As we previously blogged, a Florida law (Fla. Stat. § 655.0323, entitled “Unsafe and unsound practices”) which became effective July 1, 2024 prohibits federal and state depository institutions conducting business in the state from denying services based on religion or political beliefs and activities. Every year, financial institutions must attest to their compliance with the Florida law. When he signed the bill into law, Governor Ron DeSantis said, “We are not going to allow big banks to discriminate based on someone’s political or religious beliefs, and we will continue to fight back against indoctrination in education and the workplace.”
As we will discuss, the Florida law also prohibits a financial institution acting on the basis of “any factor if it is not a quantitative, impartial, and risk-based standard, including any such factor related to the person’s business sector[.]” This prohibition in particular creates a clear challenge for implementing an anti-money laundering/countering the financing of terrorism (“AML/CFT”) compliance program, which inherently involves subjective judgments and an assessment of the risk presented by a customer based on its line of business. The problematic implications of the Florida law did not go unnoticed by the U.S. Congress or the U.S. Department of the Treasury (“Treasury”).
The Florida Law
The Florida law creates a new “unsafe and unsound practice” that prohibits federal and out-of-state financial institutions from “denying or canceling financial services to a person, or otherwise discriminating against a person in making available such services or in the terms or conditions of such services” on the basis of a person’s political opinions, speech, or affiliations; religious beliefs, religious exercise, or religious affiliations.
Most problematic for the purposes of an effective AML/CFT compliance program, the law also prohibits a financial institution acting on the basis of “any factor if it is not a quantitative, impartial, and risk-based standard, including any such factor related to the person’s business sector[.]” Although the Bank Secrecy Act requires an AML/CFT program to be “risk-based,” it is difficult to discern how the Florida law requirements for a “quantitative” and “impartial” standard will play out, because decisions regarding AML/CFT risks necessarily occur in a gray zone based on the particular circumstances, subjective judgment, the expectations of federal regulators, and a financial institution’s risk appetite. Notably, a customer’s business sector is always a critical factor in any AML/CFT program.
The law further prohibits the use of “any rating, scoring, analysis, tabulation, or action that considers a social credit score based on factors,” including, but not limited to a person’s: political opinions or affiliations; religious beliefs; lawful ownership of a firearm; engagement in the lawful manufacture, distribution, sale, or use of firearms; engagement in the exploration, production, utilization, transportation, sale, or manufacture of fossil fuel-based energy, timber, mining, or agriculture; support of a state or federal government in combatting illegal immigration, drug trafficking, or human trafficking; and any related advocacy of the foregoing.
The law also creates a process for customers who suspect there has been a violation to file a complaint with the Florida Office of Financial Regulation (OFR). The customer must file that complaint within 30 days and the OFR is required to notify the financial institution, which then has 90 days to respond. The OFR is required to start its investigation within 90 days of receiving the complaint and to create a report of its findings within 30 days after the completion of its investigation. OFR is required to send a report to the customer and financial institution within 45 days after the completion of the investigation. If OFR finds a violation, the office is required to notify the state Department of Financial Services, as well as the Florida Attorney General.
A financial institution may be fined if it is found to have violated the law and it may be deemed to have violated the Florida Deceptive and Unfair Trade Practices Act, which also provides for sanctions and penalties. The law also creates a process for customers who suspect there has been a violation to file a complaint with the Florida Office of Financial Regulation (OFR). The defined complaint process seems to indicate that financial institutions will share with the OFR action taken in conjunction with the decision to file a Suspicious Activity Report (“SAR”), even though any such sharing would violate federal law. For example, a national bank regulated by the Office of the Comptroller of the Currency (OCC) is subject to regulations which prohibit banks from disclosing a SAR or the decision to file or not file a SAR to anyone outside of the bank, other than the OCC, FinCEN, or any Federal, State, or local law enforcement agency. The OFR is a state regulator and is not a “law enforcement agency.”
Historically, when financial institutions “de-risk” – i.e., reject or close accounts – customers due to AML/CFT concerns, they can rely on their customer agreements, which typically grant the financial institution total discretion. It is very difficult for a customer to successfully challenge being de-risked. Further, the decision-making process is confidential, and can involve the decision to file a SAR, as noted above. Financial institutions also often de-risk certain customers because they fear consequences from their federal regulator if they do not. The Florida law undermines these banking AML/CFT de-risking practices.
The Concerns
On July 8, 2024, U.S. Congressmen Josh Gottheimer (D-NJ), Blaine Luetkemeyer (R-MO), and Brad Sherman (D-CA) wrote Treasury, the Office of the Comptroller of the Currency and the Financial Crimes Enforcement Network to express their concerns regarding “the ongoing challenges to the federal anti-money laundering and terrorist framework and to urge you to continue defending these critical components of the financial system.” The Congressmen stated that recently enacted state laws, like the Florida law, may create conflicts for financial institutions that must comply with federal AML/CFT laws and jeopardize the confidentiality of SARs.
They expressed:
Weakening these confidentiality practices could expose banks’ processes for detecting suspicious activity and financial crimes. Even more concerningly, these disclosures could tip off suspects to the fact that they are under investigation or guide bad actors — including terrorists, financial criminals, and hackers — on how to change their behavior to avoid detection. We cannot allow state laws to supersede well-trodden federal norms regarding SAR secrecy and potentially endanger our national security or economic stability.
On July 18, 2024, Brian Nelson, Treasury’s Undersecretary for Terrorism and Financial Intelligence, responded to the Congressmen’s letter indicating that the Treasury shares the concerns that Florida’s law could undermine financial institutions’ compliance with anti-money laundering and countering the financing of terrorism laws and national security requirements.
He stated:
Bad actors seek to exploit weaknesses in our financial system, and our ability to stop them depends on assessments of risk-based factors including the services sought by a customer, the locations where the customer transacts business, and the particular bank’s ability to manage risks effectively. By prohibiting the consideration of any factor that is not “quantitative,” these state laws could prevent banks from considering these types of qualitative factors and discourage their efforts to appropriately identify and address risks.
. . . . For example, it is unclear whether the prohibition [in Florida’s law] on considering a customer’s “affiliations” allows banks to assess a customer’s association with a designated terrorist group—a fact clearly relevant to risk-based assessments under the BSA and U.S. sanctions laws. Similarly, because the law prohibits banks from considering factors “related to the person’s business sector,” some institutions may believe they should disregard whether certain sectors—such as the international trade in goods critical to Russia’s war effort or the manufacture and sale of fentanyl precursor chemicals—are significantly higher-risk than others. Finally, by generally requiring state regulators to issue investigative reports following complaints of account closures or restrictions directly to the individuals who submitted them, state laws risk disclosing sensitive information regarding suspicious activity reports (SARs), which must be kept confidential under federal law. Even a redacted investigative report may implicitly reveal that a SAR has been filed, potentially tipping off terrorists, criminals, and others who would do our country harm.
Other Issues
Fines and penalties for noncompliance apply and a financial institution violating the law may also be deemed to have violated the Florida Deceptive and Unfair Trade Practices Act, which also provides for sanctions and penalties. Plus, if the Attorney General successfully sues the institution, the law provides for the recovery of attorney’s fees and costs as well. Florida state officials said that financial institutions that are not clear about the applicability of the law must file a petition for a declaratory statement with the state Office of Financial Regulation. The Florida law also will encourage de-risked customers – including those who were appropriately de-risked – to pursue lawsuits.
There are many thorny issues on the horizon. It is unclear if the law applies to an out-of-state financial institution with customers in Florida but with no physical presence in the state. It also is not clear whether any customer may file a complaint, or if the customer must be a Florida resident. Presumably, national banks will need to complete a federal preemption analysis with respect to the Florida law.
[View source.]
