Bank Secrecy Act: Examiners Need More Information on How to Assess Banks' Compliance Controls for Money Transmitter Accounts

The World Bank and others have reported that some money transmitters have been losing access to banking services. Money transmitters play an important role in the financial system, in part because they provide financial services to people less likely to use traditional banking services. GAO was asked to review the causes and potential effects of derisking by banks.

This report examines, among other issues, (1) the extent to which banks are terminating or limiting services for money transmitters, (2) challenges in assessing banks' BSA/AML compliance related to money transmitters, and (3) regulators' actions to address derisking concerns.

GAO reviewed bank examination reports and documents, held eight discussion groups with federal bank examiners, surveyed a nationally representative sample of 406 banks (excluding credit unions), and interviewed federal and bank officials, money transmitters, industry associations, and other stakeholders.

From 2014 through 2016, 40 of 86 banks with money transmitter customers that responded to GAO's survey indicated they terminated at least one money transmitter account for money-laundering-related reasons. Money transmitters transfer money for their customers to recipients domestically or internationally. Common reasons given for terminating accounts included the customer not providing information needed to satisfy the banks' due diligence requirements under Bank Secrecy Act (BSA)/anti-money laundering (AML) regulations and that the cost of BSA/AML compliance made these customers unprofitable. However, banks also cited concerns that these customers drew heightened regulatory oversight; this may indicate “derisking,” the practice of banks limiting services or closing accounts with customers to avoid any perceived regulatory concerns about facilitating money laundering.

Federal bank examiners in some of GAO's discussion groups identified challenges in assessing banks' compliance with due diligence requirements. In 2005, the Department of the Treasury's (Treasury) Financial Crimes Enforcement Network (FinCEN) and the federal banking regulators issued interagency interpretive guidance to clarify BSA/AML requirements and supervisory expectations for banks providing banking services to money transmitters. The guidance was incorporated in the Federal Financial Institutions Examination Council BSA/AML examination manual. However, examiners from some discussion groups said it was unclear how much due diligence is reasonable to expect banks to conduct for their money transmitter customers. For example, while the manual's examination guidance pertaining to money transmitters states that due diligence on higher-risk accounts can include reviewing the money transmitter's BSA/AML compliance program or conducting on-site visits, the related examination procedures do not clarify what these reviews or visits might entail. Unless federal banking regulators take steps to improve examiners' ability to evaluate banks' compliance with BSA/AML requirements as applied to money transmitter accounts, examiners may not be fully achieving examination objectives.

In response to derisking concerns associated with money transmitters, FinCEN and the federal banking regulators have issued general guidance that discourages banks from terminating accounts with any particular customer type without evaluating individual customers' risks. In prior work, GAO noted that regulators had not fully evaluated how banks' regulatory concerns may be influencing decisions to derisk. GAO recommended that FinCEN and the federal banking regulators conduct a retrospective review of BSA regulations and their implementation, with a focus on how banks' regulatory concerns may affect their decisions to provide services. According to federal banking regulators and FinCEN, they and Treasury established an interagency working group in early 2018 that they believe will address the recommendation. The working group has taken important steps toward improving the efficiency and effectiveness of BSA/AML supervision, including issuing an interagency statement intended to improve the transparency of the risk-focused approach examiners use to plan and conduct BSA examinations. However, the working group has not yet evaluated the full range of factors that may influence banks to derisk.

GAO is making a total of four recommendations to the federal banking regulators that each regulator improve examiners' ability to evaluate banks' BSA/AML compliance as applied to money transmitter accounts. The federal banking regulators agreed with GAO's recommendations.

GAO also reiterates its recommendation in GAO-18-263 that FinCEN and the federal banking regulators conduct a retrospective review of BSA regulations and implementation.

Money laundering and terrorist financing pose threats to national security  and the integrity of the financial system. The Bank Secrecy Act (BSA) is  an important tool in federal law enforcement efforts to detect and deter  the use of financial institutions for criminal activity, including money  laundering and terrorist financing. The BSA and its implementing  regulations generally require financial institutions, including banks, to  collect and retain various records of customer transactions, verify  customers’ identities, maintain anti-money laundering (AML) compliance  programs, and report suspicious transactions. The Department of the  Treasury’s (Treasury) Financial Crimes Enforcement Network (FinCEN)  has authority to administer and enforce compliance with the BSA, and it  has delegated BSA/AML examination authority for banks to the federal  banking regulators—the Board of Governors of the Federal Reserve  System (Federal Reserve), the Federal Deposit Insurance Corporation  (FDIC), the Office of the Comptroller of the Currency (OCC), and the  National Credit Union Administration (NCUA).

In recent years, the World Bank and others have reported that some  money transmitters—entities that transfer money for their customers to  recipients domestically or internationally—have been losing access to  banking services with depository institutions. Money transmitters play an  important role in the financial system, in part because they often provide a  regulated channel for conducting financial transactions to people less  likely to use traditional banking services and because of their prominent  role in providing international money transfer services. You and others  have raised questions about whether some banks may be engaging in  “derisking” with respect to money transmitters—that is, limiting certain  services or ending their relationships with customers to, among other  things, avoid perceived regulatory concerns about facilitating money  laundering.

This report is the last of four addressing your request that we review the  various effects of derisking, including on money transmitters operating in  the United States. This report (1) describes regulators’ BSA/AML  supervisory expectations for banks that provide services to money  transmitters and other money services businesses (MSB) and examiner  views on bank challenges in complying with these requirements; (2)  examines challenges reported by examiners in conducting BSA/AML  assessments; (3) examines the extent to which banks are terminating or  limiting money transmitters’ access to banking services and the effects on  money transmitters; and (4) evaluates how FinCEN and the federal  banking regulators have assessed and responded to concerns about the  derisking of money transmitters.

To address our first objective, we reviewed joint guidance issued by  FinCEN and the federal banking regulators on banking MSBs—including  money transmitters—and the Federal Financial Institutions Examination Council’s (FFIEC) BSA/AML examination manual used by federal banking  regulators to examine banks for BSA/AML compliance. We also  interviewed a nongeneralizable sample of representatives of banks and  credit unions, banking industry groups and trade associations, and the  federal banking regulators. We conducted eight discussion groups with  BSA/AML examiners (six to 14 examiners in each group) from the federal  banking regulators to understand how they assess BSA/AML compliance  controls around money transmitter customers.

To address our second objective, we asked examiners in our discussion  groups to identify any challenges they encountered when assessing these  compliance controls. We also reviewed examination guidance and  procedures for assessing BSA/AML compliance controls around money  transmitters. We assessed this information against federal internal control  standards related to identifying risks and communicating information. We  also reviewed documentation from BSA/AML examinations of a  nongeneralizable sample of 56 banks and credit unions that reflected a  mix of asset sizes from each federal banking regulator. We also included  banks that had enforcement actions taken against them to gain additional  context about BSA/AML examinations, including BSA/AML violations.

To address our third objective, we administered a web-based survey to a  nationally representative sample of banks in the United States for a total  survey sample of 406 banks. In the survey, we asked banks about  terminations of money transmitter accounts and limitations on account  offerings related to BSA/AML risk and the reasons for these decisions for  the period January 1, 2014, to December 31, 2016. We obtained a  weighted survey response rate of 46.5 percent. While we designed the  survey to be nationally representative of all banks in the United States,  some results are statistically nongeneralizable because of the relatively  small number of banks that reported having money transmitters as  customers. For survey questions that are statistically nongeneralizable,  we present only the number of responses to each survey question, and  the results are not generalizable to the population of banks. See appendix  I for more information on our survey methodology and appendix II for our  survey results. To examine the effects on money transmitters of bank  account terminations on and limitations in the number of accounts, we  interviewed a nongeneralizable sample of representatives of 11 money  transmitters we selected to represent a range of sizes.

To address our fourth objective, we reviewed agency documentation and  guidance the agencies issued to banks related to the derisking of MSBs  and interviewed agency officials. We also reviewed our prior report that  evaluated regulators’ response to derisking along the Southwest border,  and we assessed actions regulators have taken to respond to a  recommendation we made in that report. A more detailed description of  our scope and methodology appears in appendix I.

We conducted this performance audit from August 2016 to December  2019 in accordance with generally accepted government auditing  standards. Those standards require that we plan and perform the audit to  obtain sufficient, appropriate evidence to provide a reasonable basis for  our findings and conclusions based on our audit objectives. We believe  that the evidence obtained provides a reasonable basis for our findings  and conclusions based on our audit objectives.

BSA/AML Requirements and Key Agencies Involved in Their Enforcement

The BSA established reporting, recordkeeping, and other AML  requirements for financial institutions. As the delegated administrator of  the BSA, FinCEN has issued implementing regulations. In complying with  BSA/AML requirements, U.S. financial institutions assist government  agencies in detecting and preventing money laundering and terrorist  financing by, among other things, establishing and maintaining  compliance programs, conducting ongoing monitoring of customers and  transactions, and reporting suspicious activity. Oversight and  enforcement of compliance with the BSA involve several federal  agencies, including FinCEN and the Internal Revenue Service (IRS).  FinCEN has overall authority for administering and enforcing compliance  under the BSA and may seek civil penalties and injunctions to compel  compliance. In addition, each of the federal banking regulators has  independent authority to initiate enforcement actions against supervised  institutions for violations of law and to seek civil money penalties for BSA  violations, among other things. FinCEN has delegated authority to IRS to  investigate most criminal violations of the BSA. The Department of  Justice prosecutes violations of federal criminal money-laundering  statutes, including violations of the BSA, and several law enforcement  agencies conduct BSA-related criminal investigations.

The federal banking regulators have also issued BSA/AML regulations  that require banks to establish and maintain a BSA/AML compliance  program that includes, among other things, policies, procedures, and  processes to identify and report suspicious activity. The banking  regulators are required to review banks’ compliance with BSA/AML  requirements and regulations, which they generally do every 1 to 2 years  as a part of their routine safety and soundness examinations. FinCEN has  also delegated examination authority for BSA/AML compliance for certain  entities, including money transmitters, to IRS. In general, money  transmitters must register with FinCEN and provide certain information on  their structure and ownership. According to Treasury, in all but one state,  money transmitters are required to obtain licenses from states in which  they are incorporated or conduct business. State supervisory agencies  also may conduct BSA/AML examinations of licensed money transmitters.

To ensure consistency in the application of BSA/AML requirements, in  2005 the federal banking regulators collaborated with FinCEN on  developing an examination manual that was issued by FFIEC for federal  bank examiners conducting BSA/AML examinations of banks. The  examination manual has been revised several times since its release, and  the most recent comprehensive revision was released in 2014. According  to the examination manual, a key function of the federal banking  regulators’ BSA/AML examinations is to assess whether banks have  established the appropriate policies, procedures, and processes based on  their BSA/AML risk to identify and report suspicious activity. The  supervisory process also assesses whether banks provide sufficient detail  in reports to law enforcement agencies to make the reports useful for  investigating suspicious transactions that are reported. Moreover, federal  banking regulators conduct risk-focused BSA/AML examinations of  banks—that is, they review key BSA/AML risks or specific risk areas  identified by the bank and tailor examination procedures based on each  bank’s risk profile. Among other things, examiners review whether banks have an adequate system of internal controls to ensure ongoing  compliance with BSA/AML regulations. Similarly, in 2008 FinCEN issued  a BSA examination manual to guide reviews of money transmitters and  other types of MSBs, including reviews by IRS and state regulators.  Both the FFIEC and FinCEN examination manuals are publicly available.

Components of BSA/AML Compliance Programs for Money Transmitters and Banks under the BSA

Money transmitters and banks are subject to requirements under the  BSA. They are generally required to design and implement a written AML  compliance program, report certain transactions to Treasury, and meet  recordkeeping (including identity documentation) requirements for  transfers of $3,000 or more. At a minimum, each AML compliance  program must establish a system of AML compliance policies, procedures, and  internal controls to ensure ongoing compliance; designate an individual to coordinate and monitor day-to-day provide training for appropriate personnel; and provide for an independent audit function to test for compliance.

Additionally, banks must include appropriate risk-based procedures for  conducting ongoing customer due diligence as part of their AML  compliance program.

BSA/AML regulations require that each bank or money transmitter tailor a  compliance program that is specific to its own risks based on factors such  as the products and services offered and the customers and locations  served. BSA/AML compliance programs for banks—including those that  service money transmitters—are expected to include the following:

Customer identification program. Banks must have written  procedures for opening accounts and must specify what identifying  information they will obtain from each customer. At a minimum, the  bank must obtain the following identifying information from each  customer before opening the account: name, date of birth, address,  and identification number, such as a Social Security number or a  passport number. Banks’ customer identification programs must also  include risk-based procedures for verifying the identity of each  customer to the extent reasonable and practicable. Additionally, a  bank’s customer identification program should contain procedures for  circumstances when a bank cannot verify the customer’s identity,  including procedures for when the bank should not open an account  and when the bank should close an account.

Customer due diligence procedures. These procedures assist  banks in determining when transactions are potentially suspicious.  Procedures must be designed to achieve two minimum regulatory  requirements: (1) understanding the nature and purpose of customer  relationships so customer risk profiles can be developed and (2)  conducting ongoing monitoring, based on the level of risk associated  with the customer, to identify and report suspicious activity and to  maintain and update customer information on a risk-basis.

Additional due diligence procedures. Due diligence procedures  also should define when and what additional customer information will  be collected for customers who banks determine may pose a higher  risk for money laundering or terrorist financing. Procedures should be  based on each customer’s risk profile and specific risks posed. Banks  review higher-risk customers and their transactions more closely at  account opening and more frequently throughout the term of their  relationship with the bank.

In addition, banks and money transmitters must also have policies and  procedures to monitor transactions and identify suspicious activity.  Monitoring generally includes (1) manual review of transaction summary  reports to identify suspicious transactions or (2) automated monitoring  systems that use computer algorithms to identify patterns of unusual  activity. As we previously reported, banks with large transaction volumes  typically use automated monitoring systems.

Banks and money transmitters also must comply with certain reporting  requirements:

Currency Transaction Reports. Banks and money transmitters must  electronically file this type of report for each transaction or a  combination of transactions in a single day—such as a deposit,  withdrawal, exchange, or other payment or transfer—in currency of  more than $10,000.

Suspicious Activity Reports (SAR). Under FinCEN regulation,  banks and money transmitters are required to file this type of report  when (1) a transaction involves or aggregates at least $5,000 in funds  or other assets for banks or at least $2,000 in funds or other assets  for money transmitters and (2) the institution knows, suspects, or has  reason to suspect that the transaction is suspicious.

In addition, banks’ compliance programs generally include policies and  procedures that describe criteria for deciding to close or not to open an  account. For example, although there is no requirement for a bank to  close an account that is the subject of a SAR filing, a bank should  develop criteria in policies and procedures that indicate when it will  escalate issues identified through repeat SAR filings on accounts,  including criteria on when to close an account. The federal banking  regulators generally do not direct banks to open, close, or maintain  individual accounts.

The money transfer industry is diverse, ranging from Fortune 500  companies with numerous outlets worldwide to small, independent money  transmitters. Some money transmitters are in communities with  population concentrations that do not necessarily have access to  traditional banking services. Money transmitters may send and receive  funds domestically—intrastate or interstate—or internationally. Money  transmitters typically work through agents—separate business entities  generally authorized to send and receive money transfers. Most money  transfers are initiated in person at retail outlets. Money transmitters  generally operate through their own retail storefronts or through grocery  stores, financial service outlets, convenience stores, and other retailers  that serve as agents.

In one common type of money transmitter transaction—known as a cash- to-cash transfer—a sender enters a money transmitter agent location and  provides cash to cover the transfer amount and fees (see fig. 1). For  transfers at or above $3,000, senders must generally provide basic  information about themselves (including name and address) at the time of  the transfer request. The agent processes the transaction, and the money  transmitter’s headquarters screens it to validate BSA/AML compliance.  The money is then transferred to a recipient via a distributing agent or  bank. In an international money transfer, the money may be distributed  through an agent in the destination country, wired through the money  transmitter’s bank to the distributor agent’s bank, or transferred by other  means to a specified agent in the recipient’s country. The distributor  agent pays out cash to the recipient in either U.S. dollars or local  currency.

Money-Laundering and Terrorist-Financing Risks Posed by Money Transmitters

Money transfers can pose money-laundering and terrorist-financing risks,  as funds related to illicit activity may go undetected due to the large  volume of transactions or to money transmitters’ inadequate oversight of  the various entities involved. We and others have identified money- laundering and terrorist-financing risks associated with money  transmitters, including risks related to agents, customers, geographic  location, and products.

Agents. Money transmitters often work with multiple agents, and  maintaining adequate oversight can be challenging, given the  decentralized nature of the agent system. According to data collected  by the Conference of State Bank Supervisors, as of December 31,  2018, 204 money transmitters reported that they had more than  440,000 agents—with nine of these money transmitters reporting that  they had at least 10,000 agents. These agents present money- laundering risks if they knowingly or unknowingly fail to follow  BSA/AML requirements or the policies and programs established by  the money transmitter. For example, an agent may not follow the  recordkeeping requirements for transfers above the regulatory funds  transfer threshold or above lower thresholds that a money transmitter  has self-imposed. MSB principals are required to conduct risk-based  monitoring of their agents.

Customers. Certain customers may pose heightened risk because of  the nature of their business, occupation, or anticipated transaction  activity. Additionally, in certain instances, they may be able to launder  money while remaining anonymous. For example, customers may use  false identities or straw men (individuals hired to conduct transfers on  behalf of others) to keep from being identified as the original source of  the funds. Examples of suspicious customer activity that may indicate  money laundering include identification documents that cannot be  easily verified; the use of different taxpayer identification numbers with variations of the same name; frequent or large transactions with no  record of past or present employment; and reluctance to provide  identification for transactions subject to identification requirements.

Geographic location. Certain geographic locations may be more  vulnerable to money laundering or terrorist financing via money  transfers. High-risk geographic locations can be either international or  domestic. According to FinCEN’s MSB examination manual,  examples of international high-risk geographic locations include  countries subject to sanctions by the Office of Foreign Assets Control  or countries and territories identified as being noncooperative.  Domestic high-risk geographic locations include High Intensity Drug  Trafficking Areas (HIDTA) and High Intensity Financial Crime Areas  (HIFCA).

Products. According to the FFIEC and FinCEN MSB examination  manuals, certain products and services, such as money transfers,  may pose a higher risk of money laundering because of the degree of  anonymity they can offer. For example, the Financial Action Task  Force identified money-laundering and terrorist-financing risks  associated with mobile payments because these services can  sometimes allow for anonymous transactions, depending on the level  of AML measures the mobile payments provider has in place. The  task force also reported that virtual currency—digital representations  of value such as Bitcoin that are not government-issued legal  tender—could facilitate international remittances as virtual-currency- based products and services are developed.

Federal agencies and international organizations have identified  instances where money transfers have been used to launder proceeds  from illicit activities such as human smuggling and trafficking, drug  trafficking, and consumer fraud, including the following examples:  In 2017, a large money transmitter entered into a $586 million  settlement with the Department of Justice, the Federal Trade  Commission, and the U.S. Attorney’s offices for several states after it  was accused of, among other things, processing money transfers that  were suspected of being used to pay human smugglers in China.

In 2012, the Department of Justice found that a large money  transmitter’s agents knowingly participated in a scheme in which  victims wired funds to the transmitter’s agents and outlets in response  to fraudulent claims such as promising victims they would receive  large cash prizes or lottery winnings, falsely offering various high- ticket items for deeply discounted prices, falsely promising  employment opportunities, or posing as a relative of the victim and  claiming to be in trouble and in urgent need of money.

In a 2011 case, seven people were sentenced for money laundering  and drug trafficking involving the transfer of funds from the U.S. Virgin  Islands to Alaska. Hundreds of thousands of dollars in payment for the  drugs were sent using a large money transmitter in amounts  averaging less than $2,000 per wire transfer, a money-laundering  method known as structuring. See figure 2 for an illustrated example  of structuring.

Requirements to Assess and Manage Money-Transmitter Risk Present Challenges for Some Banks

Banks Are Required to Assess Money-Transmitter Risks and Manage Risks through Due Diligence and Monitoring

In April 2005, FinCEN and the federal banking regulators issued  interpretative guidance to further clarify BSA/AML requirements to banks  that provide banking services to MSBs (including money transmitters)  operating in the United States. According to the interagency guidance, a  bank’s level and extent of due diligence beyond the minimum  expectations should be based on an assessment of the individual  customer’s BSA/AML risks. If a particular MSB relationship indicates a  low risk of money laundering or other illicit activity, the bank may not be  routinely expected to perform further due diligence beyond minimum  expectations. Minimum expectations include applying the bank’s  customer identification program and confirming FinCEN registration (if  required), agent status (if applicable), and state and local licensing  requirements (if applicable). Banks are also to conduct a basic BSA/AML  risk assessment to determine the level of risk associated with the account  and whether further due diligence is necessary. In order to properly  assess risks, the interpretive guidance clarifies that banks should  consider the purpose of the account, the types of products and services  offered by the MSB, the locations and markets it serves, and the  anticipated account activity (see text box).

Examples of Basic Information Banks Should Consider When Assessing a Money  Transmitter’s Money-Laundering Risk, According to the Interagency Guidance  Purpose of account: Whether the money transmitter needs the bank account to  transfer funds to its principal U.S. account or to foreign-based agents in other countries.

Products and services offered: Whether the money transmitter is a principal with a  fleet of agents, or is it an agent itself, and whether money transmission the customer’s  primary or ancillary business (such as a grocery store that derives a small fraction of its  overall revenue from providing money transmission services).

Locations served: Whether the money transmitter’s market domestic or international  and whether it targets local residents or broad markets.

Anticipated account activity: Relevant considerations include the expected transaction  amounts and whether the money transmitter is operating out of one location and using  one bank branch, or whether it has several agents making deposits at multiple branches  throughout the bank’s network.

If a bank concludes from its risk assessment that the MSB customer  presents a higher level of money-laundering or terrorist-financing risk, it  will be expected to conduct additional due diligence in a manner  commensurate with the heightened risk. According to the interagency  guidance, the appropriate amount of due diligence depends in part on the  level of perceived risk and the size and sophistication of the particular  MSB. Appropriate due diligence can include reviewing the MSB’s  BSA/AML compliance program, the results of the MSB’s independent  testing of its program, and written agent management and termination  practices for the MSB, as well as conducting on-site visits to the MSB.

The interagency guidance also provides examples of “risk indicators” to  assist banks with their risk assessments. Examples of potentially lower- risk indicators include a money transmitter that primarily markets to  customers that conduct routine transactions with moderate frequency in  low dollar amounts; is an established business with an operating history;  or only remits funds to domestic entities. Examples of potentially higher- risk indicators include a money transmitter that allows customers to  conduct transactions in higher dollar amounts with moderate to high  frequency; is a new business without an established operating history;  offers only, or specializes in, cross-border transactions, particularly to  countries posing heightened risk for money laundering or terrorism  financing; or is located in an area designated as a HIFCA or HIDTA. The  guidance notes that in determining the level of risk, a bank should not  focus on any single indicator. Rather, an effective risk assessment should  be a composite of multiple factors, and depending on the circumstances,  certain factors may be weighed more heavily than others.

Banks’ customer risk assessments also determine the level of ongoing  monitoring for suspicious activity they must perform on each customer.  The interagency guidance states that, based on the bank’s assessment of  the risks of its MSB customers (including money transmitters), monitoring  should include periodic confirmation that initial projections of account  activity have remained reasonably consistent over time. Examples of  potentially suspicious activity include a money transmitter transferring  funds to a different jurisdiction than expected or depositing currency  significantly in excess of expected amounts without any justifiable  explanation, such as an expansion of business activity or new locations.

Officials from several banks we spoke with described their additional due  diligence procedures for implementing BSA/AML requirements when  accepting new money transmitter customers or monitoring existing ones.  These include obtaining and reviewing the money transmitter’s BSA/AML  policies, using questionnaires and interviews to collect detailed  information from the money transmitter on its business operations—such  as services offered, transaction volume, and cash activity—and site visits  to verify the information collected.

Officials from one bank told us that additional due diligence includes a  review of the money transmitter’s business location, longevity, principal  owners, transaction volume, and cash activity. Bank staff collect this  information via a questionnaire administered through an in-person  interview at a branch. After reviewing the information, the bank’s  BSA/AML compliance department may choose to speak one-on-one with  the potential money transmitter customer or conduct a site visit. When  monitoring a new money transmitter customer for suspicious activity,  compliance staff compare answers from the due diligence questionnaire  against the customer’s cash log and wire activity to determine if the  activity is outside normal parameters. The compliance department  investigates any suspicious leads and reports them to the bank’s SAR  committee to decide whether to file a SAR.

Federal Banking Examiners Determine Whether Banks Adequately Incorporate BSA/AML Risk into Their Compliance Programs

Federal banking examiners determine whether a BSA/AML examination  should include a review of a bank’s money transmitter accounts based on  the overall risk profile of the bank. The FFIEC examination manual directs  examiners to tailor the BSA/AML examination scope and procedures to  the specific risk profile of the bank. Examiners begin a BSA/AML  examination by reviewing and assessing the adequacy of the bank’s  BSA/AML risk assessment. This review includes determining whether  bank management has developed an accurate risk assessment that  identifies significant risks to the bank (see text box). This determination is  based on factors such as whether management has adequately  considered all products, services, customers, transaction number and  volume, and geographic locations, and whether management’s  assessment methodology within these specific risk categories was  adequate.

Bank Secrecy Act/Anti-Money Laundering (BSA/AML) Examination Procedures for  Banks  In order to effectively apply resources and ensure compliance with BSA requirements, the  Federal Financial Institutions Examination Council (FFIEC) examination manual is  structured to allow examiners to tailor the BSA/AML examination scope and procedures to  the specific risk profile of the bank.

At a minimum, examiners are expected to follow core examination procedures to ensure  that the bank has an adequate BSA/AML compliance program commensurate with its risk  profile. The core procedures encompass four areas:

Scoping and planning: Identifying the bank’s BSA/AML risks, developing the  examination scope, and documenting the plan.

BSA/AML risk assessment: Assessing the BSA/AML risk profile of the bank and  evaluating the adequacy of the bank’s BSA/AML risk assessment process.

BSA/AML compliance program: Determining whether the bank has developed,  administered, and maintained an effective program for compliance with the BSA and  all of its implementing regulations.

Developing conclusions and finalizing the examination: Formulating conclusions,  communicating findings to management, preparing report comments, developing an  appropriate supervisory response, and closing the examination.

In addition to the core examination procedures, the examination manual also contains  sections of expanded examination procedures that address specific lines of business,  products, customers, or entities that may present unique BSA/AML compliance challenges  and exposures for which banks should institute appropriate policies, procedures, and  processes. As examples, the examination manual contains expanded examination  procedures with respect to nonbank financial institutions, electronic banking, and funds  transfers.

The examination manual indicates that not all of the core and expanded examination  procedures are likely to be applicable to every bank. The specific examination procedures  that need to be performed depend on the BSA/AML risk profile of the bank, the bank’s  history of BSA/AML compliance, and other relevant factors.

Examiners also review the bank’s written BSA/AML compliance program  and determine whether the bank has adequately incorporated the risk it  identified through its risk assessment into its BSA/AML compliance  program. This review and determination include completing relevant core  examination procedures for assessing key elements of the bank’s  compliance program, such as the customer identification program and  policies, procedures, and processes related to customer due diligence,  suspicious activity reporting, and currency transaction reporting. As part  of these core examination procedures, examiners conduct risk-based  transaction testing, which OCC staff noted allows examiners to evaluate  the adequacy of the bank’s compliance with regulatory requirements;  determine the effectiveness of its policies, procedures, and processes;  and evaluate suspicious activity monitoring systems. For example,  examiners might determine to select and review a sample of customer  accounts in testing the bank’s compliance with its policies, procedures,  and processes or for possible suspicious activity.

The FFIEC examination manual contains an expanded examination  section for banks with significant relationships with nonbank financial  institutions, which include MSBs. This expanded section references and  incorporates the April 2005 interagency guidance for providing banking  services to MSBs and includes related examination procedures.  Consistent with this guidance, these procedures direct examiners to  assess whether the bank has minimum due diligence policies,  procedures, and processes in place for new or existing MSB accounts.  Examiners are then to determine whether the bank’s policies, procedures,  and processes to assess MSB risks effectively identify higher-risk  accounts and the amount of further due diligence necessary.

To assist in this effort, the manual directs examiners to perform risk- focused transaction testing on a sample of higher-risk MSB accounts. In  discussion groups held with federal bank examiners, examiners from all  discussion groups noted that their review of the transaction activity of  money transmitter accounts is essential to determining whether the bank  understands the money transmitter’s business and has appropriately  assessed the risk. For example, one examiner said that customer due  diligence procedures at account opening should include the appropriate  qualitative and quantitative questions so that the bank can make a  reasonable determination of the types and volumes of transactions that  will be flowing in and out of the account.

Examiners from all discussion groups said that when assessing the  bank’s risk assessment of a money transmitter, they focus on whether the  bank has considered the risk factors discussed in the examination  manual, including geography, customer type, products, services, and  transactional volume. In some discussion groups, examiners noted that  they may review money transmitter accounts if these accounts are  included in the sampling of bank customer accounts as part of the core  examination procedures. One examiner said that because banks in her  region do not tend to specialize in money transmitters or have a  significant degree of risk from them, the only time she reviews money  transmitter accounts is if they are included in her sample for transaction  testing. Examiners from one discussion group said that they may review  money transmitters as part of expanded examination review procedures  for nonbank financial institutions if the bank has a large portfolio of money  transmitter accounts. For example, one examiner said he generally does  not set out to look for and review money transmitter accounts when  conducting a BSA/AML examination, but in one case his examination  team learned that during the course of a merger, a bank acquired a  number of nonbank financial institutions, including MSBs. As this bank did  not have prior experience with these kinds of customers, the examination  team decided to include them in the scope of their review. Examiners in  all discussion groups said that they neither instruct nor recommend that  banks close accounts with money transmitters or other types of MSBs.

Although IRS and state agencies also examine money transmitters and  other MSBs, examiners from all discussion groups said that BSA/AML  requirements and guidance do not allow banks to rely on IRS or state  oversight. These examiners said these reports could provide banks with a  useful additional source of information when conducting their due  diligence on MSB customers. However, these examiners added that the  reports would not substitute for or reduce the due diligence expected of  banks in complying with BSA/AML compliance program requirements..  Examiners from most discussion groups observed that they know very  little about the quality of state or IRS examinations of MSBs and their  frequency.

Examiners Identified BSA/AML Compliance Challenges for Some Banks with MSB Customers, Including Money Transmitters

Examiners in our discussion groups said the challenges that some banks  face in ensuring BSA/AML compliance for their MSB customers include  those related to customer due diligence, risk assessments, customer  identification, and BSA/AML compliance staff and resources.

Customer due diligence. Examiners from most discussion groups  said that some banks do not fully understand the customer due  diligence requirements for banking MSBs. Examiners in some  discussion groups said that banks do not always fully review or  understand the documents and information obtained from their MSB  customers in conducting due diligence. One examiner described an  instance where bank staff could not understand documentation  collected from MSB customers in a foreign language. Examiners in  some discussion groups said banks do not understand the need to  conduct ongoing monitoring of MSB accounts, including of the flow  and volume of customers’ transactions. For example, one examiner in  a different discussion group described an instance of a community  bank that was unaware that an MSB account had $2 billion flowing  through annually even though the bank had only $1 billion in assets.  Examiners in some discussion groups said that banks also may not  fully understand their automated software for monitoring suspicious  activity or how to set the proper software parameters for capturing  potentially suspicious transactions. One examiner in a different  discussion group said that without proper monitoring, a bank would  not know when sudden changes in MSB customers’ transaction types  or volumes would be considered suspicious and should be reported.

Risk assessment. Examiners in many discussion groups said some  banks do not appropriately assess their MSB customers’ risk, either  because they do not consider relevant risk factors or they rate all MSB  customers at the same risk level. One examiner in a discussion group  said he examined a bank with many money transmitter customers that  transmitted funds to several countries and found that the bank did not  assess the risk levels of the countries to which the money transmitters  sent funds. An examiner in a different discussion group said that  banks often assess all MSBs at the same level of risk because they  do not understand the difference between the various risk levels.  Another examiner in the same discussion group added that banks  often do not understand the guidance clarifying that banks should  assess each customer’s risk individually. This statement was  corroborated by our review of several banks’ BSA policies that  stipulated that all money transmitters and other MSBs should be  considered high risk, contrary to the 2005 guidance.

Customer identification. Examiners from many discussion groups  said banks do not always identify their MSB customers—for example,  when a bank acquires another bank without being aware that the  acquired bank has MSB customers. Examiners in some discussion  groups said that failure to properly identify MSB customers stems  partly from inadequate due diligence or risk assessment.

BSA/AML compliance staff and resources. Examiners in many  discussion groups said that some banks do not have sufficient  BSA/AML compliance staff or resources to manage their BSA/AML  compliance programs. For example, an examiner in one discussion  group described a bank with nearly 70 money transmitters and more  than 200 check cashers but only four staff in its BSA/AML compliance  department, which the examiner considered inadequate.

Examiners in many discussion groups said that BSA/AML deficiencies  generally stem from overall weakness in a bank’s BSA/AML compliance  program or internal controls, and not from providing services to money  transmitters or any particular customer type. An examiner from one  discussion group noted that a bank with weak internal controls around  money transmitters likely has weak internal controls across its BSA/AML  compliance program. Examples of deficiencies provided by examiners  across discussion groups include banks failing to follow written policies  and procedures, rating entire categories of customers as high-risk rather  than assessing individual customer risk, not conducting on-site customer  reviews, failing to conduct other due diligence, and not properly  monitoring and reporting suspicious activities. Moreover, our review of  bank examination documents found that BSA/AML-related deficiencies  mostly stemmed from weakness in banks’ BSA/AML compliance  programs and internal controls overall—for example, in customer  identification programs, customer due diligence procedures and practices,  and risk assessments—and not from a bank providing services to MSBs  or any other customer type.

According to examiner discussion groups and examination documents we  reviewed, not all banks with MSB customers experience BSA/AML  compliance challenges. Examiners in some discussion groups noted that  banks that successfully provide accounts to MSBs, including money  transmitters, tend to have a strong BSA/AML compliance program. For  example, examiners in some discussion groups said that such banks  have internal controls commensurate with the BSA/AML risks of the MSB  customers, including conducting appropriate monitoring and due diligence  of customers, and understand the full scope of MSB customers’ activities.

The examiners stated that these banks also have sufficient BSA/AML  compliance staff who received training. Similarly, our review of bank  examination documents included examples of banks with MSB customers  that complied with BSA/AML compliance program requirements, such as  a community bank with 80 money transmitters. In the examination  documents we reviewed, examiners noted that although the bank  engaged in higher-risk business, it was managing the risk appropriately.

Some Examiners Identified Challenges in Assessing Banks’ Due Diligence for Money Transmitters

While views among examiners in our discussion groups varied,  examiners in some discussion groups identified challenges in assessing  banks’ customer due diligence for money transmitters and other MSB  customers. As discussed earlier, the FFIEC examination manual includes  an expanded examination section for nonbank financial institutions that  provides procedures and guidance for examiners when assessing banks’  compliance controls for MSB customers, including money transmitters.  The procedures direct examiners to determine whether the banks’  policies, procedures, and processes to assess risks posed by MSB  customers allow the banks to effectively identify higher-risk accounts and  the amount of further due diligence that is necessary. The expanded  examination guidance provides examples of actions banks can take to  meet the additional due diligence requirement for customers they deem to  be higher risk. Examiners from many discussion groups said they believe  these procedures and guidance are sufficient. One examiner noted that  assessing controls is the same for a bank’s MSB customers as for any  other type of customer.

However, examiners from some discussion groups said it was unclear  how much due diligence is reasonable to expect banks to conduct for  their money transmitters and other MSB customers. An examiner in one  discussion group said it was not clear from the examination procedures  and guidance how much banks were expected to question and request  information from their MSB customers or monitor their MSB customers’  due diligence efforts without expecting banks to act as the de facto  regulator for MSBs. Other examiners noted that although banks are  responsible for understanding the kinds of transactions that flow through  an MSB, to some extent banks do not have visibility into these individual  transactions, as they are aggregated before flowing into the account at  the bank. Similarly, another examiner said there was uncertainty about  how critical an examiner should be of a bank’s due diligence efforts in  cases where a bank’s documentation on an MSB customer’s BSA/AML  compliance program is lacking. One examiner noted that while the  examination guidance provides examples of due diligence actions banks  can consider performing, those actions are not requirements. The  examiner said it was therefore not clear to what extent examiners should  apply these examples as criteria and expect banks to have implemented  them.

Further, examiners in some discussion groups said that it can be difficult  to evaluate banks’ risk assessments, including processes for identifying  higher-risk customers that require additional due diligence. One examiner  said that it is unclear from the examination procedures how to determine  whether banks’ risk assessment processes for identifying higher-risk  customers are adequate. An examiner in a different discussion group said  that in evaluating banks’ risk assessment of new money transmitter  customers, he looks for whether banks ask why new customers switched  banks. However, other examiners in the same discussion group noted  that this is not a standard question.

Our review of the expanded examination section found a lack of  examples of specific steps or processes that examiners can take in  assessing banks’ compliance for additional due diligence. For example,  this section’s procedures contain only a general reference that examiners  should determine whether the banks’ policies, procedures, and processes  effectively allow the banks to identify and conduct risk-based due  diligence for higher-risk customers and lack specific examples to assist  examiners in evaluating additional due diligence activities. The section’s  guidance states that examiners could take actions, including reviewing an  MSB’s BSA/AML compliance program or conducting on-site visits to help  evaluate a bank’s compliance. But neither the guidance nor the  procedures clarify what these reviews or visits might entail. In  comparison, the expanded section’s guidance and procedures include  examples of specific steps that examiners can take when assessing  banks’ compliance with minimum due diligence requirements for MSB  accounts, such as applying the bank’s customer identification program  and confirming FinCEN registration status and state licensing, if  applicable.

Officials from the Federal Reserve and OCC said that the examination  manual is not intended to provide explicit criteria for examiners when they  are assessing the adequacy of a bank’s program. They said that  establishing explicit criteria would result in a “check the box” approach to  BSA/AML compliance, such that banks are given a uniform set of  requirements to follow, irrespective of the money-laundering or terrorism- financing risks associated with their banking activities. They said that if  banks only needed to meet specific requirements, such an approach  would encourage banks to do the minimum to establish a BSA/AML  compliance program and would not effectively detect and deter money  laundering and terrorism financing. As discussed earlier, the examination  manual is instead structured to allow examiners to tailor the BSA/AML  examination scope and procedures to the specific risk profile of the bank.  Staff from the federal banking regulators said that as a result, examiners  are expected to apply their judgment in evaluating banks’ BSA/AML  compliance programs.

However, while regulators want compliance programs to be tailored to the  unique risks a bank’s operations present, examiners need sufficient  guidance to determine whether a given bank’s BSA/AML-related policies,  processes, and procedures are adequate. Regulators and FinCEN issued  the 2005 interagency guidance to clarify BSA/AML requirements and  supervisory expectations for banks when providing banking services to  money transmitters and other MSBs. Since then, examiners have relied  on this guidance when reviewing banks’ MSB customer accounts.  However, the examination procedures and related guidance may not  provide all of the information examiners need to conduct their  assessments, as indicated by the examiners in some of our discussion  groups who reported that it is not clear to them how to determine whether  banks’ due diligence efforts are adequate. Providing clarifying information  would not compromise examiners’ ability to exercise judgement during an  examination. Rather, it would provide them with greater certainty that they  are evaluating banks’ compliance with BSA/AML requirements  appropriately.

Federal internal control standards state that agencies should identify,  analyze, and respond to risks related to achieving the defined  objectives. Unless federal banking regulators take steps to improve  examiners’ ability to evaluate banks’ compliance controls with respect to  money transmitter accounts, examiners may not be fully achieving the  BSA/AML examination objectives of identifying and assessing risks and  banks’ ability to manage risks, as set out in the examination manual in  assessing banks’ compliance with BSA/AML requirements. Internal  control standards also state that agencies should internally communicate  the necessary quality information to achieve their objectives. With respect  to examiners, such communication could include providing updates to  examination procedures, examiner training, or a combination of methods.

Terminating or Limiting Bank Accounts with Money Transmitters May Raise Derisking Concerns and Can Affect Their Operations

Survey Results Suggest That a Number of Banks Terminated or Limited Money Transmitters’ Accounts in 2014–2016

We estimate that 32 percent of banks nationwide provided accounts to  money transmitters from 2014 through 2016, based on the results of a  survey we conducted jointly with other GAO work on derisking. For  calendar year 2016, of the 91 banks that reported having money  transmitters as customers, 71 banks of varying asset sizes reported  having 41,089 money transmitter accounts (see table 1).

Overall, of the 91 banks that reported having money transmitters as  customers, close to half of them (40 banks) terminated at least one of  their money transmitter accounts and almost one-third of them (29 banks)  limited the number of accounts with money transmitters, both for reasons  related to BSA/AML risk, from 2014 through 2016 (see table 2).

Because extra-large banks reported having a much greater number of  accounts with money transmitters, these banks also reported a greater  proportion of account terminations, compared with small and medium  banks. Specifically, 18 banks of all sizes that responded to the survey  reported that they terminated 1,098 accounts in 2016—with 89 percent of  these account closures (976 out of 1,098) reported by six extra-large  banks. In particular, one extra-large bank accounted for more than half  (601 out of 1,098) of the account terminations in that year. See table 3 for  more information on account terminations in 2016. See appendix II for  more information on account terminations and limitations.

Although Some Account Terminations and Limitations Are Associated with Managing BSA/AML Risk, Some Raise Derisking Concerns

Some terminations and limitations of money transmitters’ bank accounts  appear to be associated with managing BSA/AML risk. However, some  terminations and limitations raise derisking concerns.

Some Reasons for Terminating or Limiting Accounts Are Associated with Managing BSA/AML Risk

Some reasons that banks reported for terminating accounts were  associated with managing BSA/AML-related risk, including the filing of  SARs associated with the account and customers failing to provide  information necessary for the bank to conduct adequate BSA/AML due  diligence. Some banks also reported terminating accounts to reduce the  risk that a customer’s activity could harm a bank’s reputation, known as  reputational risk (see table 4). These survey results are consistent with  the results of our prior work on banks in the Southwest border region.

The most commonly cited reason in our survey for terminating accounts  was the filing of SARs. Officials we interviewed from one bank told us that  they investigate customers that have triggered multiple SAR filings and  considered setting up controls to limit account activities. Officials of  another bank told us that a federal bank examiner suggested that the  bank consider closing an account with a money transmitter customer  because of SAR filings associated with it.

The second most commonly cited reason for terminating accounts was  that a customer failed to provide information requested by a bank for  conducting BSA/AML due diligence. Officials we interviewed from two  banks told us that customers may not be able to provide information and  documentation or may not disclose that they are an MSB when opening  new accounts. Officials of a bank that maintained accounts with money  transmitters told us they terminated accounts in instances where a money  transmitter did not submit required documentation.

Another commonly cited reason for terminating accounts was reputational  risk—the potential that negative publicity regarding an institution’s  business practices, whether true or not, will cause a decline in the  customer base, costly litigation, or revenue reductions. One bank’s  officials said in an interview that when examiners inquired as to whether  bank officials factor reputational risk into their decision-making about  money transmitters, they viewed such inquiries as implicit suggestions  that the bank had an issue with reputational risk that needed to be  addressed.

Examiners in our discussion groups also shared similar comments on  suspicious activity monitoring and banks’ requests for information.  Specific to suspicious activities, one examiner noted that banks generally  have an internal policy stating that if a specific number of SARs are filed  on the customer, the bank will automatically terminate the account.  Regarding banks’ information requests, examiners in some discussion  groups said they observed that banks may terminate an MSB’s account if  the MSB does not comply with the bank’s request for due-diligence- related documentation.

Three of the most common reasons banks reported for limiting accounts  with money transmitters were that (1) the cost of BSA/AML compliance  made the customer type unprofitable, (2) the banks were unable to  manage the BSA/AML risk associated with the customer type, and (3) the  customer type fell outside of a bank’s risk tolerance (see table 5).

One of the most commonly cited reasons for limiting the number of  accounts with money transmitters was compliance costs associated with  managing BSA/AML risk. Officials of about two-thirds of the banks we  interviewed said their BSA/AML compliance costs had increased over  time, with eight institutions specifically citing past or planned upgrades to  their monitoring software systems as one source of increasing costs.  Moreover, officials of one bank said their compliance costs had increased  in recent years as a result of regulatory scrutiny, which they said had  increased as MSBs came to comprise a larger portion of their customer  base. In response to this heightened scrutiny, officials said the bank had  installed a new transaction-monitoring platform, which incurred a one-time  migration cost and would incur higher monthly fees, and was considering  expanding its compliance department.

Officials of three banks told us in interviews that 50 percent of their  compliance costs stem from BSA/AML compliance. As we have reported  previously, money transmitters are generally low-profit customers for  banks, in that the revenue from their accounts may not be sufficient for  some banks to offset the associated costs of BSA/AML compliance. For  example, officials of one bank said the bank spent about $250,000  annually to maintain its BSA-related monitoring software and training,  which they believed was a significant portion of the bank’s $25 million  annual income. These officials told us that unlike the bank’s other  customers, which use the bank’s other products and refer business,  money transmitters are not the bank’s core customers and do not use  other products or services, so the bank would rather focus its time and  resources on its core customers. Similarly, officials of another bank said  they decided not to bank MSBs because any revenue generated would  not cover the additional resource and compliance costs.

Banks’ inability to manage BSA/AML risks associated with money  transmitter customers was another commonly cited reason for limiting the  number of accounts. For example, officials of one bank we interviewed  said they did not accept any MSB customers, including money  transmitters, because they were not willing or able to take on the required  risk and level of BSA/AML monitoring. Another commonly cited reason for  limiting accounts was that a customer type fell outside of a bank’s risk  tolerance. In interviews, banks expressed concerns about their MSB  customers’ ability to maintain an adequate BSA/AML compliance  program. One bank’s officials told us that owners of gas stations may  offer check cashing or money transmission services to generate  additional revenue, but they may not be aware that offering such services  would subject their business to BSA/AML compliance requirements.  Another bank’s officials also said that many business owners do not know  that they have to register with FinCEN to operate as an MSB. Officials  from a third bank said that some MSBs may not understand the BSA/AML  regulations and, at their customers’ request, may inadvertently commit a  violation such as structuring that may generate a SAR (for example, by  breaking up a money transfer in excess of $10,000 into multiple transfers  to avoid generating a Currency Transaction Report).

Similarly, examiners in many discussion groups said that the staffing and  resource costs required for adequate monitoring and due diligence on  MSB customers, including money transmitters, are reasons why some  banks may choose not to bank MSBs. Moreover, examiners in many  discussion groups also said some banks offer MSBs accounts and then  find out that they do not have the necessary BSA/AML expertise or that  the business is not profitable for them. For example, one examiner said  that when a larger bank in his area terminated all of its money transmitter  accounts, a number of smaller banks looking for profit offered accounts to  these money transmitters. However, the examiner added that the smaller  banks did not understand the level of customer due diligence and  monitoring that was required for these accounts and the associated costs,  and they terminated the accounts. In contrast, examiners in some  discussion groups said that some community banks have accepted  money transmitter customers as a way to generate potentially substantial  fee income.

Some Account Terminations and Limitations Raise Derisking Concerns

According to survey responses from banks, the most commonly cited  reason for limiting the number of money transmitter accounts was that the  customer type drew heightened BSA/AML regulatory oversight—behavior  that would indicate derisking. Banks also commonly cited this reason for  terminating money transmitter accounts.

For example, officials from one bank told us that the bank no longer  offered services to MSBs because it wanted to be viewed favorably by  regulators. Officials of another bank said that money transmitter account closures were generally the result of onerous regulatory requirements and  increased regulatory scrutiny. Officials from two banks we spoke with said  that they received greater regulatory scrutiny after increasing their  number of MSB customers, which affected their willingness to open  additional accounts with MSBs. According to officials of one of the two  banks, when the bank increased its MSB customers from one to two, the  institution was assessed as high risk by examiners.

Related to heightened regulatory oversight, some banks’ officials we  interviewed also expressed concerns that some examiners’ expectations  go beyond what is described in the examination manual. For example,  they said examiners expected banks to know their customers’  customers—although BSA/AML regulations do not require banks to  obtain information on their customers’ customers. Bank officials said  ascertaining such information was difficult because money transmitters’  customers are one step removed from the bank. Some banks’ officials  also told us that they felt obligated to follow examiners’ verbal  suggestions, even when the suggestions did not appear in the final  examination report as recommendations. Other banks’ officials we  interviewed stated that although examiners did not explicitly recommend  that banks exit certain lines of business, officials felt pressure from the  examiners to do so. For example, officials from one bank said examiners  suggested that if the bank exited certain lines of business, the bank would  not have deficiencies in its BSA/AML compliance program.

We reported similar concerns in our March 2018 report. About half of the  banks we interviewed for that report said that the fear of regulatory  scrutiny served as a disincentive for banks to maintain accounts with  money transmitters. Some banks’ officials expressed uncertainty about  the amount of due diligence required for regulatory purposes because  regulations included ambiguous language or because examiner practices  exceeded regulations. These bank officials suggested that regulators  could provide more specific guidance for banks on risk management,  such as by including example scenarios and answers to frequently asked  questions.

Conversely, some banks we interviewed had a different experience. For  example, officials of one bank told us that examiners’ interpretation of  BSA/AML principles did not differ from the bank’s understanding of those  principles. Officials added that when they initially began preparing risk  assessments, they sought feedback and advice from their examiners and  that examiners now use the bank’s risk assessment as an example for  other banks. Moreover, these officials said that if they need clarification  on BSA/AML compliance requirements, they contact FinCEN, which has  been responsive to their questions. Officials of another bank told us they  have a good relationship with their federal regulator and said that  examiners follow BSA guidance and have been consistent in conducting  their examinations. Officials of two other banks told us that their BSA/AML  examinations have been consistent with guidance and requirements and  that examiners have not told officials what types of customers to avoid.

We also reported in February 2018 that recent BSA/AML law enforcement  and regulatory enforcement actions have caused some banks to become  more conservative in the types of businesses to which they offer  accounts. In our interviews for the February 2018 report, officials of  three banks and an industry group expressed concerns about potential  enforcement actions, including civil penalties, if banks’ employees make  mistakes in BSA/AML monitoring. In 2012, federal regulators assessed  civil money penalties—including a $500 million penalty assessed by OCC  and a $165 million penalty by the Federal Reserve—against HSBC Bank  for, among other things, failing to maintain an effective BSA/AML  compliance program and failing to conduct appropriate due diligence on  foreign correspondent bank account holders. As another example, in  March 2018, OCC issued consent orders for civil penalties against three  senior executives of the Merchants Bank of California for violations of  consent orders related to monitoring BSA/AML compliance. In our  interviews, officials of an industry association told us that fines associated  with BSA violations are especially difficult for community banks to absorb  and could result in the bank going out of business.

Similarly, examiners from a discussion group said some banks may  decide not to offer accounts to MSBs to avoid heightened regulatory  scrutiny. For example, examiners said some banks likely want to avoid  BSA/AML risk entirely when they decide not to offer MSBs accounts. One  examiner thought that some banks lack understanding regarding the  business models of MSBs and that it is easier for them not to provide  them accounts. In some cases, banks offer MSBs bank accounts but on a  limited basis. For example, examiners from one discussion group said  that in some cases, banks manage their BSA/AML risks by maintaining  existing MSB accounts but not offering accounts to new MSB customers.

In a 2015 speech, a senior Treasury official noted banks’ concerns about  the cost of complying with BSA/AML requirements, uncertainty about  supervisors’ expectations regarding appropriate due diligence, and the  nature of the enforcement and supervisory response if they make a  mistake. Moreover, the official stated that the banks held the perception  that supervisory and enforcement expectations lack transparency,  predictability, and consistency. The official also said that this perception  feeds into higher anticipated compliance costs and may eclipse any  potential economic gains of taking on new MSB customers. To address  these concerns, the senior official stated that policymakers needed to  continue to improve their understanding of the scope, nature, and drivers  of the problem through better data collection and continue to explore  ways to improve the effectiveness of their communication.

Effects of Account Terminations and Limitations on Money Transmitters Include Ceasing of Operations and Higher Costs for Services

According to money transmitters we spoke with, effects of account  terminations due to derisking include ceasing of operations, loss of  revenue, higher costs for services provided, and failure of the business.  For example, officials from one large money transmitter that operates in  the United States and internationally said that in recent years, about 100  of the money transmitter’s agents have lost accounts with their local and  regional banks each month. The officials added that when banks  terminate accounts with the money transmitter or its agents, the money  transmitter cannot conduct the necessary transactions with its agents to  facilitate the cash transfer. As a result, officials told us, account  terminations can cause the money transmitter to cease operations in a  particular country or cause the agents to go out of business. These  officials also told us that some banks have terminated accounts with their  institution while maintaining accounts with other money transmitters.  These officials said they obtained legal injunctions for unfair competitor  treatment in some of these cases.

Officials of a smaller, regional money transmitter said that they have  experienced 10 account terminations since 2006. Moreover, the officials  said that they have to switch banks every 2 to 3 years because of account  terminations and that it is getting more difficult to find a bank willing to  take on money transmitters as customers. For example, the officials said  that they called about 300 banks in a state and only two banks were willing to open accounts with them. The money transmitter’s officials said  it has had to cease operations in three states due to account  terminations. The officials said that the money transmitter now focuses on  opening accounts with community banks and credit unions, but these  institutions may be too small to handle the money transmitter’s volume of  deposits. Another money transmitter told us that it takes about 3 months  to open an account with a bank. Moreover, as a result of account  terminations and limitations by banks, the money transmitter has had to  reduce its number of employees from 220 to 180 and has not been able  to open new locations. Another money transmitter said that account  terminations have affected its ability to obtain accounts with other banks.

In our March 2018 report, we found that some money transmitters—those  that may be considered higher risk based on the 2005 interagency  guidance—may utilize nonbank channels for transferring money as a  response to account terminations. Specifically, we reported that as a  result of banks’ account terminations and limitations, some money  transmitters serving fragile nations have relied on nonbank channels,  such as cash couriers and armored trucks, to transfer money domestically  and abroad. We further reported that using cash couriers or armored  trucks to move money increases costs and risks of theft and safety.

Account terminations and limitations by banks also affect money  transmitters that do not serve customers abroad—money transmitters that  could be considered lower risk based on the 2005 interagency BSA  guidance. For example, a company that acquired another business  offering money transmission services to customers within the United  States also experienced account terminations. When the company  acquired the new business and thus the business’s money transmission  license, its bank refused to service the company because of its newly  acquired status as a money transmitter. In another example, officials of a  money transmitter that serves only U.S. customers told us they have  difficulty opening accounts and have experienced account terminations  often. Officials said that their business has stopped at times because they  did not have any bank accounts to facilitate money transmission.

Additionally, account closures also may affect money transmitters’  customers. For example, some money transmitters we interviewed said  they passed on increased costs resulting from account closures to their  customers. Specifically, officials of one large money transmitter said that  because of derisking, banks that still do business with them are charging  higher fees. The officials added that they try to absorb the higher fees but  have passed on the increased costs to their customers in some markets.  In contrast, some money transmitters told us in interviews that although  their costs have increased, they have not increased customer fees.

Several money transmitters told us that banks did not always provide  reasons for terminating their accounts. Some said they believe that banks  terminate accounts due to regulatory pressure, compliance costs, or  changes in a bank’s policy or risk appetite. One money transmitter stated  that the problem of account terminations due to derisking stems from  banks being too afraid to bank MSBs, including money transmitters.

In response to banks’ account terminations and limitations, some money  transmitters—including those with characteristics considered to be higher  and lower risk according to the 2005 interagency guidance—now  maintain accounts with multiple banks to help ensure they can continue  operating should a bank close their account. For example, officials of the  company that acquired another business offering domestic money  transmission services told us they maintain accounts with more than one  bank, but they said it is difficult and costly to do so. Officials of another  money transmitter said that to help prevent disruptions to their ability to  transfer funds when they experience an account closure, they try to have  back-up accounts at other banks.

Some money transmitters also engage with their banks’ management to  better understand what banks expect from them in meeting compliance  requirements. For example, an official from one money transmitter said  the money transmitter tries to meet with its banks’ financial crimes teams  to better understand how it can help minimize the risk of facilitating  money transfers for terrorist-financing and money-laundering purposes.  Officials of another money transmitter told us that as a result of meeting  with bank management, the money transmitter added additional  employees to its compliance department and bought new monitoring  software to fulfill its bank’s requirement for monthly monitoring of  transactions.

FinCEN and the Federal Regulators Have Taken Some Steps to Address Derisking Concerns but Have Not Fully Addressed Our Prior Recommendation

FinCEN and the Federal Regulators Have Issued Guidance to Banks Related to the Derisking of Money Transmitters

FinCEN and the federal banking regulators have responded to concerns  about the derisking of money transmitters and other MSBs on a national  level by issuing guidance to banks to clarify expectations for providing  banking services to these customer types. In March 2005, the federal  banking regulators and FinCEN issued a joint statement noting that MSBs  were losing access to banking services as a result of concerns about  regulatory scrutiny, the risks presented by MSB accounts, and the costs  and burdens associated with maintaining such accounts. According to  the joint statement, these concerns might have stemmed, in part, from  banks’ misperception of the requirements of the BSA and the erroneous  view that MSBs present a uniform and unacceptably high risk of money  laundering or other illicit activity. The joint statement recognized that the  MSB industry provides valuable financial services, especially to  individuals who may not have ready access to the formal banking sector.  It further noted that it is important that MSBs comply with the  requirements of the BSA and applicable state laws and remain within the  formal financial sector and be subject to appropriate AML controls. The  joint statement announced the intent of the regulators and FinCEN to  issue the interagency guidance for banks on providing services to MSBs,  which, as previously discussed, was intended to clarify BSA requirements  and supervisory expectations as applied to accounts opened or  maintained for MSBs.

More recently, in November 2014, FinCEN issued a statement reiterating  that banks can serve the MSB industry while meeting their BSA  obligations and referring to the interagency guidance to banks on  providing services to MSBs. The statement noted concerns that banks  were indiscriminately terminating the accounts of all MSBs, or refusing to  open accounts for any MSBs, thereby eliminating them as a category of  customers. It noted, similar to the March 2005 joint statement, that  regulatory scrutiny, the perceived risks presented by MSB accounts, and  the costs and burdens associated with maintaining such accounts  appeared to play a part in these decisions.

In the 2014 statement, FinCEN cautioned that a wholesale approach to  MSB customers runs counter to the expectation that financial institutions  can and should assess the risks of customers on a case-by-case basis.  Similarly, it noted that a blanket direction by U.S. banks to their foreign  correspondents not to process fund transfers of any foreign MSBs, simply  because they are MSBs, runs counter to the risk-based approach.  FinCEN stated that refusing financial services to an entire segment of the  industry can lead to an overall reduction in financial sector transparency,  and that such transparency is critical to making the sector resistant to the  efforts of illicit actors. Federal banking regulators also issued separate  statements addressing BSA/AML risk posed by MSBs and foreign banks.  See table 6 for a summary of key statements and guidance related to  MSBs issued in recent years by FinCEN and the federal banking  regulators.

Regulators Have Taken Some Steps to Address Concerns That May Be Influencing Banks to Derisk but Have Not Reviewed the Full Range of Factors

In 2018, we reported that regulators had taken only limited steps to  understand how banks’ regulatory concerns and BSA/AML compliance  efforts may be influencing banks to derisk. We reported that regulators  had taken some actions in response to derisking, including issuing the  guidance previously discussed, and that some agencies took steps aimed  at trying to determine why banks may be terminating accounts. We also  reported that regulators had conducted retrospective reviews on some  BSA/AML requirements. We noted that actions regulators had taken to  address concerns raised in BSA/AML retrospective reviews had focused  primarily on the burden resulting from the filing of Currency Transaction  Reports and SARs. However, we noted that these actions had not been  aimed at addressing—and, if possible, ameliorating—the full range of  factors that influence banks to engage in derisking, particularly how  banks’ regulatory concerns and BSA/AML compliance efforts may be  influencing their willingness to provide services.

We concluded that without a broader assessment of the full range of  BSA/AML factors that may be influencing banks to derisk, FinCEN, the  federal banking regulators, and Congress do not have the information  needed to determine if BSA/AML regulations and their implementation are  achieving their regulatory objectives in the most effective and least  burdensome way. Therefore, we recommended that FinCEN and the  federal banking regulators conduct a retrospective review of BSA  regulations and their implementation for banks, with a focus on how  banks’ regulatory concerns may be influencing their willingness to provide  services.

According to the federal banking regulators and FinCEN, they and  Treasury established an interagency working group in early 2018 that  they believe will address our recommendation. The interagency working  group is intended to identify ways to improve the efficiency and  effectiveness of BSA/AML regulations, supervision, and examinations  while continuing to meet the requirements of the BSA and its  implementing regulations, supporting law enforcement, and reducing  BSA/AML compliance burden. Staff from FinCEN and the federal banking  regulators identified several interagency statements that the working  group has completed.

Interagency Statement on Sharing BSA Resources (issued on  October 3, 2018): This statement clarified how banks may reduce the  costs of meeting BSA requirements effectively by sharing employees  or other resources in a collaborative arrangement with one or more  banks. The statement highlighted potential benefits to sharing  resources and provided examples of resources that may be  appropriate to share, such as certain internal controls, independent  testing, and BSA/AML training functions. The statement also  highlighted potential risks of sharing resources and cautioned that any  collaborative arrangements should be designed and implemented  according to each bank’s risk profile.

Joint Statement on Innovative Efforts to Combat Money  Laundering and Terrorist Financing (issued on December 3,  2018): This statement clarified the working group’s position with  respect to innovative approaches in BSA/AML compliance and  encouraged banks to consider such approaches. For example,  some banks are experimenting with artificial intelligence and digital  identity technologies applicable to their BSA/AML compliance  programs. The statement notes that these innovations and  technologies can strengthen BSA/AML compliance approaches and  that the regulators welcome these types of innovative approaches to  further efforts to protect the financial system against illicit financial  activity. According to the statement, pilot programs undertaken by  banks to test and validate the effectiveness of innovative approaches  should not subject banks to supervisory criticism even if the pilot  programs ultimately prove unsuccessful.

Joint Statement on Risk-Focused Bank Secrecy Act/Anti-Money  Laundering Supervision (issued on July 22, 2019): This statement  was intended to improve the transparency of the risk-focused  approach used for planning and performing BSA/AML examinations.  In this statement, FinCEN and the banking regulators emphasized  that they scope their examinations in response to the unique risk  profile for each bank because banks vary in focus and complexity.  The regulators also clarified common practices for assessing a bank’s  risk profile, including leveraging available information such as the  bank’s own risk assessment, contacting the banks between  examinations, and considering the bank’s ability to identify, measure,  monitor, and control risks.

Federal banking regulators and FinCEN staff said the working group’s  focus on regulatory reform and on reducing the burden associated with  BSA/AML compliance may indirectly address derisking concerns,  including those related to money transmitters. In particular, they said  these efforts may help agencies as they clarify their supervisory  expectations for banks with respect to managing BSA/AML risk. For  example, the staff said that the joint statement on the risk-focused  approach to supervision clarifies that the role of the examiner is not to  determine what level of risk a bank should assume. Instead, the  examiners should review risk management practices to evaluate whether  a bank has effective processes to identify, measure, monitor, and control  risks and to assess the effectiveness of a bank’s processes. They said  that reminding examiners and institutions of the risk-focused approach  will help dispel the perception that banks will be criticized for taking certain higher-risk customers when the bank is properly managing that  risk. Similarly, they said that the joint statement on innovation could help  address derisking concerns because it allows banks to leverage new  technologies and innovative approaches to help reduce costs of  implementing the strong risk management practices that may be  necessary to provide banking services to some higher-risk customers.

The actions taken to date by the interagency working group are important  steps toward improving the efficiency and effectiveness of BSA/AML  regulations and supervision. As previously discussed, one reason some  banks reported terminating or limiting money transmitter accounts was  because of the cost associated with BSA/AML compliance. The  interagency statements on sharing BSA resources and innovative efforts  to combat money laundering and terrorist financing could help reduce  banks’ implementation costs associated with providing banking services  to potentially higher-risk customers.

However, consistent with our prior work, our evidence demonstrates that  banks terminate or limit customer accounts not only as a way to address  legitimate money-laundering and terrorist-financing threats, but also as a  way to manage regulatory concerns, which may indicate derisking.  Reminding examiners and banks of the risk-focused examination  approach may help to dispel the perception that banks will be criticized for  taking certain higher-risk customers when the bank is properly managing  that risk and may indirectly address some factors that influence banks to  derisk. Nevertheless, the working group has not yet considered whether  there are other supervisory concerns that factor into banks’ decisions to  derisk. As we stated in our prior work, it is important to evaluate and  address the full range of factors that may be influencing banks to derisk.  Therefore, we maintain that FinCEN and the banking regulators should  continue to work toward implementing our prior recommendation to  conduct a retrospective review of BSA/AML regulations focusing on how  banks’ regulatory concerns may be influencing their willingness to provide  services.

Regulators and FinCEN issued the 2005 interagency guidance to clarify  BSA/AML requirements and supervisory expectations with regard to  accounts banks open or maintain for money transmitters and other MSBs.  However, some examiners in our discussion groups said they were  unclear about how much due diligence is reasonable to expect banks to  conduct for their money transmitters. Improving examiners’ ability to  evaluate banks’ BSA/AML compliance controls with respect to money  transmitter accounts would help ensure that such evaluations are done in  accordance with BSA/AML examination objectives of identifying and  assessing risks and banks’ ability to manage risks, as set out in the  examination manual. Options for making such improvements could  include providing examiners with more detailed examination procedures,  enhanced information, additional training, or a combination of methods.

We are making a total of four recommendations to the Federal Reserve,  OCC, FDIC, and NCUA:  The Board of Governors of the Federal Reserve System should, in  coordination with the other federal banking regulators, and with input from  BSA/AML examiners and other relevant stakeholders, take steps to  improve examiners’ ability to evaluate the effectiveness of banks’  BSA/AML compliance controls with respect to money transmitter  accounts. Steps may include providing updates to examination  procedures, examiner training, or a combination of methods.  (Recommendation 1)

The Comptroller of the Currency should, in coordination with the other  federal banking regulators, and with input from BSA/AML examiners and  other relevant stakeholders, take steps to improve examiners’ ability to  evaluate the effectiveness of banks’ BSA/AML compliance controls with  respect to money transmitter accounts. Steps may include providing  updates to examination procedures, examiner training, or a combination  of methods. (Recommendation 2)

The Chairman of the Federal Deposit Insurance Corporation should, in  coordination with the other federal banking regulators, and with input from  BSA/AML examiners and other relevant stakeholders, take steps to  improve examiners’ ability to evaluate the effectiveness of banks’  BSA/AML compliance controls with respect to money transmitter  accounts. Steps may include providing updates to examination  procedures, examiner training, or a combination of methods.  (Recommendation 3)

The Chairman of the National Credit Union Administration should, in  coordination with the other federal banking regulators, and with input from  BSA/AML examiners and other relevant stakeholders, take steps to  improve examiners’ ability to evaluate the effectiveness of banks’  BSA/AML compliance controls with respect to money transmitter  accounts. Steps may include providing updates to examination  procedures, examiner training, or a combination of methods.  (Recommendation 4)

We provided a draft of this report to the Federal Reserve, FDIC, NCUA,  OCC, and Treasury’s FinCEN for review and comment. The federal  regulators provided technical comments on the draft report, which we  have incorporated as appropriate. The Federal Reserve, FDIC, NCUA,  and OCC also provided written comments (reproduced in appendixes III  through VI). They agreed with GAO’s recommendations and expressed a  commitment to implement them.

We are sending copies of this report to the appropriate congressional  committees, the Director of the Financial Crimes Enforcement Network,  the Chairman of the Board of Governors of the Federal Reserve System,  the Chairman of the Federal Deposit Insurance Corporation, the  Comptroller of the Currency, and the Chairman of the National Credit  Union Administration. The report will also be available at no charge on  our website at http://www.gao.gov.

If you or your staffs have any questions about this report, please contact  me at (202) 512-8678 or clementsm@gao.gov. Contact points for our  Offices of Congressional Relations and Public Affairs are listed on the last  page of this report. GAO staff who made major contributions to this report  are listed in appendix VII.

Appendix I: Objectives, Scope, and Methodology

This report (1) describes regulators’ Bank Secrecy Act (BSA)/anti-money  laundering (AML) supervisory expectations for banks that provide  services to money transmitters and other money services businesses  (MSB) and examiner views on bank challenges in complying with these  requirements; (2) examines challenges reported by examiners in  conducting BSA/AML assessments; (3) examines the extent to which  banks are terminating or limiting money transmitters’ access to banking  services and the effects on money transmitters; and (4) evaluates how  the Department of the Treasury’s Financial Crimes Enforcement Network  (FinCEN) and the federal banking regulators have assessed and  responded to concerns about the derisking of money transmitters. The  federal banking regulators included in our review are the Board of  Governors of the Federal Reserve System (Federal Reserve), the Federal  Deposit Insurance Corporation (FDIC), the Office of the Comptroller of the  Currency (OCC), and the National Credit Union Administration (NCUA).

We define “derisking” as the practice of banks limiting certain services or  ending their relationships with customers to, among other things, avoid  perceived regulatory concerns about facilitating money laundering. We  developed this definition in our prior work addressing account  terminations and branch closures in the U.S. Southwest border region.

To describe regulators’ BSA/AML supervisory expectations for banks that  provide services to money transmitters and other MSBs and federal bank  examiners’ views on banks’ challenges in complying with these  requirements, we reviewed joint guidance issued by FinCEN and the  federal banking regulators in April 2005 on banking MSBs and the  Federal Financial Institutions Examination Council’s (FFIEC) BSA/AML  examination manual, which federal banking regulators use to examine  banks for BSA/AML compliance.

We also interviewed the federal regulators named above. Further, we  interviewed representatives of 16 banks, six credit unions, and relevant  industry groups and trade associations. Because of our judgmental  sampling, the views expressed by these groups may not be  representative. To identify the universe of banks for interviews, we used  data from FDIC’s Statistics on Depository Institutions database as of  December 31, 2016. Next, we excluded banks that did not offer the  product types relevant to our study, including credit card banks and banks  that offer nontraditional accounts; multiple subsidiaries of large holding  companies; and federal branches of foreign banks. We also excluded  banks with insufficient information to determine the types of accounts  offered. In addition, we excluded banks selected to participate in a web- based survey (we describe our survey methodology below). After these  exclusions, our initial list consisted of 5,922 banks.

Because the primary regulators (Federal Reserve, OCC, and FDIC) do  not track which banks have money transmitter customers, we used a  judgmental sample to randomly select banks to interview from each of the  primary regulators based on asset size (small, medium, and large). For  small and medium banks, we interviewed one bank of each size from  each of the three regulators. For large banks, all were regulated by OCC,  and we interviewed two of these banks. We defined banks’ asset-size  categories as follows: (1) “small” consisted of banks with assets of less  than $1 billion, (2) “medium” consisted of banks with assets of $1 billion to  less than $10 billion, and (3) “large” consisted of banks with assets of $10  billion to less than $50 billion.

Once we selected our sample, we contacted each bank to confirm that it  had money transmitter or other types of MSB customers. If a bank did not  have money transmitter or other MSB customers or declined to speak  with us, we selected another bank in the same asset-size category. We  initially selected nine banks to interview—three in each asset-size  category—but one large bank declined to speak with us. Because there  were no other large banks in our sample, we interviewed two large banks,  for a total of eight small, medium, or large banks. We also jointly  interviewed eight extra-large banks (with assets of $50 billion or more) in  coordination with our other work on derisking.

Because NCUA tracks which credit unions have money transmitter  customers, we obtained data from NCUA on credit unions that served  money transmitters as of April 2017 and stratified them according to  small, medium, and large asset-size categories. We defined credit unions’  asset-size categories as follows: (1) “small” consisted of credit unions  with assets of less than $100 million, (2) “medium” consisted of credit  unions with assets of $100 million to $500 million, and (3) “large”  consisted of credit unions with assets of more than $500 million. We  chose three credit unions with the largest numbers of money transmitter  customers and randomly selected one credit union from each asset-size  category, for a total of six credit unions. From our initial selection, we  emailed or called each of the six credit unions to ascertain if it had a  money transmitter customer. If a credit union did not have a money  transmitter customer or declined to speak with us, we selected another  credit union in the same asset-size category.

We then conducted two discussion groups per regulator with bank  examiners from the Federal Reserve, OCC, FDIC, and NCUA to  understand how they applied the FFIEC manual in assessing BSA/AML  compliance controls of banks with money transmitter customers. To  determine the composition of the discussion groups, we identified  BSA/AML specialists or subject-matter experts from the district and  regional offices of each federal banking regulator located in geographic  areas with relatively large numbers of money transmitters. To do this, we  first identified the states with the largest numbers of registered money  transmitters by analyzing FinCEN money transmitter registration data  from January 2015 through May 2017. We then requested rosters of staff  designated as BSA/AML subject-matter experts and specialists from each  regulator for each district or regional office in those states.

We administered a questionnaire to the individuals on each roster asking  about their experience with examining banks with money transmitter  customers and other questions, such as years of experience in  conducting bank examinations. We excluded from consideration  BSA/AML subject-matter experts and specialists who either self-identified  as supervisors or who had not examined a bank with a money transmitter  customer in the past 3 years. We then randomized and selected  BSA/AML subject-matter experts and specialists for participation in our  discussion groups. Depending on scheduling and availability, the number  of participants for each discussion group ranged from six to 14. Each  session was digitally recorded and transcribed by an outside vendor, and  we used the transcripts to summarize participants’ responses. An initial  coder assigned a code that best summarized the statements from  discussion group participants and provided an explanation of the types of  statements that should be assigned to a particular code. A separate  individual reviewed and verified the accuracy of the initial coding. The  initial coder and reviewer discussed orally and in writing any  disagreements about code assignments and documented consensus on  the final analysis results.

Discussion groups were intended to generate in-depth information about  the reasons for the participants’ views on specific topics. The opinions  expressed by the participants represent their points of view and may not  represent the views of all BSA/AML subject-matter experts and specialists  at the federal banking regulators. For purposes of this report, we used the  following terms to describe the number of discussion groups in which an  issue is mentioned: “some” to describe two to three groups out of the  eight discussion groups, “many” to describe four to five discussion  groups, and “most” to describe six to seven discussion groups.

To examine challenges reported by federal bank examiners in assessing  banks’ BSA/AML compliance controls around money transmitters, we  asked examiners in our discussion groups to identify any challenges they  encountered when assessing these compliance controls. We also reviewed examination guidance and procedures for assessing BSA/AML  compliance controls around money transmitters. We assessed this  information against federal internal control standards related to identifying  risks and communicating information.

We also reviewed bank examination and related documentation from the  federal BSA/AML examinations of 56 selected banks and credit unions to  gain additional context about BSA/AML examinations, including BSA/AML  compliance violations—10 from FDIC, 12 from the Federal Reserve, 22  from OCC, and 12 from NCUA. For the documentation review, we  selected a nongeneralizable sample of banks and credit unions based on  asset-size categories and geographic location (based on each regulator’s  field, district, or regional offices) from each federal banking regulator. For  banks, we used the same asset-size categories described earlier for our  interview selection process. We also included six banks that were issued  final BSA/AML enforcement actions—two each from OCC, FDIC, and the  Federal Reserve—for calendar years 2014 through 2016. For credit  unions, we selected randomly from the same asset-size categories we  used for selecting credit unions for interviews—along with geographic  locations—and randomly selected four credit unions from each asset-size  category, for a total of 12 credit unions. To obtain geographic  representation, we ensured that each bank and credit union selected  within each asset-size category also represented multiple geographic  locations.

For each of the 56 banks and credit unions, we requested and reviewed  bank examination reports and related workpaper documentation for 2014,  2015, and 2016, including scoping and planning memorandums, bank- or  examiner-prepared BSA/AML risk assessments, and conclusion  memorandums or documents that summarized BSA examiner findings.  For some banks, we also received banks’ BSA policies as part of the  examination report and supplemental documentation package.

To examine the extent to which banks are terminating or limiting money  transmitters’ access to banking services and their reasons why, we administered a web-based survey to a nationally representative sample of  banks in the United States for a total survey sample of 406 banks. We did  not include credit unions in our sample. In the survey, we asked banks  about terminations of money transmitter accounts and limitations on  account offerings related to BSA/AML risk and the reasons for these  decisions for the 3-year period from January 1, 2014, to December 31,  2016. We obtained a weighted survey response rate of 46.5 percent.  While we designed the survey to be nationally representative of all banks  in the United States, some results are statistically nongeneralizable  because of the relatively low number of banks that reported having  money transmitters as customers. For survey questions that are  statistically nongeneralizable, we present only the number of responses  to each survey question, and these results are not generalizable to the  population of banks. Moreover, not all banks responded to every survey  question or provided information for every year covered by our survey;  therefore, we are not able to provide trend information from 2014 through  2016. We administered the survey from July 2017 to September 2017.

To obtain information on the effects of bank account terminations on and  limitations in the number of accounts with money transmitters, we  interviewed a nongeneralizable sample of representatives from 11 money  transmitters. To select the money transmitters, we obtained money  transmitter licensure data from the Conference of State Banking  Supervisors’ Nationwide Multistate Licensing System. Using the number  of state licenses as a proxy for the size of the money transmitter, we  developed five size categories and selected the top four money  transmitters in the first stratum (40 or more licenses) along with one  money transmitter in the second, third, and fourth strata (20–39, 10–19,  and 2–9 licenses, respectively) and four money transmitters in the fifth  stratum (one license).

To evaluate how FinCEN and the federal banking regulators have  assessed and responded to concerns about derisking of money  transmitters, we reviewed agency documentation and guidance the  agencies issued to banks related to derisking and MSBs, and we  interviewed agency management. We also reviewed a prior GAO report  that evaluated regulators’ response to derisking along the Southwest  border and assessed actions regulators have taken to respond to a  recommendation we made in that report.

We utilized multiple data sources throughout our review. We assessed  the reliability of FDIC’s Statistics on Depository Institutions database by  reviewing related documentation and conducting electronic testing for  missing data, outliers, or any obvious errors. Furthermore, we used  NCUA data that track which credit unions bank money transmitters, the  Nationwide Multistate Licensing System, and FinCEN’s MSB registration  database to help select our nongeneralizable samples of credit unions  and money transmitters to interview. We did not assess the data reliability  of these sources because we used these data purely to inform our  sampling population, and once we selected our samples, we took  additional steps to confirm that the institutions we selected had MSB or  money transmitter customers and were willing to speak to us.

For FinCEN’s MSB registration database, as previously discussed, we  used the data to help identify which states had the most money  transmitters registered. In analyzing the data, we found a clear difference  in the number of MSB registrations between the top five states (California,  Texas, Michigan, Florida, and Illinois) with the most MSBs (ranging from  close to 800 to almost 4,000 MSBs) and the remaining states (all with  fewer than 500 MSBs). Because we used these data to help facilitate the  identification of BSA/AML subject-matter experts and specialists who had  experience examining banks with money transmitter customers, we did  not need to confirm the exact number of MSBs registered. As a result, we  did not assess the reliability of FinCEN’s registration database. We  concluded that all applicable data were sufficiently reliable for the  purposes of describing BSA/AML risks and compliance challenges and  identifying banks to survey on account terminations and limitations.

We conducted this performance audit from August 2016 to December  2019 in accordance with generally accepted government auditing  standards. Those standards require that we plan and perform the audit to  obtain sufficient, appropriate evidence to provide a reasonable basis for  our findings and conclusions based on our audit objectives. We believe  that the evidence obtained provides a reasonable basis for our findings  and conclusions based on our audit objectives.

Appendix II: Responses to Selected Questions from GAO’s Survey of Banks on Account Terminations and Limitations

From July 2017 through September 2017, we administered a web-based  survey to a nationally representative sample of banks. In the survey, we  asked banks about account terminations and restrictions (also referred to  as limitations) for reasons associated with managing Bank Secrecy  Act/anti-money laundering (BSA/AML) risk; whether banks are  terminating or limiting accounts with money transmitters; and the reasons  for these decisions. We collected information for the 3-year period from  January 1, 2014, to December 31, 2016. Responses to selected  questions from our survey that are directly applicable to the research  objectives in this report are shown in tables 7–19 below. While we  designed the survey to be nationally representative of all banks in the  United States, results specific to money transmitters are statistically  nongeneralizable because of the relatively low number of banks that  reported having money transmitters as customers. Because these survey  questions are statistically nongeneralizable, we present only the number  of responses to each survey question, and the results are not  generalizable to the population of banks. Moreover, not all banks  responded to every survey question or provided information for every  year covered by our survey; therefore, we are not able to provide trend  information from 2014 through 2016. Our survey included multiple-choice  and open-ended questions. For a more detailed discussion of our survey  methodology, see appendix I.

Appendix VII: GAO Contact and Staff Acknowledgments

In addition to the contact named above, Stefanie Jonkman (Assistant  Director), Kun-Fang Lee (Analyst-in-Charge), Carl Barden, Lilia Chaidez,  Giselle Cubillos-Moraga, Joshua Garties, Toni Gillich, Shamiah Kerney,  Jill Lacey, Patricia Moye, Aku Shika Pappoe, Jennifer Schwartz, Jena Y.  Sinkfield, Tyler Spunaugle, Verginie Tarpinian, and Deme Yoo made key  contributions to this report.

To fight money laundering and other crimes, the Bank Secrecy Act requires banks to verify customers’ identities and report suspicious activities. We looked at federal oversight of banks’ compliance with these requirements—particularly when banks’ customers are money transmitting businesses.

Some federal bank examiners were unclear about how much due diligence they should expect from banks’ site visits and reviews of their money transmitter customers.

We recommended that banking regulators update examination procedures, provide examiner training, or take other steps to improve evaluation of banks’ compliance.