This docum ent does not reflect the intent or official position of the bill sponsor or House of Representatives. STORAGE NAME: h0585d.COM DATE: 2/6/2024 HOUSE OF REPRESENTATIVES STAFF ANALYSIS BILL #: CS/HB 585 Access to Financial Institution Customer Accounts SPONSOR(S): Insurance & Banking Subcommittee, Rommel TIED BILLS: HB 587 IDEN./SIM. BILLS: SB 1132 REFERENCE ACTION ANALYST STAFF DIRECTOR or BUDGET/POLICY CHIEF 1) Insurance & Banking Subcommittee 15 Y, 3 N, As CS Fletcher Lloyd 2) State Administration & Technology Appropriations Subcommittee 10 Y, 0 N Perez Topp 3) Commerce Committee Fletcher Hamon SUMMARY ANALYSIS The federal Bank Secrecy Act (BSA) establishes reporting, recordkeeping, and related requirements for federal and state-chartered financial institutions to help detect and prevent money laundering. Under the BSA, financial institutions are required to report suspicious activity that might signify money laundering, tax evasion, or other criminal activities. These types of reports are known as “suspicious activity reports” (SARs) and are filed with the Financial Crimes Enforcement Network, a bureau of the U.S. Department of the Treasury. Florida’s codification of the BSA is the Florida Control of Money-Laundering and Terrorist Financing in Financial Institutions Act (Act). The Act requires financial institutions to submit to the Office of Financial Regulation (OFR) certain reports and maintain certain records of customers, accounts, and transactions involving currency or monetary instruments or suspicious activities in accordance with the policies of the BSA. Subject to limited exceptions, the bill requires financial institutions to file a report with OFR whenever the financial institution suspends, terminates, or takes similar action restricting access to a customer’s or member’s account. In connection with the termination-of-access report, the bill also: Requires OFR to investigate the report to determine whether the financial institution’s action was made in bad faith; Requires OFR to report a bad faith determination to the Department of Financial Services, the Attorney General, and the customer or member; Creates a private right of action for the recovery of damages against the financial institution if a bad faith determination is made, including award of attorney fees; and Provides that a qualified public depository’s (QPD) bad faith suspension, termination, or similar action restricting account access is grounds for suspension or disqualification from the QPD program, as well as grounds for the Chief Financial Officer to impose an administrative penalty on the QPD in lieu of a suspension or disqualification. The bill has no impact on state revenues or local government revenues and expenditures, but has an indeterminate negative impact on state expenditures and an indeterminate positive impact on the private sector. The bill provides an effective date of July 1, 2024. STORAGE NAME: h0585d.COM PAGE: 2 DATE: 2/6/2024 FULL ANALYSIS I. SUBSTANTIVE ANALYSIS A. EFFECT OF PROPOSED CHANGES: Background Financial Institutions Codes Florida’s Financial Institutions Codes are codified under Title XXXVIII of the Florida Statutes. 1 The Financial Institutions Codes apply to all state-authorized and state-chartered financial institutions and to the enforcement of all laws relating to state-authorized and state-chartered financial institutions. 2 The Financial Institutions Codes define the term “financial institution” as a state or federal savings or thrift association, bank, savings bank, trust company, international bank agency, international banking corporation, international branch, international representative office, international administrative office, international trust entity, international trust company representative office, qualified limited service affiliate, credit union, or an agreement corporation operating pursuant to s. 25 of the Federal Reserve Act, 12 U.S.C. ss. 601 et seq. or Edge Act corporation organized pursuant to s. 25(a) of the Federal Reserve Act, 12 U.S.C. ss. 611 et seq. 3 A primary purpose of the Financial Institutions Codes is to provide for and promote the safe and sound conduct of the financial services industry in Florida. 4 The specific chapters under the Financial Institutions Codes are: Ch. 655, F.S. – Financial Institutions Generally Ch. 657, F.S. – Credit Unions Ch. 658, F.S. – Banks and Trust Companies Ch. 660, F.S. – Trust Business Ch. 662, F.S. – Family Trust Companies Ch. 663, F.S. – International Banking Ch. 665, F.S. – Associations Ch. 667, F.S. – Savings Banks Office of Financial Regulation The Office of Financial Regulation (OFR) is the regulatory authority for Florida’s financial services industry. 5 OFR reports to the Financial Services Commission (Commission) which is made up of the Governor and the members of the Florida Cabinet: the Chief Financial Officer (CFO), Attorney General (AG), and Agriculture Commissioner. 6 OFR enforces and administers the Financial Institutions Codes; is responsible for supervising banks, credit unions, savings associations, and international bank agencies; and licenses and regulates non-depository finance companies and the securities industry. 7 Bank Secrecy Act The federal Bank Secrecy Act (BSA) 8 establishes reporting, recordkeeping, and related requirements for federal and state-chartered 9 financial institutions to help detect and prevent money laundering. 10 1 S. 655.005(1)(k), F.S. 2 S. 655.001(1), F.S. 3 S. 655.005(i), F.S. 4 S. 655.001(2), F.S. 5 Florida Office of Financial Regulation, About Our Agency, https://flofr.gov/sitePages/AboutOFR.htm (last visited Dec. 4, 2023). 6 Id. 7 Florida Department of Financial Services, Financial Services Commission, https://www.myfloridacfo.com/about/about- dfs/commission (last visited Dec. 4, 2023). See also, s. 655.012, F.S. 8 31 U.S.C. § 5311 et seq. STORAGE NAME: h0585d.COM PAGE: 3 DATE: 2/6/2024 Specifically, the BSA and other anti-money laundering regulations (BSA/AML) require financial institutions to, among other things, keep records of cash purchases of negotiable instruments and file reports of cash transactions exceeding $10,000 (daily aggregate amount). 11 Under the BSA/AML laws, financial institutions must also: establish effective BSA compliance programs; establish effective customer due diligence systems and monitoring programs; screen against Office of Foreign Assets Control lists and other government lists; establish an effective suspicious activity monitoring and reporting process; and develop risk-based anti-money laundering programs. 12 The U.S. Office of the Comptroller of Currency regularly conducts examinations of national banks, federal branches, federal savings associations, and agencies of foreign banks in the U.S. to determine compliance with BSA/AML laws. 13 SUSPICIOUS ACTIVITY REPORTS In addition to the other requirements under the BSA/AML laws, financial institutions are also required to report suspicious activity that might signify money laundering, tax evasion, or other criminal activities. 14 These types of reports are known as “suspicious activity reports” (SAR) and are filed with the Financial Crimes Enforcement Network (FinCEN), a bureau of the U.S. Department of the Treasury, using FinCEN’s BSA E-filing system. 15 Under this requirement, a financial institution is required to file an SAR no later than 30 calendar days after the date of initial detection of facts that may constitute a basis for filing an SAR. 16 For instances where no suspect was identified on the date of the incident requiring the filing, a financial institution may delay filing an SAR for an additional 30 calendar days to identify a suspect. 17 However, in no case shall reporting be delayed more than 60 calendar days after the date of initial detection of a reportable transaction. 18 Federal Trade Commission Act Section 5 of the Federal Trade Commission Act (FTC Act), 15 U.S.C. § 45, prohibits “unfair or deceptive acts or practices in or affecting commerce.” 19 The prohibition applies to all persons engaged in commerce, including state-chartered banks. 20 The Board of Governors of the Federal Reserve System have authority under federal law 21 to take appropriate action when unfair or deceptive acts or 9 See, 12 C.F.R. § 326.8 (sets forth requirements for state-chartered banks to establish and maintain procedures to ensure and monitor their compliance with the BSA). See also, 12 C.F.R. § 353 (establishes requirements for state- chartered banks to file a suspicious activity report under certain circumstances). 10 U.S. Treasury Financial Crimes Enforcement Network, FinCEN’s Legal Authorities, https://www.fincen.gov/resources/fincens-legal-authorities (last visited Dec. 6, 2023). 11 Id. 12 U.S. Office of the Comptroller of the Currency, Bank Secrecy Act, https://www.occ.treas.gov/topics/supervision-and- examination/bsa/index-bsa.html (last visited Dec. 5, 2023). 13 Id. 14 U.S. Treasury Financial Crimes Enforcement Network, supra note 10. 15 U.S. Office of the Comptroller of the Currency, Suspicious Activity Report Program, https://www.occ.treas.gov/publications-and-resources/forms/sar-program/index-sar-program.html (last visited Dec. 5, 2023). 16 Id. 17 Id. 18 Id. 19 Board of Governors of the Federal Reserve System, Division of Consumer and Community Affairs, Federal Trade Commission Act (last updated Dec. 2016), p. 1, https://www.federalreserve.gov/boarddocs/supmanual/cch/ftca.pdf (last visited Feb. 6, 2024). 20 Id. 21 Section 8 of the Federal Deposit Insurance Act, 12 U.S.C.A. § 1811, et seq. STORAGE NAME: h0585d.COM PAGE: 4 DATE: 2/6/2024 practices are discovered, regardless of state authorities having primary responsibility for enforcing state statutes against unfair or deceptive acts or practices. 22 Under the FTC Act, an act or practice is considered unfair if it: Causes or is likely to cause substantial injury to consumers; Cannot be reasonably avoided by consumers; and Is not outweighed by countervailing benefits to consumers or to competition. 23 According to the Board of Governors of the Federal Reserve System, there may be circumstances in which an act or practice violates section 5 of the FTC Act even though the institution is in technical compliance with other applicable laws, such as the BSA/AML laws. 24 Moreover, the policies behind the BSA/AML laws could arguably outweigh a finding that a financial institution committed an unfair act under section 5 of the FTC Act. Florida Control of Money-Laundering and Terrorist Financing in Financial Institutions Act The purpose of the Florida Control of Money-Laundering and Terrorist Financing in Financial Institutions Act 25 (Act), s. 655.50, F.S., is to require submission to OFR of certain reports and the maintenance of certain records of customers, accounts, and transactions involving currency or monetary instruments or suspicious activities if: 26 such reports and records deter using financial institutions to conceal, move, or provide proceeds obtained from or intended for criminal or terrorist activities; or such reports and records have a high degree of usefulness in criminal, tax, or regulatory investigations or proceedings. The Act requires financial institutions to designate and retain a BSA/AML compliance officer, which is defined as an officer that is responsible for the development and implementation of the financial institution’s policies and procedures for complying with the requirements of the Act and BSA/AML laws. 27 Any change in a financial institution’s BSA/AML compliance officer must be reported to OFR. 28 Additionally, the Act requires financial institutions to maintain: 29 full and complete records of all financial transactions, including all records required by the BSA/AML laws, for a minimum of 5 years; a copy of all reports filed with OFR as required under the Act for a minimum of 5 years after submission of the report; and a copy of all records of exemption for each qualified business customer 30 for a minimum of 5 calendar years after termination of exempt status of such customer. The Act also requires financial institutions to keep a record of each financial transaction which involves currency or other monetary instrument that has a value greater than $10,000, involves the proceeds of 22 Board of Governors of the Federal Reserve System, Division of Consumer and Community Affairs, supra note 19, p. 1. 23 Board of Governors of the Federal Reserve System, Division of Consumer and Community Affairs, supra note 19, p. 1. 24 Board of Governors of the Federal Reserve System, Division of Consumer and Community Affairs, supra note 19, p. 7. 25 S. 655.50, F.S. 26 S. 655.50(2), F.S. 27 S. 655.50(4), F.S. 28 Id. 29 S. 655.50(8), F.S. 30 See, 31 U.S.C. § 5313(e), providing that the U.S. Secretary of Treasury (Secretary) may exempt a depository institution from BSA/AML reporting requirements for transactions between the institution and a “qualified business customer” (QBC) of the institution on the basis of information submitted to the Secretary. QBC is defined as a business that: maintains a transaction account at the depository institution; frequently engages in transactions with the institution which are subject to BSA/AML reporting requirements; and meets criteria which the Secretary determines is sufficient to ensure the purposes of the BSA/AML laws are carried out without requiring a report for such transactions. STORAGE NAME: h0585d.COM PAGE: 5 DATE: 2/6/2024 specified unlawful activity, or is designed to evade the reporting requirements of the Act or other state or federal laws, or which the financial institution reasonably believes is suspicious activity. 31 A financial institution, or officer, employee, or agent thereof, which files a report in good faith pursuant to the Act is not liable to any person for loss or damage caused in whole or in part by the making, filing, or governmental use of the report, or any information contained therein. 32 OFR ENFORCEMENT In addition to any other powers conferred by the Financial Institutions Codes, OFR may bring an action in court to enforce or administer the Act, as well as issue and serve upon any person an order of removal if OFR determines such person is violating, has violated, or is about to violate any provisions of the Act or any similar state or federal law. 33 OFR may also impose and collect an administrative fine against any person found to have violated any provision of the Act or similar state or federal law in an amount up to $10,000 per day for each willful violation or $500 per day for each negligent violation. 34 VIOLATIONS OF THE ACT A person who willfully violates the Act commits a misdemeanor of the first degree, 35 unless the violation involves financial transactions of certain amounts, in which case the criminal penalties vary by first, second, and third-degree felonies depending on the amount and timing of such transactions. 36 In addition to the criminal penalties, a person who violates the Act may be subject to a fine of up to $250,000 or twice the value of the financial transaction, whichever is greater, and a subsequent violation could result in a fine up to $500,000 or quintuple the value of the financial transaction, whichever is greater. 37 A person or financial institution who violates the Act may also be liable for a civil penalty of not more than the greater of the value of the financial transaction involved or $25,000. 38 Effects of Banks’ Termination of Account Access In 2022, banks filed over 1.8 million SARs, which is a 50% increase in two years. 39 Multiple SARs often result in a financial institution terminating, suspending, or otherwise restricting a customer’s account access. 40 A New York Times study of over 500 cases of financial institutions “dropping” their customers, including interviews with current and former bank industry staffers, revealed the negative effects of a bank’s decision to remove a customer’s account access: 31 S. 655.50(5), F.S. 32 S. 655.50(5)(c), F.S. 33 Ss. 655.50(9)(a)-(c), F.S. 34 S. 655.50(9)(d), F.S. 35 S. 655.50(10)(a), F.S. 36 S. 655.50(10)(b), F.S. See also, s. 775.082, F.S. A person who willfully violates or knowingly causes another to violate the Act and the violation involves financial transactions of certain amounts: financial transactions totaling or exceeding $300 but less than $20,000 in any 12-month period, commits a felony of the third degree; financial transactions totaling or exceeding $20,000 but less than $100,000 in any 12-month period, commits a felony of the second degree; or financial transactions totaling or exceeding $100,000 in any 12-month period, commits a felony of the first degree. 37 S. 655.50(10)(c), F.S. 38 Ss. 655.50(10)(d)-(e), F.S. 39 Ron Lieber and Tara Seigel Bernard, Why Banks Are Suddenly Closing Down Customer Accounts, Thomson Reuters (Nov. 5, 2023), https://www.nytimes.com/2023/11/05/business/banks-accounts-close- suddenly.html?unlocked_article_code=1.8Uw.udoQ.0cmUgCSuo6eS&smid=nytcore-android-share (last visited Dec. 5, 2023). 40 Id. STORAGE NAME: h0585d.COM PAGE: 6 DATE: 2/6/2024 Individuals can’t pay their bills on time. Banks often take weeks to send them their balances. While the institutions close their credit cards, their credit scores suffer. Upon cancellation, small businesses often struggle to make payroll – and must explain to vendors and partners that they don’t have a bank account for the time being… [And] once customers have moved on, they don’t know whether there is a black mark somewhere on their permanent records that will cause a repeat episode at another bank. If the bank has filed an SAR, it isn’t legally allowed to tell you, and the federal government prosecutes only a small fraction of the people whom the banks document in their SARs. 41 As a result, customers do not know why they were ever under suspicion. 42 Interviews with individuals who had lost access to their accounts revealed behaviors that may have caused their banks to “drop” them. 43 Specifically, a few of the interviews revealed the following: 44 Unusual Cash Deposits: When a bar owner’s weekly cash deposits fell just below the federal currency reporting thresholds, the bank closed the bar’s account and the personal checking and credit card accounts of the owner and his spouse. A Marijuana Connection: A married couple’s accounts at a bank were shut down after the husband started receiving direct deposits from a cannabis company that had recently acquired his employer. Criminal History: A man who had served 5 years in prison for stealing a car from a dealership and using a counterfeit bill (among other crimes) had his accounts shut down at three different banks. His personal banker from the third bank hinted it was because of his criminal record. Qualified Public Depositories Unless a specific exemption applies, state and local governments must deposit public funds in a bank or savings association that has been designated as a qualified public depository (QPD) under the Florida Security for Public Deposits Act (FSPD). 45 To be designated as a QPD by the CFO, a bank, savings bank, or savings association must: Have a federal or state charter; Have authority to accept deposits in Florida; Have its principal place of business in Florida, or a branch office in Florida; Have deposit insurance pursuant to the Federal Deposit Insurance Act; 46 Have procedures and practices for accurate identification, classification, reporting, and collateralization of public deposits; Annually attest to the CFO that the QPD has not engaged in an “unsafe and unsound practice” by denying or cancelling services based on environmental, social, or governance factors, as required by s. 280.025, F.S.; and Meet all the requirements of ch. 280, F.S., relating to security for public deposits. 47 Under the FSPD, a QPD may be suspended or disqualified or both if the CFO determines that the QPD has engaged in certain activities that are listed in s. 280.051, F.S. Additionally, if the CFO finds that one or more grounds exist for the suspension or disqualification of a QPD, the CFO may, in lieu of suspension or disqualification, impose an administrative penalty upon the QPD. 48 Specifically, with respect to any knowing and willful violation by the QPD of a lawful order or 41 Id. 42 Id. 43 Id. 44 Id. 45 S. 280.01, F.S. The Florida Security for Public Deposits Act is codified under ch. 280, F.S. 46 12 U.S.C.A. Ch. 16. 47 S. 280.02(26), F.S. 48 S. 280.054(1), F.S. STORAGE NAME: h0585d.COM PAGE: 7 DATE: 2/6/2024 rule, the CFO may impose a penalty not exceeding $1,000 for each violation. 49 Currently, only failure to timely file the attestation required under s. 280.025, F.S., is deemed a knowing and willful violation by a QPD. 50 Effect of the Bill Termination-of-Access Reports The bill amends Florida’s Financial Institutions Codes to require a financial institution that terminates, suspends, or takes similar action restricting a customer’s or member’s account to file a termination-of- access report with OFR, unless such termination, suspension, or similar action was due to: The customer or member initiating the access change themselves; A lack of activity in the account; or The property is presumed unclaimed pursuant to ch. 717, F.S. 51 The bill provides that the termination-of-access report shall be filed at such time and must contain such information as the Commission requires by rule. OFR INVESTIGATION AND DETERMINATION Within 90 days after receipt of a termination-of-access report, OFR must investigate the financial institution’s action and determine whether the action was taken in bad faith as substantiated by competent and substantial evidence that was known or should have been known to the financial institution at the time of the termination, suspension, or similar action. Within 30 days after making a bad faith determination, OFR must report to the AG and the CFO such bad faith termination, suspension, or similar action. The report to the AG must describe the findings of the investigation, provide a summary of the evidence, and state whether the financial institution violated the Financial Institutions Codes. Upon sending the report to the AG, OFR must also send a copy of the report to the aggrieved customer or member by certified mail, return receipt requested. The bill provides that a financial institution’s termination, suspension, or similar action restricting a customer’s or member’s account access in bad faith (as determined by OFR), or a financial institution’s failure to timely file a termination-of-access report altogether, constitutes a violation of Florida’s Financial Institutions Codes and subjects the financial institution to the applicable sanctions and penalties provided therein. The bill requires OFR to provide any filed termination-of-access report, and any information contained therein, to any federal, state, or local law enforcement or prosecutorial agency, and any federal or state agency responsible for the regulation or supervision of financial institutions, if the provision of such report is otherwise required by law. 49 S. 280.054(1)(b), F.S. 50 Id. 51 Ch. 717, F.S. is the Florida Disposition of Unclaimed Property Act (FDUP Act). Unclaimed property is a financial asset that is unknown or lost, or has been left inactive, unclaimed, or abandoned by its owner. Under the FDUP Act, unclaimed property is held by business or government entities (known as “holders”) for a set period of time, usually 5 years. If the holder is unable to locate the owner, re-establish contact, and return the asset, it is reported and remitted to the Florida Department of Financial Services’ Division of Unclaimed Property. See, Florida Department of Financial Services, Division of Unclaimed Property, About, https://fltreasurehunt.gov/UP-Web/sitePages/About.jsp (last visited Dec. 5, 2023). STORAGE NAME: h0585d.COM PAGE: 8 DATE: 2/6/2024 PRIVATE CAUSE OF ACTION The bill provides a private cause of action to the aggrieved customer or member against the financial institution that, pursuant to a finding by OFR, acted in bad faith in terminating, suspending, or taking similar action restricting account access. The aggrieved customer or member may recover damages in any court of competent jurisdiction, together with costs and reasonable attorney fees to be assessed by the court. To recover damages, however, the customer or member must establish that, beyond a reasonable doubt, the financial institution acted in bad faith in terminating, suspending, or taking similar action restricting access to the customer’s or member’s account. The bill provides that a customer’s or member’s failure to initiate a cause of action within 12 months of OFR making a bad faith determination shall bar recovery of any filed claims thereafter. Qualified Public Depositories The bill also amends the list of activities that are grounds for suspension or disqualification or both for a QPD. Specifically, the bill provides that a QPD who is found by OFR to have acted in bad faith when terminating, suspending, or taking similar action restricting a customer’s or member’s account, or who has failed to timely file a termination-of-access report altogether, is grounds for suspension or disqualification or both. The bill provides that, with respect to administrative penalties imposed in lieu of suspension or disqualification, a QPD’s bad faith termination, suspension, or similar action restricting a customer’s or member’s account access (as determined by OFR), or a QPD’s failure to timely file a termination-of- access report altogether, are each deemed a knowing and willful violation by the QPD. B. SECTION DIRECTORY: Section 1. Amends s. 280.051, F.S., relating to grounds for suspension or disqualification of a qualified public depository. Section 2. Amends s. 280.054, F.S., relating to administrative penalty in lieu of suspension or disqualification. Section 3. Creates s. 655.49, F.S., relating to termination-of-access reports by financial institutions; investigations by the Office of Financial Regulation. Section 4. Provides an effective date of July 1, 2024. II. FISCAL ANALYSIS & ECONOMIC IMPACT STATEMENT A. FISCAL IMPACT ON STATE GOVERNMENT: 1. Revenues: None. 2. Expenditures: The bill may have an indeterminate negative impact on OFR given the investigatory obligations imposed upon OFR by the bill. See Fiscal Comments, below. STORAGE NAME: h0585d.COM PAGE: 9 DATE: 2/6/2024 B. FISCAL IMPACT ON LOCAL GOVERNMENTS: 1. Revenues: None. 2. Expenditures: None. C. DIRECT ECONOMIC IMPACT ON PRIVATE SECTOR: The bill may have an indeterminate positive economic impact on the private sector. The bill may lead to fewer financial institutions suspending, terminating, or taking similar action restricting customers’ or members’ account access in bad faith. D. FISCAL COMMENTS: The bill could increase the workload of OFR, depending on how many termination-of-access reports are filed with OFR. It is currently unknown whether additional resources would be needed to address the additional workload. However, if additional resources are needed, the OFR could include the required resources in their FY 2025-2026 Legislative Budget Request, due to the Legislature and the Governor, October 15, 2024. III. COMMENTS A. CONSTITUTIONAL ISSUES: 1. Applicability of Municipality/County Mandates Provision: Not applicable. The bill does not appear to affect county or municipal governments. 2. Other: Not applicable. B. RULE-MAKING AUTHORITY: The bill provides rule-making authority to the Commission. Specifically, the bill provides that the termination-of-access report required under the proposed s. 655.40, F.S., shall be filed at such time and must contain such information as the Commission requires by rule. C. DRAFTING ISSUES OR OTHER COMMENTS: None. IV. AMENDMENTS/COMMITTEE SUBSTITUTE CHANGES On December 13, 2023, the Insurance & Banking Subcommittee considered the bill, adopted one amendment, and reported the bill favorably as a committee substitute. The amendment clarifies that a financial institution’s bad faith termination, suspension, or other action restricting account access is a violation of the financial institutions codes. The analysis is drafted to the committee substitute as passed by the Insurance & Banking Subcommittee.