MilesToPass

USA PATRIOT Act, anti-money-laundering, and Gramm-Leach-Bliley privacy

Lesson 20 of 92 · All lessons · Up next: Underwriting: insurable interest, medical information, and risk classification →

Why a life insurance application is a federal compliance event

A life insurance producer sits at the meeting point of two federal concerns. The first is that permanent life insurance and annuities hold money, can be surrendered or borrowed against, and can therefore be used to launder it -- to move criminal proceeds into the financial system and out again looking clean. The second is that the application collects a customer's most sensitive personal information, and the customer is entitled to know how it will be used and shared. The first concern is addressed by the USA PATRIOT Act and the anti-money laundering (AML) program it requires; the second by the Gramm-Leach-Bliley Act (GLBA). Both apply the same way in every state.

A diagram with two tall columns side by side and a single box beneath them. The left column is red and is headed USA PATRIOT Act of two thousand one, Bank Secrecy Act, with the subtitle guard against money laundering and terrorist financing. Inside it, four boxes are stacked and connected by downward arrows. The first box is the insurer's anti-money laundering program with its four pillars: internal policies, procedures, and controls; a compliance officer; ongoing employee training; and an independent audit. A note says the program is risk based and covers permanent life, annuities, and cash-value products. The second box is customer identification: verify identity, keep the records used, and check government terrorist lists, with OFAC screening. The third box lists red flags seen by the producer: cash or structured premiums, evasion about the source of funds, early surrender to a third party, and indifference to the product. The final box, shaded darker red, is the suspicious activity report to FinCEN: five thousand dollars or more, filed within thirty days, and the customer is never told. The right column is blue and is headed Gramm-Leach-Bliley Act of nineteen ninety-nine, with the subtitle affirmative and continuing obligation to protect customer privacy. Its four stacked boxes are: nonpublic personal information, such as name, address, Social Security number, income, account values, and health answers, noting that publicly available information is not included; the privacy notice, describing what is collected, with whom it is shared, and how it is protected, given when the relationship begins and annually; the opt-out right, required before nonpublic information is shared with a nonaffiliated third party for marketing, while affiliates and transaction servicing need no opt-out; and, shaded darker blue, safeguards that are administrative, technical, and physical, meant to secure records, protect against anticipated threats, and protect against unauthorized access, with a note that pretexting is prohibited. At the bottom center a gray box labeled the producer at the application meeting reads: verifies identity, sees the source of funds, reports red flags, delivers the privacy notice. Two arrows rise from that box, one into each column, showing that the producer feeds both duties.
The PATRIOT Act's anti-money laundering duties and Gramm-Leach-Bliley's privacy duties both run through the producer at the application meeting.

Money laundering and the PATRIOT Act

Money laundering is the process of disguising the origin of illegally obtained money. It is usually taught in three stages:

  • Placement -- getting the cash into the financial system, for example by paying a large

single premium on an annuity.

  • Layering -- moving it through a series of transactions to obscure the trail, for

example surrendering the contract early or exercising a free look and asking for the refund to go to a third party.

  • Integration -- returning the funds to the launderer as apparently legitimate money.

The USA PATRIOT Act (2001) strengthened the Bank Secrecy Act to guard against money laundering and the financing of terrorism, and extended AML program duties across the financial sector. Under it, every financial institution must establish an anti-money laundering and countering-the-financing-of-terrorism program with, at a minimum, four elements -- the four pillars:

  1. the development of internal policies, procedures, and controls;
  2. the designation of a compliance officer;
  3. an ongoing employee training program; and
  4. an independent audit function to test the program.

The program must be risk-based: more attention and resources go to higher-risk customers and activities, consistent with the institution's own risk profile, rather than to low-risk ones. The Financial Crimes Enforcement Network (FinCEN), a bureau of the Treasury, writes the implementing rules and receives the reports.

How the rule reaches insurers

FinCEN's insurance rule applies the program requirement to insurers that issue covered products: permanent life insurance (any life policy other than group life), annuity contracts (other than group annuities), and any other insurance product with cash value or investment features. Term life, group products, and property and casualty insurance are not covered, because they have no accumulating value to launder through. The insurer owns the program, but it must integrate its producers into it: the producer is the person who actually meets the customer, sees the source of funds, and notices when something does not add up. Producers must complete the insurer's AML training and follow its procedures.

Knowing the customer

The PATRIOT Act also directs the Treasury to set minimum customer identification standards. At a minimum, financial institutions must implement reasonable procedures to verify the identity of any person seeking to open an account, maintain records of the information used to verify identity (name, address, and other identifying information), and consult government lists of known or suspected terrorists to check whether the customer appears on them. In practice the producer collects and records identifying information on the application and the insurer screens it against the Treasury's Office of Foreign Assets Control (OFAC) sanctions list; a policy may not be issued to a person on that list.

Reporting suspicious activity

An insurer must file a Suspicious Activity Report (SAR) with FinCEN when it knows, suspects, or has reason to suspect that a transaction involving at least $5,000 in funds or other assets involves money from illegal activity, is designed to evade reporting requirements, has no apparent lawful purpose, or uses the insurer to facilitate criminal activity. The report is generally due within 30 days of detecting the activity, and the customer may not be told that a SAR was or will be filed. Red flags a producer should report to the insurer's compliance officer include:

  • a customer who wants to pay a large premium in cash or with multiple money orders, or

who tries to break a payment into smaller amounts to stay under a threshold (structuring);

  • reluctance to provide identifying information or the source of funds;
  • indifference to the product's features, surrender charges, or investment performance

while insisting on the ability to withdraw money quickly;

  • early surrender or free-look cancellation of a large single-premium contract, especially

with a request that the refund go to a third party or a foreign bank; and

  • premiums paid by, or benefits directed to, an unrelated third party.

Gramm-Leach-Bliley privacy

The Gramm-Leach-Bliley Act (1999) declares it the policy of Congress that each financial institution -- and an insurer is one -- has an affirmative and continuing obligation to respect the privacy of its customers and to protect the security and confidentiality of their nonpublic personal information (NPI). NPI is personally identifiable financial information that the customer gives to obtain a product, that results from a transaction, or that the institution otherwise obtains -- names, addresses, Social Security numbers, income, account balances, and health information on an application all qualify. Publicly available information, such as a listed telephone number, is not NPI.

GLBA has three practical parts for the producer:

  • Privacy notice. The insurer must give the customer a clear notice of its privacy

policy -- what it collects, with whom it shares it, and how it protects it -- when the customer relationship is established and annually thereafter, and a shorter notice to consumers who apply but do not become customers.

  • Opt-out. Before sharing NPI with a nonaffiliated third party for that party's own

marketing use, the institution must tell the customer and give a reasonable opportunity to opt out. Sharing with affiliates, with service providers under contract, or as needed to process or service the customer's own transaction requires no opt-out.

  • Safeguards. Regulators must set, and institutions must follow, standards for

administrative, technical, and physical safeguards that ensure the security and confidentiality of customer records, protect against anticipated threats to their security or integrity, and protect against unauthorized access or use that could cause substantial harm or inconvenience to a customer. For a producer this means locked files, secured devices, and no discussion of a client's information with anyone who has no business need for it.

GLBA also prohibits pretexting -- obtaining a customer's financial information from an institution under false pretenses, such as by impersonating the customer.

Putting it together

Both laws are enforced against the insurer, but both depend on the producer. The application meeting is where identity is verified, source of funds is observed, red flags first appear, and the privacy notice is delivered. A producer who skips AML training, ignores a suspicious payment, tips off a customer about a report, or leaves client files where others can read them exposes the insurer to federal penalties and the producer's own license to discipline.

Key terms

Sample questions

Which of the following best describes money laundering?

  • Paying a life insurance premium with funds borrowed from a bank.
  • Reporting a large cash transaction to the federal government.
  • Investing legitimately earned income in an annuity to defer taxes.
  • Disguising the origin of illegally obtained money so that it appears legitimate.
Preview

This is a preview. The full lesson and question set require an active plan.

See pricing →

See where this fits: Florida exam outline and topic weights.