In a move long requested by the industry, on January 4, 2017, the US Financial Crimes Enforcement Network (“FinCEN”) released guidance (the “Guidance”) to “confirm” that a casino may share a suspicious activity report (“SAR”) or any information that would reveal the existence of a SAR with (i) a US parent company or (ii) a US affiliate that is also subject to a SAR filing requirement under the Bank Secrecy Act (“BSA”).1 FinCEN cited as reasons for the Guidance a casino organization’s need to manage enterprise-wide risk, as well as the enhancement of the anti-money laundering efforts of the casino’s parent or affiliate.
These benefits are limited to the United States; the Guidance specifically prohibits a casino from sharing a SAR with offices or other places of business of the casino’s parent or the casino’s affiliate that are located outside the United States. This limitation is more restrictive than similar guidance for non-US banks, which permits the US operations of a non-US-based bank to share SAR information with non-US head offices and controlling companies.2 For global corporations owning casinos in multiple countries, the Guidance would not permit sharing information about a potentially suspicious customer or questionable customer practices throughout the entire organization. In the past, FinCEN has taken the position that concerns over potentially unauthorized disclosure take precedence over the value such information could have to a global firm’s AML program.3
Generally, the Guidance is in line with the SAR-sharing guidance that has been issued for depository institutions: casinos may only share SAR information with affiliates that are also financial institutions under the BSA and subject to SAR filing obligations.4 A US affiliate of a casino may not further share a SAR with an affiliate of its own, even if that affiliate is subject to SAR-filing obligations. However, the Guidance lists several additional limitations to a casino’s ability to share SARs, or information that would reveal the existence of a SAR, with a US parent or affiliate, including a prohibition on sharing SAR information with:
- Persons within a parent’s or a casino’s organizational structure who perform functions unrelated to gaming, such as shops, restaurants, entertainment and hotels;
- Any financial institution affiliate without an independent SAR-filing obligation (such as check cashers); or
- A money services business that is located within a casino but is not an affiliate of the casino.
2 Interagency Guidance on Sharing Suspicious Activity Reports with Head Offices and Controlling Companies, issued by FinCEN, Federal Reserve, FDIC, OCC, and OTS (Jan. 20, 2006). In the 2006 guidance, FinCEN defined “control.” In this Guidance, a “parent” is defined as any entity that controls the casino filing the SAR. “Control” is not defined.
3 See Financial Crimes Enforcement Network; Confidentiality of Suspicious Activity Reports, 75 Fed. Reg. 75593, 75599 (Dec. 3, 2010).
4 Sharing Suspicious Activity Reports by Depository Institutions with Certain U.S. Affiliates, issued by FinCEN, FIN-2010-G006 (Nov. 23, 2010). The Guidance defines an “affiliate” as a financial institution that is required under rules implementing the BSA to report suspicious transactions and that is controlled by, or is under common control with, the casino filing the SAR. Unlike the 2010 guidance for depository institutions, “controlled by” and “under common control” are not defined.