THE SURVEILLANCE NO ONE VOTED FOR

THE SURVEILLANCE NO ONE VOTED FOR

OPINION BY: Hem Kumar September 2026

Twenty-five years ago this month, nineteen men turned commercial aircraft into weapons and murdered nearly three thousand people on American soil. Nothing written here disputes the scale of that grief, or the legitimacy of a state’s obligation to prevent its recurrence. But grief is not a blank check, and in 2001 Congress wrote one anyway. The USA PATRIOT Act passed both chambers and reached the President’s desk in six weeks — a bill that, as the Cato Institute’s Robert A. Levy observed at the time, moved through Congress faster than routine legislation raising no constitutional concerns, while gutting large sections of the Fourth Amendment.

Twenty-five years on, the law’s financial-surveillance architecture — expanded Know-Your-Customer mandates, a widened net of obligated institutions, and Section 314(a) information-sharing that lets federal agencies map a citizen’s entire banking footprint without a warrant, a subpoena, or a grand jury — is no longer used chiefly against terrorists. It has been redirected at immigrants and, this year, at protest movements, exactly as critics warned a permanent security state eventually would.

The American reckoning with that law is, at least, a live public argument. Reporters file to it. Cato writes about it. Talking Points Memo can publish an investigation into Homeland Security Investigations using Section 314(a) to surveil left-leaning organizing, and the story finds an audience prepared to be outraged.

Guyana has no equivalent public reckoning, because Guyana has no equivalent public knowledge of what its banks are actually doing — and this editorial exists to begin correcting that.

THE TRANSACTION THAT SHOULD NOT REQUIRE AN INTERROGATION

Here is the fact pattern, stated plainly, because plain facts are the strongest indictment available: a Guyanese customer sought a bank cheque. The funds were the customer’s own, already on deposit, already known to the institution, already accounted for on its books. There was no cash coming in from an unverified source. There was no foreign wire of uncertain origin.

There was, in the plainest sense available to a bank’s own compliance framework, no open question about where the money came from — the bank was already holding it.

The bank nonetheless demanded photo identification for the payee — a person who is not the bank’s customer, has no account relationship with the institution, and was not a party to any transaction the bank needed to evaluate for risk. The customer, whose funds and whose conduct are the actual subject of the transaction, is the one who is already fully documented, fully known, and fully compliant. The payee’s identity adds nothing to any legitimate assessment of that transaction’s risk. It cannot, because the money’s provenance was never in question.

This is not risk-based due diligence. Risk-based due diligence calibrates scrutiny to the actual uncertainty in a transaction — the FATF standard that Guyana’s own regulators claim to follow requires exactly that calibration, and explicitly warns against its opposite. This is something else: a reflexive demand for identification because demanding identification has become the institutional posture, regardless of whether the specific transaction in front of the teller presents any question that identification could answer.

NO ONE MADE THEM DO THIS

It would be a different editorial — a more familiar one — if Guyana’s banks could point to Basseterre, or to Paris, and say the FATF made them do it. That defense is not available to them. As of the June 2026 FATF plenary, Guyana is not on the Jurisdictions Under Increased Monitoring list. It is not grey-listed. It is not black-listed. It sits alongside the large majority of jurisdictions the FATF has not flagged for strategic AML-CFT deficiencies requiring international remediation.

This matters because the FATF’s own guidance is explicit that grey-listing is not an automatic trigger for enhanced due diligence, and that even where a jurisdiction is listed, the FATF discourages indiscriminate de-risking. In other words: even the architects of the global AML regime that grew out of America’s post-9/11 panic have had to formally warn financial institutions against exactly the behavior Guyanese banks are now engaged in — applying scrutiny with no proportion to actual risk.

Guyana’s banks are not merely over-complying with an international standard under pressure. They are manufacturing a standard that does not exist, on a jurisdiction that is not under the monitoring that would purport to justify it.

Two explanations remain, and neither reflects well on the institutions involved. Either this is a defensive posture; a bank inventing friction it can point to later as evidence of vigilance, at the direct expense of a customer’s time and a non-customer’s privacy, regardless of whether the friction accomplishes anything — or it is a Bank of Guyana-driven KYC requirement applied without the risk-calibration the framework itself demands, sweeping in payees who are not parties to any suspicious conduct because it is administratively simpler than assessing each transaction on its merits.

Both are failures of governance. Neither is counterterrorism, or counter-laundering, or anything the Bank Secrecy Act’s original 1970 drafters, or the PATRIOT Act’s 2001 authors, would recognize as their purpose.

THE PATTERN AMERICA IS ONLY NOW QUESTIONING

The lineage matters, and it is not flattering. Financial surveillance in the West did not begin with terrorism. It began with tax evasion, then annexed the war on drugs, then annexed counterterrorism after September 11, and is now — a quarter century later, in the same country that wrote the PATRIOT Act — annexing immigration enforcement and the policing of protest. Treasury’s recent directive requiring banks to report suspected undocumented immigrants, and Homeland Security Investigations’ use of Section 314(a) to map the finances of protest organizations without judicial process, are not aberrations from the system’s design.

They are what a permanent, expandable surveillance infrastructure does when the original justification runs out and a new one is needed to keep it staffed and funded.

Guyana should study that trajectory with more urgency than it currently does, because small states adopt these architectures with none of the institutional friction that at least slows the process in Washington. There is no Cato Institute publishing a dissent from the Bank of Guyana’s compliance posture. There is no investigative outlet with the resources of Talking Points Memo cataloguing which agencies request customer data and why. There is, in most cases, no statute a customer can cite back to a teller who has just demanded a stranger’s photo ID for a transaction the bank’s own records show presents no risk at all.

The asymmetry of power between an ordinary depositor and an institution that can simply say “regulations require it” — whether or not any regulation actually does — is the entire story, and it is a story Guyana’s banking public has had no occasion to hear told plainly.

WHAT ACCOUNTABILITY REQUIRES

This is not an argument against know-your-customer obligations, anti-money-laundering law, or the legitimate function of financial-crime enforcement. It is an argument that those obligations exist to answer specific questions about specific risks, and that a bank which cannot say what risk a payee’s photo ID resolves in a transaction it has already verified is not practicing compliance.

It is practicing theater, and billing the public for the performance in wasted time, needless friction, and the quiet normalization of surveillance for its own sake.

The twenty-fifth anniversary of September 11 is an appropriate moment for the United States to ask whether the architecture Congress built in six weeks of 2001 still serves the purpose it was built for.

It is an equally appropriate moment for Guyana to ask a simpler and more answerable question: when a bank cannot show that a specific demand for identification actually resolves a specific question of risk, on whose authority — and for whose benefit — was that identification ever required?

The 592 Guardian has posed that question to the institutions concerned. It should not require an editorial to get an answer.

— The Board