The Future of Payments

77 BANKING PERSPECTIVES QUARTER 4 2018 secure their bank account numbers. Unlike the requests received from commenters in the early 1990s, no one is suggesting that the payer’s account number be entirely removed from a payment instruction. Rather, the token would take the place of the account number and would travel with the funds transfer in the same manner that the account number would have traveled. As a condition for permitting the use of a token, FinCEN would presumably expect that the payer’s bank, which is identified in the funds transfer, could readily provide the payer’s account number associated with a token either from the bank’s own records or those of the entity operating the token vault. This might mean that the travel rule may need to be revised to place an obligation on token vault operators to store and make retrievable the account number associated with a token for a five-year period, which would correspond with the five-year period that banks must retain travel rule information for each applicable funds transfer they send. Whether these conditions would be enough to allow FinCEN to become comfortable with the use of tokens in place of account numbers in funds transfers is not yet known. What is clear is that it will be critical to communicate with FinCEN now and to consider the needs of law enforcement as the industry continues forward with tokenizing bank account numbers. n ENDNOTES 1 There is a token service available in the Automated Clearing House today for the beneficiaries of commercial payments. The Clearing House Payments Company LLC launched a service in 2002 that enables corporate entities to use a token, known as a UPIC, to receive credit payments. More information about this service is available here: https:// www.theclearinghouse.org/payment-systems/-/media/ c6fdbcd21e1c4010b8020e3589667e4c.ashx. Payment system stakeholders would like to extend a token capability to debit payments and consumer payments in the ACH. 2 Susan M. Pandy, Ph.D., and Marianne Crowe,“Industry Perspective on the Evolution of EMV Payment Tokenization,” Federal Reserve Bank of Boston, September 24, 2018.Available at: https://www.bostonfed . org/publications/mobile-payments-industry-workgroup/industry- perspectives-on-the-evolution-of-emv-payment-tokenization.aspx 3 In its mission to “safeguard the financial system from the abuses of financial crime, including terrorist financing, money laundering and other illicit activity,” FinCEN acts as the designated administrator of the Bank Secrecy Act (BSA). The BSA was established in 1970 and has become one of the most important tools in the fight against money laundering. 4 The term “financial institution” is broadly defined under the travel rule to include not only banks but entities such as broker-dealers, money services businesses, certain casinos, and mutual funds. 31 CFR 1010.100(t). 5 31 CFR 1010.410(f). 6 Id., (f)(1). 7 Id. The originator’s bank must also include the address of the originator; the amount of the payment order; the execution date of the payment order; the identity of the beneficiary’s financial institution; and either the name and address or numerical identifier of the originator’s financial institution. 8 The travel rule would require all subsequent financial institutions involved in the funds transfer to include the information they receive in their follow-on payment instructions. In other words, the information must “travel” with the funds transfer. Id. (f)(2). 9 Even if a payment is a funds transfer as defined in the regulations, the travel rule requirements do not apply if (a) the funds transfer is for an amount less than $3,000, or (b) the payer and the payee are any of the following: (i) A bank; (ii) A wholly-owned domestic subsidiary of a bank chartered in the United States; (iii) A broker or dealer in securities; (iv) A wholly owned domestic subsidiary of a broker or dealer in securities; (v) A futures commission merchant or an introducing broker in commodities; (vi) A wholly owned domestic subsidiary of a futures commission merchant or an introducing broker in commodities; (vii) The United States; (viii) A state or local government; (ix) A Federal, State or local government agency or instrumentality; or (x) A mutual fund. Also excluded are funds transfer where both the payer and payee are the same person and the payer’s financial institution and the payee’s financial institution are the same bank or broker or dealer in securities. 31 CFR 1010.410(f)(4). 10 31 CFR 1010.100 (ddd). 11 Specifically, payments sent by a commercial entity to another commercial entity (i.e., “B2B” payments) of $3,000 or more that are sent through the RTP system are subject to the travel rule. In addition, consumer payments sent through the RTP system that are not subject to EFTA, such as, potentially, payments to or from a trust account, of $3,000 or more would be subject to the travel rule. However, it is not expected that such non-EFTA consumer payments will be common in the RTP system. 12 While the focus of this article is on tokenization of bank account numbers, the authors note that another aspect of the travel rule requires the use of true names; the use of a code name or pseudonym is prohibited. See Financial Crimes Enforcement Network, “Funds ‘Travel’ Regulations: Questions & Answers,” November 9, 2010. Available at: https://www.fincen. gov/resources/statutes-regulations/guidance/funds-travel- regulations-questions-answers. Hence, there may be additional travel rule – and sanctions screening – issues to the extent existing or future payment systems might employ aliases to protect the names of payers. 13 60 Fed. Reg. 234, 236 (January 3, 1995). 14 Id. 15 Id. There is reason to be hopeful that a way forward exists that can allow all payers to benefit from tokenization of their bank account numbers without jeopardizing the effectiveness of law enforcement investigations.