On June 22, 2022, the Financial Crimes Enforcement Network (FinCEN) issued a Statement on Bank Secrecy Act Due Diligence for Independent ATM Owners or Operators to provide clarity in regards to customer due diligence (CDD) measures financial institutions should conduct when banking with independent ATM owners or operators. As the notice states, “An independent ATM operator is an individual or an entity that is in the business of owning, leasing, managing, or otherwise controlling access to the interior of an ATM, including its internal cash vault. The independent ATM operator may be the same or different from the independent ATM owner.”

FinCEN’s purpose with this memo is to encourage financial institutions to not automatically deny or exit a customer relationship solely based on their classification as an independent ATM owner or operator. Furthermore, FinCEN’s aim is to remind financial institutions that independent ATM owner or operator customers are not automatically considered a higher risk for money laundering or terrorist financing (ML/TF). This point is consistent with the FinCEN Guidance released August 3, 2020, in a bulletin titled, Frequently Asked Questions Regarding Customer Due Diligence (CDD) Requirements for Covered Financial Institutions, where it states, “covered financial institutions are not required or expected to automatically categorize as ‘high risk’ products or customer types listed in government publications.”

The memo provides examples of what financial institutions should consider when evaluating the risk associated with independent ATM owner or operator customers. Specifically, it states that risk can vary based on “transaction volume, locations of the ATMs, and the source of funds to replenish the ATMs.” FinCEN provides an example of evaluating risk based on how ATMs are replenished: “Independent ATM owners or operators that fund their ATM replenishment solely with cash withdrawn from their account at a bank may pose a relatively lower ML/TF risk because the bank knows the source of funds and can compare the volume of cash usage to electronic funds transfer settlements to identify suspicious activity. Conversely, independent ATM owners or operators that replenish ATMs from other or unknown cash sources may present potentially higher ML/TF risks, as the source of cash can be difficult for the bank to verify.”

Finally, FinCEN offers seven considerations for determining the risk level associated with ATM owner or operator customers:

• Organizational structure, including key principals and management.
• Information pertaining to the operating policies, procedures, and internal controls of the ATM owner or operator.
• ATM currency servicing arrangements, contracts, and responsibilities (e.g., cash vault services, third-party providers, and self-service).
• Information regarding the source of funds if the bank account is not used to replenish the ATM. Sources of cash may include proceeds generated by the core retail business of the owner, proceeds from a loan or revolving credit line, or cash originating from an account maintained at another bank.
• Location where the independent ATM owner or operator customer is organized, and where they maintain their places of business, including locations of owned or operated ATMs.
• Description of expected and actual ATM activity levels, including currency transactions.
• Information to better understand whether ATM operations are generally ancillary to other retail operations or the primary business of the independent ATM owner or operator customer.

As the memo states, these seven considerations are not requirements, but rather should be viewed as best practices when determining risk levels to assign to ATM owner or operator customers. If your financial institution would like to discuss developing or enhancing its policies, procedures, and monitoring processes related to independent ATM owner or operator customers or any other BSA/AML/OFACT issues, please contact Stout today.

Contributing author: Steven Bunn of Stout