As we approach the midpoint of 2016, two of the most pressing matters in the payments industry have become more acute—the push for greater transparency and accountability in merchant acquiring and processing. From the Jeremy Johnson verdict to the Panama Papers, and now with the proposed "beneficial ownership" rule, regulators are pressing banks, payment processors, and independent sales organizations (ISOs) to both "know your customer" and take steps to limit the use of legitimate financial services for illicit purposes. Although the furor over Operation Chokepoint may have died down, the underlying concerns remain an important focus of financial regulators.
This article reviews these developments and explores how regulators will continue to pressure financial institutions to monitor their customers for signs of fraud or other illegal activity. Whether fair or not, the new reality is one where payments companies are expected to understand their customer's business and ownership structure, and monitor their customer's transactions for signs of illegitimate activity. With the beneficial ownership rule scheduled to become effective on July 11, 2016 (with mandatory compliance required by May 11, 2018), payment companies should begin reviewing their policies, procedures, and internal controls now in order to prepare for enhanced expectations of transparency and accountability.
Moving Beyond Operation Chokepoint
The Verdict—The Jeremy Johnson Saga. After several years of litigation, in March 2016, a jury found Jeremy Johnson guilty of 8 criminal counts of making false statements to a bank in connection with his merchant processing activities. According to the government, Johnson and several of his associates created dozens of companies that sold bogus government-grant and money-making schemes to consumers and then repeatedly charged monthly fees for these and other memberships the consumers never ordered (the "iWorks enterprise"). When acquiring banks began placing Johnson, iWorks, and his related companies on the Member Alert to Control High-risk Merchants (MATCH) List and closing his merchant accounts, Johnson and the other defendants conspired to form shell companies in order to apply for new merchant accounts to continue processing credit card sales.
The indictment describes the defendants' process of "rebranding"—meaning to cause the iWorks products to be sold under new names on websites created for the shell companies—and their use of "dummy" websites and other false information to have their applications approved by banks. As explained in the DOJ's sentencing memorandum, the defendants submitted merchant processing applications with false and misleading information "with the intention of and for the purpose of concealing from the bank iWorks['] true ownership and control of the accounts." Johnson is in jail pending sentencing, when he will face a maximum potential sentence of 240 years in prison. He also faces a separate Federal Trade Commission complaint that has been stayed pending final resolution of the criminal case.
The Bombshell—Release of the Panama Papers. Released in April, the Panama Papers refer to the more than 11 million documents from the Panamanian law firm Mossack Fonseca that have revealed widespread offshoring of funds by wealthy individuals through the use of identity-obscuring shell companies. As explained by the White House, the Papers "appear to show that people around the globe have been using anonymous, offshore shell companies and other entities in order to hide their business and assets from authorities." See White House Blog, President Obama's Efforts on Financial Transparency and Anti-Corruption: What You Need to Know (May 6, 2016). While the use of offshore shell companies is not per se illegal, the release of the Panama Papers has focused media and regulator attention on the broader issues of transparency and accountability in domestic and international financial transactions. As was the case with Jeremy Johnson, the concern is that the use of shell companies may allow beneficial owners to engage in illegal activities without law enforcement being able to detect those activities or identify the individuals responsible for them.
The Rulemaking—FinCEN's Beneficial Ownership Rule. Finally, in May 2016, the Financial Crimes Enforcement Network (FinCEN) published its long-awaited rule requiring financial institutions to conduct customer due diligence to determine the beneficial owners of legal entity customers. Final Rule, Customer Due Diligence Requirements for Financial Institutions, 81 Fed. Reg. 29398 (May 11, 2016). The purpose of the rule, as explained by FinCEN, is to require financial institutions to "understand who their customers are and what type of transactions they conduct." In this regard, the rule aligns closely with the Johnson case and the Panama Papers, both of which have highlighted the ability of criminals to hide behind legal entities when engaging in money laundering, corruption, fraud, terrorist financing, and sanctions evasion, among other financial crimes. In fact, the White House has acknowledged that the timing of the final rule was influenced by the leak of the Papers.
To address this risk, the rule requires that each time a new account is opened for a "legal entity customer"—even for an existing customer—the financial institution must obtain current beneficial owner information, including a certification from the individual authorized by the customer to open the account that the information submitted is accurate to the best of his or her knowledge. FinCEN has emphasized that the beneficial ownership rule is an important part of a financial institution's customer identification and verification process.
The New Normal—Transparency and Accountability
The three developments summarized in this article serve as a warning for every financial institution, payment processor, and ISO to incorporate customer due diligence and monitoring into its compliance policies and procedures.
Although the beneficial ownership rule is technically limited to banks and certain other types of financial institutions, payment processors and ISOs will be responsible for its implementation. Acquiring banks will push beneficial ownership responsibilities down to processors and ISOs as part of the merchant account opening process. Applying appropriate policies and procedures to verify beneficial owners may require processors and ISOs to implement new software and internal controls. Given the time it often takes to bring new technology on line, processors and ISOs should begin taking steps now to prepare for May 2018, when compliance with the beneficial ownership rule is mandated.
Even if not required by banking partners, payments companies should incorporate concepts of transparency and accountability into their compliance policies and procedures. The Johnson case and other, similar cases brought by the DOJ, the FTC, and the Consumer Financial Protection Bureau demonstrate that it is a "mistake to think that shell corporations, multi-layered transactions, or clever end-arounds will deter detection." See FTC Blog, Shell Game? (Feb. 20, 2013). For those seeking guidance on updating their policies and procedures, the Electronic Transactions Association's Guidelines of Merchant and ISO Underwriting and Risk Monitoring contain helpful best practices for identifying "attempts to conceal interrelated companies or the true owners of a merchant for purposes of evading card brand rules or other regulatory considerations." As explained in the Guidelines, payments companies should conduct reasonable due diligence on their merchants, including information on related companies, principals, and beneficial owners.
Today, federal regulators expect payment processors, ISOs, and others in the payments industry to understand their customer's business and corporate structure and take steps to limit the use of the payments ecosystem for illicit purposes. The Johnson case, the Panama Papers, and the beneficial ownership rule have accelerated these expectations, placing a greater emphasis on transparency and accountability in the payments industry.