Twenty-five years ago this morning, nineteen hijackers attacked the United States. The day is remembered for its dead. Far fewer people realise that the morning also changed something they deal with every month: the way banks treat anyone whose life crosses a border.
The link is not obvious, because the money behind the attacks was small and ordinary. The National Commission on Terrorist Attacks Upon the United States concluded in its staff monograph on terrorist financing that the plot cost al Qaeda somewhere between 400,000 and 500,000 dollars, of which about 300,000 dollars was deposited into the hijackers' own US bank accounts. The money arrived by wire transfer, as cash and traveller's cheques carried into the country, and through debit and credit cards drawing on accounts abroad. The Commission's staff described these as unremarkable transactions and wrote that the existing safeguards did not fail; they were never designed to detect or disrupt transactions of the type that financed 9/11.
That finding came later. The law came first, and fast.
Forty-Five Days
On 26 October 2001, forty-five days after the attacks, the President signed Public Law 107-56, the USA PATRIOT Act. Its Title III carries its own name: the International Money Laundering Abatement and Anti-Terrorist Financing Act of 2001.
The findings Congress wrote into section 302 of the enrolled bill read like a map of what was about to change. Congress cited an International Monetary Fund estimate that money laundering amounted to between 2 and 5 percent of global GDP. It named offshore jurisdictions offering anonymity combined with weak supervision. It singled out correspondent banking, the accounts foreign banks hold at US banks, as open to manipulation that hides the real parties to a transaction. And it named private banking for large personal fund transfers as vulnerable, giving corrupt foreign officials as an example.
Read those findings again from the point of view of someone who lives in one country, banks in a second and earns in a third. Every feature of that life, the foreign address, the foreign account, the cross-border transfer, had just been written into federal law as a risk factor.
Five Sections That Reached Every Account
Title III is long, but five provisions did most of the work. Their banking duties still sit today in 31 U.S. Code § 5318 and in section 5318A, which section 311 created.
Section 311, special measures. It gave the Secretary of the Treasury power to require US financial institutions to take special measures where a jurisdiction, a foreign institution, a class of transactions or a type of account is found to be of primary money laundering concern. In practice, it gave Washington a lever over banks that are not American at all, because any bank that wants to move dollars needs American correspondents that are bound by these measures.
Section 312, due diligence for foreign persons. Every US financial institution that maintains a private banking account or a correspondent account for a non-US person must run due diligence policies designed to detect and report money laundering. For private banking accounts, the minimum includes identifying the nominal and beneficial owners and the source of funds, and applying enhanced scrutiny where the account belongs to a senior foreign political figure, a family member or a close associate.
Section 313, no shell banks. US institutions may not keep correspondent accounts for a foreign bank with no physical presence in any country, and must take reasonable steps to make sure their foreign bank clients do not pass services on to one. Physical presence means a fixed address, at least one full-time employee, operating records and supervision.
Section 319, reach and speed. It provided that funds deposited in a foreign bank holding an interbank account in the United States are deemed, for forfeiture purposes, to have been deposited in that US account. Separately, a covered institution must produce anti-money laundering records within 120 hours of a request from its federal banking regulator.
Section 326, who you are. Treasury had to set minimum standards for verifying the identity of anyone opening an account. The rule that followed, now 31 CFR 1020.220, requires a bank to obtain, before opening an account, at least a name, a date of birth, an identification number and an address. For an individual, the address must be a residential or business street address. For a non-US person, the identification number can be a passport number with the country of issue, or another government-issued document evidencing nationality or residence and bearing a photograph.
Why the Burden Landed on People Who Live Abroad
None of these provisions mention expatriates, digital nomads or retirees on the Algarve. They did not need to.
The architecture works through risk, and every tool in Title III treats cross-border features as the thing to look at more closely. A non-US person gets enhanced scrutiny in private banking. A foreign bank gets questioned about its owners and its own customers before it can hold a dollar account. A customer must give a street address, not a post office box, and the address must be verifiable. Nothing in that list is unreasonable on its own. Taken together, it means that the more international your life is, the more paper your bank needs before it can say yes.
Correspondent banking is where the effect travels furthest. When a US bank must know who owns its foreign bank client and whether that client serves other foreign banks, the foreign bank in turn has to know its own customers well enough to answer. The obligation moves down the chain until it reaches a teller in Lisbon, Limassol or Kuala Lumpur asking why a customer with a German passport receives payments from Singapore. The Brief's piece on de-banking describes where this ends when the answer is too complicated for the bank to price.
The irony is the one the Commission's staff spelled out. The transactions that financed 9/11 were ordinary: accounts opened in the hijackers' own names, wires, cash, cards. The system built afterwards is designed to catch what is unusual. For most people who live across borders, their normal life is exactly what now looks unusual to a compliance algorithm.
From Washington to the World
Title III did not stay American for long, because the dollar does not.
The Financial Action Task Force, the intergovernmental body that sets anti-money laundering standards, added a set of Special Recommendations on terrorist financing to its Forty Recommendations. According to the FATF, the combined "40+9" formed the international standard for combating money laundering and terrorist financing until the revised FATF Recommendations were adopted in February 2012. Countries that want access to the international financial system implement those standards and are assessed on them.
Once the machinery of verification and reporting existed, it was used for more than terrorism. On 18 March 2010, the Hiring Incentives to Restore Employment Act became Public Law 111-147. As the IRS describes it, the Foreign Account Tax Compliance Act passed as part of that law generally requires foreign financial institutions to report on the foreign assets of their US account holders or be subject to withholding. FATCA is a tax law, not an anti-terror law. But it runs on the same principle Title III established: a foreign bank's access to the US market depends on how much it tells Washington about its customers. The wider transparency agenda built on the same foundations is the subject of the Brief's analysis of CARF, CRS and the transparency endgame.
For US citizens abroad, the practical consequence is that every foreign bank has to weigh the reporting cost of each American customer against the value of the relationship. For non-Americans trying to bank in the United States, the identification rules decide what is possible, as the Brief's guide to opening a US account without an SSN shows.
Emergency Laws Do Not Expire
There is one more detail in the enrolled text worth remembering on this anniversary. Section 303 provided that, from the first day of fiscal year 2005, Title III would terminate if Congress passed a joint resolution saying so, and it asked Congress to consider any such resolution expeditiously. The banking provisions nonetheless remain in the US Code a quarter of a century later. The shell-bank ban, the 120-hour rule and the enhanced scrutiny of senior foreign political figures read in the current text of section 5318 almost word for word as they did in October 2001.
That is the general rule, not the exception. Measures adopted in a crisis rarely come with a date when the crisis will be declared over. They become the baseline, and the next set of rules is built on top. Anyone planning an international life should assume that compliance only ratchets one way.
Living With the Architecture
The history points to a few principles that follow directly from how the rules work.
Your address has to be real. The customer identification rule asks for a street address because the system wants to know where you actually are. An address that exists only for correspondence is the first thing a risk model flags.
Your story has to be consistent. Passport, tax residence, address, income source and the pattern of your transfers are read together. Where they point in different directions, the bank has to ask why, and every question costs time. The Brief's analysis of why the digital nomad model broke down on banking and CRS is largely a story of stories that did not add up.
Source of funds is permanent homework. Section 312 made beneficial ownership and source of funds standard questions for private banking accounts held by foreigners. Keeping a clean file that explains where your money came from, sale documents, tax returns and company accounts, is cheaper than reconstructing it when a bank asks.
Structure is not anonymity. The shell-bank ban and beneficial ownership rules make clear that the system looks through entities to the people behind them. Companies and trusts can serve good purposes, but a structure whose main feature is that nobody can see who owns it is precisely what the post-2001 rules were written to catch.
Diversify your banking. When compliance only ratchets one way, a single bank relationship is a single point of failure. Two or three banks in different jurisdictions, each with a complete and current file, mean that one bank's change of risk appetite is an inconvenience rather than a crisis.
Twenty-five years on, the day is rightly remembered for the people who died. The paperwork that followed is a minor footnote by comparison. But it is a footnote that every person who lives, works or invests across borders reads again each time a bank asks for one more document. Knowing where the questions came from does not make them go away. It does explain why they will not.
Work with Sebastian
If your banking has become harder as your life has become more international, the answer usually lies in making residence, tax and banking tell the same story. Book a consultation.
