H.R. 2155 — Saving Privacy Act

This section revises section 3402 of the Right to Financial Privacy Act of 1978 (RFPA) to limit government access to, or copies of, reasonably described customer financial records from a financial institution to disclosures in response to a search warrant meeting requirements of section 3406 (previously also permitted under (1) customer authorization per section 3404, (2) administrative subpoena or summons per section 3405, (3) judicial subpoena per section 3407, or (4) formal written request per section 3408); strikes sections 3404, 3405, 3407, and 3408; and updates cross-references in section 3409(a) to reference only section 3406(c). (As background, the RFPA protects customer financial records from warrantless government access except under specified procedures; thus, these changes eliminate non-warrant access methods and related procedures.) The section further amends the Bank Secrecy Act (BSA, 31 U.S.C. ch. 53, which requires financial institutions to maintain records and file reports on certain transactions to detect money laundering and other crimes) as follows: (1) revises the purpose statement in section 5311 to require retention of customer-identifiable transaction records; (2) in section 5312(a)(2), repeals definitions for multiple financial institution types (e.g., money services businesses, brokers-dealers, mutual funds) and redefines "nonfinancial trade or business" in section 5312(a)(4); (3) strikes reporting and recordkeeping sections 5313, 5314, 5315, 5316, 5317, 5318A, 5324, 5326, 5331, 5332, and 5336, special measures authority, and subchapter III (geographic targeting orders); (4) in section 5318, strikes exceptions to compliance programs, deletes paragraph (a)(2), redesignates remaining paragraphs, revises definitions in subsection (k) for payable-through and correspondent accounts, and eliminates certain special measure triggers; (5) revises civil and criminal penalties in sections 5321 and 5322 by striking exceptions and references to repealed provisions; (6) in section 5325(a), subjects the $3,000 threshold to annual CPI adjustment; (7) narrows civil penalty triggers in section 5330(d)(1); and (8) strikes non-economic sanctions in section 5335(c). (Thus, these changes repeal most BSA reporting mandates—such as currency transaction reports, suspicious activity reports, and foreign bank account reports—while retaining core record-retention and modified compliance/penalty requirements.)

This section amends the Right to Financial Privacy Act of 1978 (RFPA), which generally requires government authorities to provide customers notice and an opportunity to challenge requests for their financial records held by financial institutions (with specified exceptions), as follows: (1) in section 3408, striking the requirement that formal written requests—permitted when no administrative summons or subpoena authority is available—be authorized by regulations promulgated by the agency or department head, and redesignating subsequent paragraphs accordingly; (2) in section 3413, repealing multiple exceptions to RFPA protections that permitted disclosures of financial records without customer notice or consent in specified circumstances (subsections (a), (d), (e), (f), (g), (i), (l), (m), (n), (p), (q), and (r)); and (3) adding a new subsection (s) to section 3413 prohibiting federal access to financial records in a manner prohibited by the Fourth Amendment and expressing the sense of Congress that the RFPA protects customer expectations of privacy in such records.

This section requires the Securities and Exchange Commission (SEC) to terminate the Consolidated Audit Trail (CAT)—a consolidated audit trail and central repository for tracking orders in national market system securities created pursuant to SEC Rule 613 (17 CFR 242.613)—not later than 30 days after enactment of this Act, notwithstanding other laws or regulations, and to amend related regulations, no-action letters, interpretive letters, exemptive letters, legal bulletins, and guidance within 120 days. Following termination, it prohibits (1) the SEC and any self-regulatory organization from administering CAT and (2) any federal agency from establishing a similar consolidated audit trail, central repository, or centralized database collecting personally identifiable information (PII; i.e., information traceable to an individual, excluding CAT-Order-ID and CAT-Reporter-ID) of U.S. citizens unless specifically authorized by a duly enacted law. It further requires CAT LLC and FINRA CAT LLC to reimburse all fees collected for CAT prior to enactment within one year.

This section prohibits Federal Reserve banks, the Board of Governors of the Federal Reserve System, the Secretary of the Treasury, other agencies, and related entities from minting or issuing central bank digital currency (CBDC) directly to individuals (including through custodial intermediaries) or digital currency intermediaries, offering related products or services directly to individuals, or maintaining accounts on behalf of individuals (including at digital currency intermediaries or supervised commercial banks). It further prohibits Federal Reserve banks from holding U.S. government-issued digital currencies as balance sheet assets or liabilities or using them to fulfill monetary policy objectives under section 2A of the Federal Reserve Act.

This section declares the purpose of this title to increase accountability for and transparency in the federal regulatory process.

This section revises chapter 8 of title 5, United States Code (commonly known as the Congressional Review Act), which enables Congress to review certain federal agency rules promulgated after public notice and comment. The revision requires each federal agency, before a rule takes effect, to submit to Congress and the Comptroller General (i.e., Government Accountability Office) a report containing the rule, a general statement, a major or nonmajor rule determination (made with Office of Information and Regulatory Affairs input and addressing statutory criteria), related regulatory actions and their economic effects, the proposed effective date, and constitutional authority; to provide the cost-benefit analysis (including jobs impacts), regulatory flexibility and unfunded mandates compliance, inflation effects, and other materials; and to publish supporting information in the Federal Register with online access details. (Thus, agencies must front-load extensive transparency and analysis previously required post-promulgation or not at all.) Major rules do not take effect unless Congress enacts a joint resolution of approval under new section 802 within 70 session or legislative days (excluding periods of more than three days adjournment) from report receipt, after which no further approval resolution may be considered in the same Congress; the Comptroller General must report to committees on each major rule within 15 calendar days, assessing procedural compliance and private-sector impacts. Nonmajor rules take effect as provided under new section 803 after submission. The President may allow a major rule to take effect for one 90-calendar-day period by executive order citing an imminent health/safety threat or emergency, criminal law enforcement necessity, or similar (text cuts off).

This section amends the baseline assumptions for direct spending and receipts under the Balanced Budget and Emergency Deficit Control Act of 1985 by adding a new exception requiring that any rule subject to the congressional review procedure in 5 U.S.C. § 802—which affects budget authority, outlays, or receipts—be assumed effective unless disapproved by Congress. (Thus, in CBO and OMB budget projections, the budgetary effects of such rules are included unless Congress enacts a joint resolution of disapproval.)

This section directs the Comptroller General of the United States to conduct a study, as of the date of enactment, determining (1) the number of rules in effect, (2) the number of major rules in effect, and (3) the total estimated economic cost imposed by all such rules, as defined in 5 U.S.C. 804. The Comptroller General must submit a report containing the study's findings to Congress and publish it on the Government Accountability Office website not later than one year after enactment. (As background, under 5 U.S.C. 804, a "rule" generally follows the Administrative Procedure Act definition excluding certain agency management or procedural rules, and a "major rule" is one the Office of Information and Regulatory Affairs determines to have an annual economic effect of $100 million or more, major cost increases, or significant adverse effects on competition, employment, or U.S. enterprises.)

This section establishes criminal penalties under the Right to Financial Privacy Act of 1978 for any U.S. agency or department or financial institution that knowingly obtains or discloses financial records in violation of the Act. Violators are subject to a fine of up to $5,000, imprisonment for up to five years, or both, plus prosecution costs; U.S. officers or employees convicted of such violations must also be dismissed from office or discharged from employment. Financial institutions (or their agents or employees) acting in good-faith reliance on a government certificate or pursuant to section 1113(l) are exempt from these penalties.

This section revises civil liability under the Right to Financial Privacy Act of 1978 (RFPA)—which limits government access to customers' financial records held by financial institutions—for agencies or financial institutions that improperly obtain or disclose such records. It replaces the prior remedies of $100 statutory damages (regardless of records volume), actual damages, punitive damages (for willful or intentional violations), and costs plus reasonable attorney's fees with (1) not less than $1,000 per violation per day, (2) reasonable attorney's fees and litigation costs, and (3) compensatory damages.

This section establishes a new section 1118A in the Right to Financial Privacy Act of 1978 (RFPA), which requires government agencies to follow specific procedures—including customer notice and challenge rights—before obtaining financial records from financial institutions. The new section provides, in addition to existing remedies such as injunctive relief, a writ of mandamus and all other appropriate relief (including equitable or declaratory relief) to require compliance with the Act's procedures.

This section reinstates the de minimis exception for third party settlement organizations (i.e., payment processors such as PayPal or Venmo) reporting third party network transactions under IRC §6050W, requiring reporting only if the aggregate amount exceeds $20,000 and the number of transactions exceeds 200 (from the $600 threshold with no transaction minimum established by the American Rescue Plan Act of 2021). It also makes a conforming amendment to §6050W(c)(3). The amendments apply to (1) returns for calendar years beginning after December 31, 2021, and (2) transactions after ARPA enactment.

This section prohibits any federal agency head from restricting a covered user's ability to (1) use convertible virtual currency for the user's own purposes, such as purchasing real or virtual goods and services; or (2) conduct transactions through a self-hosted wallet. It defines convertible virtual currency as a medium of exchange equivalent to or acting as a substitute for currency; covered user as a person obtaining such currency to purchase goods or services on their own behalf; and self-hosted wallet as a software interface securing and transferring such currency where the owner retains independent control.