a

GAO

United States Government Accountability Office

Report to Congressional Committees

February 2008 BANK SECRECY ACT

Increased Use of 

Exemption Provisions 

Could Reduce 

Currency Transaction 

Reporting While 

Maintaining 

Usefulness to Law 

Enforcement Efforts

GAO-08-355
What GAO Found

United States Government Accountability Office

Why GAO Did This Study

Highlights

Accountability Integrity Reliability

February 2008

BANK SECRECY ACT

Increased Use of Exemption Provisions Could 

Reduce Currency Transaction Reporting While 

Highlights of GAO-08-355, a report to Maintaining Usefulness to Law Enforcement Efforts

congressional committees 

To aid law enforcement efforts 

against financial crimes, under the 

Bank Secrecy Act (BSA) depository 

institutions must file the Treasury 

Department’s Financial Crimes 

Enforcement Network’s (FinCEN) 

currency transaction report (CTR) 

form on their customers’ cash 

transactions of more than $10,000. 

While FinCEN’s regulations allow 

institutions to exempt certain 

customers, over 15 million CTRs 

were filed in 2006. Public Law 109-

351 directed GAO to report on (1) 

the usefulness of CTRs to law 

enforcement; (2) depository 

institutions’ costs of meeting CTR 

requirements; and (3) ways to 

encourage use of exemptions to 

avoid unnecessary CTRs. Among 

other things, GAO obtained data 

from FinCEN on CTRs and 

exemptions from 2004 to 2006, 

surveyed 115 state and local law 

enforcement agencies and 680 

depository institutions, held 

structured interviews with officials 

of federal agencies and depository 

institutions, and reviewed relevant 

laws and regulations. 

What GAO Recommends

GAO recommends that the 

Secretary of the Treasury direct 

FinCEN to consider routinely 

publishing summary information 

on CTR use, revise certain 

regulations that deter exemptions, 

and provide additional guidance 

and Web-based material to help 

depository institutions interpret 

exemption requirements. FinCEN 

concurred with our regulatory and 

guidance recommendations and 

stated that it will consider options 

for providing feedback on CTR use. 

According to federal, state, and local law enforcement officials, CTRs provide 

unique and reliable information essential to a variety of efforts, and recent 

advances in technology have enhanced law enforcement agencies’ ability to 

use CTR data by integrating it with other information. In addition to 

supporting specific investigations, CTR requirements aid law enforcement by 

forcing criminals attempting to avoid reportable transactions to act in ways 

that increase chances of detection through other methods. Linking law 

enforcement’s use of CTRs to specific outcomes is difficult, however, because 

agencies do not track their use of CTRs, which are typically one of many 

information sources used in investigations. FinCEN does not routinely 

publish summary information on law enforcement uses of CTR data—as it 

does for other data required under the BSA—that could help depository 

institutions understand the value of CTRs. 

While fewer than 30 of the largest U.S. depository institutions accounted for 

over half of new CTRs filed during the period GAO examined, all of the 

nation’s approximately 17,000 institutions incur some costs to meet CTR 

requirements. Institutions must have processes and staff in place to identify 

when and if a CTR is required, as well as the ability to aggregate same-day 

cash transactions by or on behalf of the same person; file CTRs correctly; and, 

if desired, establish and maintain exemptions for certain customers. 

Institutions GAO contacted were generally unable to quantify these costs, in 

large part because they use the same processes and staff for other purposes. 

While automation has made CTR tasks less difficult, almost all institutions 

reported that they have not completely automated all steps, such as reviews of 

CTRs by institution officials. 

GAO’s work identified a number of factors that deter use of exemptions, as 

well as opportunities for increasing their use, thereby reducing the number of 

CTRs that are likely of little or no value to law enforcement efforts. As 

reasons for not exempting eligible customers, institutions cited uncertainty 

about the documentation required to demonstrate that some customers are in 

fact eligible, along with concern that federal banking regulators (who examine 

institutions for compliance with CTR requirements) would find fault. 

Institutions also cited as deterrents the need to meet FinCEN’s regulatory 

requirements to (1) file an exemption form, and annually review the 

supporting data, particularly for hundreds of customers that are specifically 

exempted by statute; and (2) biennially renew eligibility for some customers—

a process that as a practical matter duplicates the required annual reviews for 

those customers. Institution officials indicated that additional guidance from 

FinCEN, as well as Web-based material to help train their staff in making 

exemption determinations, could increase the use of exemptions. Removing 

regulatory deterrents and providing additional guidance and Web-based 

material could help depository institutions avoid filing unnecessary CTRs 

without harming law enforcement efforts. 

To view the full product, including the scope 

and methodology, click on GAO-08-355. 

To view the results of GAO's surveys, click 

on GAO-08-385SP. For more information, 

contact David G. Wood at (202) 512-6878 or 

woodd@gao.gov. 
Page i GAO-08-355 Bank Secrecy Act

Contents

Letter 1

Results in Brief 5

Background 8

CTR Requirements Are Useful to Law Enforcement Efforts in a 

Variety of Ways, but Measuring Their Impact Is Difficult 12

Financial Institutions Incur Some Costs to Meet Requirements 

Regardless of the Number of CTRs They File 29

Uncertainty about Required Documentation and Some Regulatory 

Requirements May Unnecessarily Discourage Use of 

Exemptions 38

Conclusions 53

Recommendations for Executive Action 57

Agency Comments and Our Evaluation 58

Appendixes

Appendix I: Objectives, Scope, and Methodology 60

Appendix II: Law Enforcement Agencies’ Use of CTR Data 70

Appendix III: Information on CTRs Filed from 2004 to 2006 81

Appendix IV: Additional Information on Depository Institutions’ Use of 

Exemptions 88

Appendix V: Comments from the Financial Crimes Enforcement 

Network 95

Appendix VI: Comments from Federal Banking Regulators 96

Appendix VII: GAO Contact and Staff Acknowledgments 98

Related GAO Products 99

Tables Table 1: Statutory and Regulatory Provisions That Determine 

Which Customers May Be Exempted 9

Table 2: CTR Views by Agencies, Fiscal Years 2004 through 2006 26

Table 3: Exemption Violations Cited in BSA Examinations by FDIC, 

Federal Reserve, and OCC, 2005 and 2006 44

Table 4: Federal Agencies We Interviewed and Number of CTR 

Views, Fiscal Year 2006 61

Table 5: Number of CTRs Filed by Asset Size Category of 

Depository Institutions in 2006 64
Contents

Page ii GAO-08-355 Bank Secrecy Act

Table 6: Survey Population and Response Rate 67

Table 7: Number and Percentage of CTRs Filed by Institution Type, 

2004-2006 82

Table 8: Mean and Median Numbers of CTRs Filed by Size of 

Institution, 2004-2006 83

Table 9: Number of CTRs Based on Aggregated Transactions, 

2004-2006 84

Table 10: Number and Percentage Amount of Cash-In Transactions 

Recorded by CTRs, 2004-2006 85

Table 11: Number and Percentage of Cash-Out Transactions 

Recorded by CTRs, 2004-2006 86

Table 12: Number and Percentage of Phase I Exemptions Filed by 

Depository Institutions, 2006 88

Table 13: Number and Percentage of Phase II Exemptions Filed by 

Depository Institutions, 2006 90

Table 14: FinCEN’s CTR and Exemption-Related Enforcement 

Actions on Depository Institutions, 1997-2006 94

Figures Figure 1: Extent to Which State and Local Agencies Found That 

CTRs Assisted Them in Verifying Known or Obtaining 

Previously Unknown Information 20

Figure 2: Purposes for Which State and Local Agencies Reported 

Using CTRs and How They Rated CTRs’ Usefulness 21

Figure 3: CTRs Filed in 2006 by Banks and Credit Unions, by Asset 

Size 30

Figure 4: General Process for Filing CTRs 32

Figure 5: Extent to Which Steps in the CTR Process Were 

Automated at Surveyed Institutions 34

Figure 6: Median Time, in Minutes, to Accomplish Each CTR Filing 

Step 35

Figure 7: Factors That Surveyed Institutions Reported as of Great 

or Very Great Importance to Their Decision to Exempt 

Phase I and Phase II Customers 40

Figure 8: Percentage of Depository Institutions with Customers 

Eligible for Phase I and II Exemptions and Extent to 

Which They Filed Exemptions in 2006 41

Figure 9: An Overview of the Reveal Data Mining System 71

Figure 10: States That Viewed CTR Data, by Number of CTRs 

Viewed in the Gateway Program, Fiscal Year 2006 74

Figure 11: CTRs Filed in 2006, by Institution Asset Size 81

Figure 12: CTRs Filed in 2006, by County 87
Contents

Page iii GAO-08-355 Bank Secrecy Act

Figure 13: Factors That Institutions Considered to Be of Very Great 

or Great Importance When Deciding Not to Exempt a 

Phase I Eligible Customer 91

Figure 14: Factors That Institutions Considered to Be of Very Great 

or Great Importance When Deciding Not to Exempt a 

Phase II-Eligible Customer 93

Abbreviations

BSA Bank Secrecy Act

CBRS Currency Banking and Retrieval System

CMIR Report of International Transportation of Currency or 

Monetary Instruments

CTR currency transaction report

DEA Drug Enforcement Administration

FBI Federal Bureau of Investigation

FDIC Federal Deposit Insurance Corporation

FinCEN Financial Crimes Enforcement Network

HIDTA High Intensity Drug Trafficking Area

HIFCA High-Intensity Money Laundering and Related Financial Crimes 

Area

ICE Immigration and Customs Enforcement

IRS Internal Revenue Service

NCUA National Credit Union Administration

OCC Office of the Comptroller of the Currency

OCDETF Organized Crime Drug Enforcement Task Force

OTS Office of Thrift Supervision

TECS Treasury Enforcement Communications System 

SAR Suspicious Activity Report

This is a work of the U.S. government and is not subject to copyright protection in the 

United States. The published product may be reproduced and distributed in its entirety 

without further permission from GAO. However, because this work may contain 

copyrighted images or other material, permission from the copyright holder may be 

necessary if you wish to reproduce this material separately.
Page 1 GAO-08-355 Bank Secrecy Act

United States Government Accountability Office

Washington, D.C. 20548

A

February 21, 2008 Leter

The Honorable Christopher J. Dodd 

Chairman 

The Honorable Richard C. Shelby

Ranking Member 

Committee on Banking, Housing, and Urban Affairs 

United States Senate

The Honorable Barney Frank

Chairman 

The Honorable Spencer Bachus

Ranking Member

Committee on Financial Services

House of Representatives

To assist law enforcement agencies in their efforts to combat money 

laundering, the financing of terrorist activities, and other crimes, financial 

institutions are required to provide the federal government with 

information on customers engaging in certain currency transactions under 

the Bank Secrecy Act (BSA).1

 Among other things, the BSA—administered 

by the U.S. Department of the Treasury’s Financial Crimes Enforcement 

Network (FinCEN)—and its implementing regulations require financial 

institutions to file currency transaction reports (CTR) when their 

customers make large cash transactions, currently defined by regulation as 

those exceeding $10,000.2

 In 2006, the government received about 15 

million CTRs, the vast majority of which were filed by depository 

institutions (banks, thrifts, and credit unions). 

1

Pub. L. No. 91-508, titles I and II, 84 Stat. 1114 to 1124 (Oct. 26, 1970), as amended, codified 

at 12 U.S.C. §§ 1829b, 1951-1959, and 31 U.S.C. §§ 5311 et seq.

2

31 U.S.C. § 5313(a); 31 C.F.R. § 103.22(b).
Page 2 GAO-08-355 Bank Secrecy Act

To reduce the number of CTRs with limited usefulness to law enforcement 

efforts, in 1994 Congress enacted provisions allowing depository 

institutions to exempt two broad categories of customers that meet 

specified criteria.3

 For these exempted customers, the institutions do not 

have to file CTRs, because the customers’ cash transactions would likely be 

of little or no value to law enforcement efforts. First, the law required 

FinCEN to provide appropriate exemptions for customers that are another 

depository institution; governmental entities, including state and local 

governments; certain other entities exercising U.S., state, and local 

governmental authority; and “any business or category of business the 

reports on which have little or no value for law enforcement purposes,” 

which FinCEN has defined through regulations to generally include 

companies that are listed on any of three stock exchanges (listed 

companies) and subsidiaries that are 51 percent or more owned by a listed 

company. Second, the law authorized FinCEN to establish, through 

regulation, exemptions for “qualified business customers” that maintain an 

account at the depository institution, frequently engage in large cash 

transactions, and meet other criteria specified by regulation. FinCEN’s 

regulations provide that certain qualified business customers may not 

derive more than 50 percent of their gross revenue from activities or lines 

of business specifically deemed ineligible, such as the purchase or sale of 

automobiles or gaming of most kinds. Because FinCEN promulgated the 

regulations for these two categories in separate rule-making phases, the 

exemptions are commonly referred to as “Phase I” and “Phase II” 

exemptions, respectively.4

 It is up to the depository institutions as to 

whether they actually exempt each of their customers who are eligible for 

exemption; if they do, the institutions must file an exemption form 

documenting the customer’s eligibility and must review and verify 

eligibility at least once each year.

Depository institutions have expressed concerns about the cost and effort 

required to meet CTR filing requirements—including the steps needed to 

establish and maintain exemptions for their customers—as well as doubts 

about the usefulness of CTRs to law enforcement agencies. They note that 

they are also required, under the BSA, to file with FinCEN Suspicious 

Activity Reports (SAR) in cases of certain transactions that may involve 

3

The Money Laundering Suppression Act of 1994, Pub. L. No. 103-325, title IV, 108 Stat. 2243 

(Sept. 23, 1994). See 31 U.S.C. § 5313(d) (mandatory exemptions) and (e) (discretionary 

exemptions).

4

62 Fed. Reg. 47141 (Sept. 8, 1997) and 63 Fed. Reg. 50147 (Sept. 21, 1998).
Page 3 GAO-08-355 Bank Secrecy Act

violations of law or regulation, including money laundering. However, law 

enforcement officials have maintained that the CTR requirements help 

deter money laundering and that CTRs provide information that is highly 

useful to their investigations. Data from CTRs are aggregated and stored 

electronically in a large database accessible to law enforcement agencies 

and maintained for FinCEN by the Internal Revenue Service (IRS). The 

database also includes information about customers for which institutions 

have filed exemption forms. 

The Financial Services Regulatory Relief Act of 2006 required that we 

examine several aspects of CTRs, including their usefulness to law 

enforcement and the burden on depository institutions filing them, and to 

determine whether CTR filing rules could be modified without harming law 

enforcement operations.5

 This report discusses (1) the usefulness of CTRs 

to federal, state, and local law enforcement agencies; (2) the costs to 

depository institutions of meeting CTR requirements; and (3) factors that 

affect depository institutions’ decisions to exempt or not exempt eligible 

customers, including opportunities for encouraging use of exemptions 

while maintaining the usefulness of CTR data to law enforcement agencies.

To examine the usefulness of CTRs to federal, state, and local law 

enforcement agencies, we first obtained data from both FinCEN and IRS 

indicating the frequency of access to the CTR database by specific 

agencies. We conducted structured interviews with officials of 12 federal 

agencies and organizations—including those that most frequently accessed 

CTR data in 2006, such as FinCEN, IRS, the Federal Bureau of Investigation 

(FBI), the Drug Enforcement Administration (DEA), and the U.S. 

Department of Homeland Security’s Immigration and Customs 

Enforcement (ICE). In addition, we used a Web-based instrument to survey 

all 115 state and local law enforcement agencies that had access to CTR 

data as of May 2007; our overall response rate was 77 percent. We 

supplemented the survey by interviewing officials of 12 state and 5 local 

law enforcement agencies, selected to achieve a mix of agencies that had 

accessed CTR data frequently and agencies that had not. We asked officials 

at the law enforcement agencies to identify how information provided by 

CTRs is useful to their efforts and how technological changes have affected 

the use of CTR data. To understanding filing trends and obtain information 

on depository institutions’ costs to meet CTR requirements, we first 

analyzed FinCEN’s CTR and exemption data covering 3 calendar years—

5

Pub. L. No. 109-351 § 1001, 120 Stat. 1966, 2007-2009 (Oct. 13, 2006).
Page 4 GAO-08-355 Bank Secrecy Act

2004, 2005, and 2006—to identify the numbers of CTRs and exemptions 

filed by depository institutions of different sizes. For this purpose, we 

established four size categories (based on the dollar value of 

institutions’assets) for banks and thrifts and three categories for credit 

unions.6

 To obtain specific information on the costs of meeting CTR 

requirements, we conducted 35 structured interviews with officials of 

depository institutions of different sizes. We asked the officials whether 

they use manual or automated processes and what costs they incur to meet 

CTR requirements, including the costs of filing individual CTRs and 

exemption forms. Finally, to identify the factors affecting depository 

institutions’ exemption decisions, as well as opportunities for potentially 

increasing the use of exemptions, we used a Web-based instrument to 

survey 680 of the 3,880 depository institutions that filed at least 120 CTRs in 

2006, stratified by asset size category. Our overall response rate was 68 

percent. When presenting the survey results, all percentage estimates in 

this report have 95 percent intervals of within plus or minus 8 percentage 

points of the estimate, unless otherwise noted. This report does not contain 

all of the results of our surveys of law enforcement agencies and depository 

institutions, but the surveys and a more complete tabulation of the results 

can be viewed at http://www.gao.gov/cgi-bin/getrpt?GAO-08-385SP. We also 

analyzed statutory and regulatory filing requirements and interviewed 

officials and examiners from the five federal banking regulators to obtain 

their viewpoints on the difficulties, if any, institutions might confront in 

meeting the CTR and exemption filing requirements.7

 We also obtained data 

on BSA examinations conducted by each of the regulators for 2005 and 

2006, particularly data on their citations of depository institutions for 

noncompliance with CTR requirements. Additional details on our methods 

are presented in appendix I. We conducted this performance audit from 

November 2007 through February 2008 in accordance with generally 

accepted government auditing standards. Those standards require that we 

plan and perform the audit to obtain sufficient, appropriate evidence to 

6

See appendix I for more information on the asset size categories. We included only three 

categories of credit unions because they are generally smaller institutions, compared with 

banks and thrifts; further, credit unions filed less than 2 percent of all CTRs filed by 

depository institutions from 2004 through 2006.

7

To ensure compliance with the BSA and other laws and regulations, banks, thrifts, and 

credit unions are subject to oversight (including on-site examinations) at the federal and 

state level. Federal regulators of these institutions include the Board of Governors of the 

Federal Reserve System, the Office of the Comptroller of the Currency, the Office of Thrift 

Supervision, the Federal Deposit Insurance Corporation, and the National Credit Union 

Administration. In this report, we refer to these agencies as the federal banking regulators.
Page 5 GAO-08-355 Bank Secrecy Act

provide a reasonable basis for our findings and conclusions based on our 

audit objectives. We believe that the evidence obtained provides a 

reasonable basis for our findings and conclusions based on our audit 

objectives.

Results in Brief Federal, state, and local law enforcement officials we interviewed and 

surveyed described a variety of ways in which CTR requirements are useful 

to their efforts; however, measuring their impact is difficult. Recent 

advances in technology, along with FinCEN’s distribution of BSA data in 

bulk to certain federal agencies, have enhanced the ability to access and 

integrate CTR data with information from other sources. According to law 

enforcement officials, CTRs provide unique and reliable information that is 

essential to supporting investigations and detecting criminal activities, in 

part because CTRs provide information that is often unavailable elsewhere 

or is more objective or up-to-date than that obtained from other sources. In 

addition to supporting individual cases, law enforcement agencies use 

aggregated CTR data to help detect patterns or trends; for example, 

FinCEN analysts routinely analyze CTR data in conjunction with other 

information to develop “big picture” views of suspicious financial activity. 

Law enforcement officials noted that CTR requirements also aid their 

efforts by making it more difficult for criminals to get their illicit proceeds 

into the financial system and forcing them to act in ways that increase 

chances of detection—such as smuggling cash or “structuring” their cash 

transactions to avoid CTRs, which often prompts depository institutions to 

file a Suspicious Activity Report. Linking law enforcement’s use of CTRs to 

specific impacts is difficult, however, because agencies do not track their 

use of CTRs, which are typically one of many sources of information used 

to support investigations. FinCEN does not routinely publish any summary 

information on law enforcement’s use of CTR data—such as identified 

trends and case examples—as it does for Suspicious Activity Reports. 

Although concerns about revealing investigatory sources and methods limit 

dissemination of detailed information on how law enforcement agencies 

use CTR data, our interviews with financial institution officials suggest that 

they would better understand the value of meeting their requirements if the 

institutions were provided with similar summary information on CTR use. 

Our analysis of CTR data for 2004 to 2006 shows that a large proportion 

was filed by a small number of the largest depository institutions—for 

example, fewer than 30 very large banks accounted for 55 percent of new 

CTRs during the period—and while these institutions likely incur the 

greatest expenditure of time and resources to meet CTR requirements, all 
Page 6 GAO-08-355 Bank Secrecy Act

depository institutions incur some costs regardless of the number of CTRs 

they file. This is because institutions must have processes and trained staff 

in place to identify when and if a CTR is required, including the ability to 

aggregate same-day cash transactions made by or on behalf of the same 

person, and to file CTRs correctly. While automation has made these tasks 

less difficult, most institutions reported that their processes still include 

“manual” steps; for example, most institutions reported that their CTRs are 

reviewed by branch managers or compliance officers before being sent 

electronically to FinCEN or by mail to IRS. Institutions we contacted were 

generally unable to quantify their costs for meeting CTR requirements, in 

large part because they use the same personnel and processes for meeting 

other BSA requirements or for other purposes and do not separately 

account for CTR-related costs. However, they noted that personnel costs 

include the cost of training staff on meeting CTR requirements, as well as 

the cost of labor involved in filing CTRs. Reflecting the range of numbers of 

staff that may be involved, officials provided a wide variance of estimated 

personnel costs. For example, while one very large bank that filed almost 1 

million CTRs in 2006 estimated personnel costs, including tellers and 

compliance officers, of about $5.4 million, a large bank that filed just under 

5,000 CTRs in 2006 estimated personnel costs at $76,000. Officials at 

institutions with automated processes also cited technology as a significant 

cost.

Our survey of depository institutions and interviews with officials 

identified a variety of factors that deter the use of exemptions, as well as 

opportunities for increasing their use without diminishing the usefulness of 

CTR requirements to law enforcement. Our survey results showed that 

many financial institutions with customers considered eligible for 

exemptions do not actually exempt them, but instead continue to file CTRs 

on the customers’ transactions—despite the institutions’ recognition that 

making use of the exemption provisions would enable them to file fewer 

CTRs. The reasons they cited included uncertainty about the 

documentation needed to demonstrate that certain customers are in fact 

eligible for exemptions, accompanied by concern that the federal banking 

regulators would deem the documentation insufficient and cite them for 

noncompliance with BSA requirements. For example, depository 

institutions that chose to use the Phase II exemption relied on various 

methods—sometimes to a considerable extent—to determine and 

document the portion of the customer’s revenues derived from ineligible 

activities, including asking the customer for financial statements, tax 

records, or other documentation such as a letter certifying its revenue 

sources. While our review of data from the banking regulators showed 
Page 7 GAO-08-355 Bank Secrecy Act

relatively few violations compared with the number of BSA examinations 

conducted, we found variations in the types of documentation the 

regulators find acceptable. For example, officials from two of the banking 

regulators said that a letter from a customer self-certifying its revenue 

sources could be acceptable to document eligibility for a Phase II 

exemption, while officials from two other regulators indicated that such a 

letter alone would be inadequate documentation. Both the difficulties cited 

by the institutions and the variation among examiners indicate that further 

CTR guidance from FinCEN could be helpful in this regard. Other factors 

discouraging the use of exemptions were the cost and effort involved in 

meeting FinCEN’s regulatory requirements to (1) file an exemption form, 

and annually review and update the information, particularly for certain 

customers that are required to be exempted by statute as appropriate; and 

(2) biennially file a form to document the continued eligibility of customers 

that have been exempted under the Phase II regulation, which many 

institutions viewed as redundant in light of the required annual review 

process. Eliminating these requirements could encourage institutions to 

make greater use of exemptions. Other opportunities to encourage the use 

of exemptions include (1) shortening the waiting period—currently a full 

year under FinCEN’s regulations—before exempting certain customers 

with frequent cash transactions that exceed the $10,000 threshold, and (2) 

making available from FinCEN Web-based material to help train and guide 

depository institutions’ staff in making exemption determinations. While 

FinCEN currently provides such material—such as answers to frequently 

asked questions, rulings, and guidance—for other BSA requirements, the 

information on CTR exemption requirements is very limited; and about 50 

percent of respondents to our survey indicated that the availability of such 

Web-based material from FinCEN would increase their use of exemptions. 

Because the transactions of exempt customers are likely to be of little or no 

value to law enforcement, these actions could avoid the burden of filing 

some CTRs without harming law enforcement efforts. 

We are recommending that the Secretary of the Treasury direct FinCEN to 

consider routinely publishing summary information on law enforcement 

uses of CTRs, provide additional guidance on the documentation needed to 

demonstrate eligibility for some customers, revise certain regulations that 

deter exemptions, and provide Web-based material to help depository 

institutions interpret exemption requirements. In written comments on a 

draft of this report, the Director of FinCEN concurred with our 

recommendations seeking regulatory amendments and those related to 

guidance and materials to aid industry in making eligibility determinations 

for CTR exemptions, and said that FinCEN will consider options to provide 
Page 8 GAO-08-355 Bank Secrecy Act

industry with additional feedback on the use of CTRs by law enforcement. 

We also received written comments from the Board of Governors of the 

Federal Reserve System (Federal Reserve), Federal Deposit Insurance 

Corporation (FDIC), National Credit Union Administration (NCUA), and 

Office of Thrift Supervision (OTS) that, in a joint letter, reaffirmed their 

support for effective administration of the BSA and said they believe that 

streamlining and clarifying the exemption regulations, as we recommend, 

would be a positive step.

Background According to BSA’s objectives, CTRs are to have a “high degree of 

usefulness” and their uses include criminal, tax, or regulatory 

investigations or proceedings. In 2001, the USA PATRIOT Act added a 

fourth purpose: the conduct of intelligence or counterintelligence 

activities, including analysis, to protect against international terrorism.8

 

CTRs are intended to provide a paper trail for federal, state, and local law 

enforcement agencies in their investigations and, thus, potentially hinder 

using financial institutions as intermediaries for the transfer or deposit of 

money derived from criminal activity.9

 A CTR records account cash 

withdrawals and deposits, as well as currency exchanges, and wire 

transfers purchased with cash, when the amount of the transaction is more 

than $10,000. In addition to the dollar amount of the cash transaction, a 

CTR records information about the account owner, including the owner’s 

occupation, and the identity of the person actually conducting the 

transaction (the conductor), if not the account holder. A depository 

institution must file a CTR for transactions that collectively exceed $10,000 

during the course of a day if the institution has knowledge that they are for 

or on behalf of the same person. 

8

The Uniting and Strengthening America by Providing Appropriate Tools Required to 

Intercept and Obstruct Terrorism (USA PATRIOT ACT) Act of 2001, Pub. L. No. 107-56 § 358, 

115 Stat. 272, 326 (Oct. 26, 2001). We refer to the act as the USA PATRIOT Act.

9

In addition to depository institutions, casinos, money services businesses, and futures 

commission merchants are required to file currency transaction reports. Money services 

businesses are businesses that, among other things, transmit money; cash checks; issue, 

sell, or redeem traveler’s checks or money orders; or deal or exchange currency.
Page 9 GAO-08-355 Bank Secrecy Act

The Money Laundering Suppression Act of 1994 provided basic criteria for 

establishing and maintaining exemptions and authorized Treasury to 

establish further requirements.10 FinCEN has done so through both 

regulations and “interpretative letters” that supplement the regulations to 

provide further guidance. Table 1 summarizes the requirements as outlined 

in the statute, implementing regulations, and interpretive letters. 

Table 1: Statutory and Regulatory Provisions That Determine Which Customers May Be Exempted 

10Prior to the 1994 law, Treasury had procedures in place for filing CTR exemptions, but they 

were considered cumbersome and difficult to understand. H. R. Conf. Rep. No. 103-652 

(1994), reprinted in 1994 U.S.C.C.A.N. 1977, 2016. See also 61 Fed. Reg. 18204, 18205 (Apr. 

24, 1996).

Statutory provision Regulatory provision

Customers eligible for exemptions under Phase I

Another depository institution. A bank, to the extent of such bank’s domestic operations.

A department or agency of the United 

States, any state, or any political 

subdivision of any state.

The same as statutory provision.

Certain other entities exercising 

governmental authority on behalf of the 

United States, any state or political 

subdivision of any state.

The same as statutory provision.

Any business or category of business 

the reports on which have little or no 

value for law enforcement purposes.

Any entity, other than a bank, whose common stock is listed on the New York, American, or 

NASDAQ Stock Exchange, with some exceptions (a “listed entity”); and any subsidiary, other 

than a bank, of any “listed entity” that is organized under U.S. law and at least 51 percent of 

whose common stock is owned by the listed entity. 

A nonbank financial institution meeting these criteria may be extended only to the extent of its 

domestic operations.

Eligibility criteria for business customers under Phase II

Maintains a transaction account at the 

depository institution, and

A commercial enterprise that has maintained a transaction account at the bank for at least 12 

months.

Frequently engages in transactions 

with the depository institution that are 

subject to the CTR reporting 

requirements, and

Frequently (defined in an Interpretive Letter as at least 8 times within a 12-month period, 

excepting certain “seasonal” customers) engages in cash transactions in excess of $10,000.

Meets other criteria which the 

Secretary determines are sufficient to 

ensure the purposes of the BSA are 

carried out.

Is incorporated or organized under U.S. law, or state law, or is registered as and eligible to do 

business in the United States or a state, to the extent of its domestic operations, and to the 

extent that no more than 50 percent of its gross revenues come from activities specified as noneligible business activities.
Page 10 GAO-08-355 Bank Secrecy Act

Source: GAO analysis of 31 U.S.C. § 5313(d) and (e), and 31 C.F.R. § 103.22(d).

Note: Phase II exemptions also include a second category referred to as “payroll businesses,” which 

are defined in 31 U.S.C. § 103.22(d)(2)(vii).

Legislative proposals would alter the basis for establishing exemptions, as 

well as raise the reporting threshold amount above $10,000. For example, 

in January 2007, the U.S. House of Representatives passed the Seasoned 

Customer CTR Exemption Act of 2007 (H.R. 323), which would require the 

Secretary of the Treasury to (1) prescribe regulations for exempting 

“qualified customers,” including criteria for suspending, rejecting, or 

revoking exemptions; and (2) periodically review the threshold amount and 

adjust it for inflation as appropriate. H.R. 1447, the CTR Modernization Act, 

introduced in March 2007, would raise the threshold amount for insured 

depository institutions to $30,000.

FinCEN’s role is to oversee administration of the BSA throughout the 

federal government. Pursuant to this role, FinCEN, among other things, 

develops policy and provides guidance to other agencies and analyzes BSA 

data for trends and patterns. FinCEN relies on the regulators of depository 

institutions—the Federal Reserve Board (Federal Reserve), Federal 

Deposit Insurance Corporation (FDIC), National Credit Union 

Administration (NCUA), Office of the Comptroller of the Currency (OCC), 

and Office of Thrift Supervision (OTS)—to ensure that depository 

institutions comply with BSA reporting requirements. In addition to CTRs, 

depository institutions are required by BSA and its implementing 

regulations to make available information on their customers’ transactions 

in certain circumstances:

Customers not eligible for exemption

FinCEN must establish guidelines, 

which may include a description of the 

type of business for which no 

exemption will be granted.

Businesses for which no exemption as a nonlisted business will be granted are those engaged 

primarily in 

• serving as financial institutions or agents thereof;

• purchase or sale of motor vehicles, vessels, aircraft, farm equipment or mobile homes;

• practice of law, accountancy, or medicine;

• auctioning of goods;

• chartering or operation of ships, buses, or aircraft; 

• gaming of any kind (other than pari-mutuel betting at race tracks) 

• investment advisory services or investment banking services; 

• real estate brokerage;

• pawn brokerage;

• title insurance and real estate closing;

• trade union activities; and

• any other activities that may be specified by FinCEN

(Continued From Previous Page)

Statutory provision Regulatory provision
Page 11 GAO-08-355 Bank Secrecy Act

• Depository institutions are required to file Suspicious Activity Reports 

(SAR) with FinCEN if a transaction involves or aggregates at least 

$5,000 in funds or other assets, and the institution knows, suspects, or 

has reason to suspect that the transaction is designed to evade any 

requirements of the BSA.11

• Under Section 314(a) of the USA PATRIOT Act, federal law enforcement 

agencies, through FinCEN, can reach out to financial institutions to 

locate accounts and transactions of persons suspected of engaging in 

terrorism or money laundering.12

FinCEN is responsible for providing these agencies with assistance in 

educating institutions on their BSA responsibilities. To focus and direct 

their efforts in supporting the effectiveness of BSA compliance, FinCEN’s 

strategic plan for fiscal years 2006-2008 outlines several goals. For 

example, to assist law enforcement, the plan calls for FinCEN to reduce the 

number of CTRs filed on legitimate financial transactions that are of little 

or no value to law enforcement; and, to assist financial institutions, the 

plan calls for FinCEN to revise its data collection forms, regulations, and 

practices to ensure that FinCEN collects the information necessary to meet 

its mission while minimizing reporting burdens on the financial industry. In 

addition, FinCEN indicated in its plan that it would consider providing 

guidance on BSA requirements through written and Web-based materials 

and by means of a call center to respond to specific questions.

FinCEN, together with the IRS, is responsible for managing and storing the 

BSA data that financial institutions report. Financial institutions that 

submit CTRs in paper form mail them directly to IRS’s Enterprise 

Computing Center in Detroit. Institutions that submit data electronically 

transmit them directly to FinCEN, which in turn transmits them to the 

1131 U.S.C. § 5318(g)(1) and 31 C.F.R. §§ 103.15–103.21. Depending on the type of financial 

institution, the threshold amount may vary. For example, money services businesses 

generally must file a SAR if a transaction involves or aggregates $2,000 in funds or other 

assets. 31 C.F.R. § 103.20. SAR forms must be filed for certain suspicious transactions 

involving possible violation of law or regulation, including transactions that are broken up 

for the purpose of evading the BSA reporting and recordkeeping requirements. See FinCEN 

Ruling 2005-6 Suspicious Activity Reporting (Structuring) (July 15, 2005). 

12Additionally, Section 314(a) of the USA PATRIOT Act required the Secretary of the 

Treasury to adopt regulations to encourage regulatory authorities and law enforcement 

authorities to share with financial institutions information regarding individuals, entities, 

and organizations engaged in, or reasonably suspected of engaging in, terrorist acts or 

money laundering activities. 
Page 12 GAO-08-355 Bank Secrecy Act

center. The center collects and stores all BSA data in its Currency Banking 

and Retrieval System (CBRS).13 For fiscal year 2007, the IRS estimated the 

total cost of processing CTRs to be about $7 million, including about $3.5 

million to convert CTRs submitted on paper to an electronic format. IRS 

examiners and investigators access BSA data directly through IRS’s 

Intranet, while FinCEN has a direct connection to the Enterprise 

Computing Center. Staff at other law enforcement agencies can access BSA 

data via the Internet, and certain federal agencies also periodically receive 

bulk data downloads of BSA data for use at their agencies, as described 

later in this report.

CTR Requirements Are 

Useful to Law 

Enforcement Efforts in 

a Variety of Ways, but 

Measuring Their 

Impact Is Difficult

Federal, state, and local law enforcement officials we interviewed and 

surveyed said that information in CTRs provided unique and reliable 

information essential to a variety of efforts and that recent advances in 

technology, along with FinCEN’s distribution of BSA data in bulk, have 

enhanced their ability to use and analyze CTR information. Law 

enforcement officials stated that, in addition to supporting specific 

investigations, CTR requirements aid their efforts by making it more 

difficult for criminals to get their illicit proceeds into the financial system 

and forcing them to act in ways that increase chances of detection. Linking 

law enforcement’s use of CTRs to specific outcomes is difficult, however, 

because agencies do not track their use of CTRs, which are typically one of 

many sources of information used to support investigations. FinCEN does 

not routinely publish any summary information on law enforcement’s use 

of CTR data as it does for Suspicious Activity Reports, such as identified 

trends and case examples. Although concerns about revealing investigatory 

sources and methods limit dissemination of detailed information on how 

law enforcement agencies use CTR data, our interviews with depository 

institution officials suggest that they would better understand the value of 

meeting their requirements if the institutions were provided with similar 

summary information on CTR use. 

13For more information on the center’s activities, see GAO, Bank Secrecy Act: FinCEN and 

IRS Need to Improve and Better Coordinate Compliance and Data Management Efforts, 

GAO-07-212 (Washington, D.C.: Dec. 15, 2006). 
Page 13 GAO-08-355 Bank Secrecy Act

CTRs Provide Unique 

Information for 

Investigating Cases and 

Detecting Criminal 

Activities

In part due to advances in technology that have enhanced access to, and 

analysis of, CTR data, law enforcement officials use CTR data to help 

investigate a variety of crimes, including tax evasion, customs violations, 

and drug trafficking. They use CTR data both “reactively”—that is, to 

support existing investigations of one or more suspects—and 

“proactively”—to analyze patterns or trends that can serve as the basis for 

initiating new investigations. 

Technological Advances Have 

Increased Access and Analytic 

Capability

In 1993, we reported that CTRs were not used to their full extent by law 

enforcement agencies because the large volume of reports made 

meaningful analysis difficult and access to the data, particularly at the state 

level, was limited and cumbersome.14 However, access to BSA data at the 

federal, state, and local levels has improved and technological advances 

have made meaningful analysis of large BSA data sets possible. Consistent 

with its strategic goal of facilitating information sharing through electronic 

means, FinCEN has increased access to CTR (and other BSA) data in two 

ways.

First, FinCEN began providing selected federal agencies with access to 

“bulk” CTR data—essentially all of the data resulting from CTRs. In 2004, 

FinCEN first provided the FBI with bulk transfer of data, and during 2005 

and 2006 FinCEN agreed to provide two federal agencies—the Secret 

Service and ICE—and a multiagency program established by the 

Department of Justice (the Organized Crime Drug Enforcement Task 

Force, or OCDETF Fusion Center) with access to a bulk data set.15 

Receiving these data in bulk, rather than accessing the database remotely 

and querying it for specific records, allows agencies to conduct more 

sophisticated analyses by combining the BSA data with other data sets, as 

can be seen in the following examples.

• The FBI has combined bulk BSA data into its Investigative Data 

Warehouse, a collection of more than 50 multisource data sets that 

14GAO, Money Laundering: The Use of Bank Secrecy Act Reports by Law Enforcement 

Could Be Increased, GAO/T-GGD-93-31 (Washington, D.C.: May 26, 1993).

15The Department of Justice established the OCDETF program in 1982 to conduct 

comprehensive attacks on major drug trafficking and money laundering organizations. This 

program combines the resources and expertise of several federal agencies, including DEA, 

IRS, FBI, and ICE. The OCDETF Fusion Center stores drug and related financial 

investigative information for analysis. ICE officials noted that while it participates in 

OCEDTF, it does not participate in the Fusion Center.
Page 14 GAO-08-355 Bank Secrecy Act

includes counter terrorism data. According to the FBI, access to BSA 

bulk data has significantly increased its usage of CTR data (the bureau 

reported data that indicated approximately 194,000 CTR views from 

2004 through 2006 of the downloaded data). According to FBI officials, 

about 40 percent of all FBI terrorism subjects appeared on CTRs that 

were filed between January 1, 2000, and June 30, 2006; further, CTR data 

were the most viewed data in the warehouse.

• OCDETF’s Fusion Center integrated bulk BSA data with drug, financial, 

and gang-related investigative data provided by several other federal, 

state, and local law enforcement agencies. According to OCDETF 

officials, as of June 2007, CTR data had appeared in 61 percent of the 

Fusion Center’s analytical products. 

• ICE has combined BSA data with import and export data for selected 

countries to help identify and detect discrepancies or anomalies in 

international commerce that might indicate trade-based money 

laundering.

Second, FinCEN improved Internet access to CTR data. FinCEN provides 

and grants access using its “Gateway” program, through which law 

enforcement staff may access the database using a system known as 

WebCBRS.16 With WebCBRS, users can download large volumes of CTR 

data—up to 20,000 CTRs on a single query—and export it to a spreadsheet 

application, such as Excel. This allows users to more readily conduct 

proactive analyses, such as identifying transaction trends by categories. 

Most of the law enforcement officials with whom we spoke, as well as 

officials of state and local agencies we surveyed, confirmed that WebCBRS 

is more user friendly than its predecessor and has greatly improved their 

ability to search for and analyze CTR data.17 (More detailed information 

about the technological advances enabling greater use of CTR data, along 

with examples of use in specific investigations, is presented in appendix II. 

Our survey of law enforcement agencies and a more complete tabulation of 

the results can be viewed at http://www.gao.gov/cgi-bin.getrpt?GAO-08-

385SP.)

16Agencies without direct Gateway access may visit FINCEN’s offices and access BSA data 

directly; these users are referred to as “platform users.”

17About 79 percent of survey respondents reported that WebCBRS had made a “very great” 

or “great” improvement in their ability to access CTR data, as measured by “ease of use” or 

“query response time.”
Page 15 GAO-08-355 Bank Secrecy Act

Perhaps reflecting improvements in the ability to access and analyze CTR 

data, the number of agencies using CTR data has increased, and officials at 

some agencies noted that they have incorporated a search of CTR data as a 

routine part of their investigations. For example, from 2004 through 2006, 

the number of agencies that viewed CTR data through the Gateway 

program increased from 109 to 136 and, as of October 2007 requests from 

an additional 110 agencies for access to CTR data were pending FinCEN’s 

review.

Agencies Value CTRs as a Source 

of Unique, Reliable, and Timely 

Data

Officials from law enforcement agencies we interviewed emphasized that 

CTRs are important because they provide information that is often 

unavailable from other sources, or is more objective or up-to-date than that 

obtained from other sources. They cited ways in which CTRs provide more 

comprehensive or timely information about a suspect’s banking 

transactions than they can obtain using other provisions of law.

More specifically, law enforcement officials frequently identified the name 

of the currency transaction’s conductor—the person who actually carries 

out a cash transaction at a financial institution, but who is not the holder of 

the affected accounts—as useful information that is unique to CTRs. For 

example, an FBI official noted a case in which analysis of information 

obtained by searching the CTR database conductor field provided the 

agency with the investigative lead needed to track the banking activities of 

persons who, according to the FBI official, were involved in a cocaine 

distribution ring. The conductor information was useful because the main 

person under investigation in the ring had associates open bank accounts 

in their own names at different banks and then made large currency 

transactions into these accounts, resulting in CTRs that recorded the main 

person under investigation as the conductor. Further, FinCEN and other 

law enforcement officials explained that because multiple individuals may 

use the same account to conduct transactions, CTRs often could be used to 

identify unknown persons associated with suspects, thereby expanding the 

scope of investigations. For example, during a 4-year FBI investigation, 

analysis of CTRs showed where suspects were banking as they opened and 

closed accounts, and on which day of the week suspects typically made 

their deposits, allowing the FBI to better plan its surveillance.

Law enforcement officials also noted that CTRs provide a unique source of 

information on the occupations of account holders that often proves 

useful. For example, a DEA official reported that analyzing CTRs by the 

information in the occupation field has allowed him to identify whether 

medical companies or doctors—lines of businesses that typically would not 
Page 16 GAO-08-355 Bank Secrecy Act

be dealing in high volumes of cash—were diverting controlled substances 

for illegal use. Finally, officials from several federal law enforcement 

agencies, including the Bureau of Alcohol, Tobacco, Firearms, and 

Explosives, IRS-Criminal Investigation, ICE, and DEA, commented that 

because depository institutions are required to file CTRs soon after a 

reportable transaction occurs, the CTR database provides up-to-date 

information on large cash transactions.18 Many federal, state, and local 

officials we interviewed commented that CTRs provided them with ready 

access to information that they could not otherwise obtain in a timely 

manner.

Officials contrasted these useful aspects of information from CTRs with 

information they may be able to obtain on suspects’ banking activities 

under other provisions of the BSA or other laws:

• Suspicious Activity Reports (SAR) also provide useful information; 

however, depository institutions have some discretion in determining 

whether a transaction or customer is “suspicious,” and therefore the 

institutions determine whether to file a SAR and, if so, what information 

to include. Thus, a SAR might not capture the same level of information 

about specific transactions that a CTR routinely would provide. Further, 

criminals may use several different banks to conduct their transactions, 

and a SAR would reflect the suspicious activity only within the bank 

filing the SAR.

• The Section 314(a) process, under which federal law enforcement 

agencies may reach out to financial institutions to locate accounts and 

transactions of persons of interest, is reserved for significant moneylaundering or terrorist-financing investigations, and agencies may make 

such requests only upon approval by FinCEN, which limits the number 

of subjects on the list. Further, according to FinCEN, the request 

provides lead information only—law enforcement agencies must meet 

the legal standards that apply to the investigative tool that it chooses to 

use to obtain documents, such as a subpoena. In addition, officials at 

FinCEN and the IRS noted that the 314(a) process provides law 

enforcement access only to transactions conducted within the last 6 

18A completed CTR must be filed with FinCEN within 15 days after the date of the 

transaction (31 C.F.R. § 103.27(a)(1)). Treasury has determined that CTRs filed on magnetic 

media or electronically will be considered filed in a timely manner if received within 25 

days.
Page 17 GAO-08-355 Bank Secrecy Act

months, or accounts held within the last 12 months, while the CTR (and 

other BSA) data provide access to data going back 10 years. 

• Obtaining bank records through subpoenas could take months or be 

difficult. Further, in order to subpoena a specific institution, officials 

would need to know that a suspect banked at that institution. A majority 

(55 percent) of the state and local law enforcement officials we 

surveyed noted that it would be “somewhat more” or “much more” 

difficult to obtain information from bank records in this fashion than 

from using CTRs. 

• Other methods of obtaining information about a suspect’s bank 

accounts—including “mail covers” (copies, obtained from the U.S. 

Postal Service, of the fronts of envelopes delivered to a suspect), 

subpoenas for credit reports, and surveillance—are time consuming and 

less likely to provide needed information about a bank account, 

according to law enforcement officials. ICE and state officials from New 

York and Texas noted that their agencies could wait days to obtain mail 

covers, with no guarantee of receiving one bearing an address of the 

suspect’s financial institution. New York state law enforcement officials 

said that the next best alternative would be to subpoena a suspect’s 

credit report, a process that could take 30 days. While the credit report 

may provide useful leads—for example, a suspect’s mortgage 

application—that the agency might then subpoena, the time required 

would further lengthen the investigation. 
Page 18 GAO-08-355 Bank Secrecy Act

Agencies Reported Using CTR 

Data to Support a Wide Variety of 

Investigative Cases

Most officials of law enforcement agencies we contacted indicated that 

they most often use CTRs reactively, and many routinely review CTRs at 

the beginning of each investigation.19 For example, tax investigators in IRS 

routinely query BSA data to identify CTRs with information that suggests 

situations such as a business paying employees in cash (and thus not 

withholding taxes). However, law enforcement agencies typically did not 

use CTRs in isolation to develop a case; rather, they used CTR data to 

identify leads for further investigation, in part by comparing CTR 

information with information from other sources. As explained by law 

enforcement officials, the information in CTRs is useful in corroborating 

information contained in other BSA reports. For example, agencies may 

compare information from the CTR database to that obtained from Reports 

of International Transportation of Currency or Monetary Instruments 

(CMIR), which report currency transported into the United States, to track 

how businesses dispose of cash.20 Agencies also consult CTR data to obtain 

more detailed information after reviewing SARs. For example, officials 

from a High Intensity Money Laundering and Related Financial Crimes 

Areas (HIFCA) noted that they used CTR data for 105 of the 120 reports 

they filed over a recent 1-year period on investigations initiated after 

reviewing SARs.21 In this regard, many law enforcement officials, including 

those from ICE, IRS, and the U.S. Attorney’s office, noted that raising the 

CTR filing threshold of $10,000 would affect adversely their ability to deter 

money laundering, because the CTR threshold corresponds to those set in 

other anti-money-laundering provisions. For example, officials from the 

U.S. Attorney’s office indicated that the CTR threshold works in tandem 

with three other statutorily mandated reporting thresholds, which

19About 55 percent of the survey respondents tended to use CTR data more reactively than 

proactively, and 28 percent used CTR data completely reactively.

20Individuals or businesses are required to file a CMIR to report the transportation, whether 

physically or through the mail, of currency or other monetary instruments into or out of the 

United States, on any one occasion, in excess of $10,000. (31 U.S.C. § 5316; 31 C.F.R. § 

103.23).

21HIFCAs were conceived in the Money Laundering and Financial Crimes Strategy Act of 

1998 as a means of concentrating law enforcement efforts at the federal, state, and local 

levels in areas of high-intensity money laundering. HIFCAs were first announced in the 1999 

National Money Laundering Strategy. Pub. L. No. 105-310, 112 Stat. 2941 (Oct. 30, 1998) 

codified at 31 U.S.C. §§ 5340-5342 and 5351-5355.
Page 19 GAO-08-355 Bank Secrecy Act

are also set at $10,000: the CMIR requirement; the Form 8300 requirement; 

and the bulk cash smuggling statute.22

That no CTRs have been filed on business activities that might be expected 

to generate them also provides valuable leads to law enforcement. For 

instance, FinCEN, ICE, and DEA conduct analyses comparing known cash 

flows documented through other sources with cash flows they would 

expect CTRs to document. Officials at both FinCEN and ICE reported that 

a search of BSA data for information on a cash business revealing no CTRs 

could alert investigators that the business was not using traditional 

depository institutions and direct their focus to nonbank financial 

institutions such as money services businesses or to the possibility of 

currency smuggling. Similarly, the lack of CTRs relating to particular 

individuals or businesses can provide investigative leads. For example, 

officials from FinCEN and a Florida law enforcement agency said that the 

presence of a CMIR, coupled with an absence of related CTRs, could 

provide intelligence that currency transported into the country was 

subsequently laundered into the financial mainstream through 

“structuring” (making a series of cash transactions in amounts less than 

$10,000). Another law enforcement official from Florida indicated that a 

lack of CTRs corroborated findings from her agency’s surveillance 

operations that certain laundromats, dry cleaners, and travel agencies had 

laundered millions of dollars.

As shown in figure 1, the state and local law enforcement agencies we 

surveyed found CTRs to be of most use when developing leads for existing 

investigations. Officials from law enforcement agencies in California, New 

York, and Texas—states that were among the highest users of CTR data—

indicated that their investigators typically used CTRs to identify a subject’s 

bank account numbers and associates who might be conducting 

transactions on behalf of the subject. An official from one of these agencies 

indicated that no other source of information enabled investigators to 

22Under BSA provisions, individuals involved in trades or businesses that are not financial 

institutions—such as car dealerships or jewelers—are required to file a Form 8300 to report 

a cash payment over $10,000. (31 U.S.C. § 5331). The USA PATRIOT Act created a new 

money laundering offense: bulk cash smuggling. The new statute prohibits the concealment 

and transfer of more than $10,000 across the border with the intent to evade reporting 

requirements. (31 U.S.C. § 5332). The Money Laundering Control Act of 1986 criminalized 

money laundering, including knowingly engaging in a monetary transaction of more than 

$10,000 with property derived from criminal activity. Pub. L. No. 99-570, title I, subtitle H, § 

1352(a), 100 Stat. 3207 (Oct. 27, 1986) (codified at 18 U.S.C. § 1957).
Page 20 GAO-08-355 Bank Secrecy Act

“map” the financial links between members of a criminal organization as 

well as the CTR. 

Figure 1: Extent to Which State and Local Agencies Found That CTRs Assisted Them in Verifying Known or Obtaining 

Previously Unknown Information

Regarding types of investigations involving CTR data, officials of state and 

local agencies we surveyed reported that they primarily use CTRs for 

money-laundering, fraud, and drug investigations (see fig. 2). State law 

enforcement officials we interviewed told us that they use CTRs for a wide 

variety of investigations relating to money laundering, drugs, workers 

compensation fraud, Medicaid fraud, mortgage fraud, and white collar 

crime. 

Type of assistance Percentage

Verified or confirmed information about a suspect that was already known

Provided support to obtain a subpoena for related bank records

Provided investigative leads that were previously unknown

Identified assets that were previously unknown, including those that could be used for forfeiture action

Identified potential subjects that were previously unknown

Provided a basis for referring investigations to another agency

Eliminated subjects or narrowed the scope of the investigation

50 22

43 12

32 21

33 19

28 22

24 10

19 11

Source: GAO.

Fairly often

Always or very often
Page 21 GAO-08-355 Bank Secrecy Act

Figure 2: Purposes for Which State and Local Agencies Reported Using CTRs and How They Rated CTRs’ Usefulness

Purpose of using CTRs Usefulness

(percentage)

Support for civil or administrative actions

Tax investigations

Regulatory (e.g., financial services,

insurance) investigations

Intelligence or counterintelligence

activities, including analysis, to protect

against international terrorism

Criminal investigationsother

Support for indictments

and prosecutions

Criminal investigationsdrugs

Criminal investigationsorganized crime

Criminal investigationsfraud

Criminal investigations76 money laundering

10

66

5

66 8

65

5

67

18

68

3

64

24

64 14

65 20

63 25

77% 22%

75% 21%

60% 33%

76% 13%

44% 28%

38% 28%

33% 30%

19% 17%

14% 20%

12% 15%

Source: GAO.

Slightly or not at all useful

Extremely or very useful Secondary purpose

Primary purpose
Page 22 GAO-08-355 Bank Secrecy Act

State and local officials also indicated that the current threshold amount of 

$10,000 was important to the usefulness of CTRs. Specifically, about 58 

percent of the state and local officials we surveyed stated that increasing 

the CTR filing threshold would result in a “very great” or “great” reduction 

in the usefulness of the CTR filing requirement to their work. A law 

enforcement investigator from Illinois indicated that many of the CTRs that 

his agency’s criminal intelligence center reviewed were those that 

documented total transaction amounts between $10,000 and $20,000. 

Similarly, an investigator with a Minnesota law enforcement agency 

indicated that the overwhelming majority of CTRs that he found to be of 

use to his investigations were for transactions between $10,000 and 

$20,000.

Law Enforcement Agencies Use 

Aggregated CTR Data to Help 

Detect Patterns or Trends

Law enforcement agencies noted that CTR information also contributes to 

pattern and trend analyses. For example, at the request of DEA, FinCEN 

analyzed CTRs filed by institutions in California by ZIP code, providing a 

statistical overview of financial activity occurring within those areas that, 

combined with other law enforcement intelligence, allowed DEA analysts 

to assess threats on a statewide basis. FinCEN officials indicated that their 

analysts routinely analyze information from CTRs in conjunction with 

information from SARs or other BSA reports to develop “big picture” views 

of suspicious financial activity. In addition, ICE officials noted that their 

analysts often analyze the “conductor” and account holder information 

from CTRs to identify individuals moving the largest sums of money on 

behalf of particular account-holders over time to spot any unusual trends. 

Further, ICE officials commented that they proactively search CTR 

information to identify individuals moving large sums of money using the 

same Social Security number with different personal or business names 

(according to the officials, name variations is a common technique 

criminals use to hide their activities and avoid detection). According to 

FinCEN and IRS officials, analytical tools such as data mining—the 

application of database technology and techniques, such as statistical 

analysis and modeling, to uncover hidden patterns and subtle relationships 

in data—have enhanced their investigative efforts by improving their ability 

to identify data patterns and trends indicative of money laundering and 

other financial crimes.
Page 23 GAO-08-355 Bank Secrecy Act

CTR Requirements Can 

Cause Criminals to Act in 

Ways That Increase Chances 

of Detection

According to federal law enforcement officials, criminals are forced to 

undertake more risky and suspicious methods of money laundering than 

depositing cash into depository institutions because they are well aware of 

the $10,000 filing threshold for CTRs and the investigative paper trail that it 

creates. While criminals can use a variety of means to launder their money, 

law enforcement officials we interviewed pointed to three primary 

methods that criminals use to avoid the CTR filing requirement: 

structuring; bulk cash smuggling, or physically moving cash across borders 

via courier or secreted in cargo; and trade-based money laundering, the 

process of disguising the proceeds of crime and moving value through the 

use of trade transactions.

Many federal law enforcement officials said that the CTR reporting 

requirement was critical in supporting the ability of depository institutions, 

as well as their own investigators, to identify suspicious activity based on 

the structuring of financial transactions to avoid CTRs. The BSA makes it 

illegal to structure transactions to avoid triggering otherwise applicable 

reporting requirements, such as the CTR, allowing federal prosecutors to 

file charges against individuals who structure their cash transactions.23 

The structuring in which criminals engage to avoid CTRs may cause a 

depository institution to file a SAR. FinCEN analysis of SARs filed by 

depository institutions from April 1, 1996, through December 31, 2006, 

showed that 1.5 million SARs, or 48 percent of all SARs filed by depository 

institutions during this period, were filed based on suspicious activity 

related to structuring or money laundering.24

Many law enforcement agencies routinely review SARs for evidence of 

structuring. For example, IRS-Criminal Investigation officials said that their 

agents are required to review SARs that report structuring. Officials we 

interviewed at several law enforcement organizations, including three 

associated with HIFCAs, indicated that they had formed teams to review 

SARs to generate leads for cases based on structuring and said that they 

regarded the CTR filing requirement as essential to supporting the ability of 

depository institutions to identify suspicious activity. Federal law 

enforcement officials also emphasized that the $10,000 CTR threshold 

2331 U.S.C. § 5324.

24FinCEN, The SAR Activity Review–By the Numbers, Issue 8 (June 2007). In addition, 

according to FinCEN analysis, for fiscal years 2004, 2005, and 2006, about 25 percent of 

SARs filed by depository institutions on average included references to structuring. 
Page 24 GAO-08-355 Bank Secrecy Act

played a key role, by forcing criminals to make many more and smaller 

transactions than otherwise would be required—thus making them more 

vulnerable to being reported for structuring. Officials from IRS, ICE, FBI, 

and U.S. Attorneys Offices indicated that they believed large cash 

transactions have become more uncommon as consumer access to credit 

and electronic payment options increased in the 30 years since the 

threshold was established, making the $10,000 threshold still relevant.

The existence of the CTR filing requirement also can force criminals into 

riskier activities such as bulk cash smuggling.25 According to an ICE 

official, smuggling illegal proceeds in bulk cash form makes criminals more 

vulnerable to detection because it is easier for agents of law enforcement 

to interdict bulk cash shipments. Similarly, an official associated with the 

Chicago High Intensity Drug Trafficking Area (HIDTA) reported observing 

an increase in bulk cash smuggling because criminals would rather take 

their chances smuggling their proceeds in bulk cash to Mexico.26 In 

response, the HIDTA has formed a highway patrol to interdict these cash 

shipments. Officials from ICE, FinCEN, and the Justice Department also 

reported that the increase in recent years of bulk cash smuggling across the 

U.S.-Mexican border was an indicator of CTR success in deterring 

criminals from depositing cash into domestic financial institutions.27

Measuring Usefulness of 

CTRs Is Difficult 

Linking law enforcement’s use of CTRs to specific outcome measures is 

difficult because agencies do not track their use of CTRs, which are 

typically only one of many sources of information used to support 

investigations. FinCEN does not routinely publish any information on law 

enforcement’s use of CTR data as it does for other information that 

25According to the 2007 National Drug Threat Assessment, bulk cash smuggling is the 

principal method used by drug traffickers for moving drug money out of the United States. 

Bulk cash associated with the sale of illegal drug proceeds is typically smuggled across the 

southwestern border into Mexico.

26The Anti-Drug Abuse Act of 1988 first authorized the High Intensity Drug Trafficking Area 

program to reduce drug trafficking in the most critical areas of the country. Pub. L. No. 100-

690, title I, § 1005, 102 Stat. 4181 (Nov. 18, 1988). Administered by the Office of National 

Drug Control Policy, the program has expanded to 31 areas since the original designation of 

five HIDTAs in 1990. See 21 U.S.C. § 1706.

27According to the 2007 National Money Laundering Strategy, federal law enforcement 

agencies believe bulk cash smuggling may be on the rise due in part to increasingly effective 

anti-money-laundering policies and procedures at U.S. financial institutions.
Page 25 GAO-08-355 Bank Secrecy Act

financial institutions provide under the BSA. Although concerns about 

revealing investigatory sources and methods limit dissemination of detailed 

information on how law enforcement agencies use CTR data, our 

interviews with depository institution officials suggest that they would 

better understand the value of meeting their requirements if the institutions 

were provided with summary information on CTR use. 

Agencies Have Difficulties 

Linking CTRs to Specific 

Investigation Outcomes

While CTRs appear to be valuable for law enforcement purposes, linking 

their use to specific case outcomes, such as indictments or convictions, is 

problematic. First, no requirement exists to track the use of CTR data in 

investigations, and almost all of the officials from the federal, state, and 

local law enforcement agencies we contacted reported that their agencies 

did not track their use of CTRs or how the CTRs contributed to case 

outcomes.28

As a potential indicator of use, we obtained data from FinCEN and IRS on 

the number of CTR “views”—that is, the number of times that agencies 

accessed an individual CTR record. IRS tabulates views that occur when 

agencies access the database through WebCBRS, including its own views 

through its Intranet access, while FinCEN tabulates views occurring 

through the Gateway program.29 For example, data show over 1.6 million 

views of CTRs by federal, state, and local agencies in 2006 (see table 2). 

28Eighty-three percent of state and local law enforcement agencies we surveyed reported 

that they did not have any data that would support how often CTRs have provided 

investigative leads or contributed to any other outcome measures.

29Data from the two agencies differed somewhat but showed a consistent pattern. The 

agencies were not able to explain differences in their data on the number of views. 
Page 26 GAO-08-355 Bank Secrecy Act

Table 2: CTR Views by Agencies, Fiscal Years 2004 through 2006

Source: GAO analysis of IRS and Department of Homeland Security data.

Notes: Number of CTR views does not include those from bulk downloads by the FBI.

a

The Federal Reserve, OCC, OTS, FDIC, and NCUA.

b

Other agencies include the Bureau of Alcohol, Tobacco, Firearms, and Explosives; United States 

Secret Service; United States Postal Inspection Service; U.S. Attorneys Offices; and the Securities 

and Exchange Commission; state regulatory agencies; and state and local law enforcement agencies. 

According to FinCEN data, among users who accessed the CBRS database 

through the Gateway program, state and local law enforcement agencies 

accounted for about 33 percent and 3 percent of the total CTR views, 

respectively. These users include state bureaus of investigation and 

criminal prosecuting offices, such as state offices of attorneys general and 

county prosecutors’ offices. The number of these CTR views was 

concentrated among a few agencies; for example, 10 agencies from 8 states 

accounted for almost 64 percent of the total CTR views made by state and 

local law enforcement agencies, according to FinCEN’s data. (For a map 

showing views by state, see app. II.) 

However, the numbers of views do not provide any indication of CTRs’ 

usefulness to any specific law enforcement effort or establish a link to any 

specific outcome of an investigation. Moreover, data on views during this 

period may not reflect future trends because of the changes in access to the 

CTR database discussed previously. For example, the numbers of CTRs 

viewed by state and local users may increase due to the expanding number 

of users with access and with more understanding of how CTRs can assist

Agency

Number of CTR views 

2004 2005 2006 Total

IRS 1,466,518 1,231,345 912,405 3,610,268

ICE 213,608 241,692 207,325 662,625

FinCEN 208,609 105,266 136,090 449.965

DEA 111,294 108,845 108,507 328,646

FBI 48,364 62,487 54,290 165,141

Federal banking regulatorsa 31,408 54,039 58,006 143,453

All other agenciesb 141,602 182,181 171,943 495,726

Total 2,221,403 1,985,855 1,648,566 5,855,824
Page 27 GAO-08-355 Bank Secrecy Act

their efforts.30 Several officials from state and local law enforcement 

agencies we interviewed indicated that they believed the use of CTR data 

through Gateway probably would increase as users better understand the 

value of BSA data. Also, as noted, FinCEN has recently made bulk 

downloads of data available to several federal agencies.

A second difficulty in measuring the impact specifically of CTR 

requirements involves the way that CTRs are used—primarily to support 

investigations that also draw upon many other sources of information. 

Officials from the federal investigative agencies we interviewed generally 

stated that outcome measures, such as indictments or convictions, cannot 

be linked exclusively to CTRs because they are typically one of many leads 

used to develop an investigation. Similarly, most—about 82 percent—of the 

state and local agencies we surveyed indicated that the number of 

investigative leads provided by CTRs was the best outcome measure of 

their CTR use. Further, officials from several local law enforcement 

agencies noted that attorneys often negotiate plea agreements with the 

defendant long before a case goes to trial; thus, no matter how critical the 

role played by a CTR in the investigation, there would be no trial in which 

CTRs could be used as evidence. In addition, federal, state, and local law 

enforcement officials reported that they were more likely to use CTRs as a 

basis for obtaining subpoenas to access specific bank account records than 

to use CTRs themselves as evidence in court. Officials from IRS, DEA, and 

Justice said that by the time a case moves to the trial phase, the 

prosecution is more likely to use bank records as evidence because those 

records are generally a more convincing form of evidence of a defendant’s 

transactions. However, investigators would use the CTR to locate the 

defendant’s bank accounts and identify the correct bank records to 

subpoena. Further, according to an IRS official, CTRs generally were 

presented in court only when bank records were not available or could not 

be made available in a timely manner.

FinCEN officials reported that the agency does not have outcome measures 

related to CTR use and analysis because many of the cases FinCEN 

supported were complex and might not result in tangible success for 

several years. Officials cited the example of “Operation Cash-Out,” where 

30According to FinCEN, there are Gateway coordinators in each state authorized to respond 

to requests for BSA data from local law enforcement agencies throughout the state, and 

these coordinators are required to conduct outreach to local police organizations within 

their states.
Page 28 GAO-08-355 Bank Secrecy Act

FBI authorities eventually charged persons with attempting to provide 

funding to al Qaeda. During this investigation, conducted between 2000 and 

2006, FinCEN identified more than 14,000 CTRs relating to the 

investigation.

FinCEN Does Not Publish 

Information on CTR Uses As 

It Does for Other BSA Data

Although FinCEN has taken some steps to promote awareness of CTRs and 

their value to the financial community and law enforcement agencies, it 

does not systematically report information about the numbers of CTRs 

filed or results of CTR use. Bank officials we interviewed and those 

responding to our survey strongly questioned whether the CTRs they were 

filing, especially on customers that they had determined to be at low risk 

for financial crimes, provided any value to law enforcement. Some officials 

stated that their resources would be better directed at filing SARs, which 

they viewed as having greater value to law enforcement. Other institution 

officials noted that law enforcement agencies had never contacted them. 

Law enforcement officials have given presentations at banking industry 

conferences on how BSA data helps them in their investigations. These 

industry conferences typically include presentations on how law 

enforcement uses BSA data, but they are not necessarily CTR specific. 

Officials we interviewed and those responding to our survey stated that 

they largely did not understand how the CTRs they filed were being used by 

law enforcement. 

In contrast to this general lack of information on CTR use, FinCEN 

routinely publishes information on the numbers of SARs filed and 

examples of how they have been used by law enforcement agencies. Since 

October 2000, in conjunction with law enforcement and regulatory 

agencies, FinCEN has been issuing the SAR Activity Review, which 

provides information about the preparation, use, and value of SARs that 

depository institutions, as well as other financial institutions, filed. For 

example, the October 2007 edition contained expanded descriptions of law 

enforcement cases to demonstrate the value of BSA data to the law 

enforcement community, including cases that were proactively initiated as 

a result of BSA reports, as well as trends in certain crimes identified 

through SARs. FinCEN also includes some information on the results of 

requests to financial institutions under section 314(a) of the USA PATRIOT 

Act. FinCEN officials told us that limited resources currently precluded the 

agency from routinely analyzing and publishing trend information about 

CTRs filed by depository institutions. However, the officials noted that the 

agency recently completed a study of CTR trends and patterns, and they 
Page 29 GAO-08-355 Bank Secrecy Act

were considering whether to include information on CTRs in the SAR 

Activity Review. Many officials we interviewed and those responding to 

our survey indicated that they were genuinely interested in how CTRs were 

being used. Further, our interviews with depository institution officials 

suggest that they would better understand the value of meeting their 

requirements if the institutions were provided with some information on 

CTR use, similar to that reported on uses of SARs. 

Financial Institutions 

Incur Some Costs to 

Meet Requirements 

Regardless of the 

Number of CTRs They 

File 

Our analysis of CTRs filed during calendar years 2004 to 2006 shows that a 

large proportion was filed by a small number of the largest depository 

institutions. While these institutions therefore likely incur the greatest 

expenditure of time and resources, all depository institutions incur some 

costs to meet CTR requirements, regardless of the number of CTRs they 

file. This is because institutions must have processes and trained staff in 

place to identify when and if a CTR is required, including the ability to 

aggregate same-day cash transactions made by or on behalf of the same 

person, and to file CTRs correctly. While automation has made these tasks 

less difficult, many institutions reported that their processes still include 

“manual” steps. Institutions we contacted were generally unable to quantify 

their costs for meeting CTR requirements, in large part because they use 

the same processes and staff for meeting other BSA requirements or for 

other purposes. 

While Most Depository 

Institutions File CTRs, a 

Small Number of the Largest 

Institutions Account for the 

Majority 

Our analysis of FinCEN’s data on the numbers of CTRs filed annually 

shows that, from 2004 to 2006, a relatively small number of the nation’s 

approximately 17,000 depository institutions accounted for the large 

majority of CTRs filed. For example, in 2006, fewer than 30 very large 

banks (those with assets of $50 billion or more) accounted for over half (55 

percent) of new CTRs during this period, while banks with assets between 

$1 billion and $50 billion accounted for another 30 percent.31 The largest 

credit unions—those with assets of $100 million or more—accounted for 

only 1 percent of new CTRs, and credit unions in total accounted for less 

than 2 percent. (For illustrative purposes, the remainder of this section 

focuses on CTRs filed in 2006. Details on the numbers of CTRs filed during 

31FinCEN distinguishes “new” CTRs from those that result from amendments (correcting a 

previously-filed CTR). The data in this section are based on the 37,784,310 new CTRs that 

FinCEN data indicate were filed during 2004 to 2006, and exclude the 1,045,554 amendments 

filed during the period. For further details, see appendix III. 
Page 30 GAO-08-355 Bank Secrecy Act

the 3-year period, including analyses by institutions of different sizes, 

appear in app. III.)

In 2006, nearly two-thirds of depository institutions filed at least one CTR—

89 percent of banks and 42 percent of credit unions. However, the CTRs 

were concentrated among the larger institutions (see fig. 3). For example, 

the 27 very large banks (representing less than one-half of 1 percent of all 

banks) filed 55 percent of the CTRs filed. 

Figure 3: CTRs Filed in 2006 by Banks and Credit Unions, by Asset Size

Notes: The size categories are based on institutions’ assets, as follows: very large banks (greater than 

$50 billion); large banks (greater than $1 billion - $50 billion); midsize banks (greater than $100 million 

- $1 billion); small banks ($100 million or less); large credit unions ($100 million or more); midsize 

credit unions ($10 million to less than $100 million); and small credit unions (less than $10 million).

a

The actual percentage for very large banks was 0.2.

b

The actual percentage for small credit unions was about 0.01. The actual percentage for midsized 

credit unions was about 0.2 percent. 

Further analysis of the CTRs filed in 2006 revealed that the 100 largest 

depository institutions filed 7.8 million CTRs, or 65 percent of the total. 

One institution—the single largest filer—accounted for 1.7 million CTRs 

(14 percent of the total). The median number of CTRs filed by banks in 

each size category was as follows: very large banks, 125,202; large, 1,889; 

midsize, 154; and small, 17.

Percentage of CTRs filed Percentage of institutions

Total number

of institutions

Very large

Large

Midsize

Small

Large

Midsize

Small

55

30

12

2

1

0

0

Banks %

Credit

unions

0

5

37

26

10

19

3

27

575

4,264

3,032

1,190

2,137

344

%

Source: GAO.

a

b

b
Page 31 GAO-08-355 Bank Secrecy Act

Regardless of the Number of 

CTRs Filed, Institutions 

Incur Costs to Establish and 

Maintain a CTR Filing 

Process 

Some institutions may rarely file CTRs—for example, our analysis showed 

that over 5,900 institutions did not file any CTRs in 2006—but nevertheless 

incur costs to establish a filing process and train their staff to meet CTR 

requirements. All of our survey and interview respondents reported that 

they had established processes to file CTRs and thus incurred costs 

associated with these processes.32 While the following briefly summarizes 

and depicts a typical process, we found much variation both within 

institutions—for example, procedures for filing CTRs resulting from 

aggregated transactions differed from those applicable to a single 

transaction—and among institutions. 

At most institutions, the CTR filing process typically involves a number of 

steps and staff members (see fig. 4). The staff may include tellers, branch 

supervisors, and compliance officers.33 A teller typically inputs the 

information needed to fill out the CTR form, during or immediately 

following a cash transaction greater than $10,000. The teller completes the 

form, either by hand or through an automated system, and passes it to a 

branch-level supervisor for review. Once this review is complete, the CTR 

is sent either electronically or in hard copy to the institution’s compliance 

office for an additional review and compliance check. Once the compliance 

check is complete, the CTR is signed and sent either electronically to 

FinCEN or by mail to the IRS. 

32We surveyed institutions that filed at least 120 CTRs in 2006. To obtain the viewpoints of 

smaller institutions and those that filed fewer than 120 CTRs, we relied on structured 

interviews.

33The Bank Secrecy Act requires depository institutions to have a designated BSA 

compliance officer to help assure that the institution adheres to anti-money-laundering and 

other requirements. 31 U.S.C. § 5318(h)(1)(B).
Page 32 GAO-08-355 Bank Secrecy Act

Figure 4: General Process for Filing CTRs 

To identify cases in which a CTR may be needed if certain individual 

transactions are aggregated and for other purposes, depository institutions 

generally keep a daily report of transactions across their branches and 

service centers and aggregate the transactions by customers’ tax 

identification numbers.34 Typically, compliance office staff review the 

aggregation report to see if any of the aggregated transactions made by or 

on behalf of the same person meet the CTR filing threshold. Some 

depository institution officials we interviewed said that reviewing this 

aggregation report could take from 1 to 2 hours a day, while others noted 

that it was a time-consuming process because it was a manual or partly 

manual process. Further, if information is missing, additional time is 

required to obtain it. Our analysis of CTR data shows that in 2006, 65 

percent of all CTRs filed resulted from aggregated, rather than single, 

transactions.

>$10K

Conductor Bank teller Back office Compliance

officer

IRS

Currency transaction of more than $10,000 

triggers the need for a currency transaction

report (CTR). Includes any of these possible

scenarios within a 24-hour period:

• Cash

 (deposits/withdrawals/etc.)

• Single or multiple transactions by same 

 conductor or to the same account in one 

 or more locations

Teller fills out CTR on computer or by 

hand. May be a manual or automated process. 

May require information to be gathered from 

the conductor. CTR is then forwarded to the 

back office and reviewed (banks may use 

different types of reviews).

Compliance officer signs CTR and sends

it to IRS (by e-mail, magnetic tape, or

regular mail—submission deadline varies

by type).

Currency

transaction

report

SIGNED

Currency

transaction

report

CTR

Transaction 1

Transaction 2

Transaction 3

Large

cash

report

Sources: GAO (analysis); Art Explosion (images).

Multiple transactions totaling

 more than $10,000 on the same

 account are sent to the teller

 to initiate a CTR

34A federal tax identification number, also known as an employer identification number, 

issued by the IRS, is used to identify a business entity. Generally, businesses need a tax 

identification number.
Page 33 GAO-08-355 Bank Secrecy Act

Many of our survey and interview respondents said that, in general, their 

CTR process was not complex: Fifty percent said the process was very or 

somewhat simple for their institution to complete. However, 21 percent of 

the survey respondents said their process was very or somewhat complex. 

Officials we interviewed and surveyed also noted that, in general, a number 

of variations to the basic process outlined in figure 4 exist, depending on 

circumstances. For example, additional time and effort is needed to fill in 

any required information that a teller failed to obtain at the time of a 

transaction. Similarly, if an institution filed a CTR with an error, 

subsequently filing an amended CTR may involve collecting additional 

information about the transaction; and “backfiling” (cases in which an 

institution files a CTR after discovering one needed to be filed) may require 

time-consuming review of an account’s transactions over a period of time.

In addition, we found that while most depository institutions generally 

follow the same process for filing CTRs, significant variations can exist 

among them, which may be attributed to the quantity of CTRs filed, the 

number of staff involved, the degree of automation, or institutional 

preferences in reviewing and processing CTRs. 

Technology Has Expedited 

Some Steps in the Filing 

Process, but Institutions 

Have Not Automated All 

Steps 

Technology has helped some depository institutions expedite and 

streamline many or some parts of the CTR process. Overall, 78 percent of 

institutions responding to our survey reported that at least one part of their 

CTR filing process was mostly or fully automated. Many of the institutions 

we spoke with have software systems that prompt the teller when a CTR is 

necessary for a transaction, and some institutions have systems that allow 

tellers to electronically access the CTR form at their workstation and enter 

the necessary information. Additionally, some depository institutions 

reported that they had software systems that automatically fill in some 

parts of the form. Also, some banks have invested in software that 

processes CTRs for final reviews by their compliance office staff. 

However, the extent of automation varied widely among specific steps in 

the process (see fig. 5), and no survey respondents reported a completely 

automated CTR process. For instance, 35 percent of survey respondents 

said they had a mostly or fully automated process for their tellers to fill out 

CTR forms, while 48 percent reported this step was largely manual and 16 

percent used a mix of manual and automated steps. The step that was most 

likely to be automated was the aggregating of daily cash transactions: 68 

percent of survey respondents reported that their systems automatically 

generate this aggregation report. The step least likely to be automated was 
Page 34 GAO-08-355 Bank Secrecy Act

the supervisory review of CTRs; about 10 percent of survey respondents 

reported that the review processes at the branch level had been automated. 

While we did not obtain data showing how the extent of automation 

compares with the volume of CTRs filed, our structured interviews with 

officials from depository institutions suggest that institutions filing the 

most CTRs (generally the larger institutions) were more likely to have 

highly automated processes than smaller institutions filing fewer CTRs. 

Because of the cost, many smaller banks that do not file as many CTRs may 

choose not to invest in systems that could provide a greater degree of 

automation. 

Figure 5: Extent to Which Steps in the CTR Process Were Automated at Surveyed Institutions

0

10

20

30

40

50

60

70

80

CTR sent

to IRS

Compliance officer

approves CTR

Cash

aggregation

report reviewed

Cash

transactions

aggregated

Form sent

to back office

CTR reviewed

by immediate

supervisor

Teller

completes

CTR

Percentage

Source: GAO.

Fully or mostly manual

Equally manual and automated

Fully or mostly automated
Page 35 GAO-08-355 Bank Secrecy Act

The extent of automation could influence the time needed to process CTRs. 

Overall, survey respondents reported a median time of 25.2 minutes to 

complete a CTR in 2007 (see fig. 6). In 1998, FinCEN estimated that it took 

about 24 minutes to complete a CTR.35 

Figure 6: Median Time, in Minutes, to Accomplish Each CTR Filing Step 

Note: The median values for each of the steps have been rounded to the nearest 0.5 minute. The 

median values for each step do not necessarily sum to the total median time. The 95 percent 

confidence interval for “teller fills out CTR” is from 4.9 to 8 minutes, the interval for “CTR sent to IRS” is 

from 2.6 to 4.1 minutes, and the interval for the median time total is from 24.4 to 28.8 minutes.

Although FinCEN has taken steps to encourage institutions to file CTRs 

electronically, 76 percent of our survey respondents said that they filed 

CTRs by mail, while 14 percent reported that they filed electronically, 6 

percent filed by magnetic media, and 4 percent a combination of these 

methods.36 However, institutions that do not file CTRs electronically may 

account for a small proportion of all CTRs. According to FinCEN data, 47 

percent of all CTRs filed by financial institutions in 2006 were filed 

electronically, while 22 percent were filed by mail, and 31 percent were 

filed by magnetic media. Further, the use of electronic filing appears to be 

growing; in fiscal year 2003, only about 5 percent of CTRs were filed 

electronically. Some depository institution officials said the ability to e-file 

has made filing CTRs much easier at their institution. Others stated that 

they choose not to file electronically because the volume of CTRs they filed 

did not justify the required time and effort involved. According to FinCEN, 

35FinCEN estimated the time needed for completing the CTR at 19 minutes and the 

associated record keeping at 5 minutes per CTR (63 Fed. Reg. 50147, 50155 (Sept. 21, 1998).

36Magnetic media include discs or tapes containing the data on one or more CTRs.

Steps to completing a CTR Median time spent per CTR (in minutes)

A) Teller fills out the CTR

B) Supervisory review

C) Form submitted to an office that provides

 centralized support for processing CTRs

D) CTR reviewed and signed by approving official

E) CTR sent to IRS

F) Other steps your institution requires

6.0

4.5

4.0

4.5

3.5

4.5

Total median time: 25.2

Source: GAO.
Page 36 GAO-08-355 Bank Secrecy Act

electronic filing is best suited for institutions that file a larger volume of 

CTRs; however, the overall benefits of e-filing to lower-volume filers—for 

example, the e-filing system provides the institution submitting the CTR 

with an electronic confirmation of its receipt—in many instances may 

outweigh development costs. 

Depository Institutions 

Could Not Quantify Costs 

Specific to CTR 

Requirements

Although they provided some anecdotal estimates, officials of depository 

institutions we interviewed had difficulty separating costs for meeting CTR 

requirements from other BSA costs, such as preparing Suspicious Activity 

Reports.37 In particular, we found that at some banks, some staff and 

automated systems were used to meet CTR and other BSA filing 

requirements. While we asked institutions we spoke with to provide 

estimates of costs based on categories such as personnel, training, and 

technology, not all institutions were able to do so because they do not 

typically account for CTR costs in this way. However, officials from 

institutions we interviewed did describe general types of costs and 

provided some estimates.

In general, personnel costs associated with CTRs may include the cost of 

training staff on meeting CTR requirements, as well as the cost of labor 

involved in filing CTRs. They may include salary expenses for tellers, 

branch managers, and BSA compliance staff. Most institutions said they 

provide annual training on when and how to file CTRs, and that staff 

members, including tellers, spent an average of about 1 hour each in CTR 

training. At smaller institutions, fewer staff may receive training; for 

example, a compliance officer at one smaller bank told us that 26 staff 

members received four hours of BSA training annually, a portion of which 

is dedicated to CTRs. In contrast, the BSA officer at a very large bank said 

that 1 hour of CTR training is provided annually to 160,000 staff; officials 

from a very large bank said it registers about 40,000 hours in CTR training 

each year among its staff. Many depository institutions indicated that 

training on CTR requirements was part of a larger BSA training course, 

while a few said they offered training modules focused on CTRs. For 

example, at a cost of $15,000, one bank has purchased access to a Web37Others who have surveyed depository institutions in an effort to quantify costs report that 

banks they surveyed had difficulty estimating BSA costs. Two studies, one conducted by 

KPMG, Global Anti-Money Laundering Survey 2007: How Banks Are Facing Up to the 

Challenge, and a second, Report on FinCEN’s Survey on Bank Secrecy Act Costs and 

Exemption Procedures, by Deloitte and Touche (October 2002), found that depository 

institutions generally had difficulty estimating their costs of BSA compliance.
Page 37 GAO-08-355 Bank Secrecy Act

based training program that offers courses on CTRs, as well as other areas 

of BSA. Furthermore, officials at one very large institution noted that, in 

particular, they had to conduct training more often for tellers because of 

high rates of turnover in teller positions.

While all institutions incur some level of costs for training their staff, our 

interviews suggest that typically the higher the number of CTRs an 

institution filed, the higher the number of associated personnel—and 

therefore presumably training costs. Similarly, the labor costs associated 

with actually preparing CTRs would be expected to be larger among the 

institutions that file the most CTRs—though, as noted, such costs are also 

affected by the type of process used, including the degree of automation. 

The highest-volume CTR filers reported having staff solely dedicated to 

filing CTRs and exemptions; for example, one very large bank employed 

more than 190 staff at CTR operations centers, and representatives of 

another very large bank reported 60 staff members who worked exclusively 

on CTRs. Conversely, representatives of one midsized bank said that they 

had one and a half full-time equivalent positions in their compliance office 

dedicated to CTRs. 

Reflecting the range of numbers of staff that may be involved, officials 

provided a wide variance of estimated personnel costs. For example, the 

very large bank with more than 190 dedicated staff (which filed over 1 

million CTRs in 2006) estimated the cost to be “several” million dollars. 

Other large filers also reported high costs for staff salaries that ranged from 

just less than $1 million to over $5 million. For example, one very large 

bank that filed almost 1 million CTRs in 2006 estimated the cost at $5.4 

million—$3.6 million for the approximately 25,000 tellers involved and $1.8 

million in personnel costs for staff dedicated to CTRs. In comparison, 

officials from one large bank that filed just fewer than 5,000 CTRs in 2006 

estimated that personnel costs for tellers and compliance office staff were 

slightly more than $76,000 for the year. Similarly, the midsize bank that 

reported one and a half full-time equivalent positions dedicated to CTRs, 

and filed approximately 2,300 CTRs in 2006, estimated personnel costs of 

about $31,000 for the compliance office staff but was unable to provide an 

estimate for the costs associated with the tellers’ time. Officials from 

smaller institutions we spoke with generally estimated lower costs and 

indicated that CTR filing responsibilities at their institutions were handled 

by staff that had other responsibilities, as well; one estimated that staff 

time for filing 65 CTRs in 2006 cost a little less than $2,000. 
Page 38 GAO-08-355 Bank Secrecy Act

As noted above, institutions have automated processes for meeting CTR 

requirements to differing extents, and officials cited technology as a 

significant cost. For example, one large bank was considering adding a 

CTR module to its current software at a cost of between $60,000 and 

$70,000; another large bank reported recently spending about $30,000 to 

purchase a new software component. However, because many of the 

institutions we spoke with also used these systems for other processes, 

they were not able to break out the costs exclusively for CTRs. For 

example, some officials told us their systems cost in the thousands of 

dollars but that they used the systems for monitoring cash transactions for 

suspicious activities, as well as for preparing CTRs. As a result, officials we 

interviewed said that, even if CTR requirements were eliminated, their 

institutions would still incur both personnel and systems costs because of 

other BSA compliance activities. An official of a very large bank said that if 

the CTR requirement were eliminated, the bank would be able to eliminate 

or reassign 14 staff to other activities but still would need to prepare many 

of the same reports, such as aggregation reports, because they are used for 

other purposes, such as identifying suspicious activity. An official of a large 

bank told us if there were no CTR filing requirement, the bank would 

realize reductions in some technology costs but would retain staff involved 

for their expertise and skills in other parts of its BSA program. 

Uncertainty about 

Required 

Documentation and 

Some Regulatory 

Requirements May 

Unnecessarily 

Discourage Use of 

Exemptions

FinCEN data show that depository institutions filed about 31,500 Phase I 

and 39,300 initial Phase II exemptions during 2004-2006.38 However, 

according to our survey results, many financial institutions with customers 

considered eligible for exemptions do not actually exempt them but instead 

continue to file CTRs on the customers’ transactions—despite the 

institutions’ recognition that making use of the exemption provisions 

would enable them to file fewer CTRs. (Complete survey results can be 

viewed at http://www.gao.gov/cgi-bin.getrpt?GAO-08-385SP.) Among the 

reasons cited by institutions was uncertainty about the documentation 

required to demonstrate that some customers are in fact eligible, 

accompanied by some concern that examiners from the federal banking 

regulators would deem the documentation insufficient and cite them for 

BSA noncompliance. Our discussions with examiners revealed variations 

in the types of documentation they find acceptable, although our review of 

data from the banking regulators showed relatively few violations 

38An initial exemption is the first one filed on behalf of a specific customer. These totals do 

not include subsequent renewals for these or previously exempted customers.
Page 39 GAO-08-355 Bank Secrecy Act

concerning exemptions compared with the number of BSA examinations 

conducted. Other factors discouraging use of exemptions were the cost 

and effort involved in meeting FinCEN’s regulatory requirements to (1) file 

an exemption form, and annually review and update the information, 

particularly for certain customers that are specifically exempted by statute, 

as appropriate; and (2) biennially file a form to document the continued 

eligibility of customers that have been exempted under the Phase II 

regulations—which as a practical matter duplicates the required annual 

review process for those customers. Factors the institutions indicated 

might encourage use of exemptions included (1) shortening the waiting 

period—currently a full year under FinCEN’s regulations—before 

exempting certain customers with a relatively large volume of cash 

transactions, and (2) making Web-based material available to help train and 

guide depository institutions’ staff in making exemption determinations. 

Because the transactions of exempt customers are likely to be of little or no 

value to law enforcement, actions to encourage depository institutions to 

make greater use of exemptions could avoid the burden of filing some 

CTRs without harming law enforcement efforts. 

While Recognizing the 

Benefits of Exemptions, 

Depository Institutions Do 

Not Exempt All Eligible 

Customers

Exemptions allow institutions to avoid filing CTRs for the exempt 

customers, but the institutions are not required to exempt eligible 

customers. According to the results of our survey, institutions that made 

use of exemptions primarily did so because it allowed them to file fewer 

CTRs, was cost-effective, and the determinations involved were fairly easy. 

As shown in figure 7 below, the reasons generally were consistent for both 

Phase I and Phase II exemptions. 
Page 40 GAO-08-355 Bank Secrecy Act

Figure 7: Factors That Surveyed Institutions Reported as of Very Great or Great Importance to Their Decision to Exempt Phase I 

and Phase II Customers

Note: For the category “other factors,” the 95 percent confidence intervals for the very great/great 

importance and some/little or no importance estimates are within +/- 12 percentage points. 

The primary reason cited for using the exemption process was that it 

allowed institutions to file fewer CTRs. While it would be difficult for an 

institution to track the number of CTRs it “saved” or avoided by exempting 

a customer, some had; for example, a smaller institution reported that it 

recently began using exemptions more extensively, and by exempting five 

more Phase II eligible customers, the institution anticipated filing almost 

200 fewer CTRs. (However, the effect of exempting a single customer on 

the number of CTRs filed cannot be generalized; for example, an exemption 

might avoid 8 CTRs or 100, depending on the volume of cash transactions 

in which the customer typically engaged.) Institutions also frequently cited 

0

10

20

30

40

50

60

70

80

Regulator Other factor

recommended

your

institution

apply

exemption

Availability of

automation to

identify eligible 

customers

Minimal

concern

that examiners

would find

a basis

for a

violation

Guidance in

the BSA

examination

manual was

clear

Nature of

client

base

provided

opportunities

to exempt

customers

Cost

effectiveness

of filing

exemptions

rather than

CTRs

Ease of

determining

customers’

exemption

eligibility

Opportunity

to file

fewer

CTRs

Percentage

Factors of very great or great importance for:

Phase I exemptions

Phase II exemptions

Source: GAO.
Page 41 GAO-08-355 Bank Secrecy Act

the cost-effectiveness of using exemptions; while they had difficulty 

estimating the cost of establishing exemptions, just as they did for the costs 

of filing CTRs, some institutions regarded exempting customers as less 

costly than filing CTRs. Officials at other institutions we interviewed cited 

recent advances in commercial software systems that made exemptions 

easier. For example, software can identify the customers potentially 

eligible for the Phase II exemption due to the volume of high cash 

transactions they engaged in during the year. In addition, at least one 

software vendor makes available for purchase a database of companies 

listed on stock exchanges that are eligible for the Phase I exemption.

Despite the cost-effectiveness of using exemptions, institutions responding 

to our survey did not exempt all of their eligible customers. For example, 

while 77 percent of the institutions reported having customers eligible for 

the Phase I exemption, only 45 percent reported that they always or usually 

filed Phase I exemptions. Similarly, 83 percent of the institutions reported 

having customers eligible for the Phase II exemption, but only 49 percent 

reported that they always or usually filed Phase II exemptions (see fig. 8). 

Figure 8: Percentage of Depository Institutions with Customers Eligible for Phase I and II Exemptions and Extent to Which They 

Filed Exemptions in 2006

Note: The shaded portion of each circle equals the percentage of institutions reporting that they had 

customers eligible for the exemptions. 

Some institutions that file large numbers of CTRs—and, therefore, might 

realize the greatest savings by avoiding CTRs—do not file many 

exemptions. Some of the reasons for this are discussed in the following 

sections. (Further details on the results of our survey, including the 

percentages of institutions that cited specific factors affecting their 

decisions to exempt or not exempt customers, are presented in app. IV and 

in GAO-08-385SP.)

77%

Institutions with customers eligible for the Phase I exemption

Frequency institutions

reported filing Phase I exemptions

Institutions with customers eligible for the Phase II exemption

0 10 20 30 40 50

Usually do

not/never

Sometimes

Always/ usually

Percentage

83%

Frequency institutions

reported filing Phase II exemptions

0 10 20 30 40 50

Usually do

not/never

Sometimes

Always/ usually

Percentage

Source: GAO.
Page 42 GAO-08-355 Bank Secrecy Act

Uncertainty about 

Documentation Needed to 

Demonstrate Eligibility, 

Accompanied by Concerns 

of BSA Noncompliance, 

Deterred Some Exemptions

The leading reason identified by survey respondents that choose not to file 

Phase II exemptions was difficulty in determining the percentage of a 

customer’s gross revenue derived from lines of business not eligible for 

exemption. This difficulty—along with other concerns, including that 

federal banking regulators would deem documentation insufficient—

contributed to a reluctance to exempt customers that the institutions 

considered potentially eligible. 

The responses of officials of institutions we interviewed were consistent 

with our survey results. Officials explained that a fair amount of research 

was required on their part to determine eligibility under the Phase II 

regulations—for example, examining a business’s tax returns or financial 

statements—and that it was not always clear if the customer qualified for 

the exemption because it was difficult to determine which part of a 

business customer’s revenue was derived from which activity. The 

depository institutions that chose to use the Phase II exemption used 

various methods to document the portion of revenues derived from 

ineligible activities. Officials of several institutions we interviewed said 

they arrived at this determination after conducting what they said was 

exhaustive research, which included analyzing financial statements, 

searching the Internet, and reviewing available documents if the institution 

had a lending relationship with the customer, or asking the customer for 

documents. Officials of other institutions used less labor-intensive 

methods; for example, an official of one midsize institution indicated that 

the account officer simply asked customers about the source of their gross 

revenue and made a notation in the customer’s file. Several institutions 

reported using a letter from the customer to self-certify that no more than 

50 percent of their gross revenue came from activities or lines of business 

ineligible for exemption. 

Officials from the federal banking regulators generally indicated that they 

did not have a standardized expectation for what documentation (such as 

financial statements or tax documents) an institution might use to 

demonstrate the portion of revenues derived from ineligible activities. They 

further noted that examiners have some flexibility in determining what 

level of documentation is required, based on guidance in the
Page 43 GAO-08-355 Bank Secrecy Act

BSA/AML Examination Manual.

39 The same manual is used by each of the 

five federal banking regulators and is available to depository institutions to 

help guide their BSA compliance activities. However, our interviews with 

officials and examiners indicated differences among them regarding the 

type of documentation acceptable. For example, federal regulators and 

examiners we interviewed had different views about the use of a selfcertifying letter and whether depository institutions ought to provide other 

documentation. While Federal Reserve and FDIC officials said the 

acceptance of a self-certifying letter would depend on the circumstances, 

they generally noted that examiners had flexibility in deciding what level of 

documentation would be acceptable. Officials from OTS and OCC, on the 

other hand, indicated that a self-certification letter alone would be 

inadequate to show eligibility. Because, in this instance, the federal banking 

regulators examine institutions for compliance with FinCEN’s regulations, 

additional guidance from FinCEN could help reduce the difficulties that 

depository institutions face in making this determination and clarifying, for 

both the institutions and the regulators, the types of documentation 

acceptable for demonstrating eligibility.

Officials and examiners we interviewed from all of the federal banking 

regulators indicated that they have found few problems with exemptions, 

and our review of available violation data for 2005 and 2006 indicated that 

examiners cited relatively few violations for exemptions. We asked the 

regulators to disaggregate their data on violations to distinguish those 

related specifically to exemptions; only the Federal Reserve, FDIC, and 

OCC were able to provide this level of detail. These three agencies are 

responsible for examining about 7,800 depository institutions, including the 

largest banks that likely account for the greatest numbers of CTRs. As 

shown in table 3, the three agencies collectively found violations 

associated with exemptions in less than 5 percent of the BSA exams they 

conducted—a combined total of 227 violations for exemptions in 2005 and 

113 violations for exemptions in 2006.

39The manual requires that the examiner should “determine whether the bank maintains 

documentation to support that the ‘non-listed’ businesses it has designated as exempt from 

CTR reporting do not receive more than 50 percent of gross revenue from ineligible business 

activities.”
Page 44 GAO-08-355 Bank Secrecy Act

Table 3: Exemption Violations Cited in BSA Examinations by FDIC, Federal Reserve, 

and OCC, 2005 and 2006

Source: GAO analysis of Federal Reserve, FDIC, and OCC data. 

Similarly, we asked FinCEN for data on BSA enforcement actions it has 

taken against depository institutions related to exemptions. (While FinCEN 

generally coordinates with the federal banking regulators, it may 

independently take enforcement actions, including imposing penalties and 

fines, for BSA violations.40) FinCEN data show that, over the 10-year period 

1997 to 2006, it took 110 BSA enforcement actions related to exemptions, 4 

of which included fines. (More detailed information on FinCEN’s 

enforcement actions is presented in app. IV.)

The fairly low incidence of violations associated with exemptions may 

reflect depository institutions’ decisions to simply not grant exemptions, 

thus avoiding potential violations. (Some examiners noted that they 

sometimes encouraged depository institutions to use the exemption 

process, for example, if the institution was filing many CTRs on customers 

that were potentially eligible for the exemption.) However, our survey and 

interviews demonstrate that a lack of clear guidance from FinCEN for 

documenting eligibility, and the differing interpretations among the federal 

banking regulators, have the effect of dissuading depository institutions 

Agency

Number of BSA 

examinations 

conducted

Number of 

exemption 

violations issued

Percentage of 

exemption violations 

per examination

2005 FDIC 3,029 178 5.9

Federal 

Reserve 678 10 1.5

OCC 1,510 39 2.6

Total 5,217 227 4.4

2006 FDIC 2,825 80 2.8

Federal 

Reserve 815 6 .7

OCC 1,547 27 1.7

Total 5,187 113 2.2

4031 U.S.C. § 5321; see GAO, Bank Secrecy Act: Opportunities Exist for FinCEN and the 

Banking Regulators to Further Strengthen the Framework for Consistent BSA Oversight, 

GAO-06-386 (Washington, D.C.: Apr. 28, 2006).
Page 45 GAO-08-355 Bank Secrecy Act

from more frequently using the Phase II exemption. A minority of our 

survey respondents indicated that they “always” exempt eligible 

customers—33 percent reported doing so for Phase I-eligible customers 

and 26 percent for Phase II-eligible customers. Some depository institution 

officials noted that any compliance deficiency found by BSA examiners 

was a cause for concern. (About 10 percent of survey respondents reported 

that they had received a CTR violation or had been fined since 2000.) An 

official from the very large bank that filed more than 150,000 CTRs in 2006 

said it was the bank’s official policy not to exempt any new customers that 

were eligible for the Phase II exemption because, among other things, the 

bank faced reputation risk if it was cited for a BSA violation, and use of the 

exemption process opened the bank to examiner criticism and fines. An 

official from a large community bank said that the bank did not file Phase II 

exemptions because of concerns about regulatory risk. Officials from 

several depository institutions we interviewed specifically said it was not 

clear to them what level of support was needed, and some indicated that 

they would rather file CTRs than take the risk of not satisfying an examiner.

In a 2002 report on the exemption process mandated by section 366 of the 

USA PATRIOT Act, FinCEN concluded that it should work with the federal 

banking regulators, as well as banks, to reduce “fear of adverse regulatory 

consequences from making incorrect exemption determinations.”41 

Exemptions are addressed in the BSA/AML Examination Manual, which 

was first published in 2005 and, as noted, is used by the banking regulators 

and is available to depository institutions. However, 68 percent of our 

survey respondents said that difficulty in determining whether companies 

derive more than 50 percent of their revenues from ineligible business 

activities was a “very great” or “great” factor in their decision not to exempt 

Phase II-eligible customers. Guidance that could help institutions make 

greater use of this exemption would help avoid unnecessary CTRs that are 

of little or no use to law enforcement.

Biennial Renewals, Which 

Duplicate Annual Reviews, 

Discourage Use of Some 

Phase II Exemptions

FinCEN’s regulations require that depository institutions (1) annually—at 

least once a year—review and verify the information supporting any 

exemptions that they have filed for either Phase I or Phase II customers, 

and (2) biennially file—on March 15 of the second calendar year following 

the initial exemption—a renewal form to continue the exemption of Phase 

41Department of the Treasury, Use of Currency Transaction Reports (Washington, D.C., 

October 2002).
Page 46 GAO-08-355 Bank Secrecy Act

II customers. The purpose of the annual review is to ensure that the 

customers continue to qualify for exemption; according to FinCEN, the 

biennial renewal provides formal notification to FinCEN that the institution 

has monitored the customers’ transactions as required. About 49 percent of 

our survey respondents indicated that the time-consuming nature of the 

biennial renewal was of great or very great importance in contributing to 

their decision not to exempt customers eligible for Phase II exemptions.42

An official from the very large bank that filed more than 150,000 CTRs in 

2006 said it was the bank’s official policy not to exempt any new customers 

that were eligible for the Phase II exemption because of the costs 

associated with the biennial renewals and the need to keep track of which 

exemptions had to be renewed in each year. Officials from depository 

institutions we interviewed, particularly those that did not exempt 

customers, also said that the need to conduct this review discouraged their 

use of the exemption.

Officials of some depository institutions questioned the value added by 

biennial renewals, observing that they were already conducting the annual 

review as well as monitoring all of their customers for suspicious activities, 

which is part of a strong anti-money-laundering program pursuant to 

section 352 of the USA PATRIOT Act. Even officials of institutions that 

nevertheless filed and maintained exemptions considered the requirement 

to be redundant. For example, officials at one of the very large banks—

which had more than 1,900 Phase II exemptions on file—said they filed the 

“biennial” renewal form every year for every customer, because the bank 

went through the same steps for the biennial renewals as it did for each 

required annual review and did not want to risk failing to file a biennial 

renewal form in the correct year. Further, our analysis of FinCEN data 

revealed that some institutions file biennial renewal forms on Phase I 

customers, although they are required only for Phase II customers (in 2006, 

depository institutions filed 1,382 biennial renewals on Phase I customers). 

42The 95 percent confidence interval for this estimate is within +/-11 percentage points.
Page 47 GAO-08-355 Bank Secrecy Act

FinCEN established the biennial renewal requirement based on its 

interpretation of the Money Laundering Suppression Act. Specifically, the 

act requires the Secretary of the Treasury to prescribe regulations requiring 

that depository institutions review, at least annually, the qualified business 

customers that they have exempted and to “resubmit information about 

such customers” to the Secretary.43 According to FinCEN, the 

implementing regulations provided for the information to be resubmitted 

biennially, rather than annually, because the statute does not explicitly set a 

time frame for the resubmission.44 Further, FinCEN officials believe that 

the Secretary has general authority to prescribe appropriate exemptions to 

requirements under the BSA, including revising the regulations to eliminate 

the biennial renewals.45

FinCEN officials said that the biennial renewal form provides them with 

evidence that the exempt business remains eligible for the exemption and 

that the institution has been monitoring the business for suspicious activity. 

In addition, they reported that FinCEN routinely analyzes biennial renewal 

forms (along with other information) filed on and by specific depository 

institutions that are the subjects of compliance or enforcement actions by 

the federal banking regulators to determine if the institutions properly 

granted exemptions to eligible customers. However, these activities 

essentially duplicate those of the bank examiners who, as part of the 

examination process, ascertain whether institutions properly grant 

exemptions and monitor their customers for suspicious activity.46

Examiners from a few of the banking regulators indicated that the biennial 

renewal requirement results in depository institutions collecting the same 

kinds of information that they collect as part of the annual review of 

exemptions. Further, all biennial renewals must be filed on March 15, 

regardless of when the exemption was filed. Officials from the Federal 

Reserve noted that meeting both requirements can impose significant 

4331 U.S.C. § 5313(e)(5).

4463 Fed. Reg. 50147, 50153 (Sept. 21, 1998) (FinCEN interpreted the statute as not explicitly 

setting a time for the filing of updated information after an annual review when it issued the 

final rule requiring banks to renew the status of Phase II exemptions every 2 years). 

4531 U.S.C. § 5318(a)(6).

46The examination procedures as outlined in the BSA/AML Examination Manual require 

that examiners assess whether ongoing and reasonable due diligence is performed, 

including annual reviews, to determine whether a customer is eligible for the exemption 

designation.
Page 48 GAO-08-355 Bank Secrecy Act

compliance costs on the institutions, yet the duplication provides no 

offsetting benefit for supervisory efforts. Eliminating the requirement for 

biennial renewals could encourage more institutions to make use of Phase 

II exemptions and reduce the burden associated with filing unnecessary 

CTRs.

Current Regulations Require 

Institutions to File 

Exemptions for Customers 

That Are Statutorily Exempt

Recognizing that the cash transactions of customers that are depository 

institutions or governmental entities would likely be of little or no use to 

law enforcement efforts, the Money Laundering Suppression Act 

specifically directed that the Secretary of the Treasury exempt depository 

institutions, as appropriate, from filing CTRs on the transactions of these 

customers. FinCEN did so, but its regulations require depository 

institutions to file exemption forms if they choose to exempt these types of 

customers—and to annually review and verify the information supporting 

the exemption. The statute does not mandate annual reviews for these 

customers.

In essence, the regulations treat these entities like all other customers 

eligible for Phase I exemptions, including listed companies and majorityowned subsidiaries. Accordingly, if depository institutions choose to 

exempt these customers, they must perform the same steps and incur costs 

for annual reviews as they do for other customers they exempt. But 

depository institutions and governmental entities, in contrast to other 

Phase I entities such as publicly traded companies, are unlikely to change 

those characteristics that initially qualified them for exemption.47 For 

example, a governmental entity is unlikely to become a private company. In 

any case, a change in the status of a governmental entity or bank would 

most likely require that the exempted bank account be closed and a new 

one be opened—triggering a new consideration for exemption.

47According to FinCEN, if such a Phase I exempted entity was “delisted,” the relevant bank 

could immediately exempt the customer from CTR reporting requirements pursuant to a 

Phase II exemption providing that the necessary requirements were met.
Page 49 GAO-08-355 Bank Secrecy Act

Few institutions we interviewed cited difficulty in determining eligibility 

for their customers that are other depository institutions or government 

entities, and many said that, in these cases, they exempt all eligible 

customers. However, they would have incurred some cost to file the form 

and to annually review the supporting information. In response to our 

survey, officials of depository institutions reported that their staff took a 

median time of about 34 minutes to exempt a Phase I customer, and about 

14 minutes for the annual review process.48 Further, some depository 

institutions do not exempt these customers and continue to incur the cost 

of filing CTRs. For example, our analysis of FinCEN data shows that, in 

2006, almost 87,000 CTRs were filed on over 2,900 depository institutions, 

and about 45,000 CTRs were filed on some 5,500 government entities.49 

These CTRs are unnecessary in that the cash transactions of these entities 

are not likely to have a high degree of usefulness for law enforcement.

According to FinCEN officials, the information provided on the exemption 

forms for these entities is not required for analytical purposes per se but 

rather serves as the basis for recording which financial institutions had 

chosen to exempt specific depository institutions and governmental 

agencies. However, depository institutions are separately required to keep 

records of customers’ transactions for BSA purposes.50 Federal Reserve 

officials specifically noted that they believed that the automatic exemption 

of domestic depository institutions from the CTR filing requirement should 

be considered and that eliminating the need to file an exemption and keep 

it current for these entities would make the CTR process more efficient. 

Continuing to require depository institutions to file forms on these 

entities—and to incur the cost and effort of annually reviewing the 

information supporting the exemption—discourages use of the exemption, 

resulting in CTRs that are likely to be of little or no value to law 

enforcement.

48The 95 percent confidence interval for the total time to exempt a customer is 31.2 to 40.5 

minutes and for the annual review process is from 11.7 to 17.3 minutes.

49We identified government entities by searching the name fields on the CTRs; accordingly, 

we identified only entities that could be explicitly identified based on their names. The 

numbers we report represent a minimum number of entities for whom CTRs might have 

been filed.

5031 C.F.R. §§ 103.33 and 103.34.
Page 50 GAO-08-355 Bank Secrecy Act

Length of Time Allowed 

Before Frequent Customers 

Can Be Exempted May 

Result in Unnecessary CTRs

FinCEN’s Phase II exemption regulations specify that, in order to be 

eligible for exemption, among other things customers must have held an 

account for at least 1 year and must have “frequently” engaged in currency 

transactions in excess of $10,000. In a November 2002 guidance 

memorandum, FinCEN defined “frequently” as at least eight large currency 

transactions in a 1-year period (with an exception for seasonal 

customers).51 Officials of several banks we surveyed said that their use of 

exemptions for Phase II customers would increase if they were permitted 

to exempt businesses with frequent cash transactions in less than 12 

months.

As explained by an official of one institution, a year seems to be an 

unnecessarily long time if the business is by nature cash-intensive and not 

suspicious, and the institution regularly files CTRs on the business. Or, as 

other officials noted, a waiting period of less than 1 year would be 

appropriate if the ownership of a business changed but the transaction 

activity remained relatively similar to that under the previous owner, or if 

known customers chose to form new businesses. We analyzed FinCEN’s 

data to identify the numbers and frequency of CTRs filed on customers that 

were subsequently exempted. We found that, among customers that were 

initially exempted in 2006, the median number of CTRs filed in the 12 

months preceding the exemption was 14; the median number filed in the 8 

months preceding exemption was 11; and in the preceding 6 months, it was 

9.52 This analysis demonstrates that many customers that were later 

exempted engaged in more than the 8 transactions in a 12-month period 

required by FinCEN—generating thousands of unnecessary CTRs.

51According to the guidance, this means at least 1 CTR transaction every 6 weeks. For 

seasonal businesses, the guidance allows institutions to have engaged in at least eight large 

transactions during a portion of the year, provided the customer has had an account with 

the institution for at least 1 year. 

52This analysis is based on the 10,305 initial Phase II exemptions filed in 2006 (76 percent of 

all such exemptions) that (1) could be linked to a depository institution and (2) for which at 

least 1 CTR had been filed. 
Page 51 GAO-08-355 Bank Secrecy Act

FinCEN promulgated its regulations establishing the 12-month requirement 

before enactment of the USA PATRIOT Act. That law provided for 

customer identification programs, for which FinCEN regulations require 

depository institutions to collect sufficient information to verify the 

identity of customers when they first open an account.53 Thus, depository 

institutions must require new business customers to provide their name, 

physical location, and taxpayer identification number, at a minimum, at 

account opening. Furthermore, as noted above, BSA compliance programs 

require depository institutions to monitor their customers for suspicious 

activity. Thus, continuing to require a 12-month period before allowing 

otherwise nonsuspicious customers with large numbers of cash 

transactions to be exempted may needlessly cause depository institutions 

to file CTRs that are not highly useful to law enforcement efforts. 

Material to Help Train 

Institutions on 

Requirements Could 

Increase Use of Exemptions

FinCEN currently provides material on its Web site, such as answers to 

frequently asked questions, rulings and guidance, and information on BSA 

requirements. However, the responses to frequently asked questions and 

rulings and guidance concerning exemptions are limited and dated.54 

Forty-eight percent of respondents to our survey indicated that the 

availability of Web-based material from FinCEN would greatly or 

moderately increase their use of the Phase I exemption, and 51 percent of 

respondents said it would greatly or moderately increase their use of the 

Phase II exemption. Such material would help train respondents’ staff and 

guide them in interpreting and applying the exemption requirements. 

Officials of depository institutions we interviewed generally indicated that 

they currently purchase training modules from vendors, hire trainers, or 

have their compliance officers develop in-house training. 

5331 C.F.R. §103.121(b)(2). The regulations stipulate that, under the USA PATRIOT Act, the 

Customer Identification Program must include risk-based procedures for verifying a 

customer’s identity that enable the depository institution to form a reasonable belief that it 

knows the true identity of the customer. 

54The majority of responses to frequently asked questions and guidance on the FinCEN Web 

site related to CTR exemptions are largely technical and dated from 2000 through 2002. 
Page 52 GAO-08-355 Bank Secrecy Act

Our work suggests that material to help train staff could assist depository 

institutions in making some eligibility determinations under both the Phase 

I and Phase II regulations and help overcome difficulties that often 

dissuade institutions from greater use of the exemptions. As previously 

discussed, our survey results and interviews with depository institution 

officials highlighted difficulties in determining the portion of a customer’s 

gross revenue derived from lines of business not eligible for the exemption, 

which dissuaded some institutions from using the Phase II exemption. 

Similarly, about 39 percent of survey respondents indicated that difficulties 

in determining eligibility was a factor of great or very great importance in 

their decision not to exempt a customer eligible for the Phase I 

exemption.55 The difficulties included determining whether customers are 

“listed” (publicly traded) companies or are majority-owned subsidiaries of 

such companies. FinCEN’s regulations provide that institutions may, 

among other things, rely on documents filed with the Securities and 

Exchange Commission or listings of the three stock exchanges published in 

newspapers or available on Web sites.56 However, officials we interviewed 

stated that verifying the publicly traded status of customers was not always 

straightforward, and it is sometimes difficult to determine ownership 

structures. For example, officials from one bank explained that the bank 

held a number of accounts for a large publicly traded video rental chain; 

some of the stores were corporately owned while others were independent 

franchises. While the company-owned stores would be part of the publicly 

traded company, the franchise operations were not likely to be publicly 

traded. The bank did not exempt any of these accounts, however, to avoid 

the risk of exempting a customer that was not eligible for the Phase I 

exemption. Further, some survey respondents stated they had difficulty 

determining eligibility when a customer is a subsidiary of a listed company. 

One respondent noted that his institution would not attempt to exempt 

such a customer because it was too difficult to document eligibility in this 

case.

55The 95 percent confidence interval for this estimate is within +/-15 percentage points.

56The Securities and Exchange Commission requires public companies to disclose 

meaningful financial and other information to the public, which provides a public source for 

all investors to use to judge for themselves if a company's securities are a good investment. 

These reports are publicly available through the EDGAR database on the Securities and 

Exchange Commission’s Web site.
Page 53 GAO-08-355 Bank Secrecy Act

In addition, our analysis of FinCEN’s data on exemptions filed from 2004 

through 2006 suggests that institutions might benefit from the availability 

of Web-based material from FinCEN. For example, we found that some 

institutions were filing biennial renewals for Phase I exemptions, even 

though FinCEN regulations require renewals only for Phase II exemptions. 

Also, our interviews with examiners from the federal banking regulators 

indicated that further training might encourage appropriate use of 

exemptions. For example, examiners from FDIC and OCC reported that 

some institutions had difficulty distinguishing between businesses eligible 

for the Phase I and Phase II exemptions. Some examiners reported that 

they were educating depository institution staff about the exemption 

requirements, as well as credit union examiners in particular, on the use of 

Phase I exemptions for correspondent banks.57 

Treasury’s 2002 report on the uses of CTRs noted the importance of making 

the exemption system easier for bank personnel to understand. In 

preparing that report, FinCEN relied in part on a contractor’s survey of 

depository institutions, including their exemption practices and the 

reasons underlying them. The contractor concluded that FinCEN should 

offer a Web-based training module on its Web site to clarify the exemption 

process. Our work for this report indicates Web-based material that would 

help train staff could encourage institutions to make greater use of 

exemptions, thereby avoiding the filing of CTRs that are of little or no use 

to law enforcement efforts. Providing such material on FinCEN’s Web site 

would be a cost-effective way to help ensure that all institutions have 

available up-to-date information on how to meet the requirements.

Conclusions Since GAO reported over a decade ago that the large volume of CTR 

reports had made analysis difficult, expensive, and time consuming, 

developments in information technology have provided law enforcement 

with the capacity to simultaneously analyze large quantities of CTR data 

and link these with other data sets. These technological advancements, as 

well as the advent of bulk data downloads and expanded access to CTR 

data by state and local users, have provided law enforcement agencies with 

greater potential to make use of CTR data in their investigations of a wide 

variety of financial and related crimes. Further, in addition to supporting 

specific investigations, CTR requirements aid law enforcement by forcing 

57A correspondent bank is a financial institution that performs financial services for another 

financial institution, such as a bank or credit union. 
Page 54 GAO-08-355 Bank Secrecy Act

criminals—who attempt to avoid reportable transactions—to act in ways 

that increase chances of detection through other methods. Given the 

multiplicity of sources that federal law enforcement officials may tap in 

their investigations, and the variety of possible case outcomes, it is 

understandably difficult to link the use of CTRs with specific outcomes. 

However, information that law enforcement agencies could provide on how 

CTRs contribute to their efforts, similar to information they provide on 

their use of Suspicious Activity Reports, is not systematically provided to 

depository institutions or shared with state and local law enforcement 

agencies that have more recently gained access to BSA data. Many 

depository institutions indicated a desire for some assurance that the 

information they provide is actually useful to law enforcement efforts. 

FinCEN routinely collects and makes available information on how 

Suspicious Activity Reports have contributed to investigations through 

publication of its SAR Activity Review. A similar approach for collecting 

and publishing CTR information could provide financial institutions with 

evidence that their efforts are contributing to detecting and deterring 

money laundering and other crimes. While recognizing that this effort 

would entail an investment of resources, we believe it would prove 

beneficial by providing depository institutions with greater awareness that 

CTRs are a valuable source of data for law enforcement investigations.

With the partial exception of institutions that file the largest numbers of 

CTRs and have personnel dedicated to that function, most institutions are 

not able to quantify their costs of complying with CTR requirements, 

largely because they use the same personnel and automated systems for a 

variety of purposes. Nevertheless, depository institutions expend what 

could be considered to be significant amounts of time and resources to 

meet the requirements. Most depository institutions, based on over 35 

years of collective experience in filing CTRs, have established processes 

that have allowed the filing of most CTRs to become fairly routine. Yet, 

while technology has helped them meet filing requirements more 

efficiently, it is clear that most institutions’ processes involve steps that 

cannot be completely automated. These include reviews by compliance 

officers or other officials to provide assurance that CTRs are correct and 

will not unduly expose their institutions to risk of being cited for BSA 

noncompliance by their examiners. Further, because all institutions are 

subject to compliance with CTR requirements, all incur some costs—for 

example, in training their staff—regardless of the numbers of CTRs they 

file. While impacts could therefore vary among institutions depending on 

the numbers of CTRs they currently file as well as the processes they use, 
Page 55 GAO-08-355 Bank Secrecy Act

steps to reduce the number of unnecessary CTRs filed could avoid some 

costs. 

Increasing use of exemptions would help depository institutions avoid 

filing unnecessary CTRs, as well as reduce the government’s costs to 

process them. Institutions we surveyed told us they do not exempt all 

customers they consider eligible. Because the transactions of exempt 

customers are likely to be of little use to law enforcement efforts, steps to 

encourage the use of exemptions among depository institutions would not 

be harmful to law enforcement and could avoid some CTR filing costs. Our 

work indicates that FinCEN can take several steps that could increase the 

use of the exemption process. While some involve changes to regulations, 

they are largely consistent with goals outlined in FinCEN’s 2006-2008 

strategic plan:

• The uncertainty surrounding the level of documentation required to 

demonstrate the portion of a business’s gross revenue that is derived 

from ineligible sources appears to unduly restrict the use of the Phase II 

exemption. Institutions reported using a variety of types of 

documentation, and the federal banking regulators did not have 

consistent views on what is required to demonstrate eligibility. In this 

regard, clearer guidance from FinCEN on acceptable documentation, 

made available to depository institutions and their examiners, could 

increase the use of exemptions without increasing the risk of being cited 

for a violation. 

• The regulatory requirement to biennially renew Phase II exemptions 

causes institutions who elect to exempt their customers to undertake 

steps that duplicate those required for annual reviews (also required by 

regulation) in order to file a form on March 15, regardless of the date of 

the original exemption. While FinCEN requires the biennial renewals to 

ensure that banks are properly monitoring their customers for 

suspicious activity and properly granting exemptions as required, the 

federal banking regulators address both of these requirements as part of 

their BSA examination process. Further, as a practical matter, 

institutions must “know their customers” under provisions of the USA 

PATRIOT Act—enacted after FinCEN promulgated the CTR exemption 

regulations—that require the institutions to verify the customers’
Page 56 GAO-08-355 Bank Secrecy Act

identities and monitor their transactions.58 The biennial renewal thus 

appears to provide no additional benefit, and eliminating the 

requirement could encourage institutions who have not exempted 

customers for this reason to do so. According to FinCEN, it has 

authority under existing statutes to revise the regulations to eliminate 

the biennial renewals. To the extent that its authority is not sufficient, it 

could seek such authority from the Congress through legislation.

• To exempt certain customers that the Money Laundering Suppression 

Act mandated be exempted, as appropriate—governmental agencies 

and other depository institutions—FinCEN’s regulations require 

depository institutions to file the same form, and annually review the 

supporting documentation, as it does for public companies and their 

majority-owned subsidiaries. Yet, governmental agencies and other 

depository institutions are not likely to undergo changes that would 

affect their eligibility for exemption, and all CTRs filed on such entities 

are likely to be of little or no use to law enforcement efforts. Removing 

the requirement to file the form and annually review the supporting 

information could encourage greater use of this exemption and avoid 

unnecessary CTRs.

• While institutions can currently exempt otherwise eligible customers 

with frequent cash transactions, FinCEN’s regulations require that they 

can do so only after the customer has had an account for 1 year. During 

this time, the institution must continue filing CTRs on the customer’s 

transactions, even when from the institution’s perspective the customer 

is eligible but for the fact that the 12-month period had not elapsed. 

Permitting institutions to exempt businesses with frequent cash 

transactions within a time period of less than 1 year could help avoid the 

need to file unnecessary CTRs.

• Finally, a significant percentage of our survey respondents indicated 

that the availability of Web-based material to train and guide their staff 

would increase their use of both Phase I and Phase II exemptions. Our 

work shows that difficulties institutions experience in interpreting 

requirements often dissuaded them from greater use of the exemptions. 

In addition, institutions reported that they incur costs to train significant 

58Under provisions of the USA PATRIOT Act, certain institutions must have and implement 

policies, procedures, and internal controls, for example, to verify customers’ identities and 

file necessary BSA reports.
Page 57 GAO-08-355 Bank Secrecy Act

numbers of staff annually, and the availability of Web-based material on 

exemption requirements could help to alleviate some of these costs. 

Web-based material would be an effective way for FinCEN to assist 

institutions in making exemption determinations and could ensure that 

all institutions had the most up-to-date information on exemption 

requirements.

Recommendations for 

Executive Action 

To help depository institutions better understand the value of CTRs to law 

enforcement efforts, we recommend that the Secretary of the Treasury 

direct FinCEN to consider routinely providing summary information on the 

use of CTRs in law enforcement efforts, similar to that provided on the use 

of Suspicious Activity Reports. 

To encourage greater use of CTR exemption provisions and avoid the 

burden of filing CTRs that are likely to be of little or no value to law 

enforcement efforts, we recommend that the Secretary of the Treasury 

direct FinCEN to take the following five actions:

• Provide guidance for depository institutions and federal banking 

regulators on the documentation needed to demonstrate the portion of a 

business’s gross revenue that is derived from activities ineligible for the 

exemption. 

• Remove the regulatory requirement that depository institutions 

biennially renew Phase II exemptions—seeking legislation to provide 

additional authority, if needed. 

• Remove the regulatory requirement that depository institutions file 

exemption forms, and annually review the supporting information, for 

banks; federal, state, and local governmental agencies; and entities 

exercising federal, state, and local governmental authority. 

• Consider changing the regulatory provisions in order to permit 

depository institutions to exempt otherwise-eligible nonlisted 

customers who frequently engage in large cash transactions within a 

period of time shorter than 12 months. 

• Provide Web-based material to help train and guide staff of depository 

institutions in determining eligibility for exemptions.
Page 58 GAO-08-355 Bank Secrecy Act

Agency Comments and 

Our Evaluation

We provided a draft of this report for review and comment to the heads of 

Departments of Homeland Security, Justice, and the Treasury; the Federal 

Reserve; FDIC; NCUA; OCC; and OTS. We received written comments from 

FinCen and, in a joint letter, from the Federal Reserve, FDIC, NCUA, and 

OTS. These comments are summarized below and reprinted in appendixes 

V and VI. The Departments of Homeland Security, Justice, and the Treasury, 

the Federal Reserve, and FDIC also provided technical comments, which 

we incorporated into this report, where appropriate.

In its written comments, FinCEN said that the report’s findings based upon 

information gathered from law enforcement reinforce the value law 

enforcement gains through active use of CTRs. FinCEN concurred with the 

recommendations seeking regulatory amendments and the 

recommendations related to providing guidance and materials to aid 

industry in making eligibility determinations for CTR exemptions. Finally, 

with regard to our recommendation that FinCEN consider routinely 

providing summary information on the use of CTRs in law enforcement 

efforts, FinCEN said it will consider options to provide industry with 

additional feedback on the use of CTRs by law enforcement.

In their joint letter, the Federal Reserve, NCUA, OTS, and FDIC reaffirmed 

their support for effective administration of the BSA and said they believe 

that streamlining and clarifying the exemption regulations, as we 

recommend, would be a positive step.

We are sending copies of this report to interested congressional 

committees, the Secretaries of the Treasury and Homeland Security, the 

Attorney General, and the heads of the Federal Reserve, FDIC, IRS, NCUA, 

OCC, and OTS. We will also make copies available to others on request. In 

addition, the report will be available at no charge on the GAO Web site at 

http://www.gao.gov.
Page 59 GAO-08-355 Bank Secrecy Act

If you or your staff have any questions about this report, please contact me 

at (202) 512-6878 or woodd@gao.gov. Contact points for our Offices of 

Congressional Relations and Public Affairs may be found on the last page 

of this report. GAO staff who made key contributions to this report are 

listed in appendix VII.

David G. Wood

Director, Financial Markets and Community Investment
Page 60 GAO-08-355 Bank Secrecy Act

Appendix I

Objectives, Scope, and Methodology Appendixes Appendix I

As mandated by the Financial Services Regulatory Relief Act of 2006, we 

examined several aspects of currency transaction reports (CTR), including 

their usefulness to law enforcement, the burden on depository institutions 

for filing them, and potential changes to the exemption process. 

Specifically, our objectives were to determine: (1) the usefulness of CTR 

requirements to federal, state, and local law enforcement agencies; (2) the 

costs to depository institutions of meeting CTR requirements; and (3) 

factors that affect depository institutions’ decisions to exempt or not 

exempt eligible customers, including opportunities for encouraging use of 

exemptions while maintaining the usefulness of CTR data to law 

enforcement agencies. We conducted this performance audit in 

Washington, D.C., and Miami from November 2007 through February 2008 

in accordance with generally accepted government auditing standards. 

Those standards require that we plan and perform the audit to obtain 

sufficient, appropriate evidence to provide a reasonable basis for our 

findings and conclusions based on our audit objectives. We believe that the 

evidence obtained provides a reasonable basis for our findings and 

conclusions based on our audit objectives.

Assessing the Usefulness of 

CTR Requirements to Law 

Enforcement

We relied on two primary methods to obtain information: (1) structured 

interviews with federal law enforcement agencies and (2) a survey of all 

state and local agencies that access CTR data through FinCEN’s Gateway 

portal, supplemented by structured interviews. We used structured 

interviews to obtain specific information on the usefulness of CTRs, how 

changes in technology have affected their usefulness, and what changes 

could be made to CTR filing requirements that likely would not harm their 

usefulness to law enforcement. In addition, the Financial Crimes 

Enforcement Network (FinCEN), Immigration and Customs Enforcement 

(ICE), the Federal Bureau of Investigation (FBI), and the Organized Crime 

Drug Enforcement Task Force (OCDETF) provided demonstrations of how 

they apply their software to analyze bulk CTR data, and FinCEN provided 

demonstrations of how the Gateway program can be used to access Bank 

Secrecy Act (BSA) data through WebCBRS.

We selected federal law enforcement agencies to interview largely based on 

their level of CTR usage, as measured by the number of “views” of CTR 

records in 2006 and whether they had received access to bulk data sets (see 

table 4 for a list of these agencies.) While FinCEN and the Internal 

Revenue Service (IRS) could provide the number of CTRs viewed through 

the Gateway program, we also obtained data from Department of 

Homeland Security for the number of CTRs viewed through the Treasury 
Appendix I

Objectives, Scope, and Methodology

Page 61 GAO-08-355 Bank Secrecy Act

Enforcement Communications System (TECS) and the IRS for the number 

of CTRs viewed directly from WebCBRS. While the number of times an 

agency has “viewed” a CTR is not a measure of “usefulness” or “utility” of a 

CTR, it does provide an indication of how frequently CTRs were consulted 

as part of an ongoing investigation. In addition, we interviewed officials 

from Criminal Division/Asset Forfeiture and Money Laundering Section 

because this group is the focal point for money laundering and asset 

forfeiture matters within the Department of Justice, as well as officials 

from the OCDETF Fusion Center, which analyzes CTR data in bulk to 

improve OCDETF’s ability to disrupt and dismantle drug trafficking 

organizations and their financial components.

Table 4: Federal Agencies We Interviewed and Number of CTR Views, Fiscal Year 2006

Source: GAO analysis of IRS, FinCEN, and Department of Homeland Security data.

Notes: While the way that the three agencies define views is generally similar, how they actually count 

them may vary. The number of views of CTRs includes those filed by all financial institutions, for 

example, depository institutions and money services businesses. 

a

We interviewed officials from IRS–Small Business/Self-Employed and IRS–Criminal Investigation, the 

two units within IRS with the most CTR views.

b

DEA includes CTRs viewed by the El Paso Intelligence Center, which is a DEA program.

c

FBI includes CTRs viewed by the National Crime Information Center. 

Federal agency Bulk user

Gateway 

program user TECS user

Number of CTR 

views

Internal Revenue Servicea Yes No Yes 912,405 

U.S. Immigration and Customs Enforcement Yes Yes Yes 207,325

Financial Crimes Enforcement Network Yes No Yes 136,090

U.S. Drug Enforcement Administrationb No Yes No 108,507

Federal Bureau of Investigationc Yes Yes Yes 54,290

Bureau of Alcohol, Tobacco, Firearms, and Explosives No Yes Yes 10,124

United States Secret Service Yes Yes Yes 9,424

United States Postal Inspection Service No Yes No 3,586

United States Attorneys Offices No Yes No 1,814

U.S. Securities and Exchange Commission No Yes No 1,195
Appendix I

Objectives, Scope, and Methodology

Page 62 GAO-08-355 Bank Secrecy Act

To obtain the viewpoints of state and local law enforcement agencies on 

the usefulness of CTRs, we conducted a Web-based survey of all state and 

local law enforcement agencies that had access to CTR data through 

FinCEN’s Gateway program as of May 2007.1

 Eighty-nine of the 115 

agencies we surveyed completed the questionnaire for an overall response 

rate of 77 percent. During the development of our questionnaire, we 

pretested it with 7 law enforcement agencies from Florida, Maryland, New 

Jersey, Virginia, and Washington, D.C, and one regulatory agency from 

Kansas. We obtained the e-mail addresses and the names of contacts from 

FinCEN and opened the survey on July 5, 2007. During the course of the 

survey, we sent three follow-up e-mails to nonrespondents and then made 

telephone follow-up calls to remaining nonrespondents to address any 

problems they had and to encourage response. To learn more about 

agencies’ responses, and to obtain more information on other agencies to 

which our surveyed agencies had provided BSA data access, we conducted 

short follow-up interviews by telephone or exchanged e-mail with six 

respondents. We closed the survey on August 17, 2007.

Although this survey was conducted with all of the state and local law 

enforcement agencies in our population, and therefore is not subject to 

sampling error, the practical difficulties of conducting any survey may 

introduce other errors. For example, difficulties in interpreting a particular 

question or sources of information available to respondents can introduce 

unwanted variability or bias into the survey results. Nonresponse to the 

interview or certain questions can also result in increased variability or 

bias. We took steps in developing the questionnaire, and collecting and 

analyzing the data, to minimize such nonsampling errors. While the 

response rate of 77 percent is high, if those not responding differed 

materially from those responding on any particular question we analyzed, 

our analysis may not accurately represent the group surveyed. Our results 

therefore best represent only those responding to our survey. 

To provide more specific information about the usefulness of CTRs than we 

could obtain by survey, we also interviewed state and local law 

enforcement officials. We interviewed 14 law enforcement agencies from 

California, Florida, Illinois, New Jersey, New York, and Texas because 

1

These agencies were located in the 50 states, the District of Columbia, and Puerto Rico. 

They included law enforcement agencies, such as police departments and state bureaus of 

investigation, legal agencies such as prosecutor’s offices, and regulatory agencies such as 

state banking departments.
Appendix I

Objectives, Scope, and Methodology

Page 63 GAO-08-355 Bank Secrecy Act

many of these agencies numbered among the highest users of CTRs and 

were located in states where a higher proportion of CTRs were filed in 

2006. In addition, we interviewed 3 law enforcement agencies from 

Kentucky, Minnesota, and New Mexico, states where the viewing of CTRs 

was less frequent. Finally, we interviewed officials from four High Intensity 

Money Laundering and Related Financial Crimes Areas (HIFCA)—Chicago, 

New York, the Southwest Border, and the California Southern District—to 

identify whether and how CTRs were useful to law enforcement task forces 

with specific money-laundering responsibilities.

Costs to Depository 

Institutions of Meeting CTR 

Requirements

Overall, we used questionnaires, structured interviews, and other methods 

to obtain information on the time and resources depository institutions 

expend to meet CTR requirements. (Depository institutions include 

institutions regulated by the Federal Deposit Insurance Corporation 

(FDIC), Federal Reserve Board (Federal Reserve), Office of the 

Comptroller of the Currency (OCC), Office of Thrift Supervision (OTS), and 

state regulatory officials, and credit unions regulated by National Credit 

Union Administration (NCUA) and state regulatory authorities.) 

CTR and Depository Institution 

Analysis

To meet the mandate’s data analysis requirements, we obtained from 

FinCEN data on the CTRs and exemptions filed for 3 calendar years. This 

data consisted of all of the CTRs and designation of exempt person reports 

submitted by depository institutions during calendar years 2004, 2005, and 

2006. We chose this period because these were the 3 most recent years for 

which FinCEN had complete data. To ensure that we only tracked CTRs 

that were filed by the depository institutions within a given year, we only 

analyzed CTRs that could be clearly identified as being from that year. We 

excluded a total of 1,977,092 CTRs, or about 4.8 percent of the total number 

of CTRs that FinCEN’s data showed as being filed in 2004, 2005, and 2006. 

We also separated the remaining 38,829,864 CTRs into new (37,784,310) and 

amended (1,045,554) CTRs. We analyzed these data to identify the 

characteristics of CTRs and exemptions filed. For example, we identified 

the number of CTRs filed for withdrawals and deposits, the number based 

on aggregated rather than single transactions, and the median number of 

CTRs filed by institutions of different sizes. For exemptions, among other 

analyses, we identified the numbers filed for Phase I and Phase II 

exemptions.
Appendix I

Objectives, Scope, and Methodology

Page 64 GAO-08-355 Bank Secrecy Act

In order to construct a population of depository institutions that file CTRs, 

we needed to combine data files from several sources. We obtained yearend data for the names and asset sizes as measured in dollars of all banking 

depository institutions (banks) from the Federal Reserve Board. In 

addition, we obtained from NCUA the names and asset size of all credit 

unions insured by the National Credit Union Insurance Fund. We matched 

the CTR data from FinCEN and with information on depository institutions 

provided by the Federal Reserve and NCUA to create a single data set. 

Approximately 1 percent of CTRs that we received from FinCEN (number 

of CTRs) could not be matched and were excluded from our analysis. 

Table 5 summarizes the distribution of institutions and percentage of CTRs 

across several size categories for banks and credit unions.

Table 5: Number of CTRs Filed by Asset Size Category of Depository Institutions in 

2006

Source: GAO.

Note: We were unable to classify 82 institutions by asset size category because of inconsistencies 

between the FinCEN and depository institution data. 

Selection of Depository 

Institutions and Examiners to Be 

Interviewed

The primary purpose of the structured interviews, which were conducted 

by phone and in person by GAO analysts, was to obtain detailed 

information about the CTR process, as well as the personnel, technology, 

and training costs associated with filing CTRs and exemptions. As part of 

Institution asset size 

category

Total number of 

depository institutions in 

each category

Percentage of all 

depository institutions 

filing CTRs

Very large banks (greater 

than $50 billion) 27 .2

Large banks ($1 billion to 

less than $50 billion) 575 5.0

Midsize banks ($100 million 

to less than $1 billion) 4,264 36.9

Small banks (less than $100 

million) 3,032 26.2

Credit unions ($100 million 

or more) 1,190 10.3

Credit unions ($10 million to 

less than $100 million 2,137 18.5

Credit unions (less than $10 

million) 344 3.0
Appendix I

Objectives, Scope, and Methodology

Page 65 GAO-08-355 Bank Secrecy Act

our pretesting, we determined that information on costs could not be 

reliably collected by means of a self-administered Web survey because 

banks had difficulties in estimating their costs in the same way unless we 

prompted them with specific questions and adjusted our questions to 

match their accounting practices. 

In determining which depository institutions to interview, we primarily 

considered their asset size. Because the number of banks we categorized 

as very large was small (27), we interviewed the top 5 filers of CTRs, who 

alone accounted for 36 percent of CTRs filed. In addition, we conducted 18 

structured interviews with banks and credit unions that were categorized 

as small, midsize, and large in terms of assets. To select which institutions 

to interview, we conducted a random sample of small, midsize, and large 

institutions included in our CTR database. While the results of our 

interviews are not statistically representative of all institutions in their size 

category, this method enabled us to capture the viewpoints of some of the 

small institutions that may have been excluded from our survey. 

Factors Affecting Use of 

Exemptions and 

Opportunities to Increase 

Use

To identify the factors affecting depository institutions’ decisions regarding 

use of CTR exemption provisions, we surveyed a sample of institutions. 

(Complete survey results can be viewed at http://www.gao.gov/cgibin.getrpt?GAO-08-385SP.) We also obtained and analyzed data on the 

results of BSA examinations from, and interviewed officials of, the five 

federal banking regulatory agencies. We used information from these 

sources, along with a review of CTR filing and exemption regulations, to 

identify opportunities for potentially increasing use of exemptions.

Selection of Depository 

Institutions to Be Surveyed and 

Survey Response Rate

The survey was primarily designed to elicit the viewpoints of bank and 

credit union officials on the amount of time it takes their institution to meet 

CTR filing requirements and their use of the Phase I and Phase II 

exemption process. In addition, the survey asked about possible changes 

that could be made to the exemption process to reduce some of the 

potential burden financial institutions may face in meeting the exemption 

requirements and increase the likelihood institutions would use the 

exemption process. 

We conducted a Web-based survey of a sample of depository institutions 

located in the 50 states and the District of Columbia. Our study population 

consisted of 3,880 banks and credit unions we were able to identify as 

having filed at least 120 CTRs in 2006 and whose size (as measured by the 

dollar value of their assets) in 2006 we were able to determine. Since 
Appendix I

Objectives, Scope, and Methodology

Page 66 GAO-08-355 Bank Secrecy Act

institutions must file a minimum of 8 CTRs on a business over the course of 

a year before the business becomes eligible for the exemption, we 

excluded those institutions that filed fewer than 120 CTRs in 2006 from our 

survey to minimize the number of institutions that would have relatively 

fewer opportunities to file exemptions. As a result of applying this 

selection criterion, about 85 percent of the smallest banks and 90 percent 

of credit unions filing CTRs were excluded from our survey. To obtain the 

viewpoints of these institutions to at least some extent, we included them 

in our universe used to sample institutions for structured interviews. 

We selected a stratified random sample of 680 from this study population, 

where the strata were defined by a combination of asset size and type of 

institution (bank or credit union).2

 Table 6 summarizes the population size, 

sample size, and disposition of sample separately by stratum. Whenever 

possible, we sent the survey to each institution’s compliance officer 

because we believed this officer would be best positioned facilitate a 

response from the institution. We obtained a listing of these officers and 

their e-mail addresses from their respective regulator. The overall 

response rate to our survey was 68 percent. The survey estimates included 

in this report were formed by weighting the survey data to account for both 

sample design and the response rates for each stratum. In addition, the 

response rate varied by question, however, since not all questions were 

asked of all institutions, and institutions could skip questions. 

2

We originally selected a sample of 699 institutions, but 19 of these institutions were 

excluded for various reasons, such as bank mergers.
Appendix I

Objectives, Scope, and Methodology

Page 67 GAO-08-355 Bank Secrecy Act

Table 6: Survey Population and Response Rate

Source: GAO.

Since the primary focus of the survey was to obtain viewpoints on the 

exemption process, most of our questions focused on institutions’ use of 

exemptions. To develop the questions in the questionnaire, we interviewed 

representatives of depository institutions, their trade organizations, and 

their regulators; and FinCEN. The questionnaire also included proposals 

on how to modify the exemption system. To develop these proposals, we 

reviewed (1) the legislative history relating to the Money Laundering 

Suppression Act of 1994 and the subsequent rule-making process, (2) 

reports that previously assessed opportunities to modify the exemption 

process, and (3) current proposals to modify the exemption process, 

including those proposed by trade groups and depository institutions that 

we interviewed.3

 Finally, we pretested the questionnaire with the 

representatives of eight banks and two credit unions to check that (1) the 

questions were clear and unambiguous, (2) terminology was used correctly, 

(3) the questionnaire did not place an undue burden on institutions, (4) the 

information could feasibly be obtained, and (5) the survey was 

comprehensive and unbiased. We made changes to the content and format 

Institution asset size 

category

Number filing at 

least 120 CTRs per 

year

Number 

included in our 

survey sample

Number 

responding to 

the survey

Very large banks (greater 

than $50 billion) 24 24 19

Large banks ($1 billion to 

less than $50 billion) 508 138 90

Midsize banks ($100 million 

to less than $1 billion) 2,563 252 169

Small banks (less than $100 

million) 453 141 92

Credit unions ($100 million 

or more) 332 125 99

Total 3,880 680 469

3

Reports on the exemption procedures included the report submitted by Deloitte & Touche 

in October 2002 to FinCEN on the Bank Secrecy Act and exemption procedures, and 

FinCEN’s subsequent report, Report to the Congress, Use of Currency Transaction Reports, 

submitted by FinCEN on behalf of the Department of the Treasury (October 2002).
Appendix I

Objectives, Scope, and Methodology

Page 68 GAO-08-355 Bank Secrecy Act

of the questionnaire after each of the first pretests, based on the feedback 

we received. 

Our probability sample is used to produce estimates of the population of 

3,880 institutions that filed more than 120 CTRs in 2006. As with all sample 

surveys, our results contain sampling error—potential error that arises 

from not collecting responses from all of the institutions that we surveyed. 

Because we followed a probability procedure based on random selections, 

our sample is only one of a large number of samples that we might have 

drawn. Since each sample could have provided different estimates, we 

express our confidence in the precision of our particular sample’s results as 

a 95 percent confidence interval (e.g., plus or minus 8 percentage points). 

This is the interval that would contain the actual population value for 95 

percent of the samples we could have drawn. As a result, we are 95 percent 

confident that each of the confidence intervals in this report will include 

the true values in the study population. All percentage estimates in this 

report have 95 percent confidence intervals of within plus or minus 8 

percentage points of the estimate, unless otherwise noted. Other numerical 

estimates (for example, medians or means) have 95 percent confidence 

intervals of within plus or minus 8 percent of the value of the estimate, 

unless otherwise noted. In addition to sampling error, the practical 

difficulties of conducting any survey may introduce errors. For example, 

difficulties in interpreting a particular question or sources of information 

available to respondents can introduce unwanted variability into the survey 

results. We took steps in developing the questionnaire, collecting the data, 

and analyzing them to minimize such nonsampling error. To minimize 

nonresponse error we sent 3 follow-up e-mail messages to those who had 

not yet responded. Then we attempted to contact all remaining 

nonrespondents by telephone. It is possible that characteristics of 

responding institutions could differ from characteristics of institutions that 

did not respond to our survey. To the extent that this is the case, our 

sample estimates may differ from the actual values of the population as a 

whole.

Selection of Examiners and 

Violation Data

To obtain the viewpoints of bank and credit union examiners on how CTR 

regulations are applied, and the types of problems that CTR examinations 

surface, we interviewed 15 examiners located in field offices, and officials 

located in the headquarters offices, of the federal banking regulators, as 

well as state regulators from California, Florida, and New York. To 

determine how many CTR violations resulted from BSA examinations, we 

obtained data from each of the federal banking regulators. In addition, we 

obtained data on FinCEN’s fines and enforcement actions. We selected 
Appendix I

Objectives, Scope, and Methodology

Page 69 GAO-08-355 Bank Secrecy Act

regulator field offices in which to interview examiners based on whether 

they were located in areas where high concentrations of CTRs were filed in 

2006. These areas were largely in California, Florida, New York, and 

Illinois. However, the examiners we interviewed from these field offices 

could also speak to their experiences with banks that were located in other 

geographic locations and institutions that filed low numbers of CTRs in the 

geographic areas for which they had responsibility

Opportunities for Improving the 

Exemption System

Survey responses from depository institutions indicated potential ways to 

encourage use of exemptions. To obtain additional viewpoints and to 

understand the implications of making specific changes to the current 

exemption-filing requirements, we obtained the viewpoints of officials 

from FinCEN and the federal banking regulators. To understand how 

changes would need to be implemented, we analyzed the statutory 

requirements in the Money Laundering Suppression Act, the regulatory 

requirements, and guidance issued by FinCEN to identify which regulatory 

requirements were specifically rooted in statute. 
Page 70 GAO-08-355 Bank Secrecy Act

Appendix II

Law Enforcement Agencies’ Use of CTR Data Appendix I

Technological Advances 

Have Increased Potential 

Uses

Access to bulk BSA data, including CTRs, allows law enforcement agencies 

to conduct more sophisticated analyses by combining the BSA data with 

other data sets. Both FinCEN and IRS’s Criminal Investigation unit (IRS-CI) 

have this capability—FinCEN since 2002 and IRS-CI since 2005—enabling 

them to analyze BSA data in conjunction with their own data sets. FinCEN 

reports that its analysts have access to four primary data sources: BSA 

data, databases of criminal reports from other federal law enforcement 

agencies, FinCEN’s own database of investigations, and commercial 

databases that contain identifying information on individuals and 

businesses. IRS-CI investigators have access to BSA data, tax data, and 

counterterrorism data. For instance, IRS uses its Reveal system to identify 

financial crimes, including individual and corporate tax frauds, and 

terrorist activity.1

 The system allows users to establish a profile of the 

actions and persons associated with the search and develop reports that 

include graphical depictions of the data (see fig. 9). For example, IRS can 

search Reveal to identify when a car dealer deposited large amounts of 

cash, as recorded by CTRs, but also to determine whether the car dealer 

filed any Form 8300s, which document the source of that cash.

1

For more information, see GAO, Data Mining: Agencies Have Taken Key Steps to Protect 

Privacy in Selected Efforts, but Significant Compliance Issues Remain, GAO-05-866

(Washington, D.C.: Aug. 15, 2005).
Appendix II

Law Enforcement Agencies’ Use of CTR Data

Page 71 GAO-08-355 Bank Secrecy Act

Figure 9: An Overview of the Reveal Data Mining System 

FinCEN has also provided bulk data access to the Secret Service. The 

Secret Service received its first test data in January 2006 and is in the 

process of combining BSA data with information relating to financial 

investigations, including data on identity theft, credit card fraud, and 

counterfeit U.S. currency. Secret Service officials told us that all 3,200 staff 

across the agency will be granted access to the Secret Service database that 

will house the bulk BSA data. 

Among agencies that continue to access BSA data through the Internet, 

many officials commented that WebCBRS had given them greater 

capabilities to analyze CTR data, because they could download large 

volumes of data and analyze them at their desktops. IRS and Securities and 

Exchange Commission officials commented that the new system was 

easier to use because it displayed CTR data in a format that closely 

resembled the actual CTR document. State law enforcement officials from 

Currency Transaction Report

OMB No. 1506-0004

FINCEN Form 104 (Formerly Form 4789)

(Eff. December 2003)

(Complete all parts that apply--See Instructions)

1 Check all box(es) that apply:

Section A--Person(s) on Whose Behalf Transaction(s) Is Conducted

5 Doing business as (DBA)

2 Individual’s last name or entity’s name 3 First name 4 Middle initial

6 SSN or EIN

7 Address (number, street, and apt. or suite no.)

Department of the Treasury

FinCEN

9 City 10 State 11 ZIP code 12 Country code

 (if not U.S.)

13 Occupation, profession, or business

25 If an individual, describe method used to verify identity:

Section B--Individual(s) Conducting Transaction(s) (if other than above).

If Section B is left blank or incomplete, check the box(es) below to indicate the reason(s)

14 If an individual, describe method used to verify identity:

44 Title of approving official

47 Type or print preparer’s name

45 Signature of approving official

48 Type or print name of person to contact 49 Telephone number

18 Address (number, street, and apt. or suite no.)

15 Individual’s last name 16 First name 17 Middle initial

19 SSN

20 City 21 State 22 ZIP code 23 Country code

 (If not U.S.)

40 City

38 Address (number, street, and apt. or suite no.)

Enter Regulator or BSA

Examiner code number

 (see instructions)

37 Name of financial institution

41 State 42 ZIP code 43 Routing (MICR) number

26 $ ni hsac latoT 00.

Cat. No. 37683N FinCEN Form 104 (Formerly Form 4789) (Rev. 08-03)

Previous editions will not be accepted after August 31, 2004.

Please type or print.

Part I Person(s) Involved in Transaction(s)

 a Armored Car Service b Mail Deposit or Shipment c Night Deposit or Automated Teller Machine d Multiple Transactions

8 Date of birth ____/____/_______

MM DD YYYY

24 Date of birth ____/____/_______

MM DD YYYY

b Passport c Alien registration

d Other f Number:

Amount and Type of Transaction(s). Check all boxes that apply.

28 Date of transaction

____/____/_______

MM DD YYYY

26a ni hsac ngieroF 00.

27 Total cash out $ .00

27a o hsac ngieroF tu 00.

30 Wire Transfer(s) 31 Negotiable Instrument(s) Purchased

34 Deposit(s)/Withdrawal(s)

35 Account Number(s) Affected (if any): 36 Other (specify)

Part III Financial Institution Where Transaction(s) Takes Place

39 EIN or SSN

For Paperwork Reduction Act Notice, see page 4.

Sign

Here

____/____/_______

MM DD YYYY

( )

46 Date of signature

 a Amends prior report b Multiple persons c Multiple transactions

e Issued by:

33 Currency Exchange(s)

d Other

 a Driver’s license/State I.D. b Passport c Alien registration

e Issued by: f Number:

 e Conducted On Own Behalf

 a Driver’s license/State I.D.

 (see instructions, page 4)

32 Negotiable Instrument(s) Cashed

29 Foreign Country

 (see instructions, page 4)

Part II

Currency Transaction Report

OMB No. 1506-0004

FINCEN Form 104 (Formerly Form 4789)

(Eff. December 2003)

(Complete all parts that apply--See Instructions)

1 Check all box(es) that apply:

Section A--Person(s) on Whose Behalf Transaction(s) Is Conducted

5 Doing business as (DBA)

2 Individual’s last name or entity’s name 3 First name 4 Middle initial

6 SSN or EIN

7 Address (number, street, and apt. or suite no.)

Department of the Treasury

FinCEN

9 City 10 State 11 ZIP code 12 Country code

 (if not U.S.)

13 Occupation, profession, or business

25 If an individual, describe method used to verify identity:

Section B--Individual(s) Conducting Transaction(s) (if other than above).

If Section B is left blank or incomplete, check the box(es) below to indicate the reason(s)

14 If an individual, describe method used to verify identity:

44 Title of approving official

47 Type or print preparer’s name

45 Signature of approving official

48 Type or print name of person to contact 49 Telephone number

18 Address (number, street, and apt. or suite no.)

15 Individual’s last name 16 First name 17 Middle initial

19 SSN

20 City 21 State 22 ZIP code 23 Country code

 (If not U.S.)

40 City

38 Address (number, street, and apt. or suite no.)

Enter Regulator or BSA

Examiner code number

 (see instructions)

37 Name of financial institution

41 State 42 ZIP code 43 Routing (MICR) number

26 $ ni hsac latoT 00.

Cat. No. 37683N FinCEN Form 104 (Formerly Form 4789) (Rev. 08-03)

Previous editions will not be accepted after August 31, 2004.

Please type or print.

Part I Person(s) Involved in Transaction(s)

 a Armored Car Service b Mail Deposit or Shipment c Night Deposit or Automated Teller Machine d Multiple Transactions

8 Date of birth ____/____/_______

MM DD YYYY

24 Date of birth ____/____/_______

MM DD YYYY

b Passport c Alien registration

d Other f Number:

Amount and Type of Transaction(s). Check all boxes that apply.

28 Date of transaction

____/____/_______

MM DD YYYY

26a ni hsac ngieroF 00.

27 Total cash out $ .00

27a o hsac ngieroF tu 00.

30 Wire Transfer(s) 31 Negotiable Instrument(s) Purchased

34 Deposit(s)/Withdrawal(s)

35 Account Number(s) Affected (if any): 36 Other (specify)

Part III Financial Institution Where Transaction(s) Takes Place

39 EIN or SSN

For Paperwork Reduction Act Notice, see page 4.

Sign

Here

____/____/_______

MM DD YYYY

( )

46 Date of signature

 a Amends prior report b Multiple persons c Multiple transactions

e Issued by:

33 Currency Exchange(s)

d Other

 a Driver’s license/State I.D. b Passport c Alien registration

e Issued by: f Number:

 e Conducted On Own Behalf

 a Driver’s license/State I.D.

 (see instructions, page 4)

32 Negotiable Instrument(s) Cashed

29 Foreign Country

 (see instructions, page 4)

Part II

Currency Transaction Report

OMB No. 1506-0004

FINCEN Form 104 (Formerly Form 4789)

(Eff. December 2003)

(Complete all parts that apply--See Instructions)

1 Check all box(es) that apply:

Section A--Person(s) on Whose Behalf Transaction(s) Is Conducted

5 Doing business as (DBA)

2 Individual’s last name or entity’s name 3 First name 4 Middle initial

6 SSN or EIN

7 Address (number, street, and apt. or suite no.)

Department of the Treasury

FinCEN

9 City 10 State 11 ZIP code 12 Country code

 (if not U.S.)

13 Occupation, profession, or business

25 If an individual, describe method used to verify identity:

Section B--Individual(s) Conducting Transaction(s) (if other than above).

If Section B is left blank or incomplete, check the box(es) below to indicate the reason(s)

14 If an individual, describe method used to verify identity:

44 Title of approving official

47 Type or print preparer’s name

45 Signature of approving official

48 Type or print name of person to contact 49 Telephone number

18 Address (number, street, and apt. or suite no.)

15 Individual’s last name 16 First name 17 Middle initial

19 SSN

20 City 21 State 22 ZIP code 23 Country code

 (If not U.S.)

40 City

38 Address (number, street, and apt. or suite no.)

Enter Regulator or BSA

Examiner code number

 (see instructions)

37 Name of financial institution

41 State 42 ZIP code 43 Routing (MICR) number

26 $ ni hsac latoT 00.

Cat. No. 37683N FinCEN Form 104 (Formerly Form 4789) (Rev. 08-03)

Previous editions will not be accepted after August 31, 2004.

Please type or print.

Part I Person(s) Involved in Transaction(s)

 a Armored Car Service b Mail Deposit or Shipment c Night Deposit or Automated Teller Machine d Multiple Transactions

8 Date of birth ____/____/_______

MM DD YYYY

24 Date of birth ____/____/_______

MM DD YYYY

b Passport c Alien registration

d Other f Number:

Amount and Type of Transaction(s). Check all boxes that apply.

28 Date of transaction

____/____/_______

MM DD YYYY

26a ni hsac ngieroF 00.

27 Total cash out $ .00

27a o hsac ngieroF tu 00.

30 Wire Transfer(s) 31 Negotiable Instrument(s) Purchased

34 Deposit(s)/Withdrawal(s)

35 Account Number(s) Affected (if any): 36 Other (specify)

Part III Financial Institution Where Transaction(s) Takes Place

39 EIN or SSN

For Paperwork Reduction Act Notice, see page 4.

Sign

Here

____/____/_______

MM DD YYYY

( )

46 Date of signature

 a Amends prior report b Multiple persons c Multiple transactions

e Issued by:

33 Currency Exchange(s)

d Other

 a Driver’s license/State I.D. b Passport c Alien registration

e Issued by: f Number:

 e Conducted On Own Behalf

 a Driver’s license/State I.D.

 (see instructions, page 4)

32 Negotiable Instrument(s) Cashed

29 Foreign Country

 (see instructions, page 4)

Part II

Sources: GAO analysis of agency data; Art Explosion (clip art).

Inputs: What happens:

The database contains

lists of data that are

compared to each other.

Outputs:

The data visualization tool creates a

visual representation of the relationship

of the data pulled in a query.

Data contained on various forms such 

as currency transaction reports, tax 

data, and counterterrorism data.

Subject a subject 5551

q subject 5557

c subject 5559

l subject 5553

b subject 6555

n subject 5455

# subject 5155

v subject 5585

k subject 5955

u subject 5525

s subject 5554

u subject 5525

s subject 5554

n subject 5455

v subject 5585

a subject 5551

q subject 5557

c subject 5559

l subject 5553

b subject 6555

n subject 5455

# subject 5155

v subject 5585

k subject 5955

u subject 5525

s subject 5554

c subject 5559

l subject 5553

a subject 5551

q subject 5557

b subject 6555

-6555

b subject 6555

Social

Security #

Phone

Bank account Driver’s license

Secondary

subject

Address

Subject B

M-45969707

Home Address

Height

Weight

Organization
Appendix II

Law Enforcement Agencies’ Use of CTR Data

Page 72 GAO-08-355 Bank Secrecy Act

agencies in New York and Illinois that coordinate requests for BSA data 

reported that the new system made it easier for them to distribute CTR data 

to law enforcement agencies, because they could easily download and 

export the data directly into a PDF file or spreadsheet application. (In 

contrast, officials said that under the old CBRS system, a user had to copy, 

paste, and manually format each CTR record prior to distribution.) In 2007, 

FinCEN added a new feature to WebCBRS that allows users to download 

and export BSA data to a commercial database application, where users 

can use link analysis techniques to explore associations between various 

data sets.2

 According to FinCEN officials, technology such as this will likely 

be useful for the proactive analysis of CTR data, particularly at the state 

and local law enforcement level. 

In general, many law enforcement officials indicated that the technological 

advances had already increased their use of CTRs or would continue to do 

so.

• Investigators with the New York County District Attorney’s Office told 

us that they added 10 new Gateway user accounts last year because they 

were getting more requests for BSA data. They noted that prosecutors 

had been requesting CTR data more often as word of mouth spread 

about the value of CTRs as corroborating sources of evidence. 

• A Gateway coordinator for New York told us he had conducted training 

sessions across the state with local police departments on the value of 

CTR data and the importance of searching for CTR data at the beginning 

of an investigation. 

• An official associated with a HIFCA said she had been promoting 

awareness of the WebCBRS download feature and creative ways to 

proactively analyze CTR data, such as an analysis of CTRs filed for 

certain occupations. 

DEA officials noted that as a result of a DEA directive mandating that all of 

the agency’s investigations include a financial component, the number of 

2

According to FinCEN, link analysis is a technique used to explore associations among a 

large collection of data of different types. In the case of financial data, the connections 

might include, for example, names, addresses, bank accounts, businesses, and cash 

deposits. Combining and linking these pieces of data from multiple sources add layers of 

understanding to the behavior the data represents. 
Appendix II

Law Enforcement Agencies’ Use of CTR Data

Page 73 GAO-08-355 Bank Secrecy Act

its Gateway users increased by 34 percent from the end of calendar year 

2004 to the end of calendar year 2006. 

Data from FinCEN indicate that state and local use of CTR data has been 

somewhat concentrated. Figure 10 shows the numbers of CTR “views” 

through FinCEN’s Gateway program in 2006. (Gateway is the primary 

means of access to BSA data for state and local law enforcement users.) 
Appendix II

Law Enforcement Agencies’ Use of CTR Data

Page 74 GAO-08-355 Bank Secrecy Act

Figure 10: States That Viewed CTR Data, by Number of CTRs Viewed in the Gateway Program, Fiscal Year 2006

Sources: GAO (analysis); Art Explosion (map).

Fewer than 1,000

1,000 - 2,999

3,000 - 9,999

10,000 or more
Appendix II

Law Enforcement Agencies’ Use of CTR Data

Page 75 GAO-08-355 Bank Secrecy Act

Case Examples Illustrate 

CTRs’ Usefulness to 

Federal, State, and Local 

Law Enforcement 

Investigations 

The examples below illustrate the varied roles that CTRs can play in 

federal, state, and local law enforcement investigations. CTRs filed by 

depository institutions helped initiate or support the investigations, which 

include tax, money laundering, fraud, and narcotics cases. (Because of the 

sensitive nature of this information, references to subjects’ names and 

other identifiers have been removed.) 

Examples from IRS

• IRS investigators initiated a case based on a call from a bank security 

officer who reported that a bank customer was receiving large tax 

refunds into his accounts and withdrawing the funds in cash. Using 

known bank account numbers, the investigators searched the agency’s 

Currency Banking and Retrieval System (CBRS), which contains CTR 

data, and identified CTRs showing large “cash outs.” The investigators 

found data that they believed indicated that 30 different bank accounts 

were used to perpetuate the tax refund scheme, and 23 refunds went 

into accounts identified through CTRs. Moreover, the CTRs identified 

accounts controlled by relatives of the bank customer. Consequently, 

the CTRs provided probable cause to obtain and execute a search 

warrant at the residence of a relative. Ultimately, investigators learned 

that the scheme involved about 125 tax returns and more than $500,000 

in false claims. According to IRS, the CTRs helped narrow the focus of 

the investigation and saved valuable time in identifying the responsible 

parties in the scheme. IRS further noted that without the CTRs, the 

investigation would have been delayed for weeks or months, allowing 

the scheme to continue and potentially resulting in substantial 

additional loss to the government. 

• IRS initiated a tax investigation from a Suspicious Activity Report (SAR) 

disclosing that business receipts had been deposited into a personal 

account. According to IRS, the dollar amount reported in the SAR was 

not substantial, and based on the SAR information alone, the 

investigation would not have proceeded. However, queries of CBRS 

identified more than 125 CTRs related to the person under investigation, 

which were filed over a 3-year period for amounts in excess of $3.5 

million. Further investigation determined that the person failed to report 

almost all of the $3.5 million gross receipts on his business tax returns. 

The person further concealed these transactions by failing to file 

personal income tax returns or, in some years, misreported the income 

to IRS. When confronted with the evidence developed from the CTRs, 

the person cooperated with IRS and assisted with an undercover 
Appendix II

Law Enforcement Agencies’ Use of CTR Data

Page 76 GAO-08-355 Bank Secrecy Act

operation. According to IRS, without the CTR information, IRS may not 

have opened the investigation. 

• Investigators searched CBRS for information relating to a person 

suspected of trafficking narcotics, including all of the person’s known 

relatives and associates. A depository institution had filed a CTR on the 

person’s sister, reporting a deposit of $100,000 in cash into her account. 

The financial investigation on the sister revealed that she did not have 

enough legitimate income to justify a deposit of $100,000 in cash. Based 

on the CTR, investigators subpoenaed bank records, which showed 

evidence of a real estate purchase in Florida using the $100,000 as a 

down payment. Further investigation showed that the person had 

conducted the entire real estate transaction, and the sister had been 

used as a nominee (that is, a person in whose name assets are 

transferred). These transactions were the basis for money-laundering 

charges against the person. The evidence in the CTR implicated the 

sister, and was instrumental in obtaining a guilty plea by the person. The 

person received a 20-year prison sentence and forfeited more than 

$500,000 in assets.

Examples from Immigration and Customs Enforcement

• Following the September 11 attacks, ICE investigators in Texas 

proactively analyzed CTR data and identified an unlicensed hawala

sending money to several Middle Eastern countries. (A hawala is an 

informal banking system that provides a mechanism for the remittance 

of currency or other forms of monetary value without physical 

transportation or the use of contemporary monetary instruments.) 

Multiple same-day cash deposits, with each deposit less than $10,000,

were being made into the hawala’s bank account at various branches of 

the same bank across Texas. According to ICE, this illegal activity would 

not have been detected without CTRs because the bank activity was 

spread across 11 counties. As a result of the investigation, the hawala 

was shut down, and a total of $346,701 was seized and forfeited.

• ICE investigators in New York received information that an illegal 

money-laundering operation was being operated out of a phone card 

booth in Manhattan. Standard preliminary steps to identify the persons 

involved had failed because of the nicknames used by them, variations 

in translations of the names (which were foreign), and the persons’ 

immigration status. However, investigators searched for CTR data and 

found approximately 1,300 CTRs had been filed on the suspected 
Appendix II

Law Enforcement Agencies’ Use of CTR Data

Page 77 GAO-08-355 Bank Secrecy Act

business. The volume of CTRs revealed accounts held at multiple banks. 

Although most of the accounts had been closed, the CTRs provided 

crucial details of the alleged illegal activity and assisted in identifying 

members of the involved organization; for example, information on the 

CTRs was used in an affidavit for a search warrant for the target 

business and to obtain grand jury subpoenas for bank accounts. Two 

principal persons allegedly involved were arrested and charged with 

money laundering, alien smuggling, and conspiracy. These arrests were 

conducted simultaneously with the arrests of 35 members of an Asian 

criminal gang in Manhattan who were identified as having been involved 

in the money-laundering operation. 

• ICE investigators in Chicago initiated an investigation of a local 

business based on information in CTRs and SARs that showed different 

individuals making deposits into several bank accounts controlled by 

the business and possible structuring violations. The investigation 

revealed that the business may have been operating as an illegal money 

transmitter. The business owner instructed his customers to deposit 

money into his bank account, charged a nominal fee to remit money on 

their behalf, and arranged for the transfer of money on computers 

located in his apartment. The business owner was arrested and charged 

with operating an unlicensed money services business. 

• SARs filed on a business located in New York suspected of trafficking 

counterfeit goods showed that certain persons may have been 

structuring cash deposits into the business’s account to avoid CTRs 

being filed. However, on many occasions the persons deposited more 

than $10,000, and the depository institution filed CTRs. The CTRs were 

instrumental in identifying the co-conspirators apparently involved in 

the illegal operation, and investigators used the CTR information to 

apply for grand jury subpoenas, which produced bank account records 

of the alleged conspirators and provided further evidence of money 

laundering. The CTRs also were used in the affidavit for a seizure 

warrant for bank accounts. The investigation revealed that during a 1-

year period, the alleged conspirators had laundered approximately $5 

million to China through wire transfers. In total, seven individuals were 

charged with money laundering and trafficking in counterfeit goods and 

the funds in the six accounts belonging to the members of the 

conspiracy were seized.
Appendix II

Law Enforcement Agencies’ Use of CTR Data

Page 78 GAO-08-355 Bank Secrecy Act

Examples from the Drug Enforcement Administration

• Surveillance of a suspected drug “stash house” led to the discovery of a 

vehicle registered to a business located in central California. A search of 

BSA data revealed the existence of approximately 1,600 CTRs filed on 

the business over a 3-year period. Later, DEA intelligence revealed that 

similarly registered vehicles had been observed during other 

surveillance operations in central and Southern California. The earlier 

CTRs identified all of the conductors of the transactions as individuals, 

but later cash deposits were being made by armored carrier. DEA 

ultimately determined that the evidence indicated that the business 

represented the cash side of the drug trade and the business was being 

used to deposit the illicit proceeds. Investigators discovered that more 

than 2,000 CTRs documenting in excess of $100 million in cash deposits 

had been filed on the business over a 5-year period. However, no SARs 

were ever filed.

• A DEA office provided another DEA office with information suggesting 

that a certain person was involved in drug trafficking, money 

laundering, and terrorist financing in the receiving office’s area of 

responsibility. The only leads the receiving office had were the person’s 

name, date of birth, and Social Security number. Investigators searched 

CBRS and found CTRs. These CTRs helped indicate to them that the 

person was engaging in criminal activity. The CTRs identified the 

person’s place of employment, bank account numbers, and other 

individuals that had conducted cash transactions on behalf of the 

person under investigation.

Examples from the Federal Bureau of Investigation

• CTRs assisted FBI investigators in unraveling a complex case involving 

Medicare fraud. Over a 2-year period, the Medicare system paid several 

million dollars to dozens of “front” durable medical equipment 

companies that in turn wrote checks to nonexistent medical equipment 

supply companies. These checks were allegedly cashed at several 

check-cashing businesses, which all maintained bank accounts at the 

same local bank. The review of CTRs filed by the bank revealed several 

hundred million dollars paid out in the form of cash to the check cashers 

over a relatively short period. Approximately 90 percent of this bank’s 

revenues were derived from its check-cashing business client base. At 

the suggestion of the FBI, the bank’s regulator started an examination of 

the bank, which uncovered evidence that a bank insider was 
Appendix II

Law Enforcement Agencies’ Use of CTR Data

Page 79 GAO-08-355 Bank Secrecy Act

participating in an illegal money services business. The bank was fined 

and ultimately ceased operations.

• A search of BSA data in support of a narcotics money-laundering 

investigation produced more than 3,000 reports, the vast majority of 

which were CTRs. Through further analysis of the CTRs, the FBI was 

able to confirm and document a critical suspected link between certain 

persons under investigation in different states.

Example from the Secret Service

• CTRs assisted Secret Service investigators in identifying a person that 

had allegedly committed investment fraud. The victims of the fraud had 

given checks to the person for investments; however, the person would 

either cash or deposit the checks. Depository institutions filed CTRs on 

these transactions, which provided a direct link to the person. Further 

investigation disclosed that the person had been involved in a similar 

scheme in another part of the same state and had pending arrest 

warrants. The total estimated loss in the case was more than $400,000. 

Authorities also conducted asset seizures and forfeitures in this case.

Examples from State or Local Governments

• Investigators with the Chicago Police Department searched for CTRs on 

a business suspected of laundering drug money in the mid-1990s and 

identified a CTR that reported a cash withdrawal of $17,000 by a fork-lift 

driver. Investigators subsequently issued a subpoena for related bank 

records and discovered that the bank account, a personal checking 

account, had received more than $52 million in deposits through wire 

transfers over an 18-month period. Funds deposited into this account 

then were redistributed through checks drawn on the account and 

negotiated across southern Texas. Investigators contacted IRS-CI and 

identified this lead to a nationwide major drug money-laundering case.

• Investigators with the California Department of Justice used CTRs to 

identify bank accounts for a subpoena of bank records in support of an 

investigation on health care fraud. The CTRs linked several physicians 

to Russian organized crime figures that had set up a series of storefront 

clinics and medical diagnostic test companies. Some of the CTRs 

showed evidence of structuring, while others showed the involvement 

of family members, such as a 19-year-old son on record as the 

“corporation president,” when in reality he was fronting for his parents. 
Appendix II

Law Enforcement Agencies’ Use of CTR Data

Page 80 GAO-08-355 Bank Secrecy Act

The information on the CTRs also led the investigators to consult 

corporate fraud investigators, who were helpful in providing SARs about 

these same activities.
Page 81 GAO-08-355 Bank Secrecy Act

Appendix III

Information on CTRs Filed from 2004 to 2006 Appendix I

The Financial Services Regulatory Relief Act of 2006 asked us to analyze 

CTR filing data and to categorize these data according to the size of 

financial institutions, in groups of 100. Figure 11 shows that the 100 largest 

institutions accounted for 65 percent of all CTRs filed in 2006, while the 

portion of CTRs filed by smaller institutions (in categories of 100) 

diminished along with institution size.

Figure 11: CTRs Filed in 2006, by Institution Asset Size

CTRs (in millions)

Source: GAO.

19%

4%

8%

65%

1st 100 largest institutions

2nd 100 largest institutions

3rd 100 largest institutions

2% 4th 100 largest institutions

2% 5th 100 largest institutions

6th - 177th 100 largest

institutions

(less than 1.5% each)

012345678

6th - 177th

100 institutions

5th 100 institutions

4th 100 institutions

3rd 100 institutions

2nd 200 institutions

1st 100 institutions

Percentage of CTRs filed by largest institutions

Number of CTRs filed by institution asset size

(ranked highest to lowest)
Appendix III

Information on CTRs Filed from 2004 to 2006

Page 82 GAO-08-355 Bank Secrecy Act

Table 7 shows CTR filing data, aggregated for 2004 through 2006, by 

institution size category.

Table 7: Number and Percentage of CTRs Filed by Institution Type, 2004-2006

Source: GAO.

Note: An amended CTR is a correction to an initial CTR filed by the financial institution.

Institution

New CTRs Amended CTRs

Number

of CTRs

Percentage

of CTRs

Number

of CTRs

Percentage

of CTRs

Bank: less than $100 

million 711,007 1.9 90,379 8.6

Bank: $100 million to 

less than $1 billion 4,872,316 12.9 398,574 38.1

Bank: $1 billion to 

less than $50 billion 11,545,642 30.6 268,073 25.6

Bank: $50 billion or 

more 20,161,126 53.4 191,784 18.3

Credit union: less 

than $10 million 3,771 0 2,216 0.2

Credit union: $10 

million to less than 

$100 million 102,892 0.3 28,185 2.7

Credit union: $100 

million or more 387,556 1 66,343 6.3

Total 37,784,310 100 1,045,554 100
Appendix III

Information on CTRs Filed from 2004 to 2006

Page 83 GAO-08-355 Bank Secrecy Act

Table 8 shows the mean averages and the median numbers of CTRs filed by 

institution size category.

Table 8: Mean and Median Numbers of CTRs Filed by Size of Institution, 2004-2006

Source: GAO.

Note: In statistics, both the mean and the median are measures of central tendency and are also 

referred to as averages. The median is the midpoint in a distribution; in this case, half of the institutions 

in each size category filed more than the median number of CTRs, and half filed fewer.

Institution

2004 2005 2006

Mean Median Mean Median Mean Median 

Bank: less than $100 

million 83 22 78 23 67 17

Bank: $100 million to 

less than $1 billion 428 195 428 193 349 154

Bank: $1 billion to 

less than $50 billion 8,451 2,282 7,438 2,278 6,334 1,889

Bank: $50 billion or 

more 288,193 148,545 289,599 142,295 243,736 125,202

Credit union: less 

than $10 million 4 1 5 1 4 1

Credit union: $10 

million to less than 

$100 million 24 5 13 5 14 5

Credit union: $100 

million or more 99 43 118 49 117 47

Total 1,137 43 1,177 46 1,061 41
Appendix III

Information on CTRs Filed from 2004 to 2006

Page 84 GAO-08-355 Bank Secrecy Act

Table 9 shows the total number of CTRs that were based on multiple 

transactions—that is, transactions that in the aggregate amounted to more 

than $10,000 on the same day for a single account. 

Table 9: Number of CTRs Based on Aggregated Transactions, 2004-2006

Source: GAO.

Number of CTRs based

on multiple transactions

Percentage of all 

CTRs filed 

2004 8,710,754 66.9

2005 9,047,781 65.8

2006 8,158,049 65.4

2004-2006 total 25,916,584 66
Appendix III

Information on CTRs Filed from 2004 to 2006

Page 85 GAO-08-355 Bank Secrecy Act

Tables 10 and 11 show the number of CTRs filed for transactions in which 

the depository institution received cash (cash-in transactions) and 

dispensed cash (cash-out transactions), respectively, categorized by the 

dollar values of the transactions. 

Table 10: Number and Percentage Amount of Cash-In Transactions Recorded by CTRs, 2004-2006

Source: GAO.

CTR amount

2004 2005 2006

Number of

cash-in 

CTRs

Percentage of 

cash-in

CTRs

Number of

cash-in 

CTRs

Percentage 

of all

CTRs

Number of

cash-in

CTRs

Percentage 

of all

CTRs

$10,000 or less 19,765 0.2 19,419 0.2 15,017 0.2

$10,001 to $15,000 4,165,255 42.3 4,321,651 42.2 3,844,261 42

$15,001 to $20,000 1,856,088 18.8 1,945,226 19 1,738,266 19

$20,001 to $25,000 969,947 9.8 1,010,589 9.9 900,627 9.8

$25,001 to $30,000 612,969 6.2 636,812 6.2 566,071 6.2

$30,001 to $35,000 401,850 4.1 417,913 4.1 369,215 4

$35,001 to $40,000 292,981 3 302,029 2.9 269,586 2.9

$40,001 to $45,000 212,212 2.2 218,732 2.1 195,482 2.1

$45,001 to $50,000 168,452 1.7 174,690 1.7 156,774 1.7

More than $50,000 1,148,599 11.7 1,199,836 11.7 1,090,745 11.9

Total 9,848,118 100 10,246,897 100 9,146,044 100
Appendix III

Information on CTRs Filed from 2004 to 2006

Page 86 GAO-08-355 Bank Secrecy Act

Table 11: Number and Percentage of Cash-Out Transactions Recorded by CTRs, 2004-2006

Source: GAO.

CTR amount

2004 2005 2006

Number of

cash-out

CTRs

Percentage of 

cash-out

CTRS

Number of

cash-out 

CTRs

Percentage of 

cash-out 

CTRS

Number of

cash-out

CTRs

Percentage of 

cash-out 

CTRs

$10,000 or less 30,142 0.9 28,364 0.8 20,240 0.6

$10,001 to $15,000 1,122,836 33.3 1,289,605 34.5 1,237,693 34.9

$15,001 to $20,000 611,869 18.2 677,749 18.1 635,963 17.9

$20,001 to $25,000 289,851 8.6 319,485 8.5 296,953 8.4

$25,001 to $30,000 238,613 7.1 261,010 7 244,157 6.9

$30,001 to $35,000 130,609 3.9 140,668 3.8 130,827 3.7

$35,001 to $40,000 136,177 4 148,137 4 139,199 3.9

$40,001 to $45,000 79,128 2.3 84,758 2.3 79,081 2.2

$45,001 to $50,000 100,180 3 107,915 2.9 102,515 2.9

More than $50,000 628,961 18.7 682,254 18.2 662,877 18.7

Total 3,368,366 100 3,739,945 100 3,549,505 100
Appendix III

Information on CTRs Filed from 2004 to 2006

Page 87 GAO-08-355 Bank Secrecy Act

Figure 12 shows the geographic dispersion of CTRs filed in 2006, by county.

Figure 12: CTRs Filed in 2006, by County 

0 to 4,999

5,000 to 9,999

10,000 to 49,999

50,000 to 99,999

100,000 or more

New CTRs filed 2006

Sources: GAO (analysis); Map Resources (map).
Page 88 GAO-08-355 Bank Secrecy Act

Appendix IV

Additional Information on Depository 

Institutions’ Use of Exemptions Appendix IV

Table 12 shows the total number of Phase I exemptions filed during 2006 by 

type of customer (bank, government, listed company, or listed government 

subsidiary), by institutions of different sizes. While depository institutions 

are not required to file biennial renewals for Phase I customers, the data 

show that some institutions did so.

Table 12: Number and Percentage of Phase I Exemptions Filed by Depository Institutions, 2006

Institution

2006

Initial

exemptions

Biennial

renewals

Total

exemptions 

Total 

number

Percentage of 

total

Total 

number

Percentage of 

total

Total 

number

Percentage of 

total

Bank: less 

than $100 

million

Bank 511 65.1 205 61.4 716 64

Government 133 16.9 47 14.1 180 16.1

Listed company 111 14.1 63 18.9 174 15.5

Listed company 

subsidiary 30 3.8 19 5.7 49 4.4

Total 785 100 334 100 1,119 100

Bank: 

$100 

million to 

less than 

$1 billion

Bank 819 42.9 329 39.5 1,148 41.9

Government 672 35.2 230 27.6 902 32.9

Listed company 305 16 228 27.4 533 19.4

Listed company 

subsidiary 114 6 45 5.4 159 5.8

Total 1,910 100 832 100 2,742 100

Bank: $1 

billion to 

less than 

$50 billion

Bank 581 28.1 51 36.4 632 28.7

Government 1,040 50.4 45 32.1 1,085 49.2

Listed company 338 16.4 33 23.6 371 16.8

Listed company 

subsidiary 105 5.1 11 7.9 116 5.3

Total 2,064 100 140 100 2,204 100

Bank: $50 

billion or 

more

Bank 532 18.7 6 60 538 18.8

Government 1,208 42.5 3 30 1,211 42.4

Listed company 500 17.6 1 10 501 17.5

Listed company 

subsidiary 605 21.3 605 21.2

Total 2,845 100 10 100 2,855 100
Appendix IV

Additional Information on Depository 

Institutions’ Use of Exemptions

Page 89 GAO-08-355 Bank Secrecy Act

Source: GAO.

Table 13 shows the total number of Phase II initial exemptions and biennial 

renewals filed during 2006, by type of customer (nonlisted businesses and 

payroll customers), by institutions of different sizes.

Credit 

union: 

less than 

$10 

million

Bank 24 85.7 1 100 25 86.2

Government 3 10.7 3 10.3

Listed company

Listed company 

subsidiary 1 3.6 1 3.4

Total 28 100 1 100 29 100

Credit 

union: $10

million to 

less than 

$100 

million

Bank 81 61.4 6 33.3 87 58

Government 18 13.6 5 27.8 23 15.3

Listed company 33 25 7 38.9 40 26.7

Listed company 

subsidiary

Total 132 100 18 100 150 100

Credit 

union: 

$100 

million or 

more

Bank 79 63.2 25 53.2 104 60.5

Government 31 24.8 18 38.3 49 28.5

Listed company 13 10.4 4 8.5 17 9.9

Listed company 

subsidiary 2 1.6 2 1.2

Total 125 100 47 100 172 100

Total Bank 2,627 33.3 623 45.1 3,250 35.1

Government 3,105 39.4 348 25.2 3,453 37.2

Listed company 1,300 16.5 336 24.3 1,636 17.6

Listed company 

subsidiary 857 10.9 75 5.4 932 10.1

Total 7,889 100 1,382 100 9,271 100

(Continued From Previous Page)

Institution 

2006

Initial

exemptions

Biennial

renewals

Total

exemptions 

Total 

number

Percentage of 

total

Total 

number

Percentage of 

total

Total 

number

Percentage of 

total
Appendix IV

Additional Information on Depository 

Institutions’ Use of Exemptions

Page 90 GAO-08-355 Bank Secrecy Act

Table 13: Number and Percentage of Phase II Exemptions Filed by Depository Institutions, 2006

Source: GAO.

Institution

Initial exemptions Biennial renewals

Total

exemptions

Number 

Percentage of 

total Number

Percentage of 

total Number

Percentage 

of total

Bank: less than 

$100 million

Nonlisted 

businesses 803 99 1,618 99.9 2,421 99.6

Payroll customers 8 1 2 0.1 10 0.4

Total 811 100 1,620 100 2,431 100

Bank: $100 

million to less 

than $1 billion

Nonlisted 

businesses 4,501 99.5 9,149 99.9 13,650 99.7

Payroll customers 22 0.5 13 0.1 35 0.3

Total 4,523 100 9,162 100 13,685 100

Bank: $1 billion 

to less than $50 

billion

Nonlisted 

businesses 4,982 100 7,729 99.9 12,711 100

Payroll customers 2 0 4 0.1 6 0

Total 4,984 100 7,733 100 12,717 100

Bank: $50 billion 

or more

Nonlisted 

businesses 2,714 100 2,002 100 4,716 100

Payroll customers 1 0 1 0

Total 2,714 100 2,003 100 4,717 100

Credit union: 

less than $10

million

Nonlisted 

business 7 100 2 100 9 100

Total 7 100 2 100 9 100

Credit union: 

$10 million to 

less than $100 

million

Nonlisted 

businesses 217 96.9 63 92.6 280 95.9

Payroll customers 7 3.1 5 7.4 12 4.1

Total 224 100 68 100 292 100

Credit union: 

$100 million or 

more

Nonlisted 

businesses 188 96.9 168 98.2 356 97.5

Payroll customers 6 3.1 3 1.8 9 2.5

Total 194 100 171 100 365 100

Total Nonlisted 

businesses 13,412 99.7 20,731 99.9 34,143 99.8

Payroll customers 45 0.3 28 0.1 73 0.2

Total 13,457 100 20,759 100 34,216 100
Appendix IV

Additional Information on Depository 

Institutions’ Use of Exemptions

Page 91 GAO-08-355 Bank Secrecy Act

Depository Institutions Not 

Using Phase I or Phase II 

Exemptions Cited a Number 

of Similar Factors for Not 

Using the Exemptions 

As shown in figures 13 and 14 below, respondents to our survey cited a 

number of similar factors that were important in their decision not to 

exempt customers eligible for Phase I and Phase II exemptions. Concern 

that examiners would find that the exemption was not done correctly was 

the top concern among banks that did not exempt Phase I customers and 

the second-ranked concern among banks that did not exempt Phase II 

customers. Difficulty in determining eligibility was ranked second for those 

not exempting Phase I customers and fifth for those not exempting Phase 

II. Banks also responded that another major reason for not using the 

exemption was that it was easier to file CTRs than to go through the 

exemption process. Finally, those not exempting Phase I or Phase II 

customers responded that the time-consuming nature of the annual reviews 

was a major reason they did not use the exemption. 

Figure 13: Factors That Institutions Considered to Be of Very Great or Great Importance When Deciding Not to Exempt a 

Phase I Eligible Customer

Note: The 95 percent confidence intervals for these estimates are within +/- 15 percentage points, 

except for “other factors,” which is within +/-26 percentage points of the estimate.

Percentage

Source: GAO.

0 10 20 30 40 50

Lack of clear understanding of the

exemption process

Other factors

Difficulty determining if at least

50 percent of business is owned

by a publicly traded company

It is easier to file CTRs than to go

through the exemption process

Annual reviews are time consuming

Difficulty determining exemption eligibility

Concerns that examiners will find that the

 exemption was not done correctly
Appendix IV

Additional Information on Depository 

Institutions’ Use of Exemptions

Page 92 GAO-08-355 Bank Secrecy Act

Institutions that did not exempt customers that were eligible for the Phase I 

exemption cited difficulty determining eligibility as a reason for not using 

the Phase I exemption. More specifically, survey respondents and officials 

we interviewed noted that verifying the publicly traded status of customers 

could be difficult (see fig. 13). Typically, to verify this information, staff of 

depository institutions would need to check the listing information from 

three exchanges as well as use a search engine called EDGAR on the 

Securities and Exchange Commission Web site to search for public filings 

that the company made.1

 On average, officials of institutions we surveyed 

said conducting this research took about 1 hour per exemption. However, 

verification of listing status and ownership represents only a portion of the 

effort involved in ascertaining eligibility for an exemption. Many officials 

we interviewed said that staff in the compliance office made the exemption 

determinations after reviewing a customer’s account history. For instance, 

a respondent from a very large bank explained that it was the institution’s 

policy to conduct background checks on the principals of the business 

being considered for exemption. Another respondent noted that the 

compliance officer would send a questionnaire to the manager of the 

branch where the customer held the account; the manager then had to 

complete the questionnaire and provide supporting documents, including 

the financial statement for the business of the customer being considered 

for exemption. In addition, respondents from one very large bank noted 

that its board had to approve exemption decisions, increasing the time and 

effort involved.

As shown in Figure 14, difficulty in determining whether companies 

derived more than 50 percent of their gross revenue from ineligible 

business activities was the primary factor affecting Phase II exemption 

decisions. 

1

The Phase I eligibility for publicly traded companies generally applies to any entity (other 

than a bank) whose common stock is listed on the New York, American, or NASDAQ stock 

exchanges or any subsidiary of any “listed entity” that is organized under U.S. law and at 

least 51 percent of whose common stock is owned by a listed entity. The Securities and 

Exchange Commission’s Web site makes available to the public the Electronic Data 

Gathering Analysis and Retrieval (EDGAR) system database, which includes disclosure 

documents that public companies are required to file with the commission. EDGAR 

electronically receives, processes, and disseminates more than 500,000 financial statements 

every year.
Appendix IV

Additional Information on Depository 

Institutions’ Use of Exemptions

Page 93 GAO-08-355 Bank Secrecy Act

Figure 14: Factors That Institutions Considered to Be of Very Great or Great Importance When Deciding Not to Exempt a Phase 

II-Eligible Customer 

Note: The 95 percent confidence intervals for these estimates are within +/- 12 percentage points 

except for the “other factors,” which is within +/- 24percentage points of the estimate. 

Percentage

Source: GAO.

0 10 20 30 40 50 60 70 80

Lack of clear understanding of the

exemption process

Other factors

Biennial recertification is time consuming

Difficulty determining exemption eligibility

It is easier to file CTRs than to go

through the exemption process

Annual reviews are time consuming

Concerns that examiners will find that the

exemption was not done correctly

Difficulty determining whether companies

derive more than 50 percent of their

gross revenue from ineligible business

activities
Appendix IV

Additional Information on Depository 

Institutions’ Use of Exemptions

Page 94 GAO-08-355 Bank Secrecy Act

Table 14 provides data on FinCEN’s CTR-related (excluding exemptions) 

and exemption-related enforcement actions over the period 1997 to 2006. 

The data show that relatively few enforcement actions involved fines 

against the institutions. 

Table 14: FinCEN’s CTR and Exemption-Related Enforcement Actions on Depository Institutions, 1997-2006

Source: GAO analysis of FinCEN data.

Note: The actions without fines represent letters that FinCEN’s Office of Compliance or Office of 

Enforcement sent to depository institutions. These actions also were independent actions by FinCEN 

(that is, not imposed jointly with other regulators). Of the actions with fines, one action in 2003 was 

imposed jointly with the Federal Reserve, and the sole action in 2004 was accompanied by a joint and 

concurrent penalty that OCC assessed.

Year

Number of BSA 

actions

Number of CTRrelated actions 

without fines

Number of CTRrelated actions with 

fines

Number of 

exemption-related 

actions without 

fines

Number of 

exemption-related 

actions with fines

1997 2 0 0 1 1

1998 7 2 0 5 0

1999 13 6 0 7 0

2000 30 17 0 11 2

2001 22 8 0 14 0

2002 47 24 1 22 0

2003 15 8 2 5 0

2004 17 9 1 7 0

2005 58 36 1 21 0

2006 38 24 0 13 1
Page 95 GAO-08-355 Bank Secrecy Act

Appendix V

Comments from the Financial Crimes 

Enforcement Network Appendix V
Page 96 GAO-08-355 Bank Secrecy Act

Appendix VI

Comments from Federal Banking Regulators Appendix VI
Appendix VI

Comments from Federal Banking Regulators

Page 97 GAO-08-355 Bank Secrecy Act
Page 98 GAO-08-355 Bank Secrecy Act

Appendix VII

GAO Contact and Staff Acknowledgments Appendix VI

GAO Contact David G. Wood, (202) 512-6878 or woodd@gao.gov

Staff 

Acknowledgments 

In addition to the contact named above, Barbara I. Keller (Assistant 

Director), Sonja Bensen, John W. Mingus Jr., Eric E. Petersen, Carl 

Ramirez, Linda S. Rego, Barbara M. Roesmann, Rachel E. Siegel, and 

Monica L. Wolford made key contributions to this report.
Page 99 GAO-08-355 Bank Secrecy Act

Related GAO Products

Bank Secrecy Act: FinCEN and IRS Need to Improve and Better 

Coordinate Compliance and Data Management Efforts. GAO-07-212. 

December 15, 2006.

Bank Secrecy Act: Opportunities Exist for FinCEN and the Banking 

Regulators to Further Strengthen the Framework for Consistent BSA 

Oversight. GAO-06-386. Washington, D.C.: April 28, 2006.

Terrorist Financing: Better Strategic Planning Needed to Coordinate U.S. 

Efforts to Deliver Counter-Terrorism Financing Training and Technical 

Assistance Abroad. GAO-06-19. Washington, D.C.: October 24, 2005.

USA PATRIOT Act: Additional Guidance Could Improve Implementation 

of Regulations Related to Customer Identification and Information 

Sharing Procedures. GAO-05-412. Washington, D.C.: May 6, 2005.

Information Security: IRS Needs to Remedy Serious Weaknesses over 

Taxpayer and Bank Secrecy Act Data. GAO-05-482. Washington, D.C.: April 

15, 2005.

Anti-Money Laundering: Issues Concerning Depository Institution 

Regulatory Oversight. GAO-04-833T. Washington, D.C.: June 3, 2004.

Combating Terrorism: Federal Agencies Face Continuing Challenges in 

Addressing Terrorist Financing and Money Laundering. GAO-04-501T. 

Washington, D.C.: March 4, 2004.

Terrorist Financing: U.S. Agencies Should Systematically Assess 

Terrorists’ Use of Alternative Financing Mechanisms. GAO-04-163. 

Washington, D.C.: November 14, 2003.

Combating Money Laundering: Opportunities Exist to Improve the 

National Strategy. GAO-03-813. Washington, D.C.: September 26, 2003.

Internet Gambling: An Overview of the Issues. GAO-03-89. Washington, 

D.C.: December 2, 2002.

Money Laundering: Extent of Money Laundering through Credit Cards Is 

Unknown. GAO-02-670. Washington, D.C.: July 22, 2002.

Anti-Money Laundering: Efforts in the Securities Industry. GAO-02-111. 

Washington, D.C.: October 10, 2001.

(250329)
GAO’s Mission The Government Accountability Office, the audit, evaluation, and 

investigative arm of Congress, exists to support Congress in meeting its 

constitutional responsibilities and to help improve the performance and 

accountability of the federal government for the American people. GAO 

examines the use of public funds; evaluates federal programs and policies; 

and provides analyses, recommendations, and other assistance to help 

Congress make informed oversight, policy, and funding decisions. GAO's 

commitment to good government is reflected in its core values of 

accountability, integrity, and reliability.

Obtaining Copies of 

GAO Reports and 

Testimony

The fastest and easiest way to obtain copies of GAO documents at no cost 

is through GAO’s Web site (www.gao.gov). Each weekday, GAO posts 

newly released reports, testimony, and correspondence on its Web site. To 

have GAO e-mail you a list of newly posted products every afternoon, go to 

www.gao.gov and select “E-mail Updates.”

Order by Mail or Phone The first copy of each printed report is free. Additional copies are $2 each. 

A check or money order should be made out to the Superintendent of 

Documents. GAO also accepts VISA and Mastercard. Orders for 100 or 

more copies mailed to a single address are discounted 25 percent. Orders 

should be sent to:

U.S. Government Accountability Office

441 G Street NW, Room LM

Washington, D.C. 20548

To order by Phone: Voice: (202) 512-6000 

TDD: (202) 512-2537 

Fax: (202) 512-6061

To Report Fraud, 

Waste, and Abuse in 

Federal Programs

Contact:

Web site: www.gao.gov/fraudnet/fraudnet.htm

E-mail: fraudnet@gao.gov

Automated answering system: (800) 424-5454 or (202) 512-7470

Congressional 

Relations

Ralph Dawn, Managing Director, dawnr@gao.gov, (202) 512-4400

U.S. Government Accountability Office, 441 G Street NW, Room 7125 

Washington, D.C. 20548

Public Affairs Chuck Young, Managing Director, youngc1@gao.gov, (202) 512-4800

U.S. Government Accountability Office, 441 G Street NW, Room 7149

Washington, D.C. 20548