Bank Secrecy Act: Federal Agencies Should Take Action to Further Improve Coordination and Information-Sharing Efforts
Published: 2009-02-12T00:00:00

Fast Facts:

Highlights:
section_title: Why GAO Did This Study
paragraphs: The legislative framework for combating money laundering began with the Bank Secrecy Act (BSA) in 1970 and most recently expanded in 2001with the USA PATRIOT Act. The Financial Crimes Enforcement Network (FinCEN) administers BSA and relies on multiple federal and state agencies to ensure financial institution compliance. GAO was asked to (1) describe how BSA compliance and enforcement responsibilities are distributed, (2) describe how agencies other than FinCEN are implementing those responsibilities and evaluate their coordination efforts, and (3) evaluate how FinCEN is implementing its BSA responsibilities. Among other things, GAO reviewed legislation, past GAO and Treasury reports, and agreements and guidance from all relevant agencies; and interviewed agency, association, and financial institution officials.
section_title: What GAO Found
paragraphs: FinCEN is responsible for the administration of the BSA regulatory structure, and has delegated examination responsibility to the federal banking regulators (Board of Governors of the Federal Reserve System, Federal Deposit Insurance Corporation, Office of the Comptroller of the Currency, Office of Thrift Supervision, and National Credit Union Administration), the Securities and Exchange Commission (SEC), the Commodity Futures Trading Commission (CFTC), and the Internal Revenue Service (IRS). The federal banking regulators, SEC, CFTC, securities and futures self-regulatory organizations (SRO), and state agencies also have their own separate authorities to examine for compliance among institutions they supervise and take enforcement actions for noncompliance. FinCEN has retained enforcement authority for BSA and may take enforcement actions independently or concurrently with the regulators. While federal agencies have enhanced their BSA compliance programs, opportunities exist to improve interagency and state examination coordination. The federal banking regulators issued an interagency examination manual; SEC, CFTC, and their respective SROs developed BSA examination modules; and FinCEN and IRS, which examines nonbank financial institutions (NBFI), issued an examination manual for money services businesses (MSB). However, IRS has not fully coordinated MSB examination schedules with the states that also examine MSBs, potentially missing opportunities to reduce duplication and leverage resources. The federal financial regulators traditionally have different compliance approaches for their industries. With respect to BSA, multiple regulators are examining for compliance with the same legislation across industries and, for some larger holding companies, within the same institution. However, they do not have a mechanism through which all regulators discuss (without industry present) how to promote greater consistency, reduce unnecessary regulatory burden, and identify concerns across industries. Federal banking regulators reported improved transparency and coordination of enforcement actions. While FinCEN has increased regulatory resources, provided examination support, and made advances in outreach, it could improve its informationsharing efforts. FinCEN improved its system for tracking referrals but lack of a process for communication between IRS and FinCEN for IRS referrals, coupled with IRS's limited enforcement authority, may delay timely feedback to IRS-examined institutions. FinCEN completed more information-sharing memorandums of understanding (MOU) with federal and state agencies, but did not sign its MOU with CFTC until January 2009, which limited their information-sharing efforts. Some state regulators and securities and futures regulators continue to have no electronic access to BSA data. Lack of direct access to BSA data impedes their ability to identify potential risk areas on which to focus their examinations and effectively leverage resources. FinCEN officials said they finalized a data-access template in July 2008, and had begun providing more electronic access.

section_title: Letter
paragraphs: The legislative framework for combating money laundering and other  financial crimes has been built over nearly four decades. The Bank  Secrecy Act of 1970 (BSA) established reporting and other anti-money  laundering (AML) requirements for domestic financial institutions. Due to  the increased sophistication of money laundering activities and concerns  about terrorist financing, Congress expanded AML legislation to cover  more types of institutions involved in a broader range of financial  transactions. In 2001, the enactment of the USA PATRIOT Act  strengthened reporting and AML requirements for securities firms, futures  firms, money services businesses (MSB), and other financial institutions.  The regulators discussed in this report have developed programs to review  financial institutions’ compliance with these reporting requirements and  AML requirements.
Multiple federal and state agencies operate within the BSA framework.  The Financial Crimes Enforcement Network (FinCEN), a bureau of the  U.S. Department of the Treasury (Treasury), is the BSA administrator. The  federal financial regulators that compose the BSA compliance framework  are the federal banking regulators—the Board of Governors of the Federal  Reserve System (Federal Reserve), the Federal Deposit Insurance  Corporation (FDIC), the Office of the Comptroller of the Currency (OCC),  the Office of Thrift Supervision (OTS), and the National Credit Union  Administration (NCUA)—as well as the Securities and Exchange  Commission (SEC), and the Commodity Futures Trading Commission  (CFTC). The Internal Revenue Service (IRS) has examination  responsibilities under BSA. To different extents, four of the federal  banking regulators—the Federal Reserve, FDIC, OTS, and NCUA—share  compliance responsibilities, such as examinations of institutions that they  oversee, with state regulators. IRS, which oversees BSA/AML compliance  among some state-chartered institutions, such as MSBs, also shares  responsibilities with state regulators. The self-regulatory organizations  (SRO) that SEC and CFTC oversee also have BSA/AML compliance  responsibilities for the activities of their members. Appendix II of this  report provides an overview of the missions and compliance and  enforcement activities of these entities and provides information on their  BSA/AML-related resources and training.
As we have reported previously, FinCEN and these agencies have  responded to the challenge of increased BSA/AML responsibilities by  finalizing new regulations to implement the USA PATRIOT Act and  applying them to industries newer to BSA/AML efforts. In addition, the  federal banking regulators, FinCEN, and SEC have taken enforcement  actions involving BSA/AML-related violations that resulted in large  penalties. But, as BSA regulation has evolved, so have financial services  firms. They generally have become fewer in number and larger—providing  more and varied services and products across one or more traditional  financial sectors (banking, securities, futures, and insurance). The  proliferation of activities across industry lines also has made it all the  more important that agencies with compliance-monitoring and  enforcement responsibilities coordinate with each other. Given that many  regulators and SROs have responsibility for overseeing compliance with  BSA, Congress has raised questions about how effectively FinCEN and  these entities are coordinating their BSA/AML efforts and the general  soundness of the current BSA compliance and enforcement framework.
In response to your request that we review FinCEN and other federal  agencies’ efforts to implement BSA, we (1) describe how BSA compliance  and enforcement efforts are distributed among federal and state  regulators, SROs, and FinCEN; (2) describe how federal agencies other  than FinCEN are implementing their BSA activities and evaluate their  coordination efforts; and (3) evaluate how FinCEN is executing its BSA  responsibilities and coordinating BSA efforts among the various agencies.
To address our objectives, we reviewed relevant federal legislation and  prior GAO and Treasury Inspector General reports, and conducted  interviews with FinCEN, federal banking regulators, SEC, CFTC, IRS, and  Department of Justice (Justice) officials. We reviewed BSA compliance  and enforcement guidance from all relevant agencies, memorandums of  understanding (MOU), training documentation, staffing and performance  measurement data, strategic plans and annual reports, and internal  documentation. We also reviewed our collaboration best practices—which  encompass a set of key practices that can help agencies enhance and  sustain collaborative efforts. Furthermore, we interviewed officials from  selected state banking agencies (based on factors such as geography and  types of financial activities within their states) and SROs, and officials  from associations representing banking, credit unions, MSBs, securities,  and futures industries, as well as a state regulatory association. We also  interviewed officials from 20 depository institutions, 8 securities firms,  and 2 futures firms. For the depository institutions, we interviewed all 5  institutions that had the largest number of suspicious activity report (SAR)  filings and randomly selected the remaining 15 based on their number of  SAR filings in calendar year 2007. We interviewed the 8 securities firms  through the auspices of an industry trade association and interviewed one  large and one small futures firm drawn from a list provided by a futures  regulator.
We conducted this performance audit in Washington, D.C.; New York, New  York; and Chicago, Illinois; from October 2007 to February 2009 in  accordance with generally accepted government auditing standards. Those  standards require that we plan and perform the audit to obtain sufficient,  appropriate evidence to provide a reasonable basis for our findings and  conclusions based on our audit objectives. We believe that the evidence  obtained provides a reasonable basis for our findings and conclusions  based on our audit objectives. Appendix I explains our scope and  methodology in greater detail.
subsections: section_title: Background
paragraphs: The federal government’s framework for preventing, detecting, and  prosecuting money laundering has expanded over the course of more than  30 years. With the passage of the Bank Secrecy Act in 1970, for the first  time financial institutions were required to maintain records and reports  determined to be useful to financial regulators and law enforcement  agencies in criminal, tax, and regulatory matters. BSA has three main  objectives: create an investigative audit trail through regulatory reporting  standards; impose civil and criminal penalties for noncompliance; and  improve the detection of criminal, tax, and regulatory violations.
The reporting system first implemented under BSA was insufficient to  combat underlying money laundering activity. For example, before 1986,  BSA did not contain sanctions for money laundering, although it did  contain sanctions for failing to file reports or for doing so untruthfully. To  strengthen federal AML initiatives, Congress enacted the Money  Laundering Control Act of 1986. In addition to imposing criminal liability  for money laundering violations, the act directed each federal banking  regulator to require that insured depository institutions establish and  maintain a program that would ensure and monitor compliance with the  recording-keeping and reporting requirements of BSA.
The Annunzio-Wylie Anti-Money Laundering Act of 1992 amended BSA and  authorized Treasury to require financial institutions to report any  suspicious transaction relevant to a possible violation of a law or  regulation. It authorized Treasury to require financial institutions to carry  out AML programs and, together with the Federal Reserve, to promulgate  record-keeping rules relating to funds transfer transactions. The act also  made the operation of an unlicensed, money-transmitting business illegal  under state law a crime.
In 1994, the Secretary of the Treasury delegated overall authority for  enforcement of, and compliance with, BSA and its implementing  regulations to the Director of FinCEN. FinCEN was established within  Treasury in 1990 initially to support law enforcement by providing a  government-wide financial intelligence and analysis network, and became  a bureau in 2001. Among its current responsibilities, FinCEN issues  regulations; collects, analyzes, and maintains BSA-related reports and  information filed by financial institutions; makes those reports available to  law enforcement and regulators; and tries to ensure financial institution  compliance through enforcement actions. According to its strategic plan,  FinCEN seeks to ensure the effectiveness of the BSA regulatory  framework and facilitate interagency collaboration. FinCEN’s RPPD is  responsible for BSA regulatory, compliance, and enforcement functions. In  August 2004, FinCEN created an Office of Compliance in RPPD to oversee  and work with the federal financial regulators on BSA examination and  compliance matters.
The most recent expansion of BSA legislation occurred in October 2001  with enactment of the USA PATRIOT Act. Among other things, the act  required an entity defined in BSA as a “financial institution” to have an  AML program. Each program must incorporate: (1) written AML  compliance internal policies, procedures, and internal controls; (2) an  independent review; (3) a designated compliance person to coordinate and  monitor day-to-day compliance; and (4) training for appropriate personnel.  Entities not previously required under BSA to have such a program, such  as mutual funds, broker-dealers, MSBs, certain futures brokers, and  insurance companies, were required to do so under this act. Moreover,  the act mandated that Treasury issue regulations requiring registered  securities brokers-dealers to file SARs and provided Treasury with  authority to prescribe regulations requiring certain futures firms to submit  SARs. Among its other provisions, the act required that Treasury issue  regulations setting forth minimum standards for financial institutions  regarding verifying the identity of customers who open accounts. The USA  PATRIOT Act also required that financial institutions establish due  diligence and, in some cases, enhanced due diligence policies designed to  detect and report instances of money laundering through private banking  and correspondent accounts of non-United States persons; conduct  enhanced scrutiny of private banking accounts maintained by or on behalf  of foreign political figures or their families; and share information relating  to money laundering and terrorism with law enforcement authorities,  regulatory authorities, and financial institutions. In addition, nonfinancial  institutions also became subject to BSA currency transaction reporting  (CTR) requirements where, in the course of trade or business, the business  receives more than $10,000 in coins or currency in one transaction (or two  or more related transactions).
section_title: FinCEN Administers the BSA Framework, under which Many Regulatory Entities Exercise Delegated and Independent Compliance and Enforcement Authorities
paragraphs: The objectives of U.S. financial services regulation are pursued by a  complex combination of federal and state government agencies and SROs.  Generally, regulators specialize in the oversight of financial institutions in  the various financial services sectors, which stem largely from the laws  that established these agencies and defined their missions. Under the BSA  regulatory scheme, FinCEN is responsible for the overall administration  and enforcement of BSA and may take enforcement actions, but federal  and state regulators and SROs conduct day-to-day compliance and  enforcement activities. Specifically, with respect to examinations for BSA  compliance, FinCEN delegated its BSA examination authority to the  federal banking regulators, SEC, CFTC, and IRS. The federal banking  regulators, SEC, and CFTC also use their independent authorities to  examine entities under their supervision for compliance with applicable  BSA/AML requirements and regulations. FinCEN has retained  enforcement authority and may impose civil penalties for violations. In  addition, each of the federal bank regulators also may impose civil money  penalties for significant BSA violations, and have specific authority to  initiate cease and desist proceedings against the entities they supervise for  BSA/AML violations. SEC, CFTC, and their SROs also have authority to  enforce their rules requiring BSA/AML compliance; and IRS has very  limited enforcement authority delegated by FinCEN. Justice prosecutes  criminal violations of BSA, and several federal law enforcement agencies  can conduct BSA-related criminal investigations.
subsections: section_title: FinCEN Administers the BSA and Has Delegated Examination Authority but Retained Enforcement Authority
paragraphs: As noted previously, in 1994, the Secretary of the Treasury delegated  overall authority for compliance and enforcement of BSA and its  implementing regulations to the Director of FinCEN. Over the years, as  more financial activities and types of institutions became involved in the  BSA, Treasury delegated BSA examination authority to the federal banking  regulators; and to SEC, CFTC, and their SROs. Figure 1 shows the federal  agencies and SROs involved in examining for compliance with BSA.
Table 1 summarizes the types and numbers of institutions the federal  agencies examine for BSA/AML compliance, and which agency or SRO  conducts these examinations.
FinCEN retains BSA enforcement authority and may take enforcement  actions independently of, or concurrently with, other regulators. FinCEN’s  Office of Enforcement conducts independent investigations of BSA  violations mostly based on referrals of BSA noncompliance from financial  regulators. FinCEN has information-sharing MOUs with the federal  banking regulators, SEC, CFTC (as of January 2009), IRS, and some states  under which these agencies provide FinCEN information on significant  BSA violations and deficiencies found during their examinations. Less  frequently, FinCEN conducts investigations based on information from  Justice and from its own in-house referrals identified through analysis of  BSA data. If a FinCEN investigation results in a decision to take an  enforcement action, FinCEN may issue a civil money penalty, depending  on the severity of the violation. FinCEN and the financial regulators also  try to coordinate enforcement actions. (We discuss coordination of  enforcement actions in more detail later in this report.)
section_title: Many Federal and State Agencies, as well as SROs, Have Independent Compliance and Enforcement Authorities That Encompass BSA/AML Requirements
paragraphs: Independent of Treasury-delegated authorities, the federal banking  regulators have general authorities under the federal banking laws to  conduct compliance examinations and take enforcement actions against  institutions for violations of any applicable law, including BSA. The  Federal Deposit Insurance Act specifically provides that the Federal  Reserve, FDIC, OCC, and OTS are to prescribe regulations requiring the  institutions they supervise to maintain procedures for compliance with  BSA requirements and to conduct examinations of those institutions for  compliance with reporting and AML provisions of BSA. The Federal  Credit Union Act contains the same requirement for NCUA. Federal  banking regulators examine whether depository institutions under their  supervision are in compliance with BSA/AML requirements concurrently  with their examinations for the entities’ overall safety and soundness.
Depository institutions can generally determine their regulators by  choosing a particular kind of charter—for example, commercial bank,  thrift, or credit union—which may be obtained at the state level or the  national level. While state regulators charter institutions and participate  in oversight of those institutions, all of these institutions have a primary  federal regulator if they have federal deposit insurance. The Federal  Reserve, FDIC, OTS, and NCUA alternate or conduct joint safety and  soundness examinations—including a BSA/AML component—with state  regulators, generally using the same examination procedures (shown  earlier in table 1). As recently as 2004, about one-third of state banking  departments reported not examining for BSA compliance; however, they  have taken a more active role in conducting these reviews more recently.  FinCEN currently has information-sharing MOUs with 46 state agencies  that conduct AML examinations.
As with examinations, the Federal Reserve, FDIC, OCC, and OTS have  authority under the Federal Deposit Insurance Act to take enforcement  actions against institutions they supervise and related individuals when  they determine that an institution or related individual has violated an  applicable law or regulation. These agencies also have specific authority to  initiate cease-and-desist proceedings for failure to establish and maintain  BSA compliance procedures. NCUA also can take enforcement actions  under its legislative authorities. Furthermore, state agencies have  authority to take enforcement actions against institutions chartered within  their state that are in violation of banking legislation.
SEC and CFTC are regulatory agencies with missions that focus on  protecting investors, preventing fraud and manipulation, and promoting  fair, orderly markets, but the regulatory frameworks for the securities and  futures industries are structured differently than those for depository  institutions. Consistent with this framework, SEC and CFTC regulate their  industries in part through oversight of SROs. SEC and CFTC have  authority under the Securities Exchange Act and the Commodity  Exchange Act, respectively, to inspect the books and records of firms that  they supervise. SEC, CFTC, and their SROs have adopted rules for  compliance with BSA/AML requirements.
More specifically, SEC’s Office of Compliance Inspections and  Examination (OCIE) shares BSA examination responsibilities with  securities SROs, which have statutory responsibilities to regulate their  own members. The Financial Industry Regulatory Authority (FINRA)  provides oversight of the majority of broker-dealers in the securities  industry. Other securities self-regulatory organizations include the  Chicago Board Options Exchange and Philadelphia Stock Exchange.  OCIE and the SROs both conduct BSA/AML examinations for broker- dealers, but only OCIE conducts routine examinations of registered  investment advisors and their affiliated mutual funds for BSA compliance  as they are not members of an SRO.
CFTC officials said that CFTC does not routinely conduct direct  examinations of the firms it supervises; instead, CFTC oversees the  examinations conducted by its SROs—the National Futures Association  (NFA),which conducts most of the audits, the Chicago Mercantile  Exchange, the New York Mercantile Exchange, the Chicago Board of   Trade, and the Kansas City Board of Trade. The SROs monitor for  compliance with BSA/AML and with their own rules, which include  BSA/AML obligations.
SEC and CFTC ultimately are responsible for enforcing compliance with  their rules and regulations and can institute enforcement actions against  firms within their jurisdiction that appear to be in violation of those  agencies’ BSA-related rules. However, because the SROs overseen by SEC  and CFTC have rules requiring compliance with applicable laws and  regulations, they typically have front-line responsibility for instituting BSA- related enforcement actions and generally inform SEC and CFTC of such  actions. The securities and futures SROs have authority to enforce each of  their respective BSA/AML-based rules against their members—generally,  broker-dealers and futures firms. They take their own enforcement actions  against their members which may include suspending, expelling, fining, or  otherwise sanctioning member firms (and their associated persons).
While IRS performs a regulatory function with regard to nonbank financial  institutions (NBFI), IRS generally is not considered a “regulator”; it is a  bureau within Treasury whose mission is to assist taxpayers in  understanding and meeting their tax responsibilities. Unlike the other  federal agencies with regulatory functions, IRS does not have independent  authority to conduct BSA examinations. Rather, under delegation of  examination authority from FinCEN, IRS examines any financial  institution not subject to BSA examination by the federal financial  regulators. Thus, institutions that IRS examines include MSBs; casinos  and card clubs; dealers of precious metals, stones, and jewels; and certain  insurance companies. IRS’s Small Business/Self-Employed Division, which  reports directly to the Deputy Commissioner for Services and  Enforcement, conducts BSA compliance examinations of these types of  NBFIs. In 2004, IRS created the Office of BSA/Fraud within the division to  focus on BSA examinations of NBFIs. As some NBFIs are state-chartered  institutions, such as MSBs, IRS also has information-sharing MOUs with  many state agencies to facilitate cooperation on examinations.
FinCEN did not delegate to IRS authority to enforce BSA requirements,  except for foreign accounts, and IRS does not have independent authority  to enforce BSA requirements. IRS can issue a letter of noncompliance  and make suggestions for corrective action to institutions it examines for  BSA compliance. If significant BSA violations or deficiencies were found  or if an institution refused to take corrective action, IRS would refer the  case to FinCEN to determine what type, if any, of enforcement action  might be appropriate. IRS examiners also may refer cases to their Criminal  Investigation unit, if the examiners believe that a willful criminal violation  may be involved. IRS Criminal Investigation, IRS’s enforcement arm,  investigates individuals and businesses suspected of criminal violations of  the Internal Revenue Code, money laundering and currency crime, and  some BSA requirements. IRS Criminal Investigation investigates BSA  criminal violations in conjunction with other tax violations.
section_title: Justice Prosecutes Criminal BSA Violations, and Multiple Federal Law Enforcement Agencies Can Conduct Criminal Investigations That Are BSA-related
paragraphs: While Justice prosecutes criminal violations of the BSA, several federal  law enforcement agencies in Justice and the Department of Homeland  Security can be involved in the detection and investigation of criminal BSA  activity. More specifically, Justice investigates individuals and financial  institutions that repeatedly and systemically do not comply with BSA  regulations or are involved in criminal money laundering offenses and  prosecutes those charged. Referrals to Justice from financial regulators of  suspected cases of criminal BSA/AML violations also may trigger a Justice  investigation. In addition to prosecutions, Justice has resolved criminal  investigations through deferred or nonprosecution agreements and guilty  plea agreements, which have included fines, forfeitures, remedial actions,  and timelines for implementation.
Within the Department of Homeland Security, the Secret Service,  Immigration and Customs Enforcement, and Customs and Border  Protection all use BSA data in their investigations. According to Justice  officials, most criminal BSA cases against financial institutions start as  investigations of individuals involved in illegal activities, such as drug  trafficking or money laundering.
section_title: While Agencies Have Enhanced BSA Compliance Programs, Opportunities Exist to Improve Interagency and State Examination Coordination
paragraphs: Financial regulators have incorporated their BSA/AML responsibilities into  their supervisory approaches to compliance and enforcement, but  opportunities exist for improved coordination. Federal banking regulators  and industry representatives report that their interagency public BSA  examination manual increased collaboration on bank examinations. SEC  and CFTC have formalized their BSA/AML examination procedures in  nonpublic BSA examination modules and coordinate with their SROs on  examination issues. IRS developed an MSB examination manual and an  overall strategy for NBFI identification and examination with FinCEN, but  has not fully coordinated its MSB examination schedules with states,  missing opportunities to leverage limited resources. Further, across  financial industries, agencies have not established a formal mechanism  through which they could discuss compliance processes and trends  without industry present. The regulators with enforcement authority  issued BSA-related enforcement actions in 2008, and the federal banking  regulators improved coordination of their enforcement actions. Officials  from the federal banking regulators reported improved transparency and  consistency of enforcement actions, due in part to new interagency  guidance.
subsections: section_title: Federal Agencies Have Formalized and Cited Improvements to Examination Procedures and Guidance; However, Opportunities Exist for Increased Coordination
paragraphs: In 2005, the federal banking regulators, in collaboration with FinCEN,   combined their BSA guidance with examination procedures and made  both publicly available in one manual. Since 1986, the federal banking  regulators have been required to ensure that institutions under their  supervision have AML programs. SEC and CFTC and their SROs use a  different approach in regulating their industries—they keep their  examination modules nonpublic, but provide public guidance to industry  through various methods. With respect to BSA, these agencies and SROs  also have coordinated and formalized their examination procedures since  the 2001 USA PATRIOT Act required institutions under their supervision  to have AML programs. IRS developed an examination manual with  FinCEN for MSBs, but does not fully coordinate its examination schedules  with state examiners. The financial regulators do not have a nonpublic  forum for regularly discussing BSA examination procedures and findings  across sectors.
subsections: section_title: Federal Banking Regulators’ Manual and BSA/AML-related Training Have Improved Collaboration and Transparency
paragraphs: Through the development of an interagency BSA/AML examination  manual, guidance, and inter- and intra-agency training, the banking  regulators have increased collaboration on BSA examinations and the  transparency of the examination process. In 2005, the federal banking  regulators, in collaboration with FinCEN, published the Federal Financial  Institutions Examination Council (FFIEC) BSA/AML Examination Manual,  which was updated in 2006 and 2007. The manual provides an overview of  BSA compliance program requirements and guidance on identifying and  controlling money laundering and other illegal financial activities; presents  risk management expectations and sound practices for industry; and  identifies examination procedures. All federal and state banking regulators  use this manual when conducting BSA/AML examinations, whether they  are joint or independent examinations. As mentioned previously, the  Federal Reserve, FDIC, and OTS will conduct (on an alternating basis)  independent or joint examinations with state agencies. NCUA conducts  examinations at all federally chartered credit unions, while state  supervisory authorities conduct BSA examinations at all state-chartered  credit unions. Depending upon the risks, NCUA may conduct joint  examinations with the state authorities at the state-chartered credit  unions. OCC supervises nationally chartered banks and federal branches  of foreign banks and therefore does not share jurisdiction with state  banking regulators. Both federal and state examiners said that the manual  helped increase the consistency of examinations among the regulators.
Federal banking regulators also generally share BSA/AML examination  workpapers and findings with their state counterparts in cases where they  share regulatory jurisdiction over an institution. For example, NCUA  officials said that their findings are shared with states to coordinate their  reports on joint examinations. State officials we interviewed concurred,  stating that they share workpapers in cases where they have federal  regulatory counterparts. Several industry officials we interviewed also  thought that the federal banking regulators collaborated well with other  federal banking regulators on their examinations.
The new examination manual also has improved the consistency and  transparency of examinations by providing a framework for examinations,  requiring risk assessments and transaction testing, and providing publicly  available examination procedures for banks. For example, the manual lists  requirements for examination scoping and transaction testing. Officials  from one state regulator said the manual has helped answer questions for  institutions and regulators, and helped institutions structure their AML  programs. All of the federal banking regulators and most of the state  banking regulators and banking associations we interviewed consider the  process of gathering data for banks and the risk-assessment component of  the manual beneficial. As one regulator said, the manual helps an  examiner understand an institution’s products and services and the steps  the institution took to mitigate risks. Most industry officials we  interviewed thought the manual provided more consistency to and clearer  guidance about the examination process.
While regulators and industry officials said that the manual has been  beneficial overall, some banking regulator and industry association  officials said that initially it sometimes resulted in longer examinations or  additional procedures. Federal Reserve examiners noted that it is  important for examiners to apply the risk-based approach, using the  minimum procedures where appropriate, and to utilize work previously  done by a bank’s independent audit, where possible. Similarly, NCUA  examiners added that initially the manual resulted in some expanded  examinations. However, by using the risk-based approach they are able to  focus their resources on the highest areas of risk. Federal Reserve officials  added that as examiners have become more familiar with the manual since  its adoption, the amount of background reading that examiners need to do  in preparing for a BSA/AML examination has decreased. Some officials  from the institutions we interviewed were less concerned with the length  of the examinations than with some examiners interpreting the manual’s  requirements too literally or having expectations beyond those expressed  in the manual. For example, an official from one large bank said that when  the manual was first implemented, regulators were examining “very close  to the manual” and interpreted it literally instead of conducting their  examinations based on risk. In another case, an official from one small  bank that files very few SARs noted that in recent examinations,  examiners unnecessarily focused on the bank’s record keeping and  whether SAR reports were filed on time.
FFIEC serves as the mechanism for the banking regulators to develop  interagency BSA/AML guidance for examiners and the industry. FFIEC is  also the forum in which banking regulators and FinCEN discuss and draft  manual revisions. In addition to its role in developing the manual, the  FFIEC BSA/AML Working Group is an interagency group through which  the banking regulators develop joint examiner training, such as the AML  Workshop and Advanced BSA/AML Specialists Conference. FinCEN  officials said that FinCEN specialists also teach at these workshops. Both  federal and state banking examiners participate in FFIEC AML workshops  and other training sessions offered through their agencies or vendors. In  interagency working groups, participants share their knowledge of and  experiences with BSA, which federal banking regulator officials have said  helped them work toward achieving consistency in their examination  processes. Federal banking regulators also train examiners within their  own agencies on the new manual.
As a check on their examination programs, including their BSA/AML  examination programs, the federal banking regulators conduct quality  assurance reviews. The regulators’ quality assurance reviews that we  examined, which were conducted from 2005 through 2008, indicated that  banking examiners were implementing BSA/AML compliance  appropriately, with some minor exceptions. For example, reviews from  one regulator noted that examiner staff were well trained, devoted  significant attention to BSA/AML issues, and generally had well-organized  workpapers. Reviews from a second regulator found that examiners  complied with BSA/AML guidance, quality control processes were  satisfactory, processes for determining enforcement actions and making  referrals to FinCEN were sufficient, SAR reviews were timely, and  communication between the regulator’s headquarters and regions was  strong. Another regulator concluded that its examiners demonstrated  strong compliance with all issued national and regional guidance for BSA  examinations, and found adequate internal controls, no material  weaknesses in workpapers, and adequate supervisory and examination  resources for evaluating BSA compliance. While reviews generally were  positive, they also noted some weaknesses. One regulator recommended  that a regional office develop a process for a quality assurance group to  periodically review workpapers on a risk-focused basis because of the  complexity of the FFIEC BSA/AML examination procedures and also  expressed concern about turnover of qualified staff. A second regulator  noted a lack of both independent testing and identification of high-risk  accounts in one region, and inappropriate recording of a BSA violation in a  second region. A third regulator found instances where reported BSA  violations were not forwarded to the agency’s headquarters.
section_title: SEC, CFTC, and Their SROs Coordinated within Their Industries to Formalize Examination Procedures and Also Cited Examination Coordination across Industries
paragraphs: SEC, CFTC, and their SROs share responsibility for oversight of the  securities and futures industries, and have worked together to incorporate  new BSA/AML requirements into their compliance programs. These  agencies take a different approach than the federal banking regulators— they have separate, nonpublic procedures for their examiners and provide  public guidance to industry.
In 2006, SEC and what is now FINRA prepared a nonpublic examination  module for broker-dealers in an effort to promote consistency in BSA/AML  examinations. SEC staff said that the SEC-FINRA module generally  formalized procedures and processes that SEC and its SROs already had in  place. SEC staff added that their agency has procedures in place for  granting access to nonpublic information in response to requests by other  regulators. Furthermore, SEC provided all SRO broker-dealer examination  modules and procedures to FinCEN for its review and input under their  MOU. SEC also has a separate, nonpublic examination module for mutual  funds, which it, rather than the SROs, examines. SEC staff explained that  BSA/AML examinations of mutual funds are more complex than  examinations of broker-dealers because mutual funds do not have their  own employees and are managed by investment advisors. Registered  investment advisors are rated according to the risk they manage, and those  with a higher risk profile are examined more frequently. SEC annually  completes approximately 100 mutual fund examinations covering BSA  issues.
Working through the Joint Audit Committee, the futures SROs developed a  common, nonpublic BSA/AML examination module, which the futures  SROs (except NFA) use in their BSA/AML examinations. The Joint Audit  Committee updates the BSA module annually and submits the module to  CFTC. Unlike SEC, CFTC had not provided the examination modules to  FinCEN for its review because the agencies did not have an information- sharing MOU in place until January 2009. (We discuss MOUs in more detail  later in this report.) However, CFTC and FinCEN officials informally have  discussed procedures the futures SROs use during their BSA/AML  examinations.
In lieu of making examination modules public, SEC, CFTC, and their SROs  offer public BSA guidance and education through various methods and  venues, including the Internet and industry conferences. For example,  SEC developed BSA “source tools” for broker-dealers and mutual funds,  which compile key laws, rules, and guidance and provide regulatory  contact information. The tools are available on SEC’s Web site. Securities  SROs also provide training and update members on BSA/AML rules and  guidance. In addition, FINRA has developed an AML program template for  small firms on its Web site that provides possible language for procedures,  instructions, and relevant rules and Web sites, among other information.  Similarly, CFTC provides information on BSA/AML requirements on its  Web site and participates in industry conference panels and outreach  efforts with other regulators (in particular foreign regulators). In addition,  futures SROs also may provide training, send members updates on new  BSA/AML rules and guidance, and participate in industry conference  panels to help educate institutions on BSA/AML. For example, NFA  provides Web-based training and an AML questionnaire for futures  commission merchants and introducing brokers. Overall, industry  representatives have been complimentary about the information and  education provided by SEC, CFTC, and their SROs; however, they still  expressed a desire to have BSA/AML examination modules made public.
SEC, CFTC, and their SROs also have coordinated on multiple-regulator  and cross-industry examination issues because many institutions can be  registered with more than one SRO or join more than one exchange. For  example, broker-dealers can be members of more than one securities SRO.  FINRA (which conducts almost 90 percent of broker-dealer examinations)  meets with other securities SROs to coordinate examination schedules  and ensure that all broker-dealers are covered by examinations. FINRA  also has several regulatory agreements to conduct work on behalf of other  SROs. In the futures industry, futures commission merchants must be  members of NFA and may be clearing members of more than one contract  market. Therefore, the Joint Audit Committee assigns an SRO to be the  lead regulator, responsible for conducting examinations for each firm with  multiple memberships. Examination reports and findings are shared  among futures industry SROs where the firm is a member.
Some of the largest SEC-registered broker-dealers also may be registered  as futures commission merchants or introducing brokers on futures  exchanges. In these instances, FINRA and futures SROs may coordinate  informally on BSA/AML examinations of any futures firms that are  registered dually as securities broker-dealers. As part of FINRA’s  information-sharing agreement with NFA, the two SROs meet at least  quarterly to share examination results and schedules. Other futures  industry SROs obtain FINRA examination results on an as-needed basis.  Futures SRO officials said that (1) if FINRA examined an institution’s AML  program in the last 6 months and reported no major findings and (2) the  institution used the same BSA officer and procedures for its securities and  futures business, then SRO officials might refrain from conducting the full  range of their examination activities. Finally, SEC, CFTC, and the  securities and futures SROs participate in Intermarket Surveillance Group  meetings.
In addition to working together to help promote consistency in  examinations, securities and futures regulators also have programs and  procedures—similar to the quality assurance reviews of the federal  banking regulators—to review examinations or specific issues. For  instance, SEC staff told us that liaisons to each of SEC’s regional offices  conduct a quarterly review of a representative sample of examinations  reports that include AML findings. They added that SEC reviews the  examination reports to ensure that AML findings are sufficiently supported  and conclusions are valid. SEC staff conducts periodic inspections of  FINRA’s overall BSA/AML examination program. The purpose of these  inspections is to identify any systemic deficiencies or trends in FINRA’s  BSA/AML program. During previous SEC inspections, SEC and FINRA  staff said that SEC identified a few BSA/AML-related deficiencies in  specific FINRA examinations. FINRA officials stated that while SEC found  isolated weaknesses in some examinations, these findings did not indicate  any significant trends. FINRA officials stated they use findings from SEC’s  reviews to identify areas for additional training. Similar to SEC, CFTC  conducts reviews of SROs’ examinations, in which CFTC staff review SRO  examinations to ensure they are appropriately examining for compliance  with futures laws, including BSA. CFTC officials told us that these reviews  have not identified any problems with BSA/AML examination programs of  the futures SROs.
Although SEC, CFTC, and SRO officials cited coordination on BSA issues,  industry officials at large financial companies with whom we spoke had  mixed opinions on coordination among the securities and futures  regulators. For example, one industry representative said that futures  SROs and FINRA coordinated well and shared examination information.  The representative also stated that the futures SRO would not conduct its  own examination if its review of FINRA’s examination workpapers  showed the FINRA to be work sufficient. However, another industry  representative indicated that they had never seen FINRA and their futures  SRO coordinate on BSA/AML examinations.
section_title: IRS Has Improved Its BSA Compliance Efforts; However, It Does Not Fully Coordinate Examination Schedules with States
paragraphs: Since our 2006 report, IRS has made improvements in its BSA/AML  compliance program by revising guidance, identifying additional NBFIs,  and coordinating with FinCEN and the states; however, IRS and state  agencies have missed opportunities to better leverage examination  resources by not coordinating their examination schedules. In response to  a December 2006 GAO recommendation, IRS updated its Internal Revenue  Manual to reflect changes in its BSA/AML program policies and  procedures and distributed the revisions to IRS staff.
In our 2006 report, we also said that IRS had identified only a portion of  the NBFI population. In 2005, IRS’s database contained approximately  107,000 potential NBFIs; however, during the same year FinCEN estimated  that there could be as many as 200,000 MSBs, the largest group of NBFIs  subject to BSA requirements. Through subsequent coordination with  FinCEN and state regulators and internal identification efforts, IRS  significantly increased the number of identified MSBs. For example, at  least three or four times a year, FinCEN sends IRS lists of anywhere from  100 to 300 potentially unregistered MSBs, which FinCEN identified by  reviewing SARs from depository institutions that mention unregistered  MSBs. Similarly, states that signed an MOU with IRS must provide IRS lists  of state-licensed and registered MSBs on a quarterly basis. IRS officials  said that the agency found about 20 percent of the new MSB locations as a  result of information provided by with the FinCEN and states’, but that  most of the newly identified MSBs were added due to internal  identification efforts. According to IRS officials, in June 2008 the database  contained more than 200,000 unique locations of MSBs.
In our 2006 report, we recommended that FinCEN and IRS develop a  documented and coordinated strategy that outlined priorities, time frames,  and resources needs for better identifying and selecting NBFIs for  examination. In response, IRS and FinCEN developed such a strategy.  Furthermore, IRS, in concert with FinCEN and state regulators, has  developed a BSA/AML examination manual for MSBs that was released in  December 2008. The manual contains an overview of AML program  requirements, discusses risks and risk-management expectations and  sound practices for industry, and details examination procedures. The  manual’s main goals are to enhance consistency across BSA examiners,  promote efficient use of examination resources, and provide guidance to  examiners and MSBs about the BSA examination process.
In July and August 2008, IRS and two state regulators tested the feasibility  of conducting joint examinations using the new MSB examination manual.  Many factors complicate joint examinations—including varying state  licensing requirements, coordination of examiner resources, the  difficulties of sharing confidential information, and differing examination  scope and focus. For instance, one state may require licensing of only  money transmitters, while another state also might require check cashiers  and currency exchangers to obtain a license. Nonetheless, some state  regulators with whom we spoke expressed a desire to conduct joint or  alternating examinations with IRS to better leverage state resources. One  state regulator said that joint examinations would allow states to issue  enforcement actions pursuant to their own state authority against  institutions with AML violations since IRS lacks enforcement authority.  According to the Money Transmitter Regulators Association, state  financial regulators already conduct joint examinations with other states  to leverage examination resources and expertise. IRS officials said they  will review and incorporate examiner comments from the joint  examination pilot and work with the Conference of State Banking  Supervisors to develop formal guidance for IRS and state examiners.
Additionally, IRS has increased the number of its information-sharing  MOUs with state financial regulators from 34 in 2005 to 43 as of October  2008. Under the MOU, the state regulators are typically required to provide  lists of state-licensed and chartered MSBs, examination reports,  information concerning BSA noncompliance, and examination schedules  on a quarterly basis to IRS. Also on a quarterly basis, IRS agreed to provide  copies of all Letter 1112 (letters of noncompliance sent to institutions with  BSA violations), copies of all Letter 1052 (notifications to new institutions  of relevant BSA regulations), lists of MSBs in the state, and examination  schedules to state financial regulators. According to the MOU, IRS officials  and state regulators will meet periodically to review the implementation of  the MOU. Following one state financial regulator comment on the  usefulness of the information provided in the Letter 1112, IRS officials  revised the form letter to include information on the type of institution  examined and the activities conducted by that institution.
According to IRS officials, many state agencies are not living up to their  responsibilities as stated in the MOU. IRS data show that 28 of 43 state  agencies that signed an information-sharing MOU have not provided IRS  with MSB information and only 4 of 43 have provided examination  schedules. In addition, state financial regulators that send MSB data to IRS  do so using different formats, limiting the usefulness of the data for IRS.  IRS is working with states to develop a standardized format for all state  information, making it easier to provide the information to IRS and for IRS  to integrate the information into its database.
While IRS provides MSB information to state regulators, it has not shared  its examination schedules with states, contrary to what it agreed to do as  part of their MOUs. IRS officials said they provide state regulators with  their annual workplans, which include the total number of NBFIs to be  examined but not the names of the institutions to be examined. Therefore,  the state financial regulators cannot plan their examinations to avoid  potential overlap or coordinate joint examinations. One state agency noted  that it had conducted examinations of MSBs, only to find out later that IRS  had conducted its examinations not long before. Several state agencies  said that greater coordination and sharing of examination schedules would  help reduce redundancy in examination resources. Best practices in  interagency coordination suggest agencies should assess their relative  strengths and limitations, identify their mutual needs, and look for  opportunities to leverage each others’ resources—thus obtaining  additional benefits that would not be available if they were to work  separately. IRS officials said state regulators would not derive much  benefit from IRS providing examination schedules on a quarterly basis  because new case files on institutions are sent to field managers often,  sometimes weekly, and field managers and examiners have flexibility and  discretion to determine their examination schedules. In addition, some  institutions on IRS examination lists may not appear on a state regulator’s  list because of varying state licensing and examination requirements of  MSBs. However, by not implementing coordination of examination  schedules with states, IRS may have missed opportunities to leverage  resources, reduce regulatory duplication, maximize the number of MSBs  to be examined, and better ensure BSA compliance with MSBs.
section_title: Federal Agencies Do Not Hold Regular, Nonpublic Discussions about BSA Examination Issues, which Could Inhibit Their Ability to Leverage Resources
paragraphs: While all federal agencies have made improvements in their BSA  compliance efforts, they have not established a formal mechanism through  which they collectively can discuss sensitive BSA examination processes  and findings in nonpublic meetings. All federal agencies and some SROs  participate in the Bank Secrecy Act Advisory Group (BSAAG)—a public- private working group headed by FinCEN that meets twice a year to  discuss BSA administration. BSAAG also includes a number of  subcommittees on various BSA/AML issues. Representatives from the  SROs, industry, and law enforcement agencies are present at these  meetings and on some subcommittees. Some regulatory officials have told  us that the presence of industry representatives and the number of  participants in BSAAG inhibit more detailed discussion on some issues.  Further, sensitive information, such as examination processes and  findings, cannot be discussed due to the presence of industry.
Some federal agency officials said they have held discussions with  regulators of other industries outside of BSAAG, but the discussions  generally were held on an informal basis and were not inclusive of all  federal agencies. Some banking regulators cited their public manual as a  reason for not meeting outside of BSAAG with regulators of other  industries. FDIC officials stated, outside of meetings with other federal  banking regulators, they had met with several state MSB regulators to  understand the MSB examination process and other state roles relating to  MSBs. One of the primary goals of these meetings was to determine if they  could share information about MSB examinations with some state  regulators. SEC staff said they informally have had discussions on  BSA/AML issues with federal bank regulators and CFTC. SEC and Federal  Reserve staff cited frequent, informal communications between the  agencies on BSA issues. Further, SEC and the Federal Reserve signed an  MOU in July 2008 under which they can share information on common  interests, which could include BSA violations. Under the MOU, if SEC or  the Federal Reserve became aware of a significant violation occurring in  an institution regulated by the other agency, they would notify the other  agency and provide additional information if requested. CFTC officials  said that outside of BSAAG, they generally discuss examination  procedures only with SEC and FINRA. Similarly, IRS officials stated they  have met with regulators on an ad hoc basis when there have been  overlapping issues. FINRA officials told us that they had very useful  meetings with the Federal Reserve on two occasions (in April and  December 2008) during which they discussed BSA examination  approaches and findings. These meetings will continue on a biannual  basis. In addition, SEC and FINRA staff said that in November 2008, SEC  and FINRA staff met with OCC and Federal Reserve staff to share general  information about SEC and FINRA’s BSA/AML examination programs.
While they did not discuss specific examination procedures, FINRA  officials said they would be willing to do so if it were useful.
Some industry officials expressed concern about examination overlap and  suggested that if regulators collectively could discuss these issues, the  collaboration could help decrease resources expended on responding to  duplicative information requests and increase the consistency of  examination processes. Many of the largest financial institutions are part  of a bank or financial holding company structure—companies that could  include broker-dealers and futures firms, as well as banks. Therefore,  some financial institutions have multiple regulators from various  institutions. Industry representatives said that large financial institutions  employ enterprise-wide, risk-based AML programs that have many similar  elements across business lines. As no single regulator examines BSA/AML  procedures for all of the institution’s functions, in some cases they must  work with several regulators to review the same or similar policies and  procedures. In addition, some officials also mentioned that regulators  sometimes arrived at different findings when looking at the same BSA  processes. For example, one official stated that regulators of different  industries reviewed a common AML procedure and arrived at different  conclusions—one regulator approved a policy and another requested a  wording change.
According to our key practices for collaboration, agencies can enhance  coordination of common missions by leveraging resources and  establishing compatible procedures. To facilitate collaboration, agencies  need to address the compatibility of standards, policies, and procedures— including examination guidance and its implementation. However,  because banking-regulator and MSB examination guidance is public and  SEC and CFTC guidance is nonpublic, the agencies cannot address these  and other sensitive regulatory issues in the existing interagency forum,  BSAAG. As a result, the regulators may not be able to gain the benefits of  collaboration—leveraging scarce resources and building on the  experiences and improvements of other agencies. Furthermore, by not  having a mechanism that could provide an overview of examination  efforts, regulators may be missing opportunities to (1) discuss BSA/AML  concerns from the viewpoint of all financial industries being  interconnected and (2) decrease the regulatory burden, where possible,  for the institutions under examination by multiple regulators.
section_title: Regulators with Enforcement Authority Took BSA-Related Enforcement Actions, and Federal Banking Regulators Reported Improved Coordination of Enforcement Actions
paragraphs: The BSA/AML examinations that federal banking regulators, SEC, CFTC,  and their SROs conducted resulted in the citation of violations and the  taking of informal (in the case of the federal banking regulators) and  formal enforcement actions. In our interviews, the federal banking  regulators discussed factors potentially influencing BSA compliance in  their industry and also reported improved interagency coordination on  enforcement actions due, in part, to the issuance of new guidance. SEC  and CFTC are kept apprised of enforcement actions that their SROs take  through meetings and information-tracking efforts. In contrast, because it  does not have the enforcement authority, IRS refers the BSA violations it  finds to FinCEN, which takes an enforcement action, if appropriate.  Justice pursues cases when it believes BSA noncompliance is criminal.
subsections: section_title: Federal Banking Regulators Have Taken Informal and Formal Enforcement Actions to Promote BSA Compliance among Depository Institutions
paragraphs: The federal banking regulators have taken informal and formal  enforcement actions against depository institutions to address BSA/AML  concerns. The federal banking regulators can only take enforcement  actions under their enabling legislation contained in Title 12 of the United  States Code, but these actions can be based on an institution’s violation of  BSA. Table 2 provides aggregate numbers of examinations, violations,  and enforcement actions taken by the federal banking regulators. Under  the regulators’ AML program rules, in 2008 the most frequently occurring  violations concern requirements to independently test an institution’s  BSA/AML compliance program, train staff on BSA/AML, and maintain  internal controls. BSA requires that depository institutions implement and  maintain a system of internal controls to ensure an ongoing BSA  compliance program. An example of such a control is monitoring for  suspicious activity, which one regulator explained can be costly and  difficult, and time consuming for an institution to implement. With respect  to training, several federal banking regulators said that some banks’ staff,  even BSA compliance officers, may lack adequate BSA/AML training,  especially when such staff are newly hired.
The most frequently cited violations under Treasury’s BSA rules are  similar across the banking regulators. These violations concern customer  identification programs (CIP), CTRs, and requests for filing reports. For  example, a violation of CIP requirements could mean that an institution  did not implement a written CIP. An institution violating 31 CFR 103.22 did  not adhere to the requirement regarding reporting currency transactions in  excess of $10,000. Violations of 31 CFR 103.27 could mean that an  institution failed to meet the filing and record-keeping requirements for  CTRs, reports of international transportation of currency or monetary  instruments, or reports of foreign bank and financial accounts. While  regulators emphasized that no one factor could explain upward or  downward trends in BSA violations, they cited several possible factors  influencing these trends—the implementation of the FFIEC BSA/AML  examination manual, additional training for examiners and the banking  industry, banking regulators more clearly communicating their  expectations to institutions, and institutions developing better AML  programs. For example, one regulator said that implementing the  examination manual may have contributed to a decline in violations by  providing guidance to banks on identifying and controlling BSA/AML risk  and promoting consistency in the BSA/AML examination process.  However, another regulator said that the manual may have led to its  increasing number of violations by providing better guidance to  examiners. Appendix III provides further information on selected  BSA/AML-related enforcement actions taken by all financial regulators.
In response to violations, the federal banking regulators have issued  thousands of informal enforcement actions but relatively few formal  enforcement actions in recent years. For example, in fiscal year 2008, they  issued a total of 3,416 informal and 37 formal enforcement actions. Federal  banking regulators said that generally, informal corrective actions will  suffice for technical noncompliance or the failure of a portion of the AML  program that does not indicate that the entire program has failed. If a  compliance violation is significant and remains uncorrected after an  informal action has been taken against an institution, a federal banking  regulator may then decide to take a formal enforcement action. Banking  regulator officials said that formal enforcement actions are public and  generally considered more stringent than informal actions because they  address more significant or repeated BSA violations. Formal enforcement  actions can include cease and desist orders, assessments of civil money  penalties (CMP), or supervisory agreements, and are enforceable through  an administrative process or other injunctive relief in federal district  court. Federal banking regulators said they track enforcement actions  through their various management information systems.
section_title: Federal Banking Regulators Reported Improved Transparency of Enforcement Actions Due, in Part, to New Guidance
paragraphs: Federal banking regulators reported that new interagency guidance has  helped improve the transparency of BSA enforcement. In July 2007, the  federal banking regulators issued the “Interagency Statement on  Enforcement of Bank Secrecy Act/Anti-Money Laundering Requirements,”  which clarified the circumstances under which regulators would issue a  cease and desist order against a financial institution for noncompliance  with BSA requirements. It does not address assessment of CMPs for  violations of the BSA or regulators’ implementing regulations.
Regulators that we contacted typically stated that the guidance has been  beneficial. FDIC officials maintained that with the guidance, bank officials  have a better idea of the factors FDIC and other banking regulators take  into account before executing a cease-and-desist order. They added that  the interagency statement advises that the appropriate regulator may take  a different level of action depending on the severity and scope of the  bank’s noncompliance. NCUA officials said they found that the guidance  has led to more consistent enforcement actions taken among the banking  regulators in response to cited deficiencies and violations. Both Federal  Reserve and OCC officials suggested that the guidance provided more  clarity about, or added transparency to, the circumstances under which  the agencies will take formal or informal enforcement actions to address  concerns relating to a bank’s AML program requirements.
Federal banking and state regulators generally coordinate when necessary  on BSA enforcement actions. For example, Federal Reserve officials said  they usually take (and terminate) actions jointly with state regulators, and  a bank must continue to comply with a joint enforcement action until both  the Federal Reserve and the state authorities terminate the action.  Accordingly, the Federal Reserve and state regulators typically terminate  enforcement actions simultaneously. Officials from several state agencies  said that as a general rule, they took informal and formal enforcement  actions jointly with their federal counterparts, although some state  agencies were likely to coordinate only formal actions. Several state  officials reported taking few, if any, formal BSA/AML-related actions  against depository institutions, especially credit unions.
Several officials from institutions that were examined by multiple federal  banking regulators, such as OCC and the Federal Reserve, said that these  regulators coordinated well among themselves, while others indicated  they were unsure or thought coordination could be improved. Bank  officials had mixed views on coordination of enforcement actions between  federal and state regulators; some thought the extent of coordination was  sufficient, others thought it was lacking, and several simply did not know  how extensively these regulators coordinated on enforcement.
section_title: Agencies and SROs Take Enforcement Actions in the Securities and Futures Industries
paragraphs: The enforcement actions that SEC, CFTC, and their SROs can use to  address BSA compliance can be informal or formal. All SEC enforcement  actions are public and formal actions, but the actions of its SROs include  informal and formal enforcement processes. SEC staff said that most cited  BSA/AML deficiencies are corrected through the examination process.  Most examinations conclude with an institution sending SEC a letter  stating how it will correct the compliance problem. FINRA officials also  said that firms must document the corrective action to be taken to address  any issues found during an examination. If SEC examiners find significant  deficiencies with a firm’s BSA program, SEC staff may refer this to their  Division of Enforcement or an SRO for enforcement. In accordance with  its MOU, SEC also will notify FinCEN of any significant BSA/AML  deficiencies. SEC’s Division of Enforcement will assess whether to  proceed with an investigation, determine whether a violation has  occurred, and if so, whether an enforcement action should be taken  against the firm or any individuals. FINRA officials said their enforcement  actions are typically fines, the amount of which may vary depending on the  egregiousness of the compliance failures, the scope of conduct, and the  overall risk of money laundering through the firm.
In fiscal year 2008, SEC and the securities SROs took 25 formal  enforcement actions against securities firms (see table 3).
As shown in table 4, in both fiscal years 2007 and 2008, violations in  policies and procedures and internal controls and annual independent  testing were the most common AML-program-related violations among  broker-dealers. With respect to BSA reporting requirements, in fiscal year  2007 the most common violations among broker-dealers were related to  CIP requirements and required information sharing. In fiscal year 2008, the  most common violations were CIP and SAR requirements. SEC staff said  that many of the largest securities firms have had AML programs in place  for a while and medium-sized or small firms had AML programs that could  be improved.
SEC and its SROs routinely share information about their enforcement  activities. For example, FINRA officials said that they work with SEC if  they are both investigating an institution to ensure they are not duplicating  efforts. SEC and FINRA officials said that FINRA makes SEC staff aware  of any significant BSA/AML violations prior to an enforcement action  being taken. Further, in accordance with its MOU with FinCEN, SEC  tracks its examinations, violations, and enforcement actions, and collects  similar information from its SROs on a quarterly basis, which it then  provides to FinCEN.
While CFTC retains authority to issue enforcement actions against futures  firms, its SROs have taken all enforcement actions for BSA/AML  deficiencies to date. When CFTC becomes aware of potential BSA/AML  violations, it usually refers the violations to a firm’s SRO for investigation  and potential enforcement action, although SROs typically develop  enforcement cases through the examination process. At the conclusion of  an SRO examination, the SRO issues a report to the futures firm and  notifies the firm of any deficiencies in its AML programs. SROs require  futures firms to correct any material deficiencies prior to closing the  examination. If the deficiencies are minor, SROs may cite the deficiency in  the examination report and close the examination with no disciplinary  action or require corrective action before closing it. If examination  findings are significant, then SROs may start an investigation, during  which internal committees at the SROs may review information collected  during the examination and investigation and determine whether an  enforcement action is warranted. SROs take only formal, public  enforcement actions, and all rule violations and committee findings are  made public. SROs resolve most enforcement cases related to violations of  BSA/AML SRO rules by issuing a warning letter or assessing a fine. The  amount of the fine varies depending on the severity of the violation. SROs  also may take other types of actions for violations of their rules, such as  suspension of membership or expulsion.
NFA conducts the vast majority of examinations of futures firms and is  responsible for all formal enforcement actions taken in recent years (see  table 5). The number of BSA/AML-related enforcement actions initiated by  NFA decreased from 21 in 2006 to 10 in 2007 and 8 in 2008. Officials added  that when new requirements become effective, they usually see an  increase in deficiencies related to the new requirements. NFA officials said  they reduced the number of deficiencies cited by requiring firms to submit  written BSA compliance programs for review during their membership  application process. NFA officials said the most common BSA violations  cited since 2003 were failure to have annual independent audits and failure  to conduct annual BSA training of relevant staff.
CFTC officials said they meet quarterly with SROs to review their open  investigations and enforcement actions. If an SRO takes an enforcement  action, it will send a copy of the enforcement action to CFTC. CFTC’s  Division of Enforcement regularly tracked BSA violations investigated and  charged by futures SROs, but it did not maintain statistics by the type of  violation. Additionally, CFTC receives and reviews examination reports  from all SROs, but did not compile BSA/AML examination statistics. In  anticipation of finalizing the information-sharing MOU with FinCEN  (which the agencies finalized in January 2009), CFTC recently began  collecting BSA examination information from the SROs. (We discuss  information-sharing MOUs later in this report).
section_title: IRS Does Not Have Authority to Take Enforcement Actions and Refers Potential Violations to FinCEN
paragraphs: As previously discussed, IRS does not have its own or delegated authority  to issue enforcement actions against NBFIs for BSA violations. If IRS  finds BSA violations when examining an NBFI, it can send a letter of  noncompliance (Letter 1112) and a summary of examination findings and  recommendations to the institution, and also include an acceptance  statement for the institution to sign. In response to the statement, the  institution may agree to implement the recommendations and correct any  violations. Generally, IRS would conduct a follow-up examination within  12 months after issuing the letter to determine if the corrective action  were taken. In cases where significant BSA violations have been found or  past recommendations have been ignored, IRS will refer the case to  FinCEN to determine what, if any, enforcement action should be taken.  IRS examiners and their managers make the initial determination to refer a  case and then an IRS BSA technical analyst reviews the case to decide  whether to forward the referral to FinCEN. IRS has referred  approximately 50 cases to FinCEN since fiscal year 2006. The referrals  include the facts of the case, a summary of the examination, and the  violations cited.
During fiscal year 2008, IRS reported citing 23,987 BSA violations and  issued a Letter 1112 to 5,768 different institutions (see table 6).
Table 7 provides a summary of the total number of institutions with one of  the five violations IRS most often cites.
Justice officials said they coordinate with financial regulators and FinCEN  during criminal BSA investigations and when taking criminal enforcement  actions. Most of Justice’s BSA cases against financial institutions start as  investigations of individuals involved in illegal activities, such as drug  trafficking or money laundering. Justice officials also said they have  started investigations after receiving referrals from federal regulators.  They indicated that having a financial regulator assigned to a Justice  investigation can help investigators better understand the financial  industry and BSA policies and procedures. Over the last 2 years, both OTS  and the Federal Reserve have assigned examiners to Justice investigations.  Justice officials work closely with institutions’ regulators to obtain and  review their examination reports and workpapers, analyze SARs filed, and  determine if any civil enforcement actions were taken against the  institution. Justice officials said they will coordinate enforcement actions  with financial regulators and FinCEN when feasible—checking with both  to see if they are planning an enforcement action against the institution.  According to Justice, the challenges of coordinating regulatory and  criminal enforcement include grand jury secrecy requirements and the  differing length and pace of investigations and negotiations.
Justice officials said that all their BSA cases against financial institutions  have involved systemic, long-term failures in the BSA program and  substantial evidence of willful blindness on the part of the institution  toward money laundering activity taking place through the institution. In  2005, Justice formalized procedures that require U.S. attorneys to obtain  approval from Justice’s Asset Forfeiture and Money Laundering Section in  cases where financial institutions are alleged to be BSA offenders.  Attorneys are to consider factors such as the availability of noncriminal  penalties, prior instances of misconduct, remedial actions, cooperation  with the government, and collateral consequences of conviction—when  determining what type of action, if any, should be taken. Justice officials  said they instituted the procedures to provide more review of significant  AML cases (in particular, the nature of the violation and its impact) and  promote uniformity and consistency in enforcement approaches.  According to Justice officials, the new procedures have been well  received.
Over the last 3 years, Justice took four criminal BSA enforcement actions  against financial institutions (see table 8). All the actions resulted in  deferred prosecution agreements (three against depository institutions).  The remaining case represents the first criminal BSA enforcement action  against an MSB. Justice announced each of the actions on the same day  that FinCEN and the regulators announced their civil enforcement actions.  The forfeiture amounts generally correspond to the criminal proceeds  laundered by the institutions.
section_title: FinCEN Provides Some Effective Outreach and Regulatory Support but Could Improve Information-Sharing Efforts
paragraphs: FinCEN has increased resources dedicated to its regulatory programs and  provided some effective regulatory support and outreach to industry;  however, improvements could be made in its information-sharing efforts  with regulators. From 2001 to 2008, FinCEN staff dedicated to regulatory  efforts increased from 36 to 84. FinCEN has coordinated BSA regulation  development and supported regulators’ examination processes in various  ways, including providing input on examination guidance. In 2007, FinCEN  created a new unit to provide outreach efforts, such as a helpline, that  were well received by industry. FinCEN also has improved its  management of referrals from regulators by replacing a paper-based  system with an electronic one. However, the lack of an agreed-upon  process for communication on IRS referrals may delay timely feedback to  IRS-examined entities and allow these institutions to continue operating  without correction after deficiencies are identified. Since our April 2006  report, FinCEN has increased the number of information-sharing MOUs  with federal and state regulators and has taken steps to assess these  MOUs. FinCEN and CFTC recently finalized an MOU, without which they  previously did not have an agreed-upon framework for more consistent  coordination and information sharing. FinCEN also has been discussing  how to improve analytical support with the regulators. However, some  state, securities, and futures regulators have limited electronic access to  BSA data, which impedes their risk scoping for examinations and ability to  independently verify audit information. FinCEN officials said they  finalized a regulatory data-access template in July 2008 and have begun  providing additional state regulators with direct electronic access, and  anticipate providing expanded access to the federal functional regulators.
subsections: section_title: FinCEN Has Increased Regulatory-dedicated Resources, Collaborates with Regulators to Develop Rules and Provides Them with Examination Support, and Provides Well-received Outreach to Industry
paragraphs: Parallel to its increase in overall budget authority, FinCEN has increased  resources dedicated to its regulatory programs. FinCEN officials said they  consult with other regulators and examining agencies as necessary when  developing rules and implementing regulations, provides examination  support to regulators, and conducts BSA-related training sessions and  events for industry and regulators.
subsections: section_title: FinCEN Has Increased Resources Dedicated to Its Regulatory Programs
paragraphs: As shown in table 9, FinCEN’s budget authority and regulatory-dedicated  staff have grown from fiscal year 2001 through fiscal year 2007. FinCEN  budget authority grew from $38 million in fiscal year 2001 to $73 million in  fiscal year 2007. Since 2005, the bureau’s budget authority essentially has  been flat. From fiscal year 2001 through fiscal year 2007, the number of  FinCEN staff dedicated to regulatory policy and programs approximately  doubled, from 36 to 77. The total number of FinCEN staff increased nearly  75 percent from 174 to 302.
FinCEN regulatory policy and program staff work in RPPD, which consists  of the Offices of Regulatory Policy, Compliance, Enforcement, Regulatory  Analysis, and Outreach Resources. According to FinCEN officials, these  staff work on issues that involve multiple financial sectors, although many  employees have subject matter expertise for particular industries or  sectors. As of September 2008, FinCEN officials said that RPPD had a staff  of 84. Since 2001, several regulators also have provided detailees to  FinCEN to supplement expertise in particular areas or work on specific  projects. For example, from 2007 through 2008, a detailee from the Federal  Reserve worked on an industry survey about the potential effects of rule  making related to FinCEN’s cross-border wire transfer study and served as  a subject matter expert regarding payment systems. And from 2002  through 2005, two IRS detailees to FinCEN worked with RPPD to resolve  multiple outstanding compliance issues. In addition, in 2005-2008, FDIC  officials said that the agency provided 11 detailees to assist with report  processing and other assignments.
section_title: FinCEN and Regulators Collaborate on Implementing BSA Regulations
paragraphs: BSA provides Treasury with overall regulatory authority to administer the  act and authorizes Treasury to issue regulations, sometimes jointly with  federal financial regulators, to implement BSA requirements. FinCEN, the  bureau within Treasury responsible for administering BSA, has overall  responsibility for Treasury’s BSA regulatory program. Within FinCEN’s  RPPD, FinCEN officials said that the Office of Regulatory Policy is  responsible for developing, modifying, interpreting regulations and  consults as necessary with other regulators and examining agencies.
Depending upon the subject matter of a regulatory initiative, FinCEN  officials said their interactions with regulators on BSA implementing  regulations can range from extensive collaboration to a notification that  regulations are available. In addition to meetings with regulators, FinCEN  officials stated they obtain feedback from regulators on BSA issues  through BSAAG and its multiple subcommittees. Referring to the USA  PATRIOT Act, some federal agency officials observed that the  development of some regulations was collaborative and an improvement  compared with other processes in which the regulators were less involved.
FinCEN officials said their work in recent years with SEC and CFTC—an  outgrowth of the USA PATRIOT Act—generally has been collaborative,  particularly given the newness of the securities and futures industries to  the BSA/AML regulatory framework. SEC staff said they often met with  FinCEN to discuss BSA issues (including rules development and related  FinCEN guidance). Also, FinCEN sometimes participated in SEC’s  quarterly BSA meetings with the SROs, discussing the scope of reforms  and clarifying guidance or other issues. FINRA officials said that FinCEN  and SEC directly collaborated on rules for broker-dealers, and FINRA was  able to provide input in these discussions only through SEC. While FINRA  officials said that they coordinated well with SEC, they felt that direct and  earlier coordination with FinCEN on rule and guidance development  would have increased the efficiency of the process.
CFTC officials stated that work with FinCEN on drafting of futures-related  BSA/AML rules and guidance has been collaborative. For instance, as  required by BSA, FinCEN and CFTC jointly issued regulations in 2003 for  futures commission merchants and introducing brokers requiring them to  establish CIPs. However, according to CFTC officials, the rule resulted in  some confusion about its applicability in situations where more than one  futures commission merchant was involved in a transaction with the same  customer. In April 2007, FinCEN and CFTC jointly issued guidance to  clarify the responsibilities in such a transaction. NFA officials said the  guidance has been well received by its members and clarified issues  surrounding a firm’s BSA/AML role with its customers.
FinCEN and IRS officials had differing views on the degree of  collaboration that occurred during the revision of MSB-related regulations.  As discussed previously, FinCEN and IRS completed a coordinated  strategy in 2008 to better identify and select NBFIs for examination. The  coordinated strategy states that FinCEN would work with regulatory  partners to explore the feasibility of removing or exempting from the  definition of MSBs certain types of transactions or subcategories of MSBs  that pose relatively little risk of facilitating financial crimes. At the time of  this report, FinCEN was in the process of incorporating revised MSB  definitions into its guidance and regulations. Although legislation does not  require FinCEN to conduct joint rule making on MSB issues, FinCEN  officials stated that RPPD staff have briefed other offices and divisions in  FinCEN as well as IRS, federal banking regulators, Treasury officials,  various law enforcement agencies, and the BSAAG NBFI subcommittee on  the proposed MSB rule making. The BSAAG NBFI subcommittee, of which  IRS is a member, also sent a list of issues for FinCEN to consider when  redefining MSBs, which FinCEN officials said they reviewed. FinCEN  officials said they met with IRS staff in May 2008 to discuss the advanced  notice of proposed rule making.
According to FinCEN officials, they also developed a majority of their  guidance and administrative rulings by reviewing questions received from  the financial industry through their Regulatory Helpline (which  institutions and regulators may call with questions) or other  correspondence. For example, FinCEN officials said they review questions  asked of the Office of Outreach Resources to determine what issues  concern industry, and the results of the reviews are forwarded to the  Office of Regulatory Policy. (We discuss the Office of Outreach and  FinCEN helplines in more detail below.)
section_title: FinCEN Supports Regulators’ Examination Activities by Providing Input on Guidance and Addressing Specific Issues
paragraphs: FinCEN and RPPD’s Office of Compliance provide examination support  for financial regulators in various ways. These methods include providing  input on examination guidance and working with regulators to address  specific issues (such as risk scoping). For instance, FinCEN actively  participates in FFIEC working groups to revise the FFIEC BSA/AML  manual and develop examiner training. In February 2007, FinCEN  established a working group comprising federal and state agencies, with  the goal of identifying and implementing several large initiatives to more  effectively regulate and supervise the activities of MSBs. As previously  discussed, FinCEN, IRS, and state regulators worked together in this  forum to develop an MSB BSA/AML examination manual that was issued  in December 2008. FinCEN officials said they will work with IRS and the  manual working committee to develop a roll-out plan and provide training  to IRS and state examiners, and the working group will continue to meet  to address other MSB-related issues.
FinCEN also has reviewed SEC’s and its SROs’ nonpublic examination  procedures. Additionally, SEC and FinCEN cooperated to develop Web- based tools (“AML source tools”) that compile applicable BSA/AML rules  and regulations for mutual funds and broker-dealers as well as other  helpful information and contacts. SEC staff stated that they also developed  “plain English” guidance on the examination process to be made public in  response to further industry requests for access to SEC’s nonpublic  examination module. SEC provided the draft guidance to FinCEN for its  input; however, FinCEN officials said their review is on hold because their  staff are working on other priorities and industry already has the AML  source tools as guidance. While FinCEN has worked similarly with CFTC  on guidance to its industry, FinCEN officials said that CFTC’s SROs have  not provided their examination module and procedures to FinCEN but  intended to do so after the information-sharing MOU between FinCEN and  CFTC was finalized. However, FinCEN and CFTC officials stated they have  held meetings on the examination procedures of futures SROs.
As part of the effectiveness and efficiency initiative announced by the  Treasury Secretary in June 2007, FinCEN has been studying how the  regulatory agencies are approaching risk scoping for examinations. Its  goal is to develop new tools and guidance that would enable agencies to  better direct their examination resources. FinCEN officials stated they  evaluated tools and processes that allow examiners to analyze information  and patterns in BSA data from a specific institution to help identify areas  that may require closer review, and jointly identified ways to enhance  these tools. For example, FinCEN officials said they and the federal  banking regulators are developing an enhanced BSA data analysis tool to  incorporate into pre-examination scoping processes that will allow the  federal banking regulators to better target their resources. Federal  banking regulator officials stated that the tool would help them better  analyze BSA data information for a particular institution, but not to  conduct analyses across institutions.
In addition to supporting regulators’ examination efforts and undertaking- process- or issue-specific initiatives, FinCEN officials said it also has  produced targeted financial institution analyses. These are produced after  a regulator makes a specific request for detailed analytic information  related to a particular institution or individual. Office of Regulatory  Analysis staff said they have collaborated with regulators to produce 42  such reports during fiscal year 2007 and through the first three quarters of  fiscal year 2008.
With respect to its role in term’s of achieving greater BSA/AML  examination consistency, FinCEN officials stated that, resources  permitting, they would like to increase their efforts in areas such as  examiner training, developing and providing additional compliance  referrals to regulators, periodically joining examiners in the field, and  conducting additional macro-level analysis of BSA compliance. (We  discuss FinCEN’s analytical products in a later section.) FinCEN officials  said they have held various meeting with regulators to discuss their  examination processes, but that they have not held meetings inclusive of  all regulators. Further, as discussed previously, without an information- sharing MOU in place, FinCEN had been unable to obtain examination  procedures for the futures industry—hindering its ability to review issues  of BSA/AML examination consistency.
section_title: Offices within FinCEN Coordinated to Provide Outreach That Was Well Received by Industry
paragraphs: FinCEN has implemented new outreach initiatives and conducted support  efforts on BSA guidance that were well received by industry. The Office of  Outreach Resources was created in 2007 and has primary responsibility for  operating the Regulatory Helpline that industry and regulators may call  with BSA-related questions. FinCEN staff also operate the Financial  Institutions Hotline, which financial institutions may call to report  suspicious activity related to terrorist financing. For the past 3 years,  FinCEN has surveyed customers who use the Regulatory Resource  Center—which includes the Helpline and FinCEN’s Web site. According to  FinCEN’s surveys, in all 3 years, FinCEN staff calculated more than 90  percent of respondents—primarily industry representatives—favorably  rated the guidance they received.
FinCEN officials said that as part of its efforts to make the administration  of BSA more efficient and effective, FinCEN published proposed rules in  the Federal Register in November 2008 that centralize, without substantive  change, BSA and USA PATRIOT Act regulations to a new chapter within  the Code of Federal Regulations. FinCEN officials said that the proposed  rules would streamline BSA regulation into general and industry-specific  parts, with the goal of enabling financial institutions to more easily  identify their BSA responsibilities.
The Office of Outreach Resources also coordinates with BSAAG and  supports speaking engagements to the financial industry and regulatory  groups. FinCEN officials told us they have facilitated BSAAG  subcommittee meetings (such as ones on banking, insurance, law  enforcement, SARs, and securities and futures) throughout the year. In  2007, FinCEN reported participating in almost 100 domestic and overseas  outreach events on BSA issues relating to banking, securities, futures,  MSBs, jewelers, casinos, insurance companies, and credit unions. Industry  officials with whom we spoke generally were positive about FinCEN’s  outreach to industry, including these events and some of the public  products available on FinCEN’s Web site. Banking industry association  officials felt that FinCEN had been helpful in listening to concerns of the  banking industry. Securities industry officials stated they thought FinCEN  had been very responsive to inquiries from broker-dealers and found some  of FinCEN’s publicly available reports to be very useful, including “SAR  Activity Review: Trends, Tips, and Issues” and mortgage fraud reports.  FinCEN officials presented these reports at events and included a  discussion of how SARs have contributed to law enforcement  investigations. A representative of a futures firm with whom we spoke said  the firm used the SARs publications as part of its training program.  Securities SRO officials said they felt FinCEN was doing an excellent job  of industry outreach, in particular showing the industry how BSA data  filings were used effectively to prosecute money laundering and other  financial crimes.
In January 2008, FinCEN’s Office of the Director—with participation from  RPPD, the Analysis and Liaison Division, the Technology Solutions and  Services Division, and the Office of Chief Counsel—began a new outreach  program to the financial community. By developing a better understanding  of the needs and operations of institutions, FinCEN officials suggested  that the agency will be in a better position to help institutions effectively  operate BSA/AML programs. The outreach program’s goals include  learning how institutions’ BSA/AML programs and analytical units operate.  The first stage of the outreach program is targeted to the 15 largest  depository institutions. According to FinCEN, they will expand outreach  to other depository institutions and industry sectors, but have not finalized  the timetable for the later stages of the program.
section_title: FinCEN Has Improved Tracking for Incoming Compliance Referrals; However, Lack of a Process for IRS Referrals Could Impede BSA Compliance Activities
paragraphs: In 2006, FinCEN implemented an automated Case Management System  (CMS) to track its processing of BSA compliance referrals, which replaces  a paper-based system. While its efforts to track referrals have improved,  FinCEN processing times for IRS referrals, combined with IRS’s limited  enforcement authority, may have limited IRS’s BSA compliance activities  among NBFIs.
subsections: section_title: FinCEN Has Improved Its Compliance Referral Tracking System
paragraphs: According to their MOUs with FinCEN, the federal banking regulators,  SEC, and IRS are to inform FinCEN of any significant potential BSA  violations and provide BSA-relevant examination reports. In 2006, FinCEN  implemented an automated system—CMS—to track these BSA  compliance referrals. Prior to CMS, FinCEN tracked BSA compliance  referrals manually through a paper-based system. FinCEN officials stated  that CMS enables RPPD’s Offices of Compliance and Enforcement to track  cases from receipt to final disposition, analyze the data, and produce  management reports. Figure 2 depicts the overall process by which  FinCEN receives and tracks these referrals.
As shown in figure 2, the Office of Compliance receives referrals from  regulators or referrals that are self-reported by institutions and, after  receipt, opens corresponding cases in CMS. These matters are assessed  by compliance specialists who, in making their assessment of each  referral, consider factors such as  the type of violation and number of times it occurred;   whether the violation was systemic or technical;  hether the violation was willful or a result of negligence;  ow long the deficiency existed; and  hether the violation surfaced through self-discovery or an examination.  ompliance staff must complete the initial assessment within 60 days,  C after which the case is reviewed by a compliance project officer, the  c compliance. As part of these assessments, Office of Compliance staff m request additional data analysis from the Office of Regulatory Analysi additional documentation from the institution’s regulator. Federal ba regulator and SEC staff confirmed that FinCEN staff have requested  additional information about their referrals.  ompliance program manager, and, finally, the assistant director of  After a referral is assessed, Office of Compliance management decide  (1) close a case with no  whether to take one of the following actions: action; (2) send a notification letter to the institution indicating that the  regulator informed FinCEN of the matter, and nothing precludes FinCE from further action if FinCEN or the regulator finds that all corrective actions have not been implemented; or (3) present the matter to FinCEN Regulatory Enforcement Committee. FinCEN officials estimated that its  Office of Compliance has forwarded approximately   6 percent of referrals to its Office of Enforcement. The Regulatory  Enforcement Committee consists of compliance and enforcement staff  who review the case and decide whether to forward i Enforcement for further investigation After it is decided that a case be referred to the Office of Enforcement, the case is closed by Office of  Compliance staff in CMS and the Office of Enforcement opens a new  Enforcement case in CMS.  t to the Office of  FinCEN officials said that the fundamentals of the enforcement  investigative process are th referrals. And, as with Compliance staff, Enforcement staff may request  additional data analysis or documentation when making their dec isions.  They document their investigation in a recommendation memorand the Assistant Director of the Office of Enforcement. After the assistant  director has reviewed the case, Enforcement staff contact the referring  agency to discuss the matter. If no action is warranted, Enforcement  e same, regardless of the source of the  um to  closes the case. If a CMP is warranted, Enforcement issues a charging  letter to the financial institution. The financial institution is required to  respond in writing within a specified period (usually 30 days from the of the letter). The assistant director and an enforcement specialist thenreview the financial institution’s written response to determine whether proceed with a CMP negotiation meeting or close the matter with an  alternative action, such as a warning letter, or no action. FinCEN  Enforcement officials said that if a warning letter is issued, it will be  routed internally for approval through the Associate Director of RPPD a copy will be sent to the relevant regulator. FinCEN’s Director ite an October 2008 speech that FinCEN considers enforcement actions o when a financial institution exhibits a systemic breakdown in BSA  compliance that results in significant violations of its BSA obligations.  Table 10 shows the number of referrals RPPD received during fiscal years  2006 though 2008, the number of cases closed within the Office of  Compliance and Enforcement, and average processing times.
section_title: Lack of Agreed-upon Process That Facilitates Communication about Processing IRS Referrals Could Delay Timely Feedback to NBFIs
paragraphs: According to IRS officials, long delays in processing referrals and a lack  an agreement on time frames have limited IRS’s BSA compliance activitie among NBFIs. Unlike the federal financial regulators that have  independent enforcement authority to issue informal and formal  enforcement actions, IRS officials can send only a Letter 1112 to an  institution, which includes a statement that a copy of their report is  of  s  required to be sent to FinCEN and that FinCEN will determine if penalties  under BSA are to be imposed (see discussion in previous section).  Therefore, when IRS finds an NBFI with significant BSA deficiencies, it  must refer the case to FinCEN for further action. In fiscal years 2006— 2008, IRS sent approximately 50 referrals to FinCEN. After a referral is  made to FinCEN, IRS officials said they do not conduct a follow-up visit  with the institution to determine if corrective action has been taken until  FinCEN makes a determination on the referral, as they do not want t any actions that might negatively affect a potential FinCEN enforcement  action.
IRS officials believe FinCEN’s response time is too long. FinCEN officialsstated that IRS referrals often require follow up for additional information or supporting documentation which affects processing times. As noted in  table 10 above, FinCEN’s average processing time for all referrals in fiscal year 200 8 was 208 days in its Office of Compliance and an additional 277  days if a case was referred to its Office of Enforcement. IRS and FinCEN  officials met in early 2008 to discuss processing times and what  information an IRS referral should contain. IRS officials said they have  seen progress in the last several months, with more IRS referrals being  processed. Although IRS officials stated that they would like an agreement  with FinCEN on referral processing times, no formal agreement has been  negotiated. FinCEN officials said that they do not have established time  frames for responding to referrals because response time often v depending on the thoroughness of the referral and the need for follow u with the examiner. They said that processing of referrals also depends o interagency coordination. For example, law enforcement authorities might  ask FinCEN to refrain from advancing certain cases because of pending  criminal investigations. While FinCEN and IRS recently have been meetin more frequently to discuss IRS referrals, no formal agreed-upon proces exists to address IRS referral issues and provide more timely feedback to  IRS-examined institutions on their AML efforts. The lack of an agreed- upon process for handling referrals, combined with IRS’s inability to take  certain enforcement actions on its own, may result in these institutions  s  continuing to operate without correction, potentially remaining out of  compliance with BSA.
section_title: MOUs Have Improved Coordination with Federal Banking Regulators and SEC; and FinCEN and CFTC Recently Signed an MOU
paragraphs: FinCEN officials have increased the number of information-sharing MOUs  with regulatory agencies, which has improved coordination of  enforcement actions and BSA data reporting for the banking and secur industries. FinCEN officials said that through the information-sharing  MOUs they made progress in developing their relationships with the  federal banking regulators, SEC, and IRS. Since our April 2006 report,  FinCEN had implemented an MOU with SEC (in December 2006), and as  of October 2008, established MOUs with 46 state agencies. After several  years of drafting, FinCEN and CFTC finalized information-sharing and  data-access MOUs in January 2009.
subsections: section_title: Federal Banking Regulators and FinCEN Reported That MOUs Resulted in Improved Processes for and Coordination of BSA Reporting and Enforcement
paragraphs: FinCEN officials said that the MOU process significantly increased the level of information sharing with the federal banking regulators since its  implementation in 2004. FinCEN officials also said that the federal banki regulators made good faith efforts to comply with the MOU and provide FinCEN with reports on time. Officials from most federal banking  regulators stated that their 2004 MOU significantly strengthened  interaction with FinCEN and provided structure for coordination on  enforcement actions and information sharing. In addition, FinCEN’s  Director together with Treasury’s Under Secretary for Terrorism and  Financial Intelligence meets quarterly with the principals of the five  federal banking regulators to discuss coordination and BSA admini for the industry.
While federal banking regulator officials emphasized that they may ta enforcement actions independent of FinCEN under their own authorit they ensure that FinCEN is aware of these actions as agreed upon in  the  MOU with FinCEN. Federal Reserve officials said that such information  sharing generally issues that are resolved through informal and formal enforcement actions.  They explained that when taking an informal action—such as a  commitment letter or MOU—they provide notice to FinCEN. OTS officials   involves referral of all BSA/AML-related examination  said they have quarterly meetings with FinCEN during which they discuss any BSA-related informal or formal actions, as well as any related matter Moreover, federal banking regulators said they make FinCEN aware of  formal actions, such as CMPs or written agreements, well in advance of  when the actions will be taken. For example, if the regulators ar impose a CMP, they will inform FinCEN early enough to ensure the  process is fully coordinated. Federal Reserve officials said that since the  s.  e going to  2004 MOU, they imposed all BSA/AML-related CMPs concurrently with  FinCEN penalties. NCUA officials also said they make FinCEN aware of  informal and formal actions, and would coordinate with FinCEN prior to  the issuance of a CMP, if necessary. OCC officials said they also  coordinate any CMPs with FinCEN and that in recent years FinCEN has  been much quicker in assessing CMPs in conjunction with OCC. They  cited a case prior to the implementation of the MOU—the Riggs Bank  case—during which they said they had to wait more than a year to issue a  CMP in coordination with FinCEN. FDIC and OTS also noted they have  worked closely with FinCEN in the past few years on the development of  BSA/AML-related enforcement actions against several institutions. (App.  III contains examples of BSA/AML-related enforcement actions.)
Several federal banking regulators also cited their 2004 MOU with FinCEN  as beneficial in terms of improving agencies’ internal processes for  tracking violations and enforcement actions. Some federal banking  regulator officials said that as part of responding to the information- sharing requirement of the MOU (that is, providing FinCEN with quarterly  BSA examination, violation, and enforcement data), they established  centralized, automated data collection programs that have improved the  quality of their BSA examination data. For instance, FDIC officials said  their agency internally standardized the processes for collecting BSA data  as a result of the MOU. Federal Reserve officials also reported that  enhancements to the agency’s data management system have streamlined  the information it gathers for FinCEN under the MOU.
While federal banking regulators have made improvements in their  systems for collecting and reporting BSA/AML-related data, differences  remain in how they cite violations. In our 2006 report, we found that federal banking regulators were using different terminology to classify  BSA noncompliance and recommended that FinCEN an d the federal  banking regulators discuss the feasibility of developing a uniform  classification system. Since our report, FinCEN and the federal banking regulators established an interagency working group that is reviewing  guidance relating to the citing of BSA violations and is considering  additional guidance on citing systemic versus technical AML violation One federal banking regulator stated that while BSA/AML violation  is  generally comparable, federal banking regulators have different definition for the same terms. However, to implement their MOU, FinCEN official said that they discussed what a “significant violation” means and tha came to agreement (see previous discussion).  s.
section_title: FinCEN’s MOU with SEC Has Improved Information Sharing
paragraphs: SEC and FinCEN staff stated that their December 2006 MOU had been  beneficial overall, although it is still in the relatively early stages of  implementation. Pursuant to their MOU, SEC shares examination findings  with FinCEN after a significant BSA deficiency  is found. For enforcement  actions, SEC provides notice to FinCEN prior to the action becoming  public. In addition, SEC receives information from the SROs about  BSA/AML-related significant deficiencies or potential enforcement a and provides that information to FinCEN. SEC and FinCEN staff said the  MOU is still in the early stages of implementation and SEC and FinCEN  recently met and reached agreement on steps to further coordination.
SEC staff also said that its agency’s MOU with FinCEN has provided a  framework for the quarterly collection and reporting of BSA/AML  examination, violation, and enforcement action data. While SEC staff  stated they had provided FinCEN with data prior to the MOU, it was on a  more limited basis. Prior to the MOU, SEC cited BSA violations under  provisions of the USA PATRIOT Act. Under the MOU, SEC cites BSA,  which allows for more specific citations. As a result, under the MOU, SEC  provides additional examination information regarding BSA violation  categories and subcategories. For example, SEC previously would cite a  violation relating to CIPs under Section 326 of the USA PATRIOT Act.  Because of the MOU, SEC can determine which of the multiple  subcategories of BSA it may cite for deficiencies in a firm’s CIP. (See table  3 earlier for these data.)
section_title: FinCEN and CFTC Recently Signed an MOU, without Which the Agencies Engaged in Limited Information Sharing
paragraphs: CFTC, the last federal functional regulator to sign an information-sharing  MOU with FinCEN, had no agreed-upon formal mechanism by which to  coordinate or share information with FinCEN until the MOU was finalized  in January 2009. CFTC officials stated they approached FinCEN about  developing an MOU in fall 2004. CFTC and FinCEN cited delays on the  part of both parties in moving forward with the MOU.
In fall 2008, CFTC officials said that they developed standard procedure for obtaining BSA/AML examination information from i anticipation of the MOU’s finalization. Specifically, CFTC developed  templates that identify the episodic, quarterly, and annual report data that will be required to be reported under the MOU and already had rec reports from its SROs as of fall 2008. Previously, CFTC did not compieived  le  BSA/AML examination statistics, including information on the types of  violations cited. Further, FinCEN officials said that CFTC’s SROs have no provided their examination modules and procedures to FinCEN but theyintended to do so after an MOU with CFTC is finalized.
Without an MOU in place, CFTC’s and FinCEN’s abilities to evaluate  BSA/AML compliance in the futures industry were limited. For example,  without examination procedures and data, similar to that provided by  other regulators, FinCEN was not able to evaluate the extent to whichBSA/AML regulations were being examined consistently in the futures  industry in relation to other sectors. Further, without such information FinCEN and CFTC were not able to jointly determine areas of BSA  compliance weakness and better target guidance or outreach efforts.  According to best practices for collaboration, federal agencies engaged i collaborative efforts should create the means to monitor, evaluate, a report their efforts. FinCEN and CFTC officials recognized the benefit an MOU and developed information-sharing and data access MOUs (see  later discussion on data access) that were completed in January 2009.
section_title: IRS and FinCEN Are Discussing Methods to Improve Coordination under Their MOU
paragraphs: While some improvements have been made, FinCEN and IRS disagree on aspects of their MOU and are discussing methods to improve coordinat IRS officials said they asked to renegotiate the terms of the MOU as they  said that receive very little benefit from their MOU with FinCEN but that  FinCEN has declined, saying the MOU is only 3 years old. However,  FinCEN officials said they are in frequent communication with IRS  regarding the operation of their MOU and provided documentation of  some of these meetings. IRS officials said they believe some of the  information they are asked to collect and provide under the MOU is of  little use to FinCEN. For example, IRS officials did not think FinCEN  ion. made use of IRS’s reports of the numbers of Form 8300 and Report of  Foreign Bank Account examinations and violations.
According to IRS officials, FinCEN has not held a formal meeting with IRS  to discuss the implementation of the MOU, as required by the MOU.  However, FinCEN officials stated they have frequent meetings with IRS  staff on improving various aspects of BSA administration and information- sharing processes under the MOU. For example, due to recent meetings  with FinCEN, IRS officials said that FinCEN improved its time frames for  providing responses in cases when IRS officials send FinCEN technical  questions they have about BSA compliance in their supervised entities.
section_title: FinCEN Has Taken Steps to Assess Effectiveness of MOUs
paragraphs: FinCEN officials said that in creating their 2008–2012 strategic plan, they revised goals and performance measures to respond to an assessment and  recommendations from the Office of Management and Budget. For fiscal  year 2006, the Office of Management and Budget rated Treasury’s BSA  administration as “results not demonstrated,” and FinCEN received low  ratings for developing outcome-based performance measures and  achieving program results. In fiscal year 2007, a FinCEN working group  examined what would constitute meaningful performance measure s for  the BSA program.
The working group measures how effectively MOU holders believe their MOUs facilitate  information exchange. In 2008, FinCEN completed a survey of cust perceptions of the services it provides to the federal and state agencie with which it has information-sharing MOUs. Using results from multiple  survey questions, FinCEN staff stated they created a public performance developed an MOU compliance metric, which  measure and calculated that 64 percent of MOU holders surveyed found  FinCEN’s information sharing valuable in improving regulatory  consistency and compliance in the financial system. FinCEN has set a  goal of increasing results for this measure by 2 percentage points annually.  Through the survey, FinCEN officials said they also obtained 26 written  comments, 14 of which offered suggestions for improving information- sharing MOUs (for example, by providing more communication and  feedback).
section_title: FinCEN Has Been Improving Analytical Products; However, Lack of Direct Electronic Access to BSA Data May Limit Compliance Activities
paragraphs: FinCEN has taken steps to improve analytical products for regulators to  assist them with their BSA/AML compliance efforts and has been  discussing additional products. While some regulators have direct  electronic access to BSA data, others have access only through other  agencies. For example, FINRA conducts the vast majority of broker-dealer  examinations and does not have direct electronic access to BSA data;  instead, it must go through FinCEN or SEC to obtain data. FinCEN  officials said they finalized a regulatory data-access template in July 2008  and have begun providing additional state regulators with direct electronic  access, and anticipate providing expanded access to the federal financial  regulators. A FinCEN official said that they are working on data-access  MOUs for SROs.
subsections: section_title: FinCEN Has Provided More BSA Data Analyses and Has Been Discussing Additional Products with Regulators
paragraphs: Under their information-sharing MOUs, FinCEN is to provide analytical  products to regulators. As it collects and manages all BSA-related data,  FinCEN is in an optimal position to produce analytical products that  assess BSA-related issues within and among financial sectors and  regulators. FinCEN classifies the analytical reports it produces for its  stakeholders into two categories: reactive and proactive. As discussed  earlier, FinCEN conducts targeted financial institution analyses for  regulators at their request. These analyses are considered reactive reports.  As of September 2008, FinCEN’s proactive reports included strategic BSA  data assessments, “By the Numbers” reports (such as its SAR reports),  state-specific BSA data profiles, and reports of possible unregistered and  unlicensed MSBs (produced for IRS).
FinCEN stated that the issues for which it chooses to conduct “strategic  BSA data assessments” vary. For example, FinCEN officials said it  produced a residential real estate assessment after it produced an initial  report on commercial real estate as a possible venue for money  laundering. FinCEN also conducted an assessment of mortgage fraud after  its Office of Regulatory Analysis observed a spike in SAR filings related to  mortgage loan fraud. FinCEN officials said that it takes about 4-6 months  to produce such assessments, but that they expect this time would be  significantly shortened after FinCEN’s planned modernization of the BSA  database. While the reports are not produced on a regular schedule,  FinCEN officials said that it has at least one assessment underway at all  times.
FinCEN also biannually produces “By the Numbers” public reports that  compile numerical data from SARs and supplement the “SAR Activity  Review—Tips, Trends, and Issues” and state-specific BSA data profiles  showing analysis of BSA filing trends within the 46 states agencies with  which FinCEN has information-sharing MOUs. FinCEN began producing  “State BSA Data Profiles” in May 2007 and said it had received input and  some positive feedback from state and federal banking regulators.  Moreover, some industry officials told us that these publicly available SAR  reviews were very useful components of FinCEN’s outreach efforts.
In 2008, FinCEN, after discussions with SEC, began providing SEC with  reports of securities-related SARs filed by depository institutions. The  purpose of these reports is to alert SEC to any possible securities  violations observed by depository institutions. To compile the reports,  FinCEN analysts search on key terms provided by SEC. SEC staff said they  have found these downloads very useful to their general enforcement and  examination programs.
Approximately each quarter since June 2006, FinCEN has issued reports  on possible unregistered and unlicensed MSBs (found by reviewing SARs  filed by depository institutions). IRS officials have used the information to  contact and register previously unregistered MSBs. IRS officials also  telephone the unregistered MSBs to make sure the entities understand  their BSA obligations.
Despite the provision of more analyses, most MOU holders with whom we  spoke thought different or additional FinCEN analysis would be useful for  their BSA compliance activities and have been discussing such products  with FinCEN. In particular, some federal banking regulators said that the  summary reports of numbers of examinations, violations, and enforcement  actions among depository institutions that FinCEN provides them on a  quarterly basis were of little use as they were compilations of data the  federal banking regulators had given FinCEN. Although FinCEN provides  analyses of issues after reviewing data and reports, federal banking  regulator officials thought it would be more beneficial to receive analytical  information to assist them in examination preplanning and scoping  processes, which would allow them to better focus their BSA/AML  resources and efforts. Federal banking regulators have cited requests  regarding additional analysis made to FinCEN through the FFIEC  BSA/AML working group. For instance, several federal banking regulators  have requested state, regional, and national analysis of CTRs and SARs by  type of institution, and additional analysis of MSBs and 314(a) hits. As  they have limited access to BSA data, federal banking regulators are  unable to conduct these analyses themselves. (We discuss data access  issues in the following section.) IRS officials said they wanted reports  similar to what FinCEN provides to law enforcement, such as analyses of  potential money laundering regarding the U.S. southwest border. IRS  officials said such reports would be helpful in determining where to  allocate the agency’s examination resources. FinCEN officials said that  they provide IRS (along with the federal banking regulators) a  consolidated package containing the annual BSA data profiles for all states  and certain U.S. territories. SEC staff they have had at least two  discussions with FinCEN staff about analytic products that FinCEN could  provide and they expected further discussions would take place.
FinCEN officials stated they needed to concentrate on providing products  that could benefit multiple agencies to ensure they were using FinCEN  resources effectively. As part of its efficiency and effectiveness initiative,  FinCEN said it has identified ways it could increase its analytical support  to regulators by providing products with useful information on macro-level  risks. FinCEN officials said they are incorporating steps into its  information technology modernization plans that will make the  development of these products more feasible. FinCEN said it has been  developing analyses of 314(a) hits to better inform regulators. In addition,  one federal banking regulator and FinCEN have agreed to different  approaches for obtaining supplemental BSA data analysis. In fall 2008,  FDIC officials completed arrangements to have an FDIC analyst work at  FinCEN on a part-time basis and that analyst began work with the Office  of Regulatory Analysis. FinCEN officials said that they are open to  detailees from more regulators as it would also help them understand  better which types of analysis are more useful to the regulators.
section_title: Regulators Have Different Levels of Direct Access to BSA Data, which Inhibits Some Compliance Activities
paragraphs: With the exception of IRS, which maintains and stores all BSA information  filed, FinCEN has developed data-access MOUs with some financial  regulators to provide them with direct electronic access to BSA data.  However, the level of access across financial regulators is inconsistent and  has inhibited agencies’ compliance activities. For example, FinCEN  provides the federal banking regulators with access to CTRs for  depository institutions, SARs for depository institutions, and other  reports. Federal banking regulators access this information through a  secure system but are limited to downloading a certain number of records  at a time. Officials from some federal banking regulators said that access  to SARs or CTRs filed by institutions other than depository institutions  would be useful. One official explained that some institutions, while  regulated by others, can be affiliated with their supervised institutions. For  example, an MSB may file a SAR on a bank’s customer, but the federal  banking regulator does not have access to the SAR filed by the MSB.  Unlike other federal banking regulators, OCC officials arranged with  FinCEN to receive SAR data directly. For about 5 years, OCC has received  a monthly compact disc with SAR data for the banks it regulates. With  these data, OCC created the “SAR Data Mart,” which its staff use to take  action against unlawful activity committed by depository institution  insiders and for evaluating operational risk. OCC staff have found the  ability to conduct is own analyses very useful.
SEC staff said they use their direct access to BSA data to review  approximately 100 to 150 SARs for securities and futures firms daily.  Furthermore, SEC staff said their access to these SARs has expanded their  SAR review activities and enhanced SEC’s enforcement and examination  programs.
In contrast, futures and securities SROs (including FINRA) and some state  agencies that conduct BSA/AML examinations currently do not have direct  electronic access to BSA data. Some of these regulators’ requests for such  access have been pending for several years. FINRA—which conducts the  majority of broker-dealer examinations (more than 2,000 in fiscal year  2008)—does not have direct electronic access to BSA data and must  request SARs through SEC and FinCEN. With direct electronic access,  FINRA and state agency officials told us they could more effectively risk  scope their examination processes. Risk scoping by regulators may  include reviewing the number of SARs and CTRs filed by institutions  under their supervision to identify areas within an institution’s program or  which institutions among their supervised entities on which to  concentrate, enabling regulators to better plan their examinations and  target their resources accordingly. As discussed above, federal banking  regulators use BSA data to risk scope their examinations. Further, due to  the large number of examinations they conduct, FINRA officials said it  would strain SEC’s resources if FINRA asked SEC staff for access to every  SAR filed by the institution under review. Therefore, FINRA staff request  SARs from FinCEN primarily when FINRA staff suspect a firm may not  have filed all the SARs it says it filed. FINRA officials said they often  experienced delays in receiving the information. They also said they  started to develop an MOU with FinCEN in 2002; however, the last time  FINRA discussed data access with FinCEN was in March 2006.
CFTC is the last federal functional regulator to be provided direct  electronic access to the BSA database. CFTC officials said that they made  a formal request for direct access to BSA data in 2005. FinCEN officials  said that, until recently, FinCEN and CFTC had not agreed on the terms of  an electronic access MOU for BSA data. FinCEN and CFTC signed a data- access MOU concurrently with their information-sharing MOU in January  2009. Previously, if CFTC wanted BSA information, it had to make case-by- case requests to FinCEN. Similar to FINRA, CFTC officials said while  FinCEN responded quickly to emergency BSA data requests,  nonemergency requests could take much longer. CFTC officials said that  the data-access MOU will permit CFTC to make BSA database inquiries in  certain circumstances on behalf of an SRO. They said that they recognize  the unique and highly sensitive nature of BSA data and providing the SROs  with direct access to BSA data presents certain legal and regulatory  oversight issues.
FinCEN explained it has been conducting a comprehensive evaluation of  data access issues. In September 2008, FinCEN completed a bureau-wide  initiative to better define the types of regulatory agencies to which it will  provide electronic BSA data access and the criteria and processes for  evaluating data access requests. FinCEN determined it would consider  requests from agencies that examine for BSA compliance; supervise a  financial institution for safety and soundness or financial responsibility;  issue licenses or charters to financial institutions; or administer or enforce  laws, regulations, or rules affecting financial institutions or markets. In  evaluating these requests, FinCEN officials said that staff look at the  requester’s regulatory authorities, ability to protect sensitive BSA data,  and ability to utilize confidential information. But they said that SROs  present unique issues because of their status as private actors, rather than  governmental authorities. Although FinCEN said it anticipates providing  SROs with access to appropriate data, their nongovernmental status  requires FinCEN to contemplate appropriate access restrictions. FinCEN  officials said they finalized a regulatory data-access template in July 2008  and have begun providing additional state regulators with direct electronic  access, and anticipate providing expanded access to the federal financial  regulators. A FinCEN official said that they are working on data-access  MOUs for SROs.
Without electronic access to BSA data, some regulators cannot effectively  scope risks for examinations, affecting their ability to efficiently plan  examinations and target limited resources to areas of greatest risk. In  addition, without direct access, in accordance with their examination  procedures they cannot verify information that institutions are reporting  on their BSA filings without requesting this information from FinCEN or  another regulator who has access, thereby straining already limited  resources. For example, as discussed above, to obtain access to some  SARs, some regulators (such as FINRA) must contact FinCEN for access,  further expending FinCEN’s and their limited resources.
section_title: Conclusions
paragraphs: Through the USA PATRIOT Act, more activities of a larger number of  financial institutions have come under the umbrella of U.S. anti-money  laundering efforts. As the BSA regulation framework has expanded, it also  has become more complex—making it all the more important that FinCEN  and the regulators establish effective communication and information  exchanges to achieve their common goals. While the regulators take  different approaches to examination and enforcement within their  jurisdictions, they all have responsibilities in the BSA/AML regulatory  framework. Additional AML legislation has increased the number of  financial institutions that have come under the scope of BSA, as well as  regulators’ interactions on these issues within and across their respective  financial sectors. At the time of our 2006 report, the federal banking  regulators and FinCEN already had achieved agreement on how to address  some key aspects of BSA compliance and enforcement and developed a  common examination manual.
Since that report, FinCEN and the regulators have made additional  progress in ensuring the soundness of the current compliance and  enforcement framework. While many improvements in the coordination  among stakeholders—FinCEN, regulators, law enforcement, and the  industries being regulated—have occurred, other working relationships  among the stakeholders are not as efficient and effective as they could be.  IRS has not fully leveraged its resources with those of state regulators to  conduct examinations of MSBs. As a result of IRS not sharing its  examination schedules with state agencies, state agency officials told us  they sometimes have scheduled examinations shortly after IRS had  completed examinations on the same institutions, subjecting them to  duplicative monitoring. With approximately 200,000 MSBs in the United  States, better coordination of examination scheduling between IRS and its  state agency partners would both better leverage limited government  resources and minimize the burden placed on those being regulated.  Additionally, ongoing meetings such as those of BSAAG provide for some  exchange of information, but some important regulatory issues cannot be  discussed at meetings at which industry is present. While it is useful to  have forums in which the regulators and the regulated exchange  information, the sensitive nature of some BSA issues and the nonpublic  nature of some examination modules suggest that an additional forum for  regular information exchange among all the regulators is called for.  Whether it is coordination of efforts between IRS and state regulators or  among federal regulators, opening additional avenues for collaboration  can (1) facilitate the exchange of best practices and better leverage limited  regulatory resources, (2) minimize the regulatory burden on those being  regulated, and (3) most importantly, see that the critical concerns  embodied in BSA legislation are efficiently and effectively carried out.
FinCEN has taken many significant steps to improve execution of its BSA  administrative and coordination responsibilities, but could make  improvements in three areas: sharing information with CFTC, improving  communication on IRS referrals and ensuring timely feedback to IRS- examined institutions, and reconciling outstanding data access issues.  FinCEN also serves as the BSA data manager and provides the regulators  with access to critical BSA data related to their supervised entities. With  these data, regulators are able to scope risks for their examinations, better  target their resources, and independently verify BSA data filings. However,  CFTC only received electronic access in January 2009, and securities and  futures SROs, and some state agencies do not yet have electronic access to  BSA data. With today’s rapidly changing financial markets and the  relationship of the futures industry to other sectors of the financial  markets, it is especially important that SROs receive electronic access to  BSA data to facilitate their examinations. Furthermore, IRS is hampered in  carrying out its BSA-related compliance responsibilities because of  uncertainties about when FinCEN will take action on IRS’s referrals. Since  IRS does not have enforcement authority in this area, it is important that  IRS and FinCEN develop a process that facilitates communication on IRS  referrals. Without timely feedback, MSBs may be allowed to continue  operating in violation of BSA statutes. Finally, delays in completing data- access agreements present obstacles to some regulators attempting to  carry out their BSA-related responsibilities. While FinCEN is justified in its  concerns about sharing very sensitive information, the delay in  establishing information-sharing and data-access MOUs with CFTC, and  the failure to establish data access MOUs with SROs and some states that  also have important BSA-related responsibilities, presents a different set of  potential problems, such as incomplete risk-scoping of examinations.  While we commend FinCEN and CFTC for finalizing their MOUs, the  benefits of the agreements will take some time to be realized. Until then,  the potential ramifications include less assurance on the part of regulators  that these financial institutions are complying fully with the BSA. Taking  steps to resolve these areas of concern could provide tangible benefits in  the BSA-related efforts of the regulators and build on recent  improvements that FinCEN has made in its administrative and  coordination responsibilities.
section_title: Recommendations for Executive Action
paragraphs: To reduce the potential for duplicative efforts and better leverage limited  examination resources, we recommend that the Commissioner of IRS  work with state agencies to develop a process by which to coordinate  MSB examination schedules between IRS and state agencies that conduct  BSA examinations of MSBs.
Further, to build on improvements made in examination processes vital to  ensuring BSA compliance, we recommend that the heads of FinCEN, the  Federal Reserve, FDIC, OTS, OCC, NCUA, SEC, CFTC, and IRS direct the  appropriate staff to consider developing or using an existing process to  share and discuss information on BSA/AML examination procedures and  general trends regularly in a nonpublic setting. We recommend that the  heads of SEC and CFTC consider including the SROs that conduct BSA  examinations.
To improve its efforts to administer BSA, we recommend that the Director  of FinCEN expeditiously take the following two actions:    Work with the Commissioner of IRS to establish a mutually agreed-upon  process that facilitates communication on IRS referrals and ensures timely  feedback to IRS-examined institutions.
Finalize data-access MOUs with SROs conducting BSA examinations, and  states agencies conducting AML examinations that currently have no  direct access to BSA data.
section_title: Agency Comments and Our Evaluation
paragraphs: We provided a draft of this report to the heads of the Departments of  Justice and the Treasury; the Federal Reserve, FDIC, NCUA, OCC, OTS,  IRS, SEC, and CFTC. We received written comments from FinCEN, IRS,  and all the financial regulators. These comments are summarized below  and reprinted in appendixes IV-XII. All of the agencies provided technical  comments, which we incorporated into this report, where appropriate.
In its comments, IRS agreed with our recommendation that the IRS  commissioner work with state agencies to develop a process by which to  coordinate BSA examination schedules. The agency said that actions to  address our recommendation already were underway.
In their written responses, all of the agencies agreed with our  recommendation that they consider developing a mechanism or using an  existing process to conduct regular, nonpublic discussions of BSA  examination procedures and general trends to better ensure consistency in  the application of BSA. In technical comments, some agencies asked that  we be more specific about which component of their agencies should  participate in and conduct these discussions. We modified the  recommendation language to clarify that the heads of the agencies should  direct appropriate staff to undertake these actions. The Federal Reserve  commented that such discussions could build on improvements already  made in examination processes and that regular discussion of examination  procedures and general compliance trends could be beneficial. FDIC  agreed that periodic meetings with all federal agencies responsible for  BSA compliance could promote consistency and coordination in  examination and enforcement approaches and help reduce regulatory  burden. OCC commented that a number of groups and processes already  existed for sharing information and collaboration and that they would  continue to participate in these initiatives and look for opportunities to  share their practices and observations. OTS commented that that they  would collaborate and that the federal banking agencies and FinCEN have  established a number of formal committees and working groups to  promote collaboration on BSA issues. SEC agreed that the regulators  would benefit from the development of such a mechanism and noted that  it planned to attend a meeting in which FinCEN was planning to discuss  possible methods for achieving this goal. CFTC commented that it  supports all efforts to increase cooperation among regulators in the BSA  area and that it would be pleased to participate in discussions that would  allow the agency to share experiences and expertise in developing and  implementing BSA examination procedures.
In its comments, FinCEN said it concurred with the intent of our  recommendations, particularly in regard to expanding information sharing  with authorized stakeholders, and hoped to be situated in the future to  meet them. The draft report that we sent to the agencies for comment  contained a recommendation that FinCEN finalize information-sharing and  data-access MOUs with CFTC. These MOUs were signed on January 15,  2009, so we have removed the recommendation from the final report. In its  comments, CFTC noted that the MOUs had been signed and said that it  believed these two agreements would enhance CFTC’s ability to  effectively implement its BSA examination responsibilities. Through  discussions with FinCEN officials and FinCEN technical comments,  FinCEN provided us with additional information and data about our draft  recommendation on IRS referrals. We subsequently broadened the  recommendation language to clarify that FinCEN should work with IRS to  develop a process to facilitate communication on referrals and ensure  timely feedback to IRS-examined institutions. FinCEN and IRS said they  agreed with this modification. Finally, in its comments, SEC also  supported our recommendation that FinCEN finalize data-access MOUs  with SROs that conduct BSA examinations. SEC noted its view that direct  access to BSA data would permit FINRA to more effectively use its AML  resources to take a more risk-based approach to identifying firms and  areas within a firm’s AML program that required examination.
As agreed with your office, unless you publicly announce the contents of  this report earlier, we plan no further distribution of this report until 30  days from the report date. At that time, we will send copies to interested  congressional committees, Treasury, FinCEN, Federal Reserve, FDIC,  OCC, OTS, NCUA, SEC, CFTC, IRS, and Justice. The report also will be  available at no charge on the GAO Web site at http://www.gao.gov.
If you or you staff have questions about this report, please contact me at  (202) 512–8678 or edwardsj@gao.gov. Contact points for our Offices of  Congressional Relations and Public Affairs may be found on the last page  of this report. GAO staff who made major contributions to this report are  listed in appendix XIII.
section_title: Appendix I: Objectives, Scope and Methodology
paragraphs: Our objectives were to (1) describe how Bank Secrecy Act (BSA)  compliance and enforcement efforts are distributed among federal and  state regulators, self-regulatory organizations (SRO), and the Financial  Crimes Enforcement Network (FinCEN); (2) describe how federal  agencies other than FinCEN are implementing their BSA activities and  evaluate their coordination efforts; and (3) evaluate how FinCEN is  executing its BSA responsibilities and coordinating BSA efforts among the  various agencies.
To describe how BSA compliance and enforcement efforts are distributed  among federal regulators, SRO, and FinCEN, we reviewed and analyzed  authorities established by BSA, the USA PATRIOT Act, and other relevant  federal financial and anti-money laundering (AML) legislation. We also  reviewed prior GAO and Department of the Treasury (Treasury) Inspector  General reports on this issue. In addition, to better understand how  BSA/AML authorities were delegated and interrelate with other financial  regulatory authorities, we interviewed officials from the federal agencies  included in the BSA/AML compliance and enforcement regulatory  framework—FinCEN; the federal banking regulators: the Board of  Governors of the Federal Reserve System (Federal Reserve), Federal  Deposit Insurance Corporation (FDIC), Office of the Comptroller of the  Currency (OCC), Office of Thrift Supervision (OTS), and National Credit  Union Administration (NCUA); Securities and Exchange Commission  (SEC), Commodity Futures Trading Commission (CFTC), and the SROs  they regulate; Internal Revenue Service (IRS); and Department of Justice  (Justice).
To examine how entities with BSA/AML compliance and enforcement  responsibilities implement their BSA activities and evaluate their  coordination efforts, we reviewed prior GAO reports; available BSA/AML  examination manuals and procedures; other related guidance; reports  complied in accordance with FinCEN information-sharing memorandums  of understanding (MOU); and data maintained on the numbers of the  BSA/AML examinations, violations, and enforcement actions taken in the  banking, securities, futures, and IRS-examined industries. Further, we  conducted data reliability assessments of BSA/AML-related data and found  the information to be reliable for the purposes of this report. In addition,  we reviewed quality assurance reviews conducted by the federal banking  regulators of their BSA/AML examinations. We interviewed officials from  all of the federal agencies and their SROs mentioned above and also spoke  with officials from select state financial regulatory agencies to obtain  information on their BSA/AML compliance and enforcement activities and  how these state agencies coordinate with federal agencies. We selected  state regulators to interview on the basis of their geography, the presence  of a High Intensity Financial Crime Area in their state, the size and variety  of the financial sectors present in their state, the existence of a money  services business (MSB) examination program in their state, and whether  they were contacted by GAO for a previous BSA/AML-related GAO report  in 2006.
With respect to the federal banking regulators and their efforts to ensure  BSA compliance among depository institutions, we reviewed the Federal  Financial Institutions Examinations Council (FFIEC) BSA/AML  interagency examination manual, and GAO staff attended 3 days of  training on the manual provided to federal and state bank examiners. We  also reviewed quarterly and annual reports which included data on  examinations, violations, and enforcement actions, as well as information  on staffing and training, that were submitted by the federal banking  regulators to FinCEN per their MOU. We reviewed these reports to assess  whether regulators were in compliance with MOU requirements and to  inform our understanding of their BSA/AML compliance activities. In  addition to meetings with federal banking regulator BSA/AML program  staff, we also held interviews with groups of examiners from each of the  federal banking regulators to discuss the manual and interagency  coordination. We also spoke with a state banking regulatory association  and credit union regulatory association. Further, to obtain industry  perspective, in cooperation with another GAO team looking at the  usefulness of suspicious activity reports (SAR), we interviewed two  banking industry associations and 20 depository institutions on the impact  of the manual and coordination among federal and state banking  regulators.
To select the 20 depository institutions, we grouped the depository  institutions into four categories depending on the numbers of SARs filed in  calendar year 2007. We interviewed representatives from all 5 institutions  that had the largest number of SAR filings in 2007, as well as  representatives from 15 randomly selected institutions. The 15 institutions  represented different categories of SAR filings: small (1-4 SARs filed in  2007), medium (5-88), and large (more than 88—excluding the 5 largest).
To obtain information on the BSA/AML compliance and enforcement  activities of SEC, CFTC, and IRS, we interviewed officials from these  agencies, as well as officials from securities and futures SROs; state  regulatory agencies; securities and futures firms; and securities, futures,  and money transmitter industry associations. We interviewed 8 securities  firms through the auspices of an industry trade association and  interviewed one large and small futures drawn from a list provided by a  futures regulator. In addition, we reviewed available examination modules;  related training guidance; and reports provided to FinCEN by SEC and IRS  in accordance with their information-sharing MOUs that contain data on  BSA/AML examinations, violations, and enforcement actions; as well as  BSA/AML training and staffing information. We obtained and reviewed  similar information from CFTC. To describe Justice’s enforcement actions,  we interviewed Justice officials, analyzed Justice’s enforcement actions,  and reviewed other BSA/AML-related Justice documentation. In order to  evaluate coordination efforts, we compared the practices of these agencies  with best practices outlined in a GAO report evaluating coordination  practices among federal agencies.
To evaluate FinCEN BSA/AML compliance and enforcement efforts, we  collected and reviewed available staffing and performance measurement  data from FinCEN, program assessments, BSA/AML-violation referral data  from its Case Management System (CMS), FinCEN analytical products,  strategic plans and annual reports, and other documentation. We also  assessed the reliability of data provided to us by FinCEN from its CMS and  found it to be reliable for the purposes of this report. In addition, we  reviewed the three surveys FinCEN conducted of users of its Regulatory  Resource Center in 2006, 2007, and 2008 and a fourth survey it conducted  of regulators with which it has information-sharing MOUs. Despite some  potential limitations associated with the surveys, we concluded that the  overall frequencies for survey questions should be sufficiently valid and  reflected the overall opinions of those surveyed. FinCEN officials also told  us that information-sharing MOU survey respondents might have, in some  cases, been providing responses to reflect their experiences with data- access MOUs. Further, we interviewed FinCEN officials from the Office of  the Director, Management Programs Division, the Analysis and Liaison  Division, and the Regulatory Policy and Programs Division (RPPD). We  conducted interviews with staff from each of the offices within RPPD. In  addition, we conducted interviews with officials from the federal banking  regulators, SEC, CFTC, securities and futures SROs, IRS, and industry to  discuss FinCEN’s efforts.
We conducted this performance audit in Washington, D.C., New York, New  York, and Chicago, Illinois, from October 2007 to February 2009 in  accordance with generally accepted government auditing standards. Those  standards require that we plan and perform the audit to obtain sufficient,  appropriate evidence to provide a reasonable basis for our findings and  conclusions based on our audit objectives. We believe that the evidence  obtained provides a reasonable basis for our findings and conclusions  based on our audit objectives.
section_title: Appendix II: Overview of Federal Agencies Involved in the BSA/AML Framework and Related Resources
paragraphs: This appendix provides an overview of the compliance and enforcement  activities of the federal financial regulators and IRS and provides  information, to the extent it is available, on their BSA-related resources  and training.
subsections: section_title: Overview of Federal Agencies Involved in BSA/AML Compliance and Enforcement
paragraphs: The federal banking regulators (the Board of Governors of the Federal  Reserve System (Federal Reserve), Federal Deposit Insurance Corporation  (FDIC), Office of the Comptroller of the Currency (OCC), Office of Thrift  Supervision (OTS), and National Credit Union Administration (NCUA)),  Securities Exchange Commission (SEC), Commodity Futures Trading  Commission (CFTC), securities and futures self-regulatory organizations  (SRO), and Internal Revenue Service (IRS) play roles in implementing  BSA/AML compliance. The U.S. regulatory system is described as  “functional,” so that financial products or activities are generally regulated  according to their function, no matter who offers the product or  participates in the activity. Below is a discussion of their missions and  how they undertake general compliance and enforcement activities within  their industries.
subsections: section_title: Federal Banking Regulators
paragraphs: Depository institutions can generally determine their regulators by  choosing a particular kind of charter—for example, commercial bank,  thrift, or credit union. These charters may be obtained at the state level or  the national level. While state regulators charter institutions and  participate in oversight of those institutions, all of these institutions have a  primary federal regulator if they have federal deposit insurance. Broadly,  the federal banking regulators that provide oversight for banks are the  Federal Reserve, FDIC, and OCC; thrifts—OTS; and credit unions— NCUA. Banking regulators generally focus on ensuring the safety and  soundness of their supervised institutions. They conduct safety and  soundness examinations on-site to assess an institution’s financial  condition, policies and procedures, and adherence to laws and regulations.  Generally, regulatory agencies perform these examinations every 12 to 18  months, based on the institution’s risk. The Federal Reserve, FDIC, OTS,  and NCUA (but not OCC) alternate or conduct joint safety and soundness  examinations with state regulators, generally using the same examination  procedures. State banking regulators may examine depository institutions  chartered within their jurisdictions.
Federal and state banking regulators may address compliance problems  identified through their examinations by bringing the problem to the  attention of institution management and obtaining a commitment to take  corrective action. When these actions are insufficient or weaknesses  identified are more substantive, regulators may take nonpublic, informal  enforcement actions. Informal actions (which vary among the federal  banking regulators) may include the adoption of resolutions by an  institution’s board of directors, the execution of a memorandums of  understanding between an institution and the regulators, notices of safety  and soundness deficiency for compliance, commitment letters, or  corrective actions to be taken to address regulatory concerns. Informal  actions usually are taken to address violations that are limited in scope  and technical in nature. Federal banking regulators also may take formal  enforcement actions if a depository institution is engaging in unsafe or  unsound practices or has violated a law or regulation. Formal enforcement  actions are public and generally considered more stringent than informal  actions and can address more significant, repeated, or systemic BSA  violations. Formal enforcement actions include cease-and-desist orders,  assessments of civil money penalties (CMP), or supervisory agreements.  These types of actions are enforceable through an administrative process  or injunctive relief in federal district court.
section_title: SEC and Securities SROs
paragraphs: SEC’s mission is to protect investors; maintain fair, orderly, and efficient  securities markets; and facilitate capital formation. SEC regulates the  securities industry in part through oversight of its SROs. SEC, through its  Office of Compliance and Examination (OCIE) shares examination  responsibilities with securities SROs, which include examining for  BSA/AML compliance. OCIE’s routine examinations are conducted  according to a cycle that is based on a registrant’s perceived risk. In  addition to routine examinations, OCIE also may conduct sweep  examinations to probe specific activities of a sample of firms to identify  emerging compliance problems so they can be remedied before becoming  severe or systemic. Third, OCIE conducts cause examinations when it has  reason to believe that something is wrong at a particular firm.
SROs have statutory responsibilities to regulate their own members, and  one SRO—the Financial Industry Regulatory Association (FINRA)— provides oversight of the majority of broker-dealers in the securities  industry. SROs conduct risk-based examinations, which include a BSA  component, of their members to ensure compliance with SRO rules and  federal securities laws. These examinations are conducted on a risk-based  cycle (similar to SEC’s), and no member is examined less frequently than  every 4 years.
Through oversight inspections of the SROs, OCIE evaluates the quality of  the SROs’ oversight in enforcing member compliance. At regular intervals,  OCIE conducts routine inspections of SROs’ key regulatory programs,  such as SRO enforcement, arbitration, and examination programs.  Inspection of enforcement programs typically includes a review of SRO  surveillance programs for identifying potential violations of trading rules  or laws, investigating those potential violations, and disciplining those  who violate the rule or law.
SEC and its SROs also have enforcement divisions that are responsible for  investigating and prosecuting violations of securities laws or regulations  as identified through examinations; referrals from other regulatory  organizations; and tips from firm insiders, the public, and other sources.  For less significant issues, examiners may cite a deficiency for correction  through remedial actions. SEC and SRO examiners conduct exit  interviews with firms, which are usually followed by letters discussing  examination findings. SEC issues deficiency letters that formally identify  compliance failures or internal control weaknesses at a firm. Most  examinations conclude with the firm voluntarily correcting the  compliance problem and stating the specific actions it is taking in its  response to SEC. Potential SEC enforcement sanctions include  disgorgement, CMPs, cease-and-desist orders, and injunctions. When SROs  find evidence of potential violations of securities laws or SRO rules by  their members, they can conduct disciplinary hearings and impose  penalties. These penalties can range from disciplinary letters to the  imposition of monetary fines to expulsion from trading and SRO  membership.
section_title: CFTC and Futures SROs
paragraphs: CFTC’s primary mission is to preserve the integrity of the futures markets  and protect market users and the public from fraud, manipulation, and  abusive practices related to the sale of commodity futures and options.
While CFTC directly performs the market surveillance and enforcement  functions, CFTC carries out its regulatory functions with respect to futures  firms through SROs that act as the primary supervisor for members of the  futures industry. CFTC does not routinely conduct direct examinations of  the institutions that it supervises; instead, it oversees their SROs’—the  National Futures Association (NFA), Chicago Mercantile Exchange, New  York Mercantile Exchange, Chicago Board of Trade, and the Kansas City  Board of Trade—examinations of futures firms. Each futures exchange is  an SRO that governs its floor brokers, traders, and member firms. NFA  also regulates every firm or individual that conducts futures trading  business with public customers. SROs are responsible for establishing and  enforcing rules governing member conduct and trading, providing for the  prevention of market manipulation, ensuring futures industry  professionals meet qualifications, and examining exchange members for  financial soundness and other regulatory purposes. SROs examine their  members for compliance with their rules, including those imposing  BSA/AML requirements. The futures SROs’ examination cycles range from  9 to 18 months for futures commission merchants, but introducing brokers  may have longer examination cycles.
While CTFC does not conduct routine examinations of futures firms, it  provides oversight of futures SROs to ensure that each has an effective  self-regulatory program. CFTC’s Division of Clearing and Intermediary  Oversight conducts periodic, risk-based examinations of an SRO’s  compliance examination program, which may include BSA/AML issues.  During the examination, CFTC reviews the SRO’s documentation of select  examinations and independently performs examinations for the same  periods to compare its results with those of the SRO’s examinations.
SROs may take enforcement actions against any member that is in  violation of member rules and CFTC regulations, which include BSA/AML- related rules. BSA/AML obligations for the futures industry are set forth in  the USA PATRIOT Act, BSA, FinCEN and CTFC regulations, and SRO  member rules. CFTC’s Division of Enforcement investigates and  prosecutes alleged violations of the Commodity Exchange Act and CFTC  regulations, and reviews SRO open investigations and enforcement  actions.
IRS is a bureau within Treasury, with the mission of helping taxpayers  understand and meet their tax responsibilities and ensuring that all  taxpayers comply with tax laws. Unlike others with BSA/AML compliance  responsibilities, IRS does not conduct examinations of compliance with  any legislation other than BSA/AML rules and regulations. FinCEN  delegated BSA examination authority to IRS for any financial institution  not subject to BSA examination by another federal regulator. These  institutions are mainly nonbank financial institutions (NBFI) such as  casinos, some credit unions, credit card operators, and approximately  200,000 money service businesses (MSB), which are the most numerous of  the NBFIs.
IRS’s Small Business/Self-Employed Division, which reports to the Deputy  Commissioner of Services and Employment, conducts BSA compliance  examinations of NBFIs. In 2004, IRS created the Office of BSA/Fraud  within the Small Business/Self-Employed Division to better focus on BSA  examinations of NBFIs. IRS’s BSA program also aims to increase the  number of identified NBFIs, conduct outreach and education to NBFIs,  and refer any NBFIs to the Financial Crimes Enforcement Network  (FinCEN) or IRS Criminal Investigation for civil and criminal enforcement  actions. IRS Criminal Investigation, IRS’s enforcement arm, investigates  individuals and businesses suspected of criminal violations of the Internal  Revenue Code, money laundering and currency crime, and some BSA  laws. IRS Criminal Investigation usually investigates BSA criminal  violations in conjunction with other tax violations. IRS Criminal  Investigation’s first enforcement priority is tax fraud and tax evasion, but  currency reporting and money laundering enforcement also are areas of  emphasis.
section_title: Federal Agencies Generally Incorporate BSA/AML-related Staffing and Training into Overall Compliance Programs, but Some Maintain BSA/AML- dedicated Information on Resources
subsections: section_title: Staffing
paragraphs: The federal banking regulators, SEC, and CFTC incorporate their BSA  activities into their overall compliance programs. However, all the  regulators either track the number of hours spent on BSA/AML issues or  numbers of staff with BSA/AML-related responsibilities. All of the  regulators have staff that examine institutions for BSA/AML compliance  concurrently with their comprehensive safety and soundness compliance  examinations. The points below summarize BSA/AML-specific data (for  2008 where possible) for each regulator (IRS excepted):    Federal Reserve. The Federal Reserve has a BSA/AML Risk Section within  its Division of Banking Supervision and Regulation, which consists of  seven staff who monitor BSA/AML compliance concerns and liaise with  staff from Federal Reserve Banks to provided guidance on BSA/AML  issues. Federal Reserve officials said they also have BSA/AML specialists  located in some Federal Reserve Banks.
FDIC. In 2008, of the 1,680 examiners that conduct safety and soundness  examination (during which a BSA/AML examination is conducted  concurrently), 324 were BSA subject matter experts, and 117 are certified  AML specialist examiners. Further, FDIC officials estimated the agency  devoted 107.4 and 103.5 full-time equivalent positions to BSA/AML  activities in 2006 and 2007, respectively.
OCC. OCC has a Director for BSA/AML Compliance that oversees a staff of  six full-time BSA/AML compliance specialists in its headquarters. From  2005 through 2007, OCC officials estimated that the agency annually  devoted an average of 105 full-time equivalent positions to the BSA, while  in 2008, OCC devoted approximately 86 full-time equivalents.
OTS. In 2008, OTS reported that five Regional Assistant Directors for  Compliance serve as subject matter resources on BSA, in addition to 15  regional compliance specialists, and 2 national office staff that are  dedicated to BSA/AML issues. OTS officials estimated the time its  attorneys devoted to BSA/AML issues as being equivalent to two full-time  positions.
NCUA. As of September 30, 2008, NCUA reported employing 514  examiners, which included 31 examiners designated as consumer  compliance subject matter examiners (which includes BSA/AML issues).  Each of NCUA’s five regional offices has at least one BSA/AML analyst, its  Office of Examination and Insurance has two BSA/AML program officers,  and the Office of General Counsel has two attorneys that focus on BSA  issues.
SEC. SEC has a BSA/AML team comprised of from five to seven OCIE staff  members, from three to five Division of Enforcement staff members, and  three members from the Division of Trading and Markets. The team is  responsible for monitoring its BSA/AML examination program; providing  expertise to regional offices; and maintaining communication with  FinCEN, the SROs, and other regulators on AML issues. Further, SEC  broker-dealer examination staff have an AML working group consisting of  one or more representatives from each regional office, who serve as AML  experts. FINRA has nine AML regulatory experts.
CFTC. CFTC does not have full-time staff dedicated solely to BSA/AML  compliance; however, various staff may be involved in BSA/AML issues.  CFTC staff conduct periodic oversight examinations of SROs’ compliance  examination programs, which include a review of BSA/AML procedures.  CFTC staff also devote time to BSA/AML policy issues during the rule- making process and at other times, as requested by FinCEN. Futures SROs  include BSA/AML as part of their broader compliance examination  programs. NFA and the Chicago Mercantile Exchange have 130 and 59  examination staff respectively, all of which have been trained in BSA/AML.
section_title: Training
paragraphs: All of the regulators and their SROs that examine financial institutions for  BSA/AML compliance provide opportunities to their staff to receive  BSA/AML training—provided by the agency, working groups (such as  FFIEC), or outside vendors. FFIEC, for example, provides both an AML  workshop for examiners knowledgeable of BSA and experienced in  examining institutions for BSA program compliance and, as of 2007, an  advanced BSA/AML specialists conference for designated BSA compliance  examiners and other BSA subject matter experts. In 2007, over 400  trainees participated in these programs. Agencies and SROs provided  several examples of BSA/AML training available to their staff and others  (see table 11).
section_title: IRS Has a BSA/AML- Specific Compliance Unit, Budget, and Performance Measures
paragraphs: Unlike the federal banking regulators, SEC, and CFTC, who incorporate  BSA activities into their compliance programs, IRS’s BSA/AML activities  are managed separately in its Office of Fraud/BSA within the Small  Business/Self Employment division. This office is solely dedicated to  examining NFBIs for BSA compliance. Since IRS created the office, IRS  has tracked several BSA-specific output and efficiency performance  measures, such as number of examinations, referrals, closures, and hours  per case (see table 12). IRS also has a detailed strategic plan devoted to  BSA compliance and enforcement activities.
We previously reported that IRS lacked a measure for NBFI compliance  rates with BSA and thus could not track program effectiveness over time.  We recommended that the Secretary of Treasury direct FinCEN and IRS to  develop a documented and coordinated strategy—that would include  priorities, time frames, and resource needs, and measure the compliance  rate of NBFIs—to improve BSA compliance by NBFIs. IRS and FinCEN  responded by developing such a strategy, which identifies various NBFI  categories, prioritizes actions to be taken overall and within each category  for improving BSA compliance, explains who is responsible for the  actions, and establishes the time frames for identifying whether an action  has been completed or when it is to be completed. Similar to the other  regulators, IRS’s Office of BSA/Fraud conducts quality reviews of  examinations.
Over the last several years, IRS has increased the resources it devotes to  BSA compliance. In fiscal year 2007, IRS spent over $71 million and 700  full-time equivalents on BSA-related activities, which is an increase of 3  percent and 5 percent, respectively, from 2006. Specifically, the Small  Business/Self Employment’s Office of Fraud/BSA increased its BSA field  examiner staff from 372 in 2006 to 385 in 2007. New Small Business/Self  Employment employees receive Basic BSA/AML training on both BSA and  currency transaction reporting requirements (Form 8300 examinations).  Experienced BSA examiners receive specialized training for specific  industries, such as insurance companies, credit unions, casinos, and  jewelry and precious metals dealers. IRS also has developed specific BSA  training for managers and coaches of BSA examiners. The Office of  Fraud/BSA also distributes a BSA/AML examination guide, provides BSA  newsletters, and updated the Insurance Industry Guide and Internal  Revenue Manual.
section_title: Appendix III: Examples of BSA/AML-Related Formal Enforcement Actions
paragraphs: In fiscal year 2008, approximately 70 BSA/AML-related formal enforcement  actions were taken by federal financial regulators--the Board of Governors  of the Federal Reserve System (Federal Reserve), Federal Deposit  Insurance Corporation (FDIC), Office of the Comptroller of the Currency  (OCC), Office of Thrift Supervision (OTS), Securities Exchange  Commission (SEC)--the National Futures Association (NFA), the Financial  Industry Regulatory Authority (FINRA), and other self-regulatory  organizations (SROs). In fiscal years 2006-2008, the Financial Crimes  Enforcement Network (FinCEN) and the federal financial regulators and  SROs jointly assessed 11 civil money penalties (CMP). Table 13 contains  examples of formal enforcement actions, excluding CMPs, that were not  taken concurrently with FinCEN.
Table 14 lists examples of BSA/AML-related CMPs issued: (1) jointly by  federal and state regulators, SROs, and FinCEN; (2) solely by FinCEN; and  (3) by federal regulators only.
section_title: Appendix IV: Comments from the Department of the Treasury’s Financial Crimes Enforcement Network
section_title: Appendix V: Comments from the Internal Revenue Service
section_title: Appendix VI: Comments from the Board of Governors of the Federal Reserve
section_title: Appendix VII: Comments from the Federal Deposit Insurance Corporation
section_title: Appendix VIII: Comments from the Office of the Comptroller of the Currency
section_title: Appendix IX: Comments from the Office of Thrift Supervision
section_title: Appendix X: Comments from National Credit Union Administration
section_title: Appendix XI: Comments from Securities and Exchange Commission
section_title: Appendix XII: Comments from the Commodity Futures Trading Commission
section_title: Appendix XIII: GAO Contact and Staff Acknowledgments
subsections: section_title: GAO Contact
section_title: Staff Acknowledgments
paragraphs: In addition to the contact named above, Barbara I. Keller (Assistant  Director), Allison M. Abrams, M’Baye Diagne, John P. Forrester, Kerstin  Larsen, Carl Ramirez, Barbara M. Roesmann, Ryan Siegel, and Paul  Thompson made key contributions to this report.