Bank Secrecy Act: Federal Agencies Should Take Action to Further Improve Coordination and Information-Sharing Efforts
Released: 2009-03-16T00:00:00

Letter

Background

The federal government’s framework for preventing, detecting, and prosecuting money laundering has expanded over the course of more than 30 years. With the passage of the Bank Secrecy Act in 1970, for the first time financial institutions were required to maintain records and reports determined to be useful to financial regulators and law enforcement agencies in criminal, tax, and regulatory matters. BSA has three main objectives: create an investigative audit trail through regulatory reporting standards; impose civil and criminal penalties for noncompliance; and improve the detection of criminal, tax, and regulatory violations.

The reporting system first implemented under BSA was insufficient to combat underlying money laundering activity. For example, before 1986, BSA did not contain sanctions for money laundering, although it did contain sanctions for failing to file reports or for doing so untruthfully. To strengthen federal AML initiatives, Congress enacted the Money Laundering Control Act of 1986. In addition to imposing criminal liability for money laundering violations, the act directed each federal banking regulator to require that insured depository institutions establish and maintain a program that would ensure and monitor compliance with the recording-keeping and reporting requirements of BSA.

The Annunzio-Wylie Anti-Money Laundering Act of 1992 amended BSA and authorized Treasury to require financial institutions to report any suspicious transaction relevant to a possible violation of a law or regulation. It authorized Treasury to require financial institutions to carry out AML programs and, together with the Federal Reserve, to promulgate record-keeping rules relating to funds transfer transactions. The act also made the operation of an unlicensed, money-transmitting business illegal under state law a crime.

In 1994, the Secretary of the Treasury delegated overall authority for enforcement of, and compliance with, BSA and its implementing regulations to the Director of FinCEN. FinCEN was established within Treasury in 1990 initially to support law enforcement by providing a government-wide financial intelligence and analysis network, and became a bureau in 2001. Among its current responsibilities, FinCEN issues regulations; collects, analyzes, and maintains BSA-related reports and information filed by financial institutions; makes those reports available to law enforcement and regulators; and tries to ensure financial institution compliance through enforcement actions. According to its strategic plan, FinCEN seeks to ensure the effectiveness of the BSA regulatory framework and facilitate interagency collaboration. FinCEN’s RPPD is responsible for BSA regulatory, compliance, and enforcement functions. In August 2004, FinCEN created an Office of Compliance in RPPD to oversee and work with the federal financial regulators on BSA examination and compliance matters.

The most recent expansion of BSA legislation occurred in October 2001 with enactment of the USA PATRIOT Act. Among other things, the act required an entity defined in BSA as a “financial institution” to have an AML program. Each program must incorporate: (1) written AML compliance internal policies, procedures, and internal controls; (2) an independent review; (3) a designated compliance person to coordinate and monitor day-to-day compliance; and (4) training for appropriate personnel. Entities not previously required under BSA to have such a program, such as mutual funds, broker-dealers, MSBs, certain futures brokers, and insurance companies, were required to do so under this act. Moreover, the act mandated that Treasury issue regulations requiring registered securities brokers-dealers to file SARs and provided Treasury with authority to prescribe regulations requiring certain futures firms to submit SARs. Among its other provisions, the act required that Treasury issue regulations setting forth minimum standards for financial institutions regarding verifying the identity of customers who open accounts. The USA PATRIOT Act also required that financial institutions establish due diligence and, in some cases, enhanced due diligence policies designed to detect and report instances of money laundering through private banking and correspondent accounts of non-United States persons; conduct enhanced scrutiny of private banking accounts maintained by or on behalf of foreign political figures or their families; and share information relating to money laundering and terrorism with law enforcement authorities, regulatory authorities, and financial institutions. In addition, nonfinancial institutions also became subject to BSA currency transaction reporting (CTR) requirements where, in the course of trade or business, the business receives more than $10,000 in coins or currency in one transaction (or two or more related transactions).

FinCEN Administers the BSA Framework, under which Many Regulatory Entities Exercise Delegated and Independent Compliance and Enforcement Authorities

The objectives of U.S. financial services regulation are pursued by a complex combination of federal and state government agencies and SROs. Generally, regulators specialize in the oversight of financial institutions in the various financial services sectors, which stem largely from the laws that established these agencies and defined their missions. Under the BSA regulatory scheme, FinCEN is responsible for the overall administration and enforcement of BSA and may take enforcement actions, but federal and state regulators and SROs conduct day-to-day compliance and enforcement activities. Specifically, with respect to examinations for BSA compliance, FinCEN delegated its BSA examination authority to the federal banking regulators, SEC, CFTC, and IRS. The federal banking regulators, SEC, and CFTC also use their independent authorities to examine entities under their supervision for compliance with applicable BSA/AML requirements and regulations. FinCEN has retained enforcement authority and may impose civil penalties for violations. In addition, each of the federal bank regulators also may impose civil money penalties for significant BSA violations, and have specific authority to initiate cease and desist proceedings against the entities they supervise for BSA/AML violations. SEC, CFTC, and their SROs also have authority to enforce their rules requiring BSA/AML compliance; and IRS has very limited enforcement authority delegated by FinCEN. Justice prosecutes criminal violations of BSA, and several federal law enforcement agencies can conduct BSA-related criminal investigations.

FinCEN Administers the BSA and Has Delegated Examination Authority but Retained Enforcement Authority

As noted previously, in 1994, the Secretary of the Treasury delegated overall authority for compliance and enforcement of BSA and its implementing regulations to the Director of FinCEN. Over the years, as more financial activities and types of institutions became involved in the BSA, Treasury delegated BSA examination authority to the federal banking regulators; and to SEC, CFTC, and their SROs. Figure 1 shows the federal agencies and SROs involved in examining for compliance with BSA.

Table 1 summarizes the types and numbers of institutions the federal agencies examine for BSA/AML compliance, and which agency or SRO conducts these examinations.

FinCEN retains BSA enforcement authority and may take enforcement actions independently of, or concurrently with, other regulators. FinCEN’s Office of Enforcement conducts independent investigations of BSA violations mostly based on referrals of BSA noncompliance from financial regulators. FinCEN has information-sharing MOUs with the federal banking regulators, SEC, CFTC (as of January 2009), IRS, and some states under which these agencies provide FinCEN information on significant BSA violations and deficiencies found during their examinations. Less frequently, FinCEN conducts investigations based on information from Justice and from its own in-house referrals identified through analysis of BSA data. If a FinCEN investigation results in a decision to take an enforcement action, FinCEN may issue a civil money penalty, depending on the severity of the violation. FinCEN and the financial regulators also try to coordinate enforcement actions. (We discuss coordination of enforcement actions in more detail later in this report.)

Many Federal and State Agencies, as well as SROs, Have Independent Compliance and Enforcement Authorities That Encompass BSA/AML Requirements

Independent of Treasury-delegated authorities, the federal banking regulators have general authorities under the federal banking laws to conduct compliance examinations and take enforcement actions against institutions for violations of any applicable law, including BSA. The Federal Deposit Insurance Act specifically provides that the Federal Reserve, FDIC, OCC, and OTS are to prescribe regulations requiring the institutions they supervise to maintain procedures for compliance with BSA requirements and to conduct examinations of those institutions for compliance with reporting and AML provisions of BSA. The Federal Credit Union Act contains the same requirement for NCUA. Federal banking regulators examine whether depository institutions under their supervision are in compliance with BSA/AML requirements concurrently with their examinations for the entities’ overall safety and soundness.

Depository institutions can generally determine their regulators by choosing a particular kind of charter—for example, commercial bank, thrift, or credit union—which may be obtained at the state level or the national level. While state regulators charter institutions and participate in oversight of those institutions, all of these institutions have a primary federal regulator if they have federal deposit insurance. The Federal Reserve, FDIC, OTS, and NCUA alternate or conduct joint safety and soundness examinations—including a BSA/AML component—with state regulators, generally using the same examination procedures (shown earlier in table 1). As recently as 2004, about one-third of state banking departments reported not examining for BSA compliance; however, they have taken a more active role in conducting these reviews more recently. FinCEN currently has information-sharing MOUs with 46 state agencies that conduct AML examinations.

As with examinations, the Federal Reserve, FDIC, OCC, and OTS have authority under the Federal Deposit Insurance Act to take enforcement actions against institutions they supervise and related individuals when they determine that an institution or related individual has violated an applicable law or regulation. These agencies also have specific authority to initiate cease-and-desist proceedings for failure to establish and maintain BSA compliance procedures. NCUA also can take enforcement actions under its legislative authorities. Furthermore, state agencies have authority to take enforcement actions against institutions chartered within their state that are in violation of banking legislation.

SEC and CFTC are regulatory agencies with missions that focus on protecting investors, preventing fraud and manipulation, and promoting fair, orderly markets, but the regulatory frameworks for the securities and futures industries are structured differently than those for depository institutions. Consistent with this framework, SEC and CFTC regulate their industries in part through oversight of SROs. SEC and CFTC have authority under the Securities Exchange Act and the Commodity Exchange Act, respectively, to inspect the books and records of firms that they supervise. SEC, CFTC, and their SROs have adopted rules for compliance with BSA/AML requirements.

More specifically, SEC’s Office of Compliance Inspections and Examination (OCIE) shares BSA examination responsibilities with securities SROs, which have statutory responsibilities to regulate their own members. The Financial Industry Regulatory Authority (FINRA) provides oversight of the majority of broker-dealers in the securities industry. Other securities self-regulatory organizations include the Chicago Board Options Exchange and Philadelphia Stock Exchange. OCIE and the SROs both conduct BSA/AML examinations for broker- dealers, but only OCIE conducts routine examinations of registered investment advisors and their affiliated mutual funds for BSA compliance as they are not members of an SRO.

CFTC officials said that CFTC does not routinely conduct direct examinations of the firms it supervises; instead, CFTC oversees the examinations conducted by its SROs—the National Futures Association (NFA),which conducts most of the audits, the Chicago Mercantile Exchange, the New York Mercantile Exchange, the Chicago Board of Trade, and the Kansas City Board of Trade. The SROs monitor for compliance with BSA/AML and with their own rules, which include BSA/AML obligations.

SEC and CFTC ultimately are responsible for enforcing compliance with their rules and regulations and can institute enforcement actions against firms within their jurisdiction that appear to be in violation of those agencies’ BSA-related rules. However, because the SROs overseen by SEC and CFTC have rules requiring compliance with applicable laws and regulations, they typically have front-line responsibility for instituting BSA- related enforcement actions and generally inform SEC and CFTC of such actions. The securities and futures SROs have authority to enforce each of their respective BSA/AML-based rules against their members—generally, broker-dealers and futures firms. They take their own enforcement actions against their members which may include suspending, expelling, fining, or otherwise sanctioning member firms (and their associated persons).

While IRS performs a regulatory function with regard to nonbank financial institutions (NBFI), IRS generally is not considered a “regulator”; it is a bureau within Treasury whose mission is to assist taxpayers in understanding and meeting their tax responsibilities. Unlike the other federal agencies with regulatory functions, IRS does not have independent authority to conduct BSA examinations. Rather, under delegation of examination authority from FinCEN, IRS examines any financial institution not subject to BSA examination by the federal financial regulators. Thus, institutions that IRS examines include MSBs; casinos and card clubs; dealers of precious metals, stones, and jewels; and certain insurance companies. IRS’s Small Business/Self-Employed Division, which reports directly to the Deputy Commissioner for Services and Enforcement, conducts BSA compliance examinations of these types of NBFIs. In 2004, IRS created the Office of BSA/Fraud within the division to focus on BSA examinations of NBFIs. As some NBFIs are state-chartered institutions, such as MSBs, IRS also has information-sharing MOUs with many state agencies to facilitate cooperation on examinations.

FinCEN did not delegate to IRS authority to enforce BSA requirements, except for foreign accounts, and IRS does not have independent authority to enforce BSA requirements. IRS can issue a letter of noncompliance and make suggestions for corrective action to institutions it examines for BSA compliance. If significant BSA violations or deficiencies were found or if an institution refused to take corrective action, IRS would refer the case to FinCEN to determine what type, if any, of enforcement action might be appropriate. IRS examiners also may refer cases to their Criminal Investigation unit, if the examiners believe that a willful criminal violation may be involved. IRS Criminal Investigation, IRS’s enforcement arm, investigates individuals and businesses suspected of criminal violations of the Internal Revenue Code, money laundering and currency crime, and some BSA requirements. IRS Criminal Investigation investigates BSA criminal violations in conjunction with other tax violations.

Justice Prosecutes Criminal BSA Violations, and Multiple Federal Law Enforcement Agencies Can Conduct Criminal Investigations That Are BSA-related

While Justice prosecutes criminal violations of the BSA, several federal law enforcement agencies in Justice and the Department of Homeland Security can be involved in the detection and investigation of criminal BSA activity. More specifically, Justice investigates individuals and financial institutions that repeatedly and systemically do not comply with BSA regulations or are involved in criminal money laundering offenses and prosecutes those charged. Referrals to Justice from financial regulators of suspected cases of criminal BSA/AML violations also may trigger a Justice investigation. In addition to prosecutions, Justice has resolved criminal investigations through deferred or nonprosecution agreements and guilty plea agreements, which have included fines, forfeitures, remedial actions, and timelines for implementation.

Within the Department of Homeland Security, the Secret Service, Immigration and Customs Enforcement, and Customs and Border Protection all use BSA data in their investigations. According to Justice officials, most criminal BSA cases against financial institutions start as investigations of individuals involved in illegal activities, such as drug trafficking or money laundering.

While Agencies Have Enhanced BSA Compliance Programs, Opportunities Exist to Improve Interagency and State Examination Coordination

Financial regulators have incorporated their BSA/AML responsibilities into their supervisory approaches to compliance and enforcement, but opportunities exist for improved coordination. Federal banking regulators and industry representatives report that their interagency public BSA examination manual increased collaboration on bank examinations. SEC and CFTC have formalized their BSA/AML examination procedures in nonpublic BSA examination modules and coordinate with their SROs on examination issues. IRS developed an MSB examination manual and an overall strategy for NBFI identification and examination with FinCEN, but has not fully coordinated its MSB examination schedules with states, missing opportunities to leverage limited resources. Further, across financial industries, agencies have not established a formal mechanism through which they could discuss compliance processes and trends without industry present. The regulators with enforcement authority issued BSA-related enforcement actions in 2008, and the federal banking regulators improved coordination of their enforcement actions. Officials from the federal banking regulators reported improved transparency and consistency of enforcement actions, due in part to new interagency guidance.

Federal Agencies Have Formalized and Cited Improvements to Examination Procedures and Guidance; However, Opportunities Exist for Increased Coordination

In 2005, the federal banking regulators, in collaboration with FinCEN, combined their BSA guidance with examination procedures and made both publicly available in one manual. Since 1986, the federal banking regulators have been required to ensure that institutions under their supervision have AML programs. SEC and CFTC and their SROs use a different approach in regulating their industries—they keep their examination modules nonpublic, but provide public guidance to industry through various methods. With respect to BSA, these agencies and SROs also have coordinated and formalized their examination procedures since the 2001 USA PATRIOT Act required institutions under their supervision to have AML programs. IRS developed an examination manual with FinCEN for MSBs, but does not fully coordinate its examination schedules with state examiners. The financial regulators do not have a nonpublic forum for regularly discussing BSA examination procedures and findings across sectors.

Federal Banking Regulators’ Manual and BSA/AML-related Training Have Improved Collaboration and Transparency

Through the development of an interagency BSA/AML examination manual, guidance, and inter- and intra-agency training, the banking regulators have increased collaboration on BSA examinations and the transparency of the examination process. In 2005, the federal banking regulators, in collaboration with FinCEN, published the Federal Financial Institutions Examination Council (FFIEC) BSA/AML Examination Manual, which was updated in 2006 and 2007. The manual provides an overview of BSA compliance program requirements and guidance on identifying and controlling money laundering and other illegal financial activities; presents risk management expectations and sound practices for industry; and identifies examination procedures. All federal and state banking regulators use this manual when conducting BSA/AML examinations, whether they are joint or independent examinations. As mentioned previously, the Federal Reserve, FDIC, and OTS will conduct (on an alternating basis) independent or joint examinations with state agencies. NCUA conducts examinations at all federally chartered credit unions, while state supervisory authorities conduct BSA examinations at all state-chartered credit unions. Depending upon the risks, NCUA may conduct joint examinations with the state authorities at the state-chartered credit unions. OCC supervises nationally chartered banks and federal branches of foreign banks and therefore does not share jurisdiction with state banking regulators. Both federal and state examiners said that the manual helped increase the consistency of examinations among the regulators.

Federal banking regulators also generally share BSA/AML examination workpapers and findings with their state counterparts in cases where they share regulatory jurisdiction over an institution. For example, NCUA officials said that their findings are shared with states to coordinate their reports on joint examinations. State officials we interviewed concurred, stating that they share workpapers in cases where they have federal regulatory counterparts. Several industry officials we interviewed also thought that the federal banking regulators collaborated well with other federal banking regulators on their examinations.

The new examination manual also has improved the consistency and transparency of examinations by providing a framework for examinations, requiring risk assessments and transaction testing, and providing publicly available examination procedures for banks. For example, the manual lists requirements for examination scoping and transaction testing. Officials from one state regulator said the manual has helped answer questions for institutions and regulators, and helped institutions structure their AML programs. All of the federal banking regulators and most of the state banking regulators and banking associations we interviewed consider the process of gathering data for banks and the risk-assessment component of the manual beneficial. As one regulator said, the manual helps an examiner understand an institution’s products and services and the steps the institution took to mitigate risks. Most industry officials we interviewed thought the manual provided more consistency to and clearer guidance about the examination process.

While regulators and industry officials said that the manual has been beneficial overall, some banking regulator and industry association officials said that initially it sometimes resulted in longer examinations or additional procedures. Federal Reserve examiners noted that it is important for examiners to apply the risk-based approach, using the minimum procedures where appropriate, and to utilize work previously done by a bank’s independent audit, where possible. Similarly, NCUA examiners added that initially the manual resulted in some expanded examinations. However, by using the risk-based approach they are able to focus their resources on the highest areas of risk. Federal Reserve officials added that as examiners have become more familiar with the manual since its adoption, the amount of background reading that examiners need to do in preparing for a BSA/AML examination has decreased. Some officials from the institutions we interviewed were less concerned with the length of the examinations than with some examiners interpreting the manual’s requirements too literally or having expectations beyond those expressed in the manual. For example, an official from one large bank said that when the manual was first implemented, regulators were examining “very close to the manual” and interpreted it literally instead of conducting their examinations based on risk. In another case, an official from one small bank that files very few SARs noted that in recent examinations, examiners unnecessarily focused on the bank’s record keeping and whether SAR reports were filed on time.

FFIEC serves as the mechanism for the banking regulators to develop interagency BSA/AML guidance for examiners and the industry. FFIEC is also the forum in which banking regulators and FinCEN discuss and draft manual revisions. In addition to its role in developing the manual, the FFIEC BSA/AML Working Group is an interagency group through which the banking regulators develop joint examiner training, such as the AML Workshop and Advanced BSA/AML Specialists Conference. FinCEN officials said that FinCEN specialists also teach at these workshops. Both federal and state banking examiners participate in FFIEC AML workshops and other training sessions offered through their agencies or vendors. In interagency working groups, participants share their knowledge of and experiences with BSA, which federal banking regulator officials have said helped them work toward achieving consistency in their examination processes. Federal banking regulators also train examiners within their own agencies on the new manual.

As a check on their examination programs, including their BSA/AML examination programs, the federal banking regulators conduct quality assurance reviews. The regulators’ quality assurance reviews that we examined, which were conducted from 2005 through 2008, indicated that banking examiners were implementing BSA/AML compliance appropriately, with some minor exceptions. For example, reviews from one regulator noted that examiner staff were well trained, devoted significant attention to BSA/AML issues, and generally had well-organized workpapers. Reviews from a second regulator found that examiners complied with BSA/AML guidance, quality control processes were satisfactory, processes for determining enforcement actions and making referrals to FinCEN were sufficient, SAR reviews were timely, and communication between the regulator’s headquarters and regions was strong. Another regulator concluded that its examiners demonstrated strong compliance with all issued national and regional guidance for BSA examinations, and found adequate internal controls, no material weaknesses in workpapers, and adequate supervisory and examination resources for evaluating BSA compliance. While reviews generally were positive, they also noted some weaknesses. One regulator recommended that a regional office develop a process for a quality assurance group to periodically review workpapers on a risk-focused basis because of the complexity of the FFIEC BSA/AML examination procedures and also expressed concern about turnover of qualified staff. A second regulator noted a lack of both independent testing and identification of high-risk accounts in one region, and inappropriate recording of a BSA violation in a second region. A third regulator found instances where reported BSA violations were not forwarded to the agency’s headquarters.

SEC, CFTC, and Their SROs Coordinated within Their Industries to Formalize Examination Procedures and Also Cited Examination Coordination across Industries

SEC, CFTC, and their SROs share responsibility for oversight of the securities and futures industries, and have worked together to incorporate new BSA/AML requirements into their compliance programs. These agencies take a different approach than the federal banking regulators— they have separate, nonpublic procedures for their examiners and provide public guidance to industry.

In 2006, SEC and what is now FINRA prepared a nonpublic examination module for broker-dealers in an effort to promote consistency in BSA/AML examinations. SEC staff said that the SEC-FINRA module generally formalized procedures and processes that SEC and its SROs already had in place. SEC staff added that their agency has procedures in place for granting access to nonpublic information in response to requests by other regulators. Furthermore, SEC provided all SRO broker-dealer examination modules and procedures to FinCEN for its review and input under their MOU. SEC also has a separate, nonpublic examination module for mutual funds, which it, rather than the SROs, examines. SEC staff explained that BSA/AML examinations of mutual funds are more complex than examinations of broker-dealers because mutual funds do not have their own employees and are managed by investment advisors. Registered investment advisors are rated according to the risk they manage, and those with a higher risk profile are examined more frequently. SEC annually completes approximately 100 mutual fund examinations covering BSA issues.

Working through the Joint Audit Committee, the futures SROs developed a common, nonpublic BSA/AML examination module, which the futures SROs (except NFA) use in their BSA/AML examinations. The Joint Audit Committee updates the BSA module annually and submits the module to CFTC. Unlike SEC, CFTC had not provided the examination modules to FinCEN for its review because the agencies did not have an information- sharing MOU in place until January 2009. (We discuss MOUs in more detail later in this report.) However, CFTC and FinCEN officials informally have discussed procedures the futures SROs use during their BSA/AML examinations.

In lieu of making examination modules public, SEC, CFTC, and their SROs offer public BSA guidance and education through various methods and venues, including the Internet and industry conferences. For example, SEC developed BSA “source tools” for broker-dealers and mutual funds, which compile key laws, rules, and guidance and provide regulatory contact information. The tools are available on SEC’s Web site. Securities SROs also provide training and update members on BSA/AML rules and guidance. In addition, FINRA has developed an AML program template for small firms on its Web site that provides possible language for procedures, instructions, and relevant rules and Web sites, among other information. Similarly, CFTC provides information on BSA/AML requirements on its Web site and participates in industry conference panels and outreach efforts with other regulators (in particular foreign regulators). In addition, futures SROs also may provide training, send members updates on new BSA/AML rules and guidance, and participate in industry conference panels to help educate institutions on BSA/AML. For example, NFA provides Web-based training and an AML questionnaire for futures commission merchants and introducing brokers. Overall, industry representatives have been complimentary about the information and education provided by SEC, CFTC, and their SROs; however, they still expressed a desire to have BSA/AML examination modules made public.

SEC, CFTC, and their SROs also have coordinated on multiple-regulator and cross-industry examination issues because many institutions can be registered with more than one SRO or join more than one exchange. For example, broker-dealers can be members of more than one securities SRO. FINRA (which conducts almost 90 percent of broker-dealer examinations) meets with other securities SROs to coordinate examination schedules and ensure that all broker-dealers are covered by examinations. FINRA also has several regulatory agreements to conduct work on behalf of other SROs. In the futures industry, futures commission merchants must be members of NFA and may be clearing members of more than one contract market. Therefore, the Joint Audit Committee assigns an SRO to be the lead regulator, responsible for conducting examinations for each firm with multiple memberships. Examination reports and findings are shared among futures industry SROs where the firm is a member.

Some of the largest SEC-registered broker-dealers also may be registered as futures commission merchants or introducing brokers on futures exchanges. In these instances, FINRA and futures SROs may coordinate informally on BSA/AML examinations of any futures firms that are registered dually as securities broker-dealers. As part of FINRA’s information-sharing agreement with NFA, the two SROs meet at least quarterly to share examination results and schedules. Other futures industry SROs obtain FINRA examination results on an as-needed basis. Futures SRO officials said that (1) if FINRA examined an institution’s AML program in the last 6 months and reported no major findings and (2) the institution used the same BSA officer and procedures for its securities and futures business, then SRO officials might refrain from conducting the full range of their examination activities. Finally, SEC, CFTC, and the securities and futures SROs participate in Intermarket Surveillance Group meetings.

In addition to working together to help promote consistency in examinations, securities and futures regulators also have programs and procedures—similar to the quality assurance reviews of the federal banking regulators—to review examinations or specific issues. For instance, SEC staff told us that liaisons to each of SEC’s regional offices conduct a quarterly review of a representative sample of examinations reports that include AML findings. They added that SEC reviews the examination reports to ensure that AML findings are sufficiently supported and conclusions are valid. SEC staff conducts periodic inspections of FINRA’s overall BSA/AML examination program. The purpose of these inspections is to identify any systemic deficiencies or trends in FINRA’s BSA/AML program. During previous SEC inspections, SEC and FINRA staff said that SEC identified a few BSA/AML-related deficiencies in specific FINRA examinations. FINRA officials stated that while SEC found isolated weaknesses in some examinations, these findings did not indicate any significant trends. FINRA officials stated they use findings from SEC’s reviews to identify areas for additional training. Similar to SEC, CFTC conducts reviews of SROs’ examinations, in which CFTC staff review SRO examinations to ensure they are appropriately examining for compliance with futures laws, including BSA. CFTC officials told us that these reviews have not identified any problems with BSA/AML examination programs of the futures SROs.

Although SEC, CFTC, and SRO officials cited coordination on BSA issues, industry officials at large financial companies with whom we spoke had mixed opinions on coordination among the securities and futures regulators. For example, one industry representative said that futures SROs and FINRA coordinated well and shared examination information. The representative also stated that the futures SRO would not conduct its own examination if its review of FINRA’s examination workpapers showed the FINRA to be work sufficient. However, another industry representative indicated that they had never seen FINRA and their futures SRO coordinate on BSA/AML examinations.

IRS Has Improved Its BSA Compliance Efforts; However, It Does Not Fully Coordinate Examination Schedules with States

Since our 2006 report, IRS has made improvements in its BSA/AML compliance program by revising guidance, identifying additional NBFIs, and coordinating with FinCEN and the states; however, IRS and state agencies have missed opportunities to better leverage examination resources by not coordinating their examination schedules. In response to a December 2006 GAO recommendation, IRS updated its Internal Revenue Manual to reflect changes in its BSA/AML program policies and procedures and distributed the revisions to IRS staff.

In our 2006 report, we also said that IRS had identified only a portion of the NBFI population. In 2005, IRS’s database contained approximately 107,000 potential NBFIs; however, during the same year FinCEN estimated that there could be as many as 200,000 MSBs, the largest group of NBFIs subject to BSA requirements. Through subsequent coordination with FinCEN and state regulators and internal identification efforts, IRS significantly increased the number of identified MSBs. For example, at least three or four times a year, FinCEN sends IRS lists of anywhere from 100 to 300 potentially unregistered MSBs, which FinCEN identified by reviewing SARs from depository institutions that mention unregistered MSBs. Similarly, states that signed an MOU with IRS must provide IRS lists of state-licensed and registered MSBs on a quarterly basis. IRS officials said that the agency found about 20 percent of the new MSB locations as a result of information provided by with the FinCEN and states’, but that most of the newly identified MSBs were added due to internal identification efforts. According to IRS officials, in June 2008 the database contained more than 200,000 unique locations of MSBs.

In our 2006 report, we recommended that FinCEN and IRS develop a documented and coordinated strategy that outlined priorities, time frames, and resources needs for better identifying and selecting NBFIs for examination. In response, IRS and FinCEN developed such a strategy. Furthermore, IRS, in concert with FinCEN and state regulators, has developed a BSA/AML examination manual for MSBs that was released in December 2008. The manual contains an overview of AML program requirements, discusses risks and risk-management expectations and sound practices for industry, and details examination procedures. The manual’s main goals are to enhance consistency across BSA examiners, promote efficient use of examination resources, and provide guidance to examiners and MSBs about the BSA examination process.

In July and August 2008, IRS and two state regulators tested the feasibility of conducting joint examinations using the new MSB examination manual. Many factors complicate joint examinations—including varying state licensing requirements, coordination of examiner resources, the difficulties of sharing confidential information, and differing examination scope and focus. For instance, one state may require licensing of only money transmitters, while another state also might require check cashiers and currency exchangers to obtain a license. Nonetheless, some state regulators with whom we spoke expressed a desire to conduct joint or alternating examinations with IRS to better leverage state resources. One state regulator said that joint examinations would allow states to issue enforcement actions pursuant to their own state authority against institutions with AML violations since IRS lacks enforcement authority. According to the Money Transmitter Regulators Association, state financial regulators already conduct joint examinations with other states to leverage examination resources and expertise. IRS officials said they will review and incorporate examiner comments from the joint examination pilot and work with the Conference of State Banking Supervisors to develop formal guidance for IRS and state examiners.

Additionally, IRS has increased the number of its information-sharing MOUs with state financial regulators from 34 in 2005 to 43 as of October 2008. Under the MOU, the state regulators are typically required to provide lists of state-licensed and chartered MSBs, examination reports, information concerning BSA noncompliance, and examination schedules on a quarterly basis to IRS. Also on a quarterly basis, IRS agreed to provide copies of all Letter 1112 (letters of noncompliance sent to institutions with BSA violations), copies of all Letter 1052 (notifications to new institutions of relevant BSA regulations), lists of MSBs in the state, and examination schedules to state financial regulators. According to the MOU, IRS officials and state regulators will meet periodically to review the implementation of the MOU. Following one state financial regulator comment on the usefulness of the information provided in the Letter 1112, IRS officials revised the form letter to include information on the type of institution examined and the activities conducted by that institution.

According to IRS officials, many state agencies are not living up to their responsibilities as stated in the MOU. IRS data show that 28 of 43 state agencies that signed an information-sharing MOU have not provided IRS with MSB information and only 4 of 43 have provided examination schedules. In addition, state financial regulators that send MSB data to IRS do so using different formats, limiting the usefulness of the data for IRS. IRS is working with states to develop a standardized format for all state information, making it easier to provide the information to IRS and for IRS to integrate the information into its database.

While IRS provides MSB information to state regulators, it has not shared its examination schedules with states, contrary to what it agreed to do as part of their MOUs. IRS officials said they provide state regulators with their annual workplans, which include the total number of NBFIs to be examined but not the names of the institutions to be examined. Therefore, the state financial regulators cannot plan their examinations to avoid potential overlap or coordinate joint examinations. One state agency noted that it had conducted examinations of MSBs, only to find out later that IRS had conducted its examinations not long before. Several state agencies said that greater coordination and sharing of examination schedules would help reduce redundancy in examination resources. Best practices in interagency coordination suggest agencies should assess their relative strengths and limitations, identify their mutual needs, and look for opportunities to leverage each others’ resources—thus obtaining additional benefits that would not be available if they were to work separately. IRS officials said state regulators would not derive much benefit from IRS providing examination schedules on a quarterly basis because new case files on institutions are sent to field managers often, sometimes weekly, and field managers and examiners have flexibility and discretion to determine their examination schedules. In addition, some institutions on IRS examination lists may not appear on a state regulator’s list because of varying state licensing and examination requirements of MSBs. However, by not implementing coordination of examination schedules with states, IRS may have missed opportunities to leverage resources, reduce regulatory duplication, maximize the number of MSBs to be examined, and better ensure BSA compliance with MSBs.

Federal Agencies Do Not Hold Regular, Nonpublic Discussions about BSA Examination Issues, which Could Inhibit Their Ability to Leverage Resources

While all federal agencies have made improvements in their BSA compliance efforts, they have not established a formal mechanism through which they collectively can discuss sensitive BSA examination processes and findings in nonpublic meetings. All federal agencies and some SROs participate in the Bank Secrecy Act Advisory Group (BSAAG)—a public- private working group headed by FinCEN that meets twice a year to discuss BSA administration. BSAAG also includes a number of subcommittees on various BSA/AML issues. Representatives from the SROs, industry, and law enforcement agencies are present at these meetings and on some subcommittees. Some regulatory officials have told us that the presence of industry representatives and the number of participants in BSAAG inhibit more detailed discussion on some issues. Further, sensitive information, such as examination processes and findings, cannot be discussed due to the presence of industry.

Some federal agency officials said they have held discussions with regulators of other industries outside of BSAAG, but the discussions generally were held on an informal basis and were not inclusive of all federal agencies. Some banking regulators cited their public manual as a reason for not meeting outside of BSAAG with regulators of other industries. FDIC officials stated, outside of meetings with other federal banking regulators, they had met with several state MSB regulators to understand the MSB examination process and other state roles relating to MSBs. One of the primary goals of these meetings was to determine if they could share information about MSB examinations with some state regulators. SEC staff said they informally have had discussions on BSA/AML issues with federal bank regulators and CFTC. SEC and Federal Reserve staff cited frequent, informal communications between the agencies on BSA issues. Further, SEC and the Federal Reserve signed an MOU in July 2008 under which they can share information on common interests, which could include BSA violations. Under the MOU, if SEC or the Federal Reserve became aware of a significant violation occurring in an institution regulated by the other agency, they would notify the other agency and provide additional information if requested. CFTC officials said that outside of BSAAG, they generally discuss examination procedures only with SEC and FINRA. Similarly, IRS officials stated they have met with regulators on an ad hoc basis when there have been overlapping issues. FINRA officials told us that they had very useful meetings with the Federal Reserve on two occasions (in April and December 2008) during which they discussed BSA examination approaches and findings. These meetings will continue on a biannual basis. In addition, SEC and FINRA staff said that in November 2008, SEC and FINRA staff met with OCC and Federal Reserve staff to share general information about SEC and FINRA’s BSA/AML examination programs.

While they did not discuss specific examination procedures, FINRA officials said they would be willing to do so if it were useful.

Some industry officials expressed concern about examination overlap and suggested that if regulators collectively could discuss these issues, the collaboration could help decrease resources expended on responding to duplicative information requests and increase the consistency of examination processes. Many of the largest financial institutions are part of a bank or financial holding company structure—companies that could include broker-dealers and futures firms, as well as banks. Therefore, some financial institutions have multiple regulators from various institutions. Industry representatives said that large financial institutions employ enterprise-wide, risk-based AML programs that have many similar elements across business lines. As no single regulator examines BSA/AML procedures for all of the institution’s functions, in some cases they must work with several regulators to review the same or similar policies and procedures. In addition, some officials also mentioned that regulators sometimes arrived at different findings when looking at the same BSA processes. For example, one official stated that regulators of different industries reviewed a common AML procedure and arrived at different conclusions—one regulator approved a policy and another requested a wording change.

According to our key practices for collaboration, agencies can enhance coordination of common missions by leveraging resources and establishing compatible procedures. To facilitate collaboration, agencies need to address the compatibility of standards, policies, and procedures— including examination guidance and its implementation. However, because banking-regulator and MSB examination guidance is public and SEC and CFTC guidance is nonpublic, the agencies cannot address these and other sensitive regulatory issues in the existing interagency forum, BSAAG. As a result, the regulators may not be able to gain the benefits of collaboration—leveraging scarce resources and building on the experiences and improvements of other agencies. Furthermore, by not having a mechanism that could provide an overview of examination efforts, regulators may be missing opportunities to (1) discuss BSA/AML concerns from the viewpoint of all financial industries being interconnected and (2) decrease the regulatory burden, where possible, for the institutions under examination by multiple regulators.

Regulators with Enforcement Authority Took BSA-Related Enforcement Actions, and Federal Banking Regulators Reported Improved Coordination of Enforcement Actions

The BSA/AML examinations that federal banking regulators, SEC, CFTC, and their SROs conducted resulted in the citation of violations and the taking of informal (in the case of the federal banking regulators) and formal enforcement actions. In our interviews, the federal banking regulators discussed factors potentially influencing BSA compliance in their industry and also reported improved interagency coordination on enforcement actions due, in part, to the issuance of new guidance. SEC and CFTC are kept apprised of enforcement actions that their SROs take through meetings and information-tracking efforts. In contrast, because it does not have the enforcement authority, IRS refers the BSA violations it finds to FinCEN, which takes an enforcement action, if appropriate. Justice pursues cases when it believes BSA noncompliance is criminal.

Federal Banking Regulators Have Taken Informal and Formal Enforcement Actions to Promote BSA Compliance among Depository Institutions

The federal banking regulators have taken informal and formal enforcement actions against depository institutions to address BSA/AML concerns. The federal banking regulators can only take enforcement actions under their enabling legislation contained in Title 12 of the United States Code, but these actions can be based on an institution’s violation of BSA. Table 2 provides aggregate numbers of examinations, violations, and enforcement actions taken by the federal banking regulators. Under the regulators’ AML program rules, in 2008 the most frequently occurring violations concern requirements to independently test an institution’s BSA/AML compliance program, train staff on BSA/AML, and maintain internal controls. BSA requires that depository institutions implement and maintain a system of internal controls to ensure an ongoing BSA compliance program. An example of such a control is monitoring for suspicious activity, which one regulator explained can be costly and difficult, and time consuming for an institution to implement. With respect to training, several federal banking regulators said that some banks’ staff, even BSA compliance officers, may lack adequate BSA/AML training, especially when such staff are newly hired.

The most frequently cited violations under Treasury’s BSA rules are similar across the banking regulators. These violations concern customer identification programs (CIP), CTRs, and requests for filing reports. For example, a violation of CIP requirements could mean that an institution did not implement a written CIP. An institution violating 31 CFR 103.22 did not adhere to the requirement regarding reporting currency transactions in excess of $10,000. Violations of 31 CFR 103.27 could mean that an institution failed to meet the filing and record-keeping requirements for CTRs, reports of international transportation of currency or monetary instruments, or reports of foreign bank and financial accounts. While regulators emphasized that no one factor could explain upward or downward trends in BSA violations, they cited several possible factors influencing these trends—the implementation of the FFIEC BSA/AML examination manual, additional training for examiners and the banking industry, banking regulators more clearly communicating their expectations to institutions, and institutions developing better AML programs. For example, one regulator said that implementing the examination manual may have contributed to a decline in violations by providing guidance to banks on identifying and controlling BSA/AML risk and promoting consistency in the BSA/AML examination process. However, another regulator said that the manual may have led to its increasing number of violations by providing better guidance to examiners. Appendix III provides further information on selected BSA/AML-related enforcement actions taken by all financial regulators.

In response to violations, the federal banking regulators have issued thousands of informal enforcement actions but relatively few formal enforcement actions in recent years. For example, in fiscal year 2008, they issued a total of 3,416 informal and 37 formal enforcement actions. Federal banking regulators said that generally, informal corrective actions will suffice for technical noncompliance or the failure of a portion of the AML program that does not indicate that the entire program has failed. If a compliance violation is significant and remains uncorrected after an informal action has been taken against an institution, a federal banking regulator may then decide to take a formal enforcement action. Banking regulator officials said that formal enforcement actions are public and generally considered more stringent than informal actions because they address more significant or repeated BSA violations. Formal enforcement actions can include cease and desist orders, assessments of civil money penalties (CMP), or supervisory agreements, and are enforceable through an administrative process or other injunctive relief in federal district court. Federal banking regulators said they track enforcement actions through their various management information systems.

Federal Banking Regulators Reported Improved Transparency of Enforcement Actions Due, in Part, to New Guidance

Federal banking regulators reported that new interagency guidance has helped improve the transparency of BSA enforcement. In July 2007, the federal banking regulators issued the “Interagency Statement on Enforcement of Bank Secrecy Act/Anti-Money Laundering Requirements,” which clarified the circumstances under which regulators would issue a cease and desist order against a financial institution for noncompliance with BSA requirements. It does not address assessment of CMPs for violations of the BSA or regulators’ implementing regulations.

Regulators that we contacted typically stated that the guidance has been beneficial. FDIC officials maintained that with the guidance, bank officials have a better idea of the factors FDIC and other banking regulators take into account before executing a cease-and-desist order. They added that the interagency statement advises that the appropriate regulator may take a different level of action depending on the severity and scope of the bank’s noncompliance. NCUA officials said they found that the guidance has led to more consistent enforcement actions taken among the banking regulators in response to cited deficiencies and violations. Both Federal Reserve and OCC officials suggested that the guidance provided more clarity about, or added transparency to, the circumstances under which the agencies will take formal or informal enforcement actions to address concerns relating to a bank’s AML program requirements.

Federal banking and state regulators generally coordinate when necessary on BSA enforcement actions. For example, Federal Reserve officials said they usually take (and terminate) actions jointly with state regulators, and a bank must continue to comply with a joint enforcement action until both the Federal Reserve and the state authorities terminate the action. Accordingly, the Federal Reserve and state regulators typically terminate enforcement actions simultaneously. Officials from several state agencies said that as a general rule, they took informal and formal enforcement actions jointly with their federal counterparts, although some state agencies were likely to coordinate only formal actions. Several state officials reported taking few, if any, formal BSA/AML-related actions against depository institutions, especially credit unions.

Several officials from institutions that were examined by multiple federal banking regulators, such as OCC and the Federal Reserve, said that these regulators coordinated well among themselves, while others indicated they were unsure or thought coordination could be improved. Bank officials had mixed views on coordination of enforcement actions between federal and state regulators; some thought the extent of coordination was sufficient, others thought it was lacking, and several simply did not know how extensively these regulators coordinated on enforcement.

Agencies and SROs Take Enforcement Actions in the Securities and Futures Industries

The enforcement actions that SEC, CFTC, and their SROs can use to address BSA compliance can be informal or formal. All SEC enforcement actions are public and formal actions, but the actions of its SROs include informal and formal enforcement processes. SEC staff said that most cited BSA/AML deficiencies are corrected through the examination process. Most examinations conclude with an institution sending SEC a letter stating how it will correct the compliance problem. FINRA officials also said that firms must document the corrective action to be taken to address any issues found during an examination. If SEC examiners find significant deficiencies with a firm’s BSA program, SEC staff may refer this to their Division of Enforcement or an SRO for enforcement. In accordance with its MOU, SEC also will notify FinCEN of any significant BSA/AML deficiencies. SEC’s Division of Enforcement will assess whether to proceed with an investigation, determine whether a violation has occurred, and if so, whether an enforcement action should be taken against the firm or any individuals. FINRA officials said their enforcement actions are typically fines, the amount of which may vary depending on the egregiousness of the compliance failures, the scope of conduct, and the overall risk of money laundering through the firm.

In fiscal year 2008, SEC and the securities SROs took 25 formal enforcement actions against securities firms (see table 3).

As shown in table 4, in both fiscal years 2007 and 2008, violations in policies and procedures and internal controls and annual independent testing were the most common AML-program-related violations among broker-dealers. With respect to BSA reporting requirements, in fiscal year 2007 the most common violations among broker-dealers were related to CIP requirements and required information sharing. In fiscal year 2008, the most common violations were CIP and SAR requirements. SEC staff said that many of the largest securities firms have had AML programs in place for a while and medium-sized or small firms had AML programs that could be improved.

SEC and its SROs routinely share information about their enforcement activities. For example, FINRA officials said that they work with SEC if they are both investigating an institution to ensure they are not duplicating efforts. SEC and FINRA officials said that FINRA makes SEC staff aware of any significant BSA/AML violations prior to an enforcement action being taken. Further, in accordance with its MOU with FinCEN, SEC tracks its examinations, violations, and enforcement actions, and collects similar information from its SROs on a quarterly basis, which it then provides to FinCEN.

While CFTC retains authority to issue enforcement actions against futures firms, its SROs have taken all enforcement actions for BSA/AML deficiencies to date. When CFTC becomes aware of potential BSA/AML violations, it usually refers the violations to a firm’s SRO for investigation and potential enforcement action, although SROs typically develop enforcement cases through the examination process. At the conclusion of an SRO examination, the SRO issues a report to the futures firm and notifies the firm of any deficiencies in its AML programs. SROs require futures firms to correct any material deficiencies prior to closing the examination. If the deficiencies are minor, SROs may cite the deficiency in the examination report and close the examination with no disciplinary action or require corrective action before closing it. If examination findings are significant, then SROs may start an investigation, during which internal committees at the SROs may review information collected during the examination and investigation and determine whether an enforcement action is warranted. SROs take only formal, public enforcement actions, and all rule violations and committee findings are made public. SROs resolve most enforcement cases related to violations of BSA/AML SRO rules by issuing a warning letter or assessing a fine. The amount of the fine varies depending on the severity of the violation. SROs also may take other types of actions for violations of their rules, such as suspension of membership or expulsion.

NFA conducts the vast majority of examinations of futures firms and is responsible for all formal enforcement actions taken in recent years (see table 5). The number of BSA/AML-related enforcement actions initiated by NFA decreased from 21 in 2006 to 10 in 2007 and 8 in 2008. Officials added that when new requirements become effective, they usually see an increase in deficiencies related to the new requirements. NFA officials said they reduced the number of deficiencies cited by requiring firms to submit written BSA compliance programs for review during their membership application process. NFA officials said the most common BSA violations cited since 2003 were failure to have annual independent audits and failure to conduct annual BSA training of relevant staff.

CFTC officials said they meet quarterly with SROs to review their open investigations and enforcement actions. If an SRO takes an enforcement action, it will send a copy of the enforcement action to CFTC. CFTC’s Division of Enforcement regularly tracked BSA violations investigated and charged by futures SROs, but it did not maintain statistics by the type of violation. Additionally, CFTC receives and reviews examination reports from all SROs, but did not compile BSA/AML examination statistics. In anticipation of finalizing the information-sharing MOU with FinCEN (which the agencies finalized in January 2009), CFTC recently began collecting BSA examination information from the SROs. (We discuss information-sharing MOUs later in this report).

IRS Does Not Have Authority to Take Enforcement Actions and Refers Potential Violations to FinCEN

As previously discussed, IRS does not have its own or delegated authority to issue enforcement actions against NBFIs for BSA violations. If IRS finds BSA violations when examining an NBFI, it can send a letter of noncompliance (Letter 1112) and a summary of examination findings and recommendations to the institution, and also include an acceptance statement for the institution to sign. In response to the statement, the institution may agree to implement the recommendations and correct any violations. Generally, IRS would conduct a follow-up examination within 12 months after issuing the letter to determine if the corrective action were taken. In cases where significant BSA violations have been found or past recommendations have been ignored, IRS will refer the case to FinCEN to determine what, if any, enforcement action should be taken. IRS examiners and their managers make the initial determination to refer a case and then an IRS BSA technical analyst reviews the case to decide whether to forward the referral to FinCEN. IRS has referred approximately 50 cases to FinCEN since fiscal year 2006. The referrals include the facts of the case, a summary of the examination, and the violations cited.

During fiscal year 2008, IRS reported citing 23,987 BSA violations and issued a Letter 1112 to 5,768 different institutions (see table 6).

Table 7 provides a summary of the total number of institutions with one of the five violations IRS most often cites.

Justice officials said they coordinate with financial regulators and FinCEN during criminal BSA investigations and when taking criminal enforcement actions. Most of Justice’s BSA cases against financial institutions start as investigations of individuals involved in illegal activities, such as drug trafficking or money laundering. Justice officials also said they have started investigations after receiving referrals from federal regulators. They indicated that having a financial regulator assigned to a Justice investigation can help investigators better understand the financial industry and BSA policies and procedures. Over the last 2 years, both OTS and the Federal Reserve have assigned examiners to Justice investigations. Justice officials work closely with institutions’ regulators to obtain and review their examination reports and workpapers, analyze SARs filed, and determine if any civil enforcement actions were taken against the institution. Justice officials said they will coordinate enforcement actions with financial regulators and FinCEN when feasible—checking with both to see if they are planning an enforcement action against the institution. According to Justice, the challenges of coordinating regulatory and criminal enforcement include grand jury secrecy requirements and the differing length and pace of investigations and negotiations.

Justice officials said that all their BSA cases against financial institutions have involved systemic, long-term failures in the BSA program and substantial evidence of willful blindness on the part of the institution toward money laundering activity taking place through the institution. In 2005, Justice formalized procedures that require U.S. attorneys to obtain approval from Justice’s Asset Forfeiture and Money Laundering Section in cases where financial institutions are alleged to be BSA offenders. Attorneys are to consider factors such as the availability of noncriminal penalties, prior instances of misconduct, remedial actions, cooperation with the government, and collateral consequences of conviction—when determining what type of action, if any, should be taken. Justice officials said they instituted the procedures to provide more review of significant AML cases (in particular, the nature of the violation and its impact) and promote uniformity and consistency in enforcement approaches. According to Justice officials, the new procedures have been well received.

Over the last 3 years, Justice took four criminal BSA enforcement actions against financial institutions (see table 8). All the actions resulted in deferred prosecution agreements (three against depository institutions). The remaining case represents the first criminal BSA enforcement action against an MSB. Justice announced each of the actions on the same day that FinCEN and the regulators announced their civil enforcement actions. The forfeiture amounts generally correspond to the criminal proceeds laundered by the institutions.

FinCEN Provides Some Effective Outreach and Regulatory Support but Could Improve Information-Sharing Efforts

FinCEN has increased resources dedicated to its regulatory programs and provided some effective regulatory support and outreach to industry; however, improvements could be made in its information-sharing efforts with regulators. From 2001 to 2008, FinCEN staff dedicated to regulatory efforts increased from 36 to 84. FinCEN has coordinated BSA regulation development and supported regulators’ examination processes in various ways, including providing input on examination guidance. In 2007, FinCEN created a new unit to provide outreach efforts, such as a helpline, that were well received by industry. FinCEN also has improved its management of referrals from regulators by replacing a paper-based system with an electronic one. However, the lack of an agreed-upon process for communication on IRS referrals may delay timely feedback to IRS-examined entities and allow these institutions to continue operating without correction after deficiencies are identified. Since our April 2006 report, FinCEN has increased the number of information-sharing MOUs with federal and state regulators and has taken steps to assess these MOUs. FinCEN and CFTC recently finalized an MOU, without which they previously did not have an agreed-upon framework for more consistent coordination and information sharing. FinCEN also has been discussing how to improve analytical support with the regulators. However, some state, securities, and futures regulators have limited electronic access to BSA data, which impedes their risk scoping for examinations and ability to independently verify audit information. FinCEN officials said they finalized a regulatory data-access template in July 2008 and have begun providing additional state regulators with direct electronic access, and anticipate providing expanded access to the federal functional regulators.

FinCEN Has Increased Regulatory-dedicated Resources, Collaborates with Regulators to Develop Rules and Provides Them with Examination Support, and Provides Well-received Outreach to Industry

Parallel to its increase in overall budget authority, FinCEN has increased resources dedicated to its regulatory programs. FinCEN officials said they consult with other regulators and examining agencies as necessary when developing rules and implementing regulations, provides examination support to regulators, and conducts BSA-related training sessions and events for industry and regulators.

FinCEN Has Increased Resources Dedicated to Its Regulatory Programs

As shown in table 9, FinCEN’s budget authority and regulatory-dedicated staff have grown from fiscal year 2001 through fiscal year 2007. FinCEN budget authority grew from $38 million in fiscal year 2001 to $73 million in fiscal year 2007. Since 2005, the bureau’s budget authority essentially has been flat. From fiscal year 2001 through fiscal year 2007, the number of FinCEN staff dedicated to regulatory policy and programs approximately doubled, from 36 to 77. The total number of FinCEN staff increased nearly 75 percent from 174 to 302.

FinCEN regulatory policy and program staff work in RPPD, which consists of the Offices of Regulatory Policy, Compliance, Enforcement, Regulatory Analysis, and Outreach Resources. According to FinCEN officials, these staff work on issues that involve multiple financial sectors, although many employees have subject matter expertise for particular industries or sectors. As of September 2008, FinCEN officials said that RPPD had a staff of 84. Since 2001, several regulators also have provided detailees to FinCEN to supplement expertise in particular areas or work on specific projects. For example, from 2007 through 2008, a detailee from the Federal Reserve worked on an industry survey about the potential effects of rule making related to FinCEN’s cross-border wire transfer study and served as a subject matter expert regarding payment systems. And from 2002 through 2005, two IRS detailees to FinCEN worked with RPPD to resolve multiple outstanding compliance issues. In addition, in 2005-2008, FDIC officials said that the agency provided 11 detailees to assist with report processing and other assignments.

FinCEN and Regulators Collaborate on Implementing BSA Regulations

BSA provides Treasury with overall regulatory authority to administer the act and authorizes Treasury to issue regulations, sometimes jointly with federal financial regulators, to implement BSA requirements. FinCEN, the bureau within Treasury responsible for administering BSA, has overall responsibility for Treasury’s BSA regulatory program. Within FinCEN’s RPPD, FinCEN officials said that the Office of Regulatory Policy is responsible for developing, modifying, interpreting regulations and consults as necessary with other regulators and examining agencies.

Depending upon the subject matter of a regulatory initiative, FinCEN officials said their interactions with regulators on BSA implementing regulations can range from extensive collaboration to a notification that regulations are available. In addition to meetings with regulators, FinCEN officials stated they obtain feedback from regulators on BSA issues through BSAAG and its multiple subcommittees. Referring to the USA PATRIOT Act, some federal agency officials observed that the development of some regulations was collaborative and an improvement compared with other processes in which the regulators were less involved.

FinCEN officials said their work in recent years with SEC and CFTC—an outgrowth of the USA PATRIOT Act—generally has been collaborative, particularly given the newness of the securities and futures industries to the BSA/AML regulatory framework. SEC staff said they often met with FinCEN to discuss BSA issues (including rules development and related FinCEN guidance). Also, FinCEN sometimes participated in SEC’s quarterly BSA meetings with the SROs, discussing the scope of reforms and clarifying guidance or other issues. FINRA officials said that FinCEN and SEC directly collaborated on rules for broker-dealers, and FINRA was able to provide input in these discussions only through SEC. While FINRA officials said that they coordinated well with SEC, they felt that direct and earlier coordination with FinCEN on rule and guidance development would have increased the efficiency of the process.

CFTC officials stated that work with FinCEN on drafting of futures-related BSA/AML rules and guidance has been collaborative. For instance, as required by BSA, FinCEN and CFTC jointly issued regulations in 2003 for futures commission merchants and introducing brokers requiring them to establish CIPs. However, according to CFTC officials, the rule resulted in some confusion about its applicability in situations where more than one futures commission merchant was involved in a transaction with the same customer. In April 2007, FinCEN and CFTC jointly issued guidance to clarify the responsibilities in such a transaction. NFA officials said the guidance has been well received by its members and clarified issues surrounding a firm’s BSA/AML role with its customers.

FinCEN and IRS officials had differing views on the degree of collaboration that occurred during the revision of MSB-related regulations. As discussed previously, FinCEN and IRS completed a coordinated strategy in 2008 to better identify and select NBFIs for examination. The coordinated strategy states that FinCEN would work with regulatory partners to explore the feasibility of removing or exempting from the definition of MSBs certain types of transactions or subcategories of MSBs that pose relatively little risk of facilitating financial crimes. At the time of this report, FinCEN was in the process of incorporating revised MSB definitions into its guidance and regulations. Although legislation does not require FinCEN to conduct joint rule making on MSB issues, FinCEN officials stated that RPPD staff have briefed other offices and divisions in FinCEN as well as IRS, federal banking regulators, Treasury officials, various law enforcement agencies, and the BSAAG NBFI subcommittee on the proposed MSB rule making. The BSAAG NBFI subcommittee, of which IRS is a member, also sent a list of issues for FinCEN to consider when redefining MSBs, which FinCEN officials said they reviewed. FinCEN officials said they met with IRS staff in May 2008 to discuss the advanced notice of proposed rule making.

According to FinCEN officials, they also developed a majority of their guidance and administrative rulings by reviewing questions received from the financial industry through their Regulatory Helpline (which institutions and regulators may call with questions) or other correspondence. For example, FinCEN officials said they review questions asked of the Office of Outreach Resources to determine what issues concern industry, and the results of the reviews are forwarded to the Office of Regulatory Policy. (We discuss the Office of Outreach and FinCEN helplines in more detail below.)

FinCEN Supports Regulators’ Examination Activities by Providing Input on Guidance and Addressing Specific Issues

FinCEN and RPPD’s Office of Compliance provide examination support for financial regulators in various ways. These methods include providing input on examination guidance and working with regulators to address specific issues (such as risk scoping). For instance, FinCEN actively participates in FFIEC working groups to revise the FFIEC BSA/AML manual and develop examiner training. In February 2007, FinCEN established a working group comprising federal and state agencies, with the goal of identifying and implementing several large initiatives to more effectively regulate and supervise the activities of MSBs. As previously discussed, FinCEN, IRS, and state regulators worked together in this forum to develop an MSB BSA/AML examination manual that was issued in December 2008. FinCEN officials said they will work with IRS and the manual working committee to develop a roll-out plan and provide training to IRS and state examiners, and the working group will continue to meet to address other MSB-related issues.

FinCEN also has reviewed SEC’s and its SROs’ nonpublic examination procedures. Additionally, SEC and FinCEN cooperated to develop Web- based tools (“AML source tools”) that compile applicable BSA/AML rules and regulations for mutual funds and broker-dealers as well as other helpful information and contacts. SEC staff stated that they also developed “plain English” guidance on the examination process to be made public in response to further industry requests for access to SEC’s nonpublic examination module. SEC provided the draft guidance to FinCEN for its input; however, FinCEN officials said their review is on hold because their staff are working on other priorities and industry already has the AML source tools as guidance. While FinCEN has worked similarly with CFTC on guidance to its industry, FinCEN officials said that CFTC’s SROs have not provided their examination module and procedures to FinCEN but intended to do so after the information-sharing MOU between FinCEN and CFTC was finalized. However, FinCEN and CFTC officials stated they have held meetings on the examination procedures of futures SROs.

As part of the effectiveness and efficiency initiative announced by the Treasury Secretary in June 2007, FinCEN has been studying how the regulatory agencies are approaching risk scoping for examinations. Its goal is to develop new tools and guidance that would enable agencies to better direct their examination resources. FinCEN officials stated they evaluated tools and processes that allow examiners to analyze information and patterns in BSA data from a specific institution to help identify areas that may require closer review, and jointly identified ways to enhance these tools. For example, FinCEN officials said they and the federal banking regulators are developing an enhanced BSA data analysis tool to incorporate into pre-examination scoping processes that will allow the federal banking regulators to better target their resources. Federal banking regulator officials stated that the tool would help them better analyze BSA data information for a particular institution, but not to conduct analyses across institutions.

In addition to supporting regulators’ examination efforts and undertaking- process- or issue-specific initiatives, FinCEN officials said it also has produced targeted financial institution analyses. These are produced after a regulator makes a specific request for detailed analytic information related to a particular institution or individual. Office of Regulatory Analysis staff said they have collaborated with regulators to produce 42 such reports during fiscal year 2007 and through the first three quarters of fiscal year 2008.

With respect to its role in term’s of achieving greater BSA/AML examination consistency, FinCEN officials stated that, resources permitting, they would like to increase their efforts in areas such as examiner training, developing and providing additional compliance referrals to regulators, periodically joining examiners in the field, and conducting additional macro-level analysis of BSA compliance. (We discuss FinCEN’s analytical products in a later section.) FinCEN officials said they have held various meeting with regulators to discuss their examination processes, but that they have not held meetings inclusive of all regulators. Further, as discussed previously, without an information- sharing MOU in place, FinCEN had been unable to obtain examination procedures for the futures industry—hindering its ability to review issues of BSA/AML examination consistency.

Offices within FinCEN Coordinated to Provide Outreach That Was Well Received by Industry

FinCEN has implemented new outreach initiatives and conducted support efforts on BSA guidance that were well received by industry. The Office of Outreach Resources was created in 2007 and has primary responsibility for operating the Regulatory Helpline that industry and regulators may call with BSA-related questions. FinCEN staff also operate the Financial Institutions Hotline, which financial institutions may call to report suspicious activity related to terrorist financing. For the past 3 years, FinCEN has surveyed customers who use the Regulatory Resource Center—which includes the Helpline and FinCEN’s Web site. According to FinCEN’s surveys, in all 3 years, FinCEN staff calculated more than 90 percent of respondents—primarily industry representatives—favorably rated the guidance they received.

FinCEN officials said that as part of its efforts to make the administration of BSA more efficient and effective, FinCEN published proposed rules in the Federal Register in November 2008 that centralize, without substantive change, BSA and USA PATRIOT Act regulations to a new chapter within the Code of Federal Regulations. FinCEN officials said that the proposed rules would streamline BSA regulation into general and industry-specific parts, with the goal of enabling financial institutions to more easily identify their BSA responsibilities.

The Office of Outreach Resources also coordinates with BSAAG and supports speaking engagements to the financial industry and regulatory groups. FinCEN officials told us they have facilitated BSAAG subcommittee meetings (such as ones on banking, insurance, law enforcement, SARs, and securities and futures) throughout the year. In 2007, FinCEN reported participating in almost 100 domestic and overseas outreach events on BSA issues relating to banking, securities, futures, MSBs, jewelers, casinos, insurance companies, and credit unions. Industry officials with whom we spoke generally were positive about FinCEN’s outreach to industry, including these events and some of the public products available on FinCEN’s Web site. Banking industry association officials felt that FinCEN had been helpful in listening to concerns of the banking industry. Securities industry officials stated they thought FinCEN had been very responsive to inquiries from broker-dealers and found some of FinCEN’s publicly available reports to be very useful, including “SAR Activity Review: Trends, Tips, and Issues” and mortgage fraud reports. FinCEN officials presented these reports at events and included a discussion of how SARs have contributed to law enforcement investigations. A representative of a futures firm with whom we spoke said the firm used the SARs publications as part of its training program. Securities SRO officials said they felt FinCEN was doing an excellent job of industry outreach, in particular showing the industry how BSA data filings were used effectively to prosecute money laundering and other financial crimes.

In January 2008, FinCEN’s Office of the Director—with participation from RPPD, the Analysis and Liaison Division, the Technology Solutions and Services Division, and the Office of Chief Counsel—began a new outreach program to the financial community. By developing a better understanding of the needs and operations of institutions, FinCEN officials suggested that the agency will be in a better position to help institutions effectively operate BSA/AML programs. The outreach program’s goals include learning how institutions’ BSA/AML programs and analytical units operate. The first stage of the outreach program is targeted to the 15 largest depository institutions. According to FinCEN, they will expand outreach to other depository institutions and industry sectors, but have not finalized the timetable for the later stages of the program.

FinCEN Has Improved Tracking for Incoming Compliance Referrals; However, Lack of a Process for IRS Referrals Could Impede BSA Compliance Activities

In 2006, FinCEN implemented an automated Case Management System (CMS) to track its processing of BSA compliance referrals, which replaces a paper-based system. While its efforts to track referrals have improved, FinCEN processing times for IRS referrals, combined with IRS’s limited enforcement authority, may have limited IRS’s BSA compliance activities among NBFIs.

FinCEN Has Improved Its Compliance Referral Tracking System

According to their MOUs with FinCEN, the federal banking regulators, SEC, and IRS are to inform FinCEN of any significant potential BSA violations and provide BSA-relevant examination reports. In 2006, FinCEN implemented an automated system—CMS—to track these BSA compliance referrals. Prior to CMS, FinCEN tracked BSA compliance referrals manually through a paper-based system. FinCEN officials stated that CMS enables RPPD’s Offices of Compliance and Enforcement to track cases from receipt to final disposition, analyze the data, and produce management reports. Figure 2 depicts the overall process by which FinCEN receives and tracks these referrals.

As shown in figure 2, the Office of Compliance receives referrals from regulators or referrals that are self-reported by institutions and, after receipt, opens corresponding cases in CMS. These matters are assessed by compliance specialists who, in making their assessment of each referral, consider factors such as the type of violation and number of times it occurred; whether the violation was systemic or technical; hether the violation was willful or a result of negligence; ow long the deficiency existed; and hether the violation surfaced through self-discovery or an examination. ompliance staff must complete the initial assessment within 60 days, C after which the case is reviewed by a compliance project officer, the c compliance. As part of these assessments, Office of Compliance staff m request additional data analysis from the Office of Regulatory Analysi additional documentation from the institution’s regulator. Federal ba regulator and SEC staff confirmed that FinCEN staff have requested additional information about their referrals. ompliance program manager, and, finally, the assistant director of After a referral is assessed, Office of Compliance management decide (1) close a case with no whether to take one of the following actions: action; (2) send a notification letter to the institution indicating that the regulator informed FinCEN of the matter, and nothing precludes FinCE from further action if FinCEN or the regulator finds that all corrective actions have not been implemented; or (3) present the matter to FinCEN Regulatory Enforcement Committee. FinCEN officials estimated that its Office of Compliance has forwarded approximately 6 percent of referrals to its Office of Enforcement. The Regulatory Enforcement Committee consists of compliance and enforcement staff who review the case and decide whether to forward i Enforcement for further investigation After it is decided that a case be referred to the Office of Enforcement, the case is closed by Office of Compliance staff in CMS and the Office of Enforcement opens a new Enforcement case in CMS. t to the Office of FinCEN officials said that the fundamentals of the enforcement investigative process are th referrals. And, as with Compliance staff, Enforcement staff may request additional data analysis or documentation when making their dec isions. They document their investigation in a recommendation memorand the Assistant Director of the Office of Enforcement. After the assistant director has reviewed the case, Enforcement staff contact the referring agency to discuss the matter. If no action is warranted, Enforcement e same, regardless of the source of the um to closes the case. If a CMP is warranted, Enforcement issues a charging letter to the financial institution. The financial institution is required to respond in writing within a specified period (usually 30 days from the of the letter). The assistant director and an enforcement specialist thenreview the financial institution’s written response to determine whether proceed with a CMP negotiation meeting or close the matter with an alternative action, such as a warning letter, or no action. FinCEN Enforcement officials said that if a warning letter is issued, it will be routed internally for approval through the Associate Director of RPPD a copy will be sent to the relevant regulator. FinCEN’s Director ite an October 2008 speech that FinCEN considers enforcement actions o when a financial institution exhibits a systemic breakdown in BSA compliance that results in significant violations of its BSA obligations. Table 10 shows the number of referrals RPPD received during fiscal years 2006 though 2008, the number of cases closed within the Office of Compliance and Enforcement, and average processing times.

Lack of Agreed-upon Process That Facilitates Communication about Processing IRS Referrals Could Delay Timely Feedback to NBFIs

According to IRS officials, long delays in processing referrals and a lack an agreement on time frames have limited IRS’s BSA compliance activitie among NBFIs. Unlike the federal financial regulators that have independent enforcement authority to issue informal and formal enforcement actions, IRS officials can send only a Letter 1112 to an institution, which includes a statement that a copy of their report is of s required to be sent to FinCEN and that FinCEN will determine if penalties under BSA are to be imposed (see discussion in previous section). Therefore, when IRS finds an NBFI with significant BSA deficiencies, it must refer the case to FinCEN for further action. In fiscal years 2006— 2008, IRS sent approximately 50 referrals to FinCEN. After a referral is made to FinCEN, IRS officials said they do not conduct a follow-up visit with the institution to determine if corrective action has been taken until FinCEN makes a determination on the referral, as they do not want t any actions that might negatively affect a potential FinCEN enforcement action.

IRS officials believe FinCEN’s response time is too long. FinCEN officialsstated that IRS referrals often require follow up for additional information or supporting documentation which affects processing times. As noted in table 10 above, FinCEN’s average processing time for all referrals in fiscal year 200 8 was 208 days in its Office of Compliance and an additional 277 days if a case was referred to its Office of Enforcement. IRS and FinCEN officials met in early 2008 to discuss processing times and what information an IRS referral should contain. IRS officials said they have seen progress in the last several months, with more IRS referrals being processed. Although IRS officials stated that they would like an agreement with FinCEN on referral processing times, no formal agreement has been negotiated. FinCEN officials said that they do not have established time frames for responding to referrals because response time often v depending on the thoroughness of the referral and the need for follow u with the examiner. They said that processing of referrals also depends o interagency coordination. For example, law enforcement authorities might ask FinCEN to refrain from advancing certain cases because of pending criminal investigations. While FinCEN and IRS recently have been meetin more frequently to discuss IRS referrals, no formal agreed-upon proces exists to address IRS referral issues and provide more timely feedback to IRS-examined institutions on their AML efforts. The lack of an agreed- upon process for handling referrals, combined with IRS’s inability to take certain enforcement actions on its own, may result in these institutions s continuing to operate without correction, potentially remaining out of compliance with BSA.

MOUs Have Improved Coordination with Federal Banking Regulators and SEC; and FinCEN and CFTC Recently Signed an MOU

FinCEN officials have increased the number of information-sharing MOUs with regulatory agencies, which has improved coordination of enforcement actions and BSA data reporting for the banking and secur industries. FinCEN officials said that through the information-sharing MOUs they made progress in developing their relationships with the federal banking regulators, SEC, and IRS. Since our April 2006 report, FinCEN had implemented an MOU with SEC (in December 2006), and as of October 2008, established MOUs with 46 state agencies. After several years of drafting, FinCEN and CFTC finalized information-sharing and data-access MOUs in January 2009.

Federal Banking Regulators and FinCEN Reported That MOUs Resulted in Improved Processes for and Coordination of BSA Reporting and Enforcement

FinCEN officials said that the MOU process significantly increased the level of information sharing with the federal banking regulators since its implementation in 2004. FinCEN officials also said that the federal banki regulators made good faith efforts to comply with the MOU and provide FinCEN with reports on time. Officials from most federal banking regulators stated that their 2004 MOU significantly strengthened interaction with FinCEN and provided structure for coordination on enforcement actions and information sharing. In addition, FinCEN’s Director together with Treasury’s Under Secretary for Terrorism and Financial Intelligence meets quarterly with the principals of the five federal banking regulators to discuss coordination and BSA admini for the industry.

While federal banking regulator officials emphasized that they may ta enforcement actions independent of FinCEN under their own authorit they ensure that FinCEN is aware of these actions as agreed upon in the MOU with FinCEN. Federal Reserve officials said that such information sharing generally issues that are resolved through informal and formal enforcement actions. They explained that when taking an informal action—such as a commitment letter or MOU—they provide notice to FinCEN. OTS officials involves referral of all BSA/AML-related examination said they have quarterly meetings with FinCEN during which they discuss any BSA-related informal or formal actions, as well as any related matter Moreover, federal banking regulators said they make FinCEN aware of formal actions, such as CMPs or written agreements, well in advance of when the actions will be taken. For example, if the regulators ar impose a CMP, they will inform FinCEN early enough to ensure the process is fully coordinated. Federal Reserve officials said that since the s. e going to 2004 MOU, they imposed all BSA/AML-related CMPs concurrently with FinCEN penalties. NCUA officials also said they make FinCEN aware of informal and formal actions, and would coordinate with FinCEN prior to the issuance of a CMP, if necessary. OCC officials said they also coordinate any CMPs with FinCEN and that in recent years FinCEN has been much quicker in assessing CMPs in conjunction with OCC. They cited a case prior to the implementation of the MOU—the Riggs Bank case—during which they said they had to wait more than a year to issue a CMP in coordination with FinCEN. FDIC and OTS also noted they have worked closely with FinCEN in the past few years on the development of BSA/AML-related enforcement actions against several institutions. (App. III contains examples of BSA/AML-related enforcement actions.)

Several federal banking regulators also cited their 2004 MOU with FinCEN as beneficial in terms of improving agencies’ internal processes for tracking violations and enforcement actions. Some federal banking regulator officials said that as part of responding to the information- sharing requirement of the MOU (that is, providing FinCEN with quarterly BSA examination, violation, and enforcement data), they established centralized, automated data collection programs that have improved the quality of their BSA examination data. For instance, FDIC officials said their agency internally standardized the processes for collecting BSA data as a result of the MOU. Federal Reserve officials also reported that enhancements to the agency’s data management system have streamlined the information it gathers for FinCEN under the MOU.

While federal banking regulators have made improvements in their systems for collecting and reporting BSA/AML-related data, differences remain in how they cite violations. In our 2006 report, we found that federal banking regulators were using different terminology to classify BSA noncompliance and recommended that FinCEN an d the federal banking regulators discuss the feasibility of developing a uniform classification system. Since our report, FinCEN and the federal banking regulators established an interagency working group that is reviewing guidance relating to the citing of BSA violations and is considering additional guidance on citing systemic versus technical AML violation One federal banking regulator stated that while BSA/AML violation is generally comparable, federal banking regulators have different definition for the same terms. However, to implement their MOU, FinCEN official said that they discussed what a “significant violation” means and tha came to agreement (see previous discussion). s.

FinCEN’s MOU with SEC Has Improved Information Sharing

SEC and FinCEN staff stated that their December 2006 MOU had been beneficial overall, although it is still in the relatively early stages of implementation. Pursuant to their MOU, SEC shares examination findings with FinCEN after a significant BSA deficiency is found. For enforcement actions, SEC provides notice to FinCEN prior to the action becoming public. In addition, SEC receives information from the SROs about BSA/AML-related significant deficiencies or potential enforcement a and provides that information to FinCEN. SEC and FinCEN staff said the MOU is still in the early stages of implementation and SEC and FinCEN recently met and reached agreement on steps to further coordination.

SEC staff also said that its agency’s MOU with FinCEN has provided a framework for the quarterly collection and reporting of BSA/AML examination, violation, and enforcement action data. While SEC staff stated they had provided FinCEN with data prior to the MOU, it was on a more limited basis. Prior to the MOU, SEC cited BSA violations under provisions of the USA PATRIOT Act. Under the MOU, SEC cites BSA, which allows for more specific citations. As a result, under the MOU, SEC provides additional examination information regarding BSA violation categories and subcategories. For example, SEC previously would cite a violation relating to CIPs under Section 326 of the USA PATRIOT Act. Because of the MOU, SEC can determine which of the multiple subcategories of BSA it may cite for deficiencies in a firm’s CIP. (See table 3 earlier for these data.)

FinCEN and CFTC Recently Signed an MOU, without Which the Agencies Engaged in Limited Information Sharing

CFTC, the last federal functional regulator to sign an information-sharing MOU with FinCEN, had no agreed-upon formal mechanism by which to coordinate or share information with FinCEN until the MOU was finalized in January 2009. CFTC officials stated they approached FinCEN about developing an MOU in fall 2004. CFTC and FinCEN cited delays on the part of both parties in moving forward with the MOU.

In fall 2008, CFTC officials said that they developed standard procedure for obtaining BSA/AML examination information from i anticipation of the MOU’s finalization. Specifically, CFTC developed templates that identify the episodic, quarterly, and annual report data that will be required to be reported under the MOU and already had rec reports from its SROs as of fall 2008. Previously, CFTC did not compieived le BSA/AML examination statistics, including information on the types of violations cited. Further, FinCEN officials said that CFTC’s SROs have no provided their examination modules and procedures to FinCEN but theyintended to do so after an MOU with CFTC is finalized.

Without an MOU in place, CFTC’s and FinCEN’s abilities to evaluate BSA/AML compliance in the futures industry were limited. For example, without examination procedures and data, similar to that provided by other regulators, FinCEN was not able to evaluate the extent to whichBSA/AML regulations were being examined consistently in the futures industry in relation to other sectors. Further, without such information FinCEN and CFTC were not able to jointly determine areas of BSA compliance weakness and better target guidance or outreach efforts. According to best practices for collaboration, federal agencies engaged i collaborative efforts should create the means to monitor, evaluate, a report their efforts. FinCEN and CFTC officials recognized the benefit an MOU and developed information-sharing and data access MOUs (see later discussion on data access) that were completed in January 2009.

IRS and FinCEN Are Discussing Methods to Improve Coordination under Their MOU

While some improvements have been made, FinCEN and IRS disagree on aspects of their MOU and are discussing methods to improve coordinat IRS officials said they asked to renegotiate the terms of the MOU as they said that receive very little benefit from their MOU with FinCEN but that FinCEN has declined, saying the MOU is only 3 years old. However, FinCEN officials said they are in frequent communication with IRS regarding the operation of their MOU and provided documentation of some of these meetings. IRS officials said they believe some of the information they are asked to collect and provide under the MOU is of little use to FinCEN. For example, IRS officials did not think FinCEN ion. made use of IRS’s reports of the numbers of Form 8300 and Report of Foreign Bank Account examinations and violations.

According to IRS officials, FinCEN has not held a formal meeting with IRS to discuss the implementation of the MOU, as required by the MOU. However, FinCEN officials stated they have frequent meetings with IRS staff on improving various aspects of BSA administration and information- sharing processes under the MOU. For example, due to recent meetings with FinCEN, IRS officials said that FinCEN improved its time frames for providing responses in cases when IRS officials send FinCEN technical questions they have about BSA compliance in their supervised entities.

FinCEN Has Taken Steps to Assess Effectiveness of MOUs

FinCEN officials said that in creating their 2008–2012 strategic plan, they revised goals and performance measures to respond to an assessment and recommendations from the Office of Management and Budget. For fiscal year 2006, the Office of Management and Budget rated Treasury’s BSA administration as “results not demonstrated,” and FinCEN received low ratings for developing outcome-based performance measures and achieving program results. In fiscal year 2007, a FinCEN working group examined what would constitute meaningful performance measure s for the BSA program.

The working group measures how effectively MOU holders believe their MOUs facilitate information exchange. In 2008, FinCEN completed a survey of cust perceptions of the services it provides to the federal and state agencie with which it has information-sharing MOUs. Using results from multiple survey questions, FinCEN staff stated they created a public performance developed an MOU compliance metric, which measure and calculated that 64 percent of MOU holders surveyed found FinCEN’s information sharing valuable in improving regulatory consistency and compliance in the financial system. FinCEN has set a goal of increasing results for this measure by 2 percentage points annually. Through the survey, FinCEN officials said they also obtained 26 written comments, 14 of which offered suggestions for improving information- sharing MOUs (for example, by providing more communication and feedback).

FinCEN Has Been Improving Analytical Products; However, Lack of Direct Electronic Access to BSA Data May Limit Compliance Activities

FinCEN has taken steps to improve analytical products for regulators to assist them with their BSA/AML compliance efforts and has been discussing additional products. While some regulators have direct electronic access to BSA data, others have access only through other agencies. For example, FINRA conducts the vast majority of broker-dealer examinations and does not have direct electronic access to BSA data; instead, it must go through FinCEN or SEC to obtain data. FinCEN officials said they finalized a regulatory data-access template in July 2008 and have begun providing additional state regulators with direct electronic access, and anticipate providing expanded access to the federal financial regulators. A FinCEN official said that they are working on data-access MOUs for SROs.

FinCEN Has Provided More BSA Data Analyses and Has Been Discussing Additional Products with Regulators

Under their information-sharing MOUs, FinCEN is to provide analytical products to regulators. As it collects and manages all BSA-related data, FinCEN is in an optimal position to produce analytical products that assess BSA-related issues within and among financial sectors and regulators. FinCEN classifies the analytical reports it produces for its stakeholders into two categories: reactive and proactive. As discussed earlier, FinCEN conducts targeted financial institution analyses for regulators at their request. These analyses are considered reactive reports. As of September 2008, FinCEN’s proactive reports included strategic BSA data assessments, “By the Numbers” reports (such as its SAR reports), state-specific BSA data profiles, and reports of possible unregistered and unlicensed MSBs (produced for IRS).

FinCEN stated that the issues for which it chooses to conduct “strategic BSA data assessments” vary. For example, FinCEN officials said it produced a residential real estate assessment after it produced an initial report on commercial real estate as a possible venue for money laundering. FinCEN also conducted an assessment of mortgage fraud after its Office of Regulatory Analysis observed a spike in SAR filings related to mortgage loan fraud. FinCEN officials said that it takes about 4-6 months to produce such assessments, but that they expect this time would be significantly shortened after FinCEN’s planned modernization of the BSA database. While the reports are not produced on a regular schedule, FinCEN officials said that it has at least one assessment underway at all times.

FinCEN also biannually produces “By the Numbers” public reports that compile numerical data from SARs and supplement the “SAR Activity Review—Tips, Trends, and Issues” and state-specific BSA data profiles showing analysis of BSA filing trends within the 46 states agencies with which FinCEN has information-sharing MOUs. FinCEN began producing “State BSA Data Profiles” in May 2007 and said it had received input and some positive feedback from state and federal banking regulators. Moreover, some industry officials told us that these publicly available SAR reviews were very useful components of FinCEN’s outreach efforts.

In 2008, FinCEN, after discussions with SEC, began providing SEC with reports of securities-related SARs filed by depository institutions. The purpose of these reports is to alert SEC to any possible securities violations observed by depository institutions. To compile the reports, FinCEN analysts search on key terms provided by SEC. SEC staff said they have found these downloads very useful to their general enforcement and examination programs.

Approximately each quarter since June 2006, FinCEN has issued reports on possible unregistered and unlicensed MSBs (found by reviewing SARs filed by depository institutions). IRS officials have used the information to contact and register previously unregistered MSBs. IRS officials also telephone the unregistered MSBs to make sure the entities understand their BSA obligations.

Despite the provision of more analyses, most MOU holders with whom we spoke thought different or additional FinCEN analysis would be useful for their BSA compliance activities and have been discussing such products with FinCEN. In particular, some federal banking regulators said that the summary reports of numbers of examinations, violations, and enforcement actions among depository institutions that FinCEN provides them on a quarterly basis were of little use as they were compilations of data the federal banking regulators had given FinCEN. Although FinCEN provides analyses of issues after reviewing data and reports, federal banking regulator officials thought it would be more beneficial to receive analytical information to assist them in examination preplanning and scoping processes, which would allow them to better focus their BSA/AML resources and efforts. Federal banking regulators have cited requests regarding additional analysis made to FinCEN through the FFIEC BSA/AML working group. For instance, several federal banking regulators have requested state, regional, and national analysis of CTRs and SARs by type of institution, and additional analysis of MSBs and 314(a) hits. As they have limited access to BSA data, federal banking regulators are unable to conduct these analyses themselves. (We discuss data access issues in the following section.) IRS officials said they wanted reports similar to what FinCEN provides to law enforcement, such as analyses of potential money laundering regarding the U.S. southwest border. IRS officials said such reports would be helpful in determining where to allocate the agency’s examination resources. FinCEN officials said that they provide IRS (along with the federal banking regulators) a consolidated package containing the annual BSA data profiles for all states and certain U.S. territories. SEC staff they have had at least two discussions with FinCEN staff about analytic products that FinCEN could provide and they expected further discussions would take place.

FinCEN officials stated they needed to concentrate on providing products that could benefit multiple agencies to ensure they were using FinCEN resources effectively. As part of its efficiency and effectiveness initiative, FinCEN said it has identified ways it could increase its analytical support to regulators by providing products with useful information on macro-level risks. FinCEN officials said they are incorporating steps into its information technology modernization plans that will make the development of these products more feasible. FinCEN said it has been developing analyses of 314(a) hits to better inform regulators. In addition, one federal banking regulator and FinCEN have agreed to different approaches for obtaining supplemental BSA data analysis. In fall 2008, FDIC officials completed arrangements to have an FDIC analyst work at FinCEN on a part-time basis and that analyst began work with the Office of Regulatory Analysis. FinCEN officials said that they are open to detailees from more regulators as it would also help them understand better which types of analysis are more useful to the regulators.

Regulators Have Different Levels of Direct Access to BSA Data, which Inhibits Some Compliance Activities

With the exception of IRS, which maintains and stores all BSA information filed, FinCEN has developed data-access MOUs with some financial regulators to provide them with direct electronic access to BSA data. However, the level of access across financial regulators is inconsistent and has inhibited agencies’ compliance activities. For example, FinCEN provides the federal banking regulators with access to CTRs for depository institutions, SARs for depository institutions, and other reports. Federal banking regulators access this information through a secure system but are limited to downloading a certain number of records at a time. Officials from some federal banking regulators said that access to SARs or CTRs filed by institutions other than depository institutions would be useful. One official explained that some institutions, while regulated by others, can be affiliated with their supervised institutions. For example, an MSB may file a SAR on a bank’s customer, but the federal banking regulator does not have access to the SAR filed by the MSB. Unlike other federal banking regulators, OCC officials arranged with FinCEN to receive SAR data directly. For about 5 years, OCC has received a monthly compact disc with SAR data for the banks it regulates. With these data, OCC created the “SAR Data Mart,” which its staff use to take action against unlawful activity committed by depository institution insiders and for evaluating operational risk. OCC staff have found the ability to conduct is own analyses very useful.

SEC staff said they use their direct access to BSA data to review approximately 100 to 150 SARs for securities and futures firms daily. Furthermore, SEC staff said their access to these SARs has expanded their SAR review activities and enhanced SEC’s enforcement and examination programs.

In contrast, futures and securities SROs (including FINRA) and some state agencies that conduct BSA/AML examinations currently do not have direct electronic access to BSA data. Some of these regulators’ requests for such access have been pending for several years. FINRA—which conducts the majority of broker-dealer examinations (more than 2,000 in fiscal year 2008)—does not have direct electronic access to BSA data and must request SARs through SEC and FinCEN. With direct electronic access, FINRA and state agency officials told us they could more effectively risk scope their examination processes. Risk scoping by regulators may include reviewing the number of SARs and CTRs filed by institutions under their supervision to identify areas within an institution’s program or which institutions among their supervised entities on which to concentrate, enabling regulators to better plan their examinations and target their resources accordingly. As discussed above, federal banking regulators use BSA data to risk scope their examinations. Further, due to the large number of examinations they conduct, FINRA officials said it would strain SEC’s resources if FINRA asked SEC staff for access to every SAR filed by the institution under review. Therefore, FINRA staff request SARs from FinCEN primarily when FINRA staff suspect a firm may not have filed all the SARs it says it filed. FINRA officials said they often experienced delays in receiving the information. They also said they started to develop an MOU with FinCEN in 2002; however, the last time FINRA discussed data access with FinCEN was in March 2006.

CFTC is the last federal functional regulator to be provided direct electronic access to the BSA database. CFTC officials said that they made a formal request for direct access to BSA data in 2005. FinCEN officials said that, until recently, FinCEN and CFTC had not agreed on the terms of an electronic access MOU for BSA data. FinCEN and CFTC signed a data- access MOU concurrently with their information-sharing MOU in January 2009. Previously, if CFTC wanted BSA information, it had to make case-by- case requests to FinCEN. Similar to FINRA, CFTC officials said while FinCEN responded quickly to emergency BSA data requests, nonemergency requests could take much longer. CFTC officials said that the data-access MOU will permit CFTC to make BSA database inquiries in certain circumstances on behalf of an SRO. They said that they recognize the unique and highly sensitive nature of BSA data and providing the SROs with direct access to BSA data presents certain legal and regulatory oversight issues.

FinCEN explained it has been conducting a comprehensive evaluation of data access issues. In September 2008, FinCEN completed a bureau-wide initiative to better define the types of regulatory agencies to which it will provide electronic BSA data access and the criteria and processes for evaluating data access requests. FinCEN determined it would consider requests from agencies that examine for BSA compliance; supervise a financial institution for safety and soundness or financial responsibility; issue licenses or charters to financial institutions; or administer or enforce laws, regulations, or rules affecting financial institutions or markets. In evaluating these requests, FinCEN officials said that staff look at the requester’s regulatory authorities, ability to protect sensitive BSA data, and ability to utilize confidential information. But they said that SROs present unique issues because of their status as private actors, rather than governmental authorities. Although FinCEN said it anticipates providing SROs with access to appropriate data, their nongovernmental status requires FinCEN to contemplate appropriate access restrictions. FinCEN officials said they finalized a regulatory data-access template in July 2008 and have begun providing additional state regulators with direct electronic access, and anticipate providing expanded access to the federal financial regulators. A FinCEN official said that they are working on data-access MOUs for SROs.

Without electronic access to BSA data, some regulators cannot effectively scope risks for examinations, affecting their ability to efficiently plan examinations and target limited resources to areas of greatest risk. In addition, without direct access, in accordance with their examination procedures they cannot verify information that institutions are reporting on their BSA filings without requesting this information from FinCEN or another regulator who has access, thereby straining already limited resources. For example, as discussed above, to obtain access to some SARs, some regulators (such as FINRA) must contact FinCEN for access, further expending FinCEN’s and their limited resources.

Conclusions

Through the USA PATRIOT Act, more activities of a larger number of financial institutions have come under the umbrella of U.S. anti-money laundering efforts. As the BSA regulation framework has expanded, it also has become more complex—making it all the more important that FinCEN and the regulators establish effective communication and information exchanges to achieve their common goals. While the regulators take different approaches to examination and enforcement within their jurisdictions, they all have responsibilities in the BSA/AML regulatory framework. Additional AML legislation has increased the number of financial institutions that have come under the scope of BSA, as well as regulators’ interactions on these issues within and across their respective financial sectors. At the time of our 2006 report, the federal banking regulators and FinCEN already had achieved agreement on how to address some key aspects of BSA compliance and enforcement and developed a common examination manual.

Since that report, FinCEN and the regulators have made additional progress in ensuring the soundness of the current compliance and enforcement framework. While many improvements in the coordination among stakeholders—FinCEN, regulators, law enforcement, and the industries being regulated—have occurred, other working relationships among the stakeholders are not as efficient and effective as they could be. IRS has not fully leveraged its resources with those of state regulators to conduct examinations of MSBs. As a result of IRS not sharing its examination schedules with state agencies, state agency officials told us they sometimes have scheduled examinations shortly after IRS had completed examinations on the same institutions, subjecting them to duplicative monitoring. With approximately 200,000 MSBs in the United States, better coordination of examination scheduling between IRS and its state agency partners would both better leverage limited government resources and minimize the burden placed on those being regulated. Additionally, ongoing meetings such as those of BSAAG provide for some exchange of information, but some important regulatory issues cannot be discussed at meetings at which industry is present. While it is useful to have forums in which the regulators and the regulated exchange information, the sensitive nature of some BSA issues and the nonpublic nature of some examination modules suggest that an additional forum for regular information exchange among all the regulators is called for. Whether it is coordination of efforts between IRS and state regulators or among federal regulators, opening additional avenues for collaboration can (1) facilitate the exchange of best practices and better leverage limited regulatory resources, (2) minimize the regulatory burden on those being regulated, and (3) most importantly, see that the critical concerns embodied in BSA legislation are efficiently and effectively carried out.

FinCEN has taken many significant steps to improve execution of its BSA administrative and coordination responsibilities, but could make improvements in three areas: sharing information with CFTC, improving communication on IRS referrals and ensuring timely feedback to IRS- examined institutions, and reconciling outstanding data access issues. FinCEN also serves as the BSA data manager and provides the regulators with access to critical BSA data related to their supervised entities. With these data, regulators are able to scope risks for their examinations, better target their resources, and independently verify BSA data filings. However, CFTC only received electronic access in January 2009, and securities and futures SROs, and some state agencies do not yet have electronic access to BSA data. With today’s rapidly changing financial markets and the relationship of the futures industry to other sectors of the financial markets, it is especially important that SROs receive electronic access to BSA data to facilitate their examinations. Furthermore, IRS is hampered in carrying out its BSA-related compliance responsibilities because of uncertainties about when FinCEN will take action on IRS’s referrals. Since IRS does not have enforcement authority in this area, it is important that IRS and FinCEN develop a process that facilitates communication on IRS referrals. Without timely feedback, MSBs may be allowed to continue operating in violation of BSA statutes. Finally, delays in completing data- access agreements present obstacles to some regulators attempting to carry out their BSA-related responsibilities. While FinCEN is justified in its concerns about sharing very sensitive information, the delay in establishing information-sharing and data-access MOUs with CFTC, and the failure to establish data access MOUs with SROs and some states that also have important BSA-related responsibilities, presents a different set of potential problems, such as incomplete risk-scoping of examinations. While we commend FinCEN and CFTC for finalizing their MOUs, the benefits of the agreements will take some time to be realized. Until then, the potential ramifications include less assurance on the part of regulators that these financial institutions are complying fully with the BSA. Taking steps to resolve these areas of concern could provide tangible benefits in the BSA-related efforts of the regulators and build on recent improvements that FinCEN has made in its administrative and coordination responsibilities.

Recommendations for Executive Action

To reduce the potential for duplicative efforts and better leverage limited examination resources, we recommend that the Commissioner of IRS work with state agencies to develop a process by which to coordinate MSB examination schedules between IRS and state agencies that conduct BSA examinations of MSBs.

Further, to build on improvements made in examination processes vital to ensuring BSA compliance, we recommend that the heads of FinCEN, the Federal Reserve, FDIC, OTS, OCC, NCUA, SEC, CFTC, and IRS direct the appropriate staff to consider developing or using an existing process to share and discuss information on BSA/AML examination procedures and general trends regularly in a nonpublic setting. We recommend that the heads of SEC and CFTC consider including the SROs that conduct BSA examinations.

To improve its efforts to administer BSA, we recommend that the Director of FinCEN expeditiously take the following two actions: Work with the Commissioner of IRS to establish a mutually agreed-upon process that facilitates communication on IRS referrals and ensures timely feedback to IRS-examined institutions.

Finalize data-access MOUs with SROs conducting BSA examinations, and states agencies conducting AML examinations that currently have no direct access to BSA data.

Agency Comments and Our Evaluation

We provided a draft of this report to the heads of the Departments of Justice and the Treasury; the Federal Reserve, FDIC, NCUA, OCC, OTS, IRS, SEC, and CFTC. We received written comments from FinCEN, IRS, and all the financial regulators. These comments are summarized below and reprinted in appendixes IV-XII. All of the agencies provided technical comments, which we incorporated into this report, where appropriate.

In its comments, IRS agreed with our recommendation that the IRS commissioner work with state agencies to develop a process by which to coordinate BSA examination schedules. The agency said that actions to address our recommendation already were underway.

In their written responses, all of the agencies agreed with our recommendation that they consider developing a mechanism or using an existing process to conduct regular, nonpublic discussions of BSA examination procedures and general trends to better ensure consistency in the application of BSA. In technical comments, some agencies asked that we be more specific about which component of their agencies should participate in and conduct these discussions. We modified the recommendation language to clarify that the heads of the agencies should direct appropriate staff to undertake these actions. The Federal Reserve commented that such discussions could build on improvements already made in examination processes and that regular discussion of examination procedures and general compliance trends could be beneficial. FDIC agreed that periodic meetings with all federal agencies responsible for BSA compliance could promote consistency and coordination in examination and enforcement approaches and help reduce regulatory burden. OCC commented that a number of groups and processes already existed for sharing information and collaboration and that they would continue to participate in these initiatives and look for opportunities to share their practices and observations. OTS commented that that they would collaborate and that the federal banking agencies and FinCEN have established a number of formal committees and working groups to promote collaboration on BSA issues. SEC agreed that the regulators would benefit from the development of such a mechanism and noted that it planned to attend a meeting in which FinCEN was planning to discuss possible methods for achieving this goal. CFTC commented that it supports all efforts to increase cooperation among regulators in the BSA area and that it would be pleased to participate in discussions that would allow the agency to share experiences and expertise in developing and implementing BSA examination procedures.

In its comments, FinCEN said it concurred with the intent of our recommendations, particularly in regard to expanding information sharing with authorized stakeholders, and hoped to be situated in the future to meet them. The draft report that we sent to the agencies for comment contained a recommendation that FinCEN finalize information-sharing and data-access MOUs with CFTC. These MOUs were signed on January 15, 2009, so we have removed the recommendation from the final report. In its comments, CFTC noted that the MOUs had been signed and said that it believed these two agreements would enhance CFTC’s ability to effectively implement its BSA examination responsibilities. Through discussions with FinCEN officials and FinCEN technical comments, FinCEN provided us with additional information and data about our draft recommendation on IRS referrals. We subsequently broadened the recommendation language to clarify that FinCEN should work with IRS to develop a process to facilitate communication on referrals and ensure timely feedback to IRS-examined institutions. FinCEN and IRS said they agreed with this modification. Finally, in its comments, SEC also supported our recommendation that FinCEN finalize data-access MOUs with SROs that conduct BSA examinations. SEC noted its view that direct access to BSA data would permit FINRA to more effectively use its AML resources to take a more risk-based approach to identifying firms and areas within a firm’s AML program that required examination.

As agreed with your office, unless you publicly announce the contents of this report earlier, we plan no further distribution of this report until 30 days from the report date. At that time, we will send copies to interested congressional committees, Treasury, FinCEN, Federal Reserve, FDIC, OCC, OTS, NCUA, SEC, CFTC, IRS, and Justice. The report also will be available at no charge on the GAO Web site at http://www.gao.gov.

If you or you staff have questions about this report, please contact me at (202) 512–8678 or edwardsj@gao.gov. Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this report. GAO staff who made major contributions to this report are listed in appendix XIII.

Appendix I: Objectives, Scope and Methodology

Our objectives were to (1) describe how Bank Secrecy Act (BSA) compliance and enforcement efforts are distributed among federal and state regulators, self-regulatory organizations (SRO), and the Financial Crimes Enforcement Network (FinCEN); (2) describe how federal agencies other than FinCEN are implementing their BSA activities and evaluate their coordination efforts; and (3) evaluate how FinCEN is executing its BSA responsibilities and coordinating BSA efforts among the various agencies.

To describe how BSA compliance and enforcement efforts are distributed among federal regulators, SRO, and FinCEN, we reviewed and analyzed authorities established by BSA, the USA PATRIOT Act, and other relevant federal financial and anti-money laundering (AML) legislation. We also reviewed prior GAO and Department of the Treasury (Treasury) Inspector General reports on this issue. In addition, to better understand how BSA/AML authorities were delegated and interrelate with other financial regulatory authorities, we interviewed officials from the federal agencies included in the BSA/AML compliance and enforcement regulatory framework—FinCEN; the federal banking regulators: the Board of Governors of the Federal Reserve System (Federal Reserve), Federal Deposit Insurance Corporation (FDIC), Office of the Comptroller of the Currency (OCC), Office of Thrift Supervision (OTS), and National Credit Union Administration (NCUA); Securities and Exchange Commission (SEC), Commodity Futures Trading Commission (CFTC), and the SROs they regulate; Internal Revenue Service (IRS); and Department of Justice (Justice).

To examine how entities with BSA/AML compliance and enforcement responsibilities implement their BSA activities and evaluate their coordination efforts, we reviewed prior GAO reports; available BSA/AML examination manuals and procedures; other related guidance; reports complied in accordance with FinCEN information-sharing memorandums of understanding (MOU); and data maintained on the numbers of the BSA/AML examinations, violations, and enforcement actions taken in the banking, securities, futures, and IRS-examined industries. Further, we conducted data reliability assessments of BSA/AML-related data and found the information to be reliable for the purposes of this report. In addition, we reviewed quality assurance reviews conducted by the federal banking regulators of their BSA/AML examinations. We interviewed officials from all of the federal agencies and their SROs mentioned above and also spoke with officials from select state financial regulatory agencies to obtain information on their BSA/AML compliance and enforcement activities and how these state agencies coordinate with federal agencies. We selected state regulators to interview on the basis of their geography, the presence of a High Intensity Financial Crime Area in their state, the size and variety of the financial sectors present in their state, the existence of a money services business (MSB) examination program in their state, and whether they were contacted by GAO for a previous BSA/AML-related GAO report in 2006.

With respect to the federal banking regulators and their efforts to ensure BSA compliance among depository institutions, we reviewed the Federal Financial Institutions Examinations Council (FFIEC) BSA/AML interagency examination manual, and GAO staff attended 3 days of training on the manual provided to federal and state bank examiners. We also reviewed quarterly and annual reports which included data on examinations, violations, and enforcement actions, as well as information on staffing and training, that were submitted by the federal banking regulators to FinCEN per their MOU. We reviewed these reports to assess whether regulators were in compliance with MOU requirements and to inform our understanding of their BSA/AML compliance activities. In addition to meetings with federal banking regulator BSA/AML program staff, we also held interviews with groups of examiners from each of the federal banking regulators to discuss the manual and interagency coordination. We also spoke with a state banking regulatory association and credit union regulatory association. Further, to obtain industry perspective, in cooperation with another GAO team looking at the usefulness of suspicious activity reports (SAR), we interviewed two banking industry associations and 20 depository institutions on the impact of the manual and coordination among federal and state banking regulators.

To select the 20 depository institutions, we grouped the depository institutions into four categories depending on the numbers of SARs filed in calendar year 2007. We interviewed representatives from all 5 institutions that had the largest number of SAR filings in 2007, as well as representatives from 15 randomly selected institutions. The 15 institutions represented different categories of SAR filings: small (1-4 SARs filed in 2007), medium (5-88), and large (more than 88—excluding the 5 largest).

To obtain information on the BSA/AML compliance and enforcement activities of SEC, CFTC, and IRS, we interviewed officials from these agencies, as well as officials from securities and futures SROs; state regulatory agencies; securities and futures firms; and securities, futures, and money transmitter industry associations. We interviewed 8 securities firms through the auspices of an industry trade association and interviewed one large and small futures drawn from a list provided by a futures regulator. In addition, we reviewed available examination modules; related training guidance; and reports provided to FinCEN by SEC and IRS in accordance with their information-sharing MOUs that contain data on BSA/AML examinations, violations, and enforcement actions; as well as BSA/AML training and staffing information. We obtained and reviewed similar information from CFTC. To describe Justice’s enforcement actions, we interviewed Justice officials, analyzed Justice’s enforcement actions, and reviewed other BSA/AML-related Justice documentation. In order to evaluate coordination efforts, we compared the practices of these agencies with best practices outlined in a GAO report evaluating coordination practices among federal agencies.

To evaluate FinCEN BSA/AML compliance and enforcement efforts, we collected and reviewed available staffing and performance measurement data from FinCEN, program assessments, BSA/AML-violation referral data from its Case Management System (CMS), FinCEN analytical products, strategic plans and annual reports, and other documentation. We also assessed the reliability of data provided to us by FinCEN from its CMS and found it to be reliable for the purposes of this report. In addition, we reviewed the three surveys FinCEN conducted of users of its Regulatory Resource Center in 2006, 2007, and 2008 and a fourth survey it conducted of regulators with which it has information-sharing MOUs. Despite some potential limitations associated with the surveys, we concluded that the overall frequencies for survey questions should be sufficiently valid and reflected the overall opinions of those surveyed. FinCEN officials also told us that information-sharing MOU survey respondents might have, in some cases, been providing responses to reflect their experiences with data- access MOUs. Further, we interviewed FinCEN officials from the Office of the Director, Management Programs Division, the Analysis and Liaison Division, and the Regulatory Policy and Programs Division (RPPD). We conducted interviews with staff from each of the offices within RPPD. In addition, we conducted interviews with officials from the federal banking regulators, SEC, CFTC, securities and futures SROs, IRS, and industry to discuss FinCEN’s efforts.

We conducted this performance audit in Washington, D.C., New York, New York, and Chicago, Illinois, from October 2007 to February 2009 in accordance with generally accepted government auditing standards. Those standards require that we plan and perform the audit to obtain sufficient, appropriate evidence to provide a reasonable basis for our findings and conclusions based on our audit objectives. We believe that the evidence obtained provides a reasonable basis for our findings and conclusions based on our audit objectives.

Appendix II: Overview of Federal Agencies Involved in the BSA/AML Framework and Related Resources

This appendix provides an overview of the compliance and enforcement activities of the federal financial regulators and IRS and provides information, to the extent it is available, on their BSA-related resources and training.

Overview of Federal Agencies Involved in BSA/AML Compliance and Enforcement

The federal banking regulators (the Board of Governors of the Federal Reserve System (Federal Reserve), Federal Deposit Insurance Corporation (FDIC), Office of the Comptroller of the Currency (OCC), Office of Thrift Supervision (OTS), and National Credit Union Administration (NCUA)), Securities Exchange Commission (SEC), Commodity Futures Trading Commission (CFTC), securities and futures self-regulatory organizations (SRO), and Internal Revenue Service (IRS) play roles in implementing BSA/AML compliance. The U.S. regulatory system is described as “functional,” so that financial products or activities are generally regulated according to their function, no matter who offers the product or participates in the activity. Below is a discussion of their missions and how they undertake general compliance and enforcement activities within their industries.

Federal Banking Regulators

Depository institutions can generally determine their regulators by choosing a particular kind of charter—for example, commercial bank, thrift, or credit union. These charters may be obtained at the state level or the national level. While state regulators charter institutions and participate in oversight of those institutions, all of these institutions have a primary federal regulator if they have federal deposit insurance. Broadly, the federal banking regulators that provide oversight for banks are the Federal Reserve, FDIC, and OCC; thrifts—OTS; and credit unions— NCUA. Banking regulators generally focus on ensuring the safety and soundness of their supervised institutions. They conduct safety and soundness examinations on-site to assess an institution’s financial condition, policies and procedures, and adherence to laws and regulations. Generally, regulatory agencies perform these examinations every 12 to 18 months, based on the institution’s risk. The Federal Reserve, FDIC, OTS, and NCUA (but not OCC) alternate or conduct joint safety and soundness examinations with state regulators, generally using the same examination procedures. State banking regulators may examine depository institutions chartered within their jurisdictions.

Federal and state banking regulators may address compliance problems identified through their examinations by bringing the problem to the attention of institution management and obtaining a commitment to take corrective action. When these actions are insufficient or weaknesses identified are more substantive, regulators may take nonpublic, informal enforcement actions. Informal actions (which vary among the federal banking regulators) may include the adoption of resolutions by an institution’s board of directors, the execution of a memorandums of understanding between an institution and the regulators, notices of safety and soundness deficiency for compliance, commitment letters, or corrective actions to be taken to address regulatory concerns. Informal actions usually are taken to address violations that are limited in scope and technical in nature. Federal banking regulators also may take formal enforcement actions if a depository institution is engaging in unsafe or unsound practices or has violated a law or regulation. Formal enforcement actions are public and generally considered more stringent than informal actions and can address more significant, repeated, or systemic BSA violations. Formal enforcement actions include cease-and-desist orders, assessments of civil money penalties (CMP), or supervisory agreements. These types of actions are enforceable through an administrative process or injunctive relief in federal district court.

SEC and Securities SROs

SEC’s mission is to protect investors; maintain fair, orderly, and efficient securities markets; and facilitate capital formation. SEC regulates the securities industry in part through oversight of its SROs. SEC, through its Office of Compliance and Examination (OCIE) shares examination responsibilities with securities SROs, which include examining for BSA/AML compliance. OCIE’s routine examinations are conducted according to a cycle that is based on a registrant’s perceived risk. In addition to routine examinations, OCIE also may conduct sweep examinations to probe specific activities of a sample of firms to identify emerging compliance problems so they can be remedied before becoming severe or systemic. Third, OCIE conducts cause examinations when it has reason to believe that something is wrong at a particular firm.

SROs have statutory responsibilities to regulate their own members, and one SRO—the Financial Industry Regulatory Association (FINRA)— provides oversight of the majority of broker-dealers in the securities industry. SROs conduct risk-based examinations, which include a BSA component, of their members to ensure compliance with SRO rules and federal securities laws. These examinations are conducted on a risk-based cycle (similar to SEC’s), and no member is examined less frequently than every 4 years.

Through oversight inspections of the SROs, OCIE evaluates the quality of the SROs’ oversight in enforcing member compliance. At regular intervals, OCIE conducts routine inspections of SROs’ key regulatory programs, such as SRO enforcement, arbitration, and examination programs. Inspection of enforcement programs typically includes a review of SRO surveillance programs for identifying potential violations of trading rules or laws, investigating those potential violations, and disciplining those who violate the rule or law.

SEC and its SROs also have enforcement divisions that are responsible for investigating and prosecuting violations of securities laws or regulations as identified through examinations; referrals from other regulatory organizations; and tips from firm insiders, the public, and other sources. For less significant issues, examiners may cite a deficiency for correction through remedial actions. SEC and SRO examiners conduct exit interviews with firms, which are usually followed by letters discussing examination findings. SEC issues deficiency letters that formally identify compliance failures or internal control weaknesses at a firm. Most examinations conclude with the firm voluntarily correcting the compliance problem and stating the specific actions it is taking in its response to SEC. Potential SEC enforcement sanctions include disgorgement, CMPs, cease-and-desist orders, and injunctions. When SROs find evidence of potential violations of securities laws or SRO rules by their members, they can conduct disciplinary hearings and impose penalties. These penalties can range from disciplinary letters to the imposition of monetary fines to expulsion from trading and SRO membership.

CFTC and Futures SROs

CFTC’s primary mission is to preserve the integrity of the futures markets and protect market users and the public from fraud, manipulation, and abusive practices related to the sale of commodity futures and options.

While CFTC directly performs the market surveillance and enforcement functions, CFTC carries out its regulatory functions with respect to futures firms through SROs that act as the primary supervisor for members of the futures industry. CFTC does not routinely conduct direct examinations of the institutions that it supervises; instead, it oversees their SROs’—the National Futures Association (NFA), Chicago Mercantile Exchange, New York Mercantile Exchange, Chicago Board of Trade, and the Kansas City Board of Trade—examinations of futures firms. Each futures exchange is an SRO that governs its floor brokers, traders, and member firms. NFA also regulates every firm or individual that conducts futures trading business with public customers. SROs are responsible for establishing and enforcing rules governing member conduct and trading, providing for the prevention of market manipulation, ensuring futures industry professionals meet qualifications, and examining exchange members for financial soundness and other regulatory purposes. SROs examine their members for compliance with their rules, including those imposing BSA/AML requirements. The futures SROs’ examination cycles range from 9 to 18 months for futures commission merchants, but introducing brokers may have longer examination cycles.

While CTFC does not conduct routine examinations of futures firms, it provides oversight of futures SROs to ensure that each has an effective self-regulatory program. CFTC’s Division of Clearing and Intermediary Oversight conducts periodic, risk-based examinations of an SRO’s compliance examination program, which may include BSA/AML issues. During the examination, CFTC reviews the SRO’s documentation of select examinations and independently performs examinations for the same periods to compare its results with those of the SRO’s examinations.

SROs may take enforcement actions against any member that is in violation of member rules and CFTC regulations, which include BSA/AML- related rules. BSA/AML obligations for the futures industry are set forth in the USA PATRIOT Act, BSA, FinCEN and CTFC regulations, and SRO member rules. CFTC’s Division of Enforcement investigates and prosecutes alleged violations of the Commodity Exchange Act and CFTC regulations, and reviews SRO open investigations and enforcement actions.

IRS is a bureau within Treasury, with the mission of helping taxpayers understand and meet their tax responsibilities and ensuring that all taxpayers comply with tax laws. Unlike others with BSA/AML compliance responsibilities, IRS does not conduct examinations of compliance with any legislation other than BSA/AML rules and regulations. FinCEN delegated BSA examination authority to IRS for any financial institution not subject to BSA examination by another federal regulator. These institutions are mainly nonbank financial institutions (NBFI) such as casinos, some credit unions, credit card operators, and approximately 200,000 money service businesses (MSB), which are the most numerous of the NBFIs.

IRS’s Small Business/Self-Employed Division, which reports to the Deputy Commissioner of Services and Employment, conducts BSA compliance examinations of NBFIs. In 2004, IRS created the Office of BSA/Fraud within the Small Business/Self-Employed Division to better focus on BSA examinations of NBFIs. IRS’s BSA program also aims to increase the number of identified NBFIs, conduct outreach and education to NBFIs, and refer any NBFIs to the Financial Crimes Enforcement Network (FinCEN) or IRS Criminal Investigation for civil and criminal enforcement actions. IRS Criminal Investigation, IRS’s enforcement arm, investigates individuals and businesses suspected of criminal violations of the Internal Revenue Code, money laundering and currency crime, and some BSA laws. IRS Criminal Investigation usually investigates BSA criminal violations in conjunction with other tax violations. IRS Criminal Investigation’s first enforcement priority is tax fraud and tax evasion, but currency reporting and money laundering enforcement also are areas of emphasis.

Federal Agencies Generally Incorporate BSA/AML-related Staffing and Training into Overall Compliance Programs, but Some Maintain BSA/AML- dedicated Information on Resources

Staffing

The federal banking regulators, SEC, and CFTC incorporate their BSA activities into their overall compliance programs. However, all the regulators either track the number of hours spent on BSA/AML issues or numbers of staff with BSA/AML-related responsibilities. All of the regulators have staff that examine institutions for BSA/AML compliance concurrently with their comprehensive safety and soundness compliance examinations. The points below summarize BSA/AML-specific data (for 2008 where possible) for each regulator (IRS excepted): Federal Reserve. The Federal Reserve has a BSA/AML Risk Section within its Division of Banking Supervision and Regulation, which consists of seven staff who monitor BSA/AML compliance concerns and liaise with staff from Federal Reserve Banks to provided guidance on BSA/AML issues. Federal Reserve officials said they also have BSA/AML specialists located in some Federal Reserve Banks.

FDIC. In 2008, of the 1,680 examiners that conduct safety and soundness examination (during which a BSA/AML examination is conducted concurrently), 324 were BSA subject matter experts, and 117 are certified AML specialist examiners. Further, FDIC officials estimated the agency devoted 107.4 and 103.5 full-time equivalent positions to BSA/AML activities in 2006 and 2007, respectively.

OCC. OCC has a Director for BSA/AML Compliance that oversees a staff of six full-time BSA/AML compliance specialists in its headquarters. From 2005 through 2007, OCC officials estimated that the agency annually devoted an average of 105 full-time equivalent positions to the BSA, while in 2008, OCC devoted approximately 86 full-time equivalents.

OTS. In 2008, OTS reported that five Regional Assistant Directors for Compliance serve as subject matter resources on BSA, in addition to 15 regional compliance specialists, and 2 national office staff that are dedicated to BSA/AML issues. OTS officials estimated the time its attorneys devoted to BSA/AML issues as being equivalent to two full-time positions.

NCUA. As of September 30, 2008, NCUA reported employing 514 examiners, which included 31 examiners designated as consumer compliance subject matter examiners (which includes BSA/AML issues). Each of NCUA’s five regional offices has at least one BSA/AML analyst, its Office of Examination and Insurance has two BSA/AML program officers, and the Office of General Counsel has two attorneys that focus on BSA issues.

SEC. SEC has a BSA/AML team comprised of from five to seven OCIE staff members, from three to five Division of Enforcement staff members, and three members from the Division of Trading and Markets. The team is responsible for monitoring its BSA/AML examination program; providing expertise to regional offices; and maintaining communication with FinCEN, the SROs, and other regulators on AML issues. Further, SEC broker-dealer examination staff have an AML working group consisting of one or more representatives from each regional office, who serve as AML experts. FINRA has nine AML regulatory experts.

CFTC. CFTC does not have full-time staff dedicated solely to BSA/AML compliance; however, various staff may be involved in BSA/AML issues. CFTC staff conduct periodic oversight examinations of SROs’ compliance examination programs, which include a review of BSA/AML procedures. CFTC staff also devote time to BSA/AML policy issues during the rule- making process and at other times, as requested by FinCEN. Futures SROs include BSA/AML as part of their broader compliance examination programs. NFA and the Chicago Mercantile Exchange have 130 and 59 examination staff respectively, all of which have been trained in BSA/AML.

Training

All of the regulators and their SROs that examine financial institutions for BSA/AML compliance provide opportunities to their staff to receive BSA/AML training—provided by the agency, working groups (such as FFIEC), or outside vendors. FFIEC, for example, provides both an AML workshop for examiners knowledgeable of BSA and experienced in examining institutions for BSA program compliance and, as of 2007, an advanced BSA/AML specialists conference for designated BSA compliance examiners and other BSA subject matter experts. In 2007, over 400 trainees participated in these programs. Agencies and SROs provided several examples of BSA/AML training available to their staff and others (see table 11).

IRS Has a BSA/AML- Specific Compliance Unit, Budget, and Performance Measures

Unlike the federal banking regulators, SEC, and CFTC, who incorporate BSA activities into their compliance programs, IRS’s BSA/AML activities are managed separately in its Office of Fraud/BSA within the Small Business/Self Employment division. This office is solely dedicated to examining NFBIs for BSA compliance. Since IRS created the office, IRS has tracked several BSA-specific output and efficiency performance measures, such as number of examinations, referrals, closures, and hours per case (see table 12). IRS also has a detailed strategic plan devoted to BSA compliance and enforcement activities.

We previously reported that IRS lacked a measure for NBFI compliance rates with BSA and thus could not track program effectiveness over time. We recommended that the Secretary of Treasury direct FinCEN and IRS to develop a documented and coordinated strategy—that would include priorities, time frames, and resource needs, and measure the compliance rate of NBFIs—to improve BSA compliance by NBFIs. IRS and FinCEN responded by developing such a strategy, which identifies various NBFI categories, prioritizes actions to be taken overall and within each category for improving BSA compliance, explains who is responsible for the actions, and establishes the time frames for identifying whether an action has been completed or when it is to be completed. Similar to the other regulators, IRS’s Office of BSA/Fraud conducts quality reviews of examinations.

Over the last several years, IRS has increased the resources it devotes to BSA compliance. In fiscal year 2007, IRS spent over $71 million and 700 full-time equivalents on BSA-related activities, which is an increase of 3 percent and 5 percent, respectively, from 2006. Specifically, the Small Business/Self Employment’s Office of Fraud/BSA increased its BSA field examiner staff from 372 in 2006 to 385 in 2007. New Small Business/Self Employment employees receive Basic BSA/AML training on both BSA and currency transaction reporting requirements (Form 8300 examinations). Experienced BSA examiners receive specialized training for specific industries, such as insurance companies, credit unions, casinos, and jewelry and precious metals dealers. IRS also has developed specific BSA training for managers and coaches of BSA examiners. The Office of Fraud/BSA also distributes a BSA/AML examination guide, provides BSA newsletters, and updated the Insurance Industry Guide and Internal Revenue Manual.

Appendix III: Examples of BSA/AML-Related Formal Enforcement Actions

In fiscal year 2008, approximately 70 BSA/AML-related formal enforcement actions were taken by federal financial regulators--the Board of Governors of the Federal Reserve System (Federal Reserve), Federal Deposit Insurance Corporation (FDIC), Office of the Comptroller of the Currency (OCC), Office of Thrift Supervision (OTS), Securities Exchange Commission (SEC)--the National Futures Association (NFA), the Financial Industry Regulatory Authority (FINRA), and other self-regulatory organizations (SROs). In fiscal years 2006-2008, the Financial Crimes Enforcement Network (FinCEN) and the federal financial regulators and SROs jointly assessed 11 civil money penalties (CMP). Table 13 contains examples of formal enforcement actions, excluding CMPs, that were not taken concurrently with FinCEN.

Table 14 lists examples of BSA/AML-related CMPs issued: (1) jointly by federal and state regulators, SROs, and FinCEN; (2) solely by FinCEN; and (3) by federal regulators only.

Appendix IV: Comments from the Department of the Treasury’s Financial Crimes Enforcement Network

Appendix V: Comments from the Internal Revenue Service

Appendix VI: Comments from the Board of Governors of the Federal Reserve

Appendix VII: Comments from the Federal Deposit Insurance Corporation

Appendix VIII: Comments from the Office of the Comptroller of the Currency

Appendix IX: Comments from the Office of Thrift Supervision

Appendix X: Comments from National Credit Union Administration

Appendix XI: Comments from Securities and Exchange Commission

Appendix XII: Comments from the Commodity Futures Trading Commission

Appendix XIII: GAO Contact and Staff Acknowledgments

GAO Contact

Staff Acknowledgments

In addition to the contact named above, Barbara I. Keller (Assistant Director), Allison M. Abrams, M’Baye Diagne, John P. Forrester, Kerstin Larsen, Carl Ramirez, Barbara M. Roesmann, Ryan Siegel, and Paul Thompson made key contributions to this report.