactions that may be restricted.
3. Your bank is not required to block ACH, wire, or check payments related to unlawful Internet gambling to be in compliance with the Final Rule.
How will my bank know which transactions to block if there is no definition of "unlawful Internet gambling" included in the Final Rule?
Your bank is not required to block ACH, wire, or check payments related to unlawful Internet gambling to be in compliance with the Final Rule. Your bank will be allowed to rely on the policies and procedures established by the card networks to block restricted debit and credit card transactions. In other words, if your customer is the gambler, you do not have to block gambling transactions except for debit and credit card transactions. In those cases, you may rely on the network policies and procedures and merchant codes.
The Final Rule requires that banks establish procedures during the account opening process to identify commercial accounts that conduct Internet gambling business. It is the responsibility of the commercial account applicant to provide documentation that its online gambling business is lawful as per State or tribal law. Banks will not be required to make blocking decisions on individual transactions.
What if the card networks' policies and procedures to prohibit restricted transactions aren't effective?
Your bank is allowed to rely on the certification of the payment system operator that it is in compliance. The Agencies expect that federal regulators will examine the payment systems for compliance purposes.
How will my bank know which transactions to block if there is no list of unlawful Internet gambling entities to screen payments against?
Your bank is not required to compare and or block transactions against a government created list of Internet gambling entities. The Agencies decided that creating such a list would not be practical because of the difficulty in interpreting different state and federal laws on Internet gambling. The Agencies also recognized the obstacles presented if banks were asked to monitor and/or block transactions in real time. Instead, the Final Rule relies on the account opening screening process to identify commercial customers who may pose a risk of conducting Internet gambling business as casinos. If unlawful Internet gambling businesses are prevented from opening an account, then they will be prohibited from conducting restricted transactions.
Does my bank need to perform due diligence on existing individual or commercial accounts?
No. However, your bank's policies and procedures should reflect the requirement to notify its commercial customers that "restricted transactions" are prohibited from being transacted through the account.
Does my bank have to redesign all of its account opening documentation to demonstrate how applicants are screened according to the UIGEA Final Rule?
The focus of the Final Rule falls on commercial customer accounts. Your bank's policies and procedures should be able to demonstrate that the following steps have been taken during the account opening process. This due diligence can be performed in conjunction with existing account opening processes that are already required with the Bank Secrecy Act. The Final Rule
does not require a separate set of questions be asked of new applicants.
1. Determine whether the account is for an individual or commercial customer.
2. For accounts determined to be for individuals, no further steps are required.
3. For commercial accounts where the bank determines there is "minimal risk" of it being an Internet casino, no further steps are required.
4. For commercial accounts where it can't be immediately determined that there is "minimal risk" the applicant that does not operate as an Internet casino should certify that they do not engage in Internet gambling business. For those that certify this, no further steps are required.
5. For commercial accounts that do engage in Internet gambling business, they must provide evidence of their legal authority to do so, or a legal opinion, and, a third party certification of its age and location verification procedures (to ensure that restrictions on minors and geographic legalities are observed). This step places the burden of proving that that the Internet gambling entity is operating legally on the casino itself and its governing authorities.
How will the Final Rule affect my bank's foreign correspondent relationships?
Your bank will be expected to conduct an appropriate risk-based due diligence when establishing a foreign correspondent relationship. Your bank will NOT be required to conduct due diligence of commercial customers of the foreign correspondent.
The Final Rule will only apply to cross-border debits (ACH debits and check collections). If your bank is informed by a U.S. government entity (law enforcement agency or a regulator) that a foreign correspondent has sent your bank a restricted transaction, your bank will be expected to provide notice to that correspondent. A sample model notice is included with the Final Rule.
What should my bank do if it suspects or obtains "actual knowledge" an individual customer is using their account to place bets?
Transactions conducted by individuals are not subject to the Final Rule. However, nothing in the Final Rule changes your bank's obligation to file suspicious activity reports if you suspect a customer's behavior is suspicious.
What should my bank do if it suspects or obtains "actual knowledge" a commercial account is being used as an Internet gambling business?
Your bank's written policies and procedures should describe what steps your bank will take when it has "actual knowledge" that one of your commercial customers is participating in restricted transactions. Your bank should use its own judgment as to when a customer would benefit from counseling on their infraction or if it were more appropriate to deny a customer access to a payment system or even to close the account. The Final Rule's drafters expect each bank's regulators to review each of these situations and assess whether the remedial action that was taken was appropriate.
The "actual knowledge" standard is met when a particular fact with regard to a commercial customer is known by or brought to the attention of an individual responsible for compliance functions at your bank or an officer of the organization.
Nothing in the Final Rule changes your bank's obligations to file suspicious activity reports. What are my bank's obligations under this Final Rule when third party processors are involved in transactions?
For the purposes of the Final Rule, third party processors are defined as entities that have the direct relationship with commercial customers, not the bank. The third party processors act as intermediaries between your bank and the commercial customer. The third party processors have the direct relationship with the commercial customer, not your bank, so they are obligated to perform the required due diligence.
If your bank has hired a third party processor to facilitate payments on behalf of commercial customers that your bank has a direct relationship with, then your bank is obligated to perform the due diligence.
What liabilities does the Final Rule place on my bank if it inadvertently blocks a legitimate transaction?
The Final Rule provides liability protection if the blocked payment is:
1. A restricted transaction,
2. Reasonably believed to be a restricted transaction, or
3. Blocked per the established policies and procedures of a payments system (****/**********).
My bank has an established policy of not processing ANY gambling related transactions. Will this Final Rule force us to conduct transactions that we block today?
No. The Agencies do not believe that the UIGEA grants the authority to force a bank to process a payment that it currently blocks. If a bank has chosen to block all gambling transactions, for example, due to increased default risks, then they may continue to implement this 'business decision."
When does my bank have to be in compliance with the Final Rule?
The Final Rule becomes effective on January 19th, 2009, but the more important date is December 1, 2009 when compliance becomes mandatory.
What will my bank have to do to comply with the Final Rule?
In general, the Final Rule imposes certain responsibilities on banks to demonstrate through written policies and procedures that they are taking precautions when opening commercial accounts that may operate as illegal Internet gambling entities (casinos). If illegal Internet casinos are denied the opportunity to open a bank account, they will be denied the opportunity to make and receive payments. It also requires that banks have policies and procedures that would prevent credit and debit card transactions from being made to Internet casinos for unlawful Internet gambling by any of its customers, including individual, non-commercial account holders. For these card transactions, banks may rely on the policies and procedures established by the card networks and do not have to create a separate process.
Does my bank have to monitor my customers' accounts to make sure that they are not gambling illegally on the Internet?
No. Your bank must "...establish and implement written policies and procedures reasonably designed to identify and block or otherwise prevent or prohibit restricted transactions." Under the final rule this means:
1. Your bank must establish written policies and procedures to screen unlawful Internet gambling businesses (casinos) from opening an account at your bank. Lawful Internet gambling businesses will be required to provide extensive documentation at account opening. Robust written policies and procedures will allow your bank to meet the Final Rule's requirements. The Final Rule focuses on screening for unlawful Internet gambling businesses at the time of account opening. If unlawful Internet gambling businesses are prevented from accessing the banking system, then they will not be able to make or receive payments using checks, wires, or ACH payments.
2. Your bank is not required to monitor or determine whether its customer is a gambler except that it must ensure that unlawful credit and debit card transactions are blocked. It is the responsibility of the card network to establish policies and procedures to identify and block unlawful transactions. The bank may rely on a written notice from the network (****/**********) stating that the policies and procedures that are in place meet the UIGEA Final Rule requirements. Banks are not required to validate this claim. The networks may meet this threshold by conducting suitable due diligence checks on commercial accounts or through establishing a code system that would allow card issuers to identify and deny transactions that may be restricted.
3. Your bank is not required to block ACH, wire, or check payments related to unlawful Internet gambling to be in compliance with the Final Rule.
How will my bank know which transactions to block if there is no definition of "unlawful Internet gambling" included in the Final Rule?
Your bank is not required to block ACH, wire, or check payments related to unlawful Internet gambling to be in compliance with the Final Rule. Your bank will be allowed to rely on the policies and procedures established by the card networks to block restricted debit and credit card transactions. In other words, if your customer is the gambler, you do not have to block gambling transactions except for debit and credit card transactions. In those cases, you may rely on the network policies and procedures and merchant codes.
The Final Rule requires that banks establish procedures during the account opening process to identify commercial accounts that conduct Internet gambling business. It is the responsibility of the commercial account applicant to provide documentation that its online gambling business is lawful as per State or tribal law. Banks will not be required to make blocking decisions on individual transactions.
What if the card networks' policies and procedures to prohibit restricted transactions aren't effective?
Your bank is allowed to rely on the certification of the payment system operator that it is in compliance. The Agencies expect that federal regulators will examine the payment systems for compliance purposes.
How will my bank know which transactions to block if there is no list of unlawful Internet gambling entities to screen payments against?
Your bank is not required to compare and or block transactions against a government created list of Internet gambling entities. The Agencies decided that creating such a list would not be practical because of the difficulty in interpreting different state and federal laws on Internet gambling. The Agencies also recognized the obstacles presented if banks were asked to monitor and/or block transactions in real time. Instead, the Final Rule relies on the account opening screening process to identify commercial customers who may pose a risk of conducting Internet gambling business as casinos. If unlawful Internet gambling businesses are prevented from opening an account, then they will be prohibited from conducting restricted transactions.
Does my bank need to perform due diligence on existing individual or commercial accounts?
No. However, your bank's policies and procedures should reflect the requirement to notify its commercial customers that "restricted transactions" are prohibited from being transacted through the account.
Does my bank have to redesign all of its account opening documentation to demonstrate how applicants are screened according to the UIGEA Final Rule?
The focus of the Final Rule falls on commercial customer accounts. Your bank's policies and procedures should be able to demonstrate that the following steps have been taken during the account opening process. This due diligence can be performed in conjunction with existing account opening processes that are already required with the Bank Secrecy Act. The Final Rule
does not require a separate set of questions be asked of new applicants.
1. Determine whether the account is for an individual or commercial customer.
2. For accounts determined to be for individuals, no further steps are required.
3. For commercial accounts where the bank determines there is "minimal risk" of it being an Internet casino, no further steps are required.
4. For commercial accounts where it can't be immediately determined that there is "minimal risk" the applicant that does not operate as an Internet casino should certify that they do not engage in Internet gambling business. For those that certify this, no further steps are required.
5. For commercial accounts that do engage in Internet gambling business, they must provide evidence of their legal authority to do so, or a legal opinion, and, a third party certification of its age and location verification procedures (to ensure that restrictions on minors and geographic legalities are observed). This step places the burden of proving that that the Internet gambling entity is operating legally on the casino itself and its governing authorities.
How will the Final Rule affect my bank's foreign correspondent relationships?
Your bank will be expected to conduct an appropriate risk-based due diligence when establishing a foreign correspondent relationship. Your bank will NOT be required to conduct due diligence of commercial customers of the foreign correspondent.
The Final Rule will only apply to cross-border debits (ACH debits and check collections). If your bank is informed by a U.S. government entity (law enforcement agency or a regulator) that a foreign correspondent has sent your bank a restricted transaction, your bank will be expected to provide notice to that correspondent. A sample model notice is included with the Final Rule.
What should my bank do if it suspects or obtains "actual knowledge" an individual customer is using their account to place bets?
Transactions conducted by individuals are not subject to the Final Rule. However, nothing in the Final Rule changes your bank's obligation to file suspicious activity reports if you suspect a customer's behavior is suspicious.
What should my bank do if it suspects or obtains "actual knowledge" a commercial account is being used as an Internet gambling business?
Your bank's written policies and procedures should describe what steps your bank will take when it has "actual knowledge" that one of your commercial customers is participating in restricted transactions. Your bank should use its own judgment as to when a customer would benefit from counseling on their infraction or if it were more appropriate to deny a customer access to a payment system or even to close the account. The Final Rule's drafters expect each bank's regulators to review each of these situations and assess whether the remedial action that was taken was appropriate.
The "actual knowledge" standard is met when a particular fact with regard to a commercial customer is known by or brought to the attention of an individual responsible for compliance functions at your bank or an officer of the organization.
Nothing in the Final Rule changes your bank's obligations to file suspicious activity reports. What are my bank's obligations under this Final Rule when third party processors are involved in transactions?
For the purposes of the Final Rule, third party processors are defined as entities that have the direct relationship with commercial customers, not the bank. The third party processors act as intermediaries between your bank and the commercial customer. The third party processors have the direct relationship with the commercial customer, not your bank, so they are obligated to perform the required due diligence.
If your bank has hired a third party processor to facilitate payments on behalf of commercial customers that your bank has a direct relationship with, then your bank is obligated to perform the due diligence.
What liabilities does the Final Rule place on my bank if it inadvertently blocks a legitimate transaction?
The Final Rule provides liability protection if the blocked payment is:
1. A restricted transaction,
2. Reasonably believed to be a restricted transaction, or
3. Blocked per the established policies and procedures of a payments system (****/**********).
My bank has an established policy of not processing ANY gambling related transactions. Will this Final Rule force us to conduct transactions that we block today?
No. The Agencies do not believe that the UIGEA grants the authority to force a bank to process a payment that it currently blocks. If a bank has chosen to block all gambling transactions, for example, due to increased default risks, then they may continue to implement this 'business decision."
