Financial Institutions: Fines, Penalties, and Forfeitures for Violations of Financial Crimes and Sanctions Requirements
Published: 2016-03-22T00:00:00

Fast Facts:

Highlights:
section_title: Why GAO Did This Study
paragraphs: Over the last few years, billions of dollars have been collected in fines, penalties, and forfeitures assessed against financial institutions for violations of requirements related to financial crimes. These requirements are significant tools that help the federal government detect and disrupt money laundering, terrorist financing, bribery, corruption, and violations of U.S. sanctions programs.
GAO was asked to review the collection and use of these fines, penalties, and forfeitures assessed against financial institutions for violations of these requirements—specifically, BSA/AML, FCPA, and U.S. sanctions programs requirements. This report describes (1) the amounts collected by the federal government for these violations, and (2) the process for collecting these funds and the purposes for which they are used. GAO analyzed agency data, reviewed documentation on agency collection processes and on authorized uses of the funds in which collections are deposited, and reviewed relevant laws. GAO also interviewed officials from Treasury (including the Financial Crimes Enforcement Network and the Office of Foreign Assets Control), Securities and Exchange Commission, Department of Justice, and the federal banking regulators.
GAO is not making recommendations in this report.
section_title: What GAO Found
paragraphs: Since 2009, financial institutions have been assessed about $12 billion in fines, penalties, and forfeitures for violations of Bank Secrecy Act/anti-money- laundering regulations (BSA/AML), Foreign Corrupt Practices Act of 1977 (FCPA), and U.S. sanctions programs requirements by the federal government. Specifically, GAO found that from January 2009 to December 2015, federal agencies assessed about $5.2 billion for BSA/AML violations, $27 million for FCPA violations, and about $6.8 billion for violations of U.S. sanctions program requirements. Of the $12 billion, federal agencies have collected all of these assessments, except for about $100 million.
Collections of Fines, Penalties, and Forfeitures from Financial Institutions for Violations of Bank Secrecy Act/Anti-Money Laundering, Foreign Corrupt Practices Act, and U.S. Sanctions Programs Requirements, Assessed in January 2009–December 2015
Agencies have processes for collecting payments for violations of BSA/AML, FCPA, and U.S. sanctions programs requirements and these collections can be used to support general government and law enforcement activities and provide payments to crime victims. Components within the Department of the Treasury (Treasury) and financial regulators are responsible for initially collecting penalty payments, verifying that the correct amount has been paid, and then depositing the funds into Treasury's General Fund accounts, after which the funds are available for appropriation and use for general support of the government. Of the approximately $11.9 billion collected, about $2.7 billion was deposited into Treasury General Fund accounts. The BSA and U.S. sanctions-related criminal cases GAO identified since 2009 resulted in the forfeiture of almost $9 billion through the Department of Justice (DOJ) and Treasury. Of this amount, about $3.2 billion was deposited into DOJ's Asset Forfeiture Fund (AFF) and $5.7 billion into the Treasury Forfeiture Fund (TFF), of which $3.8 billion related to a sanctions case was rescinded in fiscal year 2016 appropriations legislation. Funds from the AFF and TFF are primarily used for program expenses, payments to third parties, including the victims of the related crimes, and payments to law enforcement agencies that participated in the efforts resulting in forfeitures. As of December 2015, DOJ and Treasury had distributed about $1.1 billion to law enforcement agencies and about $2 billion was planned for distribution to crime victims. Remaining funds from these cases are subject to general rescissions to the TFF and AFF or may be used for program or other law enforcement expenses.

section_title: Letter
paragraphs: Over the last few years, billions of dollars have been collected in fines,  penalties, and forfeitures from financial institutions for violations related to  the Bank Secrecy Act (BSA), Foreign Corrupt Practices Act of 1977  (FCPA), and U.S. sanctions programs requirements—referred to as  “covered violations” in this report. These requirements are significant  tools that aid the federal government in detecting, disrupting, and  inhibiting financial crimes, terrorist financing, bribery, corruption, and  economic interactions with entities that undermine U.S. policy interest,  among other things. For example, Congress passed BSA and FCPA to  combat money laundering, prohibit U.S. businesses from paying bribes to  foreign officials, and target the financial resources of terrorist  organizations. Similarly, federal agencies have developed regulations  related to U.S. sanctions programs to enforce the blocking of assets and  trade restrictions to accomplish foreign policy and national security goals.  As part of these efforts to stop the illegal flow of funds and to deter  financial crimes, federal agencies—including the Department of Justice  (DOJ), Department of the Treasury (Treasury), and Securities and  Exchange Commission (SEC) and other financial regulators—have the  ability to reach settlements, take enforcement actions against institutions  and individuals, and, in the case of DOJ and Treasury, seize assets.  These actions may result in fines, penalties, or forfeitures that the  agencies collect.
You asked us to review the amounts of fines, penalties, and forfeitures  federal agencies have collected from financial institutions for violations of  BSA and related anti-money-laundering (AML) requirements (referred to  as “BSA/AML requirements”), FCPA, and U.S. sanctions programs  requirements, how these funds and forfeitures are used and the policies  and controls governing their distribution. This report describes (1) the  amount of fines, penalties, and forfeitures that the federal government  has collected for these violations from January 2009 through December  2015, and (2) the process for collecting these funds and the purposes for  which they are used.
To describe the fines, penalties, and forfeitures federal agencies have  assessed on, and collected from, financial institutions, we identified and  analyzed relevant agencies’ data on enforcement actions taken and  cases brought against financial institutions that resulted in fines,  penalties, or forfeitures for the covered violations. Specifically, we  analyzed publicly available data on the number and amounts of fines and  penalties that were assessed from January 2009 through December 2015  by the Board of Governors of the Federal Reserve System (Federal  Reserve), Federal Deposit Insurance Corporation (FDIC), DOJ, National  Credit Union Administration (NCUA), Office of the Comptroller of the  Currency (OCC), SEC, and the Financial Crimes Enforcement Network  (FinCEN), a bureau within Treasury. We also reviewed enforcement  actions listed on Treasury’s Office of Foreign Assets Control (OFAC)  website and identified any actions taken against financial institutions. To  identify criminal cases against financial institutions for violations of BSA  and sanctions-related requirements, we reviewed press releases from  DOJ’s Asset Forfeiture and Money Laundering Section and related court  documents, as well as enforcement actions listed on OFAC’s website. To  determine the amounts forfeited for these cases, we obtained data from  DOJ’s Consolidated Asset Tracking System and verified any Treasury- related data in DOJ’s system by obtaining information from the Treasury  Executive Office for Asset Forfeiture.
We assessed the reliability of the data from financial regulators and  Treasury that we used by reviewing prior GAO evaluations of these data,  interviewing knowledgeable agency officials, and reviewing relevant  documentation, such as agency enforcement orders for the fines,  penalties, and forfeitures assessed. To verify that these amounts had  been collected, we requested verifying documentation from agencies  confirming that these assessments had been collected, and also obtained  and reviewed documentation for a sample of the data to verify that the  amount assessed matched the amount collected. As a result, we  determined that these data were sufficiently reliable for our purposes. We  assessed the reliability of relevant data fields from DOJ’s Consolidated  Asset Tracking System by reviewing prior GAO and DOJ evaluations of  this system and interviewing knowledgeable officials from DOJ. We  determined that these data were sufficiently reliable for purposes of this  report.
To describe how payments were collected for the covered violations, we  identified and summarized documentation of the various steps and key  agency internal controls for collection processes. We also obtained  documentation, such as statements documenting receipt of a penalty  payment, for a sample of penalties. We interviewed officials from each  agency about the process used to collect payments for assessed fines  and penalties and, for relevant agencies, the processes for collecting  cash and assets for forfeitures. To describe how these collections were  used, we obtained documentation on expenditures from the accounts into  which the payments were deposited. Specifically, we obtained  documentation on the authorized or allowed expenditures for accounts in  the Treasury General Fund, Treasury Forfeiture Fund (TFF), and DOJ’s  Assets Forfeiture Fund (AFF) and Crime Victims Fund. We also reviewed  relevant GAO reports, agency Office of Inspector General reports, and  laws governing the various accounts.
We conducted this performance audit from July 2015 to March 2016 in  accordance with generally accepted government auditing standards.  Those standards require that we plan and perform the audit to obtain  sufficient, appropriate evidence to provide a reasonable basis for our  findings and conclusions based on our audit objectives. We believe that  the evidence obtained provides a reasonable basis for our findings and  conclusions based on our audit objectives.
subsections: section_title: Background
subsections: section_title: Bank Secrecy Act/Anti- Money-Laundering Requirements
paragraphs: BSA established reporting, recordkeeping, and other anti-money-  laundering (AML) requirements for financial institutions. By complying  with BSA/AML requirements, U.S. financial institutions assist government  agencies in the detection and prevention of money-laundering and  terrorist financing by maintaining effective internal controls and reporting  suspicious financial activity. BSA regulations require financial institutions,  among other things, to comply with recordkeeping and reporting  requirements, including keeping records of cash purchases of negotiable  instruments, filing reports of cash transactions exceeding $10,000, and  reporting suspicious activity that might signify money laundering, tax  evasion, or other criminal activities. In addition, financial institutions are  required to have AML compliance programs that incorporate (1) written  AML compliance policies, procedures, and controls; (2) an independent  audit review; (3) the designation of an individual to assure day-to-day  compliance; and (4) training for appropriate personnel. Over the years,  these requirements have evolved into an important tool to help a number  of regulatory and law enforcement agencies detect money laundering,  drug trafficking, terrorist financing, and other financial crimes.
The regulation and enforcement of BSA involves several different federal  agencies, including FinCEN, the federal banking regulators—FDIC,  Federal Reserve, NCUA, and OCC—DOJ, and SEC. FinCEN oversees  the administration of BSA, has overall authority for enforcing compliance  with its requirements and implementing regulations, and also has the  authority to enforce the act, primarily through civil money penalties.  BSA/AML examination authority has been delegated to the federal  banking regulators, among others. The banking regulators use this  authority and their independent authorities to examine entities under their  supervision, including national banks, state member banks, state  nonmember banks, thrifts, and credit unions, for compliance with  applicable BSA/AML requirements and regulations. Under these  independent prudential authorities, they may also take enforcement  actions independently or concurrently for violations of BSA/AML  requirements and assess civil money penalties against financial  institutions and individuals. The authority to examine broker-dealers and  investment companies (mutual funds) for compliance with BSA and its  implementing regulations has been delegated to SEC, and SEC has  independent authority to take related enforcement actions.
DOJ’s Criminal Division develops, enforces, and supervises the  application of all federal criminal laws except those specifically assigned  to other divisions, among other responsibilities. The division and the 93  U.S. Attorneys have the responsibility for overseeing criminal matters as  well as certain civil litigation. With respect to BSA/AML regulations, DOJ  may pursue investigations of financial institutions and individuals for both  civil and criminal violations that may result in dispositions including fines,  penalties, or the forfeiture of assets. In the cases brought against financial  institutions that we reviewed, the assets were either cash or financial  instruments. Under the statutes and regulations that guide the  assessment amounts for fines, penalties, and forfeitures, each federal  agency has the discretion to consider the financial institution’s  cooperation and remediation of their BSA/AML internal controls, among  other factors.
section_title: Foreign Corrupt Practices Act and U.S. Sanctions Programs
paragraphs: The FCPA contains both antibribery and accounting provisions that apply  to issuers of securities, including financial institutions. The antibribery  provisions prohibit issuers, including financial institutions, from making  corrupt payments to foreign officials to obtain or retain business. The  accounting provisions require issuers to make and keep accurate books  and records and to devise and maintain an adequate system of internal  accounting controls, among other things. SEC and DOJ are jointly  responsible for enforcing the FCPA and have authority over issuers, their  officers, directors, employees, stockholders, and agents acting on behalf  of the issuer for violations, as well as entities that violate the FCPA. Both  SEC and DOJ have civil enforcement authority over the FCPA’s  antibribery provisions as well as over accounting provisions that apply to  issuers. DOJ also has criminal enforcement authority.
Generally, financial sanctions programs create economic penalties in  support of U.S. policy priorities, such as countering national security  threats. Sanctions are authorized by statute or executive order, and may  be comprehensive (against certain countries) or more targeted (against  individuals and groups such as regimes, terrorists, weapons of mass  destruction proliferators, and narcotics traffickers). Sanctions are used to,  among other things, block assets, impose trade embargos, prohibit trade  and investment with some countries, and bar economic and military  assistance to certain regimes. For example, financial institutions are  prohibited from using the U.S. financial system to make funds available to  designated individuals or banks and other entities in countries targeted by  sanctions. Financial institutions are required to establish compliance and  internal audit procedures for detecting and preventing violations of U.S.  sanction laws and regulations, and are also required to follow OFAC  reporting requirements. Financial institutions are to implement controls  consistent with their risk assessments, often using systems that identify  designated individuals or entities and automatically escalate related  transfers for review and disposition. Institutions may also have a  dedicated compliance officer and an officer responsible for overseeing  blocked funds, compliance training, and in-depth annual audits of each  department in the bank.
Treasury, DOJ, and federal banking regulators all have roles in  implementing U.S. sanctions programs requirements relevant to financial  institutions. Specifically, Treasury has primary responsibility for  administering and enforcing financial sanctions, developing regulations,  conducting outreach to domestic and foreign financial regulators and  financial institutions, identifying sanctions violations, and assessing the  effects of sanctions. Treasury and DOJ also enforce sanctions regulations  by taking actions against financial institutions for violations of sanctions  laws and regulations, sometimes in coordination with the federal and  state banking regulators. As part of their examinations of financial  institutions for BSA/AML compliance, banking regulators and SEC also  review financial institutions to assess their compliance programs for  sanction laws and regulations.
section_title: Funds for Depositing Collections
paragraphs: Treasury and DOJ maintain funds and accounts for fines, penalties, and  forfeitures that are collected. Expenditure of these funds is guided by  statute, and Treasury and DOJ are permitted to use the revenue from  their funds to pay for expenses associated with forfeiture activities.  Treasury administers and maintains the Treasury General Fund and TFF.  Treasury General Fund receipt accounts hold all collections that are not  earmarked by law for another account for a specific purpose or presented  in the President’s budget as either governmental (budget) or offsetting  receipts. It includes taxes, customs duties, and miscellaneous receipts.  The TFF is a multidepartmental fund that is the receipt account for  agencies participating in the Treasury Forfeiture Program (see table  1).The program has four primary goals: (1) to deprive criminals of  property used in or acquired through illegal activities; (2) to encourage  joint operations among federal, state, and local law enforcement  agencies, as well as foreign countries; (3) to strengthen law enforcement;  and (4) to protect the rights of the individual. Treasury’s Executive Office  for Asset Forfeiture is responsible for the management and oversight of  the TFF.
DOJ administers and maintains deposit accounts for the penalties and  forfeitures it assesses, including the AFF and the Crime Victims Fund.  The AFF is the receipt account for forfeited cash and proceeds from the  sale of forfeited assets generated by the Justice Asset Forfeiture Program  (see table 2). A primary goal of the Justice Asset Forfeiture Program is  preventing and reducing crime through the seizure and forfeiture of  assets that were used in or acquired as a result of criminal activity. The  Crime Victims Fund is the receipt account for criminal fines and special  assessments collected from convicted federal offenders, as well as  federal revenues from certain other sources. It was established to provide  assistance and grants for victim services throughout the United States.
In addition, the Consolidated Appropriations Act, 2016, established a new  forfeiture fund—the United States Victims of State Sponsored Terrorism  Fund—to receive the proceeds of forfeitures resulting from sanctions- related violations. Specifically, the fund will be used to receive proceeds  of forfeitures related to violations of the International Emergency  Economic Powers Act and the Trading with the Enemy Act, as well as  other offenses related to state sponsors of terrorism.
section_title: Financial Institutions Have Paid Billions for Violations of Financial Crimes-Related Requirements since 2009
paragraphs: Since 2009, financial institutions have been assessed about $12 billion in  fines, penalties, and forfeitures for violations of BSA/AML, FCPA, and  U.S. sanctions program requirements. Specifically, from January 2009  through December 2015, federal agencies assessed about $5.2 billion for  BSA violations, $27 million for FCPA violations, and about $6.8 billion for  violations of U.S. sanctions program requirements. Of the $12 billion,  federal agencies have collected all of these assessments, except for  about $100 million. The majority of the $100 million that was uncollected  was assessed in 2015 and is either subject to litigation, current  deliberations regarding the status of the collection efforts, or bankruptcy  proceedings.
subsections: section_title: Since 2009, Financial Institutions Have Paid about $5.1 Billion to the Federal Government for BSA Violations
paragraphs: From January 2009 to December 2015, DOJ, FinCEN, and federal  financial regulators (the Federal Reserve, FDIC, OCC, and SEC),  assessed about $5.2 billion and collected about $5.1 billion in penalties,  fines, and forfeitures for various BSA violations. Financial regulators  assessed a total of about $1.4 billion in penalties for BSA violations for  which they were responsible for collecting, and collected almost all of this  amount (see fig. 1). The amounts assessed by the financial regulators  and Treasury are guided by statute and based on the severity of the  violation. Based on our review of regulators’ data and enforcement  orders, the federal banking regulators assessed penalties for the failure to  implement or develop adequate BSA/AML programs, and failure to  identify or report suspicious activity. Of the $1.4 billion, one penalty  (assessed by OCC) accounted for almost 35 percent ($500 million). This  OCC enforcement action was taken against HSBC Bank USA for having  a long-standing pattern of failing to report suspicious activity in violation of  BSA and its underlying regulations and for the bank’s failure to comply  fully with a 2010 cease-and-desist order. Financial regulators assess  penalties for BSA violations both independently and concurrently with  FinCEN. In a concurrent action, FinCEN will jointly assess a penalty with  the regulator and deem the penalty satisfied with a payment to the  regulator. Out of the $1.4 billion assessed, $651 million was assessed  concurrently with FinCEN to 13 different financial institutions. FinCEN  officials told us that it could take enforcement actions independently, but  tries to take actions concurrently with regulators to mitigate duplicative  penalties. During this period, SEC also assessed about $16 million in  penalties and disgorgements against broker-dealers for their failure to  comply with the record-keeping and retention requirements under BSA.  SEC’s penalties ranged from $25,000 to $10 million—which included a  $4.2 million disgorgement. As of December 2015, SEC had collected  about $9.4 million of the $16 million it has assessed. In the case  resulting in a $10 million assessment, Oppenheimer & Company Inc.  failed to file Suspicious Activity Reports on an account selling and  depositing large quantities of penny stocks.
In addition, FinCEN assessed about $108 million in penalties that it was  responsible for collecting. Based on our analysis, almost all of the $108  million was assessed in 2015 of which $9.5 million has been collected as  of December 2015. Of the $108 million FinCEN assessed, three large  penalties totaling $93 million—including a $75 million penalty—were  assessed in 2015 and, according to FinCEN officials, have not been  collected due to litigation, current deliberations regarding the status of the  collection efforts, or pending bankruptcy actions. FinCEN’s penalty  assessments amounts ranged from $5,000 to $75 million for this period  and are guided by statute and regulations, the severity of the BSA  violation, and other factors. For example, in a case resulting in a $75  million penalty assessment against Hong Kong Entertainment (Overseas)  Investments, FinCEN found that the casino’s weak AML internal controls  led to the concealment of large cash transactions over a 4-year period.  We found that institutions were assessed penalties by FinCEN for a lack  of AML internal controls, failure to register as a money services business,  or failure to report suspicious activity as required.
Through fines and forfeitures, DOJ, in cooperation with other law  enforcement agencies and often through the federal court system,  collected about $3.6 billion from financial institutions from January 2009  through December 2015 (see fig. 2). Almost all of this amount resulted  from forfeitures, while about $1 million was from fines. As of December  2015, $1.2 million had not been collected in the cases we reviewed.  These assessments consisted of 12 separate cases and totaled about 70  percent of all penalties, fines, and forfeitures assessed against financial  institutions for BSA violations. DOJ’s forfeitures ranged from about  $240,000 to $1.7 billion, and six of the forfeitures were at least $100  million. According to DOJ officials, the amount of forfeiture is typically  determined by the amount of the proceeds of the illicit activity. In 2014,  DOJ assessed a $1.7 billion forfeiture—the largest penalty related to a  BSA violation—against JPMorgan Chase Bank. DOJ cited the bank for its  failure to detect and report the suspicious activities of Bernard Madoff.  The bank failed to maintain an effective anti-money-laundering program  and report suspicious transactions in 2008, which contributed to their  customers losing about $5.4 billion in Bernard Madoff’s Ponzi scheme.  For the remaining cases, financial institutions were generally assessed  fines and forfeitures for failures in their internal controls over AML  programs and in reporting suspicious activity.
section_title: SEC Has Collected Millions of Dollars from Financial Institutions for FCPA Violations
paragraphs: From January 2009 through December 2015, SEC collected  approximately $27 million in penalties and disgorgements from two  financial institutions for FCPA violations. SEC assessed $10.3 million in  penalties, $13.6 million in disgorgements, and $3.3 million in interest  combined for the FCPA violations. The penalties were assessed for  insufficient internal controls and FCPA books and records violations. SEC  officials stated the fact that they had not levied more penalties against  financial institutions for FCPA violations than they had against other types  of institutions may be due, in part, to financial institutions being subject to  greater regulatory oversight than other industries. While DOJ and SEC  have joint responsibility for enforcing FCPA requirements, DOJ officials  stated that they did not assess any penalties against financial institutions  during the period of our review.
section_title: Financial Institutions Incurred Billions of Dollars in Fines, Penalties, and Forfeitures for U.S. Sanctions Programs Violations since 2009
paragraphs: From January 2009 through December 2015, OFAC independently  assessed $301 million in penalties against financial institutions for  sanctions programs violations.The $301 million OFAC assessed was  comprised of 47 penalties, with penalty amounts ranging from about  $8,700 to $152 million. Of the $301 million, OFAC has collected about  $299 million (see fig. 3). OFAC’s enforcement guidelines provide the legal  framework for analyzing apparent violations. Some of the factors which  determine the size of a civil money penalty include the sanctions program  at issue and the number of apparent violations and their value. For  example, OFAC assessed Clearstream Banking a $152 million penalty  because it made securities transfers for the central bank of a sanctioned  country.
DOJ, along with participating Treasury offices and other law enforcement  partners, assessed and enforced criminal and civil forfeitures and fines  totaling about $5.7 billion for the federal government for sanctions  programs violations. This amount was the result of eight forfeitures that  also included two fines. Of the $5.7 billion collected for sanctions  programs violations, most of this amount was collected from one financial  institution—BNP Paribas. In total, BNP Paribas was assessed an $8.8  billion forfeiture and a $140 million criminal fine in 2014 for willfully  conspiring to commit violations of various sanctions laws and  regulations. BNP Paribas pleaded guilty to moving more than $8.8  billion through the U.S. financial system on behalf of sanctioned entities  from 2004 to 2012. Of the $8.8 billion forfeited, $3.8 billion was collected  by Treasury’s Executive Office for Asset Forfeiture, with the remainder  apportioned among participating state and local agencies. In addition to  BNP Paribas, DOJ and OFAC assessed fines and forfeitures against  other financial institutions for similar violations, including processing  transactions in violation of the International Emergency Economic Powers  Act, OFAC regulations, and the Trading with the Enemy Act.
From January 2009 through December 2015, the Federal Reserve  independently assessed and collected about $837 million in penalties  from six financial institutions for U.S. sanctions programs violations. The  Federal Reserve assessed its largest penalty for $508 million against  BNP Paribas for having unsafe and unsound practices that failed to  prevent the concealing of payment information of financial institutions  subject to OFAC regulations. It was assessed as part of a global  settlement with DOJ for concealing payment information of a financial  institution subject to OFAC regulations. Federal Reserve officials stated  that the remaining assessed penalties related to OFAC regulations were  largely for similar unsafe and unsound practices.
section_title: Collections for Violations Are Used to Support General Government and Law Enforcement Activities and Victims Payments
paragraphs: FinCEN and financial regulators have processes in place for receiving  penalty payments from financial institutions—including for penalties  assessed for the covered violations—and for depositing these  payments. These payments are deposited into accounts in Treasury’s  General Fund and are used for the general support of federal government  activities. From January 2009 through December 2015, about $2.7  billion was collected from financial institutions for the covered violations  and deposited into Treasury General Fund accounts. DOJ and Treasury  also have processes in place for collecting forfeitures, fines, and penalties  related to BSA and sanctions violations. Depending on which agency  seizes the assets, forfeitures are generally deposited into two accounts— either DOJ’s AFF or Treasury’s TFF. From January 2009 through  December 2015, about $3.2 billion was deposited into the AFF and $5.7  billion into the TFF, of which $3.8 billion related to a sanctions case was  rescinded in the fiscal year 2016 appropriation legislation. Funds from the  AFF and TFF are primarily used for program expenses, payments to third  parties—including the victims of the related crimes—and equitable  sharing payments to law enforcement agencies that participated in the  efforts resulting in forfeitures. For the cases in our review, as of  December 2015, DOJ and Treasury had distributed about $1.1 billion in  payments to law enforcement agencies and approximately $2 billion is  planned to be distributed to victims of crimes. The remaining funds from  these cases are subject to general rescissions to the AFF and TFF or  may be used for program or other law enforcement expenses. DOJ  officials stated that DOJ determines criminal fines on a case-by-case  basis, in consideration of the underlying criminal activity and in  compliance with relevant statutes.
subsections: section_title: Penalties Collected by Treasury and Financial Regulators Are Deposited in Treasury’s Accounts for General Government Use
paragraphs: FinCEN and financial regulators deposit collections of penalties assessed  against financial institutions—including for the covered violations—into  Treasury’s General Fund accounts (see fig. 4).
FinCEN deposits the penalty payments it receives in accounts in  Treasury’s General Fund. First, FinCEN sends financial institutions a  signed copy of the final consent order related to the enforcement action it  has taken along with instructions on how and when to make the penalty  payment. Then, Treasury’s Bureau of Fiscal Service (BFS) collects  payments from financial institutions, typically through a wire transfer.  OFAC officials explained that BFS also collects and tracks, on behalf of  OFAC, payments for civil money penalties that OFAC assesses. BFS  periodically notifies OFAC via e-mail regarding BFS’s receipt of payments  of the assessed civil monetary penalties. FinCEN officials said that its  Financial Management team tracks the collection of their penalties by  comparing the amount assessed to Treasury’s Report on Receivables,  which shows the status of government-wide receivables and debt  collection activities and is updated monthly. Specifically, FinCEN staff  compares their penalty assessments with BFS’s collections in Treasury’s  Report on Receivables to determine if a penalty payment has been  received or is past due. Once Treasury’s BFS receives payments for  FinCEN- and OFAC-assessed penalties, BFS staff deposits the payments  into the appropriate Treasury General Fund accounts.
Financial regulators also have procedures for receiving and depositing  these collections into Treasury’s General Fund accounts, as the following  examples illustrate:
SEC keeps records of each check, wire transfer, or online  payment it receives, along with a record of the assessed amount  against the financial institution, the remaining balance, and the  reasons for the remaining balance, among other details related to  the penalty. For collections we reviewed from January 2009 to  December 2015 for BSA and FCPA violations, SEC had deposited  all of them into a Treasury General Fund receipt account.
Upon execution of an enforcement action involving a penalty, the  Enforcement and Compliance Division within OCC sends a  notification of penalties due to OCC’s Office of Financial  Management. When the Office of Financial Management receives  a payment for a penalty from a financial institution, it compares the  amount with these notifications. The Office of Financial  Management records the amount received and sends a copy of  the supporting documentation (for example, a wire transfer or  check) to the Enforcement and Compliance Division. OCC holds  the payment in a civil money penalty account—an account that  belongs to and is managed by OCC—before it deposits the  payment in a Treasury General Fund receipt account on a monthly  basis.
The Federal Reserve directs financial institutions to wire their  penalty payment to the Federal Reserve Bank of Richmond  (FRBR). The Federal Reserve then verifies that the payment has  been made in the correct amount to FRBR, and when it is made,  FRBR distributes the penalty amount received to a Treasury  General Fund receipt account. Federal Reserve officials explained  that when they send the penalty to Treasury, they typically e-mail  Treasury officials to verify that they have received the payment.  They noted that when Treasury officials receive the penalty  payment, they send a verification e-mail back to the Federal  Reserve. According to officials, to keep track of what is collected  and sent to the Treasury General Fund, FRBR retains statements  that document both the collection and transfer of the penalty to a  Treasury General Fund receipt account.
FDIC has similar processes in place for collecting penalties  related to BSA violations. When enforcement orders are executed,  financial institutions send all related documentation (the stipulation  for penalty payment, the order, and the check in the amount of the  penalty payment) to FDIC’s applicable regional office Legal  Division staff, which in turn sends the documentation to Legal  Division staff in Washington, D.C. If the payment is wired, FDIC  compares the amount wired to the penalty amount to ensure that  the full penalty is paid. If the payment is a check, FDIC officials  make sure the amount matches the penalty, document receipt of  the payment in an internal payment log, and then send the check  to FDIC’s Department of Finance. Once a quarter, FDIC sends  penalty payments it receives to a Treasury General Fund receipt  account.
In addition to the processes we discuss in this report for penalty  collections, SEC, Federal Reserve, OCC, and FDIC all have audited  financial statements that include reviews of general internal controls over  agency financial reporting, including those governing collections.
From January 2009 through December 2015, FinCEN, OFAC, and  financial regulators collected in total about $2.6 billion from financial  institutions for the covered violations but they did not retain any of the  penalties they collected. Instead, the collections were deposited in  Treasury General Fund accounts and used to support various federal  government activities. Officials from these agencies stated that they have  no discretion over the use of the collections, which must be transmitted to  the Treasury. Once agencies deposit their collections into the Treasury  General Fund, they are unable to determine what subsequently happens  to the money, since it is commingled with other deposits.
Treasury Office of Management officials stated that the collections  deposited into the General Fund accounts are used according to the  purposes described in Congress’s annual appropriations. More  specifically, once a penalty collection is deposited into a receipt account  in the Treasury General Fund, only an appropriation by Congress can  begin the process of spending these funds. Appropriations from Treasury  General Fund accounts are amounts appropriated by law for the general  support of federal government activities. The General Fund Expenditure  Account is an appropriation account established to record amounts  appropriated by law for the subsequent expenditure of these funds, and  includes spending from both annual and permanent appropriations.
Treasury Office of Management officials explained that the Treasury  General Fund has a general receipt account that receives all of the  penalties that regulators and Treasury agencies collect for BSA, FCPA,  and sanctions violations. Treasury officials explained that to ensure that  the proper penalty amounts are collected, Treasury requires agency  officials to reconcile the amount of deposits recorded in their general  ledger to corresponding amounts recorded in Treasury’s government- wide accounts. If Treasury finds a discrepancy between the General  Ledger and the government-wide accounts, it sends the specific agency a  statement asking for reconciliation. Treasury’s Financial Manual provides  agencies with guidance on how to reconcile discrepancies and properly  transfer money to the general receipt account. Treasury officials  explained that they cannot associate a penalty collected for a specific  violation with an expense from the General Fund as collections deposited  in General Fund accounts are comingled.
section_title: Forfeitures Are Deposited into Accounts with Several Authorized Uses, Including Payments to Crime Victims and Law Enforcement Partners
paragraphs: Forfeitures—including those from financial institutions for violations of  BSA/AML and U.S. sanctions programs requirements—are deposited into  three accounts depending in part on the agency seizing the assets (DOJ  and other law enforcement agencies use the AFF, Treasury and the  Department of Homeland Security use the TFF, and U.S. Postal  Inspection Service uses the Postal Service Fund). In the cases we  reviewed, financial institutions forfeited either cash or financial  instruments, which were generally deposited into the AFF or the TFF.  Figure 5 shows the processes that govern the seizure and forfeiture of  assets for the Justice Asset Forfeiture Program and the Treasury  Forfeiture Program.
The Justice Asset Forfeiture Program and the Treasury Forfeiture  Program follow similar forfeiture processes. Under the Justice Asset  Forfeiture Program, a DOJ investigative agency seizes an asset (funds in  the cases we reviewed), and the asset is entered into DOJ’s Consolidated  Asset Tracking System. The asset is then transferred to the U.S.  Marshals Service for deposit into the Seized Asset Deposit Fund. The  U.S. Attorney’s Office or the seizing agency must provide notice to  interested parties and conduct Internet publication prior to entry of an  administrative declaration of forfeiture or a court-ordered final order of  forfeiture. Once the forfeiture is finalized, the seizing agency or the U.S.  Attorney’s Office enters the forfeiture information into the Consolidated  Asset Tracking System. U.S. Marshals Service subsequently transfers the  asset from the Seized Asset Deposit Fund to the AFF. Similarly, the asset  forfeiture process for the Treasury Forfeiture Program involves a  Department of Homeland Security or Treasury investigative agency  seizing the asset (funds, in the cases we reviewed). The seizing agency  takes custody of the asset, enters the case into their system of record,  and transfers the asset to the Treasury Suspense Account. Once  forfeiture is final, the seizing agency subsequently requests that  Treasury’s Executive Office for Asset Forfeiture staff transfer the asset  from the Treasury Suspense Account to the TFF. According to Treasury’s  Executive Office for Asset Forfeiture staff, each month, TFF staff  compares deposits in the TFF with records from seizing agencies to  review whether the amounts are accurately recorded.
From January 2009 through December 2015, for the cases we reviewed,  nine financial institutions forfeited about $3.2 billion in funds through the  Justice Asset Forfeiture Program due to violations of BSA/AML and U.S.  sanctions programs requirements.  AFF expenditures are governed by the  law establishing the AFF, as we have previously reported. Specifically,  the AFF is primarily used to pay the forfeiture program’s expenses in  three major categories:  1.  program operations expenses in 13 expenditure categories such  as asset management and disposal, storage and destruction of  drugs, and investigative expenses leading to a seizure; 2.  payments to third parties, including payments to satisfy interested  parties such as owners or lien holders, as well as the return of  funds to victims of crime; and 3.  equitable sharing payments to state and local law enforcement  agencies that participated in law enforcement efforts resulting in  the forfeitures.
In addition, after DOJ obligates funds to cover program expenses, any  AFF funds remaining at the end of a fiscal year may be declared an  excess unobligated balance and used for any of DOJ’s authorized  purposes, including helping to cover rescissions.
Court documents and DOJ data indicate that forfeitures from the Justice  Asset Forfeiture Program cases we reviewed will be used to compensate  victims and have been used to make equitable sharing payments.  Although DOJ data showed that DOJ has not yet remitted payments to  any victims in the cases we reviewed, court documents and comments  from DOJ officials indicated that approximately $2 billion of the forfeited  funds deposited in the AFF would be remitted to victims of fraud. For  example, according to Asset Forfeiture and Money Laundering Section  officials, DOJ has set up the Madoff Victim Fund in part from the related  $1.7 billion forfeited by JPMorgan Chase to collect and review victim  claims related to the Ponzi scheme operated by Bernard Madoff. DOJ  intends to distribute the funds to eligible victims of Madoff’s fraud.  Additionally, DOJ data for seven cases showed that it had made  approximately $660 million in equitable sharing payments.
From January 2009 through December 2015, for the cases we reviewed,  seven financial institutions forfeited about $5.7 billion in funds due to  violations of BSA/AML and U.S. sanctions programs requirements  through the Treasury Forfeiture Program. These forfeitures have been  deposited in the TFF and can be used for certain purposes as specified  by law. In the cases we identified, all seized and forfeited assets were  cash. TFF expenditures are governed by the law establishing the TFF  and, as we have previously reported, are primarily used to pay the  forfeiture program’s expenses in major categories including program  operation expenses, payments to third parties including crime victims,  equitable sharing payments to law enforcement partners, and other  expenses. Of the $5.7 billion contained in the TFF, the $3.8 billion paid  by BNP Paribas as part of the bank’s settlement with DOJ was  permanently rescinded from the TFF and is unavailable for obligation.  The remaining funds, if not subject to general rescissions, can be used for  a variety of purposes. As of December 2015, DOJ was considering using  approximately $310 million in TFF forfeitures for victim compensation  and, according to Treasury officials, Treasury had made approximately  $484 million in equitable sharing payments and obligated a further $119  million for additional equitable sharing payments. As with the AFF, after  Treasury obligates funds to cover program expenses, any TFF funds  remaining at the end of a fiscal year, if not rescinded, may be declared an  excess unobligated balance. These funds can be used to support a  variety of law enforcement purposes, such as enhancing the quality of  investigations.
section_title: Criminal Fines and Civil Penalties Are Eligible for Deposit in Treasury General Fund Accounts, Crime Victims Fund, and Three Percent Fund
paragraphs: DOJ has litigated court cases against financial institutions for criminal  violations of BSA/AML and U.S. sanctions programs requirements  resulting in criminal fines ordered by the federal courts. According to DOJ  officials, DOJ determines criminal fines on a case-by-case basis, in  consideration of the underlying criminal activity and in compliance with  relevant statutes. Court documents, such as court judgments and plea  agreements, communicate the amount of the criminal fine to the financial  institution. DOJ U.S. Attorneys’ Offices are primarily responsible for  collecting criminal fines. They begin the collection process by issuing a  demand letter to the financial institution. Upon receipt of the demand  letter, the financial institution makes the payment to the Clerk of the  Courts. According to officials from the Administrative Office of the U.S.
Courts, the Clerk of the Courts initially collects the payments which are  deposited into a Treasury account for DOJ’s Crime Victims Fund. Funds  in the Crime Victims Fund can be used for authorized purposes including  support of several state and federal crime victim assistance–related  grants and activities, among other things. DOJ officials told us that all  criminal fines, with a few exceptions, are deposited into the Crime Victims  Fund. This may include criminal fines related to violations of BSA/AML  requirements and U.S. sanctions regulations. In the cases we identified  from January 2009 through December 2015, the court ordered about  $141 million in criminal fines for violations of BSA/AML and U.S.  sanctions programs requirements. The $140 million fine assessed against  BNP Paribas was deposited into the Crime Victims Fund.
Additionally, in the cases we reviewed, DOJ had litigated a court case  against a financial institution for civil violations of U.S. sanctions programs  requirements which resulted in a civil penalty. The civil penalty collection  process is similar to the criminal fine collection process, but the financial  institution makes the payment to DOJ’s accounts in the Treasury General  Fund instead of to the Clerk of the Courts. As previously discussed in this  report, monies in the Treasury General Fund are used according to the  purposes described in Congress’s annual appropriations. Civil penalties  are also eligible to be assessed up to a 3 percent fee for disbursement to  DOJ’s Three Percent Fund, which is primarily used to offset DOJ  expenses related to civil debt collection. Of the cases we identified, one  case involved a civil penalty of $79 million against Commerzbank for  violating U.S. sanctions program requirements. DOJ collected the  Commerzbank civil penalty, deposited it into DOJ’s accounts in the  Treasury General Fund, and assessed a nearly 3 percent fee (about $2.3  million) that was deposited into the Three Percent Fund.
section_title: Agency Comments
paragraphs: We provided a draft of this report to Treasury, DOJ, SEC, OCC, FDIC,  and the Federal Reserve for review and comment. Treasury, DOJ, OCC,  FDIC, and the Federal Reserve provided technical comments, which we  incorporated as appropriate.
As agreed with your offices, unless you publicly announce the contents of  this report earlier, we plan no further distribution until 30 days from the  report date. At that time, we will send copies to Treasury, DOJ, SEC,  OCC, FDIC, and the Federal Reserve, and interested congressional  committees and members. In addition, the report will be available at no  charge on the GAO website at http://www.gao.gov.
If you or your staffs have any questions about this report, please contact  Lawrance Evans at (202) 512-8678 or evansl@gao.gov or Diana C.  Maurer at (202) 512-9627 or maurerd@gao.gov. Contact points for our  Offices of Congressional Relations and Public Affairs may be found on  the last page of this report. GAO staff who made major contributions to  this report are listed in appendix II.
section_title: Appendix I: Objectives, Scope, and Methodology
paragraphs: This report describes the fines, penalties, and forfeitures federal agencies  have collected from financial institutions for violations of Bank Secrecy  Act and related anti-money-laundering requirements (BSA/AML), Foreign  Corrupt Practices Act of 1977 (FCPA), and U.S. sanctions programs  requirements. Specifically, our objectives in this report were to describe  (1) the amount of fines, penalties, and forfeitures that the federal  government has collected for these violations from January 2009 through  December 2015; and (2) the process for collecting these funds and the  purposes for which they are used.
To address these objectives, we reviewed prior GAO and Office of the  Inspector General reports and relevant laws and regulations. We also  reviewed data and documentation and interviewed officials from key  agencies responsible for implementing and enforcing BSA/AML, FCPA,  and U.S. sanctions programs requirements. The agencies and offices  included in this review were: (1) offices within the Department of the  Treasury’s (Treasury) Office of Terrorism and Financial Intelligence,  including officials from the Financial Crimes Enforcement Network  (FinCEN), Office of Foreign Assets Control (OFAC), and Treasury  Executive Office for Asset Forfeiture, and Treasury’s Office of  Management; (2) Securities and Exchange Commission (SEC); (3) the  federal banking regulators—Board of Governors of the Federal Reserve  System (Federal Reserve), Federal Deposit Insurance Corporation  (FDIC), National Credit Union Administration (NCUA), and the Office of  the Comptroller of the Currency (OCC); and (4) the Department of Justice  (DOJ).
To respond to our first objective, we identified and analyzed these  agencies’ data on enforcement actions taken against financial institutions  that resulted in fines, penalties, or forfeitures for violations of BSA/AML,  FCPA, and U.S. sanctions programs requirements. Specifically, we  analyzed publicly available data from January 2009 through December  2015 on penalties assessed against financial institutions by the Federal  Reserve, FDIC, OCC, SEC, and the Financial Crimes Enforcement  Network (FinCEN), a bureau within Treasury, for violations of BSA/AML  requirements. NCUA officials we spoke with explained that they had not  assessed any penalties against financial institutions for violations of  BSA/AML requirements from January 2009 through December 2015.  FDIC and SEC provided us with a list of enforcement actions they took for  BSA/AML violations since 2009, as we were not able to identify all of their  actions through their publicly available data. We also reviewed Federal  Reserve data on penalties for violations of U.S. sanctions programs  requirements and data that SEC provided on FCPA violations. In  addition, we reviewed enforcement actions listed on Treasury’s Office of  Foreign Assets Control (OFAC) website to identify penalties assessed  against financial institutions for violations of U.S. sanctions programs  requirements enforced by OFAC. To identify enforcement actions taken  against financial institutions from the actions listed on OFAC’s website,  we applied Treasury’s definition of financial institutions, which covers  regulated entities in the financial industry.
To identify criminal cases against financial institutions for violations of  BSA and sanctions-related requirements, we reviewed press releases  from DOJ’s Asset Forfeiture and Money Laundering Section, associated  court documents, and enforcement actions taken against financial  institutions from the actions listed on OFAC’s website (see table 3 for a  list of these cases). We developed this approach in consultation with  DOJ officials as their data system primarily tracks assets forfeited by the  related case, which can include multiple types of violations, rather than by  a specific type of violation, such as BSA or sanctions-related violations.  Therefore, this report does not cover the entire universe of such criminal  cases as they may not have all been publicized through this channel.  However, this approach does include key cases for the period under our  review that involved large amounts of forfeitures. We obtained data from  DOJ’s Consolidated Asset Tracking System to determine the amounts  forfeited for these cases, and verified any Treasury-related data in DOJ’s  system by obtaining information from the Treasury Executive Office for  Asset Forfeiture. DOJ had not brought any criminal cases against  financial institutions for violations of FCPA.
We assessed the reliability of the data we used in this report by reviewing  prior GAO assessments of these data, interviewing knowledgeable  agency officials, and reviewing relevant documentation, such as agency  enforcement orders for the assessments. To verify that these amounts  had been collected, we requested verifying documentation from agencies  confirming that these assessments had been collected, and also obtained  and reviewed documentation for a sample of the data to verify that the  amount assessed matched the amount collected. As a result, we  determined that these data were sufficiently reliable for our purposes. We  also assessed the reliability of the DOJ data fields we reported on by  reviewing prior GAO and DOJ evaluations of these data and interviewing  knowledgeable officials from DOJ. We determined that these data were  also sufficiently reliable for our report.
To respond to our second objective—to describe how funds for violations  of BSA/AML, FCPA, and U.S. sanctions programs requirements were  collected—we identified and summarized documentation of the various  steps and key agency internal controls for collection processes, such as  procedures for how financial institutions remit payments. We also  obtained documentation, such as statements documenting receipt of a  penalty payment, for a sample of penalties. We interviewed officials from  each agency about the process used to collect payments for assessed  fines or penalties and, for relevant agencies, the processes for collecting  cash and assets for forfeitures and where funds were deposited. To  describe how these collections were used, we reviewed documentation  on the types of expenditures that can be authorized from the accounts  and funds they are deposited in. Specifically, we obtained documentation  on the authorized or allowed expenditures for accounts in the Treasury  General Fund, Treasury Forfeiture Fund (TFF), and DOJ’s Assets  Forfeiture Fund (AFF) and Crime Victims Fund. We also reviewed  relevant GAO and Office of Inspector General reports, and laws  governing the various accounts.
We conducted this performance audit from July 2015 to March 2016 in  accordance with generally accepted government auditing standards.  Those standards require that we plan and perform the audit to obtain  sufficient, appropriate evidence to provide a reasonable basis for our  findings and conclusions based on our audit objectives. We believe that  the evidence obtained provides a reasonable basis for our findings and  conclusions based on our audit objectives.
section_title: Appendix II: GAO Contact and Staff Acknowledgments
subsections: section_title: GAO Contacts
section_title: Staff Acknowledgments
paragraphs: In addition to the contacts named above, Allison Abrams (Assistant  Director), Tarek Mahmassani (Analyst-in-Charge), Bethany Benitez,  Chloe Brown, Emily R. Chalmers, Chuck Fox, Tonita Gillich, Thomas  Hackney, Valerie Kasindi, Dawn Locke, Jeremy Manion, Joshua Miller,  John Mingus, and Jena Sinkfield made significant contributions to this  report.