Apr 52024

FinCEN Seeks Input on Banks’ Collecting Partial Social Security Numbers for Customer Identification Programs

Joel D. Feinberg, David E. Teitelbaum and Stanley J. Boris
, , , ,

On March 28, 2024, the Financial Crimes Enforcement Network (FinCEN), in consultation with the U.S. banking agencies and the National Credit Union Administration, issued a request for information (RFI) regarding the customer identification program (CIP) requirement for depository institutions (referred to herein as banks) to collect tax identification numbers (TINs).1 Comments are due by May 28, 2024.

The RFI results from public interest expressed by banks, trade associations, and members of Congress about the Social Security number (SSN) collection requirement. FinCEN also recognizes that since it adopted the CIP requirement in 2003, there has been significant innovation in the way customers interact with financial institutions and receive financial services as well as significant innovation in the customer identification collection and verification tools available to financial institutions. Providing greater flexibility to banks in collecting SSNs would put non-credit-card products, including credit products offered through fintech partnerships, on a level playing field with traditional credit cards in terms of CIP requirements.

FinCEN is seeking information on the potential risks and benefits of permitting banks to collect a partial SSN (e.g., last four digits) from an individual for CIP purposes and using a reputable third-party source to obtain the full SSN prior to account opening. FinCEN also is interested in views regarding appropriate safeguards against identity theft. Under the current CIP requirement, a bank must collect the full SSN from an individual prior to opening an account, except with respect to credit card accounts, in which case a bank may obtain a SSN from a third-party source prior to extending credit to such individual.

FinCEN is also interested in comments from the public on whether permitting collection of partial SSNs by a bank prior to account opening may promote, with appropriate safeguards, increased accessibility to financial services for a broader population.

The RFI solicits responses to a series of specific questions and requests comments on suggested uses of FinCEN authorities, or changes to FinCEN regulations or guidance.

189 Fed. Reg. 22,231 (Mar. 29, 2024).

This post is as of the posting date stated above. Sidley Austin LLP assumes no duty to update this post or post about any subsequent developments having a bearing on this post.

Joel D. Feinberg

Washington, D.C.

jfeinberg@sidley.com

David E. Teitelbaum

Washington, D.C.

dteitelbaum@sidley.com

Stanley J. Boris

Washington, D.C.

sboris@sidley.com

You might also like
CMS Proposes Artificial Intelligence Limits and Utilization Management Guardrails for Medicare Advantage

On December 10, 2024, the Centers for Medicare & Medicaid Services (CMS) published a proposed rule with technical changes for the Medicare Advantage (MA) Program and the Medicare Prescription Drug Benefit Program for Calendar Year 2026 (Proposed Rule). Citing the growing use of Artificial Intelligence (AI) within the healthcare sector and reports that the use of AI may lead to “algorithmic discrimination” that exacerbates inequalities within healthcare, CMS proposes, for the first time, new guardrails that must be adopted by MA plans when using AI to manage patient care. CMS also proposes several reforms addressing utilization management (UM) techniques adopted by MA plans, including requirements for such plans to conduct and report detailed analyses on the use of prior authorizations. Notably, the Proposed Rule primarily modifies MA regulations, without direct application to the Medicare Part D prescription drug program.

EU AI Act: Are You Prepared for the “AI Literacy” Principle?

The EU AI Act is the world’s first horizontal and standalone law governing the commercialization and use of AI, and a landmark piece of legislation for the EU. Among the various provisions of the EU AI Act, the “AI literacy” principle is an often overlooked but key obligation which requires organizations to ensure that staff who are involved in the operation and use of AI have the necessary skills, knowledge and understanding to adequately assess AI-related risks and opportunities (e.g., through training and hiring staff with the appropriate background and skillset). This obligation – which applies from February 2, 2025 – is one of the few obligations under the EU AI Act that applies to all AI systems i.e., irrespective of the level of risk that the AI system presents. Indeed, by introducing AI literacy as one of the first provisions of the AI Act (Article 4), the EU legislators appear to underscore the significance of this requirement.

CFPB Releases Final Rule on Personal Financial Data Rights

On October 22, 2024, the U.S. Consumer Financial Protection Bureau (CFPB) issued a final rule under Section 1033 of the Consumer Financial Protection Act of 2010.1 The final rule includes several important changes from the proposed rule. This client alert focuses on those changes. For an analysis of the proposed rule, please see our Sidley Update here. The final rule also includes hundreds of pages of Supplementary Information that provide important insights into the manner in which the CFPB will enforce the final rule.