[Federal Register Volume 88, Number 224 (Wednesday, November 22, 2023)]
[Rules and Regulations]
[Pages 81345-81348]
From the Federal Register Online via the Government Publishing Office [www.gpo.gov]
[FR Doc No: 2023-25681]


=======================================================================
-----------------------------------------------------------------------

DEPARTMENT OF THE TREASURY

Office of the Secretary

31 CFR Part 1

RIN 1506-AB63


Privacy Act of 1974; Exemptions

AGENCY: Financial Crimes Enforcement Network (FinCEN), Treasury.

ACTION: Final rule.

-----------------------------------------------------------------------

SUMMARY: In accordance with the requirements of the Privacy Act of 
1974, as amended, Treasury is issuing a final rule, exempting a new 
system of records, entitled ``FinCEN .004--Beneficial Ownership 
Information System,'' from certain provisions of the Privacy Act. The 
Beneficial Ownership Information (BOI) System is being established to 
implement the beneficial ownership information reporting and access 
requirements set out in the Corporate Transparency Act (CTA), which was 
enacted on January 1, 2021, as part of the Anti-Money Laundering Act of 
2020. The exemptions are intended to increase the value of the system 
for law enforcement purposes and to comply with the CTA's prohibitions 
against unauthorized disclosure of certain information.

DATES: This rule is effective January 1, 2024.

FOR FURTHER INFORMATION CONTACT: For questions about this document and 
privacy issues, contact: Ryan Law, Deputy Assistant Secretary for 
Privacy, Transparency, and Records at U.S. Department of the Treasury, 
1500 Pennsylvania Avenue NW, Washington, DC 20220; telephone: (202) 
622-5710.

SUPPLEMENTARY INFORMATION: 

Background

    On September 14, 2023, Treasury published a notice of proposed 
rulemaking (the ``NPRM'') in the Federal Register, 88 FR 63039, 
proposing to exempt a system of records, FinCEN .004--Beneficial 
Ownership Information System (the ``BOI System''), from provisions of 
the Privacy Act. Pursuant to the CTA, starting on January 1, 2024, 
FinCEN will use the BOI System to maintain BOI submitted to FinCEN by 
certain corporations, limited liability companies, and other entities 
created in or registered to do business in the United States 
(``reporting companies''). BOI includes identifying information 
associated with the reporting companies themselves, their beneficial 
owners, and their company applicants. The BOI System will also maintain 
information about individuals who apply to FinCEN for FinCEN 
identifiers, which beneficial owners and company applicants will be 
able to use in lieu of the information required to be reported about 
them by reporting companies.\1\ Information provided to FinCEN to 
obtain a FinCEN identifier will be disclosed to authorized recipients 
for authorized purposes in the same way and to the same extent as BOI. 
The CTA authorizes FinCEN to disclose BOI to five categories of 
authorized recipients that include foreign and domestic law enforcement 
agencies, but do not include beneficial owners, company applicants, or 
individuals who have obtained FinCEN identifiers.
---------------------------------------------------------------------------

    \1\ Reporting companies will not use the FinCEN identifier 
application to request a FinCEN identifier but instead will request 
a FinCEN identifier when they submit a BOI report.
---------------------------------------------------------------------------

    The Privacy Act contains certain requirements regarding the 
maintenance and disclosure of a system of records. Those requirements 
may differ from, or conflict with, the comprehensive requirements for 
maintaining and disclosing BOI specified in the CTA. In any case where 
the CTA conflicts with the Privacy Act, FinCEN believes that the more 
detailed, specific provisions of the CTA supersede any contrary 
provisions in the Privacy Act. Nevertheless, to the extent certain 
provisions of the Privacy Act were to apply, and without conceding that 
they do, Treasury is publishing this final rule pursuant to 5 U.S.C. 
552a(j) and (k), to exempt the BOI System from those provisions.
    Under 5 U.S.C. 552a(j)(2), the head of a Federal agency may 
promulgate rules to exempt a system of records from certain provisions 
of 5 U.S.C. 552a if the system of records is maintained by an agency or 
component thereof that performs as its principal function any activity 
pertaining to the enforcement of criminal laws, including police 
efforts to prevent, control, or reduce crime or to apprehend criminals, 
and the activities of prosecutors, courts, correctional, probation, 
pardon, or parole authorities and which consists of (a) information 
compiled for the purpose of identifying individual criminal offenders 
and alleged offenders and consisting only of identifying data and 
notations of arrests, the nature and disposition of criminal charges, 
sentencing, confinement, release, and parole and probation status; (b) 
information compiled for the purpose of a criminal investigation, 
including reports of informants and investigators, and associated with 
an identifiable individual; or (c) reports identifiable to an 
individual compiled at any stage of the process of enforcement of the 
criminal laws from arrest or indictment through release from 
supervision.
    Under 5 U.S.C. 552a(k)(2), the head of a Federal agency may 
promulgate rules to exempt a system of records from certain provisions 
of 5 U.S.C. 552a if the system of records is ``investigatory material 
compiled for law enforcement purposes, other than material within the 
scope of subsection (j)(2) of this section.''
    The reasons for exempting the BOI System from sections (c)(3), 
(c)(4), (d)(1), (d)(2), (d)(3), (d)(4), (e)(1), (e)(2), (e)(4)(G), 
(e)(4)(H), (e)(5), (e)(8), (f), and (g) of the Privacy Act are as 
follows:
    (1) 5 U.S.C. 552a(d)(1), (e)(4)(H) and (f)(2), (f)(3), and (f)(5) 
grant individuals access to records containing information about them. 
An exemption from these provisions is appropriate because the CTA 
prohibits FinCEN from disclosing BOI except to five categories of 
authorized recipients; \2\ these categories do not include beneficial 
owners, company applicants, or individuals who have obtained FinCEN 
identifiers. Because individuals who are the subject of the records in 
the BOI System are not included in any of those categories, the 
application of 5 U.S.C. 552a(d)(1), (e)(4)(H) and (f)(2), (f)(3), and 
(f)(5) to the BOI System would contravene the CTA's disclosure 
restrictions.
---------------------------------------------------------------------------

    \2\ 31 U.S.C. 5337(c)(2).
---------------------------------------------------------------------------

    (2) 5 U.S.C. 552a(e)(4)(G) and (f)(1) enable individuals to inquire 
whether a system of records contains records about them. An exemption 
from these provisions is appropriate because allowing individuals 
involved in illegal activity to learn that FinCEN has information 
concerning those individuals that could lead to them being identified 
for investigation could undercut the CTA mandate that the BOI System be 
``highly useful'' to law enforcement agencies. For instance, such 
notice could prompt individuals engaged in illegal activity to: (a) 
take steps to avoid detection; (b) begin, continue, or resume illegal 
conduct upon learning that they are not identified in the system of 
records; or (c)

[[Page 81346]]

destroy evidence needed to prove the violation.
    (3) 5 U.S.C. 552a(d)(2), (d)(3) and (d)(4), (e)(4)(H), and (f)(4) 
permit individuals to request amendment of a record pertaining to them 
and require the agency either to amend the record or note the disputed 
portion of the record and, if the agency refuses to amend the record, 
to provide a copy of the individual's statement of disagreement with 
the agency's refusal, to persons or other agencies to whom the record 
is thereafter disclosed. Because these provisions depend on individuals 
having access to their records, and since this rule exempts the BOI 
System from the provisions of 5 U.S.C. 552a relating to access to 
records for the reasons set forth above, these provisions do not apply 
to the BOI System. Furthermore, an exemption from this requirement is 
appropriate because allowing individuals to amend certain records that 
pertain to them would conflict with the mechanism for reporting 
beneficial ownership information provided for in the CTA.
    (4) 5 U.S.C. 552a(c)(4) requires an agency to inform any person or 
other agency about any correction or notation of dispute that the 
agency made in accordance with 5 U.S.C. 552a(d) to any record that the 
agency disclosed to the person or agency, if an accounting of the 
disclosure was made. Because this provision depends on individuals 
having access to and an opportunity to request amendment of records 
pertaining to them, and because this rule exempts the BOI System from 
the provisions of 5 U.S.C. 552a relating to access to and amendment of 
records for the reasons set forth above, this provision does not apply 
to the BOI System.
    (5) 5 U.S.C. 552a(c)(3) requires an agency to make the accounting 
of any disclosures of records required by 5 U.S.C. 552a(c)(1) available 
to the individual named in the record upon his or her request. The 
accounting must state the date, nature, and purpose of each disclosure 
of the record and the name and address of the recipient. Applying this 
provision would impair the effective use of information collected in 
the BOI System. Making an accounting of disclosures available to the 
subject of an investigation would alert them that another agency is 
investigating their criminal activities and could reveal the geographic 
location of the other agency's investigation, the nature and purpose of 
that investigation, and the dates on which that investigation was 
active. Violators possessing such knowledge would be able to take 
measures to avoid detection or apprehension by: (a) altering their 
operations; (b) transferring their criminal activities to other 
geographical areas, legal entities, or ostensible beneficial owners; or 
(c) destroying or concealing evidence that would form the basis for 
arrest. Moreover, providing an accounting to the subjects of 
investigations would alert them to the fact that FinCEN has information 
relevant to their criminal activities. Access to such information, 
together with other available information, could reveal the operation 
of the information-gathering and analysis systems of FinCEN and other 
BOI System users, and permit violators to take steps to avoid detection 
or apprehension.
    (6) 5 U.S.C. 552a(e)(1) requires an agency to maintain in its 
records only such information about an individual as is relevant and 
necessary to accomplish a purpose of the agency required to be 
accomplished by statute or Executive order. Maintenance of information, 
as defined in 5 U.S.C. 552a(a)(3), includes the collection and 
dissemination of information. An exemption from this provision is 
therefore appropriate because its application would require FinCEN to 
make determinations at the time of collection about the relevance and 
necessity of collected information. Speculative determinations about 
the relevance and necessity of collected information could negatively 
impact the quality of information available to law enforcement in 
future investigations, which would undermine the mandate in the CTA 
that the BOI System be ``highly useful'' to law enforcement.
    (7) 5 U.S.C. 552a(e)(2) requires an agency to collect information 
to the greatest extent practicable directly from the subject individual 
when the information may result in adverse determinations about an 
individual's rights, benefits, and privileges under Federal programs. 
If such a program exists, an exemption to this provision is appropriate 
because applying it to the BOI System would contravene the requirement 
in the CTA that FinCEN collect BOI from reporting companies.
    (8) 5 U.S.C. 552a(e)(5) requires an agency to maintain all records 
it uses in making any determination about any individual with such 
accuracy, relevance, timeliness, and completeness as is reasonably 
necessary to assure fairness to the individual in the determination. 
Because 5 U.S.C. 552a(a)(3) defines ``maintain'' as including 
``collect'' and ``disseminate,'' applying this provision to the BOI 
System would hinder timely dissemination of BOI, and by extension 
hinder law enforcement efforts dependent upon such information. 
Information in the BOI System is filed by reporting companies and 
individual FinCEN identifier applicants, and it is not possible at the 
time of collection to determine whether the information in such records 
is accurate, relevant, timely, and complete.
    (9) 5 U.S.C. 552a(e)(8) requires an agency to make reasonable 
efforts to serve notice on an individual when the agency makes any 
record on the individual available to any person under compulsory legal 
process when such process becomes a matter of public record. Exemption 
from this requirement is appropriate because applying the requirement 
to the BOI System could reveal to the subject of a law enforcement 
investigation or action that a law enforcement agency used BOI in the 
investigation or action, thereby revealing the agency's investigative 
techniques and procedures.
    (10) 5 U.S.C. 552a(g) provides an individual with civil remedies 
when: (a) an agency wrongfully refuses to amend a record or to review a 
request for amendment; (b) an agency wrongfully refuses to grant access 
to a record; (c) any determination relating to an individual is based 
on records that are not accurate, relevant, timely and complete; and 
(d) an agency fails to comply with any other provision of 5 U.S.C. 552a 
so as to adversely affect the individual. The BOI System is exempt from 
this provision to the extent that the civil remedies relate to the 
provisions of 5 U.S.C. 552a from which the prior paragraphs of this 
section exempt the BOI System. Exemption from this provision is 
appropriate because there should be no civil remedies for failure to 
comply with provisions from which the BOI System is exempt. Exemption 
from this provision will also protect FinCEN from baseless civil court 
actions that might hamper its ability to collate, analyze, and 
disseminate data.
    Any information from a system of records for which an exemption is 
claimed under 5 U.S.C. 552a(j)(2) or (k)(2) which is also included in 
another system of records retains the same exempt status such 
information has in the system of records for which such exemption is 
claimed.

Public Comments

    Treasury received two comments on the NPRM. The first expressed 
support for the proposed rule, noting its ``import[ance] for protecting 
an individual's privacy, while also increasing the value of the [BOI 
System] for law enforcement purposes.''
    The second addresses the proposal to exempt the BOI System from the 
requirements of 5 U.S.C. 552a(c)(3) and

[[Page 81347]]

suggests a potential alternative approach. As explained above, that 
provision of the Privacy Act requires an agency to make the accounting 
of any disclosures of records required by 5 U.S.C. 552a(c)(1) available 
to the individual named in the record upon his or her request. The 
comment's author argues that fully exempting the BOI System from these 
requirements ``would make the [] audit trail required by the CTA 
meaningless'' and that ``[a]llowing for an accounting of disclosures to 
be made to the public would help ensure that the right to privacy would 
not be violated through unauthorized disclosures.'' The commenter 
suggests that the BOI System should be only partially exempt from 5 
U.S.C. 552a(c)(3) and that FinCEN should establish procedures under 5 
U.S.C. 552a(f)(2) that would make accountings of disclosures available 
to requesters after some specified amount of time has passed (the 
commenter proposes one year).
    FinCEN carefully considered this comment, particularly the 
commenter's claim that exempting the BOI System from the requirements 
of 5 U.S.C. 552a(c)(3) would make the system's audit trails 
meaningless. FinCEN interpreted this comment as asserting that BOI 
System audit trails would constitute ``accountings of disclosures'' 
that would only be meaningful if individuals about whom the system 
contains records have access to them. However, FinCEN disagrees with 
this view.
    In its ``Sense of Congress,'' the CTA directs the Secretary of the 
Treasury to ``take all steps, including regular auditing, to ensure 
that government authorities accessing beneficial ownership information 
do so only for authorized purposes consistent with [the CTA] . . . .'' 
\3\ Accordingly, FinCEN will use the BOI System's audit trails to 
identify potential instances of improper access to BOI by authorized 
system users. The audit trails will also support other aspects of the 
CTA compliance and enforcement regime, including the imposition of 
penalties, which will further help to ensure that BOI is accessed and 
used appropriately.
---------------------------------------------------------------------------

    \3\ CTA, section 6402(7)(B).
---------------------------------------------------------------------------

    Separately, for the reasons set out in the NPRM and reiterated 
above regarding the potential adverse impact on law enforcement 
investigations, Treasury declines to adopt the suggestion to make 
accountings of disclosures available to requesters after a specified 
period of time. Law enforcement investigations may span years and share 
common individuals of interest with concurrent investigations of 
equally varying durations. Revealing information about BOI disclosures 
to the subjects of those disclosures--even after a seemingly lengthy 
delay--could put those activities at risk of disruption and jeopardize 
the effective use of the BOI System for law enforcement purposes. 
Furthermore, a delay in making an accounting of disclosures available 
would not address the concern that such access could reveal information 
about the operation of the information-gathering and analysis systems 
utilized by FinCEN and other BOI System users. The resulting effect 
would be to postpone, rather than prevent, foreseeable harms to the law 
enforcement activities that Congress intended the BOI System to 
support. Such a result would contradict the purpose of the CTA and, 
therefore, Treasury will adopt the rule as proposed.

Regulatory Analysis

    This rule is not a ``significant regulatory action'' under 
Executive Order 12866, as amended.
    Pursuant to the requirements of the Regulatory Flexibility Act 
(RFA), 5 U.S.C. 601 et seq., it is hereby certified that this rule will 
not have a significant economic impact on a substantial number of small 
entities. The rule, issued under sections (j)(2) and (k)(2) of the 
Privacy Act, exempts certain information maintained by Treasury in the 
above-referenced systems of records from certain provisions of the 
Privacy Act. Small entities, as defined in the RFA, are not provided 
rights under the Privacy Act and are outside the scope of this 
regulation.
    In accordance with the provisions of the Paperwork Reduction Act of 
1995, 44 U.S.C. 3501 et seq., FinCEN has determined that this rule will 
not impose new recordkeeping, reporting, or other types of information 
collection requirements.

Lists of Subjects in 31 CFR Part 1

    Privacy.
    For the reasons stated in the preamble, part 1 of title 31 of the 
Code of Federal Regulations is amended as follows:

PART 1--DISCLOSURE OF RECORDS

0
1. The authority citation for part 1 continues to read as follows:

    Authority: 5 U.S.C. 301, 552, 552a, 553; 31 U.S.C. 301, 321; 31 
U.S.C. 3717.

0
2. Amend Sec.  1.36 by adding, in alphanumeric order, an entry for 
``FinCEN .004'' in table 7 to paragraph (c)(1)(vii) and table 17 to 
paragraph (g)(1)(ix) to read as follows:


Sec.  1.36  Systems exempt in whole or in part from provisions of the 
Privacy Act and this part.

* * * * *
    (c) * * *
    (1) * * *
    (vii) * * *

                    Table 7 to Paragraph (c)(1)(vii)
------------------------------------------------------------------------
                 No.                             Name of system
------------------------------------------------------------------------
 
                              * * * * * * *
FinCEN .004..........................  Beneficial Ownership Information
                                        System (not exempt from 5 U.S.C.
                                        552 a(e)(3) and 5 U.S.C.
                                        552a(e)(4)(I)).
------------------------------------------------------------------------

* * * * *
    (g) * * *
    (1) * * *
    (ix) * * *

[[Page 81348]]



                    Table 17 to paragraph (g)(1)(ix)
------------------------------------------------------------------------
                 No.                             Name of system
------------------------------------------------------------------------
 
                              * * * * * * *
FinCEN .004..........................  Beneficial Ownership Information
                                        System (not exempt from 5 U.S.C.
                                        552a(e)(3) and 5 U.S.C.
                                        552a(e)(4)(I)).
------------------------------------------------------------------------

* * * * *

Ryan Law,
Deputy Assistant Secretary Privacy, Transparency, and Records, U.S. 
Department of the Treasury.
[FR Doc. 2023-25681 Filed 11-21-23; 8:45 am]
BILLING CODE 4810-02-P