The Financial Recordkeeping and Currency and Foreign Transactions Reporting Act, commonly referred to as the Bank Secrecy Act, passed by Congress in 1970, requires that financial institutions file certain currency and monetary instrument reports and maintain certain records for possible use in criminal, tax, and regulatory proceedings. As a result, the BSA helps to provide a paper trail of the activities of money launderers for law enforcement officials in pursuit of criminal activities. Congress has amended the BSA a number of times to increase the effectiveness of the regulators’ efforts. For example, the initial BSA reporting system did not include provisions for separate money laundering charges against those who had not satisfied reporting requirements. Thus, Congress enacted the Money Laundering Control Act of 1986, which made money laundering a criminal offense separate from any BSA reporting violations. This act created criminal liability for individuals or entities that conduct monetary transactions knowing that the proceeds involved were obtained from unlawful activity and made it a criminal offense to knowingly structure transactions to avoid BSA reporting. The 1986 act also directed the regulators (1) to issue regulations that require the financial institutions subject to their respective jurisdiction “to establish and maintain procedures reasonably designed to assure and monitor the compliance of such institutions;” (2) to review such procedures during the course of each examination of such financial institutions; (3) to issue cease and desist orders to ensure compliance with the requirements; and (4) to assess civil money penalties for failure to maintain such compliance procedures. In 1992, Congress increased the penalties for institutions and their employees who violate the BSA and authorized the regulators to take additional supervisory actions for such violations. More specifically, the Annunzio-Wylie Anti-Money Laundering Act authorized the federal banking regulators to revoke an institution’s charter if it was convicted of money laundering and, in certain circumstances, to issue removal and prohibition orders against individuals charged with BSA offenses. As authorized by this act, in 1996, Treasury issued a rule requiring that banks and other depository institutions use a Suspicious Activity Report (SAR) form to report activities involving possible money laundering. Institutions file these forms with the Financial Crimes Enforcement Network (FinCEN) at Treasury. Congress amended the BSA again in 1994, with The Money Laundering Suppression Act, to require that financial regulators develop enhanced examination procedures and training to improve identification of money- laundering schemes at financial institutions under their supervision. Accordingly, the federal banking regulators adopted a core set of examination procedures to determine whether an institution has the necessary system of internal controls, policies, procedures, and auditing standards to assure compliance with the BSA and implementing regulations. The procedures also require examiners to review an institution’s internal audit function, procedures, selected workpapers, records, reports, and responses. Based on the results, examiners may conclude the examination or continue with expanded procedures, which might include transaction testing and review of related documentation. This act also directed the Secretary of the Treasury to delegate to appropriate federal banking regulatory agencies the authority to assess civil penalties for BSA violations. In May 1994, the Secretary delegated this authority to FinCEN but, to date, this delegation has not been made to the banking regulators. In October 2001, Congress again amended the BSA through passage of the USA PATRIOT Act, specifically through Title III of this act. The passage of the USA PATRIOT Act was prompted, in part, by the September 11, 2001, terrorist attacks in Washington, D.C. and New York City, which in turn enhanced awareness of the importance of combating terrorist financing through the U.S. government’s AML efforts. Title III expanded the scope of the BSA to include organizations not previously covered, such as securities brokers, insurance companies, and credit card system operators. Among Title III’s provisions are requirements that financial institutions covered by the act: Establish and maintain AML programs; Identify and verify the identity of customers who open accounts; Exercise due diligence and, in some cases, enhanced due diligence with respect to all private banking and correspondent accounts; Conduct enhanced scrutiny with respect to accounts maintained by or on behalf of foreign political figures or their families; and Share information relating to money laundering and terrorism with law enforcement authorities, regulatory authorities, and financial institutions. Title III also added activities that can be prosecuted as money laundering crimes and increased penalties for activities that were money laundering crimes prior to enactment of the USA PATRIOT Act. Examination procedures of the federal banking regulators are expected to conform to PATRIOT Act amendments to the BSA and regulations issued by the Treasury. In the last few years and as recently as last month, the federal banking regulators and the courts have taken actions against a number of depository institutions for significant BSA violations. In addition to deficiencies at the institutions themselves, issues raised in these cases included the timeliness of the identification of BSA violations and enforcement actions taken by the regulators. To illustrate, I will discuss three different cases at three different types of depository institutions. In the first case, a bank was charged with BSA violations of suspicious activity report requirements and received a deferred prosecution. In 2000, the U.S. Department of Justice (Justice) charged Banco Popular de Puerto Rico, a bank subsidiary of a diversified financial services company serving Puerto Rico, the United States, and Latin America, with failing to file SARs in a timely and complete manner—in violation of the BSA. According to Justice, from 1995 through 1998, an individual, who was later convicted of money laundering offenses, deposited approximately $21.6 million in cash into an account at Banco Popular. Justice indicated that a number of branch employees were aware of the suspicious activity, but that the bank failed to investigate the account for over 2 years from the date the account was opened, and also did not report the suspicious activity to FinCEN until 1998 as required by the BSA. Although the Federal Reserve Bank of New York (FRBNY) conducted four examinations of Banco Popular from 1995 through 1998, the examinations, based on procedures used at the time, did not contain any criticism of the bank’s BSA compliance policies or procedures. In 1999, 4 years after the individual first began laundering an undetermined amount of money through Banco Popular, FRBNY expanded the scope of the bank’s regularly scheduled safety and soundness examination as a result of information it received from a U.S. Customs Service drug investigation. Based on AML compliance problems identified during the examination, FRBNY developed a supervisory strategy that led to a written agreement containing numerous remedial actions. Banco Popular also entered into a deferred prosecution agreement with Justice, FinCEN, and the Federal Reserve; and agreed to a civil money penalty of over $20 million. In another instance, FinCEN assessed penalties against a credit union for currency transaction reporting violations. In January 2000, FinCEN assessed civil money penalties of $185,000 against the Polish and Slavic Federal Credit Union, located in Brooklyn, New York, for willful failure to file Currency Transaction Reports (CTR) and improperly granting an exemption from CTR filings in violation of the BSA. FinCEN determined that between 1989 and 1997, the Polish and Slavic Federal Credit Union willfully failed to file numerous CTRs for currency transactions in amounts greater than $10,000. FinCEN also reported that the credit union, through the actions of its former management and board of directors, improperly exempted one customer from CTR filings. The customer, the former chairman of the credit union’s board of directors and owner of a travel agency and money remitter business, did not qualify for the CTR filing exemption, according to FinCEN. The remitter made over 1,000 currency deposits in excess of $10,000 but no CTRs were filed. FinCEN further reported that the credit union, through its former general manager and former board, failed to establish and maintain (1) an adequate level of internal controls for BSA compliance, (2) an effective BSA compliance program, (3) BSA training for credit union employees, and (4) an effective internal audit function. NCUA, the regulator of the Polish and Slavic Federal Credit Union, took a series of enforcement actions against the credit union beginning in January 1997 to compel compliance with the BSA. However, FinCEN’s report also indicates that NCUA’s enforcement actions began about 8 years after the violations began. In April 1999, NCUA removed the credit union’s board of directors and imposed a conservatorship based on the credit union’s failure to establish adequate internal controls, including controls for BSA compliance. Last month, OCC and FinCEN assessed a $25 million civil money penalty against Riggs Bank, N.A. for numerous BSA violations, including failure to maintain an effective BSA compliance program and to monitor and report transactions involving millions of dollars by the embassies of Saudi Arabia and Equatorial Guinea in Washington, D.C. Since 1987, OCC has required each bank under its supervision to establish and maintain an AML compliance program and specified four elements that banks were required to satisfy. However, FinCEN reported that Riggs was deficient in all four elements required by the AML regulation. FinCEN found that Riggs willfully violated the suspicious activity and currency transaction reporting requirements and the AML program requirements of the BSA. Specifically, Riggs failed to establish and maintain an effective BSA compliance program because it did not provide (1) an adequate system of internal controls to ensure ongoing BSA compliance, (2) an adequate system of independent testing for BSA compliance, (3) effective training for monitoring and detecting suspicious activity, and (4) effective monitoring of BSA compliance by the BSA officer. In July 2003, OCC entered into a consent order with Riggs, in which Riggs was directed to, among other things, correct AML internal control deficiencies and referred the Riggs case to FinCEN. According to a Riggs’ filing with the Securities and Exchange Commission, in April 2004, OCC classified Riggs as being in a “troubled condition” for failing to fully comply with the July 2003 consent order. Due to additional BSA violations by Riggs National Corporation (the bank’s holding company), in May, OCC and the Federal Reserve, respectively, issued a supplemental consent order and a cease and desist order, requiring extra corrective actions. OCC and FinCEN cited the corporation for deficiencies in risk management and internal controls. Although OCC deemed Riggs to be systemically deficient in 2003 and the bank entered into a consent order with OCC, Riggs was not in full compliance with the consent order in 2004 and was subsequently assessed the penalty. In addition to the three cases discussed above, published reports of BSA violations at other banks have increased concerns about bank noncompliance with the BSA and timely oversight and enforcement by the federal banking regulators. For example, in 2003, the Department of Homeland Security’s Bureau of Immigration and Customs Enforcement (ICE) reported that the Delta National Bank & Trust Company pled guilty in U.S. District Court to charges that it failed to file a SAR in connection with a transaction made in 2000 between two accounts at the bank. As part of the plea agreement with the government, the bank agreed to forfeit $950,000. In 2002, Broadway National Bank pled guilty to three felony charges for failing to report suspicious banking activity in the 1990s, according to ICE. The prosecutors determined that more than $120 million was illegally moved through the bank. The bank was fined $4 million. Recent Treasury and FDIC IG reports assessing the regulators’ examination work and enforcement activities have raised questions about potential gaps in the consistency and timeliness of the regulators’ monitoring and follow-up on BSA violations. The Treasury’s IG issued a report in 2003 on BSA violations at depository institutions and has a number of related audits in its fiscal year 2004 work plan. In September 2003, the Treasury IG issued a report on its review of OTS enforcement actions taken against thrifts with substantive BSA violations. Among its findings, the report stated that examiners found substantive BSA violations at 180 of the 986 thrifts examined from January 2000 through October 2002. OTS had issued written enforcement actions against 11 of the 180 thrifts; however, in 5 of these actions, the IG reported that enforcement actions did not address all substantive violations found, were not timely, or were ineffective in correcting the thrifts’ BSA violations. The IG further reported that among 68 sampled cases, OTS relied on moral suasion and thrift management assurances to comply with the BSA. In 47 cases (69 percent), thrift management took the corrective actions, but in the other 21 cases (31 percent), thrift management was nonresponsive. BSA compliance worsened at some of the 21 thrifts, according to the IG. The IG made several recommendations including that OTS assess the need for additional clarification or guidance for examiners on when to initiate stronger supervisory action for substantive BSA violations and time frames for expecting corrective actions from thrifts. OTS concurred and stated that supplemental examiner guidance would be provided for the first quarter of 2004. The IG’s fiscal year 2004 annual plan lists several related audit projects including an assessment of OTS’ BSA examinations, including the new requirements under the USA PATRIOT Act. I am pleased to be on a panel with the FDIC Inspector General and would like to highlight some of his office’s work to illustrate issues recently raised regarding BSA examinations and enforcement. For example, in March 2001, the IG reported on its review of the FDIC Division of Supervision and Consumer Protection assessment of financial institutions’ compliance with the BSA. Among the IG’s findings were that FDIC did not adequately document its BSA examinations work; as a result, the IG was unable to determine the extent to which examiners reviewed regulated institutions’ compliance with the BSA during safety and soundness examinations. The IG made several recommendations, including that FDIC reemphasize to examiners and ensure that they follow (1) specific guidance related to the documentation requirements of scoping decisions, procedures, and conclusions reached during the pre-examination process when risk- focusing BSA examinations; and (2) policy and instructions on how to adequately document BSA examination decision factors and procedures. With regard to both recommendations, FDIC stated it would reemphasize its existing policies and guidance, specifically those policies requiring examiner responses to all of the BSA core decision factors at each examination. FDIC also stated that it had made revisions to its BSA examination module. In September 2003, the IG reported on its audit of FDIC’s implementation of examination procedures to address financial institutions’ compliance with provisions of Title III of the USA PATRIOT Act. The IG concluded that FDIC’s existing BSA examination procedures covered the AML subject areas required by the act to some degree and that its Division of Supervision and Consumer Protection had advised FDIC-regulated institutions of the new requirements. However, the IG reported that, for a number of reasons, the division had not issued guidance to its examiners on the act’s provisions that required new or revised examination procedures. One of the report’s recommendations was that the division issue interim examination procedures for those sections of the USA PATRIOT Act for which Treasury had issued final rules. The division agreed with the recommendation. In March 2004, the IG issued a report on its work to determine whether the FDIC adequately followed up on BSA violations reported in examinations of FDIC-supervised financial institutions to ensure that they take appropriate corrective action. Among the IG’s findings was that, in some cases, BSA violations were repeatedly identified in multiple examination reports before bank management took corrective action or FDIC took regulatory action to address the repeat violations. The IG concluded that FDIC needs to strengthen its follow-up processes for BSA violations and recommended that FDIC’s Division of Supervision and Consumer Protection (1) reevaluate and update examination guidance to strengthen monitoring and follow-up processes for BSA violations and (2) review its implementation process for referring violations to Treasury. The IG noted that FDIC has initiatives underway to reassess and update its policies and procedures. Although it did not concur with all of the IG’s findings, in its response, FDIC concurred with the recommendations. In recent years, we have done work addressing money laundering issues within the context of different activities and financial institutions such as securities broker-dealers, Russian entities, and private banking. We have also reviewed FinCEN’s regulatory role. In 1998, we issued two reports regarding FinCEN’s role in administering the BSA. In both of these reports, we discussed the Secretary of the Treasury’s mandate to delegate the authority to assess civil penalties for BSA violations to federal banking regulatory agencies and noted that this delegation had not been made. One purpose of this work was to update information on civil penalties for BSA violations. We reported that one of the issues under discussion at the time was whether violations would be enforced under BSA provisions or under the banking regulators’ general examination powers granted by Title 12 of the U.S. Code. At that time, FinCEN officials told us that they were concerned that the banking regulators might be less inclined to assess BSA penalties and instead use their non-BSA authorities under their own statutes. Also in 1998, we reported on the activities of Raul Salinas, the brother of the former President of Mexico. Mr. Salinas was allegedly involved in laundering money from Mexico, through Citibank, to accounts in Citibank affiliates in Switzerland and the United Kingdom. We determined that Mr. Salinas was able to transfer $90 - $100 million between 1992 and 1994 by using a private banking relationship structured through Citibank New York in 1992 and effectively disguise the funds’ source and destination, thus breaking the funds’ paper trail. The funds were transferred through Citibank Mexico and Citibank New York to private banking investment accounts at Citibank London and Citibank Switzerland. In October 2000, we reported on our work on suspicious banking activity indicating possible money laundering conducted by certain corporations that had been formed in the state of Delaware for unknown foreign individuals or entities. We first identified an agent that together with a related company created corporations for Russian brokers and established bank accounts for those corporations. We also reviewed SARs filed by three banks concerning transactions by corporations formed by this agent for Russian brokers. We then determined that from 1991 through early 2000, more than $1.4 billion in wire transfer transactions was deposited into over 230 accounts opened at two U.S. banks—Citibank and Commercial Bank. More than half of these funds were wired from foreign countries into accounts at Citibank and over 70 percent of the Citibank deposits for these accounts were wire-transferred to accounts in foreign countries. Further, both of these banks had violated BSA requirements regarding customer identification. We concluded that these transfers raised concerns that the U.S. banking system may have been used to launder money. In 2001, we issued a report on changes in BSA examination coverage for certain securities broker-dealers. At the time, there was no requirement that all broker-dealers file SARs; however, broker-dealer subsidiaries of depository institutions and their holding companies were required to file SARs and were examined by banking regulators for compliance. We determined that with the passage of the 1999 Gramm-Leach-Bliley Act, these broker-dealers were no longer being examined to assess their compliance with SAR requirements, although they were being examined for compliance with reporting currency transactions and other requirements Treasury had specifically placed on broker-dealers. However, with the passage of the USA PATRIOT Act and the issuance of a final rule that became effective on July 31, 2002, all broker-dealers were required to report such activity. In December 2003, the Chairman and Ranking Member of this Committee requested that we conduct a review of the regulators’ BSA examination procedures and enforcement actions. In requesting this work, you cited the Treasury and FDIC IG work that I discussed above. Among the major questions you raised were: How do the regulators design, target, and conduct BSA compliance examinations, including for the added provisions of the USA PATRIOT Act? How many BSA violations have federal banking regulators identified and taken action on over a several year time period? What consequences do the regulators’ risk-focused examinations have for identification and enforcement of BSA violations? What differences, if any, are there between enforcement of the BSA through the regulators’ general safety and soundness authorities and enforcement of the BSA under the terms of the BSA itself? Are BSA violations consistently interpreted among the regulators, Treasury, and depository institutions? How do BSA violations come to the attention of the regulators and what other agencies are involved in resolving the violations? What is the relationship between Treasury and the banking regulators in shaping examination policy and subsequent enforcement actions? Do the regulators have adequate resources for conducting BSA compliance examinations, including the BSA provisions of the USA PATRIOT Act? We have begun doing this work for the Committee. In general, the major objectives of our review are to determine: 1. How do the regulators’ risk-focused examinations of depository institutions assess BSA and AML program compliance? 2. To what extent do the banking regulators identify BSA and AML program violations and take supervisory actions for such violations? 3. How consistent are BSA examination procedures and interpretation of BSA violations across the banking regulators? 4. What resources do the federal banking regulators have for conducting examinations of BSA and PATRIOT Act compliance? As part of our review, and considering the IGs’ findings, we are examining the relevant BSA amendments and banking statutes, regulations, and policies that address the authorities under which the regulators and Treasury take supervisory action for BSA violations and violations of their AML program rules. We are reviewing current examination guidance and procedures that the regulators use for determining compliance with the BSA, and related requirements used during their regular and targeted examinations. We will also try to ascertain the implications of “risk- focused” examinations for BSA compliance and to determine whether and to what extent the regulators curtail such compliance reviews in their examinations. We are reviewing the reliability of the data systems used by banking regulators to track bank examinations, including BSA compliance examinations. We plan to obtain information on the bank examinations performed by each banking regulator over the past 4 years and then select a random sample to determine whether and the extent to which a BSA review was conducted or curtailed and the bases for these decisions. We also are obtaining information from the banking regulators on the number of BSA examinations done over the past 4 years and the number and nature of violations they identified. We plan to select and analyze samples of their BSA examinations and supporting workpapers to secure, in part, information on violations identified and the areas of operation covered during the examinations. Additionally, we plan to track supervisory actions taken by the regulators to correct the violations they identified. Our analyses in this area will include assessing the regulators’ examination procedures for BSA and AML compliance and the nature of violations and corresponding supervisory actions. We will also review the examinations in our sample to determine the extent to which the examinations reviewed policies and procedures and then tested transactions to see if the policies and procedures were implemented appropriately. We will also determine the extent to which banking regulators vary in the way they conduct their BSA examinations, cite banks for violations, and take enforcement actions. Key legal issues we will be examining are the ramifications, if any, of the lack of delegation of authority to assess BSA penalties by Treasury to the federal banking regulators, as mandated by statute in 1994. We will examine enforcement of the BSA through the regulators’ general safety and soundness authority and enforcement under the terms of the BSA itself to see whether there are differences, including circumstances under which the regulators make referrals to Treasury and law enforcement agencies. In addition, we will meet with government officials at the federal and state levels and from the banking and credit union industries to gain their perspectives on the risk-focused BSA examination process and post- examination follow-up activities. We have finished our initial meetings with the federal banking regulators; and officials at the Departments of Homeland Security, Justice, and Treasury, including FinCEN. We will have follow-on meetings with them as well as with state banking supervisors, and representatives from depository institutions of various sizes to gain their views on the consistency of examiner interpretation of potential BSA-related deficiencies and the regulators’ BSA examination procedures, and their own internal control activities. Mr. Chairman, this concludes my prepared statement. I would be happy to respond to any questions that you or Members of the Committee may have. For questions concerning this testimony, please call Davi M. D’Agostino at (202) 512-8678. Other key contributors to this statement were M’Baye Diagne, Toni Gillich, Barbara Keller, Kay Kuhlman, and Elizabeth Olivarez. This is a work of the U.S. government and is not subject to copyright protection in the United States. It may be reproduced and distributed in its entirety without further permission from GAO. However, because this work may contain copyrighted images or other material, permission from the copyright holder may be necessary if you wish to reproduce this material separately.

Summary: The U.S. government's framework for preventing, detecting, and prosecuting money laundering has been expanding through additional pieces of legislation since its inception in 1970 with the Bank Secrecy Act (BSA). The purpose of the BSA is to prevent financial institutions from being used as intermediaries for the transfer or deposit of money derived from criminal activity and to provide a paper trail for law enforcement agencies in their investigations of possible money laundering. The most recent changes arose in October 2001 with the passage of the USA PATRIOT Act, which, among other things, extends antimoney laundering (AML) requirements to other financial service providers previously not covered under the BSA. GAO was asked to testify on its previous work and the ongoing work it is doing for the Senate Committee on Banking, Housing, and Urban Affairs on the depository institution regulators' BSA examination and enforcement process. In recent years, GAO has issued a number of reports dealing with regulatory oversight of anti-money laundering activities of financial institutions. In 1998, GAO issued a report regarding Treasury's Financial Crimes Enforcement Network's (FinCEN) role in administering the BSA, which updated information on civil penalties for BSA violations. One focus was the Secretary of the Treasury's 1994 mandate to delegate the authority to assess civil money penalties for BSA violations to federal banking regulatory agencies. GAO noted that this delegation had not been made and said that FinCEN was concerned that bank regulators may be less inclined to assess BSA penalties and may prefer to use their non-BSA authorities under their own statutes. Also in 1998, GAO reported on the activities of Raul Salinas, the brother of the former President of Mexico. Mr. Salinas was allegedly involved in laundering money from Mexico, through Citibank, to accounts in Citibank affiliates in Switzerland and the United Kingdom. GAO determined that Mr. Salinas was able to transfer $90 - $100 million between 1992 and 1994 by using a private banking relationship structured through Citibank New York in 1992 and effectively disguise the funds' source and destination, thus breaking the funds' paper trail. In 2001, GAO issued a report on changes in BSA examination coverage for certain securities broker-dealers. At the time, there was no requirement that all broker-dealers file Suspicious Activity Reports (SARs); however, brokerdealer subsidiaries of depository institutions and their holding companies were required to file SARs and were examined by banking regulators for compliance. GAO determined that with the passage of the 1999 Gramm-Leach-Bliley Act, these broker-dealers were no longer being examined to assess their compliance with SAR requirements. However, with the passage of the USA PATRIOT Act and the issuance of a final rule that was effective on July 31, 2002, all broker-dealers were required to report such activity. GAO is currently studying the depository institution regulators' BSA examination and enforcement process for the Senate Committee on Banking, Housing, and Urban Affairs. The objectives include determining how the regulators' risk-focused examinations assess BSA compliance, the extent to which the regulators identify BSA and AML violations and take supervisory actions, and the consistency of BSA compliance examination procedures and interpretation of violations across regulators. GAO plans to determine whether and to what extent regulators curtailed BSA compliance examinations and the bases for these decisions. GAO plans to track supervisory actions taken to correct violations identified. GAO will also examine the ramifications, if any, of the lack of delegation of authority to assess BSA compliance penalties by Treasury to the banking regulators, as mandated by statute. GAO will meet with government and industry officials to gain their perspective on the BSA compliance examination process.