Bank Secrecy Act: Agencies and Financial Institutions Share Information but Metrics and Feedback Not Regularly Provided

Illicit finance activity, such as terrorist financing and money laundering, can pose threats to national security and the integrity of the U.S. financial system. FinCEN is responsible for administering BSA and has delegated examination responsibility to supervisory agencies. FinCEN also is to collect and disseminate BSA data. BSA requires that financial institutions submit reports, which may be used to assist law enforcement investigations. Industry perspectives on BSA reporting have included questions about its usefulness.

This report examines, among other objectives, how FinCEN and supervisory and law enforcement agencies (1) collaborate and (2) provide metrics and feedback on the usefulness of BSA reporting. GAO reviewed related laws and regulations; agency documentation; examination and enforcement action data; and interviewed FinCEN, supervisory agencies, and a nongeneralizable selection of six law enforcement agencies and seven industry associations.

The Financial Crimes Enforcement Network (FinCEN)—within the Department of Treasury—supervisory agencies (such as banking, securities, and futures regulators), and law enforcement agencies collaborate on implementing Bank Secrecy Act/anti-money laundering (BSA/AML) regulations, primarily through cross-agency working groups, data-sharing agreements, and liaison positions.

FinCEN and law enforcement agencies provided some metrics and institution-specific feedback on the usefulness of BSA reporting (such as suspicious activity reports) to the financial industry but not regularly or broadly.

FinCEN and some agencies have metrics on the usefulness of BSA reports. One law enforcement agency annually publishes aggregate metrics on BSA reports that led to investigations and indictments. But FinCEN did not consistently communicate available metrics; it generally did so on an ad-hoc basis such as through published speeches. In 2019, FinCEN began a study to identify measures on the value and usefulness of BSA reporting—to be completed by the end of 2019. By consistently communicating currently available metrics (summary data), and any later identified by the study, FinCEN may assist financial institutions in more fully understanding the importance of their efforts.

Industry associations GAO interviewed noted financial institutions would like to receive more institution-specific feedback on the usefulness of their BSA reporting; they also identified suspicious activity reports as labor-intensive. In 2017, FinCEN began providing such feedback and some law enforcement agencies have ongoing efforts to provide institution-specific briefings. But these efforts have not been regularly made and involved relatively few institutions. Additional and more regular feedback, designed to cover different types of financial institutions and those with significant financial activity, may enhance the ability of the U.S. financial industry to effectively target efforts to identify suspicious activity and provide quality BSA reporting.

GAO makes four recommendations, including that FinCEN review options to consistently communicate summary data and regularly provide institution-specific feedback on its BSA reporting. FinCEN concurred with the recommendation on summary data and agreed with the spirit of the recommendation on feedback. FinCEN raised concerns with the need for the two other recommendations. GAO continues to believe the recommendations have merit, as discussed in the report.

Illicit finance activity, such as fundraising by terrorist groups and money  laundering by drug-trafficking organizations, can pose threats to national  security, the well-being of citizens, and the integrity of the U.S. financial  system. The Bank Secrecy Act and related anti-money laundering  authorities and requirements (collectively, BSA/AML) are important tools  for regulators and law enforcement to detect and deter the use of financial  institutions for illicit finance activity. BSA and its implementing  regulations generally require financial institutions—such as banks,  securities broker-dealers, futures and commodities brokers, and money  transmitters—to collect and retain various records of customer  transactions, verify customers’ identities, maintain AML programs, and  report suspicious transactions.

The Financial Crimes Enforcement Network (FinCEN), a bureau in the  Department of the Treasury (Treasury), is responsible for the  administration of BSA/AML. As lead regulator for BSA, FinCEN issues  implementing regulations and ensures compliance with the BSA. FinCEN  has delegated its examination authority to certain federal agencies,  including the federal functional regulators who supervise institutions for  BSA compliance—Federal Deposit Insurance Corporation (FDIC), Board  of Governors of the Federal Reserve System (Federal Reserve), National  Credit Union Administration (NCUA), Office of the Comptroller of the  Currency (OCC), Commodity Futures Trading Commission (CFTC), and  Securities and Exchange Commission (SEC)—and the Internal Revenue  Service (IRS). We refer to the federal functional regulators and IRS  collectively as supervisory agencies in this report because they are  responsible for examining financial institutions for compliance with the  BSA/AML requirements. Self-regulatory organizations (SRO) for the  securities and futures industries—including the Financial Industry  Regulatory Authority (FINRA) and the National Futures Association  (NFA)—also have BSA/AML responsibilities and conduct BSA  examinations of their members. The Department of Justice (DOJ) can  conduct investigations of financial institutions and individuals for both civil  and criminal violations of BSA/AML laws and regulations. DOJ  prosecutes violations of federal criminal money laundering statutes and  violations of the BSA, and typically several law enforcement agencies  play a role in conducting BSA-related criminal investigations. In addition,  hundreds of agencies, including federal, state and local law enforcement,  supervisory agencies, and state regulators use BSA reporting—for  example, suspicious activity reports (SAR) and currency transaction  reports (CTR)—in their investigations or examinations.

In the past few years, some congressional committees have held  hearings on BSA/AML supervision and enforcement activities and  reforming the BSA/AML framework to improve coordination and  communication among agencies responsible for oversight of BSA/AML  requirements. We recently issued reports highlighting perspectives on  BSA/AML requirements and on concerns related to derisking—the  practice of banks limiting certain services or ending relationships with  customers to, among other things, avoid perceived regulatory concerns  about facilitating money laundering. In addition, financial institution  stakeholders have raised questions about the lack of a feedback loop or  clear communication from FinCEN, law enforcement, and supervisory  agencies on how to most effectively comply with BSA/AML requirements,  especially BSA reporting requirements.

You asked us to provide information on BSA implementation, including  efforts to improve coordination between federal agencies and the financial  industry to combat money laundering. This report (1) describes how  FinCEN and supervisory agencies supervise, examine for, and enforce  BSA/AML compliance; (2) discusses how FinCEN, supervisory agencies,  and law enforcement collaborated on implementing and enforcing  BSA/AML requirements; and (3) examines the extent to which FinCEN,  supervisory agencies, and law enforcement have established metrics and  provided feedback to financial institutions on the usefulness of their BSA  reporting.

To address our first objective, we reviewed relevant laws, regulations,  and agency documentation, including examination policies and  procedures. We reviewed and analyzed data from FinCEN summary  reports on the examination and enforcement activities of supervisory  agencies’ for fiscal years 2015 through 2018 (second quarter). We  assessed the reliability of the data by reviewing documentation related to  these datasets, interviewing officials knowledgeable about the data, and  conducting manual data testing for missing data, outliers, and obvious  errors. We determined the data to be sufficiently reliable for our purposes  of reporting summary data on agencies’ BSA/AML examinations,  violations, and enforcement actions. For this and our other objectives, we  interviewed officials at Treasury’s Office of Terrorism and Financial  Intelligence and FinCEN, the supervisory agencies, and SROs, FINRA  and NFA.

To address the second objective, we judgmentally selected six law  enforcement agencies: the Criminal Division (Money Laundering and  Asset Recovery Section), U.S. Attorney’s Offices (through the Executive  Office for United States Attorneys), and the Federal Bureau of  Investigation (FBI) in DOJ; IRS Criminal Investigation (IRS-CI) in  Treasury; and U.S. Immigration and Customs Enforcement-Homeland  Security Investigations (ICE-HSI) and U.S. Secret Service in the  Department of Homeland Security (DHS). We selected the six agencies  based on their (1) focus on financial crimes, (2) involvement in BSA  criminal cases we selected, (3) participation in FinCEN’s liaison program,  and (4) identification by FinCEN as key users of BSA data. The views of  selected law enforcement agencies are not generalizable. To identify key  collaborative mechanisms used to implement BSA/AML responsibilities,  we reviewed agency documentation (such as strategic plans, national  strategies, and risk assessments); prior GAO reports that contained  discussions of collaborative mechanisms; and interviewed agency  officials from FinCEN, supervisory agencies, and selected law  enforcement agencies. We compared agencies’ collaboration efforts to  criteria within federal internal control standards on management  communication. We also reviewed three criminal cases involving  BSA/AML violations by financial institutions to illustrate how law  enforcement investigates and prosecutes BSA violations and coordinates  with FinCEN and other supervisory agencies. We selected the cases  because they occurred recently (calendar year 2017 or 2018), involved  criminal violations of BSA by financial institutions, required agency  coordination, and resulted in a large monetary penalty. While not  generalizable, the cases provided insight into collaboration processes. To  obtain perspectives on BSA/AML implementation and agency  collaboration, we conducted interviews with the supervisory and law  enforcement agencies previously mentioned. To obtain additional  perspectives, we interviewed seven selected industry associations,  chosen based on their published works and relevant experience and for  coverage of key financial industries (banking, securities, futures, and money services businesses). While not generalizable, these interviews  helped provide context for how industry views the effectiveness of  BSA/AML collaboration efforts.

For the third objective, we reviewed relevant agency documentation and  data on any performance metrics related to the usefulness of BSA  reporting and any feedback mechanisms that FinCEN, supervisory  agencies, or the six selected law enforcement agencies had established.  We also interviewed FinCEN and the supervisory agencies, law  enforcement agencies, and industry associations previously mentioned.  We compared the BSA metrics against key criteria for enhancing or  facilitating the use of performance metrics that GAO previously identified  and federal internal control standards on management communication.  We also compared feedback mechanisms against Treasury’s information- sharing statutory duties and strategic plan, and international anti-money  laundering standards and guidance. For more information on our scope  and methodology, see appendix I.

We conducted this performance audit from February 2018 to August 2019  in accordance with generally accepted government auditing standards.  Those standards require that we plan and perform the audit to obtain  sufficient, appropriate evidence to provide a reasonable basis for our  findings and conclusions based on our audit objectives. We believe that  the evidence obtained provides a reasonable basis for our findings and  conclusions based on our audit objectives.

FinCEN oversees the administration of the Bank Secrecy Act and related  AML regulations, and has authority to enforce BSA, including through civil  money penalties. FinCEN issues regulations and interpretive guidance,  provides outreach to regulated industries, conducts examinations,  supports select examinations performed by federal and state agencies,  and pursues civil enforcement actions when warranted. FinCEN’s other  responsibilities include collecting, analyzing, and disseminating  information received from covered institutions, and identifying and  communicating financial crime trends and methods. See figure 1 for  federal supervisory agencies involved in the BSA/AML framework.

FinCEN primarily relies on supervisory agencies and other entities to  conduct examinations of U.S. financial institutions to determine  compliance with BSA/AML requirements (see table 1). FinCEN delegated  BSA/AML examination authority to these supervisory agencies, including  the banking regulators, SEC, CFTC, and IRS. IRS has been delegated  authority to examine certain financial institutions (such as money services  businesses) not examined by the federal functional regulators for BSA  compliance. The SROs that SEC and CFTC oversee—such as FINRA  and NFA respectively—have BSA/AML compliance responsibilities for the  activities of their members.

Apart from their delegated examination authority under the BSA, the  federal functional regulators and SROs have their own regulatory  authority to examine institutions they supervise for compliance with  BSA. FinCEN, the banking regulators, and SEC may assess civil money  penalties for BSA violations and take enforcement actions for  noncompliance. The SROs have established BSA-related rules or  requirements for their members based on federal requirements and may  take disciplinary actions against them for violations of these rules.

IRS issues letters of noncompliance to institutions it oversees and  generally relies on FinCEN for formal civil enforcement action, but IRS-CI  has the authority to investigate criminal violations. Other law  enforcement agencies (for example, DOJ Criminal Division, FBI, and ICE- HSI) also can conduct criminal investigations of BSA violations. More  generally, law enforcement agencies and prosecutors may review and  start investigations into a variety of criminal matters based on BSA  reporting filed in their areas of jurisdiction. According to FinCEN, BSA  recordkeeping and reporting requirements establish a financial trail for  law enforcement investigators to follow as they track criminals, their  activities, and their assets. Finally, DOJ prosecutes financial institutions  and individuals for violations of federal criminal money laundering  statutes.

U.S. financial institutions can assist government agencies in the detection  and prevention of money laundering and terrorist financing by complying  with BSA/AML requirements such as maintaining effective internal  controls and reporting suspicious financial activities. BSA regulations  include recordkeeping and reporting requirements, such as to keep  records of cash purchases of negotiable instruments, file CTRs on cash  transactions exceeding $10,000, and file SARs when institutions suspect  money laundering, tax evasion, or other criminal activities. Law  enforcement agencies and prosecutors (through FinCEN) may utilize the  314(a) program to locate accounts and transaction information from U.S.  financial institutions when terrorism or money laundering activity is  reasonably suspected based on credible evidence.

Most financial institutions must develop, administer, and maintain  effective AML programs. At a minimum, those financial institutions must establish a system of internal controls to ensure ongoing compliance  with the BSA and its implementing regulations; provide AML compliance training for appropriate personnel; provide for independent testing; and designate a person or persons responsible for coordinating and  monitoring day-to-day compliance.

In addition to these requirements, FinCEN issued a final rule in 2016  requiring banks, brokers or dealers in securities, mutual funds, futures  commission merchants, and introducing brokers in commodities to  establish risk-based procedures for conducting customer due diligence.  More specifically, covered financial institutions are to establish and  maintain written policies and procedures designed to (1) identify and  verify the identity of customers; (2) identify and verify the identity of the  beneficial owners of legal entity customers opening accounts; (3)  understand the nature and purpose of customer relationships to develop  customer risk profiles; and (4) conduct ongoing monitoring to identify and  report suspicious transactions and, on a risk basis, maintain and update  customer information. For example, covered financial institutions must  collect from the customer the name, birthdate, address, and Social  Security number or equivalent of any beneficial owners. The financial  institutions covered by this rule—which do not include money services  businesses, casinos, or insurance companies—had until May 11, 2018, to  comply.

Supervisory agencies and SROs oversee financial institutions’  compliance with BSA/AML requirements primarily through compliance  examinations, which, for banking regulators, can be components of  regularly scheduled safety and soundness examinations. All supervisory  agencies and SROs we interviewed that examine financial institutions for  BSA/AML compliance have established BSA/AML examination manuals  or procedures.

For example, to ensure consistency in the application of BSA  requirements, in 2008 FinCEN issued a BSA examination manual for use  in reviewing money services businesses, including for IRS and state  regulators. According to FinCEN officials, FinCEN has been updating  the entire manual and completed a draft of the update in the fourth  quarter of fiscal year 2018, with the goal of finalizing the updated manual  by the end of fiscal year 2019.

Similarly, in 2005 the federal banking regulators collaborated with FinCEN  on a BSA/AML examination manual issued by the Federal Financial  Institutions Examination Council (FFIEC). The entire FFIEC manual has  been revised several times since its release (most recently in 2014). In  May 2018, FFIEC also issued new examination procedures to address  the implementation of the 2016 customer due diligence and beneficial  ownership rule, discussed earlier. These updated customer due diligence  examination procedures replaced the existing chapter in the FFIEC BSA/AML examination manual and added a new section “Beneficial  Ownership Requirements for Legal Entity Customers—Overview and  Examination Procedures.” In addition, the FFIEC has been working on an  update of the entire FFIEC manual, which is expected to be complete by  the end of the calendar year 2019 or early 2020.

SEC and FINRA, as well as CFTC’s respective SROs, have nonpublic  procedures for conducting examinations of the institutions they oversee.  SEC, FINRA, and NFA officials all stated that they have updated  procedures to address the new customer due diligence regulations that  were applicable beginning in May 2018. We discuss examination  activities of the supervisory agencies in more detail later in this report.

FinCEN and Supervisory Agencies Consider Risk, Among Other Factors, in Examination and Enforcement Approaches

FinCEN and Supervisory Agencies Consider Risk and Size of Institutions in BSA/AML Examination Approaches

FinCEN and supervisory agencies consider risk when planning BSA/AML  examinations and all utilized BSA data to some extent to scope and plan  examinations (see table 2). As we reported in prior work, BSA/AML  examinations are risk-based—examiners have the flexibility to apply the  appropriate level of scrutiny to business lines that pose a higher level of  risk to the institution. Covered financial institutions are expected to  complete a BSA/AML risk assessment to identify specific products,  services, and customers, which supervisory agencies can use to evaluate  the compliance programs of financial institutions and scope their  examinations. Most officials from supervisory agencies and SROs said  they also consider asset size, among other factors, to determine  examination frequency and scope. For example, the federal banking  regulators implemented less frequent examination cycles for smaller,  well-capitalized financial institutions.

FinCEN is the administrator of BSA and delegated BSA/AML examination  authority to the supervisory agencies. FinCEN officials told us they have  been considering how regulators of financial institutions of different size  and risk assess BSA/AML compliance and continue to work with federal  regulators to identify better ways to supervise examinations. For example,  in a February 2019 speech, the Director of FinCEN stated that one of  FinCEN’s current regulatory reform initiatives was reviewing the risk- based approach to the examination process.

Although supervisory agencies with delegated authority conducted the  vast majority of BSA/AML compliance examinations, FinCEN has  conducted a few of its own examinations in areas it considers a high  priority. FinCEN officials told us it mostly considers risk (not size) when  conducting its own examinations because even small institutions could  pose money laundering risk. FinCEN states that it uses an intelligence- driven approach to target examinations in high-risk areas. For example,  FinCEN officials told us they have conducted BSA/AML compliance  examinations of financial institutions on issues such as virtual currencies  and data breaches in domestic branches of foreign banks. In an August  2018 speech, the Director of FinCEN noted that FinCEN, working closely  with BSA examiners at IRS, had examined more than 30 percent of  identified registered virtual currency exchangers and administrators since  2014—totaling about 30 examinations, according to FinCEN officials.  FinCEN officials said they conducted a total of five BSA/AML  examinations with IRS in fiscal years 2017 and 2018. In addition, FinCEN  conducted a BSA/AML examination in fiscal year 2018 of a branch of a  foreign bank that had been previously examined by its banking regulator  to review the effectiveness of the bank’s BSA compliance department.

All of the banking regulators with which we spoke stated they considered  risk and, to some extent, asset size to determine examination frequency  and scope. The FFIEC BSA/AML examination manual establishes a risk- based approach for bank examinations, including incorporating a review  of BSA/AML risk assessments of a financial institution in the scoping and  planning of an examination. In considering asset size to determine the  frequency of examinations, all of the banking regulators adopted rules to  reduce the frequency of examinations for small, well-capitalized financial  institutions—as seen in table 2.

In addition, in their annual reports to FinCEN the banking regulators  provide a description of the criteria used for determining the timing and  scope of BSA/AML examinations, such as risk and asset size. For  instance, FDIC and the Federal Reserve noted in their annual reports to  FinCEN that the timing and scope of their BSA/AML examinations are  primarily determined by an institution’s BSA/AML risk profile and factors  such as its condition, overall rating, and asset size. OCC, in its annual  report, said that examination scope included consideration of the bank’s  BSA/AML risk assessment, quality of validated independent testing  (internal and external audit), previous examination reports, BSA reports,  and other relevant factors, including data from the OCC’s Money  Laundering Risk System. OCC officials said the system identifies  potential indicators of BSA/AML risk by measuring the extent to which  various types of products, services, customers, and geographies are  offered or served by supervised banks. For banks that report into that  system, OCC officials said they factor information from the system into  developing an examination strategy that helps determine resource  allocation and expertise needs. According to NCUA, each credit union  must receive a BSA examination each examination cycle—although the  frequency and scope of these examinations may vary based on the credit  union’s size and other risk factors. For example, small credit unions with  assets under $50 million may be subject to a defined-scope examination  (which includes a BSA examination) where the risk areas have already  been identified and the scope is pre-determined. NCUA also provides a  BSA questionnaire that is publicly accessible to assist its examiners in  implementing BSA examinations (for example, to help examiners assess  the BSA risk of the credit union and scope the examination). Factors  considered in the questionnaire include prior violations, correspondence  from law enforcement related to BSA compliance, whether or not the  credit union conducted a risk-assessment, and high-risk accounts.

While the FFIEC BSA/AML examination manual and other federal  banking documentation discuss considering BSA/AML risk when  determining the scope and frequency of examinations, officials from all  four banking associations with whom we spoke said, in practice,  examiners do not always use a risk-based approach when assessing  BSA compliance. Nearly all said examiners may take a zero-tolerance  approach when conducting examinations. For example, representatives  from two industry associations said that although failure to file a single  SAR or unintentional errors should be treated differently than egregious,  intentional noncompliance, or a pattern of negligence (in terms of level of  noncompliance), that sometimes has not been the case. Federal Reserve  officials noted that each examination is specific to the facts and  circumstances of that examination and that systemic deficiencies in a  bank’s BSA/AML compliance program are generally treated differently  than nonsystemic deficiencies.

As discussed earlier, FFIEC has been working on updating its entire  FFIEC BSA/AML examination manual, including updates to more clearly  state the agencies’ approach to risk-based supervision, according to OCC  officials. Representatives from two of the four banking associations with  which we spoke with stated they were involved in providing input on  recent updates to FFIEC’s examination manual and all four had provided  input to the effort to implement the customer due diligence and beneficial  ownership rule. For example, OCC officials said that the risk-based  approach is most clearly discussed in the opening pages of the current  FFIEC manual and could be more directly incorporated throughout the  manual to provide enhanced guidance to examiners. These officials  stated that the agencies have been drafting proposed edits for drafting  group consideration.

More generally, FFIEC undertook its Examination Modernization Project  as a follow-up to reviews required under the Economic Growth and  Regulatory Paperwork Reduction Act. One of the project’s efforts seeks  feedback from selected supervised institutions and examiners on ways to  improve the examination process. For example, the FFIEC examination  modernization project reviewed, compared, and identified common  principles and processes for risk-focusing examinations of community  financial institutions. FFIEC members also committed to issue reinforcing  and clarifying examiner guidance on these risk-focused examination  principles.

In addition, Treasury, FinCEN, and the banking regulators established a  working group to identify ways to improve the efficiency and effectiveness  of BSA/AML regulations and supervision. In October 2018, the working  group issued a joint statement to address instances in which banks with  less complex operations and lower-risk BSA/AML profiles may decide to  enter into collaborative arrangements with other banks to share resources  to manage their BSA/AML obligations in order to increase efficiency and  reduce burden. In December 2018, the working group issued another  joint statement that recognized that banks may use existing tools in new  ways or adopt new technologies to more effectively and efficiently meet  their BSA/AML obligations.

SEC shares responsibility for broker-dealer examinations with SROs, but  has sole responsibility for examinations of mutual fund companies and  maintains supervisory authority over SROs. SEC’s Office of Compliance  Inspections and Examinations conducts risk-based examinations of  regulated entities including mutual funds (under the Investment  Adviser/Investment Company Examination Program) and broker-dealers  (under the Broker-Dealer Exchange Examination Program). According to  SEC documentation, the scope of examinations is based on a risk  assessment of various factors such as the type of business a firm  engages in and its customer base. This includes consideration of whether  the firm engages in high-risk activities. The Office of Compliance  Inspections and Examinations assesses the risks from information  sources such as tips, complaints and referrals, FinCEN BSA data, pre- examination due diligence, and previous examination history.

During the period we reviewed, BSA/AML examinations of mutual funds  accounted for less than 1 percent of all securities BSA/AML examinations  and no mutual funds were cited for violations of BSA. SEC staff said  investors primarily purchase shares of mutual funds through a distributor  (such as a broker-dealer) and, in these cases, mutual funds do not know,  and are not required to know, the identities of individual investors. In  these cases, the broker-dealer distributor has more information about the  individual investors and may be examined for BSA compliance as part of  FINRA and SEC BSA examinations.

FINRA conducts the majority of examinations of broker-dealer firms and  imposes anti-money laundering rules on its members. FINRA officials  told us that they use a risk-based approach for AML examinations, which  considers the size, complexity, customer types, and risks posed by  business activities in assessing potential BSA/AML risk. These risk  factors affect the timing of their reviews (for example, if a broker-dealer is  deemed to be higher-risk, it will be examined in the same year it was  assessed). According to FINRA officials they have different expectations  for firms’ AML programs, based on size (larger firms typically are  expected to have more complex AML programs than smaller firms).  FINRA publishes a template for small firms to help them fulfill their  responsibilities to establish an AML compliance program. The template  provides text examples, instructions, relevant rules, websites, and other  resources useful for plan development.

However, representatives from a securities industry association told us  that BSA/AML rulemaking and examinations sometimes do not take into  account the varying levels of risk of different types of business models  and activities among firms. Furthermore, these representatives stated that  sometimes compliance expectations are communicated through  enforcement actions rather than through rulemaking or guidance. As  noted previously, one of FinCEN’s has been reviewing the risk-based  approach to the examination process. According to a February 2019  speech by the Director of FinCEN, FinCEN’s initiatives also included  reviewing agencies’ approach to supervision and enforcement and  identifying better ways to communicate priorities.

Representatives from this securities industry association also identified  certain training and tools on BSA/AML compliance and implementation  that FINRA and SEC staff provide as helpful to the securities industry in  identifying priorities and compliance deficiencies. For example, SEC’s  Office of Compliance Inspections and Examinations and FINRA publish  annual examination priorities, which identified both customer due  diligence and suspicious activity monitoring as key areas for 2019.

According to SEC staff, SEC and FINRA examination priorities have  identified suspicious activity monitoring as a key area for the past several  years and have identified customer due diligence as a priority since the  implementation of the customer due diligence rule in 2018. FINRA  published examination findings for the first time in 2017 and again in  2018, including selected findings related to BSA/AML compliance, which  representatives from the industry association said have been very useful  because they describe specific BSA/AML compliance deficiencies  identified by FINRA across the industry and can assist firms in improving  their compliance programs. Additionally, FINRA and SEC included an  AML-topic in their 2017 National Compliance Outreach Program for  broker-dealers. SEC also occasionally publishes risk alerts on its website  and participates in industry outreach efforts.

The SROs that conduct the majority of examinations of futures firms use  a risk-based approach. CFTC has authority to examine futures  commission merchants and futures and commodities introducing brokers,  but does not routinely conduct examinations of the firms it supervises.  Instead, CFTC oversees the examinations conducted by its SROs. CFTC  delegated examination authority to two SROs—NFA and the CME Group.  NFA conducts the majority of BSA examinations and is the only SRO that  examines independent introducing brokers. During the period we  reviewed, NFA was assigned the majority of futures firms and conducted  a majority of AML examinations.

NFA and CME Group stated in CFTC’s annual reports to FinCEN that  they utilize a risk-based approach for AML examinations. CME Group  reported that it determined both the frequency and the scope of  examinations through an overall assessment of the financial and operational risks posed by a futures commission merchant. NFA is  required to examine futures commission merchants annually, but reported  that the timing and frequency of introducing broker examinations were  based predominately on the risks present with a firm. NFA’s risk models  measure the riskiness of each firm, and firms are prioritized for  examination based on the output from the risk model. In an interpretative  notice, NFA recognized that financial institutions vary in size and  complexity, and that firms should consider size, among other factors  (such as the nature of business and its risks to money laundering) in  designing a program to implement requirements such as customer  verification and suspicious activity reporting.

Representatives from a futures industry association told us that there is a  one-size-fits-all approach to BSA/AML compliance in that the rules are  broadly applied to varying types of financial institutions. They noted that  BSA/AML guidance tends to focus on banks and treat other types of  financial institutions (money service business, casinos, and others) as  one group, despite their diversity. In relation to the futures industry, the  representatives stated that this makes it difficult for futures commission  merchants to implement requirements because the rules or guidance do  not necessarily take into consideration their unique business structure.  CFTC staff told us that BSA requirements could be applied differently to  different types of firms and were supportive of tailoring or reducing  requirements where the obligations were duplicative, overly burdensome,  and BSA-related risks were low. For example, CFTC staff recommended  that FinCEN relieve (1) certain introducing brokers known as voice  brokers and (2) futures commission merchants that are initial clearing  firms from customer identification program requirements because they  have limited interaction with the customer and do not have access to  customer information that would allow them to perform customer due  diligence. CFTC staff told us they have been working with FinCEN on  implementing these recommendations. In July 2019, FinCEN issued  additional guidance on the application of the customer identification  program rule and the beneficial ownership rule to certain introducing  brokers, which stated that an introducing broker that has neither  customers nor accounts as defined under the customer identification  program rule has no obligations under that rule or the beneficial  ownership rule.

IRS examination staff use a risk-based approach to examine for  BSA/AML compliance. In 2008, FinCEN and IRS issued a manual for use  by IRS (and state regulator) examiners who perform risk-based  examinations of money services businesses, which are a category of  nonbank financial institutions. The BSA/AML manual for money services  businesses states that examiners should determine the appropriate depth  and scope of the examination procedures based on their assessment of  the risks of the businesses.

Specifically, the manual also states examiners should scope their  examinations based on their assessment of the risks, which they can  assess by analyzing information including the business’ BSA/AML risk  assessment and AML compliance program, and then conduct selective  transaction testing to determine if the AML program is effective. The  amount of transaction testing will vary based on the assessed level of  risk—the amount of testing would be reduced if the examiner determined  the risks were minimal.

IRS officials said that IRS examiners do not perform scheduled  examinations of all money services businesses every year; rather, they  review a percentage of businesses each year based on risk-related  factors such as a history of noncompliance, high-risk geographic areas,  and financial institutions identified by referrals. Thus, there may be some  money services businesses that are not examined for years and some  that are examined much more frequently. As discussed earlier, FinCEN  has been updating the BSA/AML Manual for money services businesses.  According to the manual, IRS examiners should consider size, among  other things, as a factor in their examination approach. IRS officials with  whom we spoke said that smaller money transmitters may not have the  resources or understand monitoring methods necessary to implementing  BSA/AML compliance programs such as suspicious activity monitoring  and reporting. IRS procedures state that it is the responsibility of BSA  examiners to ensure the financial institution is informed of reporting,  registration, recordkeeping, and compliance program requirements of the  BSA. IRS officials further explained that they share methods of detecting  suspicious activity with small money transmitters to help them meet their  requirements.

Enforcement Approaches of Supervisory Agencies Include Informal, Formal, and Joint Actions

FinCEN enforcement actions can be based on sources that include  referrals from examining authorities, information from financial institutions,  interviews, and leads from law enforcement. Supervisory agencies,  including the federal banking regulators, SEC, CFTC, and their respective  SROs are to promptly notify FinCEN of any significant potential BSA  violations. IRS also makes referrals to FinCEN for violations it identifies  in its BSA examinations, such as willful violations of AML program  requirements and recordkeeping and reporting regulations and  structuring. Additionally, financial institutions can self-report violations,  DOJ or other law enforcement agencies may provide leads, and FinCEN  personnel can refer potential violations to FinCEN’s Enforcement Division  to be investigated.

According to FinCEN officials, after receiving a referral FinCEN’s  Enforcement Division opens a case in the Financial Intelligence  Repository System, and Enforcement Division staff and management  evaluate the circumstances of the alleged violation and provide a written  recommendation for action. FinCEN generally resolves its referrals  through one of three ways: (1) closing the case without contacting the  subject of the referral, (2) issuing a letter of warning or caution to the  subject institution or individual, or (3) assessing a civil monetary penalty.  According to FinCEN officials, management in the Enforcement Division  approve which action will be taken to close the referral, and if the  recommendation is to pursue some type of civil enforcement action—the  Director of FinCEN and the Office of Chief Counsel would be involved in  that determination. FinCEN officials said that factors the Enforcement  Division considers when determining which action to recommend or take  include: any impact or harm to FinCEN’s mission by identified violations;  pervasiveness of the violations; the gravity and duration of the violations;  the institution’s history of violations; continuation of the activity; possible  obstruction or concealment; any remedial actions taken by institution; and  whether the institution received financial gain or benefit from violation.  According to FinCEN officials, the Enforcement Division maintains an  administrative record for all cases that result in an enforcement action,  and when the action is complete, the Financial Intelligence Repository  System is updated to reflect that the referral is closed.

From January 1, 2015, to September 25, 2018, FinCEN received 419  referrals directly from supervisory agencies (see table 3).

Two reports have noted some issues associated with referrals to FinCEN,  including delays in reporting by an agency and inconsistent status  updates from FinCEN to agencies. A 2018 report by the Treasury  Inspector General for Tax Administration found FinCEN had long delays  in processing IRS referrals and assessed penalties on a small proportion  of referrals. For example, 49 of 80 cases referred by IRS during fiscal  years 2014–2016 remained open as of December 31, 2017, and FinCEN  assessed penalties in six of the 80 referrals. In response, FinCEN  management said the primary reason for not processing referrals was the  “age” of the violations when the referral was made to FinCEN, which  according to FinCEN officials impedes a thorough investigation of the  violations due to an imminent expiration of the applicable statute of  limitations. The report recommended that IRS consider having its FinCEN  referral process reviewed by process experts to make it more efficient  because delays in submitting cases to FinCEN could lead to FinCEN  taking longer to process referrals or not considering cases for further civil  penalty. In response to the recommendation, IRS stated that it completed  a process improvement review of its FinCEN referral process, and had  since updated its internal guidelines (in February 2019) to reflect the  improved procedures.

The Office of Inspector General of Treasury reported in 2016, among  other findings, that several federal and state regulators told it that FinCEN  did not routinely inform them of the status of their referred cases. The  Office of Inspector General recommended that FinCEN implement a  process to periodically notify federal and state regulators of the status of  and actions taken on referred cases. In its response, FinCEN agreed  with the recommendation, and stated that it follows its standard operating  procedures for case processing. FinCEN’s response stated that its case  processing procedures provide that in all FinCEN enforcement actions  taken in coordination with other government partners (including other  regulators), FinCEN’s Enforcement Division will provide regulators with a  copy of FinCEN’s consent order that details the violations, factual  findings, and proposed settlement terms. FinCEN also noted that its  Enforcement Division holds standing and ad hoc meetings with each of its  federal regulatory partners to discuss, among other matters, the status of  top priority referrals. Treasury’s Office of Inspector General closed the  recommendation based on FinCEN’s response and its review of  FinCEN’s standard operating procedures—which it said included  procedures to provide regulators with a copy of FinCEN’s approved  consent order and proposed settlement terms in the case of formal  enforcement actions. FinCEN officials also told us that FinCEN has been  working to update and finalize its policies and procedures to further  address the recommendation from Treasury’s Office of Inspector General,  but did not have a time frame for completion.

When FinCEN assesses a penalty for BSA violations, it may do so  independently or concurrently with supervisory agencies. In a  concurrent action, FinCEN will assess a penalty with the other regulator  and has sometimes deemed the penalty (or a portion of its penalty)  satisfied by a payment to the regulator. FinCEN took 26 enforcement  actions over the period we reviewed (from fiscal year 2015 through the  second quarter of fiscal year 2018), five of which were concurrent with  supervisory agencies. Casinos, depository institutions, and money  services businesses each had eight enforcement actions and a precious  metals firm and a securities/futures firm had one each. In December  2018, FinCEN assessed a $14.5 million civil monetary penalty against  UBS Financial Services, $5 million of which was paid to Treasury and the  remainder satisfied by payment of penalties for similar or related conduct  imposed by SEC and FINRA.

Federal banking regulators identify and cite violations of BSA/AML  requirements as part of the supervision process, including the  examination process. The regulators employ progressive enforcement  regimes to address supervisory concerns that arise during the  examination cycle or through other supervisory activities. If the institution  does not respond to the concern in a timely manner, the regulators may  take informal or formal enforcement action, depending on the severity of  the circumstances. Informal enforcement actions include obtaining an  institution’s commitment to implement corrective measures under a  memorandum of understanding. Formal enforcement actions include  issuance of a cease-and-desist order or assessment of a monetary  penalty, among others. Some factors that the banking regulators reported  considering when determining whether to raise an informal enforcement  action to a formal enforcement action include the severity of the  weakness and the bank’s commitment to correct the identified  deficiencies. See appendix II for recent data on enforcement actions  taken by the banking regulators.

All SEC enforcement actions and all SRO disciplinary actions are public.  SEC has authority to enforce compliance with BSA for mutual funds and  broker-dealers. If SEC examiners find significant deficiencies with a  firm’s BSA program, the examiners may refer the finding to SEC’s  Division of Enforcement or an SRO for enforcement. In addition, SEC’s  BSA Review Group in the Division of Enforcement’s Office of Market  Intelligence may refer matters identified through the review of BSA  reports to staff in SEC’s Division of Enforcement and in the Office of  Compliance Inspections and Examinations for further consideration and  potential follow-up. SEC’s Division of Enforcement will assess whether to  proceed with an investigation, determine whether a violation has  occurred, and if so, whether an enforcement action should be  recommended against the firm or any individuals. In certain cases, SEC’s  Division of Enforcement may undertake an investigation where there has  been a widespread or systemic failure to file SARs or systemic omission  of material information from SARs. When making this assessment, SEC  staff said SEC considers a number of factors including: the  egregiousness of the conduct, the length of time over which the violations  occurred, number of SARs that were not filed or that omitted material  information, the disciplinary history of the firm, and adherence to any  internal policies and procedures.

FINRA has enforcement authority that includes the ability to fine,  suspend, or bar brokers and firms from the industry and has two separate  procedures (settlement and formal complaint) through which it applies  enforcement actions. Through a settlement, a firm or broker in violation  can offer to settle with FINRA through a Letter of Acceptance, Waiver,  and Consent. A formal complaint is filed with and heard before FINRA’s  Office of Hearing Officers. See appendix II for recent data on enforcement  actions taken by SEC and FINRA.

Although CFTC delegated examination authority to NFA and the CME  Group, it retained authority to pursue enforcement actions against futures  firms. While CFTC does not typically conduct BSA/AML examinations, it  does have a BSA review team that reviews SARs to identify potential  violations of futures laws, and CFTC has taken enforcement actions  based on leads developed from SARs reviewed. SROs generally  conduct BSA examinations of futures firms, and at the conclusion of an  examination, the SROs will issue a report to the futures firm to notify the  firm of any deficiencies in its AML program. If the deficiencies are not  significant, NFA officials stated NFA will cite the deficiency in the  examination report and close the examination with no disciplinary action  but require corrective action before closing it.

If examination findings are significant, then NFA may issue a warning  letter or recommend that its Business Conduct Committee issue a formal  complaint charging the firm with violating NFA’s AML requirements (which  is an enforcement action). NFA officials told us it resolves most  enforcement actions related to violations of NFA’s BSA/AML rules  through settlement agreements that assess a fine. NFA may take other  types of actions for violations of their rules, such as suspension of  membership or expulsion. See appendix II for recent data on informal and  formal actions SROs took.

Although FinCEN has delegated authority to IRS to conduct civil  BSA/AML examinations for a variety of nonbank financial institutions and  individuals, IRS does not have authority to enforce most civil BSA  violations identified. If IRS Small Business/Self-Employed Division  examiners find BSA violations when examining an institution, the division  can send a letter of noncompliance—a letter 1112—with a summary of  examination findings and recommendations to the institution, which also  includes an acceptance statement for the institution to sign. Additionally, if  IRS Small Business/Self-Employed Division examiners identify significant  civil violations during a BSA/AML examination, such as willful violations of  BSA reporting and record-keeping requirements, they may refer civil  violations to FinCEN or refer certain violations of potential criminal activity  to IRS-CI. See appendix II for recent data, including the number of  institutions issued a letter 1112.

FinCEN, Supervisory Agencies and Law Enforcement Established Collaborative Mechanisms, but the Futures Industry Has Been Less Represented

In recent years, Treasury and FinCEN have led efforts to identify BSA  goals and priorities such as issuing a national strategy and risk  assessments for combating illicit financing crimes. They also established  key mechanisms for BSA/AML collaboration, such as interagency working  groups, information-sharing agreements, and liaison positions that  encompass multiple federal, state, and local agencies and private-sector  participants. However, these key mechanisms have been less inclusive  of the futures industry than other financial sectors.

Treasury and FinCEN Led Efforts to Identify BSA Goals and Priorities

Treasury and FinCEN led collaborative efforts to identify BSA goals and  priorities, including the following:

National Strategy. In December 2018, Treasury issued the National  Strategy for Combating Terrorist and Other Illicit Financing as  required by 2017 legislation. The national strategy discussed  various agencies’ BSA-related goals and objectives, including those of  the supervisory agencies and law enforcement groups with which we  spoke for our review. It also laid out key priorities, such as protecting  the United States from terrorist attacks, simplifying the BSA regulatory  framework to work more effectively and efficiently, and ensuring the  stability of domestic and global markets by reducing fraud, money  laundering, and other economic crimes. The strategy also discussed  interagency coordination and information-sharing mechanisms  (including public-private information sharing). For example, the  national strategy states that FBI provided a classified briefing twice a  year to selected personnel from the 20 largest financial institutions in  the United States to share information on terrorist financing trends.  In addition, the national strategy provided data on prosecutions  related to money laundering. For example, in fiscal years 2015–2017,  DOJ annually charged on average 2,257 defendants with money  laundering.

Risk assessments. Congress also directed Treasury and relevant  agencies to evaluate the effectiveness of existing efforts that address  the highest level of risks associated with illicit finance. In December  2018, Treasury issued three risk assessments that identified money  laundering, terrorist financing, and proliferation financing risks and  describe Treasury’s and relevant agencies’ efforts to address these  risks. The three risk assessments underpin the 2018 National  Strategy. Treasury involved multiple agencies in the development of  the risk assessments, including supervisory agencies, SROs, and  several law enforcement agencies. The terrorist financing and  money laundering risk assessments built on previous Treasury-led  risk assessments issued in 2015, but the 2018 proliferation financing  risk assessment was the first ever issued.

Treasury’s Strategic Plan (2018–2022) and other guidance. Prior  to the publication of the National Strategy, Treasury issued a strategic  plan in February 2018 that identified strategies, goals, measures, and  indicators of success to meet its strategic goal for preventing terrorists  and other illicit actors from using the U.S. and international financial  systems. FinCEN also issued advisories or guidance that identify  BSA and law enforcement priorities. For example, in February 2014  FinCEN issued guidance that clarified how financial institutions should  align their BSA reports to meet federal and state law enforcement  priorities if the institutions provide services to marijuana-related  businesses. The related federal and state law enforcement priorities  included preventing the proceeds of marijuana sales from going to  criminal enterprises, gangs, and cartels.

Two industry associations (with which we spoke before the issuance of  the December 2018 national strategy and risk assessments) noted the  importance of establishing BSA priorities to better inform industry. For  example officials from one industry association said that Treasury’s risk  assessments identified priorities and suggested that it produce these  types of reports more frequently (for example annually). This may be  addressed, in part, by Congress’ requirement that the national strategy— including a discussion on goals, objectives, and priorities—be updated in  2020 and 2022. In addition, Treasury has been conducting a broad review  of BSA/AML laws, regulations, and supervision—focusing on how  effectively current requirements and related activities achieve the  underlying goals of the BSA.

Key Mechanisms for Collaboration Involve FinCEN, Supervisory Agencies, and Law Enforcement

Interagency working groups, interagency memorandums of  understanding, and liaison positions, as shown in table 4, are key  BSA/AML collaborative mechanisms that were identified through our  interviews with officials from FinCEN, supervisory agencies and law  enforcement agencies and in agency documents.

Bank Secrecy Act Advisory Group (BSAAG). Congress directed  Treasury to create BSAAG in 1992. The group, led by FinCEN, is the  primary and longest-established BSA/AML collaboration mechanism and  is used to share information and receive feedback on BSA administration.  The advisory group meets twice a year and includes working groups on  BSA/AML-related issues that may meet more frequently. BSAAG recently  has been focusing on improving the effectiveness and efficiency of the  regulatory and supervisory regime. SEC and Federal Reserve officials  told us that BSAAG is a helpful and effective collaborative mechanism to  discuss BSA/AML issues. However, as we discuss later, representatives  from CFTC, the primary futures SRO, and a futures industry association  expressed concerns that the futures industry was not as well represented  on BSAAG as other industries.

FinCEN invites the public to nominate financial institutions and trade  groups for 3-year membership terms on BSAAG. In making selections,  the Director of FinCEN retains discretion on all membership decisions  and seeks to complement current BSAAG members in terms of  affiliations, industry, and geographic representation.

Memorandums of understanding (MOU). FinCEN established  interagency agreements—information-sharing and data-access MOUs— relating to BSA data. For example, FinCEN entered into an information- sharing MOU with the federal banking regulators in 2004 and has since  established similar MOUs with other supervisory agencies, including  many state supervisory agencies. FinCEN consolidates the data from  the four federal banking regulators and told us that it shares the  consolidated reports with banking regulators. In addition, FinCEN officials  told us they use data from the information-sharing agreements to help in  certain initiatives and training. For example, FinCEN officials told us that a  recently funded initiative focused on nonbank financial institutions will use  information from the MOUs to proactively identify risks and better inform  related compliance efforts.

All the supervisory agencies told us they informally update and monitor  their information-sharing MOUs through frequent meetings and regular  communication with FinCEN. For example, FinCEN officials told us they  have been working to update how they collect information on violations  related to the customer due diligence and beneficial ownership rule. In  addition, FinCEN contracts an annual MOU satisfaction survey that  FinCEN officials said helps them monitor the effectiveness of the MOUs.

In the survey, respondents were asked about their satisfaction with their  MOU and scored their satisfaction around 80 out of 100 in 2017.

FinCEN also has more than 400 data-access MOUs with federal, state,  and local law enforcement agencies as well as with federal and state  regulatory agencies. FinCEN has data-access MOUs, or provides direct  data access, with or to all the federal supervisory agencies and with  FINRA, a securities SRO—but not with NFA, a futures SRO. As  discussed previously, supervisory agencies use these data primarily to  help scope and conduct their BSA/AML compliance examinations. In a  later section, we discuss access issues in relation to supervision of the  futures industry. Law enforcement agencies use BSA data to assist in  ongoing investigations and when initiating new investigations.

Liaison positions. FinCEN has used on-site liaison positions for more  than a decade to help avoid overlap and duplication of efforts. According  to FinCEN officials, as of April 2019, FinCEN had 18 law enforcement  liaisons from 10 law enforcement agencies. Some law enforcement  officials with which we spoke said the liaison position allowed feedback  and information exchange between law enforcement and FinCEN.  Supervisory agencies generally told us that the liaison program was for  law enforcement agencies and that they did not participate.

FinCEN officials said that while FinCEN does not have on-site liaisons  from supervisory agencies that are comparable in scope to the law  enforcement liaisons, they work closely with the supervisory agencies.  For example, FinCEN currently has a part-time detailee from FDIC who collaborates on-site at FinCEN with FinCEN analysts. FinCEN officials  said they hosted a temporary on-site detailee from NCUA in 2017. NCUA  officials told us that they also expressed an interest to FinCEN to  implement routine detailing of staff. SEC staff told us that in the past they  had a FinCEN detailee onsite working with SEC’s Division of  Enforcement, which allowed SEC to better understand FinCEN’s  methodology and approaches, and assess their own approaches to BSA  enforcement. SEC staff expressed interest in hosting another FinCEN  detailee, and the agency has been considering a FinCEN request to send  an SEC liaison to FinCEN.

There are also other BSA/AML collaborative mechanisms among  regulatory or law enforcement agencies, such as the FFIEC BSA/AML  working group, SAR review teams, and geographic targeting orders (see  table 4). We also obtained perspectives on collaboration from FinCEN  and relevant key law enforcement and regulatory agencies on three  selected BSA criminal cases, which are discussed in appendix III.

Futures Industry Not Consistently Included in BSAAG and its Key SRO Does Not Have a Data- Access MOU with FinCEN

The futures industry has been less represented in key mechanisms for  BSA/AML collaboration (those related to BSAAG and data-access  agreements) than other industries. Representatives from CFTC, the  primary futures industry SRO, and a futures industry association  expressed concerns that the futures industry was not as well represented  on BSAAG as other industries. CFTC, as the delegated supervisory  agency, always has been a member of BSAAG. However, the primary  futures industry SRO—which has developed rules to implement AML  requirements for its members and conducts a majority of AML  examinations of futures firms—and futures industry associations have  had less consistent participation. Officials from the primary futures SRO  expressed concern that they were not a regular member of BSAAG. They  noted that they were a BSAAG member in the mid-2000s but then not  selected as a member of BSAAG for almost 5 years (from 2014) until they  were invited to be a member again in March 2018, at which point, the  futures industry association’s BSAAG membership was not renewed  when its term expired.

Representatives from all key federal supervisory agencies have been  regular members of BSAAG. In particular, the securities industry, which  also uses SROs to monitor BSA compliance, has had its primary SRO as  a member of BSAAG since 2008. Representatives from the primary  securities SRO said that their participation in BSAAG allowed them to  coordinate BSA/AML efforts.

Representatives from the primary futures SRO said that their role  regarding oversight of the futures industry was similar to the primary  securities SRO. These representatives stated that they adopted AML  rules; were the only SRO with jurisdiction over all futures entities subject  to AML requirements; and conducted a majority of AML examinations.  Accordingly, representatives said that they were in the unique position of  seeing first-hand how AML requirements are implemented in the futures  industry and identifying issues, as well as potential gaps in  implementation. CFTC staff said that all significant representative groups  for the futures industry should participate in BSAAG—in particular, the  primary futures SRO because it supervises all types of registered firms in  the futures industry and the leading industry association for the futures,  options, and centrally cleared derivatives markets.

In addition, representatives from industry associations we spoke with from  other industries have been regular members of BSAAG including banking  associations and the primary securities industry association. The primary  securities industry association has been a member since 2008,  concurrent with the primary securities SRO (also a member since 2008).  Representatives from this association said that BSAAG is a mechanism  that FinCEN uses to solicit feedback from the industry. Officials from the  futures industry association that had previously participated in BSAAG,  told us that their current lack of participation may prevent FinCEN from  obtaining an in-depth understanding of futures industry issues and may  prevent the futures industry from obtaining information on BSA/AML goals  and priorities and other key communications. CFTC staff said that in  addition to the primary futures SRO, BSAAG also should include a  primary industry association.

FinCEN officials told us that there is a limit on the number of BSAAG  representatives allowed and that they have had a futures representative  that was not always an active participant. In addition, FinCEN officials  said that when selecting BSAAG members they need to consider the top  money laundering risk areas as well as the appropriate number of  members to have productive discussions. They added that because  membership rotates, additional futures representatives could be added  based on needs and topic areas. Furthermore, FinCEN officials told us  that although the most recent BSAAG (October 2018) did not include a  futures industry association, it did include the primary futures industry  SRO and six large diversified financial firms that are listed as members of  the key futures industry association. However, these firms represent a  small percentage of the association’s membership and are not smaller  firms or clearing organizations, exchanges, and global and regional  executing brokers.

As noted in Treasury’s 2018 national strategy, BSAAG is the main AML  information conduit and policy coordination mechanism among regulators,  law enforcement, and industry and has been focusing on improving the  effectiveness and efficiency of the regulatory and supervisory regime.  Without regular participation by the primary futures SRO that has  developed AML rules and conducts the majority of BSA examinations for  the futures industry, FinCEN may be missing opportunities to better  understand compliance in the futures industry and the SRO may not be  fully up to date on BSA/AML compliance issues and related initiatives that  may affect the AML rules it develops. Furthermore, without representation  on BSAAG by the key futures industry association, the diverse array of  futures industry participants may not be fully represented, informed, or  updated on key BSA/AML information. Standards for Internal Control in  the Federal Government state that management should externally  communicate the necessary quality information to achieve the entity’s  objective. In addition, the statutory purpose of BSAAG includes  informing private-sector representatives of how BSA reports have been  used and receiving advice on how reporting requirements should be  modified. Additional futures industry representation on BSAAG could  enhance both regulator and industry awareness of BSA/AML compliance  issues and potential money laundering risks.

In addition, NFA, the SRO conducting the majority of BSA examinations  for the futures’ industry, does not have direct access to BSA data—unlike  all key supervisory agencies and FINRA. In our 2009 report, we  recommended that FinCEN expand data-access MOUs to SROs  conducting BSA examinations that did not already have direct access to  BSA data. In 2014, FinCEN completed a data access MOU with FINRA.  But it did not pursue an MOU with NFA because, at that time, CFTC did  not ask FinCEN to arrange an MOU with NFA. However, CFTC staff, as  of April 2019, told us that access to BSA data would enhance the tools  that NFA has to perform its functions, including its ability to scope and  perform BSA/AML examinations, and to use BSA data more extensively  and more frequently. Currently, when conducting its examinations, NFA  must obtain SAR information from CFTC, as well as reviewing SARs  provided by a firm while conducting an on-site examination. FinCEN  officials told us that NFA has not requested direct access to BSA data.  However, NFA representatives told us they welcomed a discussion with  CFTC and FinCEN on the benefits and drawbacks of having direct access  to BSA data. FinCEN officials said they would need to better understand  any negative impacts of NFA not having direct access and NFA would  need to meet the required criteria to obtain direct access.

Standards for Internal Control in the Federal Government state that  management should externally communicate the necessary quality  information to achieve the entity’s objectives. Supervisory agencies with  direct data access all have utilized BSA data to some extent to scope and  plan examinations. Direct access to BSA data would enhance NFA’s  ability to scope BSA examinations and generally conduct its oversight  responsibilities for BSA in the futures industry.

Metrics and Feedback to Industry on the Usefulness of BSA Reporting Were Not Consistently or Widely Provided

FinCEN and two law enforcement agencies with which we spoke  generated metrics on the usefulness of BSA reporting—such as the  number of BSA reports that led to new investigations. But FinCEN, whose  role it is to collect and disseminate BSA data, has not consistently  communicated these metrics—instead only communicating some  available metrics on an ad-hoc basis through methods such as published  speeches or congressional testimonies. FinCEN and nearly all the law  enforcement agencies with which we spoke provided some feedback to  financial institutions on how to make BSA reports more useful through  formal mechanisms (such as conferences and training sessions) and  informal relationships. However, institution-specific feedback, which all  industry groups said their members preferred, has not been widely  provided.

Available Metrics on Usefulness of BSA Reporting Not Consistently Communicated

Two of the six law enforcement agencies (IRS-CI and FBI) we interviewed  produced metrics on the usefulness of BSA reporting (for example,  percentage of investigations utilizing BSA data). However, FinCEN (which  has statutory responsibilities for the central collection, analysis, and  dissemination of BSA data) did not consistently communicate this  information, but rather communicated on an ad hoc basis through  published speeches or congressional testimony. IRS-CI annually  publishes a report with data on investigations, including those generated  by BSA reports. For example, in fiscal year 2018, IRS-CI reported that  515 BSA investigations were initiated (see table 5). FinCEN’s website  generally did not refer to IRS-CI metrics, but in a November 2018  congressional testimony, the Director of FinCEN included information on  the percentage of IRS-CI investigations that began with a BSA source— 24 percent in fiscal year 2017.

In addition, IRS-CI also tracks the work of SAR review teams and has  created some metrics on the usefulness of BSA reporting, including: the  number of investigations initiated, indictments, convictions, sentenced,  and total dollars seized based on the work of the SAR review teams (see  table 6). While this information is not routinely reported publicly, IRS  officials said they have shared information about results from SAR review  teams’ during presentations to the public, law enforcement, and financial  industries.

FBI analyzes BSA filings to support existing cases and initiate new  investigations, and FBI and FinCEN have reported related metrics to the  public, but not routinely. FBI created a BSA Alert System that searches  subjects’ names, dates of birth, Social Security numbers, telephone  numbers, email addresses, and other identifying information across BSA  filings, and automatically emails the results to agents. In a November  2018 congressional testimony, the FBI section chief of its Criminal  Investigative Division stated that these searches produce an average of  2,000 alerts per month and provided statistics on the results of the  agency’s use of BSA data. From January 2017 to June 2018, BSA  reporting was directly linked to the main subject of approximately 25  percent of pending FBI investigations (up from 8.9 percent in 2012). The  November 2018 FBI testimony also described FBI’s use of SARs data  analysis to identify new cases. For example, FBI analysts run a series of  search terms and criteria related to money laundering, terrorist financing,  human trafficking, fraud, corruption, transnational organized crime, and  other schemes against SAR filings. The persons identified through the  searches are automatically searched against FBI case files and watchlist  data, and the results incorporated into reports to appropriate field offices.  FinCEN also communicated some of the FBI metrics in an August 2018  speech by the FinCEN director. For example, the director said more than  20 percent of FBI investigations utilized BSA data and for some types of  crime, like organized crime, nearly 60 percent of FBI investigations used  BSA data.

The other four law enforcement agencies with which we spoke did not  generate metrics on the usefulness of BSA reporting due to confidentiality  or data reliability concerns, among other reasons, but some tracked other  BSA-related efforts.

DHS officials said that while they do not have any metrics on the  usefulness of BSA reports, the agency provided data on the  usefulness of ICE-HSI’s Cornerstone outreach program—in which  ICE-HSI provided training to financial institutions on issues such as  trends in how criminals earn, move, and store illicit proceeds. ICE-HSI  reported that in fiscal year 2017, based on the Cornerstone outreach  program, special agents initiated more than 72 financial  investigations, made 55 criminal arrests, and seized almost $2 million  in illicit proceeds.

Secret Service officials said that they have been trying to develop an  internal tracking system for their use of BSA reports, but were not  tracking any metrics as of April 2019. They told us that they use BSA  data for investigative purposes only and they do not discuss or report  it, because they consider it confidential information—thus making it  difficult for them to gather metrics on the use of BSA reports.

An official from DOJ’s Criminal Division said that the division has  not established any performance measures or collected any statistics  that measure the effectiveness of BSA record-keeping and reporting  requirements (for example, because the success of investigations  depending on multiple factors not just BSA reporting, and other  challenges described later in this report). However, the official said  that the division recognizes the usefulness of BSA data in criminal  investigations because the data help them with prosecutions of  crimes.

Officials from DOJ Executive Office for United States Attorneys  said that they track the number of cases with statutory provisions  relating to BSA in which the U.S. Attorney’s Offices prosecuted or  enforced BSA violations. However, the officials said their case  management system does not track if BSA filings were used to initiate  or assist the case.

Supervisory agencies we interviewed generally said FinCEN and law  enforcement are better positioned to compile metrics on the usefulness of  BSA reporting because FinCEN and law enforcement agencies are the  primary users of BSA reports. However, two of the seven supervisory  agencies in our review that also have law enforcement functions—SEC  and CFTC—have their own BSA review teams, which analyze SARs to  identify potential violations of federal laws, including BSA violations, and  refer matters for further examination or investigation as appropriate. For  example, on average, from fiscal years 2016 to 2018, SEC’s BSA review  team reviewed about 27,000 SARs each year that related to current or  potential investigative matters, or entities regulated by SEC. CFTC staff  told us they review an estimated 7,500–8,000 SARs annually. On  average, in about 100 instances a year, CFTC’s BSA review team refers  SARs to investigative teams in support of new or existing investigations.  As of December 2018, CFTC staff said they had taken 33 enforcement  actions based on leads developed from SARs, with two of the actions  related to BSA/AML violations.

FinCEN collected some metrics on the usefulness of BSA data through  annual surveys and other initiatives; however, the survey results are not  public and other metrics are not regularly published. FinCEN contracts an  annual survey that includes questions to BSA data users (such as federal  and state law enforcement and regulators) about the usefulness of BSA  data to, among other things, provide new information or supplement  known information or identify new leads or investigations. BSA data users  are asked to score the value and impact of BSA data and scored it at  about 80 out of 100 for both 2016 and 2017. FinCEN contracts another  survey that solicits feedback on the 314(a) program. The 2017 survey  found the respondents that utilized the 314(a) program gave it high  scores for its usefulness—close to 90 out of 100 for 2016, and 2017.

The results from both surveys are not publicly available. In addition,  FinCEN periodically publishes a 314(a) Fact Sheet that contains some  data on the usefulness of the 314(a) program—such as the number of  314(a) requests and the percentage of requests that contributed to  arrests or indictments. Based on information FinCEN collected from  law enforcement, approximately 95 percent of 314(a) requests  contributed to arrests or indictments. In addition, FinCEN reported the  number of cases submitted and related subjects of interest identified in  314(a) requests for each 2-week period from January 5, 2016, to January  29, 2019. For example, for the 2-week period starting on January 29,  2019, 16 requests resulted in 162 subjects of interest.

FinCEN contracted a study on the value of BSA reporting—which began  in January 2019 and is to be completed by the end of 2019—with the goal  of identifying common attributes of BSA value among stakeholders;  assessing how to use available data to establish metrics for evaluating  and calculating the value of BSA; identifying gaps in data and other  information needed to measure the value of BSA reporting; and proposing  actions to improve FinCEN’s ability to identify, track , and measure the  value of BSA reporting. However, the performance work statement for  FinCEN’s BSA value study, which outlines the objectives for the study,  does not include actions related to communicating such metrics. As  discussed above, FinCEN has not consistently communicated available  metrics. FinCEN officials told us their current approach was to  communicate metrics through mechanisms such as speeches and  congressional testimonies. FinCEN officials told us that it has an ongoing  initiative to create a new communication strategy incorporating the results  of the BSA value study—but had no time frame for its completion.

Our prior work found that agencies can implement a number of practices  that can enhance or facilitate the use of performance information— including communicating performance information frequently and  routinely. In addition, Standards for Internal Control in the Federal  Government state that management should externally communicate the  necessary quality information to achieve the entity’s objectives.  Officials from some supervisory agencies and most industry associations  also told us they would like FinCEN to provide them with more  aggregated data on the usefulness of SARs filed by financial  institutions. By consistently communicating currently available metrics  on the usefulness of BSA reporting to industry, and any metrics later  identified by FinCEN’s BSA value study, financial institutions may be able  to more fully understand the importance and outcomes of their efforts.

FinCEN and Law Enforcement Have Provided Some Feedback to Financial Institutions on Improving BSA Reporting but Only Periodically and on a Small Scale

FinCEN and nearly all of the law enforcement agencies with which we  spoke provided some feedback to financial institutions on how to make  BSA reports more useful through formal mechanisms (such as  conferences and training sessions) and informal relationships. However,  institution-specific feedback, which all industry groups said their members  preferred, has not been provided on a regular basis and only on a small  scale.

FinCEN’s feedback mechanisms include a new information exchange  program, advisories, and BSAAG. For example:

FinCEN Exchange. On December 4, 2017, FinCEN publicly launched  the FinCEN Exchange, a public-private program that brings together  law enforcement, FinCEN, and different types of financial institutions  to share information to help identify vulnerabilities and disrupt money  laundering, terrorist financing, and other financial crimes. As of  December 2018, FinCEN convened more than a dozen briefings with  law enforcement agencies across the country, involving more than 40  financial institutions. According to Treasury’s 2018 national strategy,  the information provided by financial institutions through SARs after  the briefings helped FinCEN map and target weapons proliferators,  sophisticated global money laundering operations, human trafficking  and smuggling rings, and corruption and trade-based money  laundering networks, among others. FinCEN officials told us that  these exchanges provide a forum in which law enforcement can  request specific information and provide information on typologies to  financial institutions that allows financial institutions to improve their  BSA monitoring and reporting.

FinCEN advisories. FinCEN issues public and nonpublic advisories  to financial institutions to help financial institutions better detect and  report suspicious activity related to a particular risk and related  typology. For example, in October 2018 FinCEN posted an advisory  on its website to alert U.S. financial institutions of the increasing risk  that proceeds of political corruption from Nicaragua might enter the  U.S. financial system. It also posted an advisory on the Iranian  regime’s illicit activities and attempts to exploit the financial system.  These advisories included specific instructions on how to file SARs  related to this type of suspicious activity. Some of the industry  associations with which we spoke had positive feedback on FinCEN  advisories and said they would like to see more red flags and specific  guidance to help improve their BSA monitoring programs.

BSAAG. Among its functions, the advisory group serves as a forum  for industry, supervisory agencies, and law enforcement to  communicate about how law enforcement uses SARs and other BSA  data. For example, sometimes law enforcement agencies present  specific cases using BSA data or information on money laundering  and terrorist financing threats. Many of the industry associations and  supervisory agencies with which we spoke cited BSAAG as a useful  feedback mechanism. As discussed previously, the advisory group is  only open to those invited and not a public forum, so not all financial  institutions receive or can provide feedback at these meetings.

Law enforcement awards. FinCEN officials said that annual law  enforcement awards ceremonies are one of the mechanisms they use  to provide financial institutions with feedback on the usefulness or  effectiveness of BSA/AML information. The award ceremonies  highlight successful cases utilizing BSA data. FinCEN officials told us  that FinCEN also sends thank you letters to the selected financial  institutions that provided the underlying financial data used in the  awarded cases, publishes overviews of the cases for which law  enforcement agencies received awards, and documents nominated  cases. FinCEN issues press releases about the winning cases as  another way to share information with financial institutions.

Outreach events. FinCEN representatives regularly have participated  in outreach events about BSA/AML issues, such as by sharing  information at BSA/AML conferences. According to FinCEN officials,  the conferences allow FinCEN representatives to both formally  (speeches, presentations) and informally (personal interactions) solicit  and offer feedback on how financial institutions can improve BSA  reporting. Additionally, Treasury reported that its Office of Terrorism  and Financial Intelligence regularly engages public and private-sector  practitioners and leaders, both domestic and international, on money  laundering and terrorist financing issues. For example, the office  convenes multilateral and bilateral public-private sector dialogues with  key jurisdictions and regions to discuss mutual anti-money laundering  and counter-terrorist financing issues of concern.

Representatives from nearly all of the federal law enforcement agencies  we interviewed said that they conducted outreach events and developed  relationships with financial institutions to solicit and provide feedback on  their BSA reports including providing feedback on ways to improve BSA  reporting and to enhance BSA compliance by financial institutions.

Conferences. Law enforcement agencies have presented at  conferences on BSA/AML topics and host conferences for financial  institutions. For example, for more than a decade ICE-HSI, FBI,  Secret Service, IRS-CI, and the Drug Enforcement Administration  jointly have hosted an annual conference that includes speakers from  law enforcement, supervisory agencies, FinCEN, and financial  institutions. According to an ICE-HSI official, the intent of the  conference is to educate the private financial sector. FBI officials also  said they conduct outreach, such as hosting and participating in  conferences, and said that this type of outreach reached more than  6,000 people in the last year (as of August 2018).

Briefings and financial institution-specific training. Some law  enforcement agencies have their own outreach programs on BSA  topics for financial institutions. For example, ICE-HSI has the  Cornerstone Outreach Program that began to work with the private  sector in 2003 to identify money laundering vulnerabilities in the  financial system. The program is to encourage partnerships with the  private sector by sharing distinguishing traits or forms of criminal  behavior (either crime-centered or person-centered) and methods,  and providing training to financial institutions. ICE-HSI officials said  they conducted about 300 Cornerstone Outreach presentations in  fiscal year 2018. FBI officials also told us they host a couple of  meetings annually for financial institutions and sometimes conduct  institution-specific training upon request, such as on SAR usefulness.  FBI officials told us that for the institution-specific SAR trainings, they  change the information on the SARs for training purposes and  highlight how institutions can improve SAR filings. They also provide  some summary-level statistics and work with the financial institution’s  SAR teams to train them on trends. They estimated they conduct from  about eight to 10 such sessions annually (as of April 2019).

Informal relationships with financial institutions. Officials from  nearly all the law enforcement agencies with whom we spoke said  they have informal relationships with financial institutions to solicit and  provide feedback on their BSA reports.

Most supervisory agencies we interviewed said that they did not provide  feedback to financial institutions on the usefulness of their BSA reporting  due to factors such as law enforcement being better positioned to provide  feedback and SAR confidentiality restrictions. However, CFTC staff noted  that their BSA review team communicates the general usefulness of  SARs filed by their institutions at conferences and through telephone  contacts with the filer after the relevant case is filed. SEC staff told us  they do not reach out directly to provide financial institutions specific  feedback on the usefulness of SARs, but provide training on what makes  a good or bad SAR through routine interaction with the primary securities  industry association and presentations at BSAAG. As discussed earlier,  some supervisory agencies regard FinCEN and law enforcement as the  primary end users of BSA reports, and thus, in a better position to provide  feedback to financial institutions on BSA reporting. Additionally, many  supervisory agencies told us that it would be helpful if FinCEN and law  enforcement could provide more frequent or systematic feedback on  financial institutions’ SAR reporting.

Some supervisory agencies, industry associations, and law enforcement  agencies with which we spoke identified limitations with some of  FinCEN’s feedback mechanisms, including FinCEN Exchange and law  enforcement awards. Representatives from all the industry associations  we spoke with indicated that financial institutions would like to see more  institution-specific feedback on their SARs to improve their monitoring  systems and reporting.

FinCEN Exchange. Some industry associations appreciated FinCEN’s  outreach, but noted that the new FinCEN Exchange program was on a  small-scale and industry associations had not been invited to participate  or provide feedback. An official from one industry association said that the  association could help identify banks, such as community banks, that  could be a good fit for the program. Supervisory agencies also generally  said they were not involved in the FinCEN Exchange program. Officials  from OCC said that they would like to be involved because they are the  primary regulator for many of the financial institutions in the program and  thought their participation would add value. Some law enforcement  agencies had some concerns about the FinCEN Exchange program, such  as private-sector representatives not being properly vetted or the risk of  talking about ongoing investigations. For example, officials from ICE-HSI  and FBI told us their institution-specific training included only vetted or  trusted financial institutions.

FinCEN officials said that they collaborated with regulators on the FinCEN  Exchange and solicited feedback on the program from certain industry  associations. In addition, FinCEN posts frequently asked questions about  the FinCEN Exchange program on its website and encourages feedback  from financial institutions on how they can support FinCEN priorities such  as information sharing. FinCEN officials said that the FinCEN Exchange  is an invitation-based program and that FinCEN vets information received  from financial institutions and consults with law enforcement, as  appropriate, to convene a briefing. Furthermore, FinCEN’s frequently  asked questions about the program note that financial institutions that  voluntarily participate in a FinCEN Exchange briefing must adhere to the  terms noted in FinCEN’s invitation, including any requirement of  confidentiality given the sensitivity of information provided.

Awards. Representatives from CFTC, FBI, and three industry  associations with whom we spoke made suggestions for expanding  FinCEN’s law enforcement awards and related thank you letter initiatives.  For example, CFTC suggested that FinCEN expand the awards program  to include civil cases as well as criminal cases. FinCEN officials also told  us in April 2019 that they were considering awards for civil cases.  Industry associations generally said their member financial institutions  appreciated receiving thank you letters, but some noted that there were  limitations with these letters. For example, a representative from one  industry association said that only a small percentage of financial  institutions receive the awards, and representatives from another industry  association said that the letters should provide more specific feedback.  Two other industry associations said that the confidential nature of SARs  makes it difficult to share the success of the financial institution that  submitted the reporting. Many law enforcement agencies with which we  spoke said that the law enforcement awards were a good idea, and FBI  officials recommended creating awards for the financial institutions as  well. FinCEN officials stated that due to SAR confidentiality rules, it  cannot publicize awards to financial institutions.

Institution-specific feedback. Representatives from all the industry  associations with whom we spoke told us, or have publically stated that  financial institutions would like to see more institution-specific feedback  on their SARs to improve their monitoring systems and reporting. SAR  reporting is labor-intensive for financial institutions because it requires  researching and drafting narratives for a SAR filing and justifying cases  where a SAR is not filed, according to many industry association  representatives. However, many representatives said that financial  institutions get little institution-specific feedback on their SAR reporting.  We found that while law enforcement conducts some small group  briefings that industry associations said were useful, these briefings cover  a small number of financial institutions in relation to the size of the U.S.  financial industry. ICE-HSI stated that it conducted 302 institution-specific  trainings and briefings in fiscal year 2018, and FBI, as discussed  previously, estimated it has conducted from about eight to 10 institution- specific SAR reporting trainings annually in relation to the more than  10,000 depository institutions, more than 26,000 money services  businesses registered with FinCEN, and almost 4,000 active broker- dealers registered (as of January 2019). The American Bankers  Association, Independent Community Bankers of America, and The  Clearing House all have issued papers—recommending more institution- specific feedback on financial institution SAR reporting.

Some industry associations and other stakeholders pointed to  international efforts that provided feedback through public-private  partnerships. For example, the United Kingdom’s Joint Money Laundering  Intelligence Taskforce (joint task force), formally established in May 2016,  includes regulators, law enforcement, and more than 40 major United  Kingdom and international banks conducting a large proportion of  financial activity in the United Kingdom (89 percent of the volume of  personal accounts in the United Kingdom). The joint task force has a  system in place to routinely convene these partners, included vetted  banking representatives, to set AML priorities and share intelligence.  According to the intergovernmental Financial Action Task Force’s (FATF)  mutual evaluation report of the United Kingdom, financial institutions  involved in the joint task force are required to file SARs for suspicious  activity identified through the program, and these SARs are considered to  be of high value. FATF’s report also noted that the joint task force is  considered to be best practice in public-private information sharing.  According to Treasury’s 2018 national strategy, FinCEN collaborated with  the United Kingdom’s joint task force in implementing the FinCEN  Exchange program.

In prior work, we reported that FinCEN recognized that financial  institutions do not generally see the beneficial impacts of their BSA/AML  efforts. FinCEN, law enforcement, and some industry associations with  which we spoke identified challenges in providing institution-specific  feedback to financial institutions on the usefulness of their BSA reporting.  In addition to the large number of financial institutions in the United  States, officials from FinCEN and law enforcement agencies told us that  law enforcement cases may be sensitive and time-consuming, and the  unauthorized disclosure of SARs or sharing of certain information with  financial institutions might compromise ongoing investigations. Two  industry associations also identified the confidential nature of SARs as a  challenge for FinCEN and law enforcement to provide institution-specific  feedback to financial institutions. As we have discussed, FinCEN has  been undertaking a study to better understand the value and  effectiveness of BSA. In addition, FinCEN and some law enforcement  agencies have made efforts to provide some institution-specific feedback  through various methods on BSA reporting, but the feedback has been  periodic, sometimes only at the request of financial institutions, and  provided on a small scale.

FATF standards on information sharing state that anti-money laundering  authorities should provide feedback to financial institutions to assist them  in complying with anti-money laundering requirements—these  mechanisms can include feedback loops, whereby more consistent and  more fully explained feedback is provided to the private sector on  suspicious transaction reports. FinCEN’s statutory duties also include  information sharing with financial institutions in the interest of detection,  prevention, and prosecution of terrorism, organized crime, money  laundering, and other financial crimes. As discussed, other countries  have put in place mechanisms (such as the United Kingdom’s joint task  force) to provide regular feedback on AML reporting (including SAR-like  instruments) to financial institutions representing a large portion of the  country’s financial activity. Additional and more regular institution-specific  feedback, designed to cover different types of financial institutions and  those with significant financial activity, may enhance the U.S. financial  industry’s ability to effectively target its efforts to identify suspicious  activity and provide quality BSA reporting.

FinCEN, numerous supervisory agencies (covering various financial  sectors), and law enforcement agencies are responsible for enforcing the  BSA/AML regulatory framework with the end goal of detecting and  preventing money laundering and other financial crimes. While these  agencies have processes and mechanisms in place to collaborate on key  BSA/AML issues, such collaboration and information sharing could be  enhanced by additional and more regular involvement of representatives  of the futures industry—a complex and unique financial markets sector.  Unlike the other key federal supervisory agencies and securities SRO  involved in BSA compliance, the primary futures SRO was not  consistently included in BSAAG. Thus, FinCEN may be missing  opportunities to better understand compliance in the futures industry and  the SRO may not be updated on related BSAAG initiatives. The key  futures industry association also has had less consistent participation in  BSAAG, and although it has been a member of BSAAG in the past, it was  not a member concurrently with the futures SRO—thereby, potentially  missing opportunities to engage FinCEN and other agencies on BSA  issues in futures markets. In addition, by providing NFA with direct access  to BSA data (similar to the access the key securities SRO already has)  FinCEN could facilitate NFA oversight and enable it to scope  examinations proactively to address BSA risks.

Some federal agencies have taken steps to provide metrics and  institution-specific feedback on the usefulness of BSA reporting to  industry; however, metrics were not provided regularly and feedback  efforts were provided on a small scale. Additionally, challenges to  expanding and enhancing metrics and feedback remain (such as those  related to measuring the usefulness of BSA reporting, providing feedback  to thousands of individual institutions, and the sensitive nature of ongoing  law enforcement investigations). FinCEN has an ongoing effort to identify  additional measures of the value and usefulness of BSA reporting, which  is expected to be completed at the end of 2019. But opportunities exist to  enhance feedback and reporting before that date and in general. For  example, in the interim FinCEN routinely could communicate currently  available metrics on usefulness to help financial institutions more fully  understand the importance and value of their efforts to report BSA-related  information. Furthermore, with today’s rapidly changing financial markets  and potential changes to money laundering risks, it is important that  FinCEN and federal agencies take steps to provide institution-specific  feedback—while keeping in mind any confidentiality concerns—to cover  different types of financial institutions and those with significant financial  activity. Increasing the feedback on BSA reporting could help make the  BSA reporting of financial institutions more targeted and effective and  enhance collaboration among key stakeholders in U.S efforts to combat  illicit financial crime.

We are making the following four recommendations to FinCEN:  The Director of FinCEN, after consulting with CFTC, should consider  prioritizing the inclusion of the primary SRO conducting BSA  examinations in the futures industry in the Bank Secrecy Act Advisory  Group (BSAAG) on a more consistent basis and also making the primary  futures industry association a concurrent member. (Recommendation 1)

The Director of FinCEN, after consulting with CFTC, should take steps to  explore providing direct BSA data access to NFA. (Recommendation 2)

The Director of FinCEN should review options for FinCEN to more  consistently and publicly provide summary data on the usefulness of BSA  reporting. This review could either be concurrent with FinCEN’s BSA  value study or through another method. (Recommendation 3)

The Director of FinCEN should review options for establishing a  mechanism through which law enforcement agencies may provide regular  and institution-specific feedback on BSA reporting. Options should take  into consideration providing such feedback to cover different types of  financial institutions and those with significant financial activity. This  review could either be part of FinCEN’s BSA value study or through  another method. (Recommendation 4)

We provided a draft of this report to Treasury/FinCEN, CFTC, NCUA,  DHS, DOJ, the Federal Reserve, FDIC, IRS, OCC, and SEC for their  review and comment. FinCEN, CFTC, and NCUA provided written  comments, which are reproduced in appendixes IV, V, and VI. FinCEN,  DHS, the Federal Reserve, FDIC, OCC, and SEC provided technical  comments on the draft report, which we incorporated as appropriate. In  emails, DOJ and IRS audit liaisons stated that the agencies did not have  any formal or technical comments.

In its written response, FinCEN concurred with one recommendation,  disagreed with two, and agreed with the spirit of one recommendation but  noted some concerns. Specifically, FinCEN concurred with the  recommendation that FinCEN more consistently and publicly provide  summary data on the usefulness of BSA reporting (Recommendation 3).  FinCEN disagreed with the draft report’s recommendation that FinCEN,  after consulting with CFTC, should ensure that the primary SRO  conducting BSA examinations in the futures industry is a regular member  of BSAAG and also should consider making the primary futures industry  association a concurrent member (Recommendation 1). FinCEN’s written  response stated that while the primary futures SRO presently is a BSAAG  member, only federal agencies are considered permanent members, and  FinCEN will not make future membership commitments to any specific  SRO or any other nonfederal organization. As such, we modified the  recommendation to give FinCEN more flexibility to address the issues  that prompted our recommendation. We continue to believe that  prioritizing futures representation in BSAAG to be consistent with  securities industry representation would help FinCEN better understand  BSA compliance in the futures industry and keep the futures industry  updated on related BSAAG initiatives.  As noted in the report, the primary  securities SRO has been a member of BSAAG since 2008 and a key  securities industry association has been a concurrent member.

FinCEN disagreed with the recommendation that FinCEN, after consulting  with CFTC, explore providing direct BSA data access to NFA  (Recommendation 2) because FinCEN said it has not received a request  from CFTC or NFA to engage on this matter. FinCEN also said it would  review any future request for direct access in accordance with established  procedures, stating it must ensure that proper controls are in place and  that direct access to the BSA database is limited to those who truly need  it. As discussed in our report, CFTC stated that NFA’s direct access to  BSA data would enhance NFA’s ability to scope and perform BSA/AML  examinations, and to use BSA data more extensively and more frequently  to perform its functions, including conducting the majority of BSA  examinations for the futures industry. NFA representatives also told us  they welcomed a discussion with CFTC and FinCEN on the benefits and  drawbacks of having direct access to BSA data. We continue to believe  the recommendation is valid as it provides FinCEN flexibility to explore  providing NFA data access and would not preclude FinCEN from  ensuring that NFA had proper controls in place.

In its written responses, FinCEN neither agreed nor disagreed with the  recommendation that FinCEN review options for establishing a  mechanism through which law enforcement agencies may provide regular  and institution-specific feedback on BSA reporting (Recommendation 4).  FinCEN said it agreed with the spirit of this recommendation—that law  enforcement feedback on the value and usefulness of BSA information is  important—and stated that FinCEN regularly takes necessary steps to  review options for establishing additional mechanisms through which law  enforcement agencies can provide regular feedback. FinCEN also stated  that it provides a consolidated view of law enforcement feedback as well  as feedback on the value and usefulness of institution-specific BSA  information. However, as discussed in the report, we found that the  current institution-specific feedback mechanisms were not occurring on a  regular basis or were on a relatively small scale. In its response, FinCEN  also noted that unless mandated by Congress, law enforcement feedback  will be voluntary and that FinCEN cannot compel law enforcement  compliance with feedback initiatives. We continue to believe the  recommendation is valid as it allows FinCEN flexibility in reviewing  options for establishing a mechanism through which law enforcement  may choose to provide regular feedback to reach a larger number of  financial institutions from diverse industries, without requiring FinCEN to  compel law enforcement agencies to participate.

In its written responses, CFTC agreed with all our recommendations. In  particular, CFTC agreed that the primary futures SRO should be a regular  member of BSAAG (Recommendation 1). CFTC added that FinCEN  should consider making another futures SRO a concurrent member. In a  later discussion, a CFTC Assistant General Counsel said that, in general,  CFTC would like to see more futures participation in BSAAG, including  SROs and industry associations. CFTC also agreed with our  recommendation that the Director of FinCEN, after consulting with CFTC,  explore providing NFA direct access to BSA data (Recommendation 2). In  its written response, NCUA also agreed with all of our recommendations,  which it stated would enhance coordination and collaboration and  increase visibility about the value of BSA reporting requirements.

As agreed with your office, unless you publicly announce the contents of  this report earlier, we plan no further distribution until 30 days from the  report date. At that time, we will send copies of this report to the  appropriate congressional committees, the Secretary of the Treasury, the  Attorney General, the Acting Secretary of Homeland Security, the  Commissioner of IRS, the Chairman of CFTC, the Chairman of FDIC, the  Chairman of the Federal Reserve, the Chairman of NCUA, the  Comptroller of the Currency, the Chairman of SEC, and other interested  parties. This report will also be available at no charge on our website at  http://www.gao.gov.

If you or your staff have any questions about this report, please contact  me at (202) 512-8678 or ClementsM@gao.gov. Contact points for our  Offices of Congressional Relations and Public Affairs may be found on  the last page of this report. GAO staff who made key contributions to this  report are listed in appendix VII.

The objectives of this report were to:(1) describe how the Financial  Crimes Enforcement Network (FinCEN) and supervisory agencies  supervise, examine for, and enforce Bank Secrecy Act and related anti- money laundering requirements (collectively, BSA/AML) compliance; (2)  discuss how FinCEN, supervisory agencies, and law enforcement  collaborated on implementing and enforcing BSA/AML requirements; and  (3) examine the extent to which FinCEN, supervisory agencies, and law  enforcement established metrics and provided feedback to financial  institutions on the usefulness of their BSA reporting.

For this report, we identified the key agencies and entities, including  FinCEN, a bureau in the Department of the Treasury (Treasury), which is  responsible for the administration of BSA, and the supervisory agencies  that oversee BSA compliance. The supervisory agencies include the  federal banking regulators—Federal Deposit Insurance Corporation  (FDIC), Board of Governors of the Federal Reserve System (Federal  Reserve), National Credit Union Administration (NCUA), Office of the  Comptroller of the Currency (OCC)—as well as the Internal Revenue  Service (IRS), Commodity Futures Trading Commission (CFTC), and  Securities and Exchange Commission (SEC). Self-regulatory  organizations (SRO) for the securities and futures industries—including  the Financial Industry Regulatory Authority (FINRA) and National Futures  Association (NFA)—also have BSA/AML responsibilities and conduct  BSA examinations of their members. The Department of Justice may  pursue investigations and prosecutions of financial institutions and  individuals for both civil and criminal violations of BSA/AML regulations.

To address the first objective, we reviewed relevant laws—including the  Bank Secrecy Act, its related statutes, and key provisions of the USA  PATRIOT Act—regulations, and agency documentation. To better  understand how supervisory agencies conduct their examinations, we  reviewed the following BSA/AML examination manuals: the 2014  BSA/AML Examination Manual, developed by the Federal Financial  Institutions Examination Council (FFIEC); the Bank Secrecy Act/Anti- Money Laundering Examination Manual for Money Services Business  (developed by FinCEN and IRS); and SEC’s nonpublic manual and  futures SROs nonpublic examination procedures. We reviewed and  analyzed data from FinCEN summary reports on the examination and  enforcement activities of supervisory agencies for fiscal years 2015  through 2018 (second quarter), which were the most recent data available  at the time of our analysis.

We also reviewed FinCEN’s enforcement actions for this time period as  provided on its website, to identify the number and types of financial  institutions, and the number of concurrent actions FinCEN brought jointly  with a regulator. We also reviewed and analyzed FinCEN referral data  from January 1, 2015, to September 25, 2018. Referrals are potential  BSA violations or deficiencies referred by supervisory agencies, the  Department of Justice, or state regulators. We assessed the reliability of  the FinCEN summary report data and referral data by reviewing  documentation related to these datasets, interviewing knowledgeable  officials, and conducting manual data testing for missing data, outliers,  and obvious errors. We determined the data to be sufficiently reliable for  reporting on supervisory agency, SRO, and FinCEN BSA/AML  compliance and enforcement activities. For this and our other objectives,  we interviewed officials at Treasury’s Office of Terrorism and Financial  Intelligence and FinCEN, the other supervisory agencies, and two  SROs—FINRA and NFA.

To address the second objective, we judgmentally selected six law  enforcement agencies based on their (1) focus on financial crimes, (2)  role in investigating or prosecuting recent large criminal cases we  selected involving financial institutions with BSA violations, (3)  participation in FinCEN’s liaison program, and (4) identification by  FinCEN as a key user of BSA data. We selected the following law  enforcement agencies: the Criminal Division (Money Laundering and  Asset Recovery Section), the U.S. Attorney’s Offices (through the  Executive Office for United States Attorneys), and the Federal Bureau of  Investigation in the Department of Justice; IRS Criminal Investigation in  the Department of Treasury; and U.S. Immigration and Customs  Enforcement-Homeland Security Investigations and the U.S. Secret  Service in the Department of Homeland Security. The views of selected  law enforcement agencies are not generalizable.

To identify key collaborative mechanisms used to implement BSA/AML  responsibilities, we reviewed agency documentation (such as strategic  plans, national strategies, and risk assessments) and prior GAO reports  that contained discussions of collaborative mechanisms, and we  interviewed agency officials from FinCEN, supervisory agencies, SROs,  and selected law enforcement agencies. We obtained agency  documentation and data related to the identified collaboration  mechanisms and interviewed officials from FinCEN, supervisory  agencies, and selected law enforcement agencies for their perspectives  on these efforts. We compared agencies’ collaboration efforts to criteria in  federal internal control standards on management communication.

To gain further insight into the collaboration process, we also reviewed  documentation on three criminal cases involving BSA/AML violations by  financial institutions to illustrate how law enforcement investigates and  prosecutes BSA violations and coordinates with FinCEN and other  supervisory agencies. We selected the cases on the basis of recent  occurrence (calendar year 2017 or 2018) and on their having involved  criminal violations of BSA by financial institutions, required coordination  on penalties among multiple supervisory agencies and law enforcement,  and resulted in a large monetary penalty. While not generalizable, the  cases helped provide additional context for our review. To obtain  additional perspectives on the effectiveness of BSA/AML collaboration  processes, we interviewed representatives of seven selected industry  associations based on their published work and relevant experience and  for coverage of key financial industries (banking, securities, futures, and  the money services business). While not generalizable, these interviews  helped provide context for how industry views the effectiveness of  BSA/AML collaboration efforts.

For the third objective, we reviewed agency documentation and data on  metrics related to BSA reporting and feedback mechanisms that FinCEN,  the supervisory agencies, or the six selected law enforcement agencies  had established. Key documents we reviewed included Treasury’s most  recent strategic plan, national strategy for combating illicit financing, and  related risk assessments. For all agencies we interviewed, we requested  any available metrics. We reviewed agency websites, annual reports, and  recently published speeches and testimonies on BSA/AML-related topics  to identify any metrics. We also requested and reviewed contract  documentation from FinCEN, such as the performance work statement for  a study that FinCEN commissioned on how to establish metrics for and  identify the value of BSA data. We compared metrics on the usefulness  of BSA and how they were communicated against key criteria for  enhancing or facilitating the use of performance metrics that GAO  previously identified and federal internal control standards on  management communication.

For feedback mechanisms, we obtained documentation on any steps  FinCEN, supervisory agencies, or the selected law enforcement agencies  took to provide feedback on BSA reporting to financial institutions and we  interviewed agency representatives on these efforts. The documents we  reviewed included those identified above related to metrics, as well as  agency advisories, guidance, and rulemaking. We compared the  feedback efforts against Treasury’s information-sharing statutory duties  and strategic plan, and international anti-money laundering standards and  guidance. To gain industry perspectives on the usefulness of BSA  reporting and on feedback received from FinCEN, supervisory agencies,  and law enforcement, we conducted seven interviews with the selected  industry associations. While not generalizable, the interviews helped  provide context for financial industry perspectives on BSA/AML reporting  and feedback.

We conducted this performance audit from February 2018 to August 2019  in accordance with generally accepted government auditing standards.  Those standards require that we plan and perform the audit to obtain  sufficient, appropriate evidence to provide a reasonable basis for our  findings and conclusions based on our audit objectives. We believe that  the evidence obtained provides a reasonable basis for our findings and  conclusions based on our audit objectives.

Appendix II: Bank Secrecy Act/Anti-Money Laundering Violation, Examination, and Enforcement Action Data

As part of its oversight of supervisory agencies, the Financial Crimes  Enforcement Network (FinCEN) routinely collects data from supervisory  agencies as established in information-sharing memorandums of  understanding (MOU). The MOUs establish that supervisory agencies  should provide FinCEN with examination data such as the number of  Bank Secrecy Act /anti-money laundering (BSA/AML) violations, informal  actions, and formal enforcement actions (on a quarterly basis). Finally,  the Internal Revenue Service (IRS) told us it has MOUs with some state  regulators to obtain state examinations, which IRS officials said help to  identify issues among and plan examinations of money services  businesses and determine if the businesses had addressed prior  deficiencies.

The following sections provide more information on each supervisory  agency’s (1) examinations, (2) violations, and (3) enforcement actions.  Also see appendix I for more information on the types of data we  collected for each agency and any data limitations.

From fiscal year 2015 to the second quarter of fiscal year 2018, the most  common BSA violations cited by the federal banking regulators were  violations of requirements to report suspicious activities, 314(a)  information-sharing requirements, rules for filing of reports, BSA training,  and a system of internal controls. For example, regulators could cite a  violation if a financial institution failed to file a required suspicious activity  report (SAR), failed to file a SAR in a timely manner, or failed to maintain  confidentiality of SARs. Violations of internal controls include a financial  institution failing to establish a system of internal controls to ensure  ongoing compliance, including staff adherence to the financial institution’s  BSA/AML policies.

From fiscal year 2015 to 2018 (second quarter), the federal banking  regulators cited thousands of violations (11,752) and brought 116 formal  enforcement actions (see table 7). The number of informal enforcement  actions compared to the number of formal enforcement actions varied by  banking regulator. For example, in fiscal year 2017 the National Credit  Union Administration (NCUA) brought 1,077 informal enforcement actions  and no formal enforcement actions. In the same period, the Office of the  Comptroller of the Currency (OCC) brought two informal enforcement  actions and six formal enforcement actions.

SEC and its SROs took 71 formal enforcement actions against broker- dealers from fiscal year 2015 through the second quarter of fiscal year  2018 (see table 8). FINRA took the majority of enforcement actions  against broker-dealers. From fiscal year 2015 to the second quarter of  fiscal year 2018, SEC and the SROs for broker-dealers most frequently  cited violations of FINRA AML program rules. They included violations of  policies and procedures relating to reporting suspicious activity, internal  controls, and annual independent testing, as well as BSA violations of  AML program requirements for brokers or dealers and customer  identification programs for brokers or dealers.

From fiscal year 2015 to the second quarter of fiscal year 2018, the  National Futures Association (NFA) cited all BSA/AML violations, and  took all informal and formal enforcement actions for BSA/AML  deficiencies for the futures industry (see table 9). The violations NFA  most commonly cited were against introducing brokers and fell under its  AML program rules that related to policies and procedures for internal  controls, training, and annual independent testing, and BSA requirements  for AML programs and customer identification programs. The CME Group  did not cite any futures commission merchants for violations during this  period. In response to violations, NFA brought almost 200 informal  enforcement actions and a few (10) formal enforcement actions over the  period of our review. For example, in 2017 NFA took 64 informal and four  formal enforcement actions.

IRS referred more than 100 cases to FinCEN from fiscal year 2015  through the second quarter of 2018 and issued letter 1112s to thousands  of institutions, which contain a summary of examination findings and  recommendations to the institution for corrective action (see table 10).

From fiscal year 2015 to the second quarter of fiscal year 2018, the most  common violations cited by IRS fell under general AML program  requirements for money services businesses, which require such  businesses to develop, implement, and maintain an effective AML  program (one designed to prevent a business from being used to facilitate  money laundering and the financing of terrorist activities). AML program  requirements have several subcomponent violations. Among the most  commonly cited subcomponent violations were those related to overall  program deficiencies; policies, procedures, and internal controls; training  of appropriate personnel to identify suspicious transactions; and providing  for independent testing of the AML program.

Appendix III: Selected Criminal Cases Involving Bank Secrecy Act/Anti-Money Laundering Violations by Financial Institutions

The Financial Crimes Enforcement Network (FinCEN) and supervisory  agencies may be asked to provide information as part of law enforcement  investigations and can take parallel, but separate, enforcement actions  against the same institutions to address Bank Secrecy Act/anti-money  laundering (BSA/AML) concerns. FinCEN and supervisory agencies may  refer potential violations of a criminal nature an appropriate federal law  enforcement agency or to the Department of Justice (DOJ)—and within  DOJ, the U.S. Attorney’s Office—and may be asked to assist law  enforcement investigations. For example, supervisory agencies may be  asked to interpret financial institution documents or serve as expert  witnesses and records custodians in a trial. FinCEN, supervisory  agencies, and law enforcement agencies have conducted parallel civil  and criminal investigations. Federal law enforcement and supervisory  agency officials have told us that such investigations should remain  separate and independent.

We selected three recent cases in which FinCEN, supervisory agencies,  and law enforcement collaborated to conduct parallel investigations and  took concurrent but separate civil and criminal BSA enforcement actions.  Officials with whom we spoke from agencies that were involved in these  cases said the agencies coordinated with each other (for example, by  establishing liaison positions, scheduling regular conference calls, and  coordinating on global settlements).

Rabobank National Association (Rabobank). On February 7, 2018,  DOJ and the Office of the Comptroller of the Currency (OCC) both  announced actions against Rabobank for deficiencies in its BSA/AML  compliance program and obstruction of the primary regulator (OCC).  DOJ announced that Rabobank pleaded guilty to a felony conspiracy  charge for impairing, impeding, and obstructing its primary regulator  OCC by concealing deficiencies in its AML program and for  obstructing OCC’s examination of Rabobank. The bank agreed to  forfeit $368,701,259 for allowing illicit funds to be processed through  the bank without adequate BSA/AML review and OCC issued a $50  million civil money penalty against Rabobank for deficiencies in its  BSA/AML compliance program. DOJ’s Money Laundering and Asset  Recovery Section Bank Integrity Unit, the U.S. Attorney’s Office of the  Southern District of California, U.S. Immigration and Customs  Enforcement-Homeland Security Investigations (ICE-HSI) within the  Department of Homeland Security, Internal Revenue Service Criminal  Investigation (IRS-CI), and the Financial Investigations and Border  Crimes Task Force conducted the criminal investigation. The  investigation occurred in parallel with OCC’s regulatory investigation  and the investigation by FinCEN’s Enforcement Division. OCC  officials told us they collaborated extensively with other agencies over  a 4-year period, participated in numerous calls and meetings, and  provided law enforcement with examination information and access to  OCC examiners for interviews. Officials from the U.S. Attorney’s  Office of the Southern District of California said that a practice they  found helpful in this case was establishing a liaison with the agencies  involved. The liaisons allowed the different parties to share  information effectively, provided access to data as needed, and  responded to questions in a timely manner.

U.S. Bancorp. On February 15, 2018, DOJ, OCC, and FinCEN  announced actions against U.S Bancorp and its subsidiary U.S. Bank,  N.A., for violations of several provisions of BSA, including an  inadequate BSA/AML program and failure to file suspicious activity  reports (SAR) and currency transaction reports (CTR). Under a  deferred prosecution agreement with the U.S. Attorney’s Office of the  Southern District of New York, U.S Bancorp and its subsidiary agreed  to pay $528 million for BSA violations and agreed to continue to  reform its AML program. Of the $528 million, $75 million was satisfied  by a penalty paid to the Department of the Treasury as part of OCC’s  civil money penalty assessment, which cited the bank in a 2015  consent order for failure to adopt and implement a program that  covered required BSA/AML program elements. FinCEN also reached  an agreement with U.S. Bank to resolve related regulatory actions,  which required U.S. Bank to pay an additional $70 million for civil  violations of the BSA. On the same day as the FinCEN agreement,  the Board of Governors of the Federal Reserve System (Federal  Reserve) imposed a $15 million penalty against U.S. Bancorp for  deficiencies (including BSA violations) related to the bank under its  supervision. According to officials from the U.S. Attorney’s Office of  the Southern District of New York, their office, OCC, FinCEN and the  Federal Reserve coordinated the terms of their respective resolutions  to avoid the unnecessary imposition of duplicative penalties. OCC  officials told us that the U.S. Attorney’s Office of the Southern District  of New York contacted them to obtain additional information about its  examination conclusions that supported OCC’s 2015 cease and desist  order. OCC provided examination documents and information to the  U.S. Attorney’s Office of the Southern District of New York for 2 years,  including making OCC examiners available for interviews with the  U.S. Attorney’s Office personnel and to answer follow-up inquiries.  Federal Reserve officials said they coordinated in the U.S. Bancorp  case through a global resolution with the firm.

Banamex. In May 2017, Banamex admitted to criminal violations and  entered into a non-prosecution agreement, which included an  agreement to forfeit $97.44 million. The bank also admitted that it  should have improved its monitoring of money services businesses’  remittances, but failed to do so. The investigation was conducted by  the Bank Integrity Unit of DOJ’s Money Laundering and Asset  Recovery Section, U.S. Attorney’s Office of the District of  Massachusetts, IRS-CI, Drug Enforcement Administration, and the  Federal Deposit Insurance Corporation’s (FDIC) Office of Inspector  General. The agencies consulted on a general level, but the agencies’  investigations were at all times kept separate from the criminal  investigation. In July 2015, FDIC and the California Department of  Business Oversight assessed civil money penalties against Banamex  requiring a total payment of $140 million to resolve separate BSA  regulatory investigations. In February 2017, FDIC also announced  enforcement actions against four former senior bank executives  relating to BSA violations. IRS-CI officials stated that involvement by  the Bank Integrity Unit of DOJ’s Money Laundering and Asset  Recovery Section in financial institution investigations is extremely  helpful as the unit bring a wealth of knowledge and resources. DOJ  officials told us there was close collaboration between all agencies  involved. DOJ officials said that all agencies had meetings frequently  and created a liaison position to encourage interagency collaboration  as the case progressed.

In May 2018, DOJ issued a new policy to encourage coordination among  DOJ and supervisory agencies during corporate investigations. In a May  2018 speech, the DOJ Deputy Attorney General identified the Securities  and Exchange Commission, Commodity Futures Trading Commission,  Federal Reserve, FDIC, OCC, and the Department of the Treasury’s  Office of Foreign Assets Control as agencies with which DOJ works to be  better able to detect sophisticated financial fraud schemes and deploy  adequate penalties and remedies to ensure market integrity. He noted  that many federal, state, local, and foreign authorities that work with DOJ  were interested in further coordination with DOJ. DOJ’s new policy  encourages coordination and consideration of the amount of fines,  penalties, or forfeiture paid among DOJ components and other law  enforcement or other federal, state, local, or foreign enforcement  authorities seeking to resolve a case with a company for the same  misconduct. Similarly, in June 2018, the Federal Reserve, FDIC, and  OCC issued a joint statement on coordination among federal banking  agencies during formal enforcement actions.

Appendix IV: Comments from the Financial Crimes Enforcement Network

Appendix V: Comments from the Commodity Futures Trading Commission

Appendix VI: Comments from the National Credit Union Administration

Appendix VII: GAO Contact and Staff Acknowledgments

In addition to the contact named above, Allison Abrams (Assistant  Director), Verginie Tarpinian (Analyst in Charge), Peter Beck, Joseph  Cruz, Brian James, Moira Lenox, Benjamin Licht, Robert Lowthian, Marc  Molino, Ifunanya Nwokedi, Barbara Roesmann, Tyler Spunaugle, Farrah  Stone, and Sarah Veale made key contributions to this report.

The Bank Secrecy Act requires financial institutions to report information to the federal government that law enforcement can use to investigate potential crimes, like money laundering.

Industry representatives told us that generating reports on suspicious activity can be labor intensive, and that they would like more feedback on whether the reports they submitted were useful.

We found the Treasury Department and some law enforcement agencies measured things like how many reports produced investigations. However, these metrics were not consistently communicated.

We made 4 recommendations, including for regular feedback.