(v) Authorize the disclosure for a period not over 3 months.

(vi) Contain a "Statement of Customer Rights Under the Right to Financial Privacy Act of 1978" (App. B). (2) Any customer's consent not containing all of the elements listed in paragraph a of this section will not be valid.

(3) A copy of the customer's consent will be made a part of the law enforcement inquiry file.

(4) A certification of compliance with 12 U.S.C. 3401 et seq. (App. C), along with the customer's consent, will be provided to the financial institution as a prerequisite to obtaining access to the financial records.

(5) The annual reporting requirements of § 504.2(m) apply to requests made to a financial institution even with the customer's consent.

(c) Administrative summons or subpoena. The Army has no authority to issue an administrative summons or subpoena for access to financial records.

(d) Search warrant. (1) A law enforcement office may obtain financial records by using a search warrant obtained under Rule 41 of the Federal Rules of Criminal Procedure in appropriate cases.

(2) No later than 90 days after the search warrant is served, unless a delay of notice is obtained under § 504.2(i), a copy of the search warrant and the following notice must be mailed to the customer's last known address:

Records or information concerning your transactions held by the financial institution named in the attached search warrant were obtained by this (office/agency/unit) on (date) for the following purpose: (state purpose). You may have rights under the Right to Financial Privacy Act of 1978.

(3) Search authorization signed by installation commanders or military judges will not be used to gain access to financial records from financial institutions in any State or territory of the United States.

(4) Access to financial records maintained by military banking contractors in oversea areas or by other financial institutions located on DOD installations outside the United States, Puerto Rico, the District of Columbia,

Guam, American Samoa, or the Virgin Islands is preferably obtained by customer consent.

(i) In cases where it would not be appropriate to obtain this consent or such consent is refused and the financial institution is not otherwise willing to provide access to its records, the law enforcement activity may seek access by use of a search authorization. This authorization must be prepared and issued per AR 27-10, Legal Services.

(ii) Information obtained under this paragraph should be properly identified as financial information. It should be transferred only where an official need-to-know exists. Failure to do so, however, does not render the information inadmissable in courts-martial or other proceedings.

(iii) Law enforcement activities seeking access to financial records maintained by all other financial institutions overseas will comply with local foreign statutes or procedures governing such access.

(e) Judicial subpoena. Judicial subpoenas

(1) Are those subpoenas issued in connection with a pending judicial proceeding.

(2) Include subpoenas issued under paragraph 115 of the Manual for Courts-Martial and Article 46 of the Uniform Code of Military Justice. The servicing staff judge advocate will be consulted on the availability and use of judicial subpoenas. The notice and challenge provisions of 12 U.S.C. 3407 and 3410 will be followed.

(f) Formal written request. (1) A law enforcement office may formally request financial records when the records are relevant to a legitimate law enforcement inquiry. This request may be issued only if

(i) The customer has declined to consent to the disclosure of his or her records, or

(ii) Seeking consent from the customer would compromise or harmfully delay a legitimate law enforcement inquiry.

(2) A formal written request will be in a format set forth in Appendix D and will

(i) State that the request is issued under the Right to Financial Privacy Act of 1978 and this regulation.

(ii) Described the specific records to be examined.

(iii) State that access is sought in connection with a legitimate law enforcement inquiry.

(iv) Describe the nature of the inquiry.

(v) Be signed by the head of the law enforcement office or a designee (persons specified in § 504.1(e)(2)).

(3) At the same time or before a formal written request is issued to a financial institution, a copy of the request will be personally served upon or mailed to the customer's last known address unless a delay of customer notice has been obtained under § 504.2(i). The notice to the customer will be

(i) In a format similar to Appendix E.

(ii) Personally served at least 14 days or mailed at least 18 days before the date on which access is sought.

(4) The official who signs the customer notice is designated to receive any challenge from the customer.

(5) The customer will have 14 days to challenge a notice request when personal service is made, and 18 days when service is by mail.

(6) The head of the law enforcement office initiating the formal written request will set up procedures to insure that no access to financial records is attempted before expiration of the above time periods

(i) While awaiting receipt of a potential customer challenge, or

(ii) While awaiting the filing of an application for an injunction by the customer.

(7) Proper preparation of the formal written request and notice to the customer requires preparation of motion papers and a statement suitable for court filing by the customer. Accordingly, the law enforcement office intending to initiate a formal written request will coordinate preparation of the request, the notice, motion papers, and sworn statement with the supporting staff judge advocate. These documents are required by statute; their preparation cannot be waived.

(8) The supporting staff judge advocate is responsible for liaison with the proper United States Attorney and United States District Court. The re

questing official will coordinate with the supporting staff judge advocate to determine whether the customer has filed a motion to prevent disclosure of the financial records within the prescribed time limits.

(9) The head of the law enforcement office (§ 504.2(f)(2)) will certify in writing (see App. C) to the financial institution that such office has complied with the requirements of 12 U.S.C. 3401 et seq.

(i) When a customer fails to file a challenge to access to financial records within the above time periods, or

(ii) When a challenge is adjudicated in favor of the law enforcement office. No access to any financial records will be made before such certification is given.

(g) Emergency access. (1) In some cases, the requesting law enforcement office may determine that a delay in obtaining access would create an imminent danger of—

for

(i) Physical injury to a person, (ii) Serious property damage, or (iii) Flight to avoid prosecution. Section 504.2(g)(2)(3) provides emergency access in such cases of imminent danger. (No other procedures in this regulation apply to such emergency access.)

(2) When emergency access is made to financial records, the requesting official (§ 504.1(e)(2)) will—

(i) Certify in writing (in a format similar to that in App. C) to the financial institution that the provisions of 12 U.S.C. 3401 et seq. have been complied with as a prerequisite to obtaining access.

(ii) File with the proper court a signed, sworn statement setting forth the grounds for the emergency access within 5 days of obtaining access to financial records.

(3) After filing of the signed, sworn statement, the official who has obtained access to financial records under this paragraph will

(i) Personally serve or mail to the customer a copy of the request to the financial institution and the following notice, unless a delay of notice has been obtained under § 504.2(i):

Records concerning your transactions held by the financial institution named in the attached request were obtained by (office/agency/unit) under the Right to Financial Privacy Act of 1978 on (date) for the following purpose: (state with reasonable detail the nature of the law enforcement inquiry). Emergency access to such records was obtained on the grounds that (state grounds).

(ii) Insure that mailings under this section will be by certified or registered mail to the last known address of the customer.

(4) The annual reporting requirements of § 504.2(m) apply to any request for access under this section.

(h) Release of information obtained from financial institutions-(1) Records notice. Financial records, to include derived information, obtained under 12 U.S.C. 3401 et seq. will be marked as follows:

This record was obtained pursuant to the Right to Financial Privacy Act of 1978, 12 U.S.C. 3401 et seq., and may not be transferred to another Federal agency or department outside DOD without prior compliance with the transferring requirements of 12 U.S.C. 3412.

(2) Records transfer. (i) Financial records originally obtained under this regulation will not be transferred to another agency or department outside the DOD unless the transferring law enforcement office certifies their relevance in writing. Certification will state that there is reason to believe that the records are relevant to a legitimate law enforcement inquiry within the jurisdiction of the receiving agency or department. To support this certification, the transferring office may require that the requesting agency submit adequate justification for its request. File a copy of this certification with a copy of the released records.

(ii) Unless a delay of customer notice has been obtained (§ 504.2(i)), the transferring law enforcement office will, within 14 days, personally serve or mail the following to the customer at his or her last known address

(A) A copy of the certification made according to § 504.2(h)(2)(i) and

(B) The following notice, which will state the nature of the law enforcement inquiry with reasonable detail:

Copies of, or information contained in, your financial records lawfully in possession of the Department of the Army have been furnished to (state the receiving agency or department) pursuant to the Right to Financial Privacy Act of 1978 for (state the purpose). If you believe that this transfer has not been made to further a legitimate law enforcement inquiry, you may have legal rights under the Financial Privacy Act of 1978 or the Privacy Act of 1974.

(iii) If a request for release of information is from a Federal agency authorized to conduct foreign intelligence or foreign counterintelligence activities (Executive Order 12036) and is for puposes of conducting such activities by these agencies, the information will be released without notifying the customer, unless permission to provide notification is given in writing by the requesting agency.

(iv) Financial information obtained before the effective date of the Financial Privacy Act of 1978 (10 March 1978) may continue to be provided to other agencies according to existing procedures, to include applicable Privacy Act System Notices published in AR 340-21 series.

(3) Precautionary measures. Whenever financial data obtained under this regulation is incorporated into a report of investigation or other correspondence, precautions must be taken to insure that

(i) The report or correspondence is not is not distributed outside of DOD except in compliance with paragraph (h)(2)(ii)(B) of this section.

(ii) The report or other correspondence contains the following warning restriction on the first page or cover:

Some of the information contained herein (cite specific paragraphs) is financial record information which was obtained pursuant to the Right to Financial Privacy Act of 1978, 12 U.S.C. 3401 et seq. This information may not be released to another Federal agency or department outside the DOD without compliance with the specific requirements of 12 U.S.C. 3412 and AR 190-6.

(i) Delay of customer notice procedures-(1) Length of delay. The customer notice required by formal written request (§ 504.2(f)(3)), emergency access (§ 504.2(g)(3)), and release of information (§ 504.2(h)(2)(iii)) may be delayed for successive periods of 90

days. The notice required for search warrant (§ 504.2(d)(2)) may be delayed for one period of 180 days and successive periods of 90 days.

(2) Conditions for delay. A delay of notice may be granted only by a court of competent jurisdiction. This will be done only when not granting a delay in serving the notice would result in— (i) Endangering the life or physical safety of any person.

(ii) Flight from prosecution.

(iii) Destruction of or tampering with evidence.

(iv) Intimidation of potential wit

nesses.

(v) Otherwise seriously jeopardizing an investigation or official proceeding or unduly delaying a trial or ongoing official proceeding to the same degree as the circumstances in § 504.2(i)(2)(ii) through (iv).

(3) Coordination. When a delay of notice is appropriate, the law enforcement office involved will consult with the supporting staff judge advocate to obtain such a delay. Applications for delays of notice should contain reasonable detail.

(4) After delay expiration. Upon the expiration of a delay of notice under above and required by

(i) Section 504.2(d)(1), the law enforcement office obtaining financial records will mail to the customer a copy of the search warrant and the following notice.

Records or information concerning your transactions held by the financial institution named in the attached search warrant were obtained by this (agency or office) on (date). Notification was delayed beyond the statutory 90-day delay period pursuant to a determination by the court that such notice would seriously jeopardize an investigation concerning (state with reasonable detail). You may have rights under the Right to Financial Privacy Act of 1978.

(ii) Section 504.2(f)(3), the law enforcement office obtaining financial records will serve personally or mail to the customer a copy of the process or request and the following notice:

Records or information concerning your transactions which are held by the financial institution named in the attached process or request were supplied to or requested by the government authority named in the process or request on (date). Notification was withheld pursuant to a determination by the

(title of the court so ordering) under the Right to Financial Privacy Act of 1978 that such notice might (state reason). The purpose of the investigation or official proceeding was (state purpose with reasonable detail).

(iii) Section 504.2(g)(3), the law enforcement office obtaining financial records will serve personally or mail to the customer a copy of the request and the notice required by

§ 504.2(g)(3).

(iv) Section 504.2(h)(2), the law enforcement office transferring financial records will serve personally or mail to the customer the notice required by § 504.2(f)(3). If the law enforcement office was responsible for obtaining the court order authoriziang the delay, such office shall also serve personally or by mail to the customer the notice required in § 504.2(f)(3).

(5) Annual reports. The annual reporting requirements of § 504.2(m) apply to delays of notice sought or granted under this paragraph.

(j) Foreign intelligence and foreign counterintelligence activities. (1) Except as indicated below, nothing in this regulation applies to requests for financial information in connection with authorized foreign intelligence and foreign counterintelligence activities as defined in Executive Order 12036. Appropriate foreign intelligence and counterintelligence directives should be consulted in these instances. (2) However, to comply with the Financial Privacy Act of 1978, the following guidance will be followed for such requests. When a request for financial records is made

(i) A military intelligence group commander, the chief of an investigative control office, or the Commanding General (or Deputy CG), US Army Intelligence and Security Command, will certify to the financial institution that the requesting activity has complied with the provisions of 12 U.S.C. 3403(b).

(ii) The requesting official will notify the financial institution from which records are sought that 12 U.S.C. 3414(a)(3) prohibits disclosure to any person by the institution, its agents, or employees that financial records have been sought or obtained.

(3) The annual reporting requirements shown in § 504.2(m) apply to any request for access under this section.

(k) Certification. A certificate of compliance with the Right of Financial Privacy Act of 1978 (App. C) will be provided to the financial institution as a prequisite to obtaining access to financial records under the following access procedures:

(1) Customer consent (§ 504.2(b)). (2) Search warrant (§ 504.2(d)). (3) Judicial subpoena (§ 504.2(e)). (4) Formal written request (§ 504.2(f)).

(5) Emergency access (§ 504.2(g)). (6) Foreign intelligence and foreign counterintelligence activities (§ 504.2

(j)).

(1) Penalties. Obtaining or disclosing financial records or financial information on a customer from a financial institution in violation of the Act or this regulation may subject the Army to payment of civil penalties, actual damages, punitive damages as the court may allow, and cost with reasonable attorney fees. Military and civilian personnel who willfully or intentionally violate the Act or this regulation may be subject to disciplinary action.

re

(m) Right to Financial Privacy Act of 1978 Annual Report (RCS DDCOMP(A)1538). (1) Major Army commanders will submit this report to HQDA(DAPE-HRE) concerning quests for financial information from financial institutions. Reports are to include all queries requested or information obtained under the provisions of this regulation by subordinate Army law enforcement offices (as defined in § 504.1(c)(6)). Negative reports will be submitted.

(2) This report is to arrive at HQDA(DAPE-HRE), WASH, DC 20310, not later than 1 February following the calendar year reported.

(3) The annual report will contain the number of

(i) Requests for access to financial institutions, specifying the types of access and any other information deemed relevant or useful.

(ii) Customer challenges to access and whether they were successful.

(iii) Transfers to agencies outside of the DOD of information obtained under this regulation.

(iv) Customer challenges to the transfer of information and whether they were successful.

(v) Applications for delay of notice, the number granted, and the names of the officials requesting such delays.

(vi) Delay of notice extensions sought and the number granted.

(vii) Refusals by financial institutions to grant access, by category of authorization, such as customer consent or formal written request.

(4) A consolidated Army report will be submitted by HQDA(DAPE-HRE) to the Defense Privacy Board, Office of the Deputy Assistant Secretary of Defense (Administration), by 15 February each year.

Mr./Mrs. XXXXXXXXXX,

Chief Teller (as appropriate), First National Bank, Little Rock, AR 72203.

Dear Mr./Mrs. XXXXXXXXXX: In connection with a legitimate law enforcement inquiry and pursuant to section 3414(g) of the Right to Financial Privacy Act of 1978, section 3401 et seq., Title 12, United States Code, you are requested to provide the following account information: (name, address, account number, and type of account of any customer or ascertainable group of customers associated with a certain financial transaction or class of financial transactions as set forth in § 504.1(f)).

I hereby certify, pursuant to section 3403(b) of the Right to Financial Privacy Act of 1978, that the provisions of the Act have been complied with as to this request for account information. (Official Signature Block)

Under section 3417(c) of the Act, good faith reliance upon this certification relieves your institution and its employees and agents of any possible liability to the subject in connection with the disclosure of the requested financial records.

73-104 0-86--2