On February 24, the Wall Street Journal reported that the Trump administration may require banks to collect citizenship information from their customers. High time, because respectfully, the George W. Bush Treasury Department should have instituted such a plan nearly 23 years ago, instead of opting for rules that protected aliens here unlawfully.
Al-Qaeda and the PATRIOT Act
On October 26, 2001 — just over six weeks after the September 11th terrorist attacks — President Bush signed the Uniting and Strengthening America by Providing Appropriate Tools to Intercept and Obstruct Terrorism Act of 2001, better known as the PATRIOT Act.
Having played a small role in the drafting of PATRIOT, I can assure you of three things: (1) it’s among the least understood but most villainized pieces of legislation; (2) contrary to popular opinion, Congress went over it with a fine-tooth comb before it was passed; and (3) even in real time I knew the name would haunt the bill.
In any event, that law was a response to national-security vulnerabilities identified in the immediate wake of the attacks, including terrorist exploitation of the international banking system, hence the heading of Title III of the act, the “International Money Laundering Abatement and Anti-Terrorist Financing Act”.
All 19 of the al-Qaeda associated 9/11 hijackers were aliens, each entered on nonimmigrant visas, and they relied on foreign funding to support themselves while their murderous plan came together.
The final report of the 9/11 Commission concluded that al-Qaeda required about $30 million a year to carry out its global activities and noted the group had been designated as a “foreign terrorist organization” (FTO) by the State Department in October 1999.
Following that al-Qaeda FTO designation, the report explained, “it became the duty of U.S. banks to block its transactions and seize its funds”.
“Neither this designation nor UN sanctions had much additional practical effect”, however, because “the sanctions were easily circumvented, and there were no multilateral mechanisms to ensure that other countries’ financial systems were not used as conduits for terrorist funding”.
One impediment, according to the commission, was that the Treasury Department wasn’t focused on terrorist financing prior to the attacks:
Treasury regulators, as well as U.S. financial institutions, were generally focused on finding and deterring or disrupting the vast flows of U.S. currency generated by drug trafficking and high-level international fraud. Large-scale scandals, such as the use of the Bank of New York by Russian money launderers to move millions of dollars out of Russia, captured the attention of the Department of the Treasury and of Congress. Before 9/11, Treasury did not consider terrorist financing important enough to mention in its national strategy for money laundering.
Section 326
Title III aimed to close these gaps by bolstering and refocusing the Treasury Department’s powerful authorities to disrupt the financing al-Qaeda and other terror organizations relied upon.
Section 326 of the PATRIOT Act, “Verification of Identification”, directed the secretary of Treasury to “prescribe regulations setting forth the minimum standards for financial institutions and their customers regarding the identity of the customer that shall apply in connection with the opening of an account at a financial institution”.
Those regulations were to require banks to “implement reasonable procedures for verifying the identity of any” of their customers “to the extent reasonable and practicable”. If you’ve opened a checking account in the past two decades, you are likely familiar with what the subsequently implemented “know your customer” (KYC) requirement entails.
The KYC and CIP Regulations
Nineteen months later, in May 2003, the Treasury Department, Federal Reserve, FDIC, and the National Credit Union Administration published their final joint KYC regulations implementing section 326 of the PATRIOT Act.
Notably, those regulations distinguish between customers who are a “U.S. person”, i.e., a U.S. citizen or “an individual (such as a corporation, partnership, or trust), that is established or organized under the laws of a State or the United States”, and a “non-U.S. person”, defined elliptically as “a person that is not a U.S. person”.
Under those regulations, every bank must implement its own “Customer Identification Program” (CIP).
Each CIP “must contain procedures for opening an account that specify the identifying information that will be obtained from each customer”, including the customer’s: (1) name; (2) date of birth; (3) address; and (4, and most importantly) an “identification number”.
For a U.S.-person, that identification number can be either a Social Security number, individual taxpayer identification number (ITIN), or an employer identification number (EIN), collectively referred to as a “taxpayer identification number”.
A non-U.S. person, however, can present one or more of the following numbers to satisfy the regulatory CIP requirement: “a taxpayer identification number; passport number and country of issuance; alien identification card number; or number and country of issuance of any other government-issued document evidencing nationality or residence and bearing a photograph or similar safeguard”.
Thus, and notwithstanding the fact that section 326 of the PATRIOT Act was enacted specifically to prevent foreign terrorists from exploiting the U.S. banking system, the rule implementing it permits aliens to present a much-wider range of (less secure) documents to identify themselves than citizens can.
If you have a foreign passport or “other [foreign] government-issued document evidencing nationality” (like a matricula consular) with “a photograph or similar safeguard”, your money is welcome here.
As the rule tepidly explains in a footnote, the regulation “provides this flexibility because there is no uniform identification number that non-U.S. persons would be able to provide to a bank”.
Worse, the rule concedes that:
Treasury and the Agencies recognize that there currently is no method that would permit a bank to verify, for example, a taxpayer identification, passport or alien identification number through an official source. ... Thus, a bank need not establish the accuracy of every element of identifying information obtained but must do so for enough information to form a reasonable belief it knows the true identity of the customer. [Emphasis added.]
“Reasonable beliefs” provide little assurance the rule would deter future terrorist attacks (all 19 of the 9/11 hijackers had passports, for instance), so it appears the whole regulatory scheme is little more than a box-checking exercise that has only served to make opening an account more onerous for citizens.
Or, as my colleague George Fishman put it in an August report, “the regulations that the Treasury Department actually wrote turned Congress’s intent” in the PATRIOT Act “on its head”.
“Trump Administration Considers Requiring Banks to Collect Citizenship Information”
Fishman explained that the section 326 regulations represented the Treasury Department’s attempt to balance two competing interests: “preventing and detecting money laundering and the financing of terrorism” and “the ability of financial institutions to serve non-U.S. persons living and working in the United States”, including and particularly those here illegally.
He concluded:
Especially when the Trump administration is rightfully encouraging illegal aliens to “self-deport”, it makes absolutely no sense to keep Treasury Department regulations on the books that purposefully make it easier for illegal aliens to remain in the U.S. The misbegotten regulations, which should never have been promulgated in the first place, need to be repealed.
Which brings me to the Journal article, headlined “Trump Administration Considers Requiring Banks to Collect Citizenship Information”.
As the outlet explains, while the KYC regulations permit banks to accept passports for identification, they don’t require financial institutions to collect “citizenship information” per se.
Now however, the president is “weighing a possible executive order or other action that would require banks to collect” such information from their customers, which the Journal describes as “a new front in the administration’s crackdown on immigrants living in the U.S. illegally” and a prospect that’s “alarmed banks in recent days”.
Banks should be concerned.
One October 2024 estimate claims immigrants in the United States send $81 billion in remittances home annually and that collectively, their “their total economic value” hovers around $2.2 trillion.
That latter figure seems high, but regardless, even a less optimistic valuation would suggest U.S. banks are holding tens of billions of dollars in accounts for illegal “non-U.S. persons”.
Nothing indicates the Trump administration would force financial institutions to close the currently open accounts of those here unlawfully, but if new customers were required to disclose their unauthorized status, many would opt to stash their cash under their mattresses instead of risking ICE knocks on their doors.
A Correction Is Coming
In 2003, the Treasury Department watered down a post-9/11 statutory requirement that banks “know their customers” to protect aliens here unlawfully. That’s at odds with both U.S. law and Trump II policy, but it appears a regulatory correction is coming, albeit nearly 23 years late.