Please refer to Docket ID NRC-2017-0227 when contacting the NRC about the availability of information for this action. You may obtain publicly available information related to this action by any of the following methods:

• Federal Rulemaking Website: Go to https://www.regulations.gov and search for Docket ID NRC-2017-0227.

• NRC's Agencywide Documents Access and Management System (ADAMS): You may obtain publicly-available documents online in the ADAMS Public Documents collection at https://www.nrc.gov/reading-rm/adams.html. To begin the search, select “Begin Web-based ADAMS Search.” For problems with ADAMS, please contact the NRC's Public Document Room (PDR) reference staff at 1-800-397-4209, 301-415-4737, or by email to PDR.Resource@nrc.gov. For the convenience of the reader, instructions about obtaining materials referenced in this document are provided in the “Availability of Documents” section of this document.

• NRC's PDR: You may examine and purchase copies of public documents, by appointment, at the NRC's PDR, Room P1 B35, One White Flint North, 11555 Rockville Pike, Rockville, Maryland 20852. To make an appointment to visit the PDR, please send an email to PDR.Resource@nrc.gov or call 1-800-397-4209 or 301-415-4737, between 8 a.m. and 4 p.m. eastern time, Monday through Friday, except Federal holidays.

The NRC encourages electronic comment submission through the Federal rulemaking website ( https://www.regulations.gov ). Please include Docket ID NRC-2017-0227 in your comment submission.

The NRC cautions you not to include identifying or contact information that you do not want to be publicly disclosed in your comment submission. The NRC will post all comment submissions at https://www.regulations.gov as well as enter the comment submissions into ADAMS. The NRC does not routinely edit comment submissions to remove identifying or contact information.

If you are requesting or aggregating comments from other persons for submission to the NRC, then you should inform those persons not to include identifying or contact information that they do not want to be publicly disclosed in their comment submission. Your request should state that the NRC does not routinely edit comment submissions to remove such information before making the comment submissions available to the public or entering the comment into ADAMS.

The NRC has established physical security requirements for the protection of production and utilization facilities licensed under 10 CFR part 50, “Domestic Licensing of Production and Utilization Facilities,” or 10 CFR part 52, “Licenses, Certifications, and Approvals for Nuclear Power Plants.” The NRC requires these licensees to design, implement, and maintain a physical protection program that provides high assurance  1 that operation of the facility is not inimical to the common defense and security and does not constitute an unreasonable risk to the public health and safety. To satisfy this performance objective, a licensee's physical protection program must protect against the design-basis threat (DBT) of radiological sabotage as set forth in § 73.1 of title 10 of the Code of Federal Regulations (10 CFR), “Purpose and scope.” The physical security requirements that a licensee must implement to protect against the DBT of radiological sabotage are primarily set forth in 10 CFR part 73, “Physical Protection of Plants and Materials.” The Commission-approved DBT describes the type, composition, and capabilities of an adversary that a licensee can reasonably be expected to defend against. Development of the DBT is based on threat assessments of the tactics, techniques, and procedures used by international and domestic terrorist groups and organizations.

The physical security requirements for the protection of nuclear power reactors against the DBT of radiological sabotage can be found in § 73.55, “Requirements for physical protection of licensed activities in nuclear power reactors against radiological sabotage.” These requirements contain a mixture of performance-based and prescriptive security requirements that provide applicants and licensees with the flexibility to determine how to meet the established performance objective.

The focus of this proposed rule is on the physical security requirements related to protection against radiological sabotage for advanced reactors. The term “advanced reactors,” as used in this document, refers to nuclear power reactors that are non-light-water reactors (non-LWRs) or small modular reactors (SMRs) as SMR is defined in § 171.5, “Definitions.”

The current physical protection program for power reactors is designed to protect the plant features needed to provide fundamental safety functions, such as maintaining reactor core cooling to prevent significant core damage from the DBT of radiological sabotage. The loss of plant features providing these safety functions can lead to damage of a reactor core or spent nuclear fuel sabotage, with a potential subsequent release of radioactive materials. When compared to operating large LWRs, many of the advanced reactor designs have smaller power outputs and a correspondingly smaller inventory of fission products available for potential release. In comparison to large LWRs, some advanced reactor designs may include attributes that could result in smaller and slower releases of fission products following the loss of certain safety functions. Accordingly, some designs may warrant different methods for meeting the NRC's physical security requirements, commensurate with the potential radiological consequences resulting from radiological sabotage.

Concurrent with large LWR deployment and design evolution, nuclear power reactor vendors have developed several different reactor designs that are either light-water SMRs with passive safety features or reactors that do not use light water as a coolant. This latter category is commonly referred to as non-LWR technology. Advanced reactor designs using non-LWR technology include liquid metal-cooled reactors, gas-cooled reactors, and molten-salt-cooled reactors. These advanced reactor designs could have rated thermal power outputs that range from low to very high and may apply modular construction concepts.

As advanced reactor designs evolved in the 1980s and early 1990s, the NRC considered the need for a revised regulatory regime specifically for these emerging technologies. The NRC issued its “Policy Statement on the Regulation of Advanced Nuclear Power Plants” on July 8, 1986 (51 FR 24643), to provide the Commission's policy regarding the review of, and desired characteristics associated with, advanced reactors. In this policy statement, the NRC identified attributes that developers should consider in advanced designs, including safety features that are highly reliable, the use of the defense-in-depth philosophy of maintaining multiple barriers against radiation release, and, as compared to large LWRs, less-complex heat removal systems, longer time constants before reaching safety system challenges, and reduced potential for severe accidents and their consequences.

On October 14, 2008, the NRC issued a revised “Policy Statement on the Regulation of Advanced Reactors” (73 FR 60612), describing attributes that should be considered in advanced designs to establish the acceptability or licensability of such designs, including designs that include considerations for safety and security requirements together in the design process such that security issues ( e.g., newly identified threats of terrorist attacks) can be effectively resolved through facility design and engineered security features, and formulation of mitigation measures, with reduced reliance on human actions. The Commission also observed that it will be in the interest of the public as well as the design vendors and the prospective license applicants to address security issues early in the design stage to achieve a more robust and effective security posture for future nuclear power reactors.

Later, in SECY-10-0034, “Potential Policy, Licensing, and Key Technical Issues for Small Modular Nuclear Reactor Designs,” dated March 28, 2010, the NRC identified potential issues for SMRs based on the preliminary design information supplied in pre-application interactions and discussions with SMR designers and the U.S. Department of Energy (DOE). The NRC noted that establishing physical security requirements and guidance for SMRs and non-LWRs was a key policy issue of high importance.

In SECY-11-0184, “Security Regulatory Framework for Certifying, Approving, and Licensing Small Modular Nuclear Reactors (M110329),” dated December 29, 2011, the NRC staff reported that the current security regulatory framework is adequate for SMRs, including related elements of the nuclear fuel cycle. In the case of non-LWRs, the staff's assessment of the suitability of the current security regulatory framework was based on the limited information that was available at the time on reactor and fuel designs and operations of these technologies. Based on this information, the staff stated that it was not aware of any area in which the existing security regulatory framework would not apply to non-LWRs and that the staff would continue to assess the suitability and adequacy of the security and material control and accountability requirements for proposed non-LWR technologies in order to identify any regulatory gaps and potential technical or policy issues pertaining to certifying, approving, or licensing non-LWR technologies.

The staff also indicated in SECY-11-0184 that the alternative measures provision in § 73.55(r), “Alternative measures,” allows SMR and non-LWR designers and potential applicants to propose alternative methods or approaches that provide a level of protection that is at least equal to that which would otherwise be provided by the specific security requirement in § 73.55 for which an alternative measure is being proposed. These alternative methods or approaches may include increased reliance on engineered systems that reduce the need to rely on operational requirements and staffing to meet regulatory requirements.

Since the issuance of SECY-11-0184, discussions with external stakeholders and within the NRC have turned to whether some type of generic regulatory action would be preferable to the case-by-case approach described in SECY-11-0184. Reactor designers and other stakeholders have raised concerns that the current prescriptive physical security requirements could impose unnecessary regulatory burden for SMRs and non-LWRs that is not commensurate with the risks posed by some of these designs. In response, the NRC assessed potential regulatory changes that would modify existing physical security requirements to make them commensurate with the risks associated with advanced reactor designs. In proposing revisions to physical security requirements for advanced reactors, the NRC considered the inherent features of many advanced reactor designs, such as lower fission product inventories and longer thermal time constants, as well as safety and security features that could be incorporated into facility designs. As discussed previously, these types of attributes and design features have been mentioned in the Commission's Policy Statement to reduce reliance on human actions in responding to attempted acts of radiological sabotage. Initial interactions with the public related to a possible rulemaking involved meetings on the Nuclear Energy Institute (NEI) white paper, “Proposed Physical Security Requirements for Advanced Reactor Technologies,” dated December 14, 2016. The NEI white paper suggested consequence-oriented criteria for determining when an advanced reactor design would be a candidate for alternative physical security requirements. The NRC subsequently prepared a draft white paper on potential changes to the physical security requirements for advanced reactors in November 2017.

On August 1, 2018, the staff submitted SECY-18-0076, “Options and Recommendation for Physical Security for Advanced Reactors,” presenting alternatives and a recommendation to the Commission on possible changes to the regulations and guidance related to physical security for advanced reactors. The staff evaluated the advantages and disadvantages of each alternative and recommended a limited-scope rulemaking to further assess and, if appropriate, develop a limited set of alternative security requirements that licensees of certain advanced reactor designs could implement. The staff also recommended developing necessary guidance to address performance criteria used to determine an advanced reactor applicant's eligibility for using one or more of the alternative physical security requirements. In SRM-SECY-18-0076, dated November 19, 2018, the Commission approved the staff's recommendation to initiate a limited-scope rulemaking and to interact with stakeholders to identify specific requirements within existing regulations that would play a diminished role in providing physical security for advanced reactors while at the same time contributing significantly to capital and/or operating costs. The Commission also directed the staff to use exemptions until the final rule is implemented.

In response to SRM-SECY-18-0076, on July 16, 2019, the NRC published a Federal Register notice of the issuance of the regulatory basis for this rulemaking, “Regulatory Basis for the Physical Security of Advanced Reactors,” for a 30-day public comment period. The regulatory basis summarized the current physical security framework for protecting large LWRs against radiological sabotage, described regulatory issues that have motivated the NRC to pursue rulemaking, evaluated various alternatives to address physical security for advanced reactors, and identified the background documents related to these issues. In the Federal Register notice that issued the regulatory basis, the NRC requested feedback from the public on specific questions related to the eligibility criterion (referred to as “performance criteria” in the regulatory basis), offsite licensee response approach, and cumulative effects of regulation (CER).

On April 28, 2022, during the NRC's internal review of this proposed rule, a staff member from the NRC's Office of Nuclear Security and Incident Response submitted a formal non-concurrence. This NCP, identified as NCP-2022-003, was reviewed and closed without requiring changes to the proposed rule.

The public comment period closed on August 15, 2019, and the NRC received nine comment letters from six commenters, including three members of the public, one non-governmental organization, one potential NRC applicant, and one industry group. The letters provided various points of view; suggestions for clarifications, additions, and deletions; and comments outside the scope of this rulemaking. In general, the industry group commenter and the potential NRC applicant expressed support for the concept of alternative physical security requirements for advanced reactors, while the public and non-governmental organization commenters did not support the potential alternatives discussed in the regulatory basis document.

The public comment documents are available as indicated in the “Availability of Documents” section of this document. As stated in the Federal Register notice that issued the regulatory basis, the NRC is not providing formal written responses to the comments received on the regulatory basis.

As a result of SRM-SECY-18-0076, and in consideration of the public comments received on the regulatory basis, the NRC is proposing this limited-scope rule to provide a clear set of alternative performance-based physical security requirements for advanced reactors licensed under 10 CFR part 50 or 10 CFR part 52. This proposed rule would reduce the need for advanced reactor applicants and licensees to request alternative measures or exemptions from current physical security requirements. This proposed rule also would provide benefits for advanced reactor applicants by establishing greater regulatory stability, predictability, and clarity in the licensing process while maintaining a level of security commensurate with the risk associated with these facilities.

The NRC engaged with stakeholders throughout the development of the proposed rule by holding public meetings, issuing draft versions of preliminary proposed rule language, and requesting public feedback. These interactions included discussions on the draft regulatory guidance. The following table shows the public interactions conducted during the proposed rule development.

This proposed rule would establish certain risk-informed and performance-based alternative physical security requirements that eligible advanced reactor applicants and licensees could elect to implement. The physical security requirements under § 73.55 for which alternative security requirements have not been developed would remain in effect and applicable to SMR and non-LWR power reactors.

This proposed rule does not include alternatives for large LWRs, fuel cycle facilities, or non-power production and utilization facilities. Large LWRs were not included in the scope of this proposed rule because a physical security regulatory framework and provisions for requesting alternative measures already exist for those reactors under § 73.55(r). Additionally, licensees for existing large LWRs have not requested changes to the existing physical protection program to adopt the proposed consequence-based alternatives. The current fleet of operating nuclear power reactors, consisting entirely of large LWRs, would continue to be regulated by the current established framework for physical security in § 73.55 and appendices B and C to 10 CFR part 73.

Fuel cycle facilities and non-power production and utilization facilities are not subject to 10 CFR 73.55 and therefore were not included in the scope of this proposed rule.

In accordance with the rulemaking plan approved by the Commission in SRM-SECY-18-0076, this limited-scope proposed rule would retain the current overall security framework in § 73.55 to protect against radiological sabotage. This proposed rule would create specific voluntary, risk-informed, and performance-based alternative physical security requirements for SMR and non-LWR power reactors licensed under 10 CFR part 50 or 10 CFR part 52. These alternative physical security requirements would (1) enhance regulatory effectiveness by providing greater stability, predictability, and clarity in the licensing process for implementing physical security for advanced reactors; (2) reduce requests for exemptions from certain physical security requirements; (3) consider technological advancements in reactor designs and their associated design features impacting the possible loss of safety functions from malicious acts and any resulting consequences; and (4) provide alternatives for meeting certain physical security requirements under § 73.55 commensurate with the potentially lower risks posed by advanced reactors.

The current fleet of large LWRs protects against the DBT of radiological sabotage by preventing significant core damage and spent fuel sabotage. However, this requirement may not be appropriate for all SMRs or non-LWRs. Accordingly, this proposed rule would add a new technology-inclusive requirement for advanced reactors to protect against the DBT of radiological sabotage. This new provision would require that an advanced reactor licensee's physical protection program be designed to prevent a significant release of radionuclides from any source. The proposed rule would establish certain alternative physical security requirements available to those advanced reactor applicants and licensees who can meet this performance standard and the proposed eligibility criterion. The proposed eligibility criterion would be based on demonstrating that the consequences of a postulated radiological release are below prescribed dose reference values.

There are differences between non-LWR and SMR designs, and large LWR designs. These include potentially smaller reactor core sizes, lower power densities, lower probability of severe accidents, slower accident progression, different source term characteristics, and smaller offsite consequences of accidents. These differences have led DOE, designers, potential operators, and the NRC to examine the physical security requirements necessary to safely operate such advanced reactors.

The NRC anticipates that some advanced reactor vendors and applicants may design their facilities and site protective strategy to account for reliance on passive features, active engineered systems, and automation to achieve security functions with less reliance on human actions. Based on these design features, advanced reactor applicants may seek alternative measures for achieving security functions that differ substantially from the approach at the existing fleet of large LWRs. Without this proposed rule, applicants for or holders of advanced reactor licenses likely would request alternative measures or exemptions from certain physical security requirements. This is because the current regulatory framework does not establish alternative requirements for varying types and sizes of advanced reactors and an eligibility criterion authorizing these applicants to use alternative requirements.

This proposed rule would establish voluntary alternatives to certain prescriptive physical security requirements under § 73.55 for advanced reactor licensees. These alternative physical security requirements would continue to provide high assurance of adequate protection in the event of a security-initiated event. Although the exemption process could also result in relief from requirements that may not be necessary for a specific applicant or licensee, regulating by exemption generally provides less opportunity for public engagement and can lead to less regulatory certainty and increased costs for the NRC and the applicant or licensee. Proceeding by rulemaking rather than exemptions therefore supports the NRC's principles of good regulation, including openness, clarity, and reliability.

Although not specific to the scope of this rulemaking, the NRC is proposing to remove the requirements under paragraph (a)(5) of § 73.55 that relate to the Tennessee Valley Authority's Watts Bar Nuclear Plant, Unit 2 as a construction permit holder. This paragraph is no longer necessary as the Tennessee Valley Authority now has an operating license for this facility and no longer holds a construction permit.

Currently, nuclear power reactors licensed under 10 CFR part 50 and 10 CFR part 52 must protect against the DBT of radiological sabotage. The existing fleet of large LWRs meets this objective by preventing significant core damage and spent fuel sabotage. This proposed rule would not change this requirement for large LWRs.

The NRC anticipates that many of the non-LWR designs will not have reactor cores similar to those of the existing fleet of LWRs. Therefore, the objective of preventing significant core damage may not be appropriate for these types of advanced reactors, although they would still need to protect against the DBT of radiological sabotage. Accordingly, this proposed rule would add a new technology-inclusive requirement to the introductory text of paragraph (b)(3) of § 73.55 to require that a non-LWR advanced reactor licensee's physical protection program be designed to prevent a significant release of radionuclides from any source.

Although SMRs are defined as LWRs for the purpose of this rule and may therefore have reactor cores similar to those of the existing fleet of LWRs, the NRC is proposing to apply this technology-inclusive requirement of preventing a significant release of radionuclides from any source to SMRs as well as to non-LWRs. While there would likely be differences between non-LWR and SMR designs, both types of designs could potentially result in smaller and slower releases of fission products following the loss of certain safety functions when compared to large LWRs.

In this context, the phrase “a significant release of radionuclides from any source” would encompass a postulated security-initiated event that would cause a release to the environment exceeding that analyzed in the design basis accident licensing basis. This would ensure that a licensee's physical protection program considers and protects against significant release from all areas with high radiological inventories, including reactor cores and spent fuel pools common to LWRs, as well as other physical locations with radiological inventories in non-LWR designs that need to be protected from a DBT adversary ( e.g., waste processing and storage systems).

The proposed rule would establish new § 73.55(s) to contain the alternative physical security requirements, found in § 73.55(s)(2). These alternative physical security requirements could be used by advanced reactor applicants and licensees who meet the proposed general requirements in § 73.55(s)(1).

Proposed § 73.55(s)(1)(i) would establish that an applicant for or holder of a license for an advanced reactor under 10 CFR part 50 or 10 CFR part 52 may elect one or more of the alternative physical security requirements specified in proposed § 73.55(s)(2).

Proposed § 73.55(s)(1)(ii) would establish that, to be eligible to use the alternative physical security requirements in § 73.55(s)(2), the applicant or licensee must demonstrate that the consequences of a postulated radiological release that results from a postulated security-initiated event do not exceed the offsite dose reference values defined in §§ 50.34, “Contents of applications; technical information,” and 52.79, “Contents of applications; technical information in final safety analysis report.”

Proposed § 73.55(s)(1)(iii) would establish that the applicant or licensee must identify the specific alternative physical security requirement(s) it intends to implement as part of its physical protection program and demonstrate how the requirements set forth in § 73.55 are met when the selected alternatives are used. The applicant or licensee would be free to choose any combination of the proposed physical security alternatives under proposed § 73.55(s)(2). The applicant or licensee would not be required to elect all of the alternatives, nor would it be restricted to only invoking a single alternative.

Proposed § 73.55(s)(1)(iv) would require that an applicant or licensee perform a technical analysis to evaluate the potential offsite radiological consequences from a postulated security-initiated event to demonstrate eligibility to use the alternative physical security requirements. The technical analysis would not need to be submitted to the NRC for review and approval but would be subject to audit or inspection. This proposed provision also would require the licensee to maintain the analysis until the submittal of the licensee's certifications for permanent cessation of operations and permanent removal of fuel from the reactor vessel required by § 50.82(a)(1) or § 52.110(a).

This proposed rule would provide new physical security requirements, in proposed § 73.55(s)(2), that are voluntary alternatives to selected existing requirements in § 73.55 for an applicant or licensee satisfying the provisions of proposed § 73.55(s)(1). The proposed requirements in § 73.55(s)(2) would include alternatives for armed responders, interdiction and neutralization, physical barriers, onsite secondary alarm stations, and vital areas that would provide flexibility in how applicants and licensees would design their physical protection program to meet the requirements of proposed § 73.55(b)(3) for protecting against the DBT of radiological sabotage. These proposed alternative physical security requirements are intended to provide greater regulatory stability, predictability, and clarity in the licensing process, reduce the need for applicant or licensee requests for exemptions or alternatives to current physical security requirements, and reduce resources that would otherwise be required to review specific exemptions in accordance with the provisions of § 73.5, “Specific exemptions,” or alternative measures under the provisions of § 73.55(r), “Alternative measures.”

The proposed physical security alternative in § 73.55(s)(2)(i) would permit a licensee to be relieved from the current requirement for the minimum number of armed responders in § 73.55(k)(5)(ii). Under this proposal, a licensee would be permitted to design a physical protection program that potentially could have fewer than ten onsite armed responders, including no onsite armed responders, if appropriate. This alternative would give an advanced reactor licensee the flexibility to determine and use the number of onsite armed responders necessary to meet the requirements of proposed § 73.55(b)(3). The number of onsite armed responders may be reduced to zero if the licensee also implements the alternative requirements under proposed § 73.55(s)(2)(ii) that would allow the licensee to rely on law enforcement or other offsite armed responders to fulfill the interdiction and neutralization functions to protect against the DBT of radiological sabotage. Licensees would use existing methods, such as those currently used by operating reactor licensees, for determining the necessary number of onsite armed responders.

For an applicant or licensee that designs its physical protection system to rely on onsite armed responders to perform interdiction and neutralization to achieve the performance objective and requirements of § 73.55(b), “General performance objective and requirements,” the proposed physical security alternative only provides relief from the prescriptive requirement for the minimum number of armed responders; all other existing requirements associated with onsite armed personnel would continue to apply.

The proposed physical security alternative in § 73.55(s)(2)(ii) would permit a licensee, if appropriate, to rely on law enforcement or other offsite armed responders, rather than using onsite licensee security personnel, to fulfill the interdiction and neutralization functions required by § 73.55(b)(3)(i). Use of this alternative would be available only if a licensee were to have no onsite armed responders.

The current requirement in § 73.55(b)(3)(i) states that the physical security program must ensure that the capabilities to detect, assess, interdict, and neutralize threats, up to and including the DBT of radiological sabotage, are maintained at all times. An advanced reactor applicant or licensee that demonstrates it meets proposed § 73.55(s)(1) without relying on an onsite armed response force may use this alternate approach for meeting the requirements for the interdiction and neutralization capabilities required by § 73.55(b)(3)(i). Such an applicant or licensee may, under proposed § 73.55(s)(2)(ii), rely on law enforcement responders (local, State or Federal) or other offsite armed responders ( e.g., licensee proprietary or contract security personnel who are positioned offsite), rather than using onsite armed responders to fulfill the interdiction and neutralization capabilities required in § 73.55(b)(3)(i).

The proposed rule would not relieve a licensee from the responsibility to interdict and neutralize threats up to and including the DBT of radiological sabotage; rather, it would provide a licensee with an alternative method of fulfilling these responsibilities. Applicants and licensees relying on law enforcement responders to carry out the interdiction and neutralization capabilities would be relieved from the majority of the training and qualification requirements in appendix B, “General Criteria for Security Personnel,” to 10 CFR part 73, except for the performance evaluation program requirements in section VI.C.3. The proposed rule would not create any NRC regulatory jurisdiction over, or requirements for, law enforcement responders.

Associated requirements for security response personnel in current § 73.55(k)(3) through (7); § 73.55(k)(8)(ii); 10 CFR part 73, appendix B, section VI (except for section VI.C.3); and 10 CFR part 73, appendix C, section II.B.3.c.(iv) would not be applicable where a licensee's design of its physical protection system would require no armed responders onsite and the licensee would rely on law enforcement to fulfill the interdiction and neutralization functions required by § 73.55(b)(3)(i). For example, a licensee approved to implement the proposed alternative in § 73.55(s)(2)(ii) would be relieved from the requirement in § 73.55(k)(8)(ii) to initiate response actions to interdict and neutralize threats when relying on law enforcement to initiate the response actions to interdict and neutralize threats in accordance with the requirements of part 73, appendix C, section II, the safeguards contingency plan, and the licensee's response strategy. The licensee would continue to be required to detect and assess the threat and then communicate threat information to law enforcement.

The proposed requirements in § 73.55(s)(2)(ii)(A)( 1 ) through ( 5 ) would establish specific requirements to ensure that the use of law enforcement or other offsite armed responders to fulfill the interdiction and neutralization functions would still enable the licensee to protect against the DBT of radiological sabotage. Consistent with the existing regulatory framework in § 73.55, the requirement in proposed § 73.55(s)(2)(ii)(A)( 1 ) would reiterate a licensee's responsibility to detect, assess, interdict, and neutralize threats up to and including the DBT of radiological sabotage. As discussed below, allowing a licensee to rely on law enforcement responders to fulfill the interdiction and neutralization capability does not relieve the licensee of this responsibility and therefore remains consistent with the existing regulatory framework.

Proposed § 73.55(s)(2)(ii)(A)( 2 ) would establish that a licensee must provide adequate delay for threats up to and including the DBT of radiological sabotage to enable law enforcement or other armed responders located offsite sufficient time to respond to the site and to interdict and neutralize those threats. In other words, the cumulative delay time would need to be equal to or greater than the security bounding time for a specific SMR or non-LWR site. The proposed calculation methodology for security bounding time for SMR and non-LWR sites is contained in appendix C to DG-5072.

The proposed requirement in § 73.55(s)(2)(ii)(A)( 3 ) would require a licensee to provide necessary information about the site and make available periodic training to law enforcement or other offsite armed responders to support site-specific preparedness to fulfill the interdiction and neutralization functions in safeguards contingency events at the licensee's site ( i.e., within the owner controlled area, the protected area(s), vital areas, and other site facilities). Neither the NRC nor licensees can compel law enforcement to participate in the periodic training; however, the proposed requirements would ensure that licensees make the necessary information and training available to law enforcement.

The proposed requirement in § 73.55(s)(2)(ii)(A)( 4 ) would establish a requirement for a licensee relying on law enforcement or other offsite armed responders to fulfill the interdiction and neutralization functions to describe in its security contingency plan the role that law enforcement or the other offsite armed responders will play in the licensee's protective strategy. This would require a licensee to identify and plan for the role of law enforcement or other offsite armed responders in a safeguards contingency event. In accordance with the requirements of § 73.55(c)(5), a licensee shall establish, maintain, and implement a safeguards contingency plan that describes how the criteria set forth in appendix C, section II, to 10 CFR part 73 will be implemented. In applying this alternative, the licensee would address the role that law enforcement or other offsite armed responders would fulfill as a substitute for what would otherwise be the duty and responsibility of onsite armed responders associated with implementing contingency responses to safeguards events.

The proposed requirement of § 73.55(s)(2)(ii)(A)( 5 ) would establish that a licensee must identify criteria and measures to compensate for the degradation or absence of law enforcement or other offsite armed responders and propose suitable compensatory measures that meet the requirements of § 73.55(o)(2) and (3) to address this degradation. Unlike armed responders and armed security officers for currently operating power reactors, who are required by current regulations to be available at the site for response, a licensee that would rely upon law enforcement or other offsite armed responders must consider the potential that offsite response may be impeded by events outside of or independent from the safeguards event at the site. While the existing requirement in § 73.55(o), “Compensatory measures,” is specific to security systems and equipment performing required functions, the addition of the proposed alternative in § 73.55(s)(2)(ii) creates the new potential for degradation or unavailability of the personnel relied on to perform security functions such as interdiction and neutralization. The proposed requirement would rely on the requirements in § 73.55(o)(2) and (3) for establishing suitable compensatory measures to address degradation or loss of interdiction and neutralization functions.

A licensee would be relieved from the requirements in § 73.55(k)(3) through (7), § 73.55(k)(8)(ii), 10 CFR part 73, appendix B, section VI (except for section VI.C.3.), and 10 CFR part 73, appendix C, section II.B.3.c.(iv) with respect to law enforcement responders, when the licensee relies on the law enforcement responders to fulfill the interdiction and neutralization functions required by § 73.55(b)(3)(i). When an applicant or licensee relies on other offsite armed responders for interdiction and neutralization, the applicant or licensee would be relieved from the location-related requirements in § 73.55(k)(5)(iii) and 10 CFR part 73, appendix C, section II.B.3.c.(iv), because the armed responders would be housed outside a facility's protected area. One requirement from which a licensee would not be relieved would be the performance evaluation program requirements related to armed response personnel in 10 CFR part 73, appendix B, section VI.C.3. A licensee would be required to satisfy these performance evaluation program requirements for all armed response personnel, including law enforcement. The performance evaluation program requirements would continue to apply because implementation of the performance evaluation program provides assurance of the effectiveness of the requirements proposed in § 73.55(s)(2)(ii)(A)( 1 ) through ( 4 ) when a licensee relies on law enforcement or other offsite armed responders to perform the contingency response and interdiction and neutralization functions that protect the site against the DBT of radiological sabotage. The implementation of a performance evaluation program would provide assurance that any vulnerabilities or weaknesses resulting from the reliance on law enforcement or other offsite responses to safeguards contingencies would be identified and corrected and that a licensee would maintain an adequate response as is required to meet the requirements of § 73.55(b)(3).

The proposed alternative in § 73.55(s)(2)(iii) would permit a licensee to apply means other than physical barriers as defined in § 73.2, “Definitions,” in the design of its physical protection system to achieve the intended delay functions and access denial and meet the performance objective and requirements of § 73.55(b) to protect against the DBT of radiological sabotage. A licensee would be permitted to consider other methods that include the use of engineered systems or human actions, or both, where reliable and available, to achieve delay functions necessary to facilitate security responses after the successful detection and assessment of threats up to and including the DBT of radiological sabotage. For example, a licensee could potentially use engineered systems designed to disperse material that physically impedes or physiologically interferes with the adversary, such as obscurants and irritants, to achieve the delay function rather than relying on physical barriers as defined in § 73.2. The alternative methods would permit consideration of active engineered security systems performing interdiction and neutralization functions, which may delay the DBT adversary ( e.g., increasing task time, increase travel time, interrupt adversary action, etc.), as well as serving other functions. A licensee may consider physical spatial distances, terrain, and other natural features that increase adversary task times, after successful detection and assessment, in order to achieve delay functions in its design of a physical protection system. The proposed alternative also would permit a licensee to consider methods other than physical barriers for physical access controls in implementing the access authorization program, including restricting access to vital areas.

The proposed alternative in § 73.55(s)(2)(iv) would permit a licensee to locate a secondary alarm station offsite, where the capabilities of receiving and monitoring signals for intrusion detection; receiving and monitoring video image signals to assess intrusion; communicating with onsite security to assist with implementing a security response; providing command and control of the security response; and summoning offsite local, State, and Federal law enforcement assistance are redundant and equivalent to that of the onsite central alarm station. This could include, for example, having a co-located alarm station offsite that provides secondary alarm station functions for multiple reactor sites, using a commercial security service certified by an independent testing organization, or other approaches that provide the functions required of a secondary alarm station.

The proposed alternative would require that an offsite secondary alarm station be able to perform the same functions as the onsite central alarm station, but a licensee would be relieved from the requirements in § 73.55(i)(4)(iii) to construct, locate, and protect the secondary alarm station to the same standards as the central alarm station. For example, an SMR or non-LWR licensee would not need to locate the secondary alarm station inside a protected area, ensure that the interior of the secondary alarm station is not visible from the perimeter of the protected area, or construct the secondary alarm station to be bullet resistant. A licensee would be permitted to install equipment in the secondary alarm station that is different than the central alarm station, as long as the secondary alarm station can perform the equivalent and redundant functions of the central alarm station.

The proposed alternative in § 73.55(s)(2)(v) would permit relief from the requirements to designate the secondary alarm station as a vital area and locate the secondary power supply systems for the offsite secondary alarm station in a vital area. The primary purpose of designating areas as vital is to control access in order to protect vital equipment or operations important to safety or security. This is accomplished by limiting the number of site personnel that are authorized unescorted access to these areas and requiring security measures such as locks, alarms, and periodic armed security checks to control physical access and detect unauthorized access. These control measures, along with other controls implemented in accordance with a licensee's insider mitigation program, protect against the DBT insider threat. Locating the secondary alarm station offsite and separate from the central alarm station minimizes the risk of the insider threat to affect or disrupt alarm station functions. This reflects the assumption that not every individual who is authorized unescorted access to an onsite alarm station would have authorized unescorted access or physical access to a secondary alarm station that would be located offsite. In addition, a secondary alarm station does not include activities that involve special nuclear material that would pose a risk of significant release of radionuclides from any source. Thus, a secondary alarm station would not be an element of a target set that an adversary would likely seek to destroy.

This proposed rule would establish that, for SMRs and non-LWRs, the physical protection program must be designed to protect against a significant release of radionuclides from any source and would therefore be designed to protect against radiological sabotage as defined in § 73.2.

The NRC proposes to amend current requirements under § 73.55(b)(9)(i), (e)(10)(i), and (k)(1) and section VI.A.1 of appendix B to 10 CFR part 73 to provide conforming requirements for SMRs and non-LWRs. The current requirement under § 73.55(b)(3) of designing the physical protection program to prevent significant core damage ( e.g., non-localized fuel melting or core destruction) and spent fuel sabotage was established as the means of protecting against radiological sabotage for LWRs. However, the term “core damage” may not be universally applicable to all advanced reactor designs, such as those that are based on non-LWR technology. For example, in some technologies, such as molten salt reactor technologies, the nuclear fuel may be in a liquid form. Also, for some advanced reactor designs, core damage may not result in a release of radionuclides that would constitute an unreasonable risk to public health and safety. The proposed conforming requirements for SMRs and non-LWRs under § 73.55(b)(9)(i), (e)(10)(i), and (k)(1) and section VI.A.1 of appendix B to 10 CFR part 73 continue to apply the definition of radiological sabotage under § 73.2, and establish the new requirement for the design of the physical protection program to protect against significant release of radionuclides from any source.

The NRC is proposing to amend the requirements for the content of applications for operating licenses under § 50.34 and for combined licenses under § 52.79. The current regulations under § 50.34(c), “Physical security plan,” and § 52.79(a) require license applicants to include in their applications a physical security plan that describes how the applicant will meet the applicable requirements of 10 CFR part 73. Therefore, an applicant's election of a proposed alternative under § 73.55(s) would be described in the physical security plan included in the license application. The NRC is proposing to add paragraph § 50.34(c)(4) and § 52.79(a)(35)(iii) to require each applicant electing to apply an alternative in § 73.55(s)(2) to provide a description of the technical analysis required by § 73.55(s)(1)(iv). The technical analysis itself does not have to be submitted to the NRC for review and approval. Eligible licensees that would elect to use one of the proposed alternative requirements under § 73.55(s) would need to amend their security plans in accordance with the requirements in § 50.54(p).

The NRC is proposing to amend the requirements for controlling changes to the physical security plan in § 50.54(p) by adding new paragraph (p)(5). Proposed § 50.54(p)(5) would apply to all licensees who use the alternative physical security requirements of § 73.55(s). This proposal would require that the applicable requirements proposed under § 73.55(s)(1)(ii) continue to be met if a licensee makes a change to plant features or becomes aware of a change to offsite support resources described in the site-specific analysis required by proposed § 73.55(s)(1)(iv). In such cases, the licensee would need to consider the effect of the change on the analysis. The licensee would also need to amend the information in the physical security plan prepared under § 50.34(c) or § 52.79(a) to describe how the change continues to meet the requirements in proposed § 73.55(s)(1)(ii), as applicable.

Proposed § 73.55(s)(1)(iii) would require the identification and documentation of the alternative security requirements being implemented as part of the physical protection program and demonstration of how the requirements set forth in § 73.55 are met when one or more of the selected alternatives are used.

Proposed § 73.55(s)(1)(iv) would require a technical analysis be performed to demonstrate eligibility to use the alternative physical security requirements. This technical analysis can use information from both the safety analysis and the target set identification process to support a finding of eligibility. This technical analysis would be separate from the documentation in a licensee's physical security plan describing how the licensee plans to implement any alternative physical security requirements as part of its physical protection program. Under proposed § 73.55(s)(1)(iv), the licensee would be required to maintain the technical analysis until the certifications required by § 50.82(a)(1) or § 52.110(a) have been submitted. Proposed § 50.34(c)(4) and § 52.79(a)(35)(iii) would require each applicant electing to apply an alternative in § 73.55(s)(2) to provide a description of the technical analysis required by § 73.55(s)(1)(iv). However, the technical analysis itself does not have to be submitted to the NRC for review and approval but would be subject to audit or inspection.

The NRC is seeking advice and recommendations from the public on the proposed rule. We are particularly interested in comments and supporting rationale from the public on the following:

(1) Some advanced reactors may have designs that are significantly different from the current operating large LWRs. These large LWRs must meet the requirement found in § 73.55(b)(3) for preventing “significant core damage and spent fuel sabotage.” The NRC is proposing that advanced reactors meet a new technology-inclusive requirement that would prevent a “significant release of radionuclides from any source.”

(a) If non-LWRs and SMRs should use a different requirement, then what other suitable requirement besides preventing “a significant release of radionuclides from any source” could be applicable to SMRs and non-LWRs? Please provide the basis for your response.

(b) The NRC also considered using a more specific technology-inclusive requirement, such as the dose reference values currently found in §§ 50.34(a)(1)(ii)(D) and 52.79(a)(1)(vi). How could the NRC implement the use of such a dose-based requirement ( e.g., offsite dose reference values) in the context of evaluating physical security for a site? If there should be alternative value(s) (such as a different dose-based or safety-based value(s)), what would be a suitable alternative value(s)? Please provide the basis for your response.

(2) The NRC is not proposing a hybrid approach that would allow a licensee to rely on a combination of onsite armed responders and law enforcement or other offsite armed responders to implement the licensee's protective strategy. Why should or shouldn't the NRC establish requirements and supporting guidance to allow for such a hybrid approach? What changes are necessary to the proposed rule and supporting guidance to address potential hybrid approaches? Please provide the basis for your response.

(3) The NRC recognizes that allowing licensees to rely entirely or partially on law enforcement, rather than onsite armed responders, to interdict and neutralize threats up to and including the DBT of radiological sabotage, is a novel approach to meeting the performance objectives in § 73.55(b). Has the NRC adequately addressed the uncertainties associated with the proposed requirements at 10 CFR 73.55(s)(2)(ii)? Please provide the basis for your response.

(4) Some advanced reactors may have design characteristics or engineered safety features that would contribute to the ability of a designer to show that the criteria in proposed § 73.55(s)(1) are met. However, the NRC is not currently proposing to add any submittal requirements in this regard for standard design certification applications under subpart B to 10 CFR part 52. What would be the potential benefits and challenges if the NRC were to add optional submittal requirements on such design characteristics or engineered safety features to § 52.47, “Contents of applications; technical information,” similar to those for emergency plans for early site permit applicants in § 52.17(b)(2) and (3)? To what extent should the NRC consider security matters resolved under § 52.63(a)(5) for a standard design certification when the information that would be required to show that the criteria in proposed § 73.55(s)(1) are met is provided by a design certification applicant and reviewed by the NRC as part of the certification process?

The following paragraphs describe the specific changes within this rulemaking.

This proposed rule would add a new paragraph (c)(4) to add a submission requirement that licensees of SMRs and non-LWRs electing to use one or more alternative security requirements in § 73.55(s)(2) must provide a description of the technical analysis required under § 73.55(s)(1) when submitting the application documentation required under § 50.34.

This proposed rule would add a new paragraph (p)(5) to add change control requirements that licensees of SMRs and non-LWRs must follow when there is a change that impacts the documentation required under § 73.55(s).

This proposed rule would add a new paragraph (a)(35)(iii) to add a submission requirement that licensees of SMRs and non-LWRs electing to use one or more alternative security requirements in § 73.55(s)(2) must provide a description of the technical analysis required under § 73.55(s)(1) when submitting the application documentation required under § 52.79.

This proposed rule would remove and reserve paragraph (a)(5) as it is no longer relevant since Tennessee Valley Authority now has an operating license for Watts Bar Unit 2 and no longer holds a construction permit.

This proposed rule also would revise paragraph (b)(3) introductory text, revise paragraph (b)(9)(i) introductory text, add paragraphs (b)(9)(i)(A) and (B), and revise paragraphs (e)(10)(i)(A) and (k)(1) to add requirements for SMRs and non-LWRs and to distinguish between SMRs and other LWRs.

This proposed rule also would add new paragraph (s) containing the alternative physical security requirements for SMRs and non-LWRs. Proposed paragraph (s) would include both the general and specific requirements that must be met by those licensees who elect to apply the alternatives to physical security requirements.

This proposed rule would revise paragraph VI.A.1 to add requirements for SMRs and non-LWRs and to distinguish between SMRs and other LWRs.

The Regulatory Flexibility Act of 1980 (RFA), as amended at 5 U.S.C. 601 et seq., requires that agencies consider the impact of their rulemakings on small entities and, consistent with applicable statutes, consider alternatives to minimize these impacts on the businesses, organizations, and government jurisdictions to which they apply.

In accordance with the Small Business Administration's (SBA's) regulation at 13 CFR 121.903(c), the NRC has developed its own size standards for performing an RFA analysis and has verified with the SBA Office of Advocacy that its size standards are appropriate for NRC analyses. The NRC size standards at 10 CFR 2.810, “NRC size standards,” are used to determine whether an applicant or licensee qualifies as a small entity in the NRC's regulatory programs. Section 2.810 defines the following types of small entities:

A small business is a for-profit concern and is a—(1) Concern that provides a service or a concern not engaged in manufacturing with average gross receipts of $8.0 million or less over its last 5 completed fiscal years; or (2) Manufacturing concern with an average number of 500 or fewer employees based upon employment during each pay period for the preceding 12 calendar months.

A small organization is a not-for-profit organization which is independently owned and operated and has annual gross receipts of $8.0 million or less.

A small governmental jurisdiction is a government of a city, county, town, township, village, school district, or special district with a population of less than 50,000.

A small educational institution is one that is—(1) Supported by a qualifying small governmental jurisdiction; or (2) Not State or publicly supported and has 500 or fewer employees.

The NRC is currently not aware of any known small entities as defined in § 2.810 that are planning to apply for an advanced nuclear reactor construction permit or operating license under 10 CFR part 50 or an early site permit or combined license under 10 CFR part 52, and would be impacted by this proposed rule. Based on this finding, the NRC has preliminarily determined that the proposed rule would not have a significant economic impact on a substantial number of small entities.

Depending on how the ownership and/or operating responsibilities for such an enterprise were structured, applicants for an advanced nuclear reactor rated 8 megawatts electric (MWe) or less could conceivably meet the definition of small entities as defined by § 2.810. Owners that operate power reactors rated greater than 8 MWe could generate sufficient electricity revenue that exceeds the gross annual receipts limit of $8 million, assuming a 90 percent capacity factor and the June 2021 U.S. Department of Energy's Energy Information Administration U.S. average price of electricity to the ultimate customer for all sectors of 11.3 cents per kilowatt-hour.

Although the NRC is not aware of any small entities that would be affected by the proposed rule, there is a possibility that future applications for an advanced nuclear reactor permit or license could be submitted by small entities who plan to own and operate an advanced nuclear reactor rated 8 MWe or less. Advanced nuclear reactors that are rated 8 MWe or less would most likely be used to support electrical demand for military bases or small remote towns, or would provide process heat for a variety of industrial applications ( e.g., desalination, oil refining, hydrogen production), so they would not directly compete with larger advanced nuclear reactors that would typically produce electricity for the grid. As a result of these differing purposes, the NRC would expect that small and large entities would not be in direct competition with each other.

Therefore, the NRC preliminarily concludes that this proposed rule would not have a significant economic impact on a substantial number of small entities.

The NRC is seeking comments on both its initial RFA analysis and on its preliminary conclusion that this proposed rule would not have a significant economic impact on a substantial number of small entities because of the likelihood that most expected applicants would not qualify as a small entity. Additionally, the NRC is seeking comments on its preliminary conclusion that if a small entity were to submit an advanced nuclear reactor application, the small entity would not incur a significant economic impact as it would most likely not be in competition with a large entity.

Any small entity that could be subject to this regulation that determines, because of its size, it is likely to bear a disproportionate adverse economic impact should notify the Commission of this opinion in a comment that indicates—

1. The applicant's size and how the proposed regulation would impose a significant economic burden on the applicant as compared to the economic burden on a larger applicant;

2. How the proposed regulations could be modified to take into account the applicant's differing needs or capabilities;

3. The benefits that would accrue or the detriments that would be avoided if the proposed regulations were modified as suggested by the applicant;

4. How the proposed regulation, as modified, would more closely equalize the impact of NRC regulations or create more equal access to the benefits of Federal programs as opposed to providing special advantages to any individual or group; and

5. How the proposed regulation, as modified, would still adequately demonstrate compliance with the NRC's obligations under the Atomic Energy Act of 1954, as amended.

The NRC has prepared a draft regulatory analysis for this proposed rule. The analysis examines the costs and benefits of the alternatives considered by the NRC. The conclusion from the analysis is that this proposed rule and associated guidance would result in net averted costs to the industry and the NRC of $80,000 using a 7-percent discount rate and $130,000 using a 3-percent discount rate due to reductions in exemption requests. The NRC requests public comment on the draft regulatory analysis, which is available as indicated in the “Availability of Documents” section of this document. Comments on the draft regulatory analysis may be submitted to the NRC as indicated under the ADDRESSES caption of this document.

This proposed rule would contain new alternative requirements for advanced reactor applicants and licensees. Because these alternative requirements would not be imposed upon current applicants and licensees and would not prohibit any applicant or licensee from following existing requirements, the proposed requirements would not constitute backfitting under 10 CFR 50.109, “Backfitting,” or affect the issue finality of any approval issued under 10 CFR part 52.

As described in the “Availability of Guidance” section of this document, the NRC has prepared two draft regulatory guides (DG-5072 and DG-5071) that, if finalized, would provide guidance on methods acceptable to the NRC for complying with this proposed rule. Issuance of these DGs in final form would not constitute backfitting under § 50.109 and would not affect the issue finality of any approval issued under 10 CFR part 52. As discussed in the “Implementation” section of the DGs, the NRC staff does not intend to use the proposed guidance in these draft regulatory guides to support NRC staff actions in a manner that would constitute backfitting or affect the issue finality of an approval under 10 CFR part 52. If, in the future, the NRC seeks to impose positions stated in the DGs in a manner that would constitute backfitting or forward fitting or affect the issue finality of an approval under 10 CFR part 52, the NRC would need to make the showing as required in § 50.109 for backfitting or Management Directive 8.4, “Management of Backfitting, Forward Fitting, Issue Finality, and Information Requests,” for forward fitting, or address the regulatory criteria in the applicable issue finality provision, as applicable, that would allow the NRC to impose the position.

The NRC is following its CER process by engaging with external stakeholders throughout this proposed rule and related regulatory activities. Public involvement has included: (1) the publication of the regulatory basis for public comment (84 FR 33861; July 16, 2019); (2) numerous public meetings to examine potential performance-based alternatives and eligibility requirements for physical security for advanced reactors; and (3) the publication of numerous versions of preliminary proposed rule language. The NRC is considering holding additional public meetings during the remainder of the rulemaking process.

In parallel with this proposed rule, the NRC is issuing two draft implementing guidance documents for comment to support informed external stakeholder feedback. Section XIII, “Availability of Guidance,” of this document describes how the public can access the draft implementing guidance.

In addition to the questions in the “Specific Requests for Comments” section of this document, the NRC is requesting CER feedback on the following questions:

1. In light of any current or projected CER challenges, does the proposed rule's effective date provide sufficient time to implement the new proposed requirements, including changes to programs, procedures, and the facility? Please explain your answer.

2. If CER challenges currently exist or are expected, what should be done to address them? For example, if more time is required for implementation of the new requirements, what period of time is sufficient?

3. Do other (NRC or other agency) regulatory actions ( e.g., orders, generic communications, license amendment requests, inspection findings of a generic nature) influence the implementation of the proposed rule's requirements? Please explain your answer.

4. Are there unintended consequences? Does the proposed rule create conditions that would be contrary to the proposed rule's purpose and objectives? If so, what are the unintended consequences, and how should they be addressed?

5. Please comment on the NRC's cost and benefit estimates in the regulatory analysis that supports this proposed rule. The draft regulatory analysis is available as indicated under the “Availability of Documents” section of this document.

The Plain Writing Act of 2010 (Pub. L. 111-274) requires Federal agencies to write documents in a clear, concise, and well-organized manner. The NRC has written this document to be consistent with the Plain Writing Act as well as the Presidential Memorandum, “Plain Language in Government Writing,” published June 10, 1998 (63 FR 31885). The NRC requests comment on this document with respect to the clarity and effectiveness of the language used.

The Commission has determined under the National Environmental Policy Act of 1969, as amended, and the Commission's regulations in subpart A, “National Environmental Policy Act—Regulations Implementing Section 102(2),” of 10 CFR part 51, “Environmental Protection Regulations for Domestic Licensing and Related Regulatory Functions,” that this proposed rule, if adopted, would not be a major Federal action significantly affecting the quality of the human environment, and an environmental impact statement is not required. This environmental assessment focuses on those aspects of the proposed alternative physical security requirements for advanced reactors rulemaking where there is a potential for the revised requirements to affect the environment. The NRC has concluded that there would be no significant environmental impacts associated with implementation of the alternative security requirements for advanced reactors rule requirements for the following reasons:

(1) The proposed alternative requirements for physical security would provide an equivalent level of security as that for existing requirements; therefore, the environmental impacts would be the same because the resulting risk is similar.

(2) The proposed revision to the power reactor security requirements would not result in changes to the design basis requirements for the protection of structures, systems, and components (SSCs) in potential licensee facilities that function to limit the release of radiological effluents during and following postulated accidents. All the SSCs associated with limiting the releases of offsite radiological effluents would therefore continue to be able to perform their functions, and as a result, there would be no significant radiological effluent impact such that there would be no significant release of radionuclides from any source.

(3) The standards and requirements applicable to radiological releases and effluents would not be affected by the limited-scope security rulemaking and would continue to apply to the SSCs affected by the limited-scope security rulemaking.

The principal effect of this action is to revise the governing regulations pertaining to power reactor security, create alternative security requirements applicable to a certain class of licensees, and add additional requirements consistent with the rulemaking objective and requirements discussed earlier. None of the proposed revisions would affect current occupational exposure requirements; consequently, the NRC has concluded that this action would have no impact on occupational exposure.

For the reasons discussed above, the action would not significantly increase the probability or consequences of accidents, nor result in changes being made in the types of any effluents that may be released offsite, and there would be no significant increase in occupational or public radiation exposure.

With regard to potential non-radiological impacts, implementation of the rule requirements would not have a significant impact on the environment. The proposed requirements would not affect any historic sites and would not affect non-radiological plant effluents. Therefore, there would be no significant non-radiological environmental impact associated with this proposed rule. Accordingly, the NRC finds that there would be no significant environmental impact associated with this rulemaking action.

The determination of this environmental assessment is that there would be no significant effect on the quality of the human environment from this action. Public stakeholders should note, however, that comments on any aspect of this environmental assessment may be submitted to the NRC as indicated under the ADDRESSES caption. The environmental assessment is available as indicated under the “Availability of Documents” section.

The NRC has sent a copy of the environmental assessment and this proposed rule to all State Liaison Officers and has requested comments.

This proposed rule contains new or amended collections of information contained in parts 50, 52, and 73 that are subject to the Paperwork Reduction Act of 1995 (44 U.S.C. 3501 et seq. ). The collections of information have been submitted to the Office of Management and Budget for review and approval. Existing collections of information were approved by the Office of Management and Budget, approval numbers 3150-0002 (part 73), 3150-0011 (part 50), and 3150-0151 (part 52).

Type of submission, new or revision: Revision.

The title of the information collection: Alternative Physical Security Requirements for Advanced Reactors.

The form number if applicable: Not Applicable.

How often the collection is required or requested: On occasion.

Who will be required or asked to respond: Future power reactor licensees or license applicants for advanced reactors to be licensed under 10 CFR part 50 or part 52.

An estimate of the number of annual responses: 6.66 (0.33 for part 50, 3 for part 52, and 3.33 for part 73).

The estimated number of annual respondents: 3.33 (0.33 for part 50, 3 for part 52, and 3.33 for part 73).

An estimate of the total number of hours needed annually to comply with the information collection requirement or request: 9,437 (110 for part 50, 1002 for part 52, and 8,325 for part 73).

Abstract: The proposed rule would result in changes in reporting, recordkeeping, and third-party disclosure requirements relative to existing rules by providing certain alternative, risk-informed, performance-based physical security requirements for advanced reactors. Part 50 and part 52 advanced reactor applicants electing to apply an alternative would need to provide a description of the technical analysis required by proposed § 73.55(s)(1)(iv) relating to eligibility to use the alternatives. These part 50 and part 52 advanced reactor applicants or licensees would also be required to maintain a record of the technical analysis related to eligibility until the certifications of cessation of operations required by §§ 50.82(a)(1) or 52.110(a) have been docketed by the NRC. In addition, advanced reactor licensees relying on law enforcement or other offsite armed responders would need to provide information about the facilities and make available periodic training to these responders. Finally, the proposed rule would require part 50 and part 52 advanced reactor licensees, who make changes to or are aware of changes to plant features or offsite support resources described in the technical analysis, to prepare a report that considers the effect of changes and describes how the licensee will continue to meet the requirements in proposed § 73.55(s)(1)(ii) that the consequences of a postulated radiological release that results from a postulated security-initiated event does not exceed the offsite dose reference values. These new and amended information collections would be required to ensure the NRC has the necessary information to review whether an applicant or licensee has demonstrated they have met the proposed requirement to be eligible to use any of the proposed alternatives. The collected information would also be used by the NRC to review and determine whether the applicant or licensee has met the requirements for each elected alternative.

The U.S. Nuclear Regulatory Commission is seeking public comment on the potential impact of the information collection(s) contained in this proposed rule and on the following issues:

1. Is the proposed information collection necessary for the proper performance of the functions of the NRC, including whether the information will have practical utility? Please explain your response.

2. Is the estimate of the burden of the proposed information collection accurate? Please explain your response.

3. Is there a way to enhance the quality, utility, and clarity of the information to be collected? Please explain your response.

4. How can the burden of the proposed information collection on respondents be minimized, including the use of automated collection techniques or other forms of information technology?

A copy of the OMB clearance package and proposed rule is available in ADAMS under Accession Nos. ML22131A161, ML22131A167, ML21334A009, and ML21334A003 or may be viewed free of charge by contacting the NRC's Public Document Room reference staff at 1-800-397-4209, at 301-415-4737, or by email to PDR.resource@nrc.gov. You may obtain information and comment submissions related to the OMB clearance package by searching on https://www.regulations.gov under Docket ID NRC-2017-0227.

You may submit comments on any aspect of these proposed information collection(s), including suggestions for reducing the burden and on the above issues, by the following methods:

• Federal Rulemaking Website: Go to https://www.regulations.gov and search for Docket ID NRC-2017-0227.

• Mail comments to: FOIA, Library, and Information Collections Branch, Office of the Chief Information Officer, Mail Stop: T6-A10M, U.S. Nuclear Regulatory Commission, Washington, DC 20555-0001 or by email to Infocollects.Resource@nrc.gov or to the OMB reviewer at: OMB Office of Information and Regulatory Affairs (3150-0011, -0151, -0002), Attn: Desk Officer for the Nuclear Regulatory Commission, 725 17th Street NW, Washington, DC 20503.

Submit comments by September 9, 2024. Comments received after this date will be considered if it is practical to do so, but the NRC staff is able to ensure consideration only for comments received on or before this date.

The NRC may not conduct or sponsor, and a person is not required to respond to, a collection of information unless the document requesting or requiring the collection displays a currently valid OMB control number.

The NRC is issuing for public comment draft guidance for the implementation of the proposed requirements in this rulemaking: DG-5072, “Guidance for Alternative Physical Security Requirements for Small Modular Reactors and Non-Light-Water Reactors.” DG-5072 is available at https://www.regulations.gov by searching on Docket ID NRC-2017-0227.

DG-5071, “Target Set Identification and Development for Nuclear Power Reactors,” contains Official Use Only—Security Related Information (OUO-SRI) and is withheld from public disclosure. This DG may be made available to those affected stakeholders who have established a need-to-know. For access to DG-5071, contact the individuals listed for guidance information in the FOR FURTHER INFORMATION CONTACT section of this document.

This draft regulatory guide describes an approach that the NRC staff considers acceptable to develop the radiological consequence analysis required to demonstrate eligibility for the use of any alternative physical security requirement listed under § 73.55(s)(2). This analysis is performed by the applicant or licensee to determine radiation doses at the exclusion area boundary and the outer boundary of the low population zone from postulated radiological releases as a result of a postulated security-initiated event. This draft regulatory guide includes a description of an acceptable approach for demonstrating the ability to meet the requirements set forth in § 73.55 with the identified alternative physical security requirements incorporated into the security plans. This draft regulatory guide also provides a description of acceptable implementation guidance for each physical security alternative listed under § 73.55(s)(2), including guidance for licensees to provide information and conduct training and exercises with offsite law enforcement.

This draft regulatory guide describes an approach that the NRC staff considers acceptable for applicant or licensee analysis, development, documentation, and evaluation of target set elements and target sets. This includes operator actions and mitigative measures that may be credited to prevent: (1) the target set's high-level objective, (2) significant core damage or (3) loss of spent fuel coolant and exposure of spent fuel for large LWRs, and to prevent significant release of radionuclides from any source for SMRs and non-LWRs.

The NRC may conduct a public meeting on the proposed rule for the purpose of describing the proposed rule and implementation guidance to the public and answering questions from the public on the proposed rule and implementation guidance.

The NRC will publish a notice of the public meeting's location, time, and agenda on the NRC's public meeting website at least 10 calendar days before the meeting. Stakeholders should monitor the NRC's public meeting website for information about the public meeting at: https://www.nrc.gov/public-involve/public-meetings/index.cfm.

The documents identified in the following table are available to interested persons through one or more of the following methods, as indicated.

Throughout the development of this rule, the NRC may post documents related to this rule, including public comments, on the Federal rulemaking website at https://www.regulations.gov under Docket ID NRC-2017-0227.

For the reasons set out in the preamble and under the authority of the Atomic Energy Act of 1954, as amended; the Energy Reorganization Act of 1974, as amended; and 5 U.S.C. 552 and 553, the NRC is proposing to amend 10 CFR parts 50, 52, and 73 as follows:

The revisions and additions read as follows:

The proposed rule would amend the BSA compliance program rule for banks  1 supervised by each of the Agencies in a way that aligns with the rule concurrently proposed by FinCEN. 2 As explained below, pursuant to the AML Act, 3 FinCEN is amending its BSA/AML program rules to incorporate the AML/CFT Priorities. Other changes proposed by FinCEN to the BSA/AML program rules are not required by the AML Act but are intended to clarify regulatory requirements. The Agencies have independent authority to prescribe regulations requiring banks to establish and maintain procedures reasonably designed to assure and monitor the compliance of banks with the requirements of subchapter II of chapter 53 of title 31, under 12 U.S.C. 1818(s) and 1786(q), and are proposing to amend their rules concurrently with FinCEN. The intent of the Agencies is to have their program requirements for banks remain consistent with those imposed by FinCEN. Further, with consistent regulatory text, banks will not be subject to any additional burden or confusion from needing to comply with differing standards between FinCEN and the Agencies. The proposed changes are discussed in more detail below in the section-by-section analysis.

The Money Laundering Control Act of 1986 (MLCA)  4 amended 12 U.S.C. 1818(s) and 1786(q) (sections 8(s) of the Federal Deposit Insurance Act and 206(q) of the Federal Credit Union Act, respectively) to require the Agencies to issue regulations requiring their supervised institutions to “establish and maintain procedures reasonably designed to assure and monitor the compliance” of their supervised institutions with the requirements of the BSA. Consistent with the MLCA, on January 27, 1987, all of the then-Federal bank regulatory agencies issued substantially similar regulations requiring their supervised institutions to develop procedures for BSA compliance. 5 The Agencies' respective BSA compliance program rules require banks to implement a program reasonably designed to assure and monitor compliance with recordkeeping and reporting requirements set forth in the BSA and its implementing regulations. 6 These rules require the BSA compliance program to have four components, commonly known as: internal controls, independent testing, BSA officer, and training.

The Annunzio-Wylie Anti-Money Laundering Act of 1992 (Annunzio-Wylie Act)  7 subsequently amended the BSA by authorizing the Treasury Secretary to issue regulations requiring financial institutions, as defined in the BSA, to maintain an AML program. 8 The “minimum standards” set forth in the statute were substantially similar to the standards previously set forth by the Agencies in their respective BSA compliance program rules, including the four components. 9 Before 2002, BSA compliance program rules for banks with a Federal functional regulator were administered exclusively by the Agencies under sections 8(s) and 206(q). The Uniting and Strengthening America by Providing Appropriate Tools Required to Intercept and Obstruct Terrorism Act of 2001 (USA PATRIOT Act)  10 further amended the BSA, by among other things, establishing FinCEN's statutory role as the regulator and administrator of the BSA  11 and mandating that financial institutions subject to the BSA maintain AML programs consistent with the minimum standards established by the Annunzio-Wylie Act. 12

Because the statutory elements of AML programs under the BSA largely mirrored the Agencies' BSA compliance program rules, FinCEN, in 2002, issued a rule that deemed banks supervised by the Agencies to be in compliance with the BSA if they satisfied the requirements of the Agencies' BSA compliance program rules. 13

Although in practice FinCEN's and the Agencies' compliance program rules operate together, since the USA PATRIOT Act, banks have been required to maintain compliance programs under separate legal authorities administered by (i) FinCEN under title 31  14 and (ii) the Agencies under sections 8(s) and 206(q). Because the authority for each Agency's BSA compliance program rule derives from and is required by sections 8(s) and 206(q), each Agency prescribes regulations requiring the banks it supervises to establish and maintain procedures reasonably designed to assure and monitor the compliance of such banks with the requirements of the BSA.

In 2003, FinCEN, the Agencies, the Securities and Exchange Commission, and the Commodity Futures Trading Commission jointly issued final rules on customer identification program (CIP) requirements, which were mandated by amendments to the BSA under the USA PATRIOT Act  15 requiring financial institutions to implement a CIP as part of their BSA compliance program. The CIP requirements became part of the separate program rules administered by FinCEN and each of the Agencies although the rules continued to function together by allowing banks to satisfy FinCEN's rule by complying with their Agency's rule.

In 2016, FinCEN amended its AML compliance program rules to incorporate customer due diligence (CDD) requirements, including beneficial ownership information collection requirements, into its AML compliance program rule for certain financial institutions, including banks. 16 Although the Agencies did not promulgate CDD requirements at that time, the Agencies examine supervised banks for compliance with those requirements under the authority of sections 8(s) and 206(q). 17 With the exception of the CDD requirement, FinCEN's rule was substantially similar to the Agencies' rules, and banks must currently comply with both FinCEN's and the Agencies' compliance program rules.

On January 1, 2021, Congress enacted the William M. (Mac) Thornberry National Defense Authorization Act for Fiscal Year 2021, of which the AML Act was a component. 18 Section 6101(b) of the AML Act made several changes to the BSA, including, but not limited to: (1) inserting CFT as a term in the statutory compliance program requirement; (2) requiring the Treasury Secretary to establish and make public the AML/CFT Priorities and to promulgate regulations, as appropriate; (3) providing that the duty to establish, maintain, and enforce an AML/CFT program shall remain the responsibility of, and be performed by, persons in the United States who are accessible to, and subject to oversight and supervision by, the Treasury Secretary and the appropriate Federal functional regulator; and (4) requiring the Treasury Secretary and Federal functional regulators to take into account certain factors when prescribing the minimum AML/CFT standards and examining for compliance with those standards. Among these factors, section 6101 of the AML Act reinforced that AML/CFT programs are to be “reasonably designed” and “risk-based, including ensuring that more attention and resources of financial institutions should be directed toward higher-risk customers and activities, consistent with the risk profile of a financial institution, rather than toward lower-risk customers and activities.”

The proposed rule would make several changes to the Agencies' BSA compliance program rules. As mentioned earlier and described in more detail below, there are several reasons for these proposed changes. The primary reason for the changes is so that the Agencies' BSA compliance program rules will remain aligned with FinCEN's rule to avoid confusion and additional burden on banks. FinCEN is required by the AML Act to amend its program rules to incorporate the AML/CFT Priorities and is also taking the opportunity to clarify certain requirements. Although not required by the AML Act, the Agencies are revising their BSA regulations, among other reasons, to address how the AML/CFT Priorities will be incorporated into banks' BSA requirements. 19 Section IV describes the other proposed changes to the Agencies' AML/CFT program rules.

The section-by-section analysis describes the specific proposed changes to the AML/CFT program rules of the Agencies.

FinCEN and the Agencies are proposing a statement describing the purpose of an AML/CFT program requirement, which is to ensure that each bank implements an effective, risk-based, and reasonably designed AML/CFT program to identify, manage, and mitigate illicit finance activity risks that: complies with the requirements of subchapter II of chapter 53 of title 31, United States Code, and the implementing regulations promulgated thereunder by the Department of the Treasury at 31 CFR chapter X; focuses attention and resources in a manner consistent with the risk profile of the bank; may include consideration and evaluation of innovative approaches to meet its AML/CFT compliance obligations; provides highly useful reports or records to relevant government authorities; protects the financial system of the United States from criminal abuse; and safeguards the national security of the United States, including by preventing the flow of illicit funds in the financial system.

The proposed statement of purpose is not intended to establish new obligations separate and apart from the specific requirements set out for banks or impose additional costs or burdens. Rather, this language is intended to summarize the overarching goals of banks' effective, risk-based, and reasonably designed AML/CFT programs.

The Agencies are proposing changes to their existing program requirement to align with changes proposed by FinCEN including those changes that reflect the statutory requirements in AML Act section 6101(b). Paragraph (b)(1) of the proposed rule introduces the general requirement that “A [bank] must establish, implement, and maintain an effective, risk-based, and reasonably designed AML/CFT program . . .” Banks are currently required to maintain a “reasonably designed” BSA compliance program. The proposed rule would add the terms “effective” and “risk-based” to the existing program requirement. Implicit in the language that programs must be “reasonably designed to assure and monitor compliance” with the BSA and the implementing regulations issued by the Department of the Treasury at 31 CFR chapter X is the requirement that a bank's compliance program be effective. The addition of the term “effective” to describe the AML/CFT program requirement more directly reflects this purpose and would make clear that the Agencies evaluate the effectiveness of the implemented program and not only its design. As the addition of the term “effective” is a clarifying amendment, it would not be a substantive change for banks. 20 The addition of the term “risk-based” also reinforces the longstanding position of the Agencies that AML/CFT programs should be risk-based. 21

Additionally, as previously discussed, the Agencies are adding the terminology “AML/CFT” to this rule, consistent with the AML Act. The inclusion of “CFT” in the program rules also does not establish new obligations or impose additional costs or burdens as the USA PATRIOT Act already requires financial institutions to account for risks related to terrorist financing.

This subparagraph conforms to language proposed by FinCEN and is consistent with section 6101(b) of the AML Act. It describes the contents of an AML/CFT program as follows: “An effective, risk-based, and reasonably designed AML/CFT program focuses attention and resources in a manner consistent with the [bank's] risk profile that takes into account higher-risk and lower-risk customers and activities . . .” followed by setting forth the minimum requirements for such a program. This statement reflects the longstanding industry practice and expectation of the Agencies that AML/CFT programs be risk-based. Implicit in the existing requirement that banks implement a program “reasonably designed” to ensure and monitor compliance with the BSA is the expectation that banks allocate their resources according to their money laundering and terrorist financing (ML/TF) risk. Moreover, as part of existing requirements under CDD and suspicious activity monitoring, banks already evaluate customers and activities according to risk.

The proposed rule also sets forth the following minimum requirements of an AML/CFT program: (i) a risk assessment process that serves as the basis for the bank's AML/CFT program; (ii) reasonable management and mitigation of risks through internal policies, procedures, and controls; (iii) a qualified AML/CFT officer; (iv) an ongoing employee training program; (v) independent, periodic testing conducted by qualified personnel of the bank or by a qualified outside party; and (vi) CDD. As explained in the subsections that follow, the ways in which banks approach the implementation of these components is crucial to whether the resulting AML/CFT program is effective, risk-based, and reasonably designed. Each of the components does not function in isolation; instead, each component complements the other components, and together they form the basis for an AML/CFT program that is effective, risk-based, and reasonably designed in its entirety.

As noted previously, FinCEN is required by the AML Act to amend its program rules to incorporate the national AML/CFT Priorities. Consistent with FinCEN's proposal, the Agencies are proposing to require a risk assessment process as the means to incorporate the AML/CFT Priorities. The risk assessment process is now proposed as the first component required for an AML/CFT program. This proposed subparagraph would require banks to establish a risk assessment process that serves as the basis for the bank's AML/CFT program including implementation of the components as described in paragraphs (b)(2)(ii) through (vi). The Agencies have traditionally viewed a risk assessment as a critical tool of a reasonably designed BSA compliance program; a bank cannot implement a reasonably designed program to achieve compliance with the BSA unless it understands its risk profile. 22 As part of safe and sound operations, the Agencies have guided banks to use risk assessments to structure their risk-based compliance programs. The inclusion of a risk assessment process that serves as the basis of a risk-based AML/CFT program also is supported by several provisions of the AML Act, including section 6101(b), which states that AML/CFT programs should be risk-based. 23

The objective of requiring the risk assessment process to serve as the basis for a bank's AML/CFT program would be to promote programs that are appropriately risk-based and tailored to the AML/CFT Priorities and the bank's risk profile. This approach would require banks to integrate the results of their risk assessment process into their risk-based internal policies, procedures, and controls. Consistent with section 6101(b) of the AML Act, this risk-based approach would also enable banks to focus attention and resources in a manner consistent with the bank's ML/TF risk profile that takes into account higher-risk and lower-risk customers and activities. The details of a bank's particular risk assessment process should be determined by each financial institution based on its applicable activities and risk profile. Most banks already design their BSA compliance programs based on their assessment of ML/TF risk.

A bank would retain flexibility in how it would document the results of its risk assessment process. As proposed, banks would not be required to establish a single, consolidated risk assessment document solely to comply with the proposed rule. Rather, various methods and approaches could be used to ensure that a bank is appropriately documenting its particular risks. Regardless of the process, the information obtained through the risk assessment process should be sufficient to enable the bank to establish, implement, and maintain an effective, risk-based, and reasonably designed AML/CFT program.

The proposed risk assessment process would conform to the changes in FinCEN's proposed AML/CFT program and standardize the risk assessment process by requiring banks under paragraph (b)(2)(i)(A) to identify, evaluate, and document their ML, TF, and other illicit finance activity risks, including consideration of: (1) the AML/CFT Priorities; (2) the ML/TF and other illicit finance activity risks of the bank based on its business activities, including products, services, distribution channels, customers, intermediaries, and geographic locations; and (3) reports filed pursuant to the BSA and 31 CFR chapter X.

As previously noted, the proposed rule would require banks to adjust their risk assessment processes to include a consideration of the AML/CFT Priorities. The term “AML/CFT Priorities” refers to the most recent statement issued by FinCEN pursuant to 31 U.S.C. 5318(h)(4). 24 FinCEN issued the first set of AML/CFT Priorities on June 30, 2021. 25

Section 6101 of the AML Act provides that the review and incorporation by a financial institution of the AML/CFT Priorities, as appropriate, into a financial institution's AML/CFT program must be included as a measure on which a financial institution is supervised and examined for compliance with the financial institution's obligations under the BSA and other AML/CFT laws and regulations. 26 The Agencies are implementing this statutory requirement by proposing amendments that would require banks to review and consider the AML/CFT Priorities as part of their risk assessment process. The inclusion of the AML/CFT Priorities is meant to ensure that banks understand their exposure to risks in areas that are of particular importance at a national level, which may help them develop more effective, risk-based, and reasonably designed AML/CFT programs. Financial institutions would only be required to incorporate the most up-to-date set of AML/CFT Priorities into their risk-based AML/CFT programs.

The Agencies expect that most banks will be able to leverage their existing risk assessment processes when considering their exposure to each of the AML/CFT Priorities. By adopting a risk-based approach to the integration of the AML/CFT Priorities, banks can tailor their AML/CFT programs to address current and emerging risks, react to changing circumstances, and maximize the benefits of their compliance efforts. Banks also would maintain flexibility over the manner in which the AML/CFT Priorities are integrated into their risk assessment processes and the method of assessing the risk related to each of the AML/CFT Priorities. The Agencies anticipate that some banks may ultimately determine that their business models and risk profiles have limited exposure to some of the threats addressed in the AML/CFT Priorities but instead reflect greater exposure to other ML/TF and illicit finance activity risks. Additionally, some banks may determine that their AML/CFT programs already sufficiently take into account the AML/CFT Priorities.

Banks are not expected to exclusively focus their risk assessment processes on the AML/CFT Priorities. Rather, the AML/CFT Priorities are among many factors that a bank should consider when assessing its institution-specific risks. Accordingly, the proposed risk assessment process would also require consideration of ML/TF and other illicit finance activity risks of the bank based on its business activities, including products, services, distribution channels, customers, intermediaries, and geographic locations. These factors are generally consistent with banks' current risk assessment practices and the Agencies' supervisory expectations. Regardless of the source of information, the risk assessment process contemplates steps to ensure the information on which they are relying to assess risks is reasonably current, complete, and accurate.

While most banks are generally familiar with these concepts, “distribution channels” may be a newer term for some banks. For purposes of this rule, “distribution channels”  27 refers to the method(s) and tool(s) through which a bank opens accounts and provides products or services, including, for example, through the use of remote or other non-face-to-face means. The term “intermediaries” may also be a newer term for some banks. Since banks have a variety of other relationships beyond customers, such as third parties, that may pose ML/TF risks to the U.S. financial system, the proposed rule would include the term “intermediary” so that banks would consider these other types of relationships in their risk assessment process. The Agencies consider “intermediaries” to broadly include other types of financial relationships beyond customer relationships that allow financial activities by, at, or through a bank or other type of financial institution. An intermediary can include, but not be limited to, a bank or financial institution's brokers, agents, and suppliers that facilitate the introduction or processing of financial transactions, financial products and services, and customer-related financial activities.

Other sources of information relevant to the risk assessment process may include information obtained from other financial institutions, such as emerging risks and typologies identified through section 314(b) information sharing or payment transactions that other financial institutions returned or flagged due to ML/TF risks. It also could include internal information that a bank maintains. Such internal information may include, for example, the locations from which its customers access the bank's products, services, and distribution channels, such as the customer internet protocol (IP) addresses or device logins and related geolocation information.

Additional sources of information relevant to the risk assessment process may include feedback from law enforcement about a report the bank has filed, subpoenas from law enforcement, or potential risks at the bank and information identified from responding to section 314(a) requests. Additionally, a bank may find that there are FinCEN advisories or guidance that are particularly relevant to the bank's business activities. In that case, it would be appropriate for the bank to consider the information contained in relevant advisories or guidance when evaluating its ML/TF risks.

As the risk assessment process would serve as the foundation for a risk-based AML/CFT program, the proposed rule would require that banks review and evaluate reports filed by the bank with FinCEN pursuant to the BSA and its implementing regulations, such as suspicious activity reports and currency transaction reports. These reports can assist banks in identifying known or detected threat patterns or trends to incorporate into their risk assessments and apply to their risk-based internal policies, procedures, and controls. Reports generated and filed by a bank, such as suspicious activity reports and currency transaction reports, help inform its understanding of current risk in all areas of its business activities and customer base and may signal areas of emerging risk as its products and services evolve and change.

The proposed rule would include a new requirement under paragraph (b)(2)(i)(B) that banks update their risk assessments using the process required under paragraph (b)(2)(i)(A) on a periodic basis, including, at a minimum, when there are material changes to the bank's ML/TF or other illicit finance activity risks. This proposed requirement generally would be consistent with current bank practice, which includes updating risk assessments (in whole or in part) to reflect changes in the bank's products, services, customers, and geographic locations and to remain an accurate reflection of the bank's ML/TF and other illicit financial activity risks. Periodic updates of the risk assessment assist banks in maintaining a risk-based AML/CFT program. For example, currently a bank may update its risk assessment when new products, services, and customer types are introduced or when the bank expands through mergers and acquisitions. It is also possible that a bank may not have material changes and that updated AML/CFT Priorities do not alter a bank's risk profile. As such, a risk assessment may not require updating. Although “material” is a term of art in accounting standards and practice, in the proposed rule, the Agencies do not intend to define the term by reference to financial materiality. For purposes of this rule, a material change would be one that significantly changes a bank's exposure to ML/TF risks, such as a significant change in business activities including products, services, distribution channels, customers, intermediaries, and geographic locations.

In connection with the proposed language concerning the frequency or timing of the risk assessment, an annual risk assessment process requirement would be in line with other annual requirements, such as independent testing or the requirement for audited financial statements pursuant to 12 CFR 363.2 and 715.4. Also, an annual risk assessment process would assist the bank in quickly adapting to any changes in its ML/TF and other illicit finance activity risk profile. However, an annual risk assessment process could cause a bank to expend resources unnecessarily if its ML/TF and other illicit finance activity risk profile remained unchanged. The Agencies could also require a review and update to the risk assessment process between examinations by the Agencies. This review and update would ensure that the risk assessment is current for a bank's ML/TF and other illicit finance activity risks at the time of the examination. However, as with requiring an annual review and update of the risk assessment, this timing may be more frequent than necessary for certain banks with a low ML/TF and other illicit finance risk activity profile. Alternatively, the Agencies could require a review and update of the risk assessment at least as frequently as the AML/CFT Priorities are updated. However, this timing may be too long for many banks that have ML/TF and other illicit finance activity risks that change or evolve rapidly. Another option would be a combination of these options, requiring updates if there are material risk changes but no less frequently than the AML/CFT Priorities are updated. Given the variety of complexities, risk profiles, and activities, some banks may decide to review and update their risk assessment more frequently, even continuously, while other banks may decide to employ a regularly scheduled point-in-time review. Finally, the frequency can remain unspecified as “periodic,” without specifying a time frame.

The Agencies currently require BSA compliance programs to “provide for a system of internal controls to assure ongoing compliance” with the BSA. The proposed paragraph (b)(2)(ii) would amend the existing internal controls component to require that a bank “[r]easonably manage and mitigate money laundering, terrorist financing, and other illicit finance activity risks through internal policies, procedures, and controls that are commensurate with those risks and ensure ongoing compliance with the requirements of the Bank Secrecy Act, and the implementing regulations issued by the Department of the Treasury at 31 CFR chapter X.” The Agencies would generally expect banks to implement the proposed rule in a similar manner to the current rule. The proposed change would clarify the importance of implementing internal policies, procedures, and controls that are tailored to the particular risk profile of the bank to effectively mitigate risk; the level of sophistication of a bank's internal policies, procedures, and controls should be commensurate with its size, structure, risks, and complexity. In this context, the results of the risk assessment process component are expected to inform the development, implementation, and changes of the “internal policies, procedures, and controls” component of a risk-based compliance program. The relationship and interaction between and among the components of an effective, risk-based, and reasonably designed AML/CFT program is critical because deficiencies in one program component may have a significant impact on the effectiveness of other program components, including on the effectiveness and reasonable design of the AML/CFT program.

In considering appropriate internal policies, procedures, and controls, banks would be expected to consider not only the appropriate level of resources but also the nature of those resources, which can include human, technological, and financial resources. Human resources can include considerations of the number, type, and qualifications of staff that directly and indirectly support an AML/CFT program and the functions and activities that they perform within the AML/CFT program. Technological resources can include considerations of the information systems, such as suspicious activity monitoring and reporting systems, and the general technology deployed for an AML/CFT program. Financial resources can include considerations of the budget and funding directed to an AML/CFT program. A bank that does not set the level and type of resources directed to customers and activities based on their risk would not be effectively managing ML/TF risks.

Finally, the proposed rule would encourage, but would not require, banks to consider, evaluate, and, as appropriate, implement innovative approaches to meet compliance obligations pursuant to the BSA, the implementing regulations promulgated thereunder by the Department of the Treasury at 31 CFR chapter X, and this section. This provision should not be viewed as restricting or limiting the current ability of banks to consider or engage in responsible innovation consistent with the December 2018 joint statement issued by FinCEN and the Agencies that encouraged banks to take innovative approaches to combat ML/TF and other illicit finance threats. 28

Based on supervisory experience, the Agencies' understanding is that most banks have already implemented internal policies, procedures, and controls to manage and mitigate ML/TF risks. As a result, the proposed paragraph (b)(2)(ii) is anticipated to impose minimal additional compliance burden.

The AML Act did not change the existing BSA requirement that each bank designate a compliance officer as part of its BSA compliance program. The Agencies are proposing clarifying and technical changes to this subsection to codify existing regulatory expectations and to conform to changes concurrently proposed by FinCEN's rule. This change does not impose a new obligation on banks.

Paragraph (b)(2)(iii) of the proposed rule also adds the word “qualified” to the existing requirement but is not intended to change substantively the current requirements concerning a bank's BSA officer. Inherent in the statutory requirement that a bank designate a compliance officer as part of a program that is “reasonably designed” to achieve compliance with the BSA and its implementing regulations is the expectation that the designated individual is qualified, including the ability to coordinate and monitor compliance with the BSA and its implementing regulations.

Accordingly, for an AML/CFT program to be effective, reasonably designed, and risk based, the compliance officer must be qualified. Based on the experience of the Agencies in examining BSA compliance programs, it is important for the compliance officer's qualifications ( i.e., the requisite training, skills, expertise, and experience) to be commensurate with the bank's ML/TF and other illicit finance activity risks. For example, a compliance officer at a less-complex bank with a lower-risk profile would not necessarily need the same training, skills, expertise, and experience as a compliance officer at a more complex bank with a higher risk profile. Whether an individual is sufficiently qualified to be the compliance officer will depend, in part, on the bank's ML/TF risk profile, as informed by the results of the risk assessment process. Among other criteria, a qualified compliance officer would be competent and capable in order to adequately perform the duties of the position, including having sufficient knowledge and understanding of the bank's risk profile as informed by the risk assessment process, U.S. AML/CFT laws and regulations, and how those laws and regulations apply to the bank and its activities.

In addition, the compliance officer's position in the bank's organizational structure must enable the compliance officer to effectively implement the bank's AML/CFT program. The actual title of the individual responsible for day-to-day AML/CFT compliance is not important; however, the individual's authority, independence, and access to resources within the bank is critical. Based on the Agencies' experience in examining BSA compliance programs, it is important for compliance officers to have sufficient independence and authority and adequate resources to effectively implement the bank's AML/CFT program. Importantly, a compliance officer requires decision-making capability regarding the AML/CFT program and sufficient stature within the organization to ensure that the program meets the applicable requirements of the BSA. The access to resources may include, but is not limited to: adequate compliance funds and staffing with the skills and expertise appropriate to the bank's risk profile, size, and complexity; an organizational structure that supports compliance and effectiveness; and sufficient technology and systems to support the timely identification, measurement, monitoring, reporting, and management of the bank's ML/TF and other illicit finance activity risks. Similarly, an AML/CFT officer who has additional job duties or conflicting responsibilities that adversely impact the officer's ability to effectively coordinate and monitor day-to-day AML/CFT compliance generally would not fulfill this requirement.

The BSA and the Agencies' current BSA compliance program rules have long required banks to have an “ongoing employee training program.”  29 The proposed paragraph (b)(2)(iv) would amend the existing training requirement in the Agencies' BSA compliance program rules to mirror 31 U.S.C. 5318(h)(1)(C) and clarify that banks must have an “ongoing” employee training program. The Agencies view this change as clarifying in nature; it does not substantively change this component. The proposed rule makes clear that AML/CFT programs must include an ongoing program in which AML/CFT training is provided to appropriate personnel.

As part of the relationship and interaction between and among program components, the Agencies generally would expect the contents of training to be responsive to the results of the risk assessment process and incorporate current developments and changes to AML/CFT regulatory requirements, such as internal policies, procedures, and controls; the AML/CFT Priorities; and the bank's products, services, distribution channels, customers, intermediaries, and geographic locations as well as any material changes to the bank's ML/TF risk profile. The frequency with which the training would occur, and the content of the training, would depend on the bank's ML/TF risk profile and the roles and responsibilities of the persons receiving the training. The frequency would also be informed by changes in the bank's risk assessment. Overall, the training should be sufficiently targeted to the relevant roles and responsibilities.

The AML Act did not change the BSA requirement that each bank must independently test its AML/CFT program. 30 Since the original adoption of the BSA compliance program rule, the Agencies have required that banks perform independent testing. However, the BSA compliance program rules neither specify how frequently banks must conduct independent testing nor address the types of parties to perform such testing. The proposed rule would modify the existing BSA compliance program rules to require each bank's program to include independent, periodic AML/CFT program testing to be conducted by qualified personnel of the bank or by a qualified outside party. The Agencies consider these changes to be consistent with longstanding requirements for independent testing and not substantive. The Agencies do not anticipate the proposed rule would significantly impact the current compliance efforts of institutions.

The purpose of independent testing is to assess the bank's compliance with AML/CFT statutory and regulatory requirements, relative to its risk profile, and to assess the overall adequacy of the AML/CFT program. This evaluation helps to inform the bank's board of directors and senior management of weaknesses or areas in need of enhancement or stronger controls. Typically, this evaluation includes a conclusion about the bank's overall compliance with AML/CFT statutory and regulatory requirements and sufficient information for the reviewer ( e.g., board of directors, senior management, AML/CFT officer, outside auditor, or an examiner) to reach a conclusion about the overall adequacy of the bank's AML/CFT program. Under the proposed rule, independent testing could be conducted by qualified personnel of the bank, such as an internal audit department, or by a qualified outside party, such as outside auditors or consultants.

As a bank's ML/TF and other illicit finance activity risks change or evolve, periodic independent testing may also assist banks in making resource determinations and allocations, including information technology sources, systems, and processes used to support the AML/CFT program. The scope of independent testing should be risk-based, as informed by the risk assessment process, and will vary based on a bank's size, complexity, organizational structure, range of activities, quality of control functions, geographic diversity, and use of technology.

The Agencies would expect the frequency of the periodic independent testing to vary based on a bank's ML/TF and other illicit finance activity risk profile, changes to its risk profile, and overall risk management strategy, as informed by the bank's risk assessment process. More frequent independent testing may be appropriate when errors or deficiencies in some aspect of the AML/CFT program have been identified or to verify or validate mitigating or remedial actions. A bank may find it appropriate to conduct additional independent testing when there are material changes in the bank's risk profile, systems, compliance staff, or processes. Without periodic testing, a bank may not be able to confirm whether its risk assessment process is accurate or whether the other components—for example, internal policies, procedures, and controls—of an AML/CFT program are reasonably managing and mitigating the bank's risk. Specifying that independent testing is conducted on a periodic basis should assist banks in conducting independent tests as ML/TF and other illicit finance activity risks and the bank's risk profile evolve and change.

As with the risk assessment process, the Agencies are considering how often banks conduct independent testing and whether a comprehensive test is conducted each time or, instead, only certain parts of the program are tested based on changes in the bank's ML/TF and other illicit finance activity risk profile. An annual independent testing requirement would be in line with other annual requirements, such as the requirement for audited financial statements pursuant to 12 CFR 363.2 and 715.4. An annual independent test would assist the bank in quickly identifying deficiencies in its AML/CFT program. However, an annual independent testing requirement could cause the bank to expend more resources unnecessarily. The Agencies could also require a bank to conduct an independent test between their examinations. This updating would ensure that the independent test is current before the Agency begins to review a bank's AML/CFT program. However, as with an annual risk assessment, this timing may be more frequent than necessary for certain lower-risk banks. Another option would be to not specify a frequency connected with the word “periodic.” The Agencies could simply add the term “periodic” without specifying a time frame.

Consistent with the proposed clarifications to the AML/CFT officer component, the proposed rule also would require independent testers to be “qualified.” This requirement is a clarifying change consistent with current practices and expectations. The knowledge, expertise, and experience necessary for a party to be qualified to conduct the independent testing would depend, in part, on the bank's ML/TF risk profile. As with the AML/CFT officer component, the Agencies generally would expect qualified independent testers to have the expertise and experience to satisfactorily perform such a duty, including having sufficient knowledge of the bank's risk profile and AML/CFT laws and regulations.

The proposed rule would add CDD as a required component of the Agencies' AML/CFT program rule. CDD is currently a required component in FinCEN's AML program rule, and, therefore, banks are already required to comply with CDD under FinCEN's rules. The inclusion of CDD in the Agencies' proposed rules would mirror FinCEN's existing rule and reflect the Agencies' long-standing supervisory expectations. Long before FinCEN amended its AML program rule to expressly include the CDD component requirement, the Agencies had considered CDD an integral component of a risk-based program, enabling the bank to understand its customers and its customers' activity to better identify suspicious activity.

Adding the CDD component to the Agencies' AML/CFT program rule at paragraph (b)(2)(vi) will eliminate confusion for banks concerning the current differences with FinCEN's AML/CFT program rule. Because banks must already comply with FinCEN's CDD component requirement, the proposed change should not alter current compliance practices.

The Agencies' BSA compliance program rules currently require banks to have written programs approved by the board of directors. The proposed rule would maintain this requirement but move it to a separate subsection and add clarifying text to harmonize the language with FinCEN's proposed rule. The proposed section would read as follows: “The AML/CFT program and each of its components, as required under paragraphs (b)(2)(i) through (vi) of this section, must be documented and approved by the [bank's] board of directors or, if the [bank] does not have a board of directors, an equivalent governing body. The AML/CFT program must be subject to oversight by the [bank]'s board of directors, or equivalent governing body.”

The Agencies do not intend for there to be a substantive change related to the current requirement. The proposed rule modifies the operative term from “written” or “reduced to writing” to “documented” but does not substantively change the requirement that the program be written. These clarifications are intended to help banks develop a structured AML/CFT program understood across the enterprise. The proposed rule would also add a reference to an “equivalent governing body” to clarify that banks without a board of directors must have an equivalent governing body approve the program. For banks without a board of directors, the equivalent governing body can take different forms. For example, for a U.S. branch of a foreign bank, the equivalent governing body may be the foreign banking organization's board of directors or delegates acting under the board's express authority. 31 The proposed rule specifies that approval encompasses each of the components of the AML/CFT program.

Finally, while banks already must obtain board approval for their BSA compliance programs, the proposed rule also would plainly require that the AML/CFT program be subject to board oversight, or oversight of an equivalent governing body. Based on the experience of the Agencies in examining BSA compliance programs over many years, the Agencies do not consider board oversight to be a new requirement. The Agencies have recognized the board's role and responsibility include not only approving the program but also overseeing the bank's adherence to it. The proposed rule makes clear that board approval of the AML/CFT program alone is not sufficient to meet program requirements since the board, or the equivalent governing body, may approve AML/CFT programs without a reasonable understanding of a bank's risk profile or the measures necessary to identify, manage, and mitigate its ML/TF risks on an ongoing basis. Oversight in the context of the proposed requirement contemplates appropriate and effective oversight measures, such as governance mechanisms, escalation, and reporting lines, to ensure that the board of directors, or a designated board committee, can properly oversee whether AML/CFT programs are operating in an effective, risk-based, and reasonably designed manner.

Section 6101(b)(2)(C), of the AML Act, codified at 31 U.S.C. 5318(h)(5), provides that the duty to establish, maintain, and enforce a bank's AML/CFT program shall remain the responsibility of, and be performed by, persons in the United States who are accessible to, and subject to oversight and supervision by, the Secretary of the Treasury and the appropriate Federal functional regulator. The proposed rule would incorporate this statutory requirement into the AML/CFT program rule by restating that the duty to establish, maintain, and enforce the AML/CFT program must remain the responsibility of, and be performed by, persons in the United States who are accessible to, and subject to the oversight and supervision by, the relevant Agency.

The Agencies recognize that banks may currently have AML/CFT staff and operations outside of the United States or contract out or delegate parts of their AML/CFT operations to third-party providers located outside of the United States. This approach may be to improve cost efficiencies, to enhance coordination particularly with respect to cross-border operations, or for other reasons.

The proposed rule would maintain the current Customer Identification Program requirements but would move them to a separate section. The Agencies propose minor, non-substantive updates to reference the “AML/CFT” terminology and harmonize the language between the Agencies to “require a customer identification program to be implemented as part of the AML/CFT program.” These technical changes are not anticipated to establish new obligations.

As noted, these proposed rules are intended to conform the Agencies' program rules with FinCEN's and would reduce regulatory burden for banks by allowing them to follow a consistent regulatory approach between the Agencies and FinCEN. The Agencies considered maintaining their regulations in their current form but chose not to do so because the Agencies believe, and past experience has shown, that having uniform BSA compliance program rules supports the purposes of the BSA and the Agencies' mandate to ensure that their supervised institutions “establish and maintain procedures reasonably designed to assure and monitor the compliance” with the BSA, whereas incongruent and overlapping rules would likely sow confusion and inhibit these policy objectives.

The Agencies welcome comment on all aspects of the proposed amendments but specifically seeks comment on the questions below. The Agencies encourage commenters to reference specific question numbers when responding.

1. What steps are banks planning to take, or can they take, to incorporate the AML/CFT Priorities into their AML/CFT programs? What approaches would be appropriate for banks to use to demonstrate the incorporation of the AML/CFT Priorities into the proposed risk assessment process of risk-based AML/CFT programs?

a. Is the incorporation of the AML/CFT Priorities under the risk assessment process as part of the bank's AML/CFT program sufficiently clear or does it warrant additional clarification?

b. What, if any, difficulties do banks anticipate when incorporating the AML/CFT Priorities as part of the risk assessment process?

2. Please comment on how and whether banks could leverage their existing risk assessment process to meet the risk assessment process requirement in the proposed rule. To the extent it supports your response, please explain how the proposed risk assessment process requirement differs from existing practices to address current and emerging risks, react to changing circumstances, and maximize the benefits of compliance efforts.

3. Should a bank's risk assessment process be required to take into account additional or different criteria or risks than those listed in the proposed rule? If so, please specify.

4. The proposed rule requires a bank to update its risk assessment using the process proposed in this rule. Are there other approaches for a bank to identify, manage, and mitigate illicit finance activity risks aside from a risk assessment process?

5. Is the explanation of the term “distribution channels” discussed in this SUPPLEMENTARY INFORMATION section consistent with how the term is generally understood by banks? If not, please comment on how the term is generally understood by banks.

6. Is the explanation of the term “intermediaries” discussed in this SUPPLEMENTARY INFORMATION section consistent with how the term is generally understood by banks? If not, please comment on how the term is generally understood by banks.

7. The proposed rule would require banks to consider the BSA reports they file as a component of the risk assessment process. To what extent do banks currently leverage BSA reporting to identify and assess risk?

8. For banks with an established risk assessment process, what is the analysis output? For example, does it include a risk assessment document? What are other methods and formats used for providing a comprehensive analysis of the bank's ML/TF and other illicit finance activity risks?

9. The proposed rule uses the term “material” to indicate when an AML/CFT program's risk assessment would need to be reviewed and updated using the process proposed in this rule. Does this rule and/or SUPPLEMENTARY INFORMATION section warrant further explanation of the meaning of the term “material” used in this context? What further description or explanation, if any, would be appropriate?

10. The proposed rule requires a bank to review and update its risk assessment using the process proposed in this rule, on a periodic basis, including, at a minimum, when there are material changes to its ML/TF risk profile. Please comment on the time frame for the bank to update its risk assessment using the process proposed in this rule. What time frame would be reasonable? What factors might a bank consider when determining the frequency of updating its risk assessment using the process proposed in this rule? For example, would the frequency be based on a particular period, such as annually, the bank's risk profile, the examination cycle, or some other factor or period?

11. Please comment on whether a comprehensive update to the risk assessment using the process proposed in this rule is necessary each time there are material changes to the bank's risk profile or whether updating only certain parts based on changes in the bank's risk profile would be sufficient. If the response depends on certain factors, please describe those factors.

12. Does the proposed regulatory text that “an effective, risk-based, and reasonably designed AML/CFT program focuses attention and resources in a manner consistent with the bank's risk profile that takes into account higher- risk and lower-risk customers and activities” permit sufficient flexibility for banks to continue to focus attention and resources appropriately? Does redirection allow banks to appropriately reduce resource allocation to lower risk activities? What approaches would be appropriate for a bank to use to demonstrate that attention and resources are focused appropriately and consistent with the bank's risk profile?

13. What are the current practices of banks when allocating resources?

14. Do banks anticipate any challenges in assigning resources to a higher-risk product, service, or customer type that is not listed in the AML/CFT Priorities? Are there any additional changes or considerations that should be made?

15. The proposed rule would make explicit a long-standing supervisory expectation for banks that the BSA officer is qualified and that independent testing be conducted by qualified individuals. Please comment on whether and how the proposed rule's specific inclusion of the concepts: (1) “qualified” in the AML/CFT program component for the AML/CFT officer(s) and (2) “qualified,” “independent,” and “periodic” in the AML/CFT program component for independent testing, respectively, may change these components of the AML/CFT program?

16. How do banks anticipate timing the independent testing in light of periodic updates to the risk assessment process?

17. The proposed rule encourages, but does not require, the consideration of innovative approaches to help banks meet compliance obligations pursuant to the BSA. Under the proposed rule, a bank's internal policies, procedures, and controls may provide for “consideration, evaluation, and, as warranted by the [bank's] risk profile and AML/CFT program, implementation of innovative approaches to meet compliance obligations.” Should alternative methods for encouraging innovation be considered in lieu of a regulatory provision?

18. Please describe what innovative approaches and technology banks currently use, or are considering using, including but not limited to artificial intelligence and machine learning, for their AML/CFT programs. What benefits do banks currently realize, or anticipate, from these innovative approaches and how they evaluate their benefits versus associated costs?

19. Does the requirement for the AML/CFT program to be approved by an appropriate governing body need additional clarification?

20. Should the proposed rule specify the frequency with which the board of directors or an equivalent governing body must review and approve the AML/CFT program? If so, what factors are relevant to determining the frequency with which a board of directors should review and approve the AML/CFT program?

21. How does a bank's board of directors, or equivalent governing body, currently determine what resources are necessary for the bank to implement and maintain an effective, risk-based, and reasonably designed AML/CFT program?

22. Please address if and how the proposed rule would require changes to banks' AML/CFT operations outside the United States. Some banks have AML/CFT staff and operations located outside of the United States for a number of reasons. These reasons can range from cost efficiency considerations to enterprise-wide compliance purposes, particularly for banks with cross-border activities. Please provide the reasons banks have AML/CFT staff and operations located outside of the United States. Please address how banks ensure AML/CFT staff and operations located outside of the United States fulfill and comply with the BSA, including the requirements of 31 U.S.C. 5318(h)(5), and implementing regulations.

23. The requirements of 31 U.S.C. 5318(h)(5) (as added by section 6101(b)(2)(C) of the AML Act) state that the “duty to establish, maintain and enforce” the bank's AML/CFT program “shall remain the responsibility of, and be performed by, persons in the United States who are accessible to, and subject to oversight and supervision by, the Secretary of the Treasury and the appropriate Federal functional regulator.” Is including this statutory language in the rule, as proposed, sufficient or is it necessary to otherwise clarify its meaning further in the rule?

24. Please comment on the following scenarios related to persons located outside the United States who perform actions related to an AML/CFT program:

a. Do these persons perform duties that do not involve the exercise of significant discretion or judgment as part of the duty of establishing, maintaining, and enforcing banks' AML/CFT programs? Examples might include obtaining and conducting an initial review of CIP and CDD information, coding the scenarios defined by BSA personnel to be used in monitoring for suspicious transactions, the dispositioning of certain initial alerts based on established standards and criteria, or related data processing activities.

b. Do these persons have a responsibility for an AML/CFT program and perform the duty for establishing, maintaining, and enforcing a bank's AML/CFT program? Please comment on whether “establish, maintain, and enforce” would also include quality assurance functions, independent testing obligations, or similar functions conducted by other parties.

25. How do banks view the requirements in 31 U.S.C. 5318(h)(5) that affect their AML/CFT operations based wholly or partially outside of the United States, such as customer due diligence or suspicious activity monitoring and reporting systems and programs?

26. Please comment on implementation of the requirements in 31 U.S.C. 5318(h)(5) for “persons in the United States.”

a. What AML/CFT duties could appropriately be conducted by persons outside of the United States while remaining consistent with the requirements in 31 U.S.C. 5318(h)(5)? Should all persons involved in AML/CFT compliance for a bank be required to be in the United States or should the requirement only apply to persons with certain responsibilities performing certain functions? If the requirement should only apply to persons with certain responsibilities performing certain functions, please explain which responsibilities and functions these should be.

b. Should “persons in the United States” as established in 31 U.S.C. 5318(h)(5) be interpreted to mean performing their relevant duties while physically present in the United States, that they are employed by a U.S. bank, or something else?

c. How would a bank demonstrate “persons in the United States” as established in 31 U.S.C. 5318(h)(5) are accessible to, and subject to oversight and supervision by, the Secretary and the appropriate Federal functional regulator?

27. Please comment on if and how the requirements in the proposed rule and 31 U.S.C. 5318(h)(5) should apply to foreign agents of a bank, contractors, or to third-party service providers. Should the same requirements apply regardless of whether persons are direct employees of the bank?

Written comments must be received by the Agencies no later than October 8, 2024.

Certain provisions of the proposed rule contain “collection of information” requirements within the meaning of the Paperwork Reduction Act (PRA) of 1995 (44 U.S.C. 3501-3521). In accordance with the requirements of the PRA, the Agencies may not conduct or sponsor, and the respondent is not required to respond to, an information collection unless it displays a currently valid Office of Management and Budget (OMB) control number. The information collection requirements contained in this proposed rule have been submitted to OMB for review and approval by the OCC, FDIC, and NCUA under section 3507(d) of the PRA and § 1320.11 of OMB's implementing regulations (5 CFR part 1320). The Board reviewed the proposed rule under the authority delegated to the Board by OMB. The Agencies are proposing to extend for three years, with revision, these information collections.

Title of Information Collection:

OMB Control Numbers:

Respondents:

OCC: All national banks, Federal savings associations, Federal branches and agencies.

Board: All state member banks; Edge and agreement corporations; and U.S. branches, agencies, and representative offices of foreign banks supervised by the Board, except for a Federal branch or a Federal agency or a state branch that is insured by the FDIC.

NCUA: All federally insured credit unions.

FDIC: All insured state nonmember banks, insured state-licensed branches of foreign banks, insured state savings associations.

Current Actions: The proposed rule contains recordkeeping requirements that clarify the recordkeeping requirements included in the agencies currently approved information collections. Under the proposed rule, respondents “must establish, implement, and maintain an effective, risk-based, and reasonably designed AML/CFT program to ensure and monitor compliance with the requirements of the Bank Secrecy Act.”  32 The proposed rule also requires that “the AML/CFT program and each of its components, as required under paragraphs (b)(2)(i) through (vi) of this section, must be documented and approved by the [the Respondent's] board of directors.”  33

The Agencies reviewed the methodology used to estimate the recordkeeping burden found in the currently approved information collections and determined that the OCC, FDIC, and NCUA included activities that are better classified as other types of burden and beyond the scope of recordkeeping burden in their burden estimates. The Board limited its burden estimate to recordkeeping activities. The Agencies acknowledge those existing burdens in the currently approved information collections but the OCC, FDIC, and NCUA have determined much of those ongoing burdens are not specifically related to recordkeeping. The Agencies are taking this opportunity to revise and align the burden estimation methodology and assumptions used for this information collection to show only recordkeeping activities which the Agencies assume are not affected by the size of the respondent institution. The Agencies assume that the recordkeeping requirements in the proposed rule encompass two distinct activities: (1) the one-time burden associated with documenting the required AML/CFT program and creating its necessary policies and training and testing materials; and (2) the ongoing (occasional) burden of documenting (a) revisions to policies, (b) required periodic reviews of the risk assessment and independent testing, (c) compliance with training requirements, and (d) Board of Directors oversight of the AML/CFT program as required by the proposed rule.

Based on supervisory experience, the Agencies estimate the time required to document and retain a record of the necessary changes to a respondent's newly created compliance program as prescribed in the proposed rule, averages approximately 32 hours. In accordance with OMB guidance, since the implementation burden is incurred only in year one of the three-year PRA clearance cycle, the annual burden is the average of the implementation burden imposed over three years or 10.67 hours per year (32 hours in year one, plus zero hours for years two and three; divided by three).

Based on supervisory experience, the Agencies estimate the annual burden related only to documenting maintenance of the AML/CFT program and Board of Directors oversight averages approximately 8 hours per year. The Agencies assume that all their supervised entities will review their AML/CFT program annually and will submit the revised plan for Board of Director ratification every year.

Estimated Annual Burden:

Comments are invited on the following:

(a) Whether the collections of information are necessary for the proper performance of the agencies' functions, including whether the information has practical utility;

(b) the accuracy of the agencies estimates of the burden of the information collections, including the validity of the methodology and assumptions used;

(c) ways to enhance the quality, utility, and clarity of the information to be collected;

(d) ways to minimize the burden of the information collections on respondents, including through the use of automated collection techniques or other forms of information technology; and

(e) estimates of capital or start-up costs and costs of operation, maintenance, and purchase of services to provide information.

Comments on aspects of this document that may affect reporting, recordkeeping, or disclosure requirements and burden estimates should be sent to the addresses listed in the ADDRESSES section of this document. Written comments and recommendations for these information collections also should be sent within 30 days of publication of this document to www.reginfo.gov/public/do/PRAMain . Find this particular information collection by selecting “Currently under 30-day Review—Open for Public Comments” or by using the search function.

OCC:

The Regulatory Flexibility Act (RFA), 5 U.S.C. 601 et seq., requires an agency, in connection with a proposed rule, to prepare an Initial Regulatory Flexibility Analysis describing the impact of the rule on small entities (defined by the Small Business Administration (SBA) for purposes of the RFA to include commercial banks and savings institutions with total assets of $850 million or less and trust companies with total assets of $47 million or less) or to certify that the proposed rule would not have a significant economic impact on a substantial number of small entities. The OCC currently supervises approximately 636 small entities. 34 The proposed rule would impact all small entities.

The OCC estimates the annual cost for small entities to comply with the proposed rule would be approximately $3,072 dollars per bank (24 hours × $128 per hour). In general, the OCC classifies the economic impact on a small entity as significant if the total estimated impact in one year is greater than 5 percent of the small entity's total annual salaries and benefits or greater than 2.5 percent of the small entity's total non-interest expense. Based on these thresholds, the OCC estimates the proposed rule would have a significant economic impact on zero small entities, which is not a substantial number. Therefore, the OCC certifies that the proposed rule would not have a significant economic impact on a substantial number of small entities.

Board:

The Board is providing an initial regulatory flexibility analysis with respect to this proposal. The RFA, requires an agency to consider whether the rules it proposes will have a significant economic impact on a substantial number of small entities. In connection with a proposed rule, the RFA requires an agency to prepare an Initial Regulatory Flexibility Analysis describing the impact of the rule on small entities or to certify that the proposed rule would not have a significant economic impact on a substantial number of small entities. An initial regulatory flexibility analysis must contain (1) a description of the reasons why action by the agency is being considered; (2) a succinct statement of the objectives of, and legal basis for, the proposed rule; (3) a description of, and, where feasible, an estimate of the number of small entities to which the proposed rule will apply; (4) a description of the projected reporting, recordkeeping, and other compliance requirements of the proposed rule, including an estimate of the classes of small entities that will be subject to the requirement and the type of professional skills necessary for preparation of the report or record; (5) an identification, to the extent practicable, of all relevant Federal rules which may duplicate, overlap with, or conflict with the proposed rule; and (6) a description of any significant alternatives to the proposed rule which accomplish its stated objectives.

The Board has considered the potential impact of the proposal on small entities in accordance with the RFA. Based on its analysis and for the reasons stated below, the proposal is not expected to have a significant economic impact on a substantial number of small entities. Nevertheless, the Board is publishing and inviting comment on this initial regulatory flexibility analysis. The Board will consider whether to conduct a final regulatory flexibility analysis after any comments received during the public comment period have been considered.

As explained above, the Board is amending its AML/CFT compliance program rule to align with changes that are being concurrently proposed by FinCEN and are required of FinCEN by the AML Act. The proposed rule incorporates a risk assessment process in the Board's AML/CFT program rule that requires, among other things, consideration of the national AML/CFT Priorities published by FinCEN. It also would align other requirements, such as customer due diligence requirements, with FinCEN's rule and propose clarifying and other amendments to codify longstanding supervisory expectations.

The Board's intent is to have AML/CFT program requirements for applicable institutions remain consistent with those imposed by FinCEN. Further, with consistent regulatory text, these institutions will not be subject to any additional burden or confusion from needing to comply with differing standards between FinCEN and the Board. The Board proposes to promulgate this rule pursuant to its safety and soundness authority and under section 8(s) of the FDI Act, 12 U.S.C. 1818(s), which requires the Board to issue regulations requiring supervised institutions to “establish and maintain procedures reasonably designed to assure and monitor the compliance” of the institutions with the requirements of the BSA.

The proposal would apply to state member banks; Edge and agreement corporations; and branches, agencies, or representative offices of a foreign bank operating in the United States (other than a Federal branch or agency or a state branch that is insured by the FDIC) (“Board-supervised institutions”). 35 There are approximately 464 Board-supervised institutions that are small entities for purposes of the RFA. 36

The proposed rule would revise 12 CFR 208.63 to require Board-supervised institutions to establish and maintain an “effective” and “reasonably designed” AML/CFT program. Such a program must include: a risk assessment process that will serve as the basis for the AML/CFT program and includes, among other things, consideration of national AML/CFT priorities; one or more qualified AML/CFT compliance officers; policies, procedures and internal controls commensurate to address the bank's illicit finance risks; risk-based procedures for conducting ongoing CDD; an ongoing employee training program; and, independent, periodic AML/CFT program testing performed by qualified persons. The proposed rule would also incorporate a statutory requirement of the AML Act that persons with a duty of establishing, maintaining, and enforcing the AML/CFT program be in the United States and accessible to oversight and supervision by the appropriate regulator.

The Board estimates a rate of $51.20 per hour as the compensation associated with complying with the proposed rule. 37 The estimated cost and burden to comply with the requirement to update programs to incorporate the new definition of “AML/CFT program” would be minimal, as this is essentially a change in terminology. Likewise, complying with the additional regulatory requirement to conduct a risk assessment incorporating the AML/CFT priorities would not impose significant additional burden because this is an existing, longstanding supervisory expectation for Board-supervised institutions and because the priorities reflect longstanding AML/CFT concerns previously identified by FinCEN and governmental agencies. 38 Accordingly, Board-supervised institutions should already have a risk assessment incorporating the AML/CFT priorities and the other components of the proposed rule in place. The Board estimates that the additional burden associated with these minimal changes on small entities to be approximately $760,218 (32 hours × $51.20 per hour × 464 small entities) in the first year after adoption, and approximately $190,054 (8 hours × $51.20 per hour × 464 small entities) in each successive year.

The Board has not identified any Federal statutes or regulations that would duplicate, overlap, or conflict with the proposal, other than FinCEN's proposed AML/CFT program rule, described above. In addition, the Board considered the alternative of leaving its program rule unrevised but determined not to do so, for the reasons explained in the Alternatives section above.

NCUA:

As of December 2023, the NCUA supervised 4,604 federally insured credit unions (FICUs). The agency considers FICUs with fewer than $100 million in assets to be small entities for purposes of the RFA. At year-end 2023, 2,831 FICUs qualified as small—61.5 percent of supervised institutions. Typically, credit unions are much smaller than banks. At year end, for example, the median asset size for FICUs was $55.9 million (roughly one-sixth the commercial bank median); the median asset size of small FICUs (assets <$100 million) was $20.8 million. FICUs near the median typically report five full-time equivalent employees (FTEs). Because this rule applies to FICUs of all sizes, it will undoubtedly affect small credit unions. Both qualitative and quantitative evidence, however, point to an economically insignificant impact on small FICUs.

As for qualitative evidence, the NCUA already expects FICUs to maintain robust BSA-AML policies, consistent with the size and scope of the credit union. The NCUA believes this rule will marginally tighten supervisory expectations relative to the current regime. Of course, adapting to marginal changes could still prove challenging for credit unions with as few as five FTEs. For that reason, the NCUA has resources available to help small credit unions adjust to such challenges and, more broadly, support overall growth and development.

As for quantitative evidence, the OCC and FDIC present analysis showing the number of supervised institutions for whom compliance will potentially be burdensome. The threshold for “burdensome” is a compliance cost exceeding five percent of compensation expense or 2.5 percent of total non-interest expense. The NCUA believes these hurdles do not automatically carry over to FICUs because of the significant differences between the size, structure, and operation models of banks and credit unions. Unlike commercial banks, for example, credit unions are cooperatives. And, historically, many small credit unions have relied on volunteers and sponsor support to contain expenses—thereby suggesting the threshold for materiality should be higher for credit unions. But even assuming that every small credit union needs 32 hours to comply with the rule, that all credit unions pay the average hourly wage for FICUs with fewer than $100 million in assets, and the bank thresholds for materiality are appropriate, the number of credit unions facing a significant compliance burden is roughly in line with the figures obtained by the FDIC.

FDIC:

The RFA, generally requires an agency, in connection with a proposed rule, to prepare and make available for public comment an initial regulatory flexibility analysis that describes the impact of the proposed rule on small entities. 39 However, an initial regulatory flexibility analysis is not required if the agency certifies that the proposed rule will not, if promulgated, have a significant economic impact on a substantial number of small entities. The SBA has defined “small entities” to include banking organizations with total assets of less than or equal to $850 million. 40 Generally, the FDIC considers a significant economic impact to be a quantified effect in excess of 5 percent of total annual salaries and benefits or 2.5 percent of total noninterest expenses. The FDIC believes that effects in excess of one or more of these thresholds typically represent significant economic impacts for FDIC-supervised institutions. For the reasons provided below, the FDIC certifies that the proposed rule would not have a significant economic impact on a substantial number of small banking organizations. Accordingly, a regulatory flexibility analysis is not required.

As previously discussed, the proposed rule would establish consistency with the AML Act and FinCEN's proposed regulation, clarify existing requirements and make certain technical changes, if adopted. All FDIC-supervised Insured Depository Institutions (IDI) are required to comply with AML/CFT program requirements. As of the quarter ending December 31, 2023, the FDIC supervised 2,936 institutions, 41 of which 2,221 are considered small entities for the purposes of RFA. 42 Therefore, the FDIC estimates that the proposed rule would directly affect all 2,221 small, FDIC-supervised IDIs.

The proposed rule introduces changes that are unlikely to substantively affect small, FDIC-supervised IDIs. The proposed rule includes a purpose statement similar to the one FinCEN is proposing at 31 CFR 1010.210(a), without establishing new obligations.

The proposed rule would amend the current requirements to maintain a “reasonably designed” BSA compliance program by replacing it with a requirement to maintain an “effective, risk-based, and reasonably designed AML/CFT program.” Further, the proposed rule would add the term “AML/CFT” to its regulations consistent with the AML Act. The FDIC believes that proposed terms “effective” and “risk-based” are implicit in the term “reasonably designed” as established in the current BSA compliance program. The FDIC does not anticipate that the inclusion of “CFT” in the program rules will establish new obligations or impose additional costs or burdens. Therefore, the FDIC believes that these proposed changes are unlikely to be substantive for small, FDIC-supervised institutions.

The proposed rule would adopt a requirement that a small, FDIC-supervised IDI's AML/CFT compliance program “focuses attention and resources in a manner consistent with the [bank's] risk profile that takes into account higher-risk and lower-risk customers and activities . . .” However, the FDIC believes that it is both a long-standing practice of the industry and supervisory expectation, that the AML/CFT program of covered entities be risk-based. Further, banks already evaluate customers and activities according to risk as part of existing requirements under CDD and suspicious activity monitoring. Therefore, the FDIC believes that this aspect of the proposed rule is unlikely to have any substantive effect on small, FDIC-supervised IDIs.

If adopted, the proposed rule would establish that an AML/CFT program include a risk assessment process. For more than fifteen years the Federal Financial Institutions Examination Council Bank Secrecy Act/Anti-Money Laundering Examination Manual (FFIEC BSA/AML Examination Manual) has recognized the use of risk assessments by banks to structure their risk-based compliance programs and has set forth guidance to examiners in reviewing risk assessment processes. The FDIC believes that most banks will be able to leverage their existing risk assessment processes to comply with this aspect of the proposed rule. Further, the business activity factors listed are generally consistent with banks' current risk assessment practices and the Agencies' supervisory expectations. Therefore, the FDIC believes that these proposed changes are unlikely to be substantive for small, FDIC-supervised institutions.

The proposed rule would amend an existing requirement for banks to establish and maintain a system of internal controls to maintain compliance. Specifically, the proposed rule would require that a bank “[r]easonably manage and mitigate money laundering, terrorist financing, and other illicit finance activity risks through internal policies, procedures, and controls that are commensurate with those risks and ensure ongoing compliance with the recordkeeping and reporting requirements of the Bank Secrecy Act.” Based on supervisory experience, the FDIC believes that most small, FDIC-supervised IDIs have already implemented internal policies, procedures, and controls to manage and mitigate ML/TF risks. As a result, the FDIC believes that the proposed paragraph (b)(2)(ii) will impose minimal additional compliance burden.

As previously discussed, the proposed rule would make several changes to the existing requirement that banks designate a compliance officer as part of its BSA compliance program. Specifically, the FDIC proposes to change the regulatory reference from “BSA” or “BSA Compliance” officer to “AML/CFT officer” to formally reflect the CFT considerations for this role under the AML Act. The FDIC believes that this change does not impose a new obligation on small, FDIC-supervised IDIs. Further, the proposed rule also adds the word “qualified” to the FDIC's existing compliance officer requirement, but does not change substantively the current requirements concerning a bank's BSA officer. Therefore, the FDIC believes that this aspect of the proposed rule is unlikely to have any substantive effect on small, FDIC-supervised IDIs.

As previously discussed, the proposed rule would clarify that independent testing must be conducted periodically by qualified personnel of the bank or by a qualified outside party. Since the original adoption of the BSA compliance program rule, the FDIC has required that banks perform independent testing. The Agencies have not defined “periodic” so as to enable small, FDIC-supervised IDIs to comply with the independent testing requirement in a manner that is most appropriate to their activities, systems, customers and risks. Therefore, the FDIC believes that this aspect of the proposed rule is unlikely to substantively affect small, FDIC-supervised IDIs.

If adopted, the proposed rule would add CDD as a required component of the FDIC's AML/CFT compliance program rule requirements. The inclusion of CDD mirrors FinCEN's existing rule and reflects the FDIC's long-standing supervisory expectations. Therefore, the FDIC believes that this aspect of the proposed rule will impose minimal additional compliance burden.

If adopted, the proposed rule would require that the documented program be made available to the Agencies upon request. The proposed rule modifies the operative term from “in writing” to “documented,” but does not substantively change the requirement that the program be written. Therefore, the FDIC does not believe that this aspect of the final rule will pose any substantive burden on small, FDIC-supervised IDIs.

The proposed rule incorporates the statutory requirement for the AML/CFT program to be plainly subject to board oversight, or oversight of an equivalent governing body. The FDIC does not view this as a new requirement, as board approval of the AML/CFT program is implicit in the existing requirements. Therefore, the FDIC believes this aspect of the proposed rule will impose no additional compliance burden.

As previously discussed, the proposed rule would amend the FDIC's “BSA” or “AML” program regulations by adopting the term “AML/CFT,” in place of “BSA” or “AML” program rules. Further, the proposed rule would amend the existing training requirement in the FDIC's BSA compliance program rules to clarify that banks must have an “ongoing” employee training program. The BSA and the FDIC's current BSA/AML compliance program rules have long required banks to have an “ongoing employee training program.” Therefore, the FDIC believes that these changes are clarifying or technical in nature and do not substantively change requirements for small, FDIC-supervised institutions.

The proposed rule would make several changes that could substantively affect small, FDIC-supervised IDIs. In particular, the proposed rule would require FDIC-supervised institutions to incorporate the Treasury Secretary's priorities for anti-money laundering and countering the financing of terrorism policy (AML/CFT Priorities), as appropriate, into their AML/CFT compliance program. The FDIC believes that most banks will be able to leverage their existing risk assessment processes when considering their exposure to each of the AML/CFT Priorities. However, incorporation of the AML/CFT Priorities into the risk assessment process will likely pose some regulatory and recordkeeping costs to covered institutions in order to achieve compliance with this aspect of the proposed rule. The FDIC does not have the information necessary to estimate the costs small, FDIC-supervised IDIs are likely to incur, but believes that such costs are likely to be small.

As previously discussed, the proposed risk assessment process would require consideration of ML/TF and other illicit finance activity risks of a bank based on its business activities, including products, services, distribution channels, customers, intermediaries, and geographic locations. The FDIC believes that most banks are generally familiar with these business activity factors, however consideration of “distribution channels” and “intermediaries” may pose new regulatory costs for small, FDIC-supervised institutions. The FDIC does not have the information necessary to estimate the costs small, FDIC-supervised IDIs are likely to incur, but believes that such costs are likely to be small.

The proposed rule would require that banks review and evaluate information that the AML/CFT programs produce pursuant to 31 CFR chapter X, such as suspicious activity reports and currency transaction reports. As previously discussed, it has been both a long-standing industry practice and an expectation of the FDIC that AML/CFT programs be risk-based. As such, the FDIC believes that some small, FDIC-supervised IDIs may already review and evaluate information that the AML/CFT programs produce. However, the proposed incorporation of explicit consideration of such information may pose some new regulatory costs to small, FDIC-supervised IDIs. The FDIC does not have the information necessary to estimate the costs small, FDIC-supervised IDIs are likely to incur, but believes such costs are likely to be small.

Generally, the FDIC believes that the proposed rule is unlikely to burden small, FDIC-supervised IDIs by clarifying requirements and supporting a more efficient AML/CFT compliance program. The proposed rule would clarify and harmonize compliance requirements with the AML Act and FinCEN's proposed regulation, thereby benefiting covered entities by reducing confusion and duplicative compliance efforts. Further, the proposed rule would enable IDIs to focus attention and resources in a manner consistent with the bank's ML/TF risk profile, which takes into account higher-risk and lower-risk customers and activities. Finally, the proposed rule would encourage, but would not require, banks to consider, evaluate, and as appropriate, implement innovative approaches to meet compliance obligations pursuant to the BSA. Therefore, the proposed rule could enable more efficient allocation of resources to identify and manage risks.

Finally, the FDIC estimates that the proposed rule will pose some additional recordkeeping costs to small, FDIC-supervised IDIs associated with establishing policies, procedures and controls. The FDIC estimates that FDIC-supervised IDIs, including small IDIs, will expend 32 labor hours, on average, to incorporate the proposed rule's amendments into their existing policies and procedures in the first year after adoption. Further, in each successive year the FDIC estimates that FDIC-supervised IDIs will expend 8 labor hours, on average, to maintain and update those policies and procedures. The FDIC believes that these compliance requirements constitute recordkeeping burdens under the PRA. Therefore, the FDIC estimates that all small, FDIC-supervised IDIs will incur 71,072 labor hours in the first year after adoption complying with the recordkeeping requirements of the proposed rule, 43 and 17,768 labor hours in each subsequent year. 44

According to the FDIC's analysis small, FDIC-supervised IDIs will incur some costs to comply with the recordkeeping requirements of the proposed rule, however those costs are unlikely to be substantial. Employing a total hourly compensation estimate of $51.20, 45 the FDIC estimates that small, FDIC-supervised IDIs will incur $3,638,886.40 in compliance costs in the first year  46 after the final rule becomes effective, and $909,721.60 in compliance costs in each subsequent year. 47 However, in the first year after the final rule becomes effective, estimated average costs exceed the 5 percent threshold of annual salaries and benefits for only 3 (0.14 percent) small, FDIC-supervised IDIs, and exceed the 2.5 percent threshold of total non-interest expense for only 6 (0.27 percent) small, FDIC-supervised IDIs. 48 The FDIC estimates that the estimated recordkeeping compliance costs will exceed those thresholds for fewer small, FDIC-supervised IDIs in subsequent years.

The FDIC believes that covered institutions are likely to incur other regulatory costs to achieve compliance with the changes in this proposed rule, if adopted, such as changes to internal systems and processes. However, the FDIC believes that any such increased costs are unlikely to be substantial because, as previously discussed, the proposed rule would generally reflect long-standing industry practice and expectations and further clarify existing requirements.

Based on the information above, the FDIC certifies that the rule would not have a significant economic impact on a substantial number of small entities.

The FDIC invites comments on all aspects of the supporting information provided in this section, and in particular, whether the proposed rule would have any significant effects on small entities that the FDIC has not identified.

Section 722 of the Gramm-Leach-Bliley Act  49 requires the FDIC, OCC, and Federal Reserve Board to use plain language in all proposed and final rules published after January 1, 2000. While the NCUA is not subject to section 722 of the Gramm-Leach-Bliley Act, the Plain Writing Act of 2010 imposes similar, clear communication standards on the NCUA and its rulemakings. The Agencies have sought to present the proposed rule in a simple and straightforward manner. The Agencies invite comments on whether the proposal is clearly stated and effectively organized, and how the Federal banking agencies might make the proposal easier to understand. For example:

• Is the material presented in an organized manner that meets your needs? If not, how could this material be better organized?

• Are the requirements in the notice of proposed rulemaking clearly stated? If not, how could the proposed rule be more clearly stated?

• Does the proposed rule contain language that is not clear? If so, which language requires clarification?

• Would a different format (grouping and order of sections, use of headings, paragraphing) make the proposed rule easier to understand? If so, what changes to the format would make the proposed rule easier to understand?

• What else could make the proposed rule easier to understand?

The OCC has analyzed the proposed rule under the factors in the Unfunded Mandates Reform Act of 1995 (UMRA) (2 U.S.C. 1532). Under this analysis, the OCC considered whether the proposed rule includes a Federal mandate that may result in the expenditure by State, local, and tribal governments, in the aggregate, or by the private sector, of $100 million or more in any one year (adjusted annually for inflation).

The OCC has determined this proposed rule is likely to result in the expenditure by the private sector of $100 million or more in any one year (adjusted annually for inflation). The OCC has prepared an impact analysis and identified and considered alternative approaches. When the proposed rule is published in the Federal Register , the full text of the OCC's analysis will be available at: https://www.regulations.gov, Docket ID OCC-2024-0005.

Under section 2222 of the Economic Growth and Regulatory Paperwork Reduction Act of 1996 (EGRPRA), the Federal banking agencies are required to review all of their regulations, at least once every 10 years, in order to identify any outdated or otherwise unnecessary regulations imposed on insured institutions. 50 The Federal banking agencies and the NCUA  51 submitted a Joint Report to Congress on March 21, 2017 (EGRPRA Report) discussing how the review was conducted, what has been done to date to address regulatory burden, and further measures the Federal banking agencies will take to address issues that were identified. 52

Pursuant to section 302(a) of the Riegle Community Development and Regulatory Improvement Act (RCDRIA), 53 in determining the effective date and administrative compliance requirements for new regulations that impose additional reporting, disclosure, or other requirements on IDIs, each Agency must consider, consistent with principles of safety and soundness and the public interest, any administrative burdens that the regulations would place on depository institutions, including small depository institutions, and customers of depository institutions, as well as the benefits of the regulations. In addition, section 302(b) of RCDRIA requires new regulations and amendments to regulations that impose additional reporting, disclosures, or other new requirements on IDIs generally to take effect on the first day of a calendar quarter that begins on or after the date on which the regulations are published in final form, with certain exceptions, including for good cause. 54 The Agencies request comment on any administrative burdens that the proposed rule would place on depository institutions, including small depository institutions and their customers, and the benefits of the proposed rule that the Agencies should consider in determining the effective date and administrative compliance requirements for a final rule.

The Providing Accountability Through Transparency Act of 2023 (12 U.S.C. 553(b)(4)) requires that a notice of proposed rulemaking include the internet address of a summary of not more than 100 words in length of a proposed rule, in plain language, that shall be posted on the internet website under section 206(d) of the E-Government Act of 2002 (44 U.S.C. 3501 note) (commonly known as regulations.gov ).

In summary, the Agencies seek comment on a proposed rule that would amend the requirements that each Agency has issued for its supervised banks (currently referred to as “BSA compliance programs”) to establish, implement, and maintain effective, risk-based, and reasonably designed AML/CFT programs. The amendments are intended to conform with changes that are being concurrently proposed by FinCEN as a result of the AML Act.

The proposal and the required summary can be found at https://www.regulations.gov, https://occ.gov/topics/laws-and-regulations/occ-regulations/proposed-issuances/index-proposed-issuances.html, https://www.federalreserve.gov/apps/foia/proposedregs.aspx, and https://www.fdic.gov/resources/regulations/federal-register-publications/index.html#.

Executive Order 13132 encourages independent regulatory agencies to consider the impact of their actions on state and local interests. The NCUA, an independent regulatory agency as defined in 44 U.S.C. 3502(5), voluntarily complies with the executive order to adhere to fundamental federalism principles. This proposed rule would apply to all federally insured credit unions, including state-chartered credit unions. This scope is set by statute. The NCUA works cooperatively with state regulatory agencies on all supervisory matters, including BSA/AML matters, and will continue to do so. The NCUA expects that any effect on states or on the distribution of power and responsibilities among the various levels of government will be minor. The NCUA welcomes comments on ways to eliminate, or at least minimize, any potential impact in this area.

The NCUA has determined that this proposed rule would not affect family well-being within the meaning of section 654 of the Treasury and General Government Appropriations Act, 1999. 55 The proposed rule relates to federally insured credit unions' BSA/AML programs, and any effect on family well-being is expected to be indirect.

For the reasons stated in the preamble, the Office of the Comptroller of the Currency proposes to amend 12 CFR part 21 as follows:

The FAA invites the public to submit comments on the draft policy statement as specified in the ADDRESSES section. Commenters should include the subject line “Safety Continuum for Powered-lift” and docket number FAA-2024-1656 on all comments submitted to the FAA. The most helpful comments will reference a specific portion of the draft document, explain the reason for any recommended change, and include supporting data. The FAA will also consider all comments received on or before the closing date before issuing the final policy statement. The FAA will also consider late filed comments if it is possible to do so without incurring expense or delay.

The FAA recognizes that the public will benefit from adequate time to review the draft policy statement. Therefore, the FAA is extending the comment period for an additional 31 days to September 12, 2024.

You may examine the draft policy statement on the agency's public website and in the docket as follows:

• At www.regulations.gov in Docket FAA-2024-1656.

• At www.faa.gov/aircraft/draft_docs/.

The FAA invites you to send any written relevant data, views, or arguments about this proposal. Send your comments to an address listed under ADDRESSES . Include “Docket No. FAA-2024-2015; Project Identifier MCAI-2023-00769-T” at the beginning of your comments. The most helpful comments reference a specific portion of the proposal, explain the reason for any recommended change, and include supporting data. The FAA will consider all comments received by the closing date and may amend the proposal because of those comments.

Except for Confidential Business Information (CBI) as described in the following paragraph, and other information as described in 14 CFR 11.35, the FAA will post all comments received, without change, to regulations.gov, including any personal information you provide. The agency will also post a report summarizing each substantive verbal contact received about this NPRM.

CBI is commercial or financial information that is both customarily and actually treated as private by its owner. Under the Freedom of Information Act (FOIA) (5 U.S.C. 552), CBI is exempt from public disclosure. If your comments responsive to this NPRM contain commercial or financial information that is customarily treated as private, that you actually treat as private, and that is relevant or responsive to this NPRM, it is important that you clearly designate the submitted comments as CBI. Please mark each page of your submission containing CBI as “PROPIN.” The FAA will treat such marked submissions as confidential under the FOIA, and they will not be placed in the public docket of this NPRM. Submissions containing CBI should be sent to Yaser Osman, Aviation Safety Engineer, FAA, 1600 Stewart Avenue, Suite 410, Westbury, NY 11590; telephone 516-228-7300; email 9-avs-nyaco-cos@faa.gov. Any commentary that the FAA receives that is not specifically designated as CBI will be placed in the public docket for this rulemaking.

Transport Canada, which is the aviation authority for Canada, has issued Transport Canada AD CF-2023-42, dated June 19, 2023 (Transport Canada AD CF-2023-42) (also referred to after this as the MCAI), to correct an unsafe condition on certain Bombardier, Inc., Model BD-700-1A10 and BD-700-1A11 airplanes. The MCAI states that there have been multiple reports in service of missing or damaged inboard flap seal plates. An investigation revealed a premature fatigue failure mode of the inboard flap seal plates. Left uncorrected, an inboard flap seal plate may partially or totally detach. Under certain flight conditions, a missing inboard flap seal plate could lead to excessive buffeting and vibration, and consequent damage to the airplane.

The FAA is proposing this AD to address the unsafe condition on these products.

You may examine the MCAI in the AD docket at regulations.gov under Docket No. FAA-2024-2015.

The FAA reviewed Bombardier Service Bulletins 700-27-5509 and 700-27-6509, both Revision 01, both dated May 5, 2023. This material specifies procedures for repetitive detailed inspections for cracks of the attaching angles of the inboard flap seal plates and replacing the inboard flap seal plates if any crack is detected. This material also specifies procedures for replacing both existing inboard flap seal plates with structurally more robust redesigned components. The replacement actions include a detailed visual inspection for damage (including signs of failure, cracking, and deformation) of the flap inboard closing ribs and trailing edges, an eddy current or liquid penetrant inspection for cracks running out of the flap inboard closing rib holes common to the outboard stiffener and angle, and repair for cracks and other damage. The replacement would eliminate the need for the repetitive detailed inspections. These documents are distinct since they apply to different airplane models. This material is reasonably available because the interested parties have access to it through their normal course of business or by the means identified in the ADDRESSES section.

This product has been approved by the aviation authority of another country, and is approved for operation in the United States. Pursuant to the FAA's bilateral agreement with this State of Design Authority, it has notified the FAA of the unsafe condition described in the MCAI and material referenced above. The FAA is issuing this NPRM after determining that the unsafe condition described previously is likely to exist or develop on other products of the same type design.

This proposed AD would require accomplishing the actions specified in the material already described.

The FAA estimates that this AD, if adopted as proposed, would affect 43 airplanes of U.S. registry. The FAA estimates the following costs to comply with this proposed AD:

The FAA invites you to send any written relevant data, views, or arguments about this proposal. Send your comments to an address listed under ADDRESSES . Include “Docket No. FAA-2024-2007; Project Identifier MCAI-2023-01270-T” at the beginning of your comments. The most helpful comments reference a specific portion of the proposal, explain the reason for any recommended change, and include supporting data. The FAA will consider all comments received by the closing date and may amend the proposal because of those comments.

Except for Confidential Business Information (CBI) as described in the following paragraph, and other information as described in 14 CFR 11.35, the FAA will post all comments received, without change, to regulations.gov, including any personal information you provide. The agency will also post a report summarizing each substantive verbal contact received about this NPRM.

CBI is commercial or financial information that is both customarily and actually treated as private by its owner. Under the Freedom of Information Act (FOIA) (5 U.S.C. 552), CBI is exempt from public disclosure. If your comments responsive to this NPRM contain commercial or financial information that is customarily treated as private, that you actually treat as private, and that is relevant or responsive to this NPRM, it is important that you clearly designate the submitted comments as CBI. Please mark each page of your submission containing CBI as “PROPIN.” The FAA will treat such marked submissions as confidential under the FOIA, and they will not be placed in the public docket of this NPRM. Submissions containing CBI should be sent to Steven Dzierzynski, Aviation Safety Engineer, FAA, 1600 Stewart Avenue, Suite 410, Westbury, NY 11590; telephone: 516-228-7300; email: 9-avs-nyaco-cos@faa.gov. Any commentary that the FAA receives which is not specifically designated as CBI will be placed in the public docket for this rulemaking.

Transport Canada, which is the aviation authority for Canada, has issued Transport Canada AD CF-2023-78, dated December 19, 2023 (Transport Canada AD CF-2023-78) (also referred to as the MCAI), to correct an unsafe condition for all Bombardier, Inc., Model BD-100-1A10 airplanes. The MCAI states that airplanes could experience misleading electrical system status indications (push button annunciators (PBA) and engine indicating and crew alerting system (EICAS)) as a result of contamination of electrical contacts in the left-hand (LH) direct current power center (DCPC) internal communication data bus. The MCAI states that new or more restrictive maintenance tasks have been developed to rectify lower time LH DCPC units not addressed by previously issued AD's.

The FAA is proposing this AD to address erratic indications, which could cause the flightcrew to turn off fully operational electrical power sources, leading to partial or complete loss of electrical power. The unsafe condition, if not addressed, could result in loss of flight displays and reduced controllability of the airplane. You may examine the MCAI in the AD docket at regulations.gov under Docket No. FAA-2024-2007.

The FAA reviewed the following documents:

• Task 24-61-01-101, “Restoration of the left DC Power Center (DCPC) (Pre SB100-24-30),” Section 5-10-20, “Time Limits—Supplementary Limitations,” of Part 2, “Airworthiness Limitations”, of the Bombardier Challenger 300 BD-100 Time Limits/Maintenance Checks, Revision 24, dated August 9, 2023.

• Task 24-61-01-101, “Restoration of the Left DC Power Center (DCPC) (Pre SB350-24-005),” Section 5-10-20, “Time Limits—Supplementary Limitations,” of Part 2, “Airworthiness Limitations,” of the Bombardier Challenger 350 BD-100 Time Limits/Maintenance Checks, Revision 14, dated August 9, 2023.

This material specifies new or more restrictive airworthiness limitations for safe life limits.

This material is reasonably available because the interested parties have access to it through their normal course of business or by the means identified in ADDRESSES section.

This product has been approved by the aviation authority of another country and is approved for operation in the United States. Pursuant to the FAA's bilateral agreement with this State of Design Authority, the FAA has been notified of the unsafe condition described in the MCAI and material referenced above. The FAA is issuing this NPRM after determining that the unsafe condition described previously is likely to exist or develop on other products of the same type design.

This proposed AD would require revising the existing maintenance or inspection program, as applicable, to incorporate new or more restrictive maintenance tasks.

This proposed AD would require revisions to certain operator maintenance documents to include new actions ( e.g., inspections). Compliance with these actions is required by 14 CFR 91.403(c). For airplanes that have been previously modified, altered, or repaired in the areas addressed by this proposed AD, the operator may not be able to accomplish the actions described in the revisions. In this situation, to comply with 14 CFR 91.403(c), the operator must request approval for an alternative method of compliance according to paragraph (i)(1) of this proposed AD.

The FAA estimates that this AD, if adopted as proposed, would affect 356 airplanes of U.S. registry. The FAA estimates the following costs to comply with this proposed AD:

The FAA has determined that revising the maintenance or inspection program takes an average of 90 work-hours per operator, although the agency recognizes that this number may vary from operator to operator. Since operators incorporate maintenance or inspection program changes for their affected fleet(s), the FAA has determined that a per-operator estimate is more accurate than a per-airplane estimate. Therefore, the agency estimates the average total cost per operator to be $7,650 (90 work-hours x $85 per work-hour).

Title 49 of the United States Code specifies the FAA's authority to issue rules on aviation safety. Subtitle I, section 106, describes the authority of the FAA Administrator. Subtitle VII: Aviation Programs, describes in more detail the scope of the Agency's authority.

The FAA is issuing this rulemaking under the authority described in Subtitle VII, Part A, Subpart III, Section 44701: General requirements. Under that section, Congress charges the FAA with promoting safe flight of civil aircraft in air commerce by prescribing regulations for practices, methods, and procedures the Administrator finds necessary for safety in air commerce. This regulation is within the scope of that authority because it addresses an unsafe condition that is likely to exist or develop on products identified in this rulemaking action.

The FAA determined that this proposed AD would not have federalism implications under Executive Order 13132. This proposed AD would not have a substantial direct effect on the States, on the relationship between the national government and the States, or on the distribution of power and responsibilities among the various levels of government.

For the reasons discussed above, I certify this proposed regulation:

(1) Is not a “significant regulatory action” under Executive Order 12866,

(2) Would not affect intrastate aviation in Alaska, and

(3) Would not have a significant economic impact, positive or negative, on a substantial number of small entities under the criteria of the Regulatory Flexibility Act.

Accordingly, under the authority delegated to me by the Administrator, the FAA proposes to amend 14 CFR part 39 as follows:

The FAA invites you to send any written relevant data, views, or arguments about this proposal. Send your comments to an address listed under the ADDRESSES section. Include “Docket No. FAA-2024-2014; Project Identifier MCAI-2024-00162-E” at the beginning of your comments. The most helpful comments reference a specific portion of the proposal, explain the reason for any recommended change, and include supporting data. The FAA will consider all comments received by the closing date and may amend the proposal because of those comments.

Except for Confidential Business Information (CBI) as described in the following paragraph, and other information as described in 14 CFR 11.35, the FAA will post all comments received, without change, to regulations.gov , including any personal information you provide. The agency will also post a report summarizing each substantive verbal contact received about this NPRM.

CBI is commercial or financial information that is both customarily and actually treated as private by its owner. Under the Freedom of Information Act (FOIA) (5 U.S.C. 552), CBI is exempt from public disclosure. If your comments responsive to this NPRM contain commercial or financial information that is customarily treated as private, that you actually treat as private, and that is relevant or responsive to this NPRM, it is important that you clearly designate the submitted comments as CBI. Please mark each page of your submission containing CBI as “PROPIN.” The FAA will treat such marked submissions as confidential under the FOIA, and they will not be placed in the public docket of this NPRM. Submissions containing CBI should be sent to Ethan Carlson, Aviation Safety Engineer, FAA, 2200 South 216th Street, Des Moines, WA 98198. Any commentary that the FAA receives which is not specifically designated as CBI will be placed in the public docket for this rulemaking.

The FAA issued AD 2023-21-08, Amendment 39-22580 (88 FR 77889, November 14, 2023) (AD 2023-21-08), for certain RRD Model Trent 1000-A, Trent 1000-AE, Trent 1000-C, Trent 1000-CE, Trent 1000-D, Trent 1000-E, Trent 1000-G, and Trent 1000-H engines. AD 2023-21-08 was prompted by an MCAI originated by EASA, which is the Technical Agent for the Member States of the European Union. EASA issued EASA AD 2022-0259, dated December 20, 2022 (EASA AD 2022-0259) to correct an unsafe condition identified as the manufacturer revising the engine TLM life limits of certain critical rotating parts.

AD 2023-21-08 requires revisions to the ALS of the operator's existing approved AMP. The FAA issued AD 2023-21-08 to prevent the failure of critical rotating parts.

Since the FAA issued AD 2023-21-08, EASA superseded EASA AD 2022-0259 and issued EASA AD 2024-0062, dated March 6, 2024 (EASA AD 2024-0062) (also referred to as the MCAI). The MCAI states that the manufacturer published a revised TLM introducing new or more restrictive tasks and limitations. These new or more restrictive tasks and limitations include updating Direct Accumulation Counting data files.

You may examine the MCAI in the AD docket at regulations.gov under Docket No. FAA-2024-2014.

The FAA reviewed EASA AD 2024-0062, which specifies instructions for accomplishing the actions specified in the applicable TLM, including performing maintenance tasks, replacing life-limited parts, and revising the existing approved maintenance or inspection program, as applicable, by incorporating the limitations, tasks, and associated thresholds and intervals described in the TLM. This material is reasonably available because the interested parties have access to it through their normal course of business or by the means identified in the ADDRESSES section.

These products have been approved by the aviation authority of another country and are approved for operation in the United States. Pursuant to the FAA's bilateral agreement with this State of Design Authority, it has notified the FAA of the unsafe condition described in the MCAI referenced above. The FAA is issuing this NPRM after determining that the unsafe condition described previously is likely to exist or develop on other products of the same type design.

This proposed AD would retain none of the requirements of AD 2023-21-08. This proposed AD would require accomplishing the actions specified in the MCAI described previously, except for any differences identified as exceptions in the regulatory text of this proposed AD and except as discussed under “Differences Between this Proposed AD and the MCAI.”

In the FAA's ongoing efforts to improve the efficiency of the AD process, the FAA developed a process to use some civil aviation authority (CAA) ADs as the primary source of information for compliance with requirements for corresponding FAA ADs. The FAA has since coordinated with other manufacturers and CAAs to use this process. As a result, EASA AD 2024-0062 will be incorporated by reference in the final rule. This AD, therefore, requires compliance with EASA AD 2024-0062 in its entirety through that incorporation, except for any differences identified as exceptions in the regulatory text of this AD. Using common terms that are the same as the heading of a particular section in the EASA AD does not mean that operators need comply only with that section. For example, where the AD requirement refers to “all required actions and compliance times,” compliance with this AD requirement is not limited to the section titled “Required Action(s) and Compliance Time(s)” in EASA AD 2024-0062. Service information required by the EASA AD for compliance will be available at regulations.gov under Docket No. FAA-2024-2014.

Where EASA AD 2024-0062 specifies revising the approved AMP within 12 months after the effective date of EASA AD 2024-0062, this proposed AD requires revising the ALS of the existing approved aircraft maintenance or inspection program, as applicable, within 30 days after the effective date of this AD.

The FAA estimates that this AD, if adopted as proposed, would affect 28 engines installed on airplanes of U.S. registry.

The FAA estimates the following costs to comply with this proposed:

Title 49 of the United States Code specifies the FAA's authority to issue rules on aviation safety. Subtitle I, section 106, describes the authority of the FAA Administrator. Subtitle VII, Aviation Programs, describes in more detail the scope of the Agency's authority.

The FAA is issuing this rulemaking under the authority described in Subtitle VII, Part A, Subpart III, Section 44701: General requirements. Under that section, Congress charges the FAA with promoting safe flight of civil aircraft in air commerce by prescribing regulations for practices, methods, and procedures the Administrator finds necessary for safety in air commerce. This regulation is within the scope of that authority because it addresses an unsafe condition that is likely to exist or develop on products identified in this rulemaking action.

The FAA determined that this proposed AD would not have federalism implications under Executive Order 13132. This proposed AD would not have a substantial direct effect on the States, on the relationship between the national government and the States, or on the distribution of power and responsibilities among the various levels of government.

For the reasons discussed above, I certify that the proposed regulation:

(1) Is not a “significant regulatory action” under Executive Order 12866,

(2) Would not affect intrastate aviation in Alaska, and

(3) Would not have a significant economic impact, positive or negative, on a substantial number of small entities under the criteria of the Regulatory Flexibility Act.

Accordingly, under the authority delegated to me by the Administrator, the FAA proposes to amend 14 CFR part 39 as follows:

The FAA Extension, Safety, and Security Act of 2016 (2016 FAA Extension Act) requires the Department to review U.S. air carrier family seating policies and, if appropriate, direct air carriers to establish policies that enable young children, age 13 and under, to sit adjacent to an accompanying family member, age 14 or over, to the maximum extent practicable and at no additional cost. 1 In response to this directive, in 2017, the Department's Office of Aviation Consumer Protection (OACP) reviewed family seating complaints received between June 1, 2016 and June 1, 2017, to better understand the issues facing consumers. OACP also conducted a review of the nine largest U.S. airlines'  2 family seating policies and had discussions with each of these airlines to learn about their family seating policies, practices, and procedures. Based on its review of airline family seating policies and consumer complaints, the Department determined that it was unnecessary to direct airlines to establish policies that enable a child to sit next to an adult family member at that time.

OACP conducted a follow-up review in 2019 and learned that airlines had implemented enhanced approaches for providing family seating ( e.g., more than one airline had developed an automated system to assign young children to seats next to an adult family member), but airlines did not guarantee family seating. Also, the total number of family seating complaints against U.S. airlines received by the Department trended slightly higher from July 2017 through June 2019. 3 In the Joint Explanatory Statement accompanying the Consolidated Appropriations Act of 2019, the House and Senate Committees on Appropriations (Committees) requested that the Department provide a report to the Committees “on its review of family seating policies and a justification for its decision to defer to current airline seating policies,” noting that the Department has stated that it completed its review and deferred to current airline family seating policies. 4 The Department submitted the requested report to the Committees on March 12, 2020. In that report, the Department concluded that “[i]n lieu of directing airlines to establish specific seating policies, [it would] continue[ ] to update the family seating web page . . . [and] monitor and review the family seating complaints it receives on a regular basis to better understand what is and is not working.”

In July 2021, DOT Secretary Buttigieg and other officials from the Department met with consumer advocates who, as one of their top priorities, urged the Department to issue a rule requiring airlines to seat children next to at least one adult family member at no additional cost. The consumer advocates emphasized that, while the number of complaints about children being seated apart from an accompanying adult on a flight may not be large, the harm to the children who are separated is significant. After the meeting, the Department publicly stated that it would review this matter again to determine what other actions should be taken. 5

In July 2022, the Department issued a notice encouraging airlines to review and improve, as needed, their policies and procedures to ensure young children are seated adjacent to at least one accompanying adult to the maximum extent practicable and at no additional cost. 6 In the notice, the Department asked airlines to review and improve their policies and procedures and stated that, four months from the date of the notice, it would initiate a review of airlines' family seating policies to ensure that children aged 13 or younger would be seated adjacent to an accompanying adult without paying an additional fee. In November 2022, the Department reviewed the ten largest U.S. airlines'  7 family seating policies and discovered that airlines generally promised to make efforts to seat families together, but many required families to pay an additional fee to be assured that a young child traveling in the party would be seated adjacent to an accompanying adult.

In February 2023, the President called upon Congress to ban airline family seating fees and announced that the Department would publish a family seating fee dashboard and initiate a rulemaking to ban the practice. 8 The Secretary of Transportation (Secretary) also announced the Department's plan to launch a dashboard that provides information to air travelers on the largest airlines' guarantees to seat young children adjacent to at least one accompanying adult without the traveler having to pay an additional fee.

In anticipation of the dashboard's release, some airlines amended their family seating policies and added language to their customer service plans guaranteeing that they would provide adjacent seats for young children 13 or under traveling with an accompanying adult at no additional cost, subject to limited conditions. When the Department's family seating dashboard was published on OACP's website on March 6, 2023, only three out of the ten largest U.S. carriers had committed to guaranteeing adjacent seating for families at no additional cost. Since then, one additional airline has made that commitment. 9

Because most airlines would not guarantee that they would seat a parent and a child together at no extra cost, the Department initiated this rulemaking to ensure a young child is able to sit adjacent to an accompanying adult. On March 10, 2023, the Secretary also submitted a legislative proposal to Congress to amend chapter 417 of title 49, U.S. Code, to ensure that young children are seated adjacent to at least one accompanying adult at no additional cost, subject to certain conditions. 10

The Department views family seating as a basic service, essential for the provision of adequate air transportation, that should be provided to passengers at no additional cost. As described in the Regulatory Impact Analysis (RIA) developed in support of this rulemaking, the Department estimates the percentage of consumers, including families with young children, who may pay seating fees. According to complaints received by DOT, some parents mistakenly assume that they will be seated next to their young children when they purchase tickets for air transportation. 11 These passengers assume that fee-free family seating is already required because a parent would need to supervise and tend to their child during a flight, not to mention the potential harm that may occur from a child being separated from a parent during a flight.

Based on the nature and severity of the complaints the Department has received, and the reluctance shown by the majority of the largest U.S. airlines to amend their family seating policies to guarantee family seating at no additional cost, demonstrates a need for action in this area. Additionally, the Department received several hundred comments on its Enhancing Transparency of Airline Ancillary Service Fees NPRM that urged the Department to ban family seating fees, rather than requiring that those fees be disclosed to consumers early in the purchasing process. 12

Specifically, the Department is concerned about the hardship experienced by families when they are unable to ensure family seating in advance of travel and about families paying extra fees just to ensure that they are seated with their children. Furthermore, a carrier's failure to provide family seating harms not only passengers traveling with young children, but also other passengers on the aircraft who may be asked or directed to give up their seats to accommodate families on the day of travel or who may be required to sit next to an unsupervised child.

Consumers traveling with young children have reported feeling undue stress and anxiety when they are unable to receive assurances from carriers before the date of travel that they will be seated next to their young children. Although most airlines have indicated that their gate agents and flight crew will attempt to seat families together during the boarding process, these attempts are often taxing and, sometimes, unsuccessful. In one passenger complaint received by the Department, the passenger alleges that she purchased a “basic” ticket, and she was assigned a seat in a different row than her 4-year-old son. 13 She states that her son was assigned to a seat in between two men that she had never met before, and the flight attendant onboard the aircraft refused to assist her with asking passengers to shuffle seats because it was a full flight. Similarly, the Department received another consumer complaint alleging that a 10-year-old child suffered an anxiety attack when, at the start of boarding, the child was still assigned to a seat in a separate row from his parents. 14

The Department is also concerned that the carriers that do not guarantee family seating advise passengers to purchase advance seat assignments, purchase seats in a higher fare class, or pay a fee to receive early boarding on the aircraft, simply to ensure that families are seated together. Many U.S. airlines offer basic economy, or another equivalent low-cost economy ticket. These low-cost economy ticket options typically do not allow passengers to select a seat assignment for free. Thus, if a passenger wants to ensure that they will receive a seat assignment next to their child in advance of the flight, carriers that do not guarantee free family seating typically advise passengers to either pay the advance seat assignment selection fee, or purchase seats that cost more than the low-cost economy tickets to be assured of seats adjacent to their young child. Thus, families traveling with young children are being forced to purchase a more expensive fare to ensure that they are seated with their young children.

Most carriers have indicated to the Department that they would try to make accommodations at the airport to ensure that families are seated together, regardless of the fare purchased by the passenger. Nonetheless, passengers who purchase low-fare economy tickets for their family have reported having difficulty when attempting to obtain family seating at the gate, and have, in some instances, been shamed by airlines for failing to purchase a higher fare ticket to ensure that their family will be assigned adjacent seats.

To illustrate, one passenger alleged that she purchased inexpensive seats on a large U.S. carrier and when she approached a gate agent on the day of travel, the agent initially refused to assign her a seat next to her two-year old and four-year old children and stated that she should have booked in a “higher class.”  15 The passenger states that the agent eventually facilitated new seat assignments for her family, but she was upset by the lack of empathy shown by the agent and the unpleasantness of the encounter. In another complaint received by the Department, a passenger alleges that she was seated eight rows apart from her 3-year-old child and that the airline stated that it hoped she would be able to sit with her child on the day of travel or, in the alternative, that the passenger could pay for upgraded seats. 16

The Department also notes that even if a passenger reserves seats in advance, pays a fee to selects seats, or purchases seats in a higher class to ensure family seating, the passenger may be later assigned seats away from a young child in their travel party if the carrier changes the flight's aircraft. For example, the Department received a complaint from a passenger who alleges that he booked a flight for himself and his 8-year-old daughter. He states that when he booked his flight, he made sure that he reserved a seat directly next to his daughter, but when the airline changed the flight schedule, they also changed his seat assignment, and he was no longer seated next to his daughter. 17

Families have also identified child safety concerns as a major cause of stress and anxiety when a carrier does not provide passengers with assurances that they will be seated next to their young child on a flight. 18 In one passenger complaint received by DOT, a passenger alleges that her three children, all under the age of 13, were assigned seats away from the accompanying adults in their travel party. She states that she was concerned about the seating arrangement because there would be no responsible adult available to help her children with masks or life vests in the case of an emergency, no one to help her children load baggage into the overhead bin, and no assurances that her children were protected sitting next to strangers. 19 No family should have to worry about the safety of a young child, including during a potential emergency, because their child is seated rows away and next to complete strangers.

Additionally, carriers that do not guarantee family seating to passengers traveling with children cause harm to passengers traveling without children. When a carrier assigns a young child a seat away from their accompanying adult, other passengers must make the decision to sit next to an unsupervised child or to forfeit the seat they may have paid to obtain, to remedy a situation the carrier created. When a parent and child are seated apart, carriers rely heavily on the goodwill of other passengers on the aircraft to relinquish their seats to allow a child and a parent to be seated next to each other on the aircraft. However, due to carriers' seating policies, many passengers may have paid an additional fee for the seat they selected or have paid an additional fee to board the aircraft early. If the passenger elects not to relocate, the passenger would then sit next to, and potentially have to look after, an unsupervised child. Similarly, the Department views it as unreasonable for passengers who paid for early boarding to relinquish their seats to families traveling with young children to remedy the situation the carrier created. The seat switching process also creates a transaction cost on all parties involved, including delays in boarding and departure time, that could have been avoided if the family had already been assigned seats together prior to boarding, or in the case of open seating carriers, boarded in a manner that ensured family seating.

As described above, the Department has received various complaints describing stress-inducing incidents where families with very young children were assigned seats apart from a parent, and complaints describing fees that had to be paid to ensure that a parent was seated adjacent to their child. These additional costs can be a significant expense and can be a barrier for families who cannot afford to pay additional fees to ensure that a child in the travel party is seated adjacent to at least one accompanying adult.

In this rulemaking, the Department proposes to amend 14 CFR part 259, Enhanced Protections for Airline Passengers, and create a new 14 CFR part 261 Family Seating, to require U.S. and foreign air carriers to seat children aged 13 and under next to at least one accompanying adult at no additional cost, as defined in this rulemaking, subject to limited exceptions. Under this proposal, a carrier would be prohibited from imposing additional charges to provide adjacent seating. Failure to provide family seating at no additional cost beyond the fare, including by charging for seat selection or upgraded priority boarding, would subject the carrier to civil penalties on a per passenger (child) basis or a per fee basis. If an airline fails to provide adjacent seating as required by the proposed rule, it would be required to provide the passengers remedial choices.