Online Gambling: UIGEA Bank Final Rule Q&A Submitted

The Unlawful Internet Gambling Enforcement Act (UIGEA) was enacted into law in 2006. The  proposed rule implementing the legislation was published for comment in October 2007. The  Final Rule was issued on November 12, 2008.  

When does my bank have to be in compliance with the Final Rule? 

The Final Rule becomes effective on January 19th, 2009, but the more important date is  December 1, 2009 when compliance becomes mandatory.  

What will my bank have to do to comply with the Final Rule? 

In general, the Final Rule imposes certain responsibilities on banks to demonstrate through  written policies and procedures that they are taking precautions when opening commercial  accounts that may operate as illegal Internet gambling entities (casinos). If illegal Internet  casinos are denied the opportunity to open a bank account, they will be denied the opportunity  to make and receive payments. It also requires that banks have policies and procedures that  would prevent credit and debit card transactions from being made to Internet casinos for  unlawful Internet gambling by any of its customers, including individual, non-commercial  account holders. For these card transactions, banks may rely on the policies and procedures  established by the card networks and do not have to create a separate process. 

Does my bank have to monitor my customers' accounts to make sure that they are not  gambling illegally on the Internet?  

No. Your bank must "...establish and implement written policies and procedures reasonably  designed to identify and block or otherwise prevent or prohibit restricted transactions." Under  the final rule this means:  

1. Your bank must establish written policies and procedures to screen unlawful Internet  gambling businesses (casinos) from opening an account at your bank. Lawful Internet  gambling businesses will be required to provide extensive documentation at account  opening. Robust written policies and procedures will allow your bank to meet the Final  Rule's requirements. The Final Rule focuses on screening for unlawful Internet gambling  businesses at the time of account opening. If unlawful Internet gambling businesses are  prevented from accessing the banking system, then they will not be able to make or  receive payments using checks, wires, or ACH payments.  

2. Your bank is not required to monitor or determine whether its customer is a gambler  except that it must ensure that unlawful credit and debit card transactions are blocked. It  is the responsibility of the card network to establish policies and procedures to identify  and block unlawful transactions. The bank may rely on a written notice from the network  (Visa/MasterCard) stating that the policies and procedures that are in place meet the UIGEA Final Rule requirements. Banks are not required to validate this claim. The  networks may meet this threshold by conducting suitable due diligence checks on  commercial accounts or through establishing a code system that would allow card  issuers to identify and deny transactions that may be restricted.  

3. Your bank is not required to block ACH, wire, or check payments related to unlawful  Internet gambling to be in compliance with the Final Rule. 

How will my bank know which transactions to block if there is no definition of "unlawful  Internet gambling" included in the Final Rule?  

Your bank is not required to block ACH, wire, or check payments related to unlawful Internet  gambling to be in compliance with the Final Rule. Your bank will be allowed to rely on the  policies and procedures established by the card networks to block restricted debit and credit  card transactions. In other words, if your customer is the gambler, you do not have to block  gambling transactions except for debit and credit card transactions. In those cases, you may  rely on the network policies and procedures and merchant codes. 

The Final Rule requires that banks establish procedures during the account opening process to  identify commercial accounts that conduct Internet gambling business. It is the responsibility of  the commercial account applicant to provide documentation that its online gambling business is  lawful as per State or tribal law. Banks will not be required to make blocking decisions on individual transactions.  

What if the card networks' policies and procedures to prohibit restricted transactions  aren't effective?  

Your bank is allowed to rely on the certification of the payment system operator that it is in  compliance. The Agencies expect that federal regulators will examine the payment systems for  compliance purposes. 

How will my bank know which transactions to block if there is no list of unlawful Internet  gambling entities to screen payments against?  

Your bank is not required to compare and or block transactions against a government created  list of Internet gambling entities. The Agencies decided that creating such a list would not be  practical because of the difficulty in interpreting different state and federal laws on Internet  gambling. The Agencies also recognized the obstacles presented if banks were asked to  monitor and/or block transactions in real time. Instead, the Final Rule relies on the account  opening screening process to identify commercial customers who may pose a risk of conducting  Internet gambling business as casinos. If unlawful Internet gambling businesses are prevented  from opening an account, then they will be prohibited from conducting restricted transactions.  

Does my bank need to perform due diligence on existing individual or commercial accounts? 

No. However, your bank's policies and procedures should reflect the requirement to notify its commercial customers that "restricted transactions" are prohibited from being transacted through the account.  

Does my bank have to redesign all of its account opening documentation to demonstrate  how applicants are screened according to the UIGEA Final Rule? 

The focus of the Final Rule falls on commercial customer accounts. Your bank's policies and  procedures should be able to demonstrate that the following steps have been taken during the account opening process. This due diligence can be performed in conjunction with existing account opening processes that are already required with the Bank Secrecy Act. The Final Rule

does not require a separate set of questions be asked of new applicants. 

1. Determine whether the account is for an individual or commercial customer. 

2. For accounts determined to be for individuals, no further steps are required. 

3. For commercial accounts where the bank determines there is "minimal risk" of it being an Internet casino, no further steps are required. 

4. For commercial accounts where it can't be immediately determined that there is "minimal risk" the applicant that does not operate as an Internet casino should certify that they do not engage in Internet gambling business. For those that certify this, no further steps are required. 

5. For commercial accounts that do engage in Internet gambling business, they must provide evidence of their legal authority to do so, or a legal opinion, and, a third party certification of its age and location verification procedures (to ensure that restrictions on minors and geographic legalities are observed). This step places the burden of proving that that the Internet gambling entity is operating legally on the casino itself and its governing authorities.

How will the Final Rule affect my bank's foreign correspondent relationships?

Your bank will be expected to conduct an appropriate risk-based due diligence when establishing a foreign correspondent relationship. Your bank will NOT be required to conduct due diligence of commercial customers of the foreign correspondent.

The Final Rule will only apply to cross-border debits (ACH debits and check collections). If your bank is informed by a U.S. government entity (law enforcement agency or a regulator) that a foreign correspondent has sent your bank a restricted transaction, your bank will be expected to provide notice to that correspondent. A sample model notice is included with the Final Rule. 

What should my bank do if it suspects or obtains "actual knowledge" an individual customer is using their account to place bets? 

Transactions conducted by individuals are not subject to the Final Rule. However, nothing in the Final Rule changes your bank's obligation to file suspicious activity reports if you suspect a customer's behavior is suspicious. 

What should my bank do if it suspects or obtains "actual knowledge" a commercial account is being used as an Internet gambling business?

Your bank's written policies and procedures should describe what steps your bank will take when it has "actual knowledge" that one of your commercial customers is participating in restricted transactions. Your bank should use its own judgment as to when a customer would benefit from counseling on their infraction or if it were more appropriate to deny a customer access to a payment system or even to close the account. The Final Rule's drafters expect each bank's regulators to review each of these situations and assess whether the remedial action that was taken was appropriate.

The "actual knowledge" standard is met when a particular fact with regard to a commercial customer is known by or brought to the attention of an individual responsible for compliance functions at your bank or an officer of the organization.

Nothing in the Final Rule changes your bank's obligations to file suspicious activity reports. What are my bank's obligations under this Final Rule when third party processors are involved in transactions?

For the purposes of the Final Rule, third party processors are defined as entities that have the direct relationship with commercial customers, not the bank. The third party processors act as intermediaries between your bank and the commercial customer. The third party processors have the direct relationship with the commercial customer, not your bank, so they are obligated to perform the required due diligence. 

If your bank has hired a third party processor to facilitate payments on behalf of commercial customers that your bank has a direct relationship with, then your bank is obligated to perform the due diligence.

What liabilities does the Final Rule place on my bank if it inadvertently blocks a legitimate transaction?

The Final Rule provides liability protection if the blocked payment is: 

1. A restricted transaction, 

2. Reasonably believed to be a restricted transaction, or 

3. Blocked per the established policies and procedures of a payments system (Visa/MasterCard).

My bank has an established policy of not processing ANY gambling related transactions. Will this Final Rule force us to conduct transactions that we block today?

No. The Agencies do not believe that the UIGEA grants the authority to force a bank to process a payment that it currently blocks. If a bank has chosen to block all gambling transactions, for example, due to increased default risks, then they may continue to implement this 'business decision."