Verification that FFL Boss is ATF Ruling 2016-1 Compliant

ATF Ruling 2016-1 authorizes FFLs to use cloud based electronic acquisition and disposition records but places the burden on FFLs to verify software service providers meet 14 conditions.  Here are the 14 conditions that must be met and how FFL Boss complies with all provisions:

 

1. The licensee records in the computer system all of the acquisition and disposition information required by 27 CFR 478.121, 478.122, 478.123, 478.125(e), 478.125(f), and 27 CFR 479.131, as applicable. Required information includes a record of both the manufacturer and the importer (if any). Additional columns can be utilized to capture certain additional information (e.g., inventory number, new/used, etc.), so long as the additional information is separate from the required information and the required information is readily apparent. An ATF Form 4473 serial number may be used instead of the address for recording the transfer of a firearm to a non-licensee if such forms are filed numerically.

FFL Boss creates a printable version of your electronic A&D book which contains all information you would find in a paper bound book:

2. The electronic acquisition and disposition bound book software must track corrections and changes utilizing one of the following methods of tracking changes:

b. The system must be able to print the corrections as a separate report containing the same parameters as are required for a paper bound book, including the firearm information, acquisition details, and disposition details. The format of the correction report may follow the traditional bound book format, or may be presented in any column format as long as the necessary information outlined above exists in the report (which may include a notes column).

FFL Boss tracks changes to the electronic bound book and creates a separate report containing the original value and the replaced value along with any notes about the correction:

3. The system cannot rely upon invoices or other paper/manual systems to provide any of the required information. Also, if a licensee chooses to use an electronic recordkeeping system for any of its required acquisition and disposition records, then all acquisition and disposition records, regardless of type (e.g., gunsmithing, sales, NFA), must also be in the electronic format as prescribed by this ruling.

FFL Boss provides electronic records for all types of ATF required records, including Acquisitions, Dispositions, Destroyed Items, Lost / Stolen Items, NFA items and Gunsmithing items:

4. The system must allow queries by firearm serial number, acquisition date, name of the manufacturer or importer, name of the purchaser, address of purchaser or other transferee, and ATF Form 4473 transferor’s transaction serial number (if any).

FFL Boss allows you to search by any value within the bound book, acquisition, disposition or product information, including but not limited to the serial number, acquisition date, name of the manufacturer or importer, name of the purchaser, address of purchaser or other transferee, and ATF Form 4473 transferor’s transaction serial number:

5. The licensee must download all records from the system to a physical storage device (e.g. hard drive, Compact Disc (CD), Digital Versatile Disc (DVD), or Universal Serial Bus (USB) Flash Drive) at the licensee’s business premises, or print and maintain them at the licensee’s business premises:

a. at least semiannually; however, if the records are downloaded, from a host facility (e.g., remote server or cloud storage provider) contracted/leased by the licensee as provided in condition #9, they must be downloaded at least daily. In all cases, the records must be downloaded in a format that is unencrypted with the required information readily apparent;

b. upon request of an ATF officer (must be provided within 24 hours);

c. prior to discontinuance or change of: the software (program); the database system, whether or not maintained by a host facility (e.g., remote server or cloud storage provider); and/or the host facility (if applicable); and

d. prior to discontinuance of the licensee’s firearms business.

The entire Electronic Bound Books can be downloaded or printed in an unencrypted form at any time from the BOUND BOOKS menu:

6. If a licensee downloads the records onto a physical storage device (e.g., hard drive, CD, DVD, or USB Flash Drive), the download must be retained on the physical storage device until the next download is prepared. Additionally, the licensee must be able to present the most current version of the requested records in a printed format at ATF’s request.

We encourage and remind FFL Boss users to download their Electronic Bound Books every day directly from the Dashboard upon login and all downloads are automatically updated with the most current version of A&D records:

7. If the licensee prints out the records, the printout must be retained until the next printout is prepared.

Printing your Electronic Bound Book in FFL Boss is very simple, all you have to do is go to the BOUND BOOKS menu and click print:

We also encourage our users to retain their print outs until they print the next one out.

8. Downloads/printouts may include antique firearms, but cannot include other merchandise. However, antique firearms must be identified as such in the “firearm type” column.

You can add several different types of products to the “Products / Firearms” inventory system within FFL Boss but only the following types are complied into the download / printout copy of the Electronic Bound Book:

9. Electronic firearms acquisition and disposition records may be stored on a computer server or device owned and operated by the licensee, or contracted/leased by the licensee through a host facility (e.g., remote server or cloud storage provider), provided that:

a. The firearms acquisition and disposition records are readily accessible through a computer or device located at the licensed premises during regular business hours; and

b. The licensee’s server is located within the United States or its territories, or if a host facility is used, that facility must have a business premises within the United States or its territories, and must be subject to U.S. legal process.

Licensees are strongly encouraged to ensure that there are proper and robust security protection measures in place (e.g., encryption) to ensure all data is protected.

FFL Boss uses many layers of high level security to validate and verify that your data is protected, we secure and encrypt on both ends of communication, both client side (your computer) and server side. You can access our website 24/7/365(6) to access all your data at https://www.fflboss.com, our servers and backup systems are all located within US data centers of the Azure Cloud Service:

10. If the licensee contracts with, leases from, or changes a host facility (e.g., remote server or cloud storage provider), the licensee must, within 30 days, notify his/her respective ATF Area Office of the name and address of the host facility.

When you start using FFL Boss remember to contact your ATF Area Office and let them know that you use FFL Boss (of Queen Creek, AZ).

11. Each licensee must maintain its firearms acquisition and disposition records on a separate/partitioned database that cannot be intermingled with the records associated with another license.

All data, for every FFL Boss user account is stored within a secured, separate, token validated and partitioned database so that no data can be intermingled with the records of any other user account.  FFL Boss allows you to have multiple FFLs added to your single login (i.e. two store locations, each has their own FFL) and even those Electronic Bound Books are simultaneously accessible within your FFL Boss account yet fully separate and partitioned so that records nor data cannot be intermingled:

12. The storage system must back-up the firearms acquisition and disposition records on at least a daily basis to protect the data from accidental deletion or system failure.

Data is backed up at least once per day to a backup server within the US data centers of the Azure Cloud Service.

13. Licensees must retain all records in accordance with 27 CFR 478.129, ATF Rul. 2010-8, Consolidation of Required Records for Manufacturers, and ATF Rul. 2011-1, Consolidation of Required Records for Importers (as applicable). It is strongly recommended that upon reaching 20 years, those electronic firearms acquisition and disposition records be either permanently maintained by the licensee or forwarded to the ATF Out-of-Business Records Center for preservation.

FFL Boss has been in business since 2011, we have maintained electronic data records since then and will continue to maintain records in perpetuity for our customers for as long as they need accessibility to them (20 years+). Electronic firearms records can easily be downloaded from within the BOUND BOOKS menu or from the Dashboard at any time:

14. Upon discontinuance of business, the licensee must send required records to the ATF Out-of-Business Center in accordance with 27 CFR 478.127. The licensee must print out the required records or download them to a physical storage device (as defined in paragraph 5) or, at the discretion of the licensee, both. The complete printout or download must provide an American Standard Code for Information Interchange (ASCII) text file (in conformity with industry standards) containing all acquisition and disposition records, and a file description. The complete printout or downloaded ASCII text file (and file description) must contain all information prescribed by regulation. The NTC converts these files into image files not searchable by name.

You can print an ATF Out-of-Business compliant copy of all your electronic bound books from within the BOUND BOOKS section of our website:

Also review: Verification that FFL Boss is ATF Ruling 2016-2 Compliant