USA Patriot Act: Additional Guidance Could Improve Implementation of Regulations Related to Customer Identification and Information Sharing Procedures
Released: 2005-06-06T00:00:00

Letter

Background

Money laundering is the process used to transform monetary proceeds derived from criminal activities into funds and assets that appear to have come from legitimate sources. Terrorist financing is generally characterized by different motives than money laundering and the funds involved often originate from legitimate sources. However, the techniques for hiding the movement of funds intended to be used to finance terrorist activity—techniques to obscure the origin of funds and the ultimate destination—are often similar to those used to launder money. Therefore, Treasury, federal law enforcement agencies, and the federal financial regulators often employ similar approaches and techniques in trying to detect and prevent both money laundering and terrorist financing.

Following the September 11 terrorist attacks, Congress passed the USA PATRIOT Act, which was enacted on October 26, 2001. Title III of the PATRIOT Act amended the BSA. The BSA was enacted by Congress in 1970 and requires that financial institutions file reports and maintain records with respect to certain transactions in currency and monetary instruments that are determined to have a high degree of usefulness in criminal, tax, or regulatory investigations and, as amended by the PATRIOT Act, these records and reports also have a high degree of usefulness in the conduct of intelligence or counterintelligence activities. As a result, the BSA helps to provide a paper trail of the activities of money launderers for law enforcement officials in pursuit of criminal activities. Congress has amended the BSA several times to give the U.S. government a wider variety of regulatory tools to combat money laundering. In addition to requiring regulations for information sharing and customer identification programs, Title III of the PATRIOT Act expands Treasury’s authority to regulate the activities of U.S. financial institutions and requires a wide variety of types of financial institutions to maintain anti-money laundering programs.

Agencies under the Departments of the Treasury, Justice, and Homeland Security are to coordinate with each other and with federal financial regulators in combating money laundering and terrorist financing. Within Treasury, FinCEN, under delegated authority from the Secretary of the Treasury, is the administrator for the BSA and supports law enforcement agencies by collecting, analyzing, and coordinating financial intelligence information to combat money laundering. As a bureau of Treasury, FinCEN clears all BSA regulations through Treasury. In August 2004, FinCEN created an Office of Compliance to oversee and work with the federal financial regulators on BSA examination and compliance matters. FinCEN signed a Memorandum of Understanding (MOU) with the banking regulators in September 2004 that laid out procedures for the exchange of certain BSA information. The MOU requires that the federal banking regulators provide information on examination policies and procedures and on significant BSA violations or deficiencies that have occurred at the financial institutions they supervise, including relevant portions of examination reports and information on follow-up and resolution. FinCEN will also provide information to the banking regulators, including information on FinCEN enforcement actions and analytical products that will identify various patterns and trends in BSA compliance. FinCEN has been working on similar MOUs with SEC and CFTC; however, as of March 25, 2005, no effective dates have been set for either of them.

Department of Justice components involved in efforts to combat money laundering and terrorist financing include the Criminal Division’s Asset Forfeiture and Money Laundering Section and Counterterrorism Section, the FBI, the Bureau of Alcohol, Firearms, and Explosives, the Drug Enforcement Administration, and the Executive Office for U.S. Attorneys (EOUSA) and U.S. Attorneys Offices. The Department of Homeland Security’s Bureau of Immigration and Customs Enforcement (ICE) also investigates cases involving money laundering and terrorist activities.

The federal financial regulators who oversee financial institutions and examine them for compliance with anti-money laundering laws and regulations include the federal banking regulators—the Federal Reserve, OCC, OTS, FDIC, and NCUA—and SEC, which regulates the securities markets, and the CFTC, which regulates commodity futures and options markets. Because the U.S. securities and futures markets are regulated through a combination of self-regulation (subject to federal oversight) and direct federal regulation, the SROs also oversee compliance with anti- money laundering laws and regulations. Two of the SROs—NASD and NYSE—oversee registered broker-dealers. NFA oversees futures commission merchants and introducing brokers in commodities. In addition to NFA, a number of the futures commission merchants are overseen by futures exchanges, including the New York Mercantile Exchange, CME, and CBOT.

Developing Regulations for CIP and Section 314 That Applied to a Wide Range of Financial Institutions Was Difficult and Complex

Treasury and the federal financial regulators encountered numerous challenges as they developed regulations to implement sections 314 and 326. Key challenges related to implementing section 326 included developing regulations that could be applied consistently across a financial industry that has diverse business models, customer relationships, and financial products. In addition, many financial institutions have arrangements with other institutions to process customer transactions. These arrangements and the need to build in a risk-based approach to customer identification created concerns among the regulators and industry about reasonable levels of accountability for verifying the identity of customers. Developing regulations for section 314 presented practical problems on how to develop a process for information sharing between law enforcement and industry and a process that allows financial institutions to share information with each other.

Development of the CIP Requirement Highlighted Difficulties in Applying Requirements Consistently to a Wide Range of Financial Products and Businesses

Treasury and the federal financial regulators had to resolve several issues through an interagency process when developing the regulations for CIP, such as defining “customer” and “account” for the purposes of the regulations and determining how much flexibility to give firms in verifying the identity of customers. Because the regulations for CIP would apply to a diverse financial industry, FinCEN and the regulators formed a working group and gathered information from industry officials about their different business models and customer relationships. According to FinCEN officials, the interagency process employed to issue joint regulations was the first that included Treasury and the seven federal financial regulators. Specifically, Treasury and the five banking regulators (FDIC, Federal Reserve, NCUA, OCC, and OTS) jointly adopted a CIP rule covering banks, thrifts, and credit unions. Treasury and SEC jointly adopted separate rules for broker-dealers and mutual funds. Treasury and CFTC jointly adopted a rule for futures commission merchants and introducing brokers. As shown in figure 1, the rulemaking process took over a year and a half to complete.

Following the issuance of the joint notices of proposed rulemaking in July 2002, Treasury and the federal financial regulators collectively received approximately 500 comments, many of which expressed concerns about the types of accounts and customers that should be subject to CIP. For instance, some comments questioned whether an account established as part of an employee benefit plan should be subject to CIP regulations, the extent to which the risk-based approach should be used, and the need for Treasury and the federal financial regulators to be more specific about the methods of verification. Other comments proposed that the entire process be risk-based without any minimum requirements. Some comments also addressed how financial institutions could rely on or share responsibility with another institution for verifying the identity of a shared customer account. This reliance aspect is important for some types of financial institutions that have securities and futures products. For example, in the securities industry, many brokers interact with customers (introducing brokers) but rely on another broker for clearance, settlement, and custody purposes (clearing firms). Typically under this arrangement the introducing broker interacts with the customer by taking orders and making recommendations and the clearing firm holds the customer assets. Treasury and the regulators also considered how financial institutions could verify customer identities for customers who open accounts by mail, by phone, or over the Internet.

Treasury and the federal financial regulators ultimately established minimum identification requirements and mandated that financial institutions develop risk-based procedures for verifying the identity of each customer to the extent reasonable and practicable. The verification procedures included documentary and nondocumentary methods to cover the variety of approaches customers use to open accounts. The final rules published on May 9, 2003, provide a framework with minimum standards for identifying customers, while allowing financial institutions flexibility to design and implement CIPs according to risk-based procedures for verifying identity based on their business lines, types of customers, and methods of opening accounts. Figure 2 illustrates requirements for identification and verification procedures.

In addition to establishing minimum identification standards and a risk- based approach for verification procedures, the final rule requires that financial institutions develop CIPs that include procedures for (1) making and maintaining a record of information required to be obtained from the customer at the time the account is opened and retaining the information for five years after the date the account is closed, (2) providing notice to the customer that their identity will be verified, and (3) determining whether a person appears on any list designated by Treasury (in consultation with the federal financial regulators) as a federal government list of known or suspected terrorists or terrorist organizations that must be checked by financial institutions as part of the CIP requirement. Treasury has not designated a list for the CIP requirement at this time.

The final rule also allows financial institutions to rely on another financial institution to perform any procedures of its own CIP for customers that the two financial institutions share provided that, among other requirements, the financial institution that is being relied on enter into a contract certifying annually to the relying financial institution that it has implemented its own anti-money laundering program and that it will perform the specified requirements of the relying financial institution’s CIP. The rule also requires that the financial institution being relied on is regulated by a federal functional regulator. The final rules stated that financial institutions were expected to be in compliance with the final rules no later than October 1, 2003.

Treasury issued a Notice of Inquiry in July 2003 (see fig. 1) approximately 2 months after the final CIP rules had been adopted, soliciting additional comments about two aspects of the final CIP rules that concerned some interested parties, including members of Congress and law enforcement officials. The Notice of Inquiry sought additional comments on (1) whether and under what circumstances financial institutions should be required to retain photocopies of identification documents relied on to verify customer identity and (2) whether there are situations when the regulations should preclude reliance on certain forms of foreign government-issued identification to verify customer identity. Treasury received over 34,000 comments in response to the Notice of Inquiry from a wide variety of individuals and entities, including members of Congress, the Department of Justice, the financial services industry, advocacy groups, and interested citizens.

Treasury did not make any changes to the final CIP rules for two reasons. First, it concluded that requiring photocopies in all cases is not consistent with the risk-based approach for CIP. In its official disposition of comments to the notice, Treasury said that the decision to make photocopies should be at the discretion of the financial institution rather than an across-the- board requirement. Second, Treasury decided that specifying individual types of documents that cannot be relied upon to verify customer identities did not make sense from a regulatory perspective because the relative security and reliability of various identification documents that are available is constantly changing. The comments received in response to the Notice of Inquiry primarily related to encouraging Treasury to take an official position on whether the Mexican consular identification document, the Matricula Consular is a reliable document for verifying identification. Treasury concluded that because the relative security and reliability of identification documents are constantly changing, any list of unacceptable documents would quickly become outdated and may provide financial institutions with an unwarranted sense of security concerning documents that do not appear on such a list. Therefore, Treasury decided not to prescribe a specific list of documents that are acceptable or not acceptable in the regulation, but rather committed to providing financial institutions with information relating to the security and reliability of identification cards.

Developing Section 314 Regulations Required Balancing the Needs of Law Enforcement and Industry

When developing section 314 regulations, Treasury (through FinCEN) had to determine the extent to which financial institutions should share information about customers with law enforcement officials and with each other. Treasury adopted final regulations in September 2002. Figure 3 shows the key dates in the rulemaking process for section 314.

For section 314(a), FinCEN implemented a process in which law enforcement agencies provide information on potential suspects to FinCEN. FinCEN distributes these 314(a) information requests across the country to financial institutions that are required to search their accounts and transactions to identify any matches.

The process was temporarily suspended in November 2002, based on feedback from financial institutions that they were overwhelmed or confused by the process. Some institutions did not know what to do with the information requests, while others were not sure which accounts or transactions to search. Following consultations with law enforcement and the federal financial regulators to streamline the process, FinCEN resumed 314(a) information requests in February 2003. FinCEN and industry officials agreed that, since the moratorium, FinCEN has implemented a more streamlined process that has improved the clarity and efficiency of 314(a) information requests. Officials from FinCEN and law enforcement agencies have also established procedures to vet requests sent by law enforcement agencies to ensure that they are related to terrorist or significant money laundering activities. (See fig. 4.) Before putting a name on the information request list, FinCEN officials said that they follow up with the requesting law enforcement agent to obtain more information to determine whether the case merits the use of the 314(a) process and to verify that the agent will be available to respond to any financial institution that finds a match when the request goes out. FinCEN also sends each law enforcement requester a feedback form on the usefulness of the information obtained. For example, the feedback form asks if law enforcement officials served grand jury subpoenas based on the information obtained from the 314(a) process. In addition, law enforcement officials said that they have taken steps to caution agents against overusing the 314(a) process, and that the 314(a) process is not meant to replace the need for a subpoena or more rigorous investigation methods.

FinCEN sends out the 314(a) information request list every 2 weeks. The information requests include suspects related to terrorist cases and significant money laundering investigations. FinCEN tries to limit the number of subjects on the bi-weekly information request. The request contains as much identifying information as possible, such as dates of birth, social security numbers, and addresses as well as aliases so the number of records that are to be searched for can be extensive. Financial institutions have 2 weeks to respond. Urgent requests can also be distributed with shorter turnaround time when deemed necessary.

The rulemaking process for section 314(b) addressed the need to encourage information sharing among financial institutions while still protecting customers’ right to privacy and established a mechanism for financial institutions to satisfy the statutory notice requirement. Section 314(b) of the PATRIOT Act allows financial institutions, upon providing notice to Treasury, to share information regarding individuals, entities, and countries suspected of possible terrorist or money laundering activities. The final rule requires that to be protected by the safe harbor from liability for sharing information pursuant to section 314(b), financial institutions must comply with the procedures prescribed by the rule, including providing notice annually to FinCEN of their intent to share information with other institutions. The rule also requires that prior to sharing information, a financial institution must verify that the financial institution with which information will be shared has also filed a notice with FinCEN. FinCEN determines that the notice requirement sufficiently reminds financial institutions of their need to safeguard information that is obtained using section 314(b).

Treasury and the Federal Financial Regulators Have Reached Out to the Financial Industry to Assist It in Implementing CIP and Section 314 Rules, but Industry Concerns Remain

Treasury and the federal financial regulators have taken several steps to help the financial industry understand and comply with the CIP and 314 information sharing regulations; however, the need for agency coordination has slowed the issuance of additional guidance. Industry officials said that although the government’s guidance has been helpful, it does not completely address their questions and compliance concerns particularly related to the CIP rule. The implementation of the 314(a) information sharing process has highlighted the tension between law enforcement officials’ duty to protect sensitive information and the need for information from law enforcement to help industry monitor, identify, and report possible financial crimes, including terrorist financing and money laundering. Finally, industry officials said that they appreciate the safe harbor provided by 314(b), but some officials said distinguishing possible money laundering and terrorist activities from other types of financial crimes not covered by section 314(b), such as fraud, has been difficult.

Treasury and the Regulators Have Assisted Industry in Implementing CIP and Section 314 Requirements, but Interagency Coordination Has Slowed Issuance of Additional Guidance

Treasury and the federal financial regulators have sought to educate the financial community to help it understand the new requirements, but the need for interagency coordination has slowed regulators’ issuance of additional guidance. Regulators and SROs used established, formal channels (such as Web site postings and existing regulatory memorandums distribution channels) to distribute guidance to firms describing the regulations, clarifying when the regulations would become effective, and offering advice about implementation. Officials from the regulatory agencies and SROs also informed firms of the regulations and addressed practical issues during numerous industry-related conferences, conference calls, and training sessions. Moreover, agency officials said that during compliance exams conducted before and soon after the regulations became effective, examiners clarified particular aspects and helped firms establish compliant programs.

Treasury and the federal financial regulators have provided specific guidance related to the CIP rule and section 314 in the form of responses to “frequently asked questions” or “FAQs.” In August and October 2003, Treasury and SEC issued limited FAQ guidance related to mutual funds and broker-dealers, respectively. In January 2004, Treasury and the banking regulators jointly issued FAQ guidance that addressed several issues related to CIP. Among other topics, the answers clarified the definitions of a customer and an account in different situations and discussed how firms should apply the rules to existing customers. In July 2004, Treasury and CFTC issued FAQ guidance concerning CIP that was similar to the banking regulators’ guidance.

FinCEN issued FAQs for the 314 information sharing regulations in February 2003. These FAQs were initially posted on FinCEN’s public Web site but, according to FinCEN officials, they were removed due to law enforcement concerns that this guidance could give criminals an advantage. FinCEN officials said they have now posted these FAQs to its secure Web site that financial institutions access to obtain the 314(a) information requests and will send the FAQs to a financial institution upon request.

According to FinCEN, because of the joint nature of the CIP rules, all of the affected regulators and FinCEN must coordinate when issuing guidance to assure consistency in the implementation of the regulations. Such coordination has slowed the issuance of further guidance. Similar to the challenges they encountered in the rulemaking process, the financial regulators and FinCEN face continuing challenges in developing guidance that applies to diverse types of financial products and businesses. FinCEN and the federal financial regulators began developing a second series of CIP FAQs pertaining primarily to banks in early 2004. Some officials told us that this guidance has taken longer to finalize because of difficulties reaching agreements on which questions to address and how to answer them. FinCEN officials told us that although some of the officials had signed off on the draft FAQs, agreement was not reached among two of the regulators on one outstanding question until February 2005. FinCEN officials told us that, although these are questions pertaining to CIPs, some questions have broader policy implications for the affected agencies. FinCEN released the draft for internal approval by the financial regulators on March 25, 2005, and the final CIP FAQs were jointly issued by Treasury, FinCEN, and the banking regulators on April 28, 2005. Officials from CFTC and FinCEN told us that they hoped guidance in the form of an FAQ addressing the CIP issue related to customers of executing and carrying brokers would be released soon, but it has also taken some time to finalize the guidance. SEC officials told us that they have been waiting for the second set of banking FAQs and will then adapt the first and second set of CIP FAQs for securities firms.

The industry officials we spoke with largely agreed that the regulators have provided valuable information and services helping them to understand the regulations. Some officials lauded the time and effort regulators have taken to inform firms of the new regulations and answer difficult, practical questions.

Industry Officials Believe That More Guidance from FinCEN and Financial Regulators Would Help Address Some CIP Implementation Challenges

Industry officials we met with said that while regulators’ guidance has been helpful, it does not address all of their questions and concerns, thus making it difficult for them to know if they are in full compliance with the requirements. Industry officials said that although their institutions had customer identification procedures in place prior to the PATRIOT Act, they revised their forms, processes, and systems to meet the minimum CIP requirements. Many industry officials said that CIP regulations have challenged them to organize and document their identification procedures, create new forms and processes to notify customers of the new procedures, and reconfigure systems in order to store information required by the regulations for the specified period. Industry officials also said that implementing CIP has improved the consistency of customer identification procedures across different business lines in their own institutions and should improve consistency across the various financial sectors.

CIP FAQs that FinCEN and the federal financial regulators issued for bank, securities, and futures firms in 2003 and 2004 responded to several of the industry’s implementation concerns. For example, the FAQs for banks discussed two issues banks raised during the public comment period in the rulemaking process—(1) the extent to which banks should verify existing customers and (2) how banks may identify customers using nondocumentary sources of identification information. The one CIP FAQ for securities firms clarified when an intermediary will be deemed the customer for purposes of the CIP rule when opening a domestic omnibus securities account to execute transactions for the intermediary customers.

Despite the guidance, industry officials remain concerned about some challenges they raised during the comment period and have additional concerns. For example, industry officials said they are still uncertain how examiners determine that firms have taken appropriate steps to verify the identity of customers when the CIP regulations allow firms to take a risk- based approach and give them the flexibility to tailor their procedures for verifying customers’ identities according to their location, customers, and products. Industry officials believe that they and their examiners may reasonably disagree on the risks posed by certain customers and subsequently disagree about when to take extra steps to verify the identity of the customers. The officials expressed concern that examiners will sanction firms who differed with them, despite the fact that the firms followed what they believed were reasonable steps to determine the risk of the customers and subsequently took reasonable steps to verify their identity. For example, one industry representative told us that in a recent exam an examiner questioned the firm’s designation of high-risk countries-- the firm planned to take more stringent steps to verify the identity of customers depending on the risk ranking of high-risk countries. According to the industry official, the examiner thought that two of the countries on the risk matrix should have been placed in a higher risk category but did not provide a basis for believing that certain countries should be higher on the firm’s risk ranking.

Some industry officials also said that they were unsure how examiners expected them to verify the identity of institutions and people when reliable identification information is unavailable, such as for people from countries where sources of identification may not be reliable. CIP rules require that financial institutions collect a government identification number for corporations as well as individuals. Some industry officials said that a foreign government identification number for institutions or corporations can be very difficult to verify and therefore the collection of the identification number is virtually worthless. Also, one of the documentary methods for verifying the identity of a corporation is to obtain the articles of incorporation, but these documents can also be difficult to use to verify identities for foreign entities. Some securities industry officials told us that foreign incorporation documents are difficult to obtain and sometimes impossible because the country does not make this information available to the public. Similarly, officials from mutual fund firms expressed uncertainty concerning how examiners will assess their practices for verifying the identity of some customers processed online or over the telephone. The officials explained that they often use credit reports and other nondocumentary sources to verify these types of customers, and such sources are not always available for some customers, such as young customers or some senior customers.

Additionally, some industry officials expressed uncertainty about the reliance provision of the CIP rule. Specifically, industry officials said that they did not know the scope of a reasonable reliance agreement and which firm is liable for mistakes. Even after regulators issued guidance on the reliance provision in the first series of CIP FAQs, some industry officials said that they remain uncertain about the scope of reasonable reliance agreements in some instances. Industry officials in the futures industry told us that they hope that the federal government will provide guidance on how the CIP requirement affects the relationship between executing brokers and carrying brokers in “give up” relationships. CFTC and NFA officials said that the regulations suggest that for an executing broker to invoke the reliance provision in give-up transactions, carrying brokers must certify that they have verified the identity of each customer whose trades are given up to the carrying broker, thus requiring numerous verifications, which could overwhelm the daily operations of the firms with CIP requirements. In February and March 2005, CFTC and FinCEN officials told us that they were working to issue additional guidance concerning these give-up relationships and they hoped it would be issued shortly. In addition, some industry officials said that they avoid relying on other firms because they did not know how examiners would determine which firm will be responsible for mistakes. During the rulemaking process, officials from the securities sector expressed this same concern. Some industry officials told us that examiners did not fully understand the reliance provision. The securities industry officials told us that the reliance provision was meant to ensure that the CIP requirement did not result in duplicative efforts. Because of these concerns, some firms may not take advantage of the provision.

Industry Officials Faced Some Implementation Challenges and Question Whether the 314(a) Information Sharing Process Improves Communication with Law Enforcement

The implementation of the 314(a) information sharing process has created some practical challenges and highlighted the tension between law enforcement officials’ duty to protect sensitive information and industry’s need for information useful in identifying and reporting financial crimes, including terrorist financing and money laundering. One challenge industry officials said they faced was their inability to simultaneously search the multiple customer databases they are required to search, which forces them to search numerous databases individually. Some industry officials told us that they have dedicated significant staff hours to conduct the searches, developed search programs specifically for 314(a) information requests, and hired third-party vendors to conduct the searches.

Despite the attempts to lessen the burden of the 314(a) process, some industry officials said that they have been disappointed with how federal law enforcement agencies appear to be using the process. Industry officials said that they expected law enforcement officials to request information only for select, serious threats and primarily terrorist-related activities; however, they questioned the significance of some of the information requests they have received because requesting law enforcement agents have not followed up matches by sending subpoena requests or returning telephone calls concerning the matches. FinCEN and law enforcement agency officials responded that they continue to refine the process for vetting requests and preventing agents from overburdening financial institutions with unnecessary requests.

Also, some industry officials asked why law enforcement officials could not provide more information about cases involving their institutions, how to treat particular suspicious customers, and profiles of terrorists and other criminals. The industry officials said that such information would help them to recognize and report a potential criminal or terrorist and enable them to update their criteria for assessing the risk of individual customers, thus strengthening due diligence systems and improving their contributions to law enforcement officials’ anti-money laundering and anti-terrorism efforts. Law enforcement and FinCEN officials said that although they greatly appreciate the information provided by firms via the 314(a) process, providing feedback to firms on particular cases can be a challenge, particularly when cases involve sensitive information. In August 2004, the FBI created a list of terrorist financing indicators to assist financial institutions in identifying and reporting suspicious activity that may relate to terrorism. FinCEN forwarded this information to financial institutions through the 314(a) distribution channels. Consistent with the statements of the law enforcement officials we spoke with, the 9-11 Commission praised the benefits of the section 314(a) information sharing process, but also expressed concerns about the extent to which law enforcement should share sensitive law enforcement or intelligence information. The 9-11 Commission noted that providing financial institutions with information concerning ongoing investigations opens up the possibility that the institutions may leak sensitive information, compromise investigations, or violate the privacy rights of suspects.

In response to the industry’s request for more information concerning the value of the 314(a) process, FinCEN periodically publishes 314(a) fact sheets. These fact sheets provide industry with summary data on 314(a) requests over a specific time period, including the law enforcement agencies making requests and the number of search warrants, grand jury subpoenas, and indictments attributable to information firms provide through the 314(a) process. Regulators, industry officials, and law enforcement officials also jointly publish semiannual Suspicious Activity Report (SAR) Activity Reviews, which provide information on trends and patterns in financial crimes and how industry’s contributions through reporting suspicious activity and responding to 314(a) requests have helped investigations. Furthermore, as stated in its Fiscal Year 2006-2008 Strategic Plan, released in February 2005, FinCEN plans to seek faster and more efficient technical channels for dialog between government and the financial industry. For example, FinCEN officials told us that they hope to use FinCEN’s new secure information sharing system to provide financial institutions additional feedback information.

Industry Officials Expressed Some Confusion about Types of Suspicious Activity That Can Be Shared under Section 314(b)

Although industry officials said section 314(b) is a helpful tool and has enabled them to share information in a new way, some officials said it is not always easy to determine if the suspicious activity is money laundering or terrorist activity or other financial crimes. As noted earlier, section 314(b) of the PATRIOT Act provides a safe harbor for financial institutions to protect them from liability for sharing information only if it relates to individuals, entities, organizations, and countries suspected of possible terrorist or money laundering activities. Some industry officials stated that sometimes it is difficult to distinguish fraudulent activity from possible money laundering, thus making it hard to determine if a firm can share information about that activity with other firms participating in the 314(b) network. As a consequence, some financial institutions may be reluctant to use the 314(b) process.

On the positive side, industry officials who had used the process said that the 314(b) provision has allowed firms to share useful information regarding potential money laundering or terrorist activities with other institutions that they previously had little or no interaction with. The officials said that such sharing has helped them efficiently collect otherwise unattainable information about customers, enabling their firms to practice better due diligence. Furthermore, some officials from the banking industry said the 314(b) safe harbor provision has encouraged them to give and receive information that uncovers diverse criminal activities because money laundering is a predicate to a wide variety of crimes.

Financial Regulators and SROs Have Updated Examination Guidance and Trained Examiners to Evaluate Compliance with CIP and Section 314

Since February 1 and October 1, 2003—when financial institutions were to be in compliance with regulations for sections 314 and CIP of the PATRIOT Act, respectively—banking, securities, and futures regulators and SROs issued examination guidance and trained examiners to assess firms for compliance with both provisions. The five banking regulators jointly issued guidance for CIP and section 314. The SEC and the securities SROs we reviewed issued final guidance for both provisions individually, and the futures SROs we reviewed issued final guidance jointly in February 2004 through the Joint Audit Committee—a consortium of futures exchanges. NFA updated and issued its guidance by October 2003 for both provisions. All federal financial regulators and SROs continue to update staff on changes to examination procedures and have trained examiners to assess firms for compliance with CIP and section 314.

All Financial Regulators and SROs Have Issued Final Guidance and Procedures for CIP and Section 314 and Used a Variety of Methods to Communicate Changes to Their Staff

The banking regulators jointly issued guidance and procedures for section 314 on October 20, 2003, and for CIP on July 28, 2004. Although banking regulators did not issue final examination guidance for CIPs until several months after the regulations took effect, examiners were assessing firms’ CIPs using draft or interim guidance beginning in October 2003. SEC issued final guidance and procedures for broker-dealers in September 2003 and April 2002 for mutual funds. SEC’s guidance for mutual fund examination does not address examination for compliance with section 314(a) requests to mutual funds. SEC officials told us that FinCEN is currently not including mutual funds in the 314(a) process. Also, SEC officials said that because mutual fund shares are typically purchased through a principal underwriter, which is a registered broker-dealer, most mutual fund accounts would likely be covered by broker-dealers who receive 314(a) information requests.

Development of examination guidance for all of the federal financial regulators and the SROs continues to evolve as events change the requirements financial institutions must adhere to in order to maintain sound anti-money laundering programs. FinCEN is working to provide support to regulators that have been delegated compliance examination responsibilities for financial institutions and has become more involved in helping regulators develop examination guidance and best practices. For example, federal banking regulators, working on an interagency basis through the Federal Financial Institutions Examination Council (FFIEC) and with FinCEN, have drafted joint examination guidance that was being field tested as of March 2005. The targeted issue date for this guidance is June 30, 2005. Banking agency officials told us that this is the first time they have developed joint anti-money laundering guidance and procedures and that they are more comprehensive than any they have issued in the past. As part of this effort, the banking regulators plan to distribute the new examination manual to examiners on a CD that will also include the most current anti-money laundering examination guidance and procedures. SEC officials told us that they also plan to revise the examination guidance and procedures for broker-dealers and mutual funds based on lessons learned from examinations conducted last year. FinCEN officials told us they intend to also work jointly with SEC and CFTC to coordinate efforts among securities and futures regulators and work together on new or revised guidance and procedures. However, FinCEN officials told us that they have not been involved with SEC and CFTC in developing examination guidance to date and they are still in the process of establishing MOUs with the two regulators.

All of the SROs in our review issued final examination guidance and procedures for the CIP rule and section 314 of the PATRIOT Act. The securities SROs issued final examination guidance for both provisions by October 2003. However, NASD and NYSE began examining firms for compliance with section 314 as early as October 2002 and January 2003, respectively. The futures exchanges jointly issued final guidance for both provisions in February 2004 through a consortium of futures exchanges called the Joint Audit Committee. The CFTC, which performs regulatory oversight of the Joint Audit Committee, conducts an annual review of all Joint Audit Committee programs. The anti-money laundering program used by the Joint Audit Committee is among the programs reviewed annually by the CFTC. CME and CBOT had begun assessing firms for account verification, which closely resembles the CIP requirement, by May 2002. NFA updated its guidance to reflect the CIP requirement in October 2003 and April 2003 for section 314 and immediately began assessing firms for compliance with both provisions. NFA officials said they expect to issue revised examination guidance in 2005 for section 326 to address whether, and under what circumstances, an executing broker in a give-up transaction is required to apply its CIP to the give-up customer.

The federal financial regulators and the SROs included in our review told us they have updated staff about changes to examination guidance and procedures using a variety of techniques including teleconferences, monthly or biannual staff meetings, interagency bulletins, email notifications, and training sessions. For example, banking and securities regulators including the Federal Reserve, OCC, FDIC, SEC, and NASD use teleconferences that are broadcast to headquarters and district offices to update staff on changes to examination guidance, post updates on the organization’s Intranet, or use biannual and monthly staff meetings. CFTC and the futures SROs including, CBOT, CME, and NFA update staff through monthly staff meetings and email. NCUA and NYSE send emails to staff that outline or highlight major changes to examination guidance. The banking regulators also issue agencywide regulatory bulletins and letters to update examiners.

Financial Regulators and SROs Updated Their Training Program and Have Begun to Train Examiners to Evaluate Financial Institutions for Compliance with the CIP Requirement and Section 314

All federal financial regulators and SROs in our review updated their anti- money laundering training to include CIP and section 314. The federal financial regulators and SROs began including CIP and section 314 in training for anti-money laundering examination staff between January 2002 and June 2003. Banking and securities regulators use formal training courses that are both instructor-led and computer-based and industry experts to train staff administering anti-money laundering examinations. Banking regulators also send examiners to training offered by FFIEC. Training at most futures SROs we interviewed is more informal and occurs mostly on the job due to the relatively small examination staffs at these organizations. However, NFA and CFTC offer instructor-led training.

Banking Regulators Use Formal Training Courses and FFIEC to Provide Staff Training

All of the federal banking regulators provide instructor-led courses in anti- money laundering and Web-based training. This training introduces BSA and PATRIOT Act requirements and includes standard presentations and theoretical as well as hands-on training. Their anti-money laundering training curriculum includes instruction in various examination techniques designed to help examiners recognize potential money laundering risks confronting financial institutions and to learn procedures for assessing the soundness of an institution’s anti-money laundering program. The federal banking regulators also send staff to conferences sponsored by trade associations that offer multiday focused courses and provide informal resources for self-training such as subscriptions to online newsletters.

However, each banking regulator approaches training differently. For example, OTS and NCUA require all new staff to attend a basic training course in anti-money laundering. According to OTS officials, regional conference training, which is attended primarily by examiners, is an important part of bringing examiners up to speed on anti-money laundering examination procedures. NCUA also uses regional conferences to train large numbers of its examination staff. For example, in 2002, NCUA used regional conferences to provide training on sections 314 and 326 of the PATRIOT Act to all examination staff.

FDIC and the Federal Reserve both have examiners that are anti-money laundering specialists who serve as a training resource to other examiners. Both agencies train examiners who are primarily responsible for conducting anti-money laundering examinations. At the Federal Reserve, anti-money laundering examination specialists interact on a daily basis with examination staff engaged in anti-money laundering examinations to offer case-specific guidance regarding the requirements. The Federal Reserve also provides on-site examiner training at the individual Reserve Banks, which emphasizes requirements under section 314 and 326 of the PATRIOT Act as warranted. Similar to the Federal Reserve, FDIC uses staff experienced in conducting anti-money laundering examinations as a resource for examiners. Currently, FDIC has 321 anti-money laundering specialists who serve as a resource and as trainers for other examiners. However, FDIC recently trained every examiner on staff, approximately 1,721 as of 2004, in anti-money laundering requirements. In addition, many of its supervisory and legal professionals are pursuing anti-money laundering specialist certifications. OCC has four different training schools, which all provide live, instructor-led training in anti-money laundering requirements. Finally, in an effort to build up staff with anti-money laundering expertise, OCC has a formal on-the-job training program for anti-money laundering and finances certifications in anti-money laundering examination for some of its examiners.

Banking regulators also send examiners to FFIEC’s interagency anti-money laundering training workshops. We were able to attend one of these workshops and observed that the course covered the CIP requirement and section 314, in addition to other anti-money laundering requirements. The course included lectures by experienced examiners, presentations by FBI and Internal Revenue Service officials, reading materials, and case study exercises. Many of the case study exercises demonstrated how to identify suspicious transactions and how transaction testing could reveal weaknesses in a financial institution’s anti-money laundering program. Table 1 provides additional information about training at each of the banking regulators.

Similar to the banking regulators, the securities regulators and SROs also provide formal classroom instruction in anti-money laundering review and some Web-based training, but their approaches differ. SEC provides training to more seasoned staff in anti-money laundering while anti-money laundering training is available to all staff at the securities SROs. However, SEC and NASD are beginning to tailor training in anti-money laundering review for newer staff. For example, beginning in 2005, SEC’s training for new examiners will include an anti-money laundering workshop. According to SEC, this effort responds to the increasing importance of anti- money laundering issues and serves to alert less experienced examiners to SEC’s new coordination efforts with FinCEN. Similarly, NASD has recently enhanced its new examiner training program through the implementation of a formal classroom training program. As part of this 6-week course, participants will go through 2 full days of training devoted to anti-money laundering requirements, including the CIP requirement and section 314 of the PATRIOT Act. NYSE provides training using a combination of internal and industry experts. Its training program includes several sessions on anti- money laundering and is administered by both internal employees who have an extensive knowledge of the area and outside experts from law and accounting firms.

Securities regulators also coordinate with each other to provide joint training for their examiners. In February 2005, SEC, NASD, and NYSE prepared a 2-day training session devoted to anti-money laundering requirements. This training included presentations from FBI, FinCEN, industry experts, and officials from each of the three securities regulators. The SROs also work together to provide training about timely and relevant examination and compliance topics. According to NASD and NYSE officials we interviewed, the SROs periodically prepare joint training sessions, which cover topics such as anti-money laundering requirements. Table 2 provides additional information about training at SEC and the securities SROs.

Futures SRO officials at CBOT and CME told us that anti-money laundering training was conducted primarily on the job because these organizations have relatively small examination staffs. According to officials at these organizations, more seasoned, senior staff is responsible for training new staff on how to conduct anti-money laundering reviews. NFA also provides on-the-job training; however, all examiners are required to attend formal training in anti-money laundering such as instructor-led training sessions and technical roundtables on various anti-money laundering issues. In June and July 2004, the NFA’s compliance department conducted two technical roundtables, which focused primarily on CIP requirements. In addition to in-house training, NFA also hosts outside agencies, such as FinCEN, to make presentations on relevant and timely issued related to anti-money laundering requirements. NFA invites other futures SROs including CME and CBOT to most of their training sessions. According to officials at all of the futures SROs, on-the-job and formal, classroom training for examination staff on the CIP requirement and section 314 started as early as May 2002. The CFTC also provides in-house training opportunities for its entire staff, which includes examiners who conduct oversight examinations of SROs. The training covers all aspects of the anti-money laundering regulatory requirements applicable to futures firms.

Examinations and Enforcement Actions Highlight Progress and Difficulties in Overseeing Compliance with the CIP Requirement and Section 314

The federal financial regulators and SROs responsible for examining financial institutions’ compliance with anti-money laundering laws and regulations have conducted examinations that cover compliance with, and have taken enforcement actions concerning, violations of both the CIP requirement and section 314 and its corresponding regulations, but coverage of these requirements varied in the examinations we reviewed. Most of the examinations in our sample assessed whether financial institutions had developed CIPs and procedures for complying with the regulations implementing section 314(a), but specific aspects of the procedures reviewed were not always documented. Some examinations highlighted the difficulties examiners and financial institutions have encountered in understanding CIP requirements. Compliance with section 314(b) and the implementing regulations was not routinely assessed in part because information sharing under 314(b) is voluntary. The regulators and SROs used informal actions to address the deficiencies or apparent violations identified in the examinations in our sample. Since the regulations became effective, some of the regulators have also taken formal enforcement actions that include violations of the CIP requirement and the regulations adopted under section 314(a). Finally, in conducting our work for this objective, we encountered difficulties in obtaining the information on examinations and violations from two of the regulators that revealed weaknesses in their processes for tracking anti-money laundering compliance.

Most Examinations in Our Sample Reviewed CIP, but Coverage of Certain Aspects Varied

As shown in table 3, about 95 percent of the examinations in our sample (168 of 176) documented some type of review of financial institutions’ CIP procedures. However, coverage varied when we looked for (1) evidence that the examiner reviewed CIP and (2) documentation of specific aspects of the examiners’ reviews, such as reviewing the financial institution’s methods of verifying customers’ identities or testing the CIP procedures. When we reviewed the examinations for coverage of the CIP requirement, we specifically looked for documentation that the examiner assessed whether (1) the financial institution had developed a CIP and written procedures for CIP; (2) the CIP procedures included collecting appropriate customer information including the minimum requirements, such as date of birth for individuals; (3) the CIP procedures included verifying customer information using documentary or nondocumentary methods; (4) the financial institution was using risk-based procedures for verification, such as determining how much information to verify depending on its assessment of the risk of the customer or type of account or collecting additional information; and (5) the CIP had been adequately implemented by testing a sample of accounts.

Generally, we saw documentation showing that examiners reviewed the financial institution’s written CIP procedures. Most examinations in our sample had evidence that the review included assessing written procedures for CIP (157 of 176 or 89 percent), and the procedures included appropriate customer identification information (144 of 176 or 82 percent) and methods of verification (143 of 176 or 81 percent). Fewer examinations— approximately 56 percent (99 of 176)—assessed whether the financial institution was using a risk-based approach. Our review leads us to believe that the risk-based aspect of CIP is an area that could be difficult for both financial institutions and examiners to interpret consistently, because determining the level of risk of a customer or account can be difficult and depends on several factors, such as the customer’s line of business, the process used to open the account, and whether the customer is in the United States or overseas.

Because it can be difficult to determine the customer’s risk level, it is not surprising that some examiners would focus on reviewing the minimum requirements, such as the requirements to collect minimum information on customers. OCC officials told us that they developed some internal guidance to assist OCC examiners in understanding the risk-based aspect of CIP early in 2004 because some examiners were confused about it. This guidance explained that limited identification and verification procedures may be appropriate for local residents and businesses, but enhanced procedures may be needed for nonlocal customers, non face-to-face customers (such as customers who conduct transactions by mail, telephone, and Internet), and high-risk accounts (such as private investment corporations, offshore trusts, and foreign customers). The guidance also provided examples of types of enhanced verification procedures, such as customer callbacks, credit verification, and on-site visits that could be used to verify the identity of higher-risk customers. Finally, the guidance stated that for most banks a single set of procedures for verifying the identity of customers would not be adequate. FDIC had also incorporated some examples in examination guidance updated in December 2004 that included examples of how CIP procedures may differ depending on the risk of the customer or type of account. One example in FDIC’s guidance explained when a bank may want to obtain more information on a business or company. The guidance said that although obtaining information on signatories, beneficiaries, principals, and guarantors is not a minimum requirement for CIPs, in the case of opening an account for a relatively new or unknown firm, it would be in the bank’s interest to obtain and verify a greater volume of information on signatories and other individuals with control or authority over the firm’s account. It is important that examiners determine whether financial institutions have developed risk-based procedures in addition to developing procedures that meet the minimum requirements, because (1) the regulations require that financial institutions develop risk-based procedures and (2) the risk-based procedures allow for more rigorous verification procedures on those types of customers thought to be more at risk of engaging in money laundering or terrorist activities.

The results of our review of examinations showed considerable variation when we looked for documentation showing whether the examiner tested CIP procedures. We found that only about 43 percent (75 out of 176) examinations tested procedures, in part because our review looked at examinations during the early implementation phase and the examination guidance issued by some regulators does not require that they test procedures. Federal Reserve and FDIC officials said that during the early phase of implementation examiners may have focused on reviewing the procedures with the intent of testing procedures in the next examination cycle. SEC officials said that since many of their broker-dealer examinations that we reviewed were oversight examinations of examinations conducted by NASD or NYSE, SEC examiners would not always conduct testing. Officials from NASD and NYSE told us that some of the smaller broker-dealers may not have opened any new accounts between October 1, 2003, and the time of the examination and, therefore, the examiner would not have tested accounts. NYSE officials also said that CIP was not reviewed in one examination in our sample because the examiner determined that the firm did not have any customers and did not interact with the public.

The regulators and SROs varied in their examiner guidance for testing procedures. The banking regulators use a risk-based approach to their examinations that determines what procedures are performed. Under this risk-based approach to examinations, the examiners first determine whether the financial institution has a strong compliance program and a history of compliance and then tailors the examination procedures based on this risk assessment and review of past examinations. For example, Federal Reserve officials explained that an examiner’s review of the independent testing of an institution’s anti-money laundering procedures may reduce the need for the examiner to also test certain procedures. When the banking regulators issued their joint examination guidance and procedures for CIP in July 2004, the guidance directed examiners to determine whether and to what extent to test CIP procedures based on a risk assessment, prior examination reports, and a review of the bank’s audit findings. Although the SEC examination procedures for broker-dealers that we reviewed did not include procedures for testing, an SEC official told us that the initial request letters sent to institutions include a request for customer account information so that examiners can test those accounts for CIP compliance. SEC’s procedures that we reviewed for mutual funds included procedures for sampling accounts and testing CIP procedures for examinations of funds’ transfer agents that maintain customer account information. NASD and NYSE have instructions that include sampling accounts to determine whether the financial institution’s CIP procedures are being implemented properly. The examination procedures used by NFA and the futures exchanges also include procedures to test the CIP procedures against a sample of high-risk accounts.

We also looked to see if examiners conducted any testing of high-risk accounts because the results of such testing would provide a clearer indicator of whether the financial institution was exercising more due diligence on riskier accounts. We saw evidence that examiners tested a sample of high-risk accounts for CIP compliance in 8 of 176 of the examinations. Several regulatory officials told us that the institutions in our sample may not have had high-risk accounts. For example, many of the NFA examinations included documentation saying that the institution did not have any high-risk accounts and therefore a sample of such accounts were not tested. Also, NCUA and OTS officials said that the probability that the institutions they regulate would have high-risk accounts was small.

Although most of the examinations had documentation that the examiner had reviewed CIP, the documentation, such as the examination report or a summary written by an examiner, did not always specify how the review was conducted. Therefore, some of the variation in the results from our examination review may also be due to differences in the way examiners document their work. We observed a variety of methods for documenting examination procedures that were conducted and examination results. Some of the federal financial regulators and SROs used a system of recording the completion of examination procedures, such as a questionnaire or worksheet, which generally made it easy to follow what the examiner had done but did not always include the same aspects that we were reviewing. For example, NCUA examiners document their examinations using a questionnaire. However, this questionnaire does not ask the examiner to document whether he or she tested CIP procedures. In the one instance in which we saw documentation of testing by NCUA, the NCUA examiner had documented a deficiency in the credit union’s CIP procedures based on looking at a sample of accounts. An FDIC official told us that examiners may not document that they tested procedures unless it showed a deficiency. Some examiners documented their review by making notes on copies of the financial institution’s procedures. Finally, some examinations, such as a few of the examinations conducted by the Federal Reserve and OCC, used memorandums that discussed the findings of the examination. However, the memorandums may not have specified all of the aspects of CIP that were reviewed. In addition, OCC officials told us that OCC does not require examiners to document every procedure that they complete or what they do not do in an examination.

The Results of Our Examination Review Highlighted Some Difficulties in Understanding CIP Requirements

Our review of some of the examinations in the sample revealed that examiners and financial institutions may not always understand the requirements for CIP or interpret them in the same way. The aspects of CIP that raised questions about whether examiners or financial institutions understand them are (1) the differences between CIP and know-your- customer procedures; (2) the differences between the requirements to check government lists for CIP versus other government lists such as OFAC; and (3) the extent to which a financial institution performs CIP procedures for existing customers. Some confusion or lack of understanding is to be expected during the early phases of implementing new requirements. However, these differences in understanding have resulted in inconsistencies in the examination process and may have created further confusion and misunderstandings.

CIP and Other Procedures That Require Customer Identification

A potential challenge to assessing compliance with CIP are the similarities among CIP requirements and other procedures that require customer identification for anti-money laundering purposes, including what has been called “know-your-customer” or “customer due diligence” (CDD) procedures. Also, although not an issue in the examinations we reviewed, section 312 of the PATRIOT Act adds another customer due diligence requirement and could lead to misunderstandings about appropriate due diligence. Section 312 requires appropriate, specific and, where necessary, enhanced, due diligence for correspondent accounts and private banking accounts established in the United States for non-U.S. persons. FinCEN adopted an interim final rule for section 312 on July 23, 2002. In the interim rule, FinCEN noted that the requirements of this provision placed on financial institutions are significant and therefore, additional time was necessary to consider what is appropriate for the final rule.

As shown in table 4, CIP, know-your-customer procedures, and section 312 have some similarities. All three require some level of collecting customer identification information and taking steps to verify that information and the risk-based aspect of CIP could overlap or duplicate know-your- customer procedures and section 312 requirements. However, know-your- customer procedures typically require more information than CIP. According to the 1997 BSA examination manual issued by the Federal Reserve, a know-your-customer policy begins with obtaining identification information and taking steps to verify information—similar procedures to CIP. However, know-your-customer procedures also include obtaining information on the source of funds used to open an account and determining whether to obtain information on beneficial owners of certain types of accounts such as trusts. One goal of know-your-customer procedures is to collect sufficient information so that the financial institution knows what to expect in terms of customer account activity so that it can adequately monitor for unusual or suspicious activities.

In 6 examinations in our sample of 176, we found evidence that examiners were confusing know-your-customer procedures with CIP. For example, in 1 examination, the examiner documented a review of CIP but the documentation included a copy of the financial institution’s know-your- customer procedures that had been in place since 1997 and had not been updated to include the minimum identification standards and other CIP requirements, such as recordkeeping procedures. As a consequence, this institution may be doing less than what CIP requires. In another examination, the examiner reviewed the institution’s know-your-customer procedures, which included the minimum CIP requirements but also directed employees to do more due diligence than CIP may require depending on a risk assessment of the account and customer. As a consequence the examiner and institution may believe that compliance with CIP requires more procedures than necessary. Draft examination guidance that the banking regulators intend to issue in June 2005 may improve understanding of the difference. The draft guidance explains that customer due diligence begins with customer identification and verification but also involves collecting information in order to evaluate the purpose of the account to be able to detect, monitor, and report suspicious activity. One regulatory official told us that the banking regulators now refer to know-your–customer procedures as “customer due diligence.”

CIP Requirements for Checking Government Lists

In 7 examinations, we found that the examiner confused the CIP requirement to check government lists of suspected terrorists with another government requirement to freeze assets and block transactions of designated persons and entities. Treasury’s Office of Foreign Assets Control (OFAC) requires financial institutions to freeze assets or block transactions of people and entities on the List of Specially Designated and Blocked Persons. Therefore, financial institutions check customers against this list to ensure that they are in compliance. In these 7 examinations, the examiners noted that the financial institution was not compliant with the CIP requirement to check government lists because the institution was not checking customers against the OFAC list. However, as FinCEN and the banking regulators noted in the first set of CIP FAQs, lists published by OFAC whose independent requirements stem from statutes other than the PATRIOT Act and are not limited to terrorism, have not been designated for purposes of the CIP rule.

Applying CIP to Existing Customers

Two examinations documented disputes or confusion about the extent to which financial institutions should apply the CIP requirement to existing customers who open new accounts. In one examination, the examiner cited a CIP deficiency because the institution had not updated the address information for all of its existing customers. However, the CIP rule only applies when an existing customer is opening a new account and the CIP rule does not expect institutions to update records on existing customers if it has a reasonable belief that it knows the true identity of its customers. As stated in FAQs for the CIP rule issued by FinCEN and the banking regulators, a bank can demonstrate it has a reasonable belief that it knows its customers’ true identities if it had comparable procedures in place prior to October 1, 2003, or provide documentation showing that it has had a long-standing relationship with a particular customer. In the other examination, the institution and the examiners were familiar with the CIP requirements but differed in interpreting the extent to which an institution can develop a policy that exempts existing customers who open new accounts. The institution disputed the examiners’ finding that it was not in compliance with CIP because it had assumed it knew the identity of all of its customers who had opened accounts prior to January 2000. The institution argued that it had procedures in place prior to 2000 that were similar to CIP procedures and therefore did not have to apply the CIP requirement to existing customers who open new accounts.

Most Examinations in Our Sample Covered Section 314(a), While about Half Covered Section 314(b) in Part Because It Is Voluntary

As shown in table 5, most of the examinations in our sample—about 76 percent—included a review of compliance with section 314(a), but documentation of specific aspects of section 314(a) were somewhat less. We found documentation in 58 percent (91 of 157) of the examinations in which the examiner determined that the financial institution was receiving 314(a) information requests from FinCEN. We also looked for evidence of whether the examiner tested the 314(a) procedures and found documentation of testing for about 16 percent (25 of 157) of the examinations.

Although many of the examinations had documentation that the examiner had reviewed section 314(a), the documentation, such as the examination report or a summary written by an examiner, did not always provide enough specificity for us to determine if the examiner had verified that the financial institution was receiving the requests or tested the procedures. Also, in some cases, the examination procedures did not require that examiners test 314(a) procedures. Neither NFA nor the exchanges require in their examination guidance that examiners test the 314(a) procedures to check if all of the required types of records are searched, but they do require that the examiner determine if the financial institution responded within 2 weeks if it had a customer account that matched a subject on the 314(a) request. An SEC official told us that it would be difficult to test the 314(a) procedures in many cases because many financial institutions destroy the 314(a) information requests after they have searched their accounts. The examination procedures for section 314(a) issued by the banking regulators are also conducted under a risk-based approach. Under the risk-based approach, examiners may determine the need to select a sample of positive matches or recent 314(a) requests to test the procedures.

The samples for SEC and NFA are smaller in our review of section 314(a) because certain types of financial institutions do not typically receive the 314(a) information requests from FinCEN. According to SEC and FinCEN officials, under the 314(a) process, information requests are generally sent out to banks, credit unions, broker-dealers, and futures commission merchants because these types of financial institutions have an established infrastructure for capturing point of contact information. Also, SEC officials told us that because mutual fund shares are typically purchased through a principal underwriter, which is a registered broker-dealer, most mutual fund accounts would likely be covered by broker-dealers who receive 314(a) information requests. Therefore, SEC does not examine mutual funds for compliance with section 314(a) at this time. SEC officials said that because many of the examinations of broker-dealers in our sample were oversight examinations of NASD and NYSE, some examinations would not necessarily review all aspects of a financial institution’s anti- money laundering program.

The number of examinations in our sample of NFA examinations that covered section 314(a) is fewer than for CIP because most of the examinations included in our NFA sample were examinations of introducing brokers. NFA officials explained that introducing brokers do not typically receive 314(a) requests because under industry regulation every customer of an introducing broker must also be a customer of a futures commission merchant. Therefore, if introducing brokers were required to conduct 314(a) searches, they would be searching the same universe of customers covered by the 314(a) requests sent to futures commission merchants. Also, two of the NFA examinations of futures commission merchants did not cover section 314(a) because (1) NYSE and NASD had recently examined one of the firms and had covered it and (2) NFA limited the scope of the examination of the other firm based on prior NFA examinations that found the procedures were adequate. The two CBOT examinations did not cover section 314(a) because the examinations we reviewed were conducted prior to the issuance of the futures exchanges’ revised examination guidance and procedures in February 2004 that were updated to include section 314(a).

Some of the OCC and NYSE examinations also did not cover a review of section 314 procedures because our review occurred during the early implementation phase and their examination approaches were still evolving. According to OCC officials, OCC examinations in our sample did not always cover section 314(a) procedures because during this time period OCC was in the process of implementing its approach to reviewing the PATRIOT Act provisions. In February 2004, OCC issued guidance to its examiners to identify those banks with a high risk money laundering profile with the intent of giving those institutions a higher priority in the examination cycle for covering the PATRIOT Act provisions. Because OCC examiners were just beginning to review the PATRIOT Act provisions during the time of our review, some examinations may have not covered all aspects of the PATRIOT Act. OCC officials also said that some examiners may have focused on CIP because CIP procedures are more complex. OCC officials said that compliance with section 314 and the CIP requirement would be examined in all large banks by March 2005 and in all small and mid-sized banks by end of 2006. NYSE examinations did not always cover section 314(a) procedures, in part, because NYSE examination procedures were not clear about how examiners should review section 314(a) procedures. Initially, NYSE had included an examination procedure covering section 314(a) within its examination objective covering the firm’s anti-money laundering program. NYSE officials created a separate examination objective for section 314(a) while we were conducting our review and told us that the revised questions and procedures were incorporated into the anti-money laundering examination module in December 2004.

As shown in table 6, about 55 percent of the examinations in our sample covered section 314(b). The sharing of information with other financial institutions pursuant to section 314(b) is voluntary. As a consequence, some examiners may have chosen not to examine for compliance with section 314(b) regulations and some federal financial regulators and SROs did not develop examination procedures for determining compliance with section 314(b) regulations. SEC did not include section 314(b) in its examination procedures for mutual funds because it is voluntary. The futures SROs—NFA, CME, and CBOT—also did not include procedures for examining compliance with section 314(b) regulations. An NFA official told us that they did not review 314(b) because it is voluntary. Most of the regulators and SROs that examined section 314(b) procedures emphasized in their guidance that the provision is voluntary and financial institutions can choose not to share customer information with other financial institutions or share customer information without the benefit of the safe harbor. However, financial institutions may choose to share information without providing notice to FinCEN and be at risk of violating privacy laws. An NYSE official told us that they assess compliance with section 314(b) regulations to ensure that the financial institution will not violate privacy laws. The procedures issued jointly by the federal banking regulators state that the failure to follow the section 314(b) procedures is not a violation of section 314(b) but could lead to a violation of privacy laws or other laws and regulations.

Federal Financial Regulators and SROs Generally Used Informal Actions to Address CIP and Section 314(a) Deficiencies and Violations

Because the regulations were new and many deficiencies and violations were technical mistakes, the federal financial regulators and SROs mostly took informal actions to address deficiencies and apparent violations associated with section 314 and CIP. In our sample of 176 examinations, 32 examinations reported deficiencies or apparent violations related to section 314(a) and 79 examinations reported deficiencies or apparent violations relating to CIP requirements.

The federal financial regulators and SROs used different terms to classify problems associated with section 314 and CIP and other elements of institutions’ anti-money laundering programs. For example, some regulators would generally identify section 314 or CIP problems as “violations” or “apparent violations,” while some of the banking regulators would use the term “deficiency” in some cases and “violation” in other cases. Officials from one of the banking regulators told us that they are in the process of developing guidance on the matter. To allow for comparison and aggregation across the different regulators and SROs, we examined problems identified as both violations and deficiencies for our analysis. The varying terminology has an impact on the banking regulators’ reporting systems, since some regulators track apparent violations but do not track deficiencies. This issue will be examined in more depth in other work we are conducting on the banking regulators and BSA examinations and enforcement.

The types of section 314(a) deficiencies and violations in our sample varied. Table 7 lists examples of the types of deficiencies and violations in the examinations we identified as being minor or significant. We defined those deficiencies and violations as minor when the financial institution was generally receiving 314(a) requests and searching its accounts, but its procedures needed enhancements. Those deficiencies and violations that we defined as significant were situations in which the institution was not receiving 314(a) requests or adequately searching accounts.

The severity of CIP deficiencies and violations also varied. We defined CIP deficiencies and violations as being minor when the financial institution generally had CIP procedures, but some aspects needed enhancements or were incomplete according to the regulatory requirements. Situations in which the institution did not have any CIP procedures or the examiner found that the institution was generally not following its CIP procedures we defined as significant. Table 8 lists some examples of minor and significant CIP deficiencies and violations in our sample of examinations.

In many cases, the examinations included documentation showing that institution management agreed to correct deficiencies or violations. In several instances, the examination included documentation in which the board of directors of the institution is directed to address the deficiencies. For example, the Federal Reserve required a board of directors to address a bank’s failure to maintain documentation of its 314(a) searches and to address the violation within 30 days of the examination. Similarly, NCUA noted that a credit union lacked CIP policies and procedures and directed its board of directors to address the apparent violation within a specific timeframe. Additionally, in a few cases, examiners documented that deficiencies or violations were corrected during the exam. For example, a financial institution examined by NASD updated its procedures for addressing FinCEN information requests while examiners were on-site.

Recent Formal Enforcement Actions Have Cited Violations of CIP and Section 314(a)

Although none of the examinations in our sample resulted in formal enforcement actions, recent formal enforcement actions involved violations of the CIP requirement and the regulations under section 314(a). The federal financial regulators have independent statutory authority to institute formal enforcement actions themselves, and they may also refer BSA violations to FinCEN for formal enforcement action. Under delegated authority, FinCEN is the administrator of the BSA and has the authority to enforce BSA regulations. FinCEN’s Office of Compliance and Regulatory Enforcement evaluates enforcement matters that may result in a variety of remedies, including the assessment of civil money penalties.

The federal banking regulators have the authority to take formal enforcement action if they determine that a financial institution is engaging in unsafe or unsound practices or has violated any applicable law or regulation. According to officials from the federal banking regulators, they would take formal action, such as issuing a cease and desist order, if they detected systemic or willful violations of the BSA. Violations of formal agreements or orders, such as a cease and desist order, may result in the assessment of civil money penalties. According to a September 2004 MOU among the federal banking regulators and FinCEN, the federal banking regulators have agreed to promptly notify FinCEN of significant BSA violations or deficiencies by financial institutions under their jurisdiction. SEC officials said that significant and willful BSA violations would be referred to its enforcement division, as well as FinCEN. Similarly, NASD and NYSE have their own rules to enforce anti-money laundering regulations and officials from NASD and NYSE said that they would take formal actions and may make a formal referral to FinCEN if they encountered certain BSA violations. Officials from CFTC and the three futures SROs in our review also said that they would take formal action for significant BSA violations under their own rules to enforce anti-money laundering regulations as well as refer the violations to FinCEN.

We identified several formal enforcement actions taken by the federal banking regulators and FinCEN that included violations of CIP that demonstrate how violations of CIP and section 314(a) are enforced (see table 9). Only one enforcement action—AmSouth—included a violation of section 314(a). These enforcement actions generally consisted of civil money penalties, supervisory or written agreements, or cease and desist orders. In each of these actions, the financial institution agreed to comply with the enforcement action.

Two of these enforcement actions provide additional examples of how CIP has been confused with know-your-customer policies. In two of the cases above, Beach Bank and BAC Florida Bank, FDIC’s cease and desist orders cited institutions for violations of 31 C.F.R. § 103.121 by “failing to implement an effective customer identification program and/or effective ‘Know Your Customer’ policies and procedures.” While 31 C.F.R. § 103.121 requires banks to implement a CIP appropriate for their size and type of business, it does not require banks to adopt know-your-customer policies and procedures. Know-your-customer procedures generally require more information than CIP.

We also identified five formal enforcement actions brought against broker- dealers for violations of CIP and section 314(a) requirements. According to NASD, the firms that were the subject of the NASD enforcement actions in table 10 were generally firms with limited risk profiles. Most of the firms did not have extensive client bases, a large number of registered representatives, and multiple branch offices. Therefore, the fine amounts reflect both the smaller size and financial resources of the firms and the lower risk of money laundering inherent in their business models.

Regulators’ Processes for Tracking Examination Information Varied with Some Having Weaknesses That Could Affect Their Ability to Monitor Anti- Money Laundering Compliance

Reviewing examination data and 176 examinations across six regulators and five SROs provided us an opportunity to see a wide range of practices for managing anti-money laundering oversight programs. One of the key practices that varied across programs was the tracking system used to track examination information. The information that was provided to us on the examinations and apparent violations that covered section 314 and CIP raised broader issues about how the regulators and SROs track anti-money laundering compliance information. To select our sample of examinations, we requested information on the examinations and apparent violations that covered section 314 and CIP, but two of the regulators could not easily obtain this information from their tracking systems. Although we assessed the reliability of the data we received, we did not conduct broad assessments of the information systems and processes regulators and SROs use to track examinations in this report, in part, because we have other work reviewing the banking regulators’ anti-money laundering examinations and enforcement programs and SEC’s examination programs that both include reviewing how they track examinations. However, we highlight the problems we encountered in this review because the problems could affect regulators’ ability to monitor compliance with sections 314 and CIP as well as other anti-money laundering requirements.

Generally, OCC, FDIC, OTS, and NCUA were able to respond to our data request using their examination tracking systems and provide information on examinations that would most likely cover section 314 and CIP by identifying examinations that covered anti-money laundering compliance and information on apparent violations. The information varied in determining whether the examinations actually covered CIP and section 314 during the period of time between October 1, 2003, and May 31, 2004, because the regulators began examining for these provisions at different times. For example, OCC’s system is designed to capture examination areas but examiners were not provided guidance to begin reviewing PATRIOT Act provisions until late February 2004, and therefore, the system was not always recording that they had performed modules covering the PATRIOT Act sections for the period of our review. Also, NCUA officials told us that we were more likely to be able to review examinations that covered section 314 and CIP in examinations completed on or after February 2004, because those examinations were more likely to have used the revised examination questionnaire for anti-money laundering compliance that had been installed on computers in December 2003.

The Federal Reserve had some difficulty responding to our request because the Federal Reserve’s existing automated tracking system for examinations did not capture sufficient detail on whether its examinations cover a review of anti-money laundering compliance. Although full-scope examinations are all supposed to cover anti-money laundering compliance, many of the Federal Reserve’s target examinations may also cover anti-money laundering compliance, but their tracking system does not capture this level of detail. Therefore, the Federal Reserve could not readily identify the population of examinations that would most likely cover CIP and section 314. Also, although the Federal Reserve tracks information on apparent violations, its tracking system does not track deficiencies. This distinction was important to our information request because the Federal Reserve had not had any apparent violations related to section 314 or CIP, but its Federal Reserve Banks had reported deficiencies in quarterly reports to the Federal Reserve Board. However, the information in the quarterly reports was not sufficiently detailed enough for identifying specific examinations that had deficiencies related to CIP or section 314. Therefore, the Federal Reserve Board had to request this information from the 12 Federal Reserve Banks who had to manually go through examination files and compile the information. Federal Reserve officials told us that they are making significant enhancements to the tracking system to capture additional information on Bank Secrecy Act and anti-money laundering compliance.

SEC’s examination tracking system is supposed to capture information on whether the examination included certain focus areas, such as a review of anti-money laundering compliance. However, when attempting to respond to our information request on broker-dealer examinations, SEC discovered that the information from its tracking system did not appear to be accurate. According to an SEC official, SEC information on anti-money laundering examinations for broker-dealers was not always accurate because examiners were not always inputting all of the focus areas that they covered, including anti-money laundering. Therefore, SEC conducted a word search through its database of examination reports to identify examinations that covered section 314 and CIP and identified about 26 examinations to respond to our information request. After our data request, SEC officials emailed a reminder to examination staff of the importance of accurately filling out all examination information in the tracking system, including identifying when anti-money laundering is a focus area, and asked that they review the accuracy of this information for completed examinations and update it as necessary. For mutual fund examinations, SEC used the same tracking system to identify all routine examinations of mutual funds during our examination review period because anti-money laundering was expected to be a focus area for all routine examinations and did not encounter the same problem. NASD and NYSE were able to identify examinations and apparent violations of section 314 and CIP using their examination tracking systems.

The futures SROs provided us information without any difficulty. According to an NFA official, once NFA had identified through its tracking system the population of examinations that covered anti-money laundering compliance and those examinations that included an apparent violation, the examinations were reviewed to identify whether the apparent violation was related to section 314 or CIP. CME and CBOT each only have approximately 30 to 40 futures commission merchants at any point in time that they track and had only completed a few examinations during the time period for our examination review and therefore did not have difficulty responding to our information request.

Law Enforcement Officials Believe That Section 314(a) and CIP Have Been Valuable Tools in Terrorist and Money Laundering Investigations

Law enforcement officials praised the 314(a) process, stating that it has improved coordination between law enforcement agencies and financial institutions and indicated that CIP has also assisted investigations. The 314(a) process has resulted in discovery of additional accounts held by suspects and issuance of grand jury subpoenas, search warrants, arrests, and indictments. Most law enforcement officials we interviewed also believed that CIP requirements have helped investigators by ensuring that better and more detailed information is collected and maintained at financial institutions. Although CIP and 314(a) processes are useful tools for investigating money laundering and terrorist financing cases, the decision to bring charges in specific cases is always discretionary.

Law Enforcement Officials Believe That the Section 314(a) Process Has Improved Coordination with Financial Institutions and Has Led to More Efficient Investigations

Officials from the Department of Justice and other law enforcement agencies told us that the 314(a) process has improved coordination between law enforcement agencies and financial institutions and has increased the speed and efficiency of investigations. Department of Justice officials, including supervisory prosecutors in two U.S. Attorneys Offices, with whom we spoke, said that the 314(a) process facilitated the flow of information between financial institutions and law enforcement officials by connecting FinCEN to approximately 20,000 financial institutions.

Investigators use the information FinCEN gathers from these financial institutions as evidence in building cases against potential money launderers and terrorist financers. FinCEN recently reported that the 314(a) system has processed 381 requests since it resumed operation in February 2003. Of the total number of requests processed, 137 of them were submitted by federal law enforcement agencies in the conduct of terrorist financing investigations and 244 in the conduct of money laundering investigations. FinCEN also reported that 314(a) feedback from law enforcement requesters has been overwhelmingly positive. In approximately 2 years, February 2003 through March 2005, 314(a) requests submitted by law enforcement have resulted in the identification of thousands of new accounts and transactions. According to information that law enforcement provides to FinCEN, the 314(a) process has provided information that helped support the issuance of more than 800 subpoenas, 11 search warrants, and 9 arrests. However, FinCEN officials cautioned that this information represents feedback from only 10 percent of the cases for which 314(a) information requests were made and that FinCEN does not verify the accuracy of the data provided by law enforcement officials.

Almost all of the law enforcement officials we interviewed said that the 314(a) process improved the speed and efficiency of investigations by allowing investigators to query a large number of financial institutions in a short amount of time. One FBI official we interviewed showed us information on how a 314(a) request led to identification of additional suspect accounts across 23 states and 45 financial institutions. Prior to submitting the request, the FBI was aware of only four accounts. One law enforcement official told us that prior to section 314, law enforcement officials often sent subpoenas to individual banks for information. They could not, however, simultaneously request financial institutions across the country to search accounts or transactions for groups of individuals or even one person. According to FBI officials, the 314(a) process improves the efficiency of investigations because agents spend less time finding the suspect’s specific financial transactions or accounts. The results from a 314(a) request may also help law enforcement to eliminate false leads. One prosecutor told us that the 314(a) process had been used 3 or 4 times during investigations of terrorist financing or money laundering cases. However, all of the law enforcement officials we interviewed told us that they are very judicious in their use of 314(a) requests, in part, because they were aware of the costs to the financial services industry and also because submitting the request can expose a covert operation. For instance, it is possible that a financial institution will take some action, permissible under the law, but which has the unintended effect of compromising the investigation.

According to some law enforcement officials, the 314(a) process also allows investigators to track down sophisticated criminals who might normally elude typical investigative approaches. For example, one prosecutor told us that a potential money launderer or terrorist financer with a lot of knowledge and sophistication about financial institutions might have been able to circumvent traditional approaches used to collect information, such as surveillance or tracing financial transactions to individual financial institutions. However, in her view, the 314(a) process has allowed investigators to cast a wider net thereby significantly improving the investigative effort.

Information Collected through CIP Can Assist Money Laundering and Terrorist Financing Investigations

Many of the law enforcement officials we interviewed said financial institutions are collecting and maintaining better and more detailed information as a result of CIP requirements. One prosecutor told us that as a result of section 326 regulations, grand jury subpoenas can be used to obtain more substantive and detailed information on accounts. This improvement was due to the fact that the CIP rule requires financial institutions to consistently gather more information from a customer when an account is opened. For example, investigators and prosecutors are now able to receive social security numbers, dates of birth, and complete addresses when they issue subpoenas. The same prosecutor told us that in the past, subpoenaed account information concerning criminal suspects was often incomplete. For instance, instead of a physical address they would receive only a P.O. Box or mailbox associated with the account. Standardization of account opening procedures has also made it easier for law enforcement to make positive matches with suspects on 314(a) lists. Prior to the enactment of the PATRIOT Act, some financial institutions already had established policies and procedures to verify customer identities, but the financial services industry overall was not subject to uniform minimum requirements for identifying and maintaining customer information. As a result, law enforcement officials did not always know what kind of information they would acquire from institutions pursuant to a subpoena or warrant.

Successful Prosecutions of Terrorist Financing and Money Laundering Cases Depend on Numerous Factors

Although the CIP requirement and 314(a) requests have made useful information available to federal prosecutors who are investigating and prosecuting terrorist financing and money laundering cases, prosecution of specific cases is always discretionary. Department of Justice officials, including prosecutors in U.S. Attorneys Offices, said that case specific factors continue to determine whether or not a prosecutor will bring charges on a terrorist financing or money laundering case. There are no specific monetary thresholds or criteria that determine when a prosecutor will pursue a money laundering or terrorist financing case. One prosecutor told us that these provisions helped prosecutors better understand the financial lay of the land in anti-money laundering and terrorist financing and that the use of the provisions by law enforcement leads to better investigations. It is not feasible, however, to enumerate how many cases were successfully prosecuted as a direct result of Suspicious Activity Reports or 314(a) requests since each prosecution is unique and based on many factors.

Prosecutors in two U.S. Attorney’s Offices also told us that the provisions, while helpful, could not alter the fact that anti-money laundering and terrorist financing cases are resource intensive and complex. Prosecutors told us that reviewing transactions for a typical money services business or currency exchange was time consuming and may typically involve review of voluminous daily transaction records. Once the transaction analysis is performed, the information then must be reviewed in coordination with other evidence to determine if it can support proof beyond a reasonable doubt, and whether the evidence used to build the case is suitable for presentation in court.

Conclusions

Since the passage of the PATRIOT Act, the U.S. government and the financial industry have worked together to develop and implement the regulations required by the PATRIOT Act. It was challenging to develop joint regulations that covered so many sectors of the financial industry. The financial industry has implemented procedures to comply with the PATRIOT Act’s regulations, including the CIP requirement and the information sharing provisions in section 314, but it has encountered several challenges along the way and there are some concerns and issues that remain outstanding. FinCEN, the federal financial regulators, and SROs have made a concerted effort to reach out to and educate the industry on its responsibilities for customer identification and sharing information with law enforcement. However, the interagency process has delayed the release of additional guidance for CIP. The implementation challenges that industry officials shared with us demonstrate that the government will need to continue its education efforts and work with industry to resolve outstanding issues. Primarily, industry officials are unclear about the regulators’ views on what constitutes sufficient verification procedures for certain high-risk customers, such as foreign individuals and companies and whether they and their examiners would view a customer and the appropriate level of verification in the same way. Therefore, industry officials would like to receive more guidance from FinCEN and the regulators on issues such as these.

FinCEN, the federal financial regulators, and SROs have also taken steps to implement section 314 and CIP and have begun examining financial institutions and taking enforcement action for violations. However, our review revealed examiner difficulties in assessing compliance with CIP that could reduce its effectiveness at uncovering suspicious or questionable customers or lead to inconsistencies in the way examiners conduct examinations. Because our review found that not all examinations documented a review of the risk-based aspect of CIP, we believe that some examiners and financial institutions may not fully understand how the CIP requirements should be applied to higher risk customers. The primary reason that Treasury and the federal financial regulators adopted the risk- based approach to verifying customer identity was so that financial institutions would be able to focus more effort on high-risk customers. Also, some of the other difficulties we found in our review of examinations highlight how inconsistent interpretations can occur during examinations. For example, some examiners came to different conclusions about how the CIP requirement is applied to existing customers that open new accounts. Because examination findings can cause a financial institution to change its practices, such inconsistencies could lead to significant variations in policies and procedures among financial institutions based on differing interpretations of the CIP requirements by examiners.

Although our review focused on two specific anti-money laundering regulations, the enforcement of these regulations occurs under the broader BSA regulatory structure and, hence, the results of our review should be understood in this broader context. Enforcing the BSA, as amended by the PATRIOT Act, is a shared responsibility among FinCEN and the federal financial regulators. As the administrator of BSA, FinCEN has responsibility for enforcement of the provisions added by the PATRIOT Act, but FinCEN relies on the federal financial regulators to conduct examinations and alert it to violations that warrant an enforcement action. This arrangement is even more complicated for securities and futures financial institutions because SEC and CFTC largely rely on the SROs to conduct examinations and enforce rules and regulations. Since the passage of the PATRIOT Act, FinCEN and the financial regulators have been working more closely together to better coordinate BSA examinations and enforcement and to improve the consistency of the information they provide to the financial industry. FinCEN’s new Office of Compliance and MOU with the federal banking regulators are good first steps in better BSA oversight and enforcement. In addition, FinCEN and the federal banking regulators have worked together to develop interagency anti-money laundering examination procedures for the first time. FinCEN is in the process of reaching similar MOU agreements with SEC and CFTC. Whether in issuing guidance for industry or examiners, FinCEN will need the continued cooperation of all seven financial regulators to effectively address problems and inconsistencies in the U.S. anti-money laundering regulatory system.

Recommendations for Executive Action

To improve implementation of sections 326 and 314 of the PATRIOT Act, we are making two recommendations: To build on education and outreach efforts and help financial institutions subject to the CIP requirement effectively implement their programs, we recommend that the Secretary of the Treasury, through FinCEN and in coordination with the federal financial regulators and SROs, develop additional guidance covering ongoing implementation issues related to the CIP requirement. Specifically, additional guidance on the CIP requirement that provides examples or alternatives of how to verify the identity of high-risk customers, such as foreign individuals and companies, could help financial institutions develop better risk- based procedures.

To enhance examination guidance covering the CIP requirement and ensure that examiners are well-informed about CIP requirements, we recommend that the Director of FinCEN work with the federal financial regulators to develop additional guidance for examiners to use in conducting BSA examinations. Specifically, the guidance should clarify that complying with the CIP requirement is more than determining whether the minimum customer identification information has been obtained—the examiner should determine whether a financial institution’s CIP contains effective risk-based procedures for verifying the identity of customers. Secondly, the guidance should clarify how CIP fits into other customer due diligence practices, such as know-your- customer procedures. Finally, the guidance should reflect the FAQs on CIP issued for industry, which addressed the difficulties in interpretation we observed for checking government lists and applying the CIP requirement to existing customers.

Agency Comments and Our Evaluation

We provided a draft of this report for review and comment to the Departments of the Treasury, Justice, and Homeland Security; seven federal financial regulators (Federal Reserve, FDIC, OCC, OTS, NCUA, SEC, and CFTC) and five SROs (CBOT, CME, NFA, NASD, and NYSE). We received written comments from the Department of the Treasury, NCUA, and SEC. These comments are reprinted in appendixes II, III, and IV. The Departments of the Treasury and Justice, the Federal Reserve, FDIC, OCC, SEC, CFTC, NASD, NYSE and NFA also provided technical comments and clarifications, which we incorporated in this report where appropriate. The Department of Homeland Security, OTS, CME, and CBOT had no comments.

In its written comments, Treasury said that despite the considerable educational and outreach efforts already undertaken by FinCEN, there was still some confusion and lack of clarity on the part of both the federal financial regulators and SROs, and the regulated industries and examiners who conduct compliance inspections of these industries. Treasury concurred with our recommendations that additional guidance would improve implementation of these regulations. Treasury also commented that, with the diversity of financial institutions that must comply with CIP regulations, firms need the flexibility to implement programs tailored to their own size, location, and type of business and to allow them to use a risk-based approach to verify the identity of their respective customer bases. In its written comments, NCUA also supported our recommendations. Both agencies commented that Treasury and the federal banking regulators plan to issue new BSA examination procedures in June 2005. In its written response, SEC commented that consistent with our recommendation, the federal financial regulators are continuing to work cooperatively to ensure that they provide consistent guidance on interpretive and compliance issues. Concerning difficulties SEC had with its examination tracking system when responding to our information request, SEC also said that its staff is formulating improvements to the existing automated tracking system.

Unless you publicly announce its contents earlier, we plan no further distribution of this report until 30 days after the date of this report. At that time, we will send copies of this report to the Departments of the Treasury, Homeland Security, and Justice; the Federal Reserve Board, FDIC, OCC, OTS, NCUA, CFTC, SEC, NASD, NYSE, NFA, CBOT, CME, and interested congressional committees. We will also make copies available to others on request. In addition, this report will be available at no cost on our Web site at http://www.gao.gov.

If you or your staff have any questions about this report please contact me at (202) 512-2717 or Barbara Keller, Assistant Director, at (202) 512-9624. GAO contacts and key contributors to this report are listed in appendix V.

Scope and Methodology

To determine how Treasury and the federal financial regulators developed the regulations for CIP and section 314 and identify challenges, we reviewed documents related to the rulemaking process including comment letters and the Federal Register notices of the final rules and interviewed officials from Treasury (FinCEN), Justice, the federal financial regulators, and SROs.

To identify the government’s education and outreach efforts, we interviewed officials from Treasury (FinCEN), the federal financial regulators, and SROs about how they have informed and educated the industry and reviewed education and outreach materials provided to us. To identify implementation challenges encountered by financial institutions, we interviewed company officials and industry trade associations representing banks, credit unions, securities broker-dealers, mutual funds, futures commission merchants, and futures introducing brokers. We also reviewed letters that company officials and industry representatives sent to Treasury and the federal financial regulators during the rulemaking process as well as after the final rules were issued that expressed concerns and challenges they had about implementing procedures to comply with CIP and section 314 regulations.

To determine the extent to which the federal financial regulators and SROs have updated examination guidance and trained examiners on CIP and section 314, we reviewed copies of draft and final versions of guidance; collected information on examiner training courses related to anti-money laundering and the number of examiners trained in 2002, 2003, and 2004; and interviewed officials on their examination guidance and training programs. We also observed one anti-money laundering training course taught by the Federal Financial Institutions Examination Council (FFIEC) that provides training to bank examiners.

To determine the extent to which the federal financial regulators have examined for compliance and taken enforcement actions on CIP and section 314 regulations, we collected data on the number of exams completed from October 1, 2003, through May 31, 2004, and the number of violations for CIP and section 314 regulations for the same time period from six federal financial regulators and five SROs. The data from the regulators and SROs generally came from information systems and reporting processes used to collect and track information on examinations and violations. There was some variability in how the regulators and SROs defined examinations, violations, and the start and end dates for examinations and therefore the data are not comparable. However, we determined that the data provided to us were generally reliable for our purposes. Our data reliability assessments generally involved interviewing officials about the management of the data and basic tests of the data to determine if it appeared accurate. We attempted to select approximately 20 examinations from each regulator and SRO. To ensure that we would be able to review a sufficient number of examinations with the types of violations related to CIP and section 314 requirements and how the regulators and SROs addressed violations, we sampled proportionally more examinations that included violations of CIP and section 314 than examinations without violations, though in some cases the number of examinations that had such violations were less than 10 and, therefore, the sample would not include proportionally more examinations with violations. We reviewed a total of 176 examinations. However, the number of examinations varied widely between organizations, and in the cases of CBOT and CME, all available examinations were selected because the number of examinations was small. While the selections of individual examinations were made randomly within the subsets of violation and nonviolation examinations to minimize the possibility of bias in our sample, the arbitrary totals selected were small in number and not representative of the true ratio of violation to nonviolation examinations within the organization nor the volume of examination activity across the organizations. Therefore, these samples are not statistically representative. However, our review of the examinations enabled us to describe the approaches used by the regulators to examine for compliance and highlight issues that may present challenges for examiners in interpreting the new regulations and appropriately assessing financial institutions for compliance. Table 11 displays the final sample size for each of the regulators and SROs and also explains why some examinations initially selected were not part of our final sample.

After selecting our sample of examinations, we requested the examination reports and related workpapers associated with each examination from each of the regulators and SROs. We developed a data collection instrument to review the examination documentation. The data collection instrument was developed by reviewing the regulation requirements for CIP and section 314 and the examination procedures developed by the regulators and SROs. After each examination was reviewed once using the data collection instrument, a second person reviewed the examination using the data collection instrument a second time to ensure the reliability of our coding of the review questions and accuracy of data entry. We used the results from the data collection instrument to determine how the regulators and SROs reviewed compliance and how regulators and SROs dealt with deficiencies and violations related to CIP and section 314. We also identified formal enforcement actions that were completed during the time of our review and included violations of CIP or section 314 regulations. Finally, we interviewed officials from FinCEN, the federal financial regulators, and SROs about their examination and enforcement policies.

To determine how these new regulations have and could improve law enforcement investigations and prosecutions of money laundering and terrorist activities, we interviewed officials representing several law enforcement agencies, including the FBI and ICE, and Department of Justice officials. We interviewed supervisory prosecutors from two U.S. Attorneys offices as well as supervisory officials at the Asset Forfeiture and Money Laundering Section and the Counter-Terrorism Section at the Department of Justice who have been involved with money laundering and terrorist cases and had experience with section 314 and CIP to better understand the factors that are considered when deciding whether to prosecute a money laundering or terrorist financing case. We also reviewed information that FinCEN collects from law enforcement agencies on the results of the 314(a) process.

We conducted our work in New York City, NY; Chicago, IL; and Washington, D.C., between February 2004 and March 2005 in accordance with generally accepted government auditing standards.

Comments from the Department of the Treasury

Comments from the National Credit Union Administration

Comments from the Securities and Exchange Commission

GAO Contacts and Staff Acknowledgments

GAO Contacts

Staff Acknowledgments

William Bates, Davi M. D’Agostino, David Nicholson, Carl Ramirez, Omyra Ramsingh, Adam Shapiro, and Kaya Leigh Taylor made key contributions to this report.

Related Products

Anti-Money Laundering: Issues Concerning Depository Institution Regulatory Oversight. GAO-04-833T. Washington, D.C.: June 3, 2004.

Combating Money Laundering: Opportunities Exist to Improve the National Strategy. GAO-03-813. Washington, D.C.: September 26, 2003.

Internet Gambling: An Overview of the Issues. GAO-03-89. Washington, D.C.: December 2, 2002.

Interim Report on Internet Gambling. GAO-02-1101R. Washington, D.C.: September 23, 2002.

Money Laundering: Extent of Money Laundering through Credit Cards is Unknown. GAO-02-670. Washington, D.C.: July 22, 2002.

Anti-Money Laundering: Efforts in the Securities Industry. GAO-02-111. Washington, D.C.: October 10, 2001.

Money Laundering: Oversight of Suspicious Activity Reporting at Bank- Affiliated Broker-Dealers Ceased. GAO-01-474. Washington, D.C.: March 22, 2001.

Suspicious Banking Activities: Possible Money Laundering by U.S. Corporations Formed for Russian Entities. GAO-01-120. Washington, D.C.: October 31, 2000.

Money Laundering: Observations on Private Banking and Related Oversight of Selected Offshore Jurisdictions. GAO/T-GGD-00-32. Washington, D.C.: November 9, 1999.

Private Banking: Raul Salinas, Citibank, and Alleged Money Laundering. GAO/T-OSI-00-3. Washington, D.C.: November 9, 1999.

Private Banking: Raul Salinas, Citibank, and Alleged Money Laundering. GAO/OSI-99-1. Washington, D.C.: October 30, 1998.

Money Laundering: Regulatory Oversight of Offshore Private Banking Activities. GAO/GGD-98-154. Washington, D.C.: June 29, 1998.

Money Laundering: FinCEN’s Law Enforcement Support Role Is Evolving. GAO/GGD-98-117. Washington, D.C.: June 19, 1998.

Money Laundering: FinCEN Needs to Better Manage Bank Secrecy Act Civil Penalties. GAO/GGD-98-108. Washington, D.C.: June 15, 1998.

Money Laundering: FinCEN’s Law Enforcement Support, Regulatory, and International Roles. GAO/GGD-98-83. Washington, D.C.: April 1, 1998.

Money Laundering: FinCEN Needs to Better Communicate Regulatory Priorities and Timelines. GAO/GGD-98-18. Washington, D.C.: February 6, 1998.

Private Banking: Information on Private Banking and Its Vulnerability to Money Laundering. GAO/GGD-98-19R. Washington, D.C.: October 30, 1997.

Money Laundering: A Framework for Understanding U.S. Efforts Overseas. GAO/GGD-96-105. Washington, D.C.: May 24, 1996.