Farm Credit Administration

Office of Inspector General

Audit Report 

Farm Credit Administration’s 

Criminal Referral Process

A-19-03

March 12, 2020
1501 Farm Credit Drive, McLean, VA 22102 703-883-4030 www.fca.gov/about/inspector-general

March 12, 2020

The Honorable Glen R. Smith, Board Chairman 

The Honorable Jeffery S. Hall, Board Member

Farm Credit Administration

1501 Farm Credit Drive

McLean, Virginia 22102-5090

Dear Chairman Smith and Board Member Hall:

The Office of Inspector General (OIG) completed an audit of the criminal referral process at the Farm 

Credit Administration (FCA or Agency). The objective of this audit was to determine whether FCA’s

criminal referral and follow-up process is effective and efficient. To ensure public confidence in the Farm 

Credit System and to ensure safety and soundness, FCA requires all institutions to report known or 

suspected criminal activity. The referral requirement applies to known or suspected criminal violations 

of the United States Code involving assets, operations, or affairs of an institution.

The OIG found that FCA has established regulations on criminal referral requirements and has processes 

in place to enable examination staff to access criminal referral information that could assist in safety 

and soundness reviews. We also found that various offices work together to collect, store, and review 

criminal referrals and communicate issues and concerns. 

However, we identified opportunities to improve the overall effectiveness and efficiency of collecting, 

storing, and analyzing criminal referrals. We made seven recommendations to strengthen the overall 

criminal referral process. These improvements should help protect information in FCA systems, formally 

document procedures, and further the Agency’s analytic capabilities of criminal referrals. 

It is also important to note that FCA personnel are developing clarification guidance for the criminal 

referral regulations. The draft guidance is formatted as a frequently asked questions document 

that aims to clarify the process and expectations for criminal referrals. Although we did not 

make a recommendation specific to finalizing the guidance, we believe this is an important area 

that will also enhance the overall criminal referral process once issued to the Farm Credit System. 

We appreciate the courtesies and professionalism extended by FCA to our staff during the audit. If you

have any questions about this audit, we would be pleased to meet with you at your convenience. 

Respectfully,

Sonya K. Cerne 

Assistant Inspector General for Audits, Inspections, and Evaluations
EXECUTIVE SUMMARY

Criminal Referral Process

Report No. A-19-03 March 12, 2020

Objective

The objective of this audit was to determine 

whether the Farm Credit Administration’s (FCA) 

criminal referral and follow-up process is effective 

and efficient.

Recommendations

Based on our review, we made seven

recommendations to improve the criminal referral 

process. We recommend: 

1. The Office of General Counsel update internal 

policies and procedures on the handling and 

processing of criminal referral forms received 

from the Farm Credit System.

2. The Office of General Counsel, in conjunction 

with the Office of Information Technology,

complete a Privacy Impact Assessment and 

update the System of Records Notice for 

criminal referrals.

3. The Office of Examination document the Risk 

Supervision Division’s responsibilities for 

reviewing and initiating actions on criminal 

referrals and other types of reviews 

performed on criminal referral forms.

4. The Office of Information Technology, in 

conjunction with other Agency offices, reduce 

storage and visibility of Personally Identifiable 

Information in criminal referrals.

5. The Office of Examination, in conjunction with 

other applicable offices, analyze whether 

additional resources are needed to educate 

System institutions on criminal activity in the 

System, trends, and other valuable 

information. 

6. The Office of Information Technology add 

fields to the internal criminal referral listing for 

amount of potential loss to the institutions 

and whether an insider was involved to 

increase efficiency in analyzing data. 

7. The Office of Examination, in conjunction with 

the Office of Data Analytics and Economics 

and other applicable offices, develop criminal 

referral statistics. 

The Farm Credit Administration (FCA or Agency) is an 

independent federal agency responsible for regulating, 

examining, and supervising the Farm Credit System (System) and 

the Federal Agricultural Mortgage Corporation. The Agency’s 

mission is to ensure that System institutions are safe, sound, and 

dependable sources of credit and related services for all 

creditworthy and eligible persons in agriculture and rural 

America. To ensure public confidence in the System and to 

ensure safety and soundness, FCA requires all institutions to 

report known or suspected criminal activity. The referral 

requirement applies to known or suspected criminal violations of 

the Unites States Code involving assets, operations, or affairs of 

an institution. 

For this audit, we reviewed how the Agency is handling the 

criminal referrals. We found the Agency established regulations 

on the criminal referral requirements and designed processes to 

enable examination staff to access criminal referral information 

that could assist in safety and soundness reviews. FCA staff 

communicate issues and concerns amongst various offices. FCA 

designed and implemented certain controls over the collection 

and storage of criminal referrals, and documentation showed 

that FCA evaluated criminal referral information. FCA is also 

working on clarification guidance for the criminal referral 

regulations. The draft guidance is formatted as a frequently 

asked questions document clarifying FCA’s process and 

expectations for criminal referrals.

While the Agency has implemented a process, there are 

opportunities to improve the overall effectiveness and efficiency 

of collecting, storing, and analyzing criminal referrals. These 

improvements could help protect information in FCA systems, 

formally document procedures, and further the Agency’s analytic 

capabilities of criminal referrals. 

Because of FCA’s role as a regulator, it is important that strong 

practices are initiated to protect data and educate and aid

institutions in responding to criminal activity that jeopardizes the 

safety and soundness of the System. 
TABLE OF CONTENTS

Acronyms ....................................................................................................................................... 1

Background.................................................................................................................................... 1

Prior Reviews ................................................................................................................................................................ 3

Audit Results.................................................................................................................................. 3

Criminal Referral Handling and Storage............................................................................................................ 3

Criminal Referral Form Handling...................................................................................................................... 4

Criminal Referral Form Storage ........................................................................................................................ 5

Privacy Notices........................................................................................................................................................ 6

Recommendations 1-4 ............................................................................................................................................. 7

Criminal Referral Analysis........................................................................................................................................ 7

Increased Number of Criminal Referrals ....................................................................................................... 8

Criminal Referral Filings....................................................................................................................................... 9

Limited Analytical Procedures and Education.......................................................................................... 13

Recommendations 5-7 .......................................................................................................................................... 14

Objective, Scope, and Methodology ......................................................................................... 15
1 

ACRONYMS

Agency or FCA Farm Credit Administration

EDGe Enterprise Documentation and Guidance

Farmer Mac Federal Agricultural Mortgage Corporation

FY Fiscal Year

OE Office of Examination

OGC Office of General Counsel 

OIT Office of Information Technology

OIG Office of Inspector General

PII Personally Identifiable Information 

RSD Risk Supervision Division

SAR Suspicious Activity Report

SORN System of Records Notice

System Farm Credit System

U.S.C. United States Code

BACKGROUND

The Farm Credit Administration (FCA or Agency) is an independent federal agency responsible for 

regulating, examining, and supervising the Farm Credit System (System) and the Federal 

Agricultural Mortgage Corporation (Farmer Mac). The Agency’s mission is to ensure that System 

institutions and Farmer Mac are safe, sound, and dependable sources of credit and related services 

for all creditworthy and eligible persons in agriculture and rural America. The risk of criminal 

activity could present safety and soundness concerns to the System. To ensure public confidence 

in the System and to ensure safety and soundness, FCA requires all institutions to report known 
2 

or suspected criminal activity. The referral requirement applies to known or suspected criminal 

violations of the United States Code involving assets, operations, or affairs of an institution. 

FCA Regulation § 612.2301(a)1 states that each institution and its board of directors shall exercise 

due diligence to ensure the discovery, appropriate investigation, and reporting of criminal activity.

FCA Regulation § 612.2300(d)2

 states that it shall be the responsibility of each institution to 

determine whether there appears to be a reasonable basis to conclude that a criminal violation 

has been committed and, if so, to report the matter to the proper law enforcement authorities for 

consideration of prosecution. When there is known or suspected criminal activity, institutions are 

required to send a Criminal Referral Form to the United States Attorney for the region and 

appropriate law enforcement agencies, and to submit an electronic copy to FCA through the EData Portal on FCA’s website. For the portal, System institutions answer questions online, and 

attach the completed referral form. Internally, the Agency established a listing that pulls 

information from the submissions accessed through the Enterprise Documentation and Guidance

(EDGe) system for examination and legal staff. 

FCA’s criminal referral form is a nine-page document that contains information, such as name and 

location of the institution, asset size, date of suspected violation, amount of potential loss to the 

institution, and details on types of potential criminal violations. The form also asks for other 

details, including information about the suspect, and specific sections depending on the type of 

violations. The criminal referral form is unique to FCA. Most financial institutions are required to

file Suspicious Activity Reports (SARs) through the Financial Crimes Enforcement Network’s filing 

system under Bank Secrecy Act requirements, which do not apply to the System. SARs include

types of suspicious activity affecting institutions such as check fraud, identity theft, mortgage and 

consumer loan fraud, and money laundering. 

There are two main offices within FCA that have criminal referral responsibilities, the Office of 

Examination (OE) and the Office of General Counsel (OGC). In general, OGC has two individuals 

that work with the criminal referrals. One attorney is assigned as the main point of contact for the 

criminal referral forms, adds referrals to the internal site if the form was not processed 

electronically, and, if needed, removes forms from the internal system based on sensitivity. OGC 

has another attorney that works directly with OE’s Risk Supervision Division (RSD) on enforcement 

and supervision activities, which may also involve work with criminal referrals. 

OE personnel are responsible for several aspects of the criminal referral process. OE has a Financial 

Analyst that compiles certain data from criminal referral information. OE also has individuals who, 

in conjunction with the Office of Information Technology (OIT), help maintain the internal site that 

houses the criminal referral forms. There are also individuals from OE’s RSD that review criminal 

referrals for systemic issues or activities that contain overall System safety and soundness 

concerns. There are also specific procedures in the Examination Manual on criminal referrals for 

staff to consider during examinations.

 

1 12 CFR § 612.2301(a) 

2 12 CFR § 612.2300(d)
3 

Prior Reviews

The Office of Inspector General (OIG) has not reviewed the criminal referral process as the main 

objective of a review; however, other reviews have been conducted in related areas. In March

2015, the OIG completed an audit of FCA’s Special Supervision and Enforcement Processes. The 

objective of the audit was to determine whether the FCA was following special supervision and 

enforcement processes and monitoring institution compliance effectively. Our report made three 

recommendations that the Agency agreed to, implemented, and closed by February 2016: 

• Develop a training program for special supervision and enforcement actions to ensure the 

organization has the knowledge to react to the changing FCS environment.

• Emphasize the requirement of FCA Regulation 612, Subpart B, and provide training and/or 

education to examiners on the role and responsibility FCA has regarding the criminal 

referral form and to ensure institutions are filing the form as required.

• Address the use of informal ratings and other supervisory letters by either expanding or 

changing current directives and/or processes to include when they are appropriate and 

how they will be used.

The OIG also reviewed the enforcement program in 2007 and 1998. There were no open 

recommendations relating to these reviews.

AUDIT RESULTS

The objective of this audit was to determine whether FCA’s criminal referral and follow-up process 

is effective and efficient. We found the Agency established regulations on the criminal referral 

requirements and designed processes to enable examination staff to access criminal referral 

information that could assist in safety and soundness reviews. FCA staff communicate issues and 

concerns amongst various offices. FCA designed and implemented certain controls over the 

collection and storage of criminal referrals, and documentation showed that FCA evaluated 

criminal referral information.

While the Agency has implemented a process, there are opportunities to improve the overall 

effectiveness and efficiency of collecting, storing, and analyzing criminal referrals. These 

improvements could help protect information in FCA systems, formally document procedures, and 

further the Agency’s analytic capabilities of criminal referrals.

Criminal Referral Handling and Storage 

FCA needs to improve the internal handling and storage of criminal referrals. System institutions 

must file criminal referrals with law enforcement agencies and FCA when there is known or

suspected criminal activity. However, there is limited documentation on FCA’s handling of the 

information once received.
4 

Criminal Referral Form Handling 

OE and OGC need to clarify the handling of criminal referrals in documented procedures. In 2014, 

FCA moved to an electronic submission process for criminal referrals. As part of this change, FCA 

directed institutions to submit criminal referrals in a web-based portal. Once FCA receives a 

criminal referral form electronically in the portal, the information feeds into a SharePoint listing 

accessed through the EDGe system.3 To see the actual criminal referral form submitted by 

institutions in EDGe, staff must click on the referral in the listing and open each individual form as 

a separate attachment. 

As previously noted, there are two primary FCA offices that work with criminal referrals, OGC and 

OE. OGC is responsible for ensuring criminal referral information is in the internal listing. However, 

OGC internal policies and procedures have not been updated to account for substantial changes 

made to the criminal referral process. For example, the EDGe system and the electronic portal are 

not addressed in the OGC policies. The current policies state that the administrative assistant hand 

delivers criminal referrals to the responsible attorney to maintain confidentiality. The policies then 

state the attorney logs the criminal referral in, maintains the FCA criminal referral forms, reviews 

them for trends, and forwards them to OE and the Inspector General. These policies are currently 

not followed. At this time, the forms are not hand delivered, the criminal referral forms are 

maintained in SharePoint since 2014,

4 and the forms are not forwarded to the Inspector General. 

OGC policies do not address the portal or current processes such as moving certain criminal 

referrals to a more restricted area in EDGe if the form contains certain sensitive information.

In OE, there are several individuals performing certain tasks relating to criminal referrals, but those 

processes are not documented. For example, there are individuals in RSD that review criminal 

referrals for concerns to an individual institution, systemic information that could affect the overall 

safety and soundness of the System, and items that may warrant supervisory or enforcement 

actions. The process was initiated about two years ago, but there are no procedures documenting 

the RSD review or how the process works. OE also has a financial analyst that maintains a log of 

criminal referrals. The analyst reviews certain referral information and creates a log by fiscal year

(FY). This individual stated a quarterly report is given to the Chief Examiner and a limited group of 

OE managers; however, this process is also not documented. It is important for OE to document 

what types of reviews are done relating to the criminal referrals and who is responsible for specific 

tasks. 

OE documents expectations of other examination staff for handling criminal referrals. The 

Examination Manual has specific procedures for staff to consider during reviews of System

 

3 EDGe is an internal system comprised of three web-based applications and SharePoint site, libraries, and 

lists. Examination staff use EDGe to house examination, institution, and System information. 

4 OGC maintains criminal referral forms submitted before the electronic portal in a locked storage area. 
5 

institutions relating to criminal referrals if included in the scope of the review.

5 These procedures 

contain items such as:

• Examiners should always be attentive to any transaction or activity that may represent a 

standards of conduct concern or potential criminal activity. 

• Examiners should ask management about any potential criminal activity that has not been 

reported. 

• Understanding that whether the activity is worthy of prosecution is not a consideration 

when determining the need to file a criminal referral. 

• Examiners should validate management’s responses and follow up, as needed, through 

the transaction testing process. 

• Examiners should consider reviewing criminal referrals the institution has reported to test 

compliance with regulations and the institution’s criminal referral processes. 

Because OE and OGC procedures are not fully documented, the Agency is at risk for duplicative 

efforts. Further, procedures document control systems and define roles for pertinent personnel. 

Procedures need to clarify which offices have specific responsibilities with the criminal referrals

and how the information is analyzed and shared between OE and OGC. 

Criminal Referral Form Storage 

FCA needs to improve the criminal referral storage process to limit access to, and storage of, 

sensitive information. The criminal referral form is a nine-page document that requires System

institutions to fill in details of known or suspected criminal violations. Also included in the form is 

detailed information on suspects such as name, address, date of birth, and Social Security number. 

The page also contains fields for the relationship of the suspect to the institution, insider 

information, and prior referrals. Because these forms contain such sensitive information, FCA has 

a duty to protect the information.

As part of our audit, we tested access to the criminal referral information. FCA has a layer of 

controls to access the Agency network and hardware. Access to the criminal referral forms is 

further limited to certain employees within FCA. We were unable to gain access or export data 

from EDGe when attempted. FCA must grant specific persons or offices access to the criminal 

referral listing and further access to specific, sensitive criminal referrals. When accessing the 

criminal referrals list through EDGe, the following message appears: 

“The link below takes you to a SharePoint list that contains criminal referral records from 

System institutions. These are protected Privacy Act records. You may access this list only if 

you have a "need-to-know." This means you may access these records only when necessary 

 

5 OE utilizes a scoping tool to determine which procedures to conduct as part of each examination. The 

scoping tool allows examination staff to make risk-based decisions on examination scope, depth, timing,

and resources.
6 

to effectively conduct official business of the FCA. Also, this means you may not disclose a 

criminal referral to others unless necessary to conduct official business. This list may be 

monitored to identify the individuals who access the criminal referrals. You can be subject to 

a misdemeanor criminal charge and a fine of up to $5000 for a violation of the Privacy Act.”

All staff assigned to OE, which accounts for about half of the Agency, have access to all criminal 

referral information. The criminal referral list contains each form filed with FCA since October 2014.

The forms contain personally identifiable information (PII) and investigative information including 

Social Security numbers, suspect information, and detailed account information. However, the 

majority of OE staff do not need PII items, such as Social Security numbers, to complete 

examination work. 

The Examination Manual includes procedures for staff to understand if criminal referrals have been 

filed for institutions under their responsibility. Staff need certain information, such as the type of 

violation and amount of potential loss, but do not need Social Security numbers for suspects.

There are certain groups within FCA, such as RSD or OGC personnel that may need detailed 

information to assist with legal actions. Certain OE senior management may also need full access 

for systemic criminal activity information. However, blanket access for all examination staff that 

includes unredacted information is not necessary. In general, examination staff are assigned 

certain institutions for reviews. OE staff do not need full access to all other institution’s criminal 

referral forms that are not related to current examination work.

Privacy Notices

FCA does not have an updated System of Records Notice (SORN) or Privacy Impact Assessment 

relating to criminal referrals. Despite having a large amount of PII, FCA does not have a 

documented Privacy Impact Assessment relating to this area. A Privacy Impact Assessment is an 

analysis of how PII is collected, used, shared, and maintained. This assessment can be used to 

communicate clearly about how information is handled, including how the Agency addresses

privacy concerns and safeguards information. 

FCA has a SORN relating to System criminal referrals. The current criminal referral SORN states 

that the system may contain items such as correspondence, memoranda, criminal referral reports, 

indictments, and arrest or conviction information. However, the SORN is outdated and does not 

contain information on the current criminal referral process or storage of records. The criminal 

referral SORN has not been updated since initially published in the Federal Register in May 1999, 

despite the changes to the electronic submission, storage of the forms, and accessibility in EDGe. 

The criminal referral listing contains titles in some referrals with names of individuals involved in 

the potential criminal activity. Further, the actual criminal referral form collected and stored by 

FCA contains specific suspect information, as noted in our previous section, that includes specific 

fillable categories such as name, address, and Social Security number. FCA needs to update its 

privacy information relating to the collection and storage of these criminal referrals. Because of 

FCA’s role as a regulator, it is important that strong practices are initiated internally to protect 

data and disclose uses of information in a prudent and proper fashion. 
7 

Recommendations 1-4 

To strengthen the criminal referral process, we recommend: 

1. The Office of General Counsel update internal policies and procedures on the handling 

and processing of criminal referral forms received from the Farm Credit System. 

2. The Office of General Counsel, in conjunction with the Office of Information Technology,

complete a Privacy Impact Assessment and update the System of Records Notice for 

criminal referrals.

3. The Office of Examination document the Risk Supervision Division’s responsibilities for 

reviewing and initiating actions on criminal referrals and other types of reviews performed 

on criminal referral forms.

4. The Office of Information Technology, in conjunction with other Agency offices, reduce 

storage and visibility of Personally Identifiable Information in criminal referrals. 

FCA Response

The Agency agreed with the recommendations. OGC stated updated policies and procedures have 

been drafted and will be provided to the OIG by March 31, 2020. OGC will also work with the 

Privacy Officer in OIT to complete a Privacy Impact Assessment and update the criminal referral 

SORN by July 30, 2020. OE stated RSD is reviewing and updating its processes for criminal referral 

reviews and will coordinate with OE’s Examination Policy Division to assess the other review 

processes and determine if changes or additional guidance are needed. OE will provide the 

updated procedures by April 30, 2020, and the assessment by June 30, 2020.

In response to the audit, OIT has a project underway to minimize the storage and visibility of PII 

in criminal referrals. The project includes revising the criminal referral form and developing a new 

interface to show the minimum amount of information that OE and OGC require. For existing 

criminal referrals stored by the Agency, OIT will establish procedures for storing and retrieving 

copies of the original forms and limit access to the original forms.

OIG Response

The OIG finds the planned actions responsive to our recommendations. 

Criminal Referral Analysis

We found that, in general, FCA had processes in place to address criminal referrals from the 

System. FCA collects and stores criminal referrals in a way that examination and legal staff can 

refer to information if needed. OE has a process in place for RSD staff to review referrals for 

systemic issues. The criminal referral listing contains useful information but allows for limited 

analytical procedures. 
8 

We identified opportunities to potentially improve criminal referral processes. Further analytical 

capabilities should be developed and additional education on criminal referrals may be needed 

internally and to the System. 

Increased Number of Criminal Referrals

FCA needs to evaluate whether additional resources are needed to educate System institutions 

on criminal referrals. The number of criminal referrals filed with FCA has dramatically increased

since the listing was created in late 2014. FCA began collecting criminal referrals through an 

electronic portal in 2014 that feeds information into a SharePoint listing. We analyzed the listing 

to understand the number of referrals received from the System. Overall, the listing contained 798

criminal referrals from October 2014 through September 2019.

6

 

Based on the data in the listing, criminal referrals are increasing each year.

7 For FY 2015, there 

were 52 referrals filed. In FY 2016, the number of criminal referrals filed increased by about 36 

percent to 71 criminal referrals for the year. By the end of FY 2019, the number increased to 300, 

averaging about 25 criminal referrals per month. The following chart shows the data from FY 2015 

through FY 2019.

 

6 This number includes all criminal referrals in the listing as well as follow-up filings from institutions on the 

same criminal referral. A follow-up referral may be filed with new information relating to the potential crime. 

It can update the potential loss amount or provide other types of investigative information. For this review, 

follow-up referrals are counted as separate filings. However, if the criminal referral contained specific 

potential loss information, we did not count the potential losses to the institutions again unless it was clear 

the amount on the follow-up was in addition to the original filing amount. 

7 An increase in criminal referral filings may indicate increased education and regulatory knowledge, 

potential differences in interpretations of the filing requirements, or other items. Therefore, one cannot 

conclude that the increase in filings directly correlates, independently, to increased criminal activity in the 

System. OE officials stated that specific changes were implemented through examination work to increase 

reporting related to certain transactions associated with 
9 

Number of Criminal Referrals Filed by Fiscal Year from 

FY 2015-FY 2019 

52

71

157

218

300

0

50

100

150

200

250

300

350

FY 2015 FY 2016 FY 2017 FY 2018 FY 2019

Criminal Referral Filings

For this audit, we performed further analysis on details in the criminal referral forms in our sample. 

We analyzed criminal referrals from October 1, 2016 through June 30, 20198 with information 

available in the criminal referral listing, which totaled 615 filings, and information from the actual

criminal referral forms. We reviewed criminal referral forms to obtain information on potential 

losses to the institutions and whether the potential criminal activities were committed by an 

insider to the institutions. We used this data, along with additional information in FCA’s SharePoint 

listing, to perform analyses on the number of institutions filing referrals, types of potential criminal 

violations, potential losses to the institutions, and insider cases. 

Over the 33-month period reviewed, 60 different institutions filed criminal referrals. Of those 60 

institutions, many filed only one referral. In fact, 16 of the 60 institutions, or about 27 percent of 

those institutions that filed, made one referral during the period we reviewed. Additionally, 51 of 

the 60 institutions that filed had less than 10 criminal referrals. 

 

8 We analyzed information from FCA’s SharePoint listing. Any criminal referrals filed outside of the portal 

and not manually entered by OGC would not be included in this analysis. Further, as noted in previous 

sections, the listing may contain multiple filings for a criminal activity. Institutions may file follow-up referrals 

if more information is gathered, new investigative action is taken, or other situations occur that involve the 

potential crimes. 
10

Most of the criminal referrals in the listing came from less than ten institutions. The following nine

System institutions, which had ten or more criminal referrals, accounted for 449 of the 615 referrals 

(about 73 percent). alone accounted for 244 of the 615 referrals (about 40 percent).

9

Institution

Number of Criminal 

Referrals filed from

October 1, 2016 through

June 30, 2019

10

11

12

14

20

21

54

63

244

We also analyzed the potential losses to the institutions due to the potential criminal violations. 

Each institution completes a section on the criminal form showing an amount of potential loss to 

the institution.

10 In total, the potential losses for the 615 sampled filings came to $105,624,404. 

Of the 615 filings sampled, 249 filings contained potential losses that exceeded $1,000. Of the 

over $105 million in potential losses stated on the forms, $35,807,986 contained detailed

annotations that the potential loss may not be realized, had been returned, had been reversed, or 

the loss may not be attributed to the institution but to others, such as borrowers.11

FCA’s criminal referral forms list several types of criminal activity and ask institutions to check one 

of the five categories listed. The following shows the options on the form and provides a brief 

description of each type of potential criminal violation: 

 

9 A high number of referrals disproportionate to other institutions may indicate differences in size, mission 

and products at institutions, differing interpretations of the criminal referral regulations and guidance, or 

other reasons.

10 Institutions are required to file a criminal referral form within 30 days of determining that a known or 

suspected criminal violation has occurred. Because the investigation of the potential criminal violation may 

be in the beginning phase, the loss amount may not be the final loss amount incurred by the institution. 

FCA does not have a criminal referral reporting mechanism for actual losses incurred.

11 The $35.8 million figure was not calculated based on a specific question in the criminal referral form. 

When we reviewed the criminal referrals, we noted instances where the criminal referral detail stated that 

the actual loss may not be attributed to the institution or realized.
11

• Conversion (18 U.S.C. § 658)-Criminalizes the fraudulent taking of property mortgaged or 

pledged to, or held by, a System institution.

• False Statement (18 U.S.C. § 1014)-Criminalizes the making of false statements and the 

overvaluing of property and securities to influence an action of FCA or System institution.

• False Entry (18 U.S.C. § 1006)-Prohibits officers, employees, and other individuals 

connected to a System institution from making a false entry in a book, report, or statement 

in order to defraud the institution or a federal agency. Section 1006 also criminalizes the 

unauthorized issuance of obligations and prohibits fraudulent participation in a 

transaction or loan.

• Misappropriation (18 U.S.C. § 657)-Prohibits officers, employees, and other individuals 

connected to a System institution from embezzling or otherwise appropriating funds, 

securities, and other things of value belonging to the institution or entrusted to the 

institution’s care.

• Other-This category allows the System institution to fill in the specific type of potential 

criminal violation.

We analyzed the type of potential criminal violation selected by the institutions on the criminal 

referral forms. Of the 615 filings in our sample, there were 161 that selected the conversion

category as the type of potential criminal violation, 52 with false statements, 13 with 

misappropriation, 4 with false entry, and 385 in the “other” category.

12 

 

12 The form leaves the “other” category blank for the System institution to fill in the violation type but has 

a footnote that cites to the other types of criminal violations under title 18 of the United States Code. In 

FCA’s listing, standard of conduct violations were annotated in four cases. For our analysis, those four were 

included in the “other” category.
12

161

4

52

13

385

Potential Criminal Violations by Type 

Conversion False Entry, etc.

False Statement Misappropriation, etc.

Other

We also analyzed the amount of potential losses reported by institutions by potential criminal 

violation type, which is shown in the table below. False statement filings had the most potential

losses reported with $46,150,044. Next, conversion accounted for $33,410,346 of the potential 

losses with $8,288,516 in the misappropriation category and $325,000 as false entry. The “other” 

category accounted for $17,450,499 of the potential losses. 

Criminal Violation Type Amount of Potential

Losses Reported 

Conversion $33,410,346

False Entry, etc. $325,000

False Statement $46,150,044

Misappropriation, etc. $8,288,516

Other $17,450,499

Grand Total $105,624,405 

An important area for FCA is whether potential suspects in the criminal referrals were insiders. 

Insider cases are especially harmful to the integrity and reputation of System institutions. Each 
13

referral contains a section on persons suspected of criminal violations. The detail in that section 

asks institutions to check whether the suspect is an officer, employee, director, agent, borrower, 

appraiser, other, or unknown. If the suspect is an insider, the form asks for further information: 

• whether the person is currently affiliated with the institution,

• if the person was terminated or resigned, and

• a description category for circumstances of separation. 

In total, there were 615 criminal referrals in our sample with 16 referrals annotated as potential 

insider cases. Of the 16 insider cases, we sampled the insider cases with potential losses annotated 

as more than $5,000, which resulted in five cases. We sampled the files to determine if FCA acted

on these types of cases because the integrity of the institution could be compromised. In all five 

cases, the EDGe files or RSD files contained information showing actions were taken in response 

to the filings by FCA examination staff, RSD staff, or both. 

Limited Analytical Procedures and Education 

Our sample of the filings showed the increase of criminal referrals and the potential impact to the 

institutions. Overall, criminal violations impact the safety and soundness of the System. However, 

there are limited analytics performed in this area. We identified a log of criminal referrals 

completed by an analyst with quarterly reports from the log showing limited information. There 

was also a set of analytics performed from listing data in April 2019 in response to an Agency 

project to issue guidance and a limited analysis on the number of filings from 2009 through 2014. 

Analytical data could provide OE with indications of specific criminal activity affecting the System, 

as well as other information. RSD, OGC, and other Agency personnel could utilize the information 

to conduct analyses more efficiently. For example, analytics could provide additional trends in 

filings with violation types and potential losses that could help other institutions. Further, analyzed 

data can aid examination staff on efficiently understanding which institutions have not filed any 

criminal referrals, which may indicate the institutions are either not following regulations or not 

understanding how to recognize potential criminal activity. 

Although FCA’s current listing in EDGe contains valuable information, the listing could be 

improved. By adding fields such as potential monetary loss amounts and insider information, FCA 

staff could more easily and efficiently run statistical reports on criminal referral information. This 

would allow pertinent staff to run analyses without needing to open actual criminal referral forms, 

which contain pages of information with details not needed to run most analytics. 

In addition, the Agency has issued limited formal guidance to the System on criminal referrals. 

Over the last five years, FCA has worked on clarification guidance for the criminal referral 

regulations. The draft guidance is formatted as a frequently asked questions document clarifying 

FCA’s process and expectations regarding criminal referrals. However, the document remains in 

draft and has not yet been approved for release. In addition to completing the guidance, FCA 

should explore whether additional education of System institutions on criminal activity is needed. 
14

For example, although System institutions are not required by FCA to file SARs, the information 

from SAR statistics is valuable. The Financial Crimes Enforcement Network has an interactive 

dashboard of statistics generated solely from the data submitted in certain filings. FCA could post 

similar statistics on criminal referral data received from System institutions. This could assist 

institutions in educating staff, looking for trends, and adapting control systems if needed.

Recommendations 5-7 

To strengthen the criminal referral process, we recommend:

5. The Office of Examination, in conjunction with other applicable offices, analyze whether 

additional resources are needed to educate System institutions on criminal activity in the 

System, trends, and other valuable information. 

6. The Office of Information Technology add fields to the internal criminal referral listing for 

amount of potential loss to the institutions and whether an insider was involved to increase 

efficiency in analyzing data. 

7. The Office of Examination, in conjunction with the Office of Data Analytics and Economics 

and other applicable offices, develop criminal referral statistics. 

FCA Response

The Agency agreed to the recommendations. OE stated it would complete the analysis of whether 

additional resources are needed to educate the System on criminal referral activity and trends and 

plans to provide the analysis to the OIG by December 31, 2020. OE stated it will participate with 

other FCA offices in completing the recommended analysis, and that activity notwithstanding, it 

believes that the Criminal Referral Instructions, FCA Examination Manual, and the proposed FCA 

Bookletter provide necessary instructions for the System. OE also noted that its conversations 

educate System employees as examination work at institutions is conducted. 

In response to the audit, OIT has a project underway to minimize storage and visibility of PII in 

criminal referrals and will add potential loss and insider information fields to the project. OE will 

also coordinate with the Office of Data Analytics and Economics to evaluate and identify ways to 

enhance the capture of criminal referral data and presentation of related statistics. The 

enhancement is planned for completion by December 31, 2020.

OIG Response

The OIG finds the planned actions responsive to our recommendations.

The Agency did not provide any further comments and waived an exit conference.
15

OBJECTIVE, SCOPE, AND METHODOLOGY

The objective of this audit was to determine whether FCA’s criminal referral and follow-up process 

is effective and efficient. We performed this audit at FCA’s headquarters in McLean, Virginia, 

from June 2019 through March 2020. 

The scope of our audit was limited to the criminal referrals in the internal listings. 

We performed the following steps to accomplish the audit objective: 

• Identified and reviewed laws and regulations related to the audit objective;

• Identified and reviewed related policies, procedures, directives, and guidance;

• Reviewed and tested access controls for criminal referral forms;

• Sampled criminal referrals in the listing from October 1, 2014 through September 30, 2019

and analyzed the number of filings made each year by institutions. This sample was

judgmental and cannot be projected to the population;

• Sampled criminal referral filings in the listing from October 1, 2016 through June 30, 2019

for loss and insider data. We selected the sample based on the previous two fiscal years

through the beginning of our audit. We calculated potential loss data attributed to other

areas from criminal referral form data. The figure was not calculated based on a specific

question in the criminal referral form. When we reviewed the criminal referrals, we noted

instances where the detail stated the potential loss may not be realized, had been returned,

had been reversed, or that the loss may be not be attributed to the institution but to

others, such as borrowers. We totaled the amount associated with that information in the

report. This sample and calculation were judgmental and cannot be projected to the

population;

• Reviewed supporting documentation in EDGe; and

• Interviewed selected OGC, OE, and OIT personnel.

We conducted this audit in accordance with Generally Accepted Government Auditing Standards. 

Those standards require that we plan and perform the audit to obtain sufficient, appropriate 

evidence to provide a reasonable basis for our findings and conclusions based on our audit 

objective. We assessed internal controls and compliance with laws and regulations to the extent 

necessary to satisfy the objective. Because our review was limited, it would not necessarily have 

disclosed all internal control deficiencies that may have existed at the time of our audit. We also 

assessed the computer-processed data relevant to our audit objective and determined that the 

data was sufficiently reliable. We assessed the risk of fraud related to our audit objective while 

evaluating audit evidence. Overall, we believe that the evidence obtained provides a reasonable 

basis for our findings and conclusions based on our audit objective. 
REPORT FRAUD, WASTE, ABUSE, & 

MISMANAGEMENT: 

Phone: (800) 437-7322 (Toll-Free)

(703) 883-4316

Fax: (703) 883-4059

Email: fca-ig-hotline@rcn.com

Mail: 1501 Farm Credit Drive

McLean, VA 22102-5090

To learn more about reporting wrongdoing to the OIG, please visit our 

website at https://www.fca.gov/about/inspector-general.