Aviation: FAA Needs to Better Prevent, Detect, and Respond to Fraud and Abuse Risks in Aircraft Registration

The U.S. aircraft registry, managed by FAA, maintains information on approximately 300,000 civil aircraft. FAA issues aircraft registration to individuals and entities that meet eligibility requirements, such as U.S. citizenship or permanent legal residence. Registry fraud and abuse hinders the ability of law-enforcement and safety officials to use the registry to identify aircraft and their owners who might be involved in illicit or unsafe operations.

GAO was asked to examine registry fraud and abuse. This report assesses FAA's actions to (1) prevent, (2) detect, and (3) respond to fraud and abuse risks in aircraft registrations.

GAO reviewed relevant laws, regulations, and FAA policies; reviewed reports, DOJ press releases, and court cases that illustrated risks associated with the registry; analyzed aircraft registry data from fiscal year 2010 through 2018 to identify registrations with risk indicators; and interviewed FAA registry, legal, law-enforcement liaison, and safety officials, as well as officials from DOJ and DHS.

To register civil aircraft, the Federal Aviation Administration (FAA) generally relies on self-certification of registrants' eligibility and does not verify key information. According to GAO's review of the registry process, there are risks associated with FAA not verifying applicant identity, ownership, and address information. The registry is further vulnerable to fraud and abuse when applicants register aircraft using opaque ownership structures that afford limited transparency into who is the actual beneficial owner (i.e., the person who ultimately owns and controls the aircraft). Such structures can be used to own aircraft associated with money laundering or other illegal activities (see example in figure). FAA has not conducted a risk assessment that would inform its eligibility review and collection of information to manage risks. Without a risk assessment, FAA is limited in its ability to prevent fraud and abuse in aircraft registrations, which enable aircraft-related criminal, national security, or safety risks.

FAA makes some use of registry information to detect risks of fraud and abuse, but the format of the data limits its usefulness. Specifically, most data on individuals and entities with potentially significant responsibilities for aircraft ownership, such as trustors and beneficiaries, are stored in files that cannot be readily analyzed due to system limitations. As FAA modernizes its information-technology systems, it has an opportunity to develop data analytics capabilities to detect indicators of fraud and abuse in the registry.

FAA takes administrative actions, such as registration revocations, to respond to registration violations and coordinates with law-enforcement agencies on investigations and enforcement actions such as aircraft seizures. Since 2017, FAA has coordinated with the Departments of Justice (DOJ) and Homeland Security (DHS) as part of an Aircraft Registry Task Force to address aircraft registry vulnerabilities. However, this coordination is informal, and other mechanisms for joint enforcement actions, sharing of information, and use of liaison positions are not in place,

GAO is making 15 recommendations to FAA, including that it collect and verify key information on aircraft owners; undertake a risk assessment of the registry; leverage information-technology modernization efforts to develop data analytics approaches for detecting registry fraud and abuse; and formalize coordination mechanisms with law-enforcement agencies. FAA agreed with all recommendations.

The Civil Aviation Registry, managed by the Federal Aviation  Administration (FAA), processes and maintains publicly available  information on approximately 300,000 civil aircraft to facilitate aviation  safety, security, and commerce. As the largest civil aviation registry in  the world, it is critical for ensuring aircraft are lawfully owned, maintained,  and operated. FAA maintains the registry to meet federal statutory and  international civil aviation standards that promote safe and efficient civil  aviation. FAA registers aircraft to individuals, entities, and dealers that  meet eligibility requirements, generally related to U.S. citizenship,  permanent legal residency, or noncitizen corporation status. Many  domestic and foreign owners as well as lenders prefer to register aircraft  in the United States due to FAA’s high standards for aviation safety and  maintenance, large markets for commercial and general aviation aircraft,  and low aircraft registration fee—$5 for a 3-year period.

The completeness and accuracy of registry data and the transparency of  owner information are relevant to the wide range of users who rely on  aircraft and owner information to communicate airworthiness directives  and safety notices, facilitate aircraft purchases, investigate safety  incidents and accidents, and identify aircraft and owners potentially  associated with unlawful activity, among other things. However, recent  Department of Transportation (DOT) Office of Inspector General (OIG)  and other reports raised concerns about the accuracy and completeness  of registry information, and limitations in using the registry in preventing,  detecting, and responding to cases involving the use of aircraft in unsafe  and illicit activities. For example, according to the 2018 National Drug  Threat Assessment, cocaine trafficking organizations use a wide variety  of methods to transport cocaine into and throughout the United States,  including via aircraft. The assessment determined that, increasingly,  traffickers use private airplanes and secondary airports to augment  commercial smuggling. Furthermore, as a high-value asset, aircraft have  been used to launder illicit proceeds, including as part of trade-based  money laundering schemes. Information from the registry supports  oversight and investigations into such activities, including identification of  the “beneficial owners” of an aircraft, which, for the purposes of this  report, refers to the natural person or persons who ultimately own and  control the aircraft.

You asked us to examine potential fraud and abuse of aircraft registration  requirements and processes as well as the extent of FAA and law- enforcement efforts to address vulnerabilities and challenges associated  with aircraft registrations. This report assesses FAA’s: (1) actions to  prevent fraud and abuse in aircraft registrations, (2) ability to detect  potential fraud and abuse in aircraft registrations, and (3) actions and coordination with law-enforcement entities to respond to aircraft registry– related fraud and abuse risks.

To address all three objectives, we reviewed relevant international  standards, laws, regulations, and FAA policies and procedures such as  process guidelines, policy statements, and orders. We interviewed FAA  officials from the Office of Aviation Safety, the Flight Standards Service– Civil Aviation Registry, including the Aircraft Registration Branch (aircraft  registry), and Special Emphasis Investigation Team (SEIT). We also  interviewed officials from the FAA Office of the General Counsel and the  Office of Security and Hazardous Materials Safety (ASH), including the  Law Enforcement Assistance Program (LEAP) and the Law Enforcement  Assistance Unit (LEAU). We interviewed officials from relevant federal  law-enforcement, foreign policy, and aviation safety agencies, including  the

Department of Justice’s (DOJ) Drug Enforcement Administration

Department of Homeland Security’s (DHS) Homeland Security  Investigations (HSI),

Department of the Treasury’s (Treasury) Office of Foreign Assets  Control (OFAC),

National Transportation Safety Board (NTSB), and

We interviewed representatives of aviation industry associations, selected  based on a range of aviation interests such as general aviation and  equipment leasing. We also interviewed aircraft registry intermediaries— individuals and entities that facilitate aircraft registrations for others—such  as trust companies, banks, and a registered agent, selected based on our  analysis of aircraft-registry data across types of intermediaries and  number of registrations. We conducted a site visit to the FAA Civil  Aviation Registry facility located at the Mike Monroney Aeronautical  Center in Oklahoma City, Oklahoma. During the site visit, we interviewed  relevant officials from FAA’s Civil Aviation Registry and observed aircraft  registration processes.

To assess potential fraud and abuse in aircraft registration and FAA  actions to prevent them, we analyzed and synthesized a variety of  information, including agency reports; registration, postal, and sanctions  data; and news articles. Our review of information generally spanned  fiscal years 2010 through 2018. Specifically, we conducted illustrative  case research related to U.S.-registered aircraft that were investigated by  federal law-enforcement agencies or prosecuted by DOJ. We also  researched news articles and agency reports covering the same period,  including safety investigation reports, to identify potential cases involving  U.S.-registered aircraft. Based on our initial review of over 1,200  publications and reports, through several rounds of selection to confirm  relevance and availability of information for further research, we selected  six case studies for in-depth review across three categories of risk  enabled by fraud and abuse—criminal activity, national security, and  safety. For discussion of each case study, see appendix I.

We also conducted research on intermediaries and selected examples  from this research to illustrate these risks. For our in-depth research of  selected case studies and intermediary examples, we used FAA  registration documentation, state business registration data, and GAO’s  internal resources that included a mix of government and corporate  databases, among others. All selected cases are intended for the purpose  of illustrating fraud and abuse vulnerabilities associated with the aircraft  registration process. These cases may not represent all existing  vulnerabilities and are not generalizable to the FAA registry population as  a whole. To identify potential vulnerabilities related to noncompliant  registration addresses, we analyzed 2018 FAA aircraft registry address  data. Using address information, we conducted a match to United States  Postal Service (USPS) data to identify examples of aircraft registration  addresses that did not match to the postal data or appeared to be post  office boxes. To verify addresses that did not match or to identify post  office boxes, we conducted internet searches and reviewed FAA  registration documents for selected registrations based on categories of  addresses, such as post office boxes. We further investigated selected  applicants’ address locations to include verification through site visits.

To assess FAA’s ability to detect potential fraud and abuse in aircraft  registrations, we examined FAA aircraft registry data collection and  storage as well as oversight actions based on registry information and  data. We also conducted data mining and matching to identify registrations with indicators of potential fraud or abuse that may enable  criminal activity, national security, and safety risks by analyzing FAA  aircraft registry data from calendar years 2010 to 2018, as well as other  registry-based and external data sets. We selected five risk indicators— which were informed by interviews with FAA and law-enforcement  officials and our background research—three for analysis of registry- related data and two for matching to a selection of external data sets. We  analyzed FAA aircraft registry data to identify registrations with  characteristics that matched one or more risk indicators, such as  registrations using opaque ownership structures—corporation- and trust- based ownership that potentially disguises the beneficial owner—and  registration addresses in countries identified by the U.S. Department of  State as associated with major illicit drug production and money  laundering, among other factors.

We also matched aircraft registry data to the OFAC lists of sanctioned  entities and individuals as of March 2019 to identify aircraft, individuals  and entities subject to U.S. sanctions. We also used data sources such  as NTSB’s data on aviation accidents and incidents covering the period  from calendar years 2010 to 2018. We assessed the reliability of FAA  registry data, as well as the data sets used for matching by performing  electronic tests to determine the completeness and accuracy of key fields.  We also reviewed system documentation, where available, and agency  officials’ responses to data-quality questions regarding the purpose,  structure, definitions, and values for selected fields, automated and  manual data-quality checks for accuracy, and limitations of the data.  Overall, we found that the data were generally reliable for our purposes,  including for matching to registrations to identify risk indicators,  generating descriptive totals, and describing trends over the 9-year period  of our review. The five risk indicators we selected do not prove fraud or  that any unlawful activity has occurred. Alone or together, the risk  indicators may serve as points of inquiry for further examination of  conduct that may run counter to the interests of the federal government  by posing potential criminal, national security, or safety risks.

To assess FAA’s actions to respond and coordinate with law-enforcement  agencies to address registration-related risks, in addition to the interviews  noted above, we reviewed FAA enforcement actions and government- wide data on aircraft seizures. Specifically, we analyzed data from FAA’s  Enforcement Information System related to aircraft registration  revocations and suspensions from fiscal year 2011 to August 2018, and  data from the DOJ Consolidated Asset Tracking System and the DHS  Customs and Border Protection Seized Assets and Case Tracking  System to generate government-wide totals for aircraft seizures and  forfeitures from fiscal year 2010 to August 2018. We assessed the  reliability of data in each system described above for the purposes of  generating high-level totals and found that the data were sufficiently  reliable for our purposes.

For additional information on our scope and methods, see appendix II.  We conducted this performance audit from November 2017 to March  2020 in accordance with generally accepted government auditing  standards. Those standards require that we plan and perform the audit to  obtain sufficient, appropriate evidence to provide a reasonable basis for  our findings and conclusions based on our audit objectives. We believe  that the evidence obtained provides a reasonable basis for our findings  and conclusions based on our audit objectives. We conducted our related  investigative work in accordance with investigation standards prescribed  by the Council of the Inspectors General on Integrity and Efficiency.

FAA issues aircraft registrations according to eligibility requirements  prescribed by federal statute in support of International Civil Aviation  Organization requirements that every aircraft engaged in international air  navigation must bear its appropriate nationality and registration marks.  Specifically, the law requires that the aircraft may not be registered under  the laws of a foreign country and must be owned by (1) a citizen of the  United States, (2) a foreign citizen lawfully admitted for permanent  residence in the United States, (3) a noncitizen corporation that is  organized and doing business under the laws of the United States or a  state if the aircraft is based and primarily used in the United States, or (4)  the U.S. government, District of Columbia government, or the government  of a U.S. state, territory, or possession.

By law and FAA policy, FAA imposes safety obligations on all owners of  registered aircraft. To meet these obligations, an owner must maintain  current information about the identity and whereabouts of the operators of  an aircraft and location and nature of the aircraft’s operation on an  ongoing basis. In doing so, the owner is to retain the ability to provide  the operator with safety-critical information in a timely manner, and to  obtain information responsive to FAA inquiries, including investigations of  alleged violations of FAA regulations. Such information supports FAA’s  ability to carry out its oversight obligations under U.S. and international  law.

FAA’s aircraft registry is an owner registry; it is not intended to include  aircraft operator information. Only an aircraft’s owner may apply for  registration, and a registration is not valid if the interest of the applicant in  the aircraft was created by a transaction that was not entered into in good  faith, but rather was made to avoid registration requirements. In addition,  anyone who knowingly and willfully submits documents to FAA with false,  misleading, or fraudulent information could be subject to criminal  penalties and revocation of the aircraft registration.

Aircraft and Aircraft Dealer Registration Requirements

To register an aircraft for a 3-year period, in addition to a $5 application  fee, applicants must submit to FAA at least two primary documents: (1) a  completed application form and (2) a bill of sale or other evidence of  aircraft ownership. A sample aircraft registration submission for an  individual owner is shown in figure 1 below. For additional information  about required documentation based on registration type, see appendix  III. According to FAA officials, in 2018 FAA received approximately  71,000 registration applications.

FAA also issues dealer certificates, also known as dealer licenses, in  support of aviation commerce. Individuals and legal entities who are U.S.  citizens can apply for an aircraft dealer certificate. The dealer certificate is  valid for 1 year at a cost of $10 for the initial certificate and $2 for  additional certificates. The certificates allow manufacturers and dealers to  demonstrate and merchandize aircraft for prospective buyers and to  make flight tests without a standard aircraft registration certificate. A  dealer may obtain one or more certificates and may use a certificate for  any aircraft the dealer owns. Dealer certificates require the applicant to be  a U.S. citizen, identify an established place of business in the United  States, provide a mailing and physical address, and substantially engage  in manufacturing or selling of aircraft. Among other things, a dealer  certificate is generally valid when the dealer, his or her agent or  employee, or prospective buyer within the United States operate the  aircraft, and only for flights that are required for testing of the aircraft or  necessary for, or incident to, the sale of the aircraft. In 2018, there were 9,864 dealer certificates in the aircraft registry, primarily issued to  corporations, limited liability companies (LLC), or individuals.

Aircraft Registration Types and Ownership Structures

FAA’s aircraft registration application form identifies eight registration  types, including individual, corporation, and government. In 2018, there  were 294,221 aircraft registered with FAA across all registration types  (see fig. 2).

The various registration types are associated with different types of  aircraft ownership structures. Individuals who are U.S. citizens or resident  aliens can register aircraft in the United States as individual owners or as  part of a legal entity, such as a corporation or LLC. Legal entities that  meet certain requirements can also register aircraft in the United States.  For most types of legal entities, the entity must qualify as a U.S. citizen.

For example, a corporation may own and register an aircraft as a U.S.  citizen if (1) it is organized under the laws of the United States or a state,  District of Columbia, or a territory or possession of the United States; (2)  the president and at least two-thirds of the board of directors and other  managing officers are citizens of the United States; (3) it is under the  actual control of citizens of the United States; and (4) at least 75 percent  of the voting interest is owned or controlled by persons that are citizens of  the United States. Depending on the type of legal entity, additional  requirements may apply, and in some cases additional documentation  must be provided to FAA. For some legal entities, the registered owners  of aircraft may not be the beneficial owners—the persons who ultimately  own and control an aircraft. See appendix III for further information about  the types of registrations and an additional ownership structure, along  with associated documentation requirements beyond the aircraft  registration application form, bill of sale, and $5 registration fee.

Use of Voting Trusts to Meet U.S. Citizenship Requirement

If necessary, a corporation may use a voting trust to establish the fourth  element of citizenship noted above for the purposes of registering an  aircraft. Generally, a voting trust legally transfers the voting control in the  corporation from a foreign citizen to a U.S. citizen who holds those  interests in trust; however, the exact requirements are governed by the  law of the state in which the trust is created. FAA regulations have  included requirements around the use of voting trusts since 1980. When  promulgating the relevant regulations, FAA explained that use of a voting  trust allows a domestic corporation to come within legal compliance by  placing the “voting interest of the stock of the corporate applicant . . . in  the hands of U.S. citizens as voting trustees  that the trustees have  a valid, independent, and bona fide control of the voting interest.” As a  result, if a voting trust is used by the domestic corporation to meet the  fourth element of citizenship, the corporation must submit to FAA a copy  of the voting trust agreement, which identifies the voting interests and  must be binding upon all parties to the transaction, as well as an affidavit  from each voting trustee, which represents that the voting trustee is an  independent actor. A sample aircraft registration submission for a  corporation using a voting trust is shown in figure 3 below.

Trusts are not a registration type on the FAA aircraft registration  application form; however, trusts are a legal structure that may own  property such as an aircraft and therefore may be used to register an  aircraft. As of June 2019, according to FAA data, there were 11,364 trusts  in the aircraft registry. Depending on whether the trustee is an individual  or an entity as well as on the specific terms of the trust, the aircraft’s  owner in the FAA registry may be listed as an individual or as a  corporation (see fig. 4).

A trust may own and register an aircraft if each of the trustees is a U.S.  citizen or resident alien, and 75 percent of the control of the trust must be  vested in U.S. citizens or resident aliens. Specifically, each trustee must  affirm that trust beneficiaries who are not U.S. citizens or resident aliens  do not have more than 25 percent of the aggregate power to influence or  limit the exercise of the trustee’s authority. However, foreign citizens  who are not resident aliens may have more than 25 percent of the  beneficial interest in the trust. Trusts for which foreign citizens have a  majority of the beneficial interest are generally referred to as “noncitizen  trusts,” even though legal title in the aircraft remains owned by one or  more U.S. citizen or resident alien trustees.

In a 1979 rulemaking, FAA cited “increased activities of foreign investors  in aircraft financing” as a reason for updating its regulations related to  noncitizen trusts. In the ensuing decades, FAA experienced problems  obtaining important operational and maintenance information concerning  aircraft owned by noncitizen trusts from the owner trustees, prompting  FAA in 2011 to begin a review of its policies and practices regarding the  registration of such aircraft. After a series of public meetings and receipt  of written public comments, FAA issued a notice of policy clarification for  noncitizen trusts in 2013. Among other things, the policy clarification  confirmed that the “FAA does not consider the status of the trustee as the  owner of the aircraft under a trust agreement as having any differing  effect on its responsibilities for regulatory compliance issues compared to  other owners of a U.S.-registered aircraft,” and that “FAA is not aware of  any basis for treating one type of owner—such as a trustee under a  noncitizen trust—differently from any other owner of a civil aircraft on the  U.S. registry when considering issues of regulatory compliance.”

Information and Data Collected by Aircraft Registry

FAA collects, stores, and makes publicly available aircraft registration  information. FAA collects basic aircraft registration data from the  application form, which are available and searchable on FAA’s website or  in imaged records in portable document format (PDF). FAA data  available on its website include aircraft registration number (tail or N- number), serial number, aircraft make and model, owner name, owner’s  address, and registration status. According to FAA officials, FAA stores  scanned images in two key systems: (1) aircraft records, which includes  documents such as registration application forms and bills of sale, and (2)  ancillary files, which includes documents such as trust agreements. FAA  officials told us that aircraft record files are accessible to the LEAU, FAA  LEAP, and aviation safety inspectors who access aircraft records files via  a web-based portal. Ancillary files must be accessed on-site at the FAA  Aeronautical Center in Oklahoma City, Oklahoma. The LEAU has direct  access to the ancillary files and provides aircraft record and ancillary file  information to law-enforcement agencies, FAA LEAP, and aviation safety  inspectors. Additionally, all records are accessible to the public in FAA’s  public documents room located at the FAA Aeronautical Center or upon  request. Figure 5 shows collection, storage, and availability of FAA’s  aircraft registration documentation.

Within FAA’s Aviation Safety office, the Flight Standards Service  manages the Civil Aviation Registry and is the primary user of aircraft  registry information. Registry staff process registrations for U.S. civil  aircraft, issue aircraft registration numbers, and record conveyances  affecting interest in aircraft. Internal FAA users of registration information  include officials from ASH, LEAP, and SEIT, and aviation safety  inspectors. FAA LEAP and SEIT coordinate closely with registry officials  to request registration information in support of their missions on security  and law-enforcement assistance. Apart from FAA, major users of aircraft  registry information are organizations serving the aviation industry,  international civil aviation agencies, federal safety officials, and law- enforcement agencies (see table 1).

In 1964, FAA issued updated aircraft registration regulations and set the  aircraft registration fee at $5. In 1988, Congress passed the Federal  Aviation Administration Drug Enforcement Assistance Act of 1988 (FAA  DEA Act), which declared that it is FAA policy to assist law-enforcement  agencies in the enforcement of laws relating to the regulation of controlled  substances and, among other things, required FAA to promulgate  regulations that would require individuals to provide their driver’s license  number and entities to provide a tax identification number in their  registration application. In 1990, FAA issued a proposed rulemaking  that, among other things, required a driver’s license number for an  individual and a tax identification number for others. In 2005, FAA  issued a notice of proposed rulemaking withdrawal, stating that it fulfilled  the requirements of the FAA DEA Act, with certain exceptions, through  changes to its system and procedures used by the FAA Civil Aviation  Registry, such as by providing law-enforcement agencies access to the  registry data. With regard to the requirement to provide a driver’s  license number or tax identification number, FAA determined that the  requirement would be detrimental to users of aircraft records and  potentially to the aircraft owners, and cause an unnecessary burden on  aircraft owners and government, and that this information was not  necessary for law-enforcement agencies to carry out their responsibilities.

In 2010, to improve the quality of registry data and to provide more  accurate information to law-enforcement agencies and other users, FAA  started requiring aircraft registration renewal. Such renewals must occur  every 3 years. In 2018, the FAA Reauthorization Act of 2018 required  FAA to modernize the Civil Aviation Registry’s information technology (IT)  systems. The act also required FAA to initiate a rulemaking to extend  the registration duration for noncommercial general aviation aircraft from  3 to 7 years.

International Standards and Guidance on Beneficial Owners and Misuse of Corporate Structures

Beneficial ownership and legal information can assist law-enforcement  and safety authorities by identifying those natural persons who may be  responsible for the underlying activity of concern, or who may have  relevant information to further an investigation. The Financial Action  Task Force (FATF)—an international standards-setting body for  combating money laundering, financing of terrorism, and other related  threats to the integrity of the international financial system—has  examined how legal and beneficial ownership information can assist law- enforcement and other competent authorities. FATF was established by  the group of seven economic summit partners, known as the G7, of which  the United States is a member, and the Treasury’s Office of Terrorist  Financing and Financial Crimes leads the U.S. delegation to FATF.

FATF developed a series of 40 recommendations, last updated in 2019,  that are recognized as the international standard for combating of money  laundering and the financing of terrorism and proliferation of weapons of  mass destruction. Specifically, FATF Recommendations 24 and 25 call  on member countries to ensure the availability of adequate, accurate, and  timely information on the beneficial ownership of corporate vehicles that  can be accessed by competent authorities in a timely fashion. To the  extent that such information is made available, it may help financial  institutions and other organizations to implement the due-diligence  requirements on corporate vehicles including to identify the beneficial  owner and to identify and manage financial crimes risks, including  sanctions requirements.

Internal controls help entities fulfill their mission and objectives while  safeguarding assets and ensuring proper stewardship of public  resources. According to federal internal control standards, managers are  responsible for an effective internal control system, which increases the  likelihood that an entity will achieve its objectives. Additionally,  managers are responsible for proactively managing risks, including fraud  risks and misconduct such as waste and abuse, to facilitate the entity’s  mission and strategic goals by ensuring that taxpayer dollars and  government services are being used for their intended purposes.

The Fraud Reduction and Data Analytics Act of 2015, enacted in June  2016, required federal agencies to establish financial and administrative  controls for managing fraud risks. These requirements are aligned with  leading practices outlined in A Framework for Managing Fraud Risks in  Federal Programs (Fraud Risk Framework). GAO’s Fraud Risk  Framework outlines leading practices to prevent, detect, and respond to  fraud risks. As depicted by the larger circle for prevention in the sidebar,  preventive activities generally offer the most cost-efficient use of  resources, since they enable managers to avoid costly and inefficient  recovery activities following fraudulent transactions. Therefore, leading  practices for strategically managing fraud risks emphasize risk-based  preventive activities.

Limited Verification of Registration Information and Transparency in Aircraft Ownership Hinder FAA’s Ability to Prevent Registry Fraud and Abuse

FAA reviews registry applicant information for completeness and  compliance with regulations—generally accepting self-certification of  eligibility and aircraft ownership—but does not verify this information or  collect key information on applicants and aircraft owners, according to our  review of the registry process. This limits FAA’s ability to prevent fraud  and abuse in aircraft registrations, which has enabled aircraft-related  criminal, national security, or safety risks, according to our case-study  review. Specifically, FAA’s review of aircraft registrations and dealer  certifications primarily focuses on ensuring that applicants provide  required documents and that forms are complete. Additionally, FAA  requires limited personally identifiable information (PII), and it generally  does not use that information to verify applicant information. The registry  is further vulnerable to fraud and abuse when applicants register aircraft  using opaque ownership structures that limit transparency into beneficial  owners of aircraft. FAA’s approach has focused on obtaining and  recording the required documents, and consequently, FAA has not  identified fraud risks, their likelihood and impact, the suitability of controls,  and other aspects of a fraud risk assessment that would support fraud prevention activities. As a result, FAA is limited in its ability to ensure  registrant eligibility and prevent fraud and abuse and associated criminal,  national security, and safety risks involving U.S.-registered aircraft.

Limited Registration Verification and Risk Management Hinder FAA’s Ability to Prevent Fraud and Abuse

FAA generally accepts certification by applicants of their eligibility and  aircraft ownership and performs limited review of applicant information to  identify potential fraud or abuse.

Specifically, FAA requires applicants to submit signed documents that  attest to the requirements relevant to their registration type, including U.S.  citizenship, resident alien status, or eligibility as a noncitizen corporation.  Where owners are LLCs or trusts, applicants submit documentation that  the entity is organized under U.S. or state laws. Additionally, applicants  must submit evidence of aircraft ownership, such as a bill of sale, and  attest to their ownership of the aircraft.

According to FAA policy, by signing the application form, applicants certify  to the truthfulness and accuracy of the information provided and that they  understand that knowingly and willfully submitting documents to FAA with  false, misleading, or fraudulent information could subject the person to  criminal penalties and revocation of the aircraft registration. FAA collects  applicants’ name and address, although according to officials, it accepts  this information as factually valid and does not make an attempt to detect  intentional fraud at the time of application. FAA does not require or collect  other PII, such as the applicant’s date of birth or driver’s license  information for individual applicants, or taxpayer identification numbers  and state of incorporation for legal and corporate entities, for identity  verification or record keeping. FAA collects some PII in the airmen  registry, such as for pilot licensing, but it does not use this information for  aircraft registration verification purposes. Use of PII is a key way federal  programs verify the identity and eligibility of potential beneficiaries.

FAA’s policy is to review documents for acceptability during the initial  registration. This includes, for example, checking for internal  discrepancies within the documents submitted, ensuring that documents  are complete, and that the self-certification is signed. For previously  registered aircraft, FAA also reviews prior bill of sale documents for  inconsistencies in the chain of ownership. Where owners are corporations  with complex ownership structures, such as LLCs that are owned by other  LLCs, registry officials may request review by FAA’s legal counsel to  confirm eligibility. FAA’s legal counsel may also review documentation  provided by noncitizen corporations as well as trust agreements and  related documents for registrations involving noncitizen trusts, statutory  trusts, and corporations using voting trusts to meet U.S. citizenship  requirements at the time of registration. In these cases, according to  FAA officials, FAA legal counsel reviews documentation to ensure that  the entity is organized under U.S. or state laws and may periodically  perform spot checks by contacting a Secretary of State office to confirm  the existence of an entity. However, where the owner is a U.S.-citizen  corporation, FAA generally does not request or review articles or  certificates of incorporation to ensure the entity is organized under U.S. or  state laws.

In addition, FAA does not require or review additional documentation for  individual, partnership, and government registration types. For these  applicants, FAA checks (1) all sections of the application form for  completeness, (2) chain of ownership, and (3) that applicants self-certify  their U.S. citizenship. Further, according to FAA officials, when FAA  informs applicants of its unfavorable determination, such as when  reviewing LLC documentation, for example, applicants are generally  provided an opportunity to remedy deficiencies and resubmit their  applications. According to FAA officials, FAA applies the same scrutiny to  resubmissions as it does to initial applications. In addition, FAA does not  review documents for eligibility when individuals certify that there have  not been any changes since initial registration.

As with aircraft registrations, FAA does not verify dealer identity, check for  prior relevant violations, or enforce requirements associated with dealer  certificates, such as verifying that dealers are substantially engaged in  manufacturing or selling aircraft or only operating domestically, except  when delivering an aircraft to a foreign purchaser. Furthermore, FAA  regulations do not prescribe enforcement mechanisms to ensure  continued dealer eligibility once approved or at the time of certificate  renewal. Law-enforcement and FAA LEAP agents told us that dealer  certificates is an area in need of greater oversight because dealer  certificate applications have been falsified similar to other aircraft  registrations, as discussed below. Additionally, FAA LEAP agents told us  that they have identified instances of dealers acting as nominees on  behalf of foreign entities, registering aircraft under their U.S. dealer  certificate. The use of a nominee is an invalid means to register an  aircraft, including for dealers. FAA LEAP agents noted that, in their  experience, this practice may have enabled otherwise ineligible foreign  entities to meet aircraft registration citizenship requirements.

In our case studies and interviews with FAA, we identified examples of  fraudulent registrations and potential abuse of the registry that occurred  within the context of FAA’s current practice of limited verification and  review of applicant information. In addition, our analysis of address data  and investigation of selected addresses highlights the risks of abuse  arising from FAA’s approach of not verifying address information. The  examples below illustrate some of the risks associated with FAA not  verifying: (1) applicant identity, (2) ownership, and (3) address  information.

Applicants falsified identities and registration self-certification. A  2017 case involving an aircraft registered through a falsified identity  illustrates inherent risks of not verifying applicants’ information and  identities, such as through PII or other checks. According to FAA  documents, an applicant registered an aircraft as an LLC owner with  supporting documents identifying two individual members. In registration  documents, the applicant provided the name of a stolen identity for the  first LLC member’s name and “John Doe” for the second. FAA accepted the registration information as factually valid and the aircraft remained  legitimately registered for about 1 year. A DEA and FAA LEAP  investigation of aircraft operating outside the United States eventually  discovered the falsification. When FAA LEAP agents contacted the first  named individual of the LLC, he affirmed that he was not a member of the  LLC, never owned an aircraft, and never executed any documents to  register an aircraft in his individual capacity or on behalf of a business  entity. FAA LEAP determined that the stolen identity had been used to  submit aircraft registration paperwork without the individual’s knowledge  or consent. Accordingly, FAA revoked the aircraft registration, finding that  the registration was invalid because the applicant’s interest in the aircraft  was created by a transaction that was not entered into in good faith. This  revocation was associated with a broader effort by DEA and FAA  involving international operations of multiple U.S.-registered aircraft that  resulted in aircraft and cocaine seizures, discussed later in this report.

Aircraft broker fraudulently registered multiple aircraft for bank loan  fraud scheme. A 2013 case involving an aircraft sales broker and dealer  who was convicted of making a false statement to FAA in registering  aircraft, among other convictions, illustrates risks associated with FAA’s  reliance on self-certification and limited review of ownership information.  In this case, the broker submitted fraudulent registration applications and  bills of sale to FAA using forged signatures for over 20 aircraft as part of a  multi-million-dollar bank fraud scheme. FAA accepted the broker’s self- certification as factually valid. The broker used the registration certificates  that FAA had provided as an asset to support a loan application that  resulted in a $3 million bank loan for his failing aircraft sales business.  The bank uncovered the fraud over a year after the sales broker first  submitted to the bank fraudulent aircraft registration documents to  execute the bank loan. A subsequent investigation by the Federal Bureau  of Investigation revealed the extent of the fraud, namely that the main  thrust of the fraud scheme was to pledge 22 aircraft as collateral, which  neither the broker nor his company owned, in order to obtain money from  the bank. As a result of the fraud, some of the rightful owners of the  aircraft experienced difficulty reinstating aircraft registrations in their  names. For example, one owner told federal investigators that he could  not fly his aircraft for 2 years because the registration of his aircraft was in  the name of the fraudulent broker. This aircraft broker was also a licensed  dealer, who held and renewed a dealer certificate during the time he was  perpetrating his illicit scheme submitting fraudulent aircraft registrations to  FAA.

Noncompliant addresses. We also identified registrations with  potentially noncompliant addresses and addresses that did not match  USPS postal verification data in our analysis of FAA’s publicly available  and ancillary registry data files. Our analysis illustrates noncompliance  risks associated with FAA’s approach of not verifying physical address  information as well as safety and security risks associated with FAA’s  ability to readily identify or contact owners when issues arise. FAA  regulations require that owners submit physical address information in  their application forms. According to FAA policy, a physical address is  needed so that the owner can be located, if necessary, for security or  safety reasons. According to FAA officials, FAA will accept the use of a  mail drop or a registered agent’s address as a mailing address, provided  the physical address is included. However, our analysis of 2018  physical and mailing address data shows that over 2,000 (about 1  percent) of addresses list a mail drop location without a physical address,  which does not comply with FAA’s requirement. We selected seven of  these cases for further verification using online and subscription database  research, including three for site inspection.

In our review of seven selected cases based on categories of addresses  and locality, we identified three cases in which a physical address was  not provided by registrants. Through a site inspection for one of the  selected cases, we were able to confirm a UPS Store location was  provided as the mailing address, and no physical address was provided   as required by FAA policy. (See sidebar.) For the remaining two cases,  the registrants provided the addresses of the registered agents that likely  facilitated the application on behalf of the registrants, but no physical  addresses were provided. The address of one of these registered agents  is the same address we identified in a case study discussed later in this  report. In that case, FAA registry officials were not able to get in contact  with the owner, who used a registered agent address, after the aircraft  had crashed outside the United States. The aircraft was being operated   by a foreign government, following its seizure on drug trafficking charges.  FAA sent multiple letters to the owner to deregister the aircraft and also  when the aircraft registration was expiring, but all were returned as  refused by the registered agent. As discussed later, the use of a  registered agent address may provide a layer of anonymity in aircraft  ownership and pose challenges when FAA or law-enforcement agencies  need to contact registered owners.

The address of this mail drop location was  used in one of the aircraft registration cases  we selected for postal address verification,  inconsistent with Federal Aviation  Administration policy.

Additionally, we selected five dealer addresses for further review. We  found that in three cases physical addresses were provided on the  certificate application forms as required. In two remaining cases, we  cannot make any conclusions regarding the validity of the physical  addresses provided because we could not confirm through our online and  subscription databases whether the companies were or were not located  at the physical addresses provided to the registry.

In addition to fraud and abuse risks posed by limited verification and  review of applicant information, the registry faces risks associated with  nominee registrations. As noted above, use of a nominee is an invalid  means to register an aircraft and involves a person or business acting on  behalf of an ineligible owner, as shown in the following example.

Fraudulently registered aircraft linked to notorious cartel. A 2016  case involving the use of a nominee to register an aircraft on behalf of an  ineligible owner illustrates risks of registration fraud by individuals and  entities misrepresenting their aircraft ownership. In this case, law- enforcement officials received information that an aircraft was in the  process of being purchased by a foreign national. A U.S. corporation,  acting on behalf of entities known to have ties to the Sinaloa Cartel,  purchased the aircraft, filed registration documents for it, and represented  itself as the aircraft owner. According to court documents, by registering  as the aircraft owner, the nominee corporation concealed the otherwise  ineligible non–U.S. citizen ownership of the aircraft by entities with  Mexican drug cartel ties. FAA accepted the registration and registered the  aircraft in 2014. A law-enforcement agency, which was aware of the  scheme, seized the aircraft shortly after final payment was made on it.  Law-enforcement investigation into this case also revealed that some of  the same entities had previously been involved in similar schemes  involving aircraft purchases and registration associated with drug  trafficking. The aircraft was subsequently forfeited to the federal  government because its registration was fraudulent and it was purchased  with assets derived from wire fraud, money laundering, or other unlawful  activities.

As part of its IT modernization effort, FAA identified some risks to the  aircraft registry, such as financial fraud and terrorist access. FAA officials  have also pointed to various FAA LEAP and law-enforcement activities  directed at managing these risks, as discussed later in this report. These  are reactive measures, and the current process—which accepts applicant  information at face value—is not designed to identify and prevent fraud  and abuse. Preventive activities generally offer the most cost-efficient use  of resources because they enable managers to avoid a costly and  inefficient “pay-and-chase” approach. According to federal internal control  standards, managers should identify, analyze, and respond to risks.  Furthermore, GAO’s Fraud Risk Framework emphasizes risk-based  preventive activities that are based on a comprehensive, documented risk  assessment that identifies risks, assesses them, and develops a strategy  to address analyzed risks, including periodic assessments to evaluate  continuing effectiveness of the risk response. To identify risks,  managers should consider the types of risks, including both inherent and  residual risks. To assess risks, managers should estimate the  significance of a risk by considering the magnitude of impact, likelihood of  occurrence, nature, and tolerance of the risk. Managers should then  design overall risk responses for the analyzed risks based on the  significance of the risk and defined risk tolerance. According to FAA  officials, FAA has not conducted such an assessment, which would better  position it to design and implement risk-based preventive and other  controls to manage these risks. As our case studies and illustrative  examples demonstrate, this has enabled illicit actors to defraud and  abuse the registry, with criminal and national security consequences.

In addition, federal internal control standards call for agency management  to design control activities to achieve objectives and respond to risks,  including designing a variety of transaction controls, which may include  verifications, reconciliations, and authorizations. As discussed in the  Fraud Risk Framework, a leading practice to effectively prevent instances  of potential fraud is for managers to take steps to verify reported  information, particularly self-reported data and other key data necessary  to determine eligibility. According to FAA officials, the law directs FAA to  register an aircraft or issue a dealer certificate that meets eligibility  requirements, but does not require FAA to verify the accuracy of the  information included in the registration application. Yet without such a  review to verify applicants’ information, FAA cannot be assured it is  appropriately determining eligibility for the approximately 71,000  applications the registry processes annually. In turn, this limits FAA’s  ability to prevent fraud and abuse of the registry from registrants engaged  in illicit activities.

Aircraft Registration and Dealer Fees  Aircraft registration costs $5 and a dealer  certificate costs $10 for initial application and  $2 for additional certificates. While these fees  are attractive to aircraft owners and dealers  for economic reasons, we previously  determined that the registration fee, in place  since 1964, did not cover the cost of  reviewing and processing an application.  Considering only inflation adjustment, the $5  fee would be $41 in 2019 dollars, which may  still be short of what the Federal Aviation  Administration (FAA) would need to cover its  expenses.  FAA has been working to increase  registration-related fees since 2013.  According to FAA officials, FAA is evaluating  regulatory strategy in light of registry  information technology modernization and  considering other regulatory priorities.

According to FAA officials, although they have the authority to collect  information for verification purposes, they do not have the tools and  resources to do so. With respect to tools, as noted earlier, FAA is making  plans to modernize registry operations by implementing streamlined and  automated processes where registration information is submitted  electronically. According to FAA officials, this is expected to improve  online data availability and allow for cross-checking information with other  data sources, such as other government databases. With respect to  resources, FAA collects a fee that is intended to cover registration  processing activities. However, the registration fee has remained the  same—$5—since 1964, and for many years has not covered FAA costs  associated with registration processing. In a 1993 report, we estimated  that FAA had forgone about $6.5 million in fees since 1968 because the  registration fee did not cover the cost of reviewing and processing an  application. Since that time, U.S. taxpayers have subsidized the  processing of aircraft registrations and dealer certificates, including legal  analysis, and covering the costs of labor, technology, postage, and other  direct and indirect expenses. GAO’s federal user fee guide states that fee  collections should be sufficient to cover the intended portion of program  costs over time, including factors such as inflation. (See sidebar.)  Without a fee that keeps pace with inflation and covers the cost of  collecting and verifying applicant information for these high-value assets,  FAA passes these costs on to U.S. taxpayers and limits the resources  available for applicant verification.

Use of Opaque Ownership Structures in Aircraft Registrations Provides Opportunities for Abuse

Individuals or entities may use opaque ownership structures—a legitimate  means to register aircraft—to disguise potential ineligibility or hide illicit  activity, according to our illustrative case and intermediary research, and  interviews with FAA and law-enforcement officials. Opaque ownership  structures are legitimate business structures that are widely used by  corporations and individuals to facilitate commerce as well as for asset  and tax management. However, we identified cases where these  structures were used to name legal entities or trusts as the owner of an  aircraft to disguise potential ineligibility or provide layers of anonymity in  support of illicit activity. The lack of transparency related to these  registrations also creates challenges for safety and law-enforcement  investigators seeking information about beneficial owners of aircraft to  support timely investigations, according to these officials.

On the basis of interviews with FAA LEAP, SEIT, and law-enforcement  officials, we identified four types of ownership structures that can be used  to register an aircraft so that the beneficial owner is not transparent. The  four types can be used alone or in combination and include the use of (1)  LLCs, (2) shell companies, (3) noncitizen trusts, and (4) U.S. citizen  corporations using voting trusts. According to our analysis of the registry’s  calendar year 2018 data, although not mutually exclusive, there were  54,549 aircraft registered to LLCs; approximately 2,300 aircraft registered  to likely shell companies; 3,300 registered as noncitizen trusts, and 4,200  registered to U.S. citizen corporations using voting trusts. The four types  of opaque ownership structures are often established by intermediaries— individuals and entities that facilitate aircraft registration for a fee, such as  by establishing legal structures and submitting aircraft registration  applications and renewals. (See sidebar.) The use of intermediaries adds  a layer of opacity to aircraft registrations. Intermediaries may not know,  and most are not required to know, beneficial owners of aircraft they help  to register. However, intermediaries that are banks are required to  establish due diligence procedures for accepting and monitoring their  clients as part of banks’ anti-money-laundering requirements under the  Bank Secrecy Act and its amendments. To obtain beneficial ownership  information, banks must identify and verify the identity of any individual  who owns 25 percent or more of a legal entity, and an individual who  controls the legal entity. Other intermediaries are not required to establish  due-diligence procedures for accepting and monitoring their clients.

Another approach that adds opacity to aircraft registrations is when  applicants use the address of a registered agent—a person or entity  authorized to accept service of process or other important legal and tax  documents on behalf of a business—as the applicant’s address. Although  the use of opaque ownership structures, intermediaries, and registered  agents can serve legitimate purposes, they can also be abused in the  context of aircraft registration to disguise potential ineligibility or hide illicit  activity, according to our analysis of registry data and research. (See app.  IV for additional details on the use of opaque ownership structures for  aircraft registration.)

In our analysis of illustrative cases involving U.S.-registered aircraft and  our intermediary research, we identified examples where opaqueness  and complexities of aircraft registrations using the ownership structures  hindered FAA’s ability to prevent abuse of the registry to facilitate other  criminal activity. In these examples, intermediaries used mechanisms  allowable under current registration requirements to register aircraft,  sometimes using multiple ownership structures for the same registration.  The first example, based on our review of FAA registration records,  illustrates opaqueness of information contained in FAA registration  records and includes the use of multiple intermediaries and jurisdictions  for an aircraft associated with asset forfeiture. The second example  illustrates the use of an intermediary in establishing opaque ownership  structures for several aircraft involved in illicit activities, including actions  subject to U.S. sanctions.

Use of multiple intermediaries and jurisdictions to obscure  ownership of aircraft. According to our review of registry documents for  this case, an intermediary registered the aircraft in 2010 using a  noncitizen trust, providing limited information about the corporate trustor,  whose beneficial owner was a high-net-worth foreign national. To register  the aircraft, the intermediary—a bank providing corporate owner trustee  services for aircraft registrations—established the noncitizen trust. The  trust agreement identified the trustor as a company established in the  British Virgin Islands. The trustor’s address for correspondence was listed  as a post office box in Switzerland, with an email address indicating  another trust company. Signatures of two trustors, identified as directors  of two other apparent intermediary companies, were illegible and omitted  printed names of individuals (see fig. 6). In 2019, the foreign national  consented to the forfeiture of this aircraft and other property to DOJ in  exchange for the release of certain other frozen assets, with both parties  agreeing that the agreement did not constitute a finding of guilt, fault,  liability, or wrongdoing.

Use of an intermediary to obscure ownership of multiple aircraft.  Between 2011 and 2018, an intermediary set up various corporations to  facilitate aircraft registrations. The intermediary was an attorney who  established the corporations using a registered agent service and also  established voting trusts for those corporations to meet U.S. citizenship  requirements for the aircraft registrations. Acting as director of these  corporations, which have indicators of being shell companies, he  registered two aircraft in 2011 and 2013. In 2019, individuals associated  with these companies were sanctioned by OFAC as part of a U.S.  sanctions program. Specifically, the individuals were designated in  connection with paying bribes and involvement in a corruption scheme  designed to take advantage of Venezuela’s currency exchange practices.  The intermediary facilitated an aircraft sale about a month prior to the  OFAC sanction designation for one aircraft and resigned from his position  as director of the other company upon the OFAC announcement. Another  aircraft registered by a company with the assistance of this intermediary  in 2012 was seized in 2016 and forfeited to the U.S. government as part  of the black-market currency exchange scheme. The investigation  revealed that the aircraft had been purchased by a U.S. corporation  whose sole beneficial owner was a Venezuelan individual using proceeds  from a scheme that involved black-market currency exchange. The U.S.  government seized the aircraft, alleging it was purchased with assets  traceable to money laundering or other illegal activities, and the aircraft  was later forfeited. Through our research on intermediaries, we  identified another aircraft in which this intermediary had been similarly  involved. Registration documents for this aircraft indicate a pattern of  activity associated with potential trade-based money laundering. We are  making a referral to DHS HSI for further investigation to determine  whether individuals associated with the aircraft may have engaged in  unlawful activity.

Opaque ownership structures pose challenges for law-enforcement  investigations. According to the 2018 National Money Laundering Risk  Assessment, federal law-enforcement agencies noted that misuse of legal  entities posed a significant money laundering risk and that law- enforcement efforts to uncover beneficial owners of companies can be  resource-intensive, especially when ownership trails lead outside the  United States or involve numerous layers. Law-enforcement officials  across multiple agencies and FAA ASH, LEAP, and SEIT officials noted  that challenges identifying beneficial owners of aircraft can impede their  investigations. According to FAA LEAP agents, it is an ongoing challenge  for them to identify beneficial owners. For example, according to FAA  LEAP agents, a secretary of a company frequently registers aircraft on  the company’s behalf and it takes time to determine the identity of the  company’s beneficial owner.

Limited PII in the registry records further impedes law-enforcement  efforts. FAA LEAP agents and law-enforcement officials from DHS HSI  and DEA described challenges they experience in their investigative work  because aircraft registration records do not contain relevant PII, as noted  above. For example, according to LEAP agents, they experience daily  challenges identifying individuals without PII, particularly those with  common names, hyphenated names, and multiple last names. This can  be particularly difficult when aircraft are registered through legal  structures, and, as DHS HSI officials noted, penetrating through the  layers of ownership can take time, slowing down investigations. Further,  one DEA official stated that without PII, identifying beneficial owners of  aircraft is a challenge in his investigations, and in two cases he was  ultimately unable to identify beneficial owners of aircraft. In prior work, we  reported on challenges that law-enforcement officials face in their  investigations when information is not available, particularly company  ownership information such as names of directors or officers.

As discussed earlier, the FAA DEA Act required FAA to promulgate  regulations—in consultation with other federal agencies, law-enforcement  officials, and representatives of the general aviation industry—that would  require individuals to provide driver’s license and taxpayer identification  numbers, but did not require applicants to provide date of birth. FAA’s  approach, however, did not require applicants to submit driver’s license  and taxpayer identification numbers. In part to serve the aviation  community, which relies on publicly available registration information for  the purchase and sale of aircraft, in 2005 FAA determined that adding PII  to the records would require restricting access to them and therefore it  would be detrimental to users of aircraft records, burdensome on aircraft  owners and the government, and not necessary for law enforcement.

FAA’s IT Modernization  The Federal Aviation Administration (FAA) is  making plans to modernize its information  technology (IT) infrastructure for the registry,  including potentially revising relevant  regulations. According to FAA, it plans,  among other things, to (1) enhance service  delivery through process improvement and  automation for near real-time access to  accurate information; (2) utilize technology to  reduce or eliminate mail, fax, or paper-driven  service requests, processing, and information  delivery; and (3) utilize technology to mine  data to support risk-based decision-making,  including the use of business intelligence  algorithms to eliminate fraud, inaccurate  information, and inappropriate use. In a May  2019 report, the Department of  Transportation (DOT) Office of Inspector  General (OIG) assessed FAA’s efforts and  plans and determined that the agency has not  identified costs, schedule, or an acquisition  strategy for IT modernization. DOT OIG  recommended, among other things, that FAA  develop a timeline for making key decisions  to implement IT modernization. See  Department of Transportation, Office of  Inspector General, FAA Plans To Modernize  Its Outdated Civil Aviation Registry Systems,  but Key Decisions and Challenges Remain,  AV2019052 (May 8, 2019)

We recognize the concerns for federal agencies associated with  collecting and storing PII as well as the potential burden for applicants to  submit such information. However, according to FAA officials, the IT  modernization for which FAA is currently in its planning stages is intended  to provide FAA the technical capability to adjust the level of access to  registry records for various users, restricting PII access for some while  allowing broader access to authorized users such as law-enforcement  agencies. (See sidebar.) Industry associations and corporate registry  users we interviewed expressed concerns about client privacy; however  they also indicated openness to future technology improvements of FAA  systems. Additionally, as noted earlier, use of PII is a key way federal  programs verify the identity and eligibility of potential beneficiaries.  Including in the planning stages of IT modernization basic elements of PII  such as name, date of birth, physical address, and a driver’s or pilot’s  license could provide FAA with the initial capability to verify applicant  information while it develops a risk-based approach informed by its risk  assessment.

According to federal internal control standards, managers should use  quality information to achieve the entity’s objectives, including obtaining  relevant data from reliable internal and external sources in a timely  manner. By not collecting and recording PII at the time of application and  renewal, FAA has limited assurance of registrants’ eligibility, and lacks  information that could support its oversight and law-enforcement officials’  ability to identify relevant persons and entities as part of investigations  involving registered aircraft.

As with applicant PII, FAA does not require applicants to submit  information on beneficial owners of aircraft—individuals and certain  entities that own more than 25 percent of the aircraft. In addition to the  federal internal control standards for managers to use quality information  to achieve the entity’s objectives, U.S. implementation of international  standards for combating money laundering and terrorism financing would  need to ensure availability of adequate, accurate, and timely information  on beneficial ownership of high-value assets. By not collecting and  recording information on beneficial owners in an electronic format that  facilitates data analytics, FAA has limited assurance of registrants’  eligibility, and lacks information that could support its oversight and law- enforcement officials’ ability to identify relevant persons and entities as  part of investigations involving registered aircraft.

FAA Uses Some Registry Information to Detect Potential Fraud and Abuse, but Registry Data Format Hinders Analysis, and Additional Data Could Support Oversight FAA Makes Some Use of Registry Information to Detect Potential Fraud and Abuse

FAA makes some use of registry information on a case-by-case basis to  detect potential fraud and abuse. FAA LEAP agents, in addition to  supporting law-enforcement officials by providing access to registry  information and specialized guidance related to aviation issues, have  conducted registry analyses to identify suspicious and potentially illicit  actors. For example, in 2018, FAA LEAP agents and registry officials  started a project to flag aircraft registrations for FAA LEAP monitoring  when applications are filed by entities or individuals, such as multiple  shell companies associated with a certain individual, suspected of  abusing registry processes. Additionally, one FAA LEAP agent told us  that he reviews aircraft registrations filed the previous day and checks  them against other information sources to determine suspicious activity,  sharing leads identified through this analysis with law-enforcement  officials for further investigation. However, this case-by-case review is  limited to the data and information FAA currently collects, and is further  hindered by a data format that does not support data analytics for fraud  and abuse detection.

Most Registry Data Are Not in a Format That Facilitates Data Analytics to Support Oversight and Risk Mitigation

FAA collects some information that could support fraud and abuse  detection and oversight. As described earlier, FAA collects information on  aircraft owners from the registration application, such as name and  address, and these data are searchable and electronically analyzable. In  April 2018, FAA also began tracking aircraft registrations that use voting  trusts to meet U.S. citizenship requirements and trusts with noncitizen  trustors, which are opaque ownership structures discussed earlier. This  included recording in ancillary files the names of individuals and entities  with potentially significant responsibilities for aircraft ownership, such as  trustors and voting trustees. Additionally, according to FAA and some  industry officials, the 3-year registration renewal implemented in 2010 has  helped improve the quality of registry data that FAA collects. According to  FAA officials, in addition to updating owner address information,  registration renewal improves data quality as it prompts (1) reports of  unreported aircraft sales, (2) new registrations due to ownership changes,  and (3) cancelations due to destruction, scrapping, and exports. However,  the benefits of registration renewal for data-quality purposes could  diminish when the renewal period for noncommercial general aviation  aircraft changes from 3 to 7 years, in alignment with new requirements  from the FAA Reauthorization Act of 2018.

Nevertheless, most of the information that FAA collects in the ancillary  files and elsewhere is not recorded in a format that facilitates data  analytics, according to our review of FAA’s registry system. Specifically,  data on individuals and legal entities with potentially significant  responsibilities for aircraft ownership such as trustors, beneficiaries,  stockholders, directors, and managers are stored as imaged PDF records  that, due to information-system limitations, cannot facilitate data analytics.  For example, information on LLC directors and managers as well as  directors, managers, and stockholders of U.S. citizen corporations that  use voting trusts is stored in imaged records. Our intermediary research  identified an aircraft registered to a company whose sole stockholder was  subject to U.S. sanctions; however, FAA currently stores data on foreign  stockholders of U.S. citizen corporations that use voting trusts in PDF  records, preventing it from being able to conduct data analysis to identify  such individuals or entities for all registrations. Such data may be useful  in identifying entities and individuals subject to U.S. sanctions, as  discussed below.

Additionally, the current system configuration limits FAA to viewing  individual records within the ancillary files. This configuration prevents  agency officials from tracking aircraft registration numbers—a common  identifier—across records or linking them to the registration data portion  of the registry. Further, FAA internally tracks noncitizen trusts and U.S.  citizen corporations using voting trusts as one category within registry  data, preventing analysis and monitoring of each group of registrations.  Lastly, FAA stores records of declarations of international operations— requests that expedite registration processing for aircraft intending to  travel outside the United States—as imaged PDF records, so information  about the aircraft, owner’s name, departure and destination locations,  date of intended travel, and name of the individual submitting the  declaration are not in a format that facilitates data analytics. According to  2017–2018 analysis of information from declarations of international  operations with checks against flight history data, FAA SEIT identified  patterns of activity that could be used in support of safety and law- enforcement investigations, as discussed later in this report.

Furthermore, due to manual data entry and lack of verification, the  registry’s postal data may not support effective data analytics and  oversight. FAA staff also have the option to override the formatting  prompts produced by its address validation software. Our analysis of  2018 physical and mailing address data found that about 25,000 (9  percent) of all registrant addresses did not match a valid address in the  USPS postal verification data, while just over 300 (about 3 percent) of all  dealer addresses did not match. Of the seven aircraft registration cases  we selected based on address category and locality, we found three  registrant addresses that indicated a registry data-quality issue and one  that did not. Specifically, our review of the application forms for two  registrants showed that a physical address was provided by the  registrants, but was not recorded in the physical address file. In another  case, our review of five registration records for one company showed that  FAA revoked registrations for the five aircraft in 1971, but did not  deregister them until 2019, sending deregistration notification letters to  the original address, which were returned as undeliverable. We did not  find any noncompliance in the last case and, based on our review of  aircraft registration documents, determined that a change of address form  was provided to FAA following the most-recent renewal, but the new  address had not yet been updated at the time we received the physical  address data.

As described earlier, FAA is taking steps to modernize its IT system for  the registry because it is outdated. According to a recent DOT OIG report,  the system had its last significant upgrade in 2008, is approaching the  end of its service life, suffers intermittent outages, and uses an outdated  programming language. According to FAA, the future system is  expected to streamline and automate processes, allow for the submission  of electronic forms, improve online data availability, and implement  additional security controls, such as software that can cross-check aircraft  registrations with other government databases. In December 2018 and  June 2019, FAA issued requests for information to conduct a market  survey and to develop a strategy based on feedback received,  respectively. As of November 2019, FAA was making plans to issue a  request for proposal, but did not identify specific time frames. Registry  system modernization presents an opportunity to mitigate data format  limitations as FAA designs new systems and controls.

According to federal internal control standards, managers should use  quality information to achieve the entity’s objectives. Managers can do  that by designing processes and identifying information requirements  needed to achieve objectives and address risks as well as by processing  obtained data into quality information that supports the internal control  system. This could include electronically analyzable information from  declarations of international operations and information on owners and  related individuals and entities with potential significant responsibilities for  aircraft ownership such as beneficial owners, trustors, trustees,  stockholders, directors, and managers. Without analyzable data on  significant parties involved in aircraft registrations that can be linked  through a common identifier, FAA is limited in its ability to exercise its  domestic and international oversight functions and fully support safety  and law-enforcement investigations.

Analyzing Registry Data with Other Data Sets Could Assist in FAA’s Detection of Fraud and Abuse Risks

Use of data analytics to detect suspicious activity, anomalies, or patterns  is one of the leading practices identified in GAO’s Fraud Risk  Framework. However, registry officials primarily use collected data to  send automated notifications, such as for aircraft renewals, and current  use of data to support oversight is limited, in part hindered by data format  limitations described earlier. In addition, registry officials do not analyze  various external data sources against registry data to detect patterns of  potential fraud or abuse. Risk indicators identified through such analyses  may serve as points of inquiry for a broader fraud risk assessment, or for  further examination of conduct that may pose criminal, national security,  or safety risks.

To demonstrate how FAA could identify registrations with indicators of  potential fraud or abuse that may enable criminal activity, national  security, and safety risks, we analyzed aircraft registry and related data.  Specifically, we analyzed aircraft registry data from publicly available and  ancillary files, as well as matched registry data against other datasets to  identify (1) registrations using registered agent address, (2) registrations  using opaque ownership structures, (3) aircraft registration addresses  located in countries identified by the Department of State as associated  with major illicit drug production and money laundering, (4) OFAC data on  individuals and entities subject to U.S. sanctions, and (5) NTSB safety  accident and incident reports. Based on this analysis, we found over  17,000 registrations out of approximately 300,000 registrations  associated with one or more risk indicators for fraud or abuse. The  majority of registrations (over 15,000 or about 90 percent) were  associated with one risk indicator, about 2,000 registrations (10 percent)  were associated with two risk indicators, and the remaining 140 (1  percent) were associated with three or more risk indicators. The results of  our various analyses are described below.

Use of registered agent address. As discussed earlier, registered  agents are authorized to accept legal documents on behalf of a business.  According to FAA officials, FAA will accept the use of a registered agent’s  address as a mailing address, provided the owner’s physical address is  also included. Our analysis of registry data identified cases where a  registered agent’s address was recorded as the registrant’s physical  address. The registry data do not specifically identify registered agents,  but by analyzing address information for calendar year 2018, we identified  at least 4,080 cases using registered agents’ addresses. For one of the  registered agents we were able to confirm, we identified 965 associated  registrations, including about 300 registrations associated with  characteristics of a likely shell company or that were a noncitizen trust or  a U.S. citizen corporation using a voting trust. Further, for this one  registered agent, we identified about 280 unique business names,  associated with about 760 registrations, which used this registered  agent’s address on aircraft registration applications. Additionally, based  on our analysis of postal address data provided by FAA as well as  verification of selected cases, we identified and confirmed through site  inspections two additional registered agents whose addresses were used  in over 100 registrations and over 3,220 registrations, respectively. Use  of registered agent addresses, when not accompanied by physical  address information, particularly in combination with opaque ownership  structures, provides a layer of anonymity to beneficial owners of aircraft  and may mask ineligibility or illicit actors.

Noncitizen trusts and U.S. citizen corporations using voting trusts.  We reviewed internal FAA trust data from April 2018 through May 2019— the full range of data available at the time of our review—to identify the  number of registrants that were noncitizen trusts or were U.S. citizen  corporations using a voting trust. In total, we found about 6,800 such  registrations contained in the registry data. Of these registrations, two  were associated with individuals subject to U.S. sanctions, four were  associated with an FAA revocation or suspension, and 16 appeared to be  shell companies. FAA regulations allow for registrations using noncitizen  trusts and U.S. citizen corporations using voting trusts as valid means of enabling registrants to meet FAA’s citizenship requirements. However,  as discussed earlier and according to FAA and law-enforcement officials,  registrations using noncitizen trusts and U.S. citizen corporations using  voting trusts may also mask ineligibility or illicit actors. Consistent with  their program-management responsibilities, if FAA registry officials detect  aircraft owners, dealers, or intermediaries potentially abusing registration  requirements or abusive use of noncitizen or voting trusts, they may send  them warnings of denial of future services if observed abusive actions  continue. For example, if registry officials suspect that an entity applying  for registration is misrepresenting its citizenship, officials could request  citizenship information as appropriate for the president, board of directors,  and managing officers. If the inquiry results in a determination that the  entity does not qualify as a citizen, FAA could deny the application or  issue a letter of apparent ineffectiveness for an existing registration.  However, according to FAA officials, they take mitigation actions on a  case-by-case basis because they do not have a systematic way to  analyze data and detect potential fraud and abuse.

Department of State country lists associated with major illicit drug  production and money laundering. We analyzed registry address data  using lists of countries associated with major illicit drug production and  money laundering published by the Department of State to identify aircraft  registrations associated with such countries. We found 251 registrations  with addresses located in countries on the Department of State’s list of  money laundering jurisdictions that were registered as noncitizen trusts or  corporations using voting trusts. Countries identified in the Department of  State’s lists do not necessarily indicate that a registration is associated  with criminal activity. However, the risk of abuse or illicit activity with these  registrations may be increased when combined with the use of opaque  ownership structures, another risk indicator that, according to FAA and  law-enforcement officials, may mask ineligibility or illicit activity.

U.S. sanctions. We analyzed and matched registry data to U.S.  sanctions data that contain information on blocked assets and sanctioned  entities and individuals. Through this data analysis as well as illustrative  case and intermediary research, we identified six aircraft owned by  entities subject to Venezuela-related U.S. sanctions from 2017 to  February 2019. These six aircraft involved registrations established by  intermediaries using noncitizen trusts or by U.S. citizen corporations  using voting trusts, where aircraft were beneficially owned by noncitizen  trustors or stockholders of companies using voting trusts to meet U.S.  citizenship registration requirements. However, as discussed earlier, trust  agreements that contain information on aircraft owners and related  individuals and entities with potentially significant responsibilities for  aircraft ownership are stored in PDF format that are not electronically  analyzable, potentially inhibiting detection of sanctioned individuals or  entities. Additionally, our analysis identified limitations in the sharing of  sanctions information within FAA, specifically between the aircraft registry  and dealer records. These limitations present the risk of registry abuse or  illicit activity through sanctions violations while potentially impeding  effective coordination between FAA and Treasury’s OFAC, which  administers U.S. sanctions programs.

On the basis of U.S. national security and foreign policy goals, OFAC can  impose controls on transactions and block or freeze assets under U.S.  jurisdiction, including aircraft. By blocking an asset such as an aircraft,  its title remains with the targeted individual or entity; however, these  individuals and entities cannot exercise the powers and privileges  normally associated with ownership unless authorized by OFAC. Certain  activities related to the use of the aircraft may violate the relevant  sanctions program. Additionally, OFAC regulations generally prohibit  persons and entities within the United States from engaging in  transactions involving blocked property—including U.S-incorporated  companies and aircraft—of sanctioned individuals and entities.

OFAC-Sanctioned Aircraft  One of the U.S.-registered aircraft about  which Treasury’s Office of Foreign Assets  Control (OFAC) notified the Federal Aviation  Administration (FAA) was used as part of an  illicit narcotics trafficking scheme. According  to its 2017 announcement, OFAC designated  a high-ranking Venezuela government official  as a Specially Designated Narcotics  Trafficker pursuant to the Foreign Narcotics  Kingpin Designation Act (“Kingpin Act”) for  playing a significant role in international  narcotics trafficking. According to OFAC, the  sanctioned official used a front man who  laundered drug proceeds and purchased  assets. In addition to a network of  international companies, according to OFAC,  the front man owned or controlled five U.S.  companies, including a limited liability  company (LLC) that registered an aircraft with  FAA and used a voting trust to meet U.S.  citizenship requirements. As part of its action,  OFAC identified the U.S.-registered aircraft  and the LLC as blocked property.   FAA deregistered the aircraft in 2019 after  registration renewal documentation submitted  to FAA contained numerous errors. However,  because the flags placed on sanctioned  individuals’ and entities’ registration records  do not extend to dealer records, FAA issued  a dealer certificate to the blocked LLC after  the OFAC designation and without  coordination with OFAC, according to FAA  records and officials. The blocked LLC held  the dealer certificate for a year until the  certificate expired. (See app. I.)

FAA relies on OFAC to share information on sanctions and does not  check whether applicants and aircraft are subject to U.S. sanctions or  blocking at registration, at renewal, or on a periodic basis. Specifically,  FAA does not proactively obtain and use OFAC data to detect (1) blocked  aircraft, (2) entities or individuals subject to sanctions, or (3) those with  potentially significant responsibilities for aircraft ownership, such as  intermediaries registering on behalf of blocked aircraft or entities. Our  analysis of the six cases revealed that OFAC officials initiated  coordination with FAA, notifying FAA about four of the six cases.

According to FAA officials, when FAA finds out about a blocking action  from OFAC, it internally flags registry records and will withhold  registration processing actions until further communication with OFAC.  However, according to FAA officials, FAA does not have the authority to  deny or revoke a registration solely because the registration is associated  with an individual subject to OFAC sanctions. Accordingly, in those  instances, FAA would register the aircraft or the aircraft’s registration  would remain valid. In addition, although FAA flags sanctioned  individuals’ and entities’ registry records, the flags do not extend to dealer  certificate records. As a result, sanctioned individuals or entities flagged  in aircraft registration records are not flagged by FAA for OFAC  coordination before receiving a dealer certificate, which could allow  operation of blocked aircraft under that certificate. One of the six cases  we identified illustrates the criminal and national security risks involved  with the use of U.S.-registered aircraft by OFAC-sanctioned individuals  and entities, as well as risk-management challenges associated with  dealer certificates. (See sidebar.)

OFAC efforts to identify aircraft assets associated with sanctioned  individuals and entities can encounter obstacles. According to OFAC  officials, they search the publicly available FAA registry to identify aircraft  for potential blocking. Where OFAC is aware that a sanctioned individual  has control of a company, and the company had directly registered an  aircraft, a search of the public database can provide relevant information  about the aircraft. However, according to OFAC officials, identifying  aircraft is more challenging when, for example, a voting trust or a shell  company is the registered owner. As a result, OFAC does not have all the  information from FAA it might need to support its investigations or  enforcement when aircraft associated with sanctioned entities and  individuals are not readily identifiable.

FAA’s IT modernization provides an opportunity for FAA to link flagged  records across aircraft registration and dealer systems and to proactively  check OFAC sanctions data. OFAC provides information on individuals  and entities subject to sanctions on its website that can be checked using  online searches or by downloading data, but FAA officials said that  checking sanctions designations would require resources and extend  processing time for aircraft registrations. However, automated linkages  across aircraft registration and dealer systems, and checks of OFAC  information, could be achieved through FAA IT modernization, which aims  to automate near-real time access to accurate information. An aspect of  the modernization project could involve automatically cross-referencing  sanctions data, which are dynamic and updated in real time in response  to U.S. sanctions programs, with aircraft registration information on  owners and related individuals and entities with potentially significant  responsibilities for aircraft ownership, such as intermediaries. FAA noted  that it does not have authority to deny or revoke a registration based  solely on an OFAC sanctions designation. Nevertheless, records that are  flagged across aircraft registration and dealer systems, as well as  awareness of blocked aircraft, sanctioned owners, or intermediaries doing  business with sanctioned entities, would help to ensure coordinated  actions with OFAC. Such coordination would allow OFAC to seek a delay  from FAA of the registration or dealer certification, to alert law- enforcement agencies to determine aircraft location, or to coordinate with  its U.S. partner agencies on investigations as appropriate. By not linking  flagged records across systems and not proactively checking OFAC  sanctions data, FAA and OFAC may be unaware of, and therefore not  well-positioned to manage, risks associated with registration of blocked  aircraft, sanctioned entities, or intermediaries operating in violation of U.S.  sanctions. In addition, FAA misses opportunities to address abuse of the  registry for illicit purposes, as well as to provide information to OFAC in  support of U.S. efforts to curb drug trafficking, corruption, and other illicit  activity.

Aircraft primarily operating outside the United States. According to  our analysis of NTSB data, we identified 303 cases of U.S.-registered  aircraft involved in accidents and incidents outside the United States from  calendar years 2010 to 2018. According to FAA officials and our  illustrative case research, U.S.-registered aircraft that are primarily based  and operated outside the United States may be associated with risk of  registration abuse. For example, FAA SEIT and LEAP officials told us that  they were aware of numerous cases of aircraft operated primarily outside  the United States that were registered to nominee buyers. In addition,  they noted international operation of aircraft that were associated with  illicit activity and registration violations such as bills of sale identifying  foreign owners and cloned registrations.

A 2010 case involving a U.S.-registered aircraft seized for alleged drug  trafficking by the Panamanian government highlights registration violation  risks related to aircraft primarily operating outside the United States. After  Panama seized the aircraft, it was turned over to the country’s civil  aviation authority (CAA), which registered the aircraft in Panama and  painted a Panamanian registration number on it. According to FAA  officials, the CAA did not seek to deregister the aircraft from the United  States, and the new registration was likely invalid under international law.  According to FAA officials, the Panamanian CAA operated the aircraft for  about 1 year before it crashed. During that time, the aircraft remained  registered to the original U.S. owner at a registered agent address. FAA  sent multiple letters to the owner to deregister the aircraft and also when  the aircraft registration was expiring, but all were returned as refused by  the registered agent.

Multiple Safety Violations Contributed to  the Crash of an Aircraft Primarily  Operating Outside the United States  Our research identified a case where safety  violations contributed to a fatal accident in the  Caribbean involving a U.S.-registered aircraft  in 2016. A Jamaican aviation training center  was operating the aircraft since 2015 and at  the time of the crash. The accident  investigation by Jamaican authorities  identified multiple safety deficiencies as the  causes and contributing factors of the crash.  This included falsified aircraft maintenance  records, an engine replacement that did not  conform to aircraft model and type, and the  use of non-U.S.-certified maintenance  programs. (See app. I.)

Furthermore, aircraft that are based and primarily operated outside the  United States may pose safety risks by not meeting FAA aircraft  maintenance standards. Once registered with FAA, aircraft owners must  continue to meet eligibility requirements and, along with operators,  comply with certain maintenance responsibilities in order to operate,  regardless of their location. According to FAA officials, U.S.-registered  aircraft operating outside the United States may receive less scrutiny and  inspections from other countries’ CAAs, and nefarious actors prefer a  U.S. registration when aircraft are inspected abroad. Additionally, FAA  SEIT and LEAP officials told us that they were aware of many U.S.- registered aircraft primarily operating in Latin American countries that  may not be following required U.S. maintenance programs, thus posing  aviation safety risks. One of our case studies highlights safety risks  related to U.S.-registered aircraft that are primarily based and operated  outside the United States. (See sidebar.)

In another example involving 2011 and 2013 FAA examinations, an FAA  maintenance inspector conducted inspections of U.S.-registered  helicopters and airplanes located in Panama at the request of the  Panama CAA and found multiple violations. According to FAA, the  inspection of 16 aircraft initially found that, in addition to registration  issues such as flying with a temporary registration, ten aircraft had  maintenance issues, including maintenance performed by nonauthorized  personnel. At least seven of the issues identified during this inspection  resulted in FAA enforcement actions. According to this official, two of the  aircraft had significant maintenance concerns and were not airworthy. On  the basis of his experience inspecting aircraft domestically, safety  violations among the aircraft inspected in Panama were more significant.  In combination with other data sources and information, flight history data  can provide indications of safety risks associated with aircraft based and  primarily operated outside the United States. However, according to  registry officials, they do not use these data to identify such risks.

To examine specific registrations based on the entire risk-indicator data  analysis, we also reviewed randomly selected aircraft registrations across each overall risk-indicator category. Our review of 20 selected  registrations generally confirmed the risk-indicator characteristics we had  identified for analysis. We did not identify further indicators of risk as part  of this review except for the OFAC cases described earlier.

Analysis of various data sources, alone or in combination, can help detect  patterns of potential fraud or abuse. As demonstrated by our analysis,  FAA data, such as postal addresses, information on dealers, noncitizen  corporations, intermediaries, and entities with significant responsibilities  for aircraft ownership, among others, along with various external  databases could be used for such a purpose. FAA also has access to  flight history data, currently used on an ad hoc basis, but which could also  serve for (1) routine oversight functions such a verifying aircraft are based  and primarily operating in the United States for certain registrant types or  (2) to detect patterns of activity associated with declarations of  international operations that could be used in support of safety and law- enforcement investigations. In addition, our analysis of registry data  against external data sources, such as OFAC sanctions lists, illustrates  the utility of such analyses for detecting registrant risks. FAA currently  does not use internal or external information for such analysis or to assist  in safety or law-enforcement oversight responsibilities across multiple  aircraft, registrations, or dealer certificates. This is due, in part, to data  limitations, but also because, according to registry officials, their role is  primarily focused on recording of aircraft registration information. Aircraft  registration data made available through IT modernization, as well as  other currently available data, could support ongoing monitoring and risk- based oversight by FAA.

Federal internal control standards call on managers to establish and  operate activities to monitor the internal control system and evaluate  results. By not analyzing available internal and external data, FAA is  missing opportunities to identify registrant risks, conduct oversight, and  safeguard the registry from potential fraud and abuse. Furthermore, while  FAA registry officials may take risk-based mitigation actions, such as by  sending warnings letters or denying services if abusive actions are  detected, it generally does not take such action. According to FAA  officials, the registry focuses on recording information, while it is currently  the responsibility of other FAA organizations, such as ASH, LEAP, and  SEIT, to detect fraud. However, federal internal control standards require  managers to respond to risks by remediating internal control deficiencies  on a timely basis. Without timely and measured risk-based mitigation  actions, the aircraft registry continues to be vulnerable to fraud and  abuse. In this context, as the key program office, aircraft registry is best  positioned to manage fraud and abuse risks—by preventing, detecting,  and responding to risks—in close coordination with stakeholder  organizations such as ASH, LEAP, and SEIT.

FAA and Law- Enforcement Agencies Have Mechanisms to Respond to Registration Fraud and Abuse Risks, but Collaboration Is Not Formalized FAA Can Take Administrative Actions, and Law-Enforcement Agencies Can Seize Aircraft

FAA and law-enforcement agencies have a variety of enforcement  mechanisms to respond to instances of suspected fraud and abuse in  aircraft registrations. For example, FAA can use administrative actions,  such as aircraft registration suspensions and revocations, and law- enforcement agencies can use civil actions and criminal prosecutions to  seize aircraft, among other enforcement actions. Law-enforcement  agencies such as DEA, DHS HSI, and DOT OIG have authority to  investigate criminal activity and take actions to seize aircraft when  warranted.

FAA and Law-Enforcement Agencies Have Established a Task Force, but Coordination Remains Informal

Recognizing the need for better dialogue and coordination, in August  2017 FAA LEAP agents launched the Aircraft Registry Task Force to  discuss ideas and solutions for dealing with potentially fraudulent aircraft  registrations and to improve FAA processes to assist the law-enforcement  community. The first meeting, in August 2017, included participants from  FAA—aircraft registry officials, legal counsel, ASH, LEAP, and SEIT—as  well as other federal agencies, including DEA and DHS HSI. This meeting  was the first time these various units came together to discuss aircraft  registry vulnerabilities. FAA and law-enforcement officials presented  cases associated with fraudulent aircraft registrations, highlighting safety  implications. Participants also discussed issues related to deregistration,  and aircraft seizures, among others. According to aircraft registry officials  and FAA LEAP agents, the task force meeting discussions resulted in  several changes, including revisions to the signature block in the aircraft  application form, addition of a separate registration type for LLCs for  tracking purposes, and sharing of declarations of international operations  with FAA LEAP and SEIT. Specifically, regarding modifications to the  signature block, in 2018 FAA added a statement requiring applicants to  certify that information they provide is true and accurate while also  identifying specific penalties for false information.

The subsequent task force meeting, held in October 2018, included only  FAA participants. Aircraft registry officials, legal counsel, ASH, LEAP, and  SEIT, among others, discussed follow-up from the previous meeting and  covered topics associated with ongoing concerns such as falsification of  registration documents, incomplete applications, and proof of citizenship,  among others. According to FAA officials, since the October 2018  meeting, the task force has not met.

FAA and DEA have also established informal mechanisms to address  registration violations and safety risks associated with aircraft based and  operated outside the United States. For example, in 2016 and 2017, DEA  and FAA LEAP and SEIT officials conducted a joint initiative at the  request of the government of Guatemala to examine multiple U.S.- registered aircraft located in Guatemala. According to FAA, a total of 81  U.S.-registered aircraft were inspected through this effort as of April 2017.  During the inspections, FAA identified more than 25 registration violations  and numerous safety violations resulting in approximately 31 condition  notices. Additionally, authorities seized eight aircraft with an  approximate value of $2.5 million as well as over 400 kilograms of  cocaine. According to FAA, registration violations identified during this  effort included inconsistencies with trust agreements and associated  documentation, violations involving U.S. corporations having individuals  listed as president who do not meet U.S. citizenship requirements, and  documentation allowing non-U.S. citizens to control U.S.-citizen entities  that had registered aircraft. Since then, according to FAA officials, on the  basis of the results of this initiative, DEA and FAA officials have  conducted similar visits to other countries in Latin America and the  Caribbean. The visits typically include training for local CAA officials on  authorities to inspect U.S.-registered aircraft, ramp checks of U.S.- registered aircraft located in these countries, and maintenance  inspections.

FAA and DHS HSI also use informal collaboration mechanisms to support  law-enforcement investigations. According to DHS HSI officials, they have  a robust relationship with an FAA LEAP agent with whom they  communicate on a daily basis. This agent has helped to investigate  aircraft sale transactions and other cases and also provided leads to DHS  HSI officials.

Declarations of International Operations  The Convention on International Civil Aviation  requires registration certificates for  international operations. The Federal Aviation  Administration’s typical registration process  takes 16–20 working days, during which  applicants may fly domestically using a  temporary registration. Registry officials have  put in place declarations of international  operations for applicants to notify the registry  of the intent to operate internationally thereby  expediting typical processing time to the  same day or next day.

FAA registry officials have been sharing expedited registration filings— declarations of international operations to expedite registration processing  for aircraft intending to travel internationally—with FAA LEAP and SEIT  officials for monitoring and analysis purposes. (See sidebar.) However,  this informal collaboration does not extend to FAA sharing of declarations  of international operations with DHS HSI or DEA. According to law- enforcement officials, declarations of international operations present  challenges. Specifically, DEA officials noted that expedited registrations  limit the amount of time law enforcement can effectively query appropriate  sources of information to determine that payment for the aircraft is not  derived from illicit proceeds. In addition, according to DEA officials,  expedited registrations shorten the amount of time investigators have to  determine whether the aircraft is being used to facilitate drug crimes and  to identify beneficial owners of the aircraft, which, as discussed earlier in  this report, can be a time-consuming process.

The lack of notification about declarations of international operations  further compounds these challenges. DHS HSI officials explained that  they have experienced challenges not receiving information from  expedited registrations, which could have allowed some illicit actors to  expediently move or export aircraft out of the country, including as part of  trade-based money laundering or trafficking schemes. According to these  officials, aircraft can be purchased with illicit proceeds to launder money  as well as used to smuggle illicit cargo such as persons, cash, cigarettes,  and liquor. DHS HSI officials stated that, in one case, which resulted in  aircraft seizure, the aircraft potentially could have been seized 2 years  earlier if they had received declaration of international operations at the  time of aircraft registration. Additionally, according to DHS HSI officials,  information from declarations of international operations could help to  generate leads, including information on planned travel to countries that  are associated with illicit drug trafficking or money laundering. For  example, they noted that in investigations of trade-based money  laundering schemes, information from declarations of international  operations can be used to check against shipping export declarations and  trade data from other countries.

Separately, in our analysis of aircraft registered to entities subject to U.S.  sanctions described earlier, we found that five of the six aircraft  registrations received expedited processing. Although not a precise  indicator of actual travel, information from declarations of international  operations could provide timely information about potential planned  movement of aircraft in time-sensitive situations as well as bring  awareness for longer-term investigative purposes. Expedited registrations  provide more immediate opportunity to move aircraft out of the country  and information on applicants’ intention to do so, which can inform  monitoring and law-enforcement action. However, FAA does not provide  declarations of international operations to DHS HSI or DEA. Without  declarations of international operations, these law-enforcement entities  may be missing opportunities to generate leads that would ultimately  support FAA’s interests in addressing abuse of the registry for illicit  purposes and support detection and response to potential trade-based  money laundering and other cross-border schemes.

Our prior work on interagency collaboration identified practices that can  help enhance and sustain collaboration among federal agencies,  including written agreements and use of liaison positions. Agencies that  articulate their agreements in formal documents, such as memorandums  of understanding, can strengthen their commitment to working  collaboratively. Additionally, articulating a common outcome and roles  and responsibilities in a written document can facilitate coordination.  Similarly, the use of liaison positions, when an employee of one  organization is assigned to work primarily or exclusively with another  agency, can enhance coordination. For example, by providing direct  access to agency information, liaison positions have helped to facilitate  sharing of information and coordination of missions and activities.

As relatively new and unofficial collaboration mechanisms, the Aircraft  Registry Task Force and other efforts have not been fully utilized or  leveraged some of the enhanced collaboration practices such as written  agreements or liaison positions at law-enforcement agencies. While FAA  LEAP agents coordinate with law-enforcement officials, these are not  liaison positions as suggested by leading practices for collaboration,  wherein an employee is assigned to or works primarily with another  agency and has direct access to agency staff and information, and  arrangements are formally outlined, such as in memorandums of  understanding. Rather, FAA LEAP agents are assigned to FAA and do  not have formal agreements for collaboration. The Aircraft Registry Task  Force holds potential for FAA to work collaboratively internally and  externally by formalizing various informal coordination efforts, such as  international inspections by FAA and DEA and sharing of declarations of  international operations with law-enforcement agencies, to bring together  varied perspectives, functions, and skill sets necessary to mitigate aircraft  registry vulnerabilities going forward. Leading practices in risk  management also call for involvement of relevant stakeholders as part of  risk-assessment and risk-mitigation activities. In the FAA context, the  aircraft registry is best positioned to develop preventive measures and  controls in coordination with FAA LEAP, SEIT, and law-enforcement  stakeholders.

FAA’s aircraft registry, the largest in the world, is preferred by aircraft  owners for safety, economic, and financial reasons. Accordingly, the  integrity of owner information for registry users is important to support  these benefits. It is also important to ensure the registry is not exploited  for fraudulent purposes or to support illicit activity involving U.S.- registered aircraft. FAA’s current process does not include strong controls  to prevent ineligible registrants and potential fraud and abuse, instead  allowing registrants to self-certify their information with limited  independent review. A comprehensive registry risk assessment could  help to manage risks of fraud and abuse, which enable criminal, national  security, and other risks. Such a risk assessment, which considers  inherent and residual risks as well as determination of likelihood, impact,  and risk tolerance, would support the development of a risk-based  strategy and approach to guide registry actions in preventing, detecting,  and responding to fraud and abuse risks.

To support its eligibility determinations, FAA currently obtains limited PII  from individual registrants, aircraft dealers, or those entities (e.g., trustors)  who might have a significant role in aircraft registrations. Additionally, the  registry lacks information about beneficial owners of aircraft. Further, the  registry generally accepts self-certification of eligibility and aircraft  ownership and does not verify the information it receives. Such an  approach may be appropriate for the majority of law-abiding registrants,  but it leaves the registry vulnerable to exploitation by those who wish to  circumvent eligibility requirements, disregard safety standards, or pursue  criminal activities. Limited transparency into who beneficially owns aircraft  has also precluded FAA from maximizing its collaboration with partners in  the law-enforcement and safety communities to support detection and  investigation of criminal, national security, and safety risks associated  with registered aircraft.

U.S. taxpayers have subsidized the costs of aircraft registration for  several decades. Without a change to aircraft registration and dealer  fees, the costs of FAA labor, technology, coordination, and risk-based  oversight for these high-value assets would continue to be borne by the  public and limit resources available for applicant verification.

The absence of more and electronically analyzable information has  substantially hindered FAA’s ability to use the registry as a tool to detect  potential fraud and abuse and to oversee registered aircraft. As part of its  ongoing IT modernization, FAA has an opportunity to collect such data  and record them in a format that facilitates data analytics. These data  could help FAA detect potential fraud and abuse and conduct preventive,  risk-based monitoring and oversight of aircraft registrations as well as  dealer certifications to ensure the integrity of the registry. They would also  support a risk-based approach for verifying information provided by some  registry applicants as well as for taking corrective actions. Additional  information would position FAA to more broadly prevent, detect, and  respond to risks associated with the aircraft registry and to facilitate data  analytics by FAA and stakeholders for oversight, safety, and law- enforcement purposes. For example, FAA officials could analyze data  patterns for potential fraud and abuse, as well as share data across  dealer and aircraft records and to check OFAC sanctions data to ensure  that they coordinate about owners with sanctions designations, as  appropriate.

Lastly, FAA lacks formal agreements with other federal entities to respond  to risks. Specifically, FAA can provide additional support to law- enforcement and safety investigations by sharing quality information  about individuals and entities with potentially significant responsibilities in  aircraft registrations, as well as other registration information, such as  declarations of international operations. FAA’s Aircraft Registry Task  Force positions FAA to work collaboratively internally—among officials  from the aircraft registry, legal counsel, ASH, LEAP, and SEIT—and with  external law-enforcement to share information and to take advantage of  collaborative mechanisms to formalize coordination.

We are making the following 15 recommendations to FAA:  The Administrator of FAA should conduct and document a risk  assessment that considers inherent and residual fraud and abuse risks  that may enable criminal, national security, or safety risks.  (Recommendation 1)

The Administrator of FAA should determine impact, likelihood, and risk  tolerance as part of a risk assessment. (Recommendation 2)

The Administrator of FAA should develop a strategy that outlines specific  actions to address analyzed risks, including periodic assessments to  evaluate continuing effectiveness of the risk response. (Recommendation  3)

The Administrator of FAA should collect and record information on  individual registrants, initially including name, address, date of birth, and  driver’s license or pilot’s license, or both, with subsequent PII elements  informed by the risk assessment, once completed. (Recommendation 4)

The Administrator of FAA should collect and record information on legal  entities not traded publicly—on each individual and entity that owns more  than 25 percent of the aircraft; for individuals: name, date of birth,  physical address, and driver’s license or pilot’s license, or both; and for  entities: name, physical address, state of residence, and taxpayer  identification number. (Recommendation 5)

The Administrator of FAA should verify aircraft registration applicants’ and  dealers’ eligibility and information. (Recommendation 6)

The Administrator of FAA should increase aircraft registration and dealer  fees to ensure the fees are sufficient to cover the costs of FAA efforts to  collect and verify applicant information while keeping pace with inflation.  (Recommendation 7)

The Administrator of FAA should ensure, as part of aircraft registry IT  modernization, that information currently collected in ancillary files or in  PDF format on (1) owners and related individuals and entities with  potentially significant responsibilities for aircraft ownership (e.g.,  beneficial owners, trustors, trustees, beneficiaries, stockholders,  directors, and managers) and (2) declarations of international operations  is recorded in an electronic format that facilitates data analytics by FAA  and its stakeholders. (Recommendation 8)

The Administrator of FAA should link information on owners and related  individuals and entities with significant responsibilities for aircraft  ownership through a common identifier. (Recommendation 9)

The Administrator of FAA should, as part of IT modernization, develop an  approach to check OFAC sanctions data on owners and related  individuals and entities with potentially significant responsibilities for  aircraft ownership for coordination with OFAC and to flag sanctioned  individuals and entities across aircraft registration and dealer systems.  (Recommendation 10)

The Administrator of FAA should use data collected as part of IT  modernization as well as current data sources to identify and analyze  patterns of activity indicative of fraud or abuse, based on information from  declarations of international operations, postal addresses, sanctions  listings, and other sources, and information on dealers, noncitizen  corporations, and individuals and entities with significant responsibilities  for aircraft ownership. (Recommendation 11)

The Administrator of FAA should develop and implement risk-based  mitigation actions to address potential fraud and abuse identified through  data analyses. (Recommendation 12)

The Administrator of FAA should develop mechanisms, including  regulations if necessary, for dealer suspension and revocation.  (Recommendation 13)

The Administrator of FAA, in coordination with relevant law-enforcement  agencies, should enhance coordination within the Aircraft Registry Task  Force through collaborative mechanisms such as written agreements and  use of liaison positions. (Recommendation 14)

The Administrator of FAA, in coordination with relevant law-enforcement  agencies, should develop a mechanism to provide declarations of  international operations for law-enforcement purposes. (Recommendation  15)

We provided a draft of this product to DOT, DOJ, DHS, and Treasury for  review and comment. DOT provided written comments, which are  reproduced in appendix V. DOT concurred with our recommendations.  Specifically, DOT stated that it supports other government agencies in  addressing illegal activities and enforcing U.S. sanctions and agreed that  enhancements to the accuracy of registry information would expedite  enforcement actions and reduce the risk of ineligible aircraft registrations.  FAA and DHS provided technical comments, which we incorporated as  appropriate. DOJ and Treasury did not have any comments.

We are sending copies of this report to the appropriate congressional  committees, the Secretary of Transportation, the Attorney General, the  Secretary of Homeland Security, the Secretary of the Treasury, and other  interested parties. In addition, the report is available at no charge on the  GAO website at http://www.gao.gov.

If you or your staff members have any questions about this report, please  contact me at 202-512-6722 or shear@gao.gov. Contact points for our  Offices of Congressional Relations and Public Affairs may be found on  the last page of this report. GAO staff who made major contributions to  this report are listed in appendix VI.

We conducted illustrative case research related to U.S.-registered aircraft  generally covering the 2010–2018 period, including over 1,200  publications and reports from cases investigated by law-enforcement  agencies, news articles, and agency and safety investigation reports. We  selected six case studies for in-depth review across three categories of  risk enabled by aircraft registration fraud and abuse—criminal activity,  national security, and safety (see app. II for additional details on the  selection methodology). All selected cases are intended for the purpose  of illustrating fraud and abuse vulnerabilities associated with the aircraft  registration process. These cases may not represent all existing  vulnerabilities and are not generalizable to the Federal Aviation  Administration (FAA) registry population as a whole.

From 2010 to 2011, an aircraft sales broker obtained multiple registration  certificates from FAA for aircraft he did not rightfully own or possess.  According to court records associated with this case, the broker submitted  to FAA fraudulent registration applications and bills of sale with forged  signatures for 22 aircraft as part of a multi-million-dollar bank fraud  scheme. He used the registration documents that FAA provided as an  asset to support a loan application that ultimately resulted in an  approximately $3 million bank loan used to float his failing aircraft-sales  business. The bank uncovered the fraud over a year after the sales  broker first submitted the fraudulent aircraft registration documents to  execute the loan. A subsequent investigation by the Federal Bureau of  Investigation revealed the extent of the fraud, namely that the main thrust  of the fraud scheme was to pledge as collateral 22 aircraft that neither the  broker nor his company owned, in order to obtain money from the bank.  Court records reveal that law-enforcement officials interviewed some of  the rightful owners of the aircraft, who stated that the aircraft were always  in their possession and they had never sold the aircraft to the fraudulent  broker. These owners identified the signatures on the bills of sale used to  register the aircraft as forged. In 2013, the broker pled guilty to bank  fraud, making a false statement to a federally insured financial institution,  and making a false statement to FAA in the registration of aircraft.

As a result of the fraud, some of the rightful owners of the aircraft  experienced difficulty in reinstating the aircraft registrations in their name.  For example, one owner told federal investigators that he could not fly his  aircraft for 2 years because the registration of his aircraft was in the name  of the fraudulent broker. Another owner stated that he incurred thousands  of dollars in legal fees to reinstate the registration of the aircraft in his  name. Additionally, the court ordered the broker to pay approximately  $2.4 million in restitution to the bank.

In 2014, a U.S.-registered aircraft was seized by and subsequently  forfeited to the U.S. government in 2016 because the aircraft had been  fraudulently registered and it was purchased with assets derived from  wire fraud, money laundering, or other unlawful activities, according to  court records associated with this case. The registration was found to be  fraudulent because at the time of registration, the applicant was not the  true owner of the aircraft. Rather, the U.S. corporation that registered the  aircraft acted as a nominee to purchase and register the aircraft on behalf  of entities known to have ties to the Sinaloa Cartel, one of the world’s  most notorious criminal enterprises. Law-enforcement officials were  aware of the scheme and seized the aircraft shortly after final payment  was made on it. Court records reveal that this corporation had been  previously investigated for violations related to false and fictitious U.S.  registration of aircraft on behalf of a criminal organization, and that the  corporation’s owner was well known to members of law-enforcement  agencies for his suspected role in multiple illegal activities. The aircraft  was ultimately forfeited to the U.S. government because it had been  purchased with proceeds traceable to illegal activities.

In 2012, an intermediary established a U.S. corporation for a foreign  national beneficial owner, and the company registered the aircraft. The  foreign national was engaged in the black-market currency exchange,  which is a common scheme used in trade-based money laundering. In  this case, the foreign national conspired with another individual to  fraudulently purchase millions of dollars in Venezuela at a rate preferred  by the Venezuelan government that was reportedly established as a  control to prevent capital flight from Venezuela. Court records show that  the aircraft was purchased with illicit proceeds from this fraudulent  scheme. In 2016, U.S. law enforcement seized the aircraft, and in 2018 it  was forfeited to the U.S. government.

In 2017, as the result of a multiyear investigation, the Department of the  Treasury’s Office of Foreign Assets Control (OFAC) designated the  Executive Vice President of Venezuela as a Specially Designated  Narcotics Trafficker pursuant to the Foreign Narcotics Kingpin  Designation Act for playing a significant role in international narcotics  trafficking. According to the 2017 OFAC announcement on this case, this  Venezuelan government official facilitated shipments of narcotics with the  final destinations of Mexico and the United States, including control over  airplanes and ports used in drug trafficking in Venezuela. According to  OFAC, in previous government positions, this official oversaw and  partially owned large narcotics shipments destined for the United States.  Further, this official also used a front man who laundered drug proceeds  and purchased assets. In addition to a network of international  companies, according to OFAC, the front man owned or controlled five  U.S. companies, including a limited liability company (LLC) that registered  an aircraft with FAA using a voting trust to meet U.S. citizenship  requirements. As part of its action, OFAC also designated the front man  for providing material assistance, financial support, or goods or services  in support of the international narcotics trafficking activities of, and acting  for or on behalf of, the Venezuelan Executive Vice President. OFAC also  identified as blocked property the U.S.-registered aircraft as well as the  LLC used to register the aircraft.

According to FAA officials, the agency does not have the legal authority to  deny a registration solely because of a sanctions designation. OFAC  notified FAA of the designation, and FAA flagged the aircraft in its system.  FAA deregistered the aircraft in 2019 after registration renewal  documentation submitted to FAA contained numerous errors. However,  because the flags placed on sanctioned individuals’ and entities’  registration records do not extend to dealer records, FAA issued a dealer  certificate to the blocked LLC after the OFAC designation and without  coordination with OFAC, according to FAA records and officials. The  blocked LLC held the dealer certificate for a year until the certificate  expired.

In 2011, an aircraft registered to a U.S. citizen with a registered agent  address disappeared and was reported to have crashed off the coast of  Panama with six fatalities. At the time of the crash, the government of  Panama was operating the aircraft while it was still under the U.S.  registration of the owner. According to FAA officials and documents we  reviewed, the aircraft was in the possession of the Panamanian  government because it had been seized by Panamanian authorities in  2010 on allegations that it had been used to traffic narcotics from Panama  into Colombia. According to an FAA official knowledgeable about this  case, as part of the seizure, a Panamanian court assigned the aircraft to  the Panamanian civil aviation authority, which then registered the aircraft  in Panama and painted a Panamanian registration number on it.  However, the Panamanian civil aviation authority did not take the actions  to first deregister the aircraft in the United States, so the new registration  was likely invalid under international law. When told this by an FAA  official, Panamanian authorities removed the Panamanian registration  number from the plane and replaced it with the original N-number. FAA  sent multiple letters to the owner to deregister the aircraft and also when  the aircraft registration was expiring, but all were returned as refused by  the registered agent. According to an FAA official we interviewed about  this case, the Panamanian civil aviation authority operated the aircraft  under U.S. registration for approximately 1 year until its crash. According  to this official, at the time of the crash the aircraft was reportedly operated  by the Panamanian civil aviation authority for the purposes of radar  maintenance missions in that country.

In 2016, an aircraft registered to a U.S.-based LLC crashed in the  Caribbean, resulting in fatal injuries to all three people aboard. According  to the accident report, the aircraft was operated by a foreign entity, an  aviation training center located in Jamaica. The Jamaican civil aviation  authority, the entity responsible for investigating the accident, found  multiple safety deficiencies as the causes and contributing factors of the  fatal crash. These deficiencies include the aircraft’s engine replacement  not conforming to its design type; engine parts showing signs of wear  ranging from worn to extremely worn conditions exhibiting heavy  corrosion; and falsified maintenance records.

FAA, by law, imposes safety obligations on all owners of aircraft. To meet  these obligations, an owner must maintain current information about the  identity and whereabouts of the actual operators of an aircraft and  location and nature of the operation on an ongoing basis, thereby  allowing that owner to provide the operator with safety-critical information  in a timely manner, and to obtain information responsive to FAA inquiries,  including investigations of alleged violations of FAA regulations. Such  information is an essential element in FAA’s ability to carry out its  oversight obligations under U.S. and international law. The safety  deficiencies cited in the accident report indicate that, as the registered  owner of the aircraft, the LLC may not have been fulfilling its safety  obligations.

Appendix II: Objectives, Scope, and Methodology

Our objectives were to assess the Federal Aviation Administration’s  (FAA) (1) actions to prevent fraud and abuse in aircraft registrations, (2)  ability to detect potential fraud and abuse in aircraft registrations, and (3)  actions and coordination with law-enforcement entities to respond to  aircraft registry–related fraud and abuse risks.

To address all objectives, we reviewed laws, regulations, and FAA  policies pertaining to the aircraft registration eligibility requirements and  processes. We also reviewed standard operating procedures, policy  statements, and guidance for staff charged with processing aircraft  registrations and addressing administrative compliance actions— including FAA Order 2150.3C issuing enforcement actions per its  compliance and enforcement program, FAA Aircraft Examiner’s  Guidelines outlining the steps for processing aircraft registrations, and  published International Civil Aviation Organization civil aviation standards.  We also reviewed prior GAO reports and Department of Transportation  (DOT) Office of Inspector General (OIG) reports regarding the quality and  utility of registry data, risks, and ongoing challenges associated with the  registry’s information technology (IT) system.

For all objectives, we interviewed FAA officials from: aircraft registry, legal  counsel, FAA’s Security and Hazardous Materials Safety (ASH), FAA’s  Law Enforcement Assistance Program (LEAP), and FAA’s Special  Emphasis Investigation Team (SEIT). We also interviewed aviation  safety, foreign policy, and law-enforcement officials to obtain broader  perspectives, where applicable, on the registration process, challenges,  and vulnerabilities, including officials from the National Transportation  Safety Board (NTSB), the Department of the Treasury’s (Treasury) Office  of Foreign Assets Control (OFAC) and Internal Revenue Service Criminal  Investigations, the Department of Justice’s (DOJ) Drug Enforcement  Administration (DEA), the Department of Homeland Security’s (DHS)  Homeland Security Investigations (HSI), and DOT’s OIG. We interviewed  aviation industry associations, selected based on a range of aviation  interests, such as general aviation and equipment leasing. We also  interviewed aircraft registry intermediaries—individuals and entities that  facilitate aircraft registrations for others—such as trust companies, banks,  and a registered agent, selected based on our analysis of aircraft registry  data across types of intermediaries and number of registrations. We also  reviewed relevant international standards on countering money  laundering and issues related to transparency of corporate structures and  beneficial ownership of assets.

We performed a descriptive analysis of the registry data from calendar  year 2010 through 2018. To do this, we first performed an in-depth  review of the calendar year 2018 registry master data—which contains  the most-current registration information for our review period—and  selected key fields such as aircraft registration number and registrant  name information for further analysis. For the remaining calendar years  2010 to 2017 annual files, we focused on identifying any substantive  differences occurring between years for the selected key fields. We  developed frequencies of the selected key fields to determine the number  of registered aircraft, registration types and ownership structures (such as  corporations, trusts, and dealers) used to register aircraft, and registration  status across the 9-year period of our review.

In September 2018 we conducted a site visit to the FAA Registry facility  located at the Mike Monroney Aeronautical Center in Oklahoma City,  Oklahoma. During the site visit, we interviewed officials from FAA’s major  components responsible for processing aircraft registrations and  addressing administrative compliance actions, including registry data  analysts and managers for the aircraft and airmen systems, FAA ASH  officials, and an Office of the Chief Counsel attorney. We also observed  firsthand the registry’s process for receiving, sorting, scanning, and  recording aircraft registration and renewal application packages.

To determine potential fraud and abuse in aircraft registration and FAA  actions to prevent them, we analyzed and synthesized a variety of  information, including agency reports, registration, postal, and sanctions  data, and news articles, among other sources. Our review of information  generally spanned fiscal years 2010 through 2018. To identify illustrative  cases of potential fraud and abuse, we conducted a literature review that  included sources such as Lexis Nexis news articles, DOJ press releases,  and investigative reports published by DOT OIG, FAA LEAP, Internal  Revenue Service Criminal Investigations, and DHS HSI. We also  searched the NTSB publicly available online database of aviation  accidents and incidents for examples of safety-related cases. Our  literature search yielded over 900 publications and over 300 aviation  accident reports for further screening. We then applied two levels of  criteria to filter the results for case narrative selections. For the first level,  we identified 66 cases from fiscal years 2010 to 2018 involving U.S.- registered aircraft related to three categories of risk enabled by fraud and  abuse—criminal activity, national security, and safety. Next, we  performed a secondary level of review and selected 28 illustrative cases  that included case details, such as entity names and aircraft registration  numbers, to facilitate further research including legal review to ensure  that selected case studies were adjudicated by a court of law, where  applicable. Of those 28 cases, we selected six case studies for in-depth  review. We also drew examples from our research of intermediaries of the  registry, including selected banks, trust companies, and registered  agents. For our in-depth research of these cases, we reviewed available  information contained in the FAA Civil Aviation Registry, FAA Electronic  Document Retrieval System, and ancillary files; aircraft flight plans; NTSB  accident report information; state business registration data; court  records; and GAO’s internal resources that included a mix of government  and corporate databases. All selected cases are intended for the purpose  of illustrating fraud and abuse vulnerabilities associated with the aircraft  registration process and may not represent all existing vulnerabilities, nor  are they generalizable to the FAA registry population as a whole.

To further determine potential fraud and abuse in aircraft registrations, we  analyzed FAA aircraft registry address data from calendar year 2018.  Using registry address information, we performed a match to United  States Postal Service (USPS) data to identify examples of potentially  unverified and noncompliant addresses provided to the registry. To  analyze postal address data, we used the address fields contained in the  FAA registry master and dealer data to verify address information and  identify examples of invalid addresses provided to the registry in calendar  year 2018, which is the most-current registry data included in our review.  Additionally, we obtained data from an internal registry physical address  report that we then matched to the calendar year 2018 registry master  data to replace mail drop boxes with physical address information, where  available. We then performed a match of this updated address file to the  USPS Address Matching System as of June 2019 to identify examples of  potentially invalid addresses. Our match results revealed a number of  commercial mail drop locations, including post office boxes, and  addresses that did not match to the postal data. We selected seven  aircraft registration addresses and five dealer addresses (total of 12  match results) using a randomized list filtered by locality. We then  manually verified the match results for these selected cases using  publicly available online geo-mapping tools such as Google Maps and  company listings such as White Pages. On the basis of the results of  those searches, we selected three aircraft registrations and three dealer  certifications that highlight examples of potentially noncompliant  addresses provided to the registry in violation of FAA regulations and  policy. We conducted subscription database searches and reviewed FAA  registration documents for these selected cases based on categories of  addresses, such as mail drop boxes, and verified three addresses  selected based on locality through site inspections by GAO investigators.

Finally, we analyzed the costs associated with aircraft and dealer  certificate registrations. To do this, we reviewed an FAA internal report  that assessed the costs of FAA’s registration processing, and compared  proposed fees to the current fee values for aircraft registrations and  dealer certificates. We also reviewed GAO’s federal user fee guide  provision that states that fee collections should be sufficient to cover the  intended portion of program costs over time, including accounting for  factors such as inflation. We reviewed a prior 1993 GAO report in which  we determined that the registration fee, in place since 1964, did not cover  the cost of reviewing and processing a registration application. Finally,  we performed an inflation analysis of the 1964 fee level adjusted for  inflation based on the Consumer Price Index.

To assess FAA’s ability to detect potential fraud and abuse in aircraft  registrations, we examined FAA aircraft registry data collection and  storage as well as oversight actions based on registry information and  data. We also conducted data mining and matching to identify  registrations with indicators of potential fraud or abuse that may enable  criminal activity, national security, and safety risks by analyzing FAA  aircraft registry master data from calendar years 2010 through 2018, as  well as other registry-based and external data sets. We selected five risk  indicators, which were informed by interviews with FAA and law- enforcement officials and our background research, for analysis of  registry-related data and for matching to a selection of external data sets.  We analyzed FAA aircraft registry data to identify registrations with  characteristics that matched one or more risk indicators, such as  registrations using opaque ownership structures—corporation- and trust- based ownership that disguises the beneficial owner—and registration  addresses in countries identified by the Department of State as  associated with major illicit drug production and money laundering,  among other factors. The risk indicators do not prove fraud or that any  unlawful activity has occurred. Alone or together, the risk indicators may  serve as points of inquiry for further examination of conduct that may run  counter to the interests of the federal government by posing potential  criminal, national security, or safety risks.

On the basis of the results of our risk-indicator analysis using registry  data, we selected a total of five items as potential risk indicators. We  selected three risk indicators based on public and internal aircraft registry  data. We compared the registry master data to the list of countries  published in the latest Department of State narcotics control and financial  crimes watch lists. Additionally, we reviewed nonpublic extracts of FAA  registry voting trusts used by U.S. citizen corporations and noncitizen  trusts from April 2018 through May 2019—the most complete data  available at the time of our review—due to their opaque ownership  structures and potential for abuse as registration vehicles. We also  performed an analysis of types of intermediaries and selected a  registered agent as a risk indicator based on confirmed misuse of its  address as a means for corporate entities to register aircraft. To establish  our population of corporate entities for outreach, we selected four  corporate codes contained in the registry data. Next, we developed  selection criteria that included geographic distribution (U.S.-based or  foreign-based); registrant size based on thresholds that reflect the  distribution of registered aircraft (small, medium, or large); and finally,  registrant type (bank, trust company, or registered agent). Based on  these criteria, we randomly selected two U.S.-based banks and four U.S.- based and foreign trust companies to interview. To identify registered  agents, which are not specifically coded in the registry data, we  summarized the registry address information and selected all entities with  two or more aircraft registrations per address for further screening. We  then randomly selected one established registered agent entity for  outreach.

We analyzed extracts from two external selected data sources for the risk  indicator data matching—Treasury OFAC lists of sanctioned entities and  individuals, and an NTSB accidents and incidents report—covering the  period January 2010 through March 2019, where available. To do this, we  used key fields to match the selected data sources to the FAA registry  master and trust data, and selected additional risk indicators based on  our analysis of the match file results. We matched aircraft registry data to  the OFAC lists of sanctioned entities and individuals as of March 2019 to  identify aircraft, individuals, and entities subject to U.S. sanctions. We  combined five cases identified from our OFAC data match with one  additional case identified through our illustrative case and intermediary  research to report on our findings of U.S.-sanctioned individuals and  aircraft. We included all NTSB-reported accidents and incidents of U.S.- registered aircraft taking place outside the United States as a safety risk  indicator. Using the FAA registry aircraft registration number and  registrant name fields as the primary match keys, we performed a final  merge of all risk indicators identified through our multiple analysis steps  described above. Our combined risk flag match returned over  17,000 records, which we used to develop totals for each risk indicator  category that we identified. Next, we randomized the list generated from  our combined match and applied criteria to filter cases for further review.  These criteria included cases with multiple risk indicators, as well as  prioritization of risk based on a combined evaluation across all risk  indicator categories, among other filters. In total, we selected 20 cases for  agency follow-up and in-depth file reviews based on a comprehensive  assessment of risk flag categories described above. However, without  reviewing a generalizable sample of cases across all categories, we were  unable to determine the extent of risk such cases may represent as a  proportion of total registrations. Therefore, we used the results of our file  reviews for these 20 cases solely to illustrate examples of the risk  indicators that we identified.

We assessed the reliability of each data set described above for the  purposes of generating high-level totals, as well as identifying and  tracking potential risk-indicator cases across time. To do this, we  performed electronic tests using reports from eight information systems to  determine the completeness and accuracy of key fields contained in the  data files. We also submitted to the overseeing offices for all eight  information systems general data-quality questions regarding the purpose  of the data, their structure, definitions and values for selected fields,  automated and manual data-quality checks to ensure the accuracy of the  data, and limitations. Overall, we found that the data were generally  reliable for the purpose of performing a cross-comparison of current  registrations associated with safety and compliance violations over the  nine-year period of our review.

To assess FAA’s actions and coordination with law-enforcement agencies  to respond to registration-related risks, in addition to the interviews noted  above, we reviewed FAA policies pertaining to the aircraft registration  process and documents about FAA and law-enforcement efforts to  address registry-related vulnerabilities. We reviewed FAA enforcement  actions and government-wide data on aircraft seizures. To generate  government-wide totals for aircraft seizures and forfeitures over time, we  obtained data extracts from the DOJ Consolidated Asset Tracking System  and DHS Customs and Border Protection Seized Assets and Case  Tracking System from fiscal years 2010 through 2018. We limited our  Consolidated Asset Tracking System data request to aircraft adjudicated  as either seized and forfeited, or seized and substituted for cash  forfeiture, while the report from the Seized Assets and Case Tracking  System contains all seizures recorded by Customs and Border Protection  during our review period. Therefore, the reports represent different  populations, and we opted to report the totals for the two databases  separately. Where feasible, we assessed the reliability of data in each  system described above for the purposes of generating high-level totals.  Our data-quality testing of selected data elements showed that the  primary fields of interest were well-populated and sufficiently reliable for  our purposes.

We conducted this performance audit from November 2017 to March  2020 in accordance with generally accepted government auditing  standards. Those standards require that we plan and perform the audit to  obtain sufficient, appropriate evidence to provide a reasonable basis for  our findings and conclusions based on our audit objectives. We believe  that the evidence obtained provides a reasonable basis for our findings  and conclusions based on our audit objectives. We conducted our related  investigative work in accordance with investigation standards prescribed  by the Council of the Inspectors General on Integrity and Efficiency.

Appendix III: Registration Types and Documentation Requirements

In addition to an aircraft registration application form, evidence of  ownership, and $5 registration fee, the Federal Aviation Administration  (FAA) requires additional documentation based on the type of individual  or entity that owns the aircraft, as discussed in table 2 below.

Appendix IV: Use of Opaque Ownership Structures for Aircraft Registration

Opaque ownership structures are legitimate business structures that are  widely used by corporations and individuals to facilitate commerce as well  as for asset and tax management. However, the lack of transparency  related to aircraft registrations using opaque ownership structures also  creates challenges for safety and law-enforcement investigators seeking  information about beneficial owners to support timely investigations. The  Financial Action Task Force (FATF) and other international organizations  have determined that beneficial ownership information can be obscured  through, among other things, the use of  shell companies (which can be established with various forms of  ownership structures) especially in cases where there is foreign  ownership that is spread across jurisdictions;  complex ownership and control structures involving many layers of  shares registered in the name of other legal entities;  formal nominee shareholders and directors where the identity of the  beneficial owner is undisclosed;  trusts and other legal arrangements that enable a separation of legal  ownership and beneficial ownership of assets; and use of intermediaries in forming legal entities, including professional  intermediaries.

Shell companies, one of the opaque ownership structures, may be formed  for legitimate purposes to obtain financing prior to starting operations. In  the aircraft ownership context, shell companies may own aircraft by  holding title for registration purposes. However, shell companies may also  be used to conceal the beneficial owner’s identity for illicit purposes. For  example, according to Federal Aviation Administration (FAA) officials,  some aircraft registrations have “stacked” company ownership, where  shell companies own each other. Such ownership arrangement can be  used for illicit purposes to conceal the identity of foreign-based beneficial  owners and create challenges for investigators, according to law- enforcement officials. Further, shell companies may use a registered  agent’s mailing address on their aircraft application forms, further  obscuring aircraft ownership information.

Table 3 describes the four opaque ownership structures, their legitimate  uses, and how they can be vulnerable to abuse, according to our  illustrative case and intermediary research, and interviews with FAA and  law-enforcement officials.

In the example and figure below, we illustrate opaqueness and  complexities of aircraft registrations using intermediaries and opaque  ownership structures. It is based on an actual case from our review of  aircraft registration documents and research from corporate filings and  other databases.

Apparent shell company and noncitizen trust used to register  aircraft for unknown foreign beneficial owner. In this case, a foreign  company obtained U.S. aircraft registration through an intermediary,  using opaque ownership structures. This is allowable under current  registration requirements and there is no identified wrongdoing in this  case. The application, depicted in figure 13, shows the involvement of an  intermediary, who used various legal entities and took a number of steps  to facilitate aircraft registration for a beneficial owner who is unknown.  The intermediary listed himself as the director of a corporation, N003 Inc.,  which was established using a company that provides company formation  and registered agent services. Among other indicators, N003 Inc.  appeared to be a shell company established shortly before the filing of the  aircraft registration. The intermediary also used the mailing address of the  registered agent as the owner’s address on the aircraft registration  application. Further, the intermediary established a noncitizen trust for  aircraft ownership. The trust agreement identified N003 Inc. as the owner  trustee of the aircraft, and a foreign corporation, DEF Ltd., as the trustor.  As such, the role of the intermediary, the use of apparent shell company  and noncitizen trust ownership structures, and use of the registered  agent’s mailing address worked to obscure the foreign beneficial owner of  the aircraft while facilitating access to U.S. aircraft registration.

Appendix V: Comments from the Department of Transportation

Appendix VI: GAO Contact and Staff Acknowledgments

Rebecca Shea, (202) 512-6722 or shear@gao.gov  In addition to the contact named above, Tonita Gillich (Assistant Director),  Irina Carnevale (Analyst-in-Charge), James Ashley, Priyanka Sethi  Bansal, Gary Bianchi, Daniel Bibeault, Kimberley Bynum, Steven  Campbell, Colin Fallon, Robert Graves, Ying Long, Olivia Lopez, Maria  McMullen, James Murphy, George J. Ogilvie, Sean Peck, and April Van  Cleef made key contributions to this report.

The Federal Aviation Administration manages the U.S. aircraft registry, which maintains information on about 300,000 civil aircraft. Accurate registry information can help investigators combat illegal activities such as drug trafficking or purchasing an aircraft as part of a money laundering scheme.

We found FAA generally relies on self-certification and doesn’t verify key information such as applicant identity or aircraft ownership. Shell company or limited liability company ownership can also make it difficult to determine who ultimately owns an aircraft.

We made 15 recommendations, including that FAA verify key owner information.