S. 809 — Saving Privacy Act

This section revises section 3402 of the Right to Financial Privacy Act of 1978 (RFPA) to permit a government authority to access or obtain copies of, or information in, a customer's reasonably described financial records from a financial institution only in response to a search warrant meeting requirements of RFPA section 3406 (previously permitted also via customer authorization under sec. 3404, administrative subpoena under sec. 3405, judicial subpoena under sec. 3407, or formal written request under sec. 3408, subject to specified exceptions). It strikes RFPA sections 3404, 3405, 3407, and 3408; and in RFPA sec. 3409(a), replaces cross-references to the struck sections with a reference solely to sec. 3406(c). (Thus, nearly all non-warrant government access to customer financial records is prohibited.) This section further amends the Bank Secrecy Act (BSA, 31 U.S.C. ch. 53) as follows: (1) revises the purpose of subchapter II to require financial institutions to retain only transaction records identifiable to particular customers; (2) in sec. 5312(a)(2), repeals definitions for specified nonfinancial businesses and organizations (e.g., money services businesses, casinos); (3) strikes reporting and recordkeeping requirements in secs. 5313 (currency transactions over $10,000), 5314, 5316 (bulk cash shipments), 5331 (nonfinancial business reports), and 5332 (ML/TF reports); (4) strikes enforcement and penalty provisions in secs. 5315, 5317, 5318A (special measures), 5324 (structuring), 5326 (ML advisory), and 5336 (civil penalties); (5) in sec. 5318, strikes exceptions to confidentiality requirements, eliminates paragraph (2) on customer due diligence, and revises definitions and special measures for foreign bank accounts; (6) revises civil and criminal penalties in secs. 5321 and 5322 by striking references to repealed sections and special measures; (7) in sec. 5325(a), subjects the $3,000 aggregation threshold for reciprocal reporting to annual CPI adjustment; (8) in secs. 5330 and 5335, strikes certain registration and reporting requirements; and (9) strikes subchapter III (currency transaction reporting) and related table of contents items. (As background, the BSA combats money laundering and terrorism financing by mandating financial institution reports of suspicious activities and large cash transactions; these changes eliminate most such mandates.)

This section amends the Right to Financial Privacy Act of 1978 (RFPA)—which generally requires government authorities to provide financial institution customers with notice and an opportunity to challenge disclosure of their records before access is granted—by (1) eliminating the requirement in section 1108 that formal written requests for financial records be authorized by regulations promulgated by the agency or department head (thus streamlining such requests to three conditions: no alternative summons or subpoena authority available, relevance to a legitimate law enforcement inquiry, and customer notice with a 10-day/14-day waiting period); and (2) in section 1113, repealing exceptions permitting access without full RFPA procedures in cases including certain foreign counterintelligence activities (subsec. (d)), emergency situations involving immediate danger (subsec. (e)), legislative branch investigations (subsec. (f)), and regulatory examinations (subsecs. (g), (l), etc.), while adding subsection (s) to prohibit federal access to financial records in violation of the Fourth Amendment and expressing the sense of Congress that the RFPA protects expectations of privacy in such records.

This section requires the Securities and Exchange Commission (SEC) to terminate the Consolidated Audit Trail (CAT)—a central repository for order and trade data in U.S. equity and options markets created pursuant to SEC Rule 613 (17 C.F.R. § 242.613)—within 30 days of enactment (notwithstanding other law) and to amend related regulations, no-action letters, and guidance within 120 days. Following termination, it prohibits the SEC and self-regulatory organizations from administering CAT and bars any federal agency from establishing a similar consolidated audit trail, central repository, or centralized database collecting personally identifiable information (PII) of U.S. citizens absent specific statutory authorization. It further requires CAT LLC and FINRA CAT LLC to reimburse all fees collected for CAT prior to enactment within one year.

This section prohibits Federal Reserve banks, the Board of Governors of the Federal Reserve System, the Secretary of the Treasury, other agencies, and entities acting on their behalf from (1) minting or issuing central bank digital currency directly to an individual (including through a custodial intermediary) or a digital currency intermediary; (2) offering related products or services directly to an individual; or (3) maintaining an account on behalf of an individual (including at a digital currency intermediary or supervised commercial bank). It further prohibits any Federal Reserve bank from holding U.S. government-issued digital currencies as balance sheet assets or liabilities or using them to fulfill monetary policy requirements under section 2A of the Federal Reserve Act.

This section states the purpose of the title as increasing accountability for and transparency in the federal regulatory process through the REINS Act, which requires a congressional vote on major regulations.

This section revises chapter 8 of title 5, United States Code (commonly known as the Congressional Review Act), which currently enables Congress to disapprove agency rules via joint resolution within a 60-day review period. (1) It requires agencies, before any rule takes effect, to publish in the Federal Register a list of supporting information (including data, studies, and cost-benefit analyses) with online access details and to submit to Congress and the Comptroller General a report containing the rule, a general statement, a major/nonmajor determination (with explanation), related regulatory actions and effects, proposed effective date, and constitutional authority; agencies must also provide cost-benefit analyses (including jobs impacts distinguishing public and private sectors), regulatory flexibility and unfunded mandates compliance, inflation estimates, and other relevant materials. (2) It directs the Comptroller General to assess each major rule's procedural compliance and private-sector impacts in a report to congressional committees within 15 calendar days of submission or publication and to make requested determinations on rule status (within 60 days) or major rule classification (within 90 days, consulting CBO). (3) It provides that major rules take effect only upon enactment of a joint resolution of approval under new section 802 (or later per the rule) and do not take effect if no such resolution is enacted within 70 session or legislative days (excluding adjournments over 3 days) of report receipt, after which no further approval is permitted in that Congress; nonmajor rules take effect subject to new disapproval procedures under section 803. (4) It authorizes the President to permit a major rule to take effect for one 90-calendar-day period via Executive order if necessary due to an imminent health/safety threat or emergency, for criminal law enforcement, or for national security (text as provided).

This section establishes a new baseline assumption that any rule subject to the congressional approval procedure under 5 U.S.C. §802 (i.e., Congressional Review Act) affecting budget authority, outlays, or receipts is assumed effective unless disapproved by Congress in accordance with that section. (Thus, for CBO baseline projections used in budget enforcement mechanisms such as PAYGO and sequestration, the budgetary effects of such rules are included unless Congress vetoes them.)

This section directs the Comptroller General of the United States to conduct a study, as of the date of enactment, to determine (1) the number of rules in effect, (2) the number of major rules in effect, and (3) the total estimated economic cost imposed by all such rules, as defined in 5 U.S.C. 804. Not later than one year after enactment, the Comptroller General must submit a report containing the study's findings to Congress and publish it on the Government Accountability Office (GAO) website.

This section establishes criminal penalties under the Right to Financial Privacy Act of 1978 for any U.S. agency, department, or financial institution that knowingly obtains or discloses financial records in violation of the Act. It imposes fines up to $5,000, imprisonment up to five years, or both—plus prosecution costs—with conviction requiring dismissal of any involved federal officer or employee; financial institutions or their agents or employees acting in good-faith reliance on a government certificate or per section 1113(l) are exempt from prosecution. (As background, the Act restricts government access to customer financial records held by financial institutions absent customer notice and consent or required legal process.)

This section revises civil liability under the Right to Financial Privacy Act of 1978 (RFPA)—which restricts government access to individuals' financial records without notice or customer consent—for U.S. agencies or financial institutions violating those protections by replacing the prior structure of (1) a flat $100 penalty, (2) actual damages, (3) punitive damages for willful violations, and (4) costs plus reasonable attorney's fees in successful actions with (1) not less than $1,000 per violation per day, (2) reasonable attorney's fees and litigation costs, and (3) compensatory damages. (Thus, penalties increase substantially due to the per-violation-per-day calculation, while eliminating punitive damages and making attorney's fees and costs available without requiring a successful action.)

This section establishes a new section 1118A in the Right to Financial Privacy Act of 1978 (RFPA) providing that, in addition to existing remedies such as injunctive relief, a writ of mandamus and all other appropriate relief—including equitable or declaratory relief—shall be available to require compliance with the Act's procedures. (As background, the RFPA generally requires government agencies to provide customer notice and an opportunity to challenge access before obtaining an individual's financial records from financial institutions.)

This section restores the de minimis exception from third party settlement organization reporting requirements for third party network transactions (i.e., payments processed through platforms such as PayPal and Venmo)—previously modified by the American Rescue Plan Act of 2021 to require reporting for payments exceeding $600 with no transaction minimum—to the prior thresholds of payments exceeding $20,000 and more than 200 transactions. The amendments apply to returns for calendar years beginning after December 31, 2021 (subsection (a)), and to transactions after the March 11, 2021, enactment of the American Rescue Plan Act (subsection (b)).

This section prohibits the head of any federal agency from restricting a covered user's ability to (1) use convertible virtual currency for the user's own purposes, such as purchasing real or virtual goods and services for the user's own use; or (2) conduct transactions through a self-hosted wallet. Convertible virtual currency is a medium of exchange equivalent to or substituting for currency; a covered user is a person obtaining such currency to purchase goods or services on their own behalf; and a self-hosted wallet is an interface securing and transferring such currency where the owner retains independent control.