BSA established reporting, recordkeeping, and other anti-money- laundering (AML) requirements for financial institutions. By complying with BSA/AML requirements, U.S. financial institutions assist government agencies in the detection and prevention of money-laundering and terrorist financing by maintaining effective internal controls and reporting suspicious financial activity. BSA regulations require financial institutions, among other things, to comply with recordkeeping and reporting requirements, including keeping records of cash purchases of negotiable instruments, filing reports of cash transactions exceeding $10,000, and reporting suspicious activity that might signify money laundering, tax evasion, or other criminal activities. In addition, financial institutions are required to have AML compliance programs that incorporate (1) written AML compliance policies, procedures, and controls; (2) an independent audit review; (3) the designation of an individual to assure day-to-day compliance; and (4) training for appropriate personnel. Over the years, these requirements have evolved into an important tool to help a number of regulatory and law enforcement agencies detect money laundering, drug trafficking, terrorist financing, and other financial crimes. The regulation and enforcement of BSA involves several different federal agencies, including FinCEN, the federal banking regulators—FDIC, Federal Reserve, NCUA, and OCC—DOJ, and SEC. FinCEN oversees the administration of BSA, has overall authority for enforcing compliance with its requirements and implementing regulations, and also has the authority to enforce the act, primarily through civil money penalties. BSA/AML examination authority has been delegated to the federal banking regulators, among others. The banking regulators use this authority and their independent authorities to examine entities under their supervision, including national banks, state member banks, state nonmember banks, thrifts, and credit unions, for compliance with applicable BSA/AML requirements and regulations. Under these independent prudential authorities, they may also take enforcement actions independently or concurrently for violations of BSA/AML requirements and assess civil money penalties against financial institutions and individuals. The authority to examine broker-dealers and investment companies (mutual funds) for compliance with BSA and its implementing regulations has been delegated to SEC, and SEC has independent authority to take related enforcement actions. DOJ’s Criminal Division develops, enforces, and supervises the application of all federal criminal laws except those specifically assigned to other divisions, among other responsibilities. The division and the 93 U.S. Attorneys have the responsibility for overseeing criminal matters as well as certain civil litigation. With respect to BSA/AML regulations, DOJ may pursue investigations of financial institutions and individuals for both civil and criminal violations that may result in dispositions including fines, penalties, or the forfeiture of assets. In the cases brought against financial institutions that we reviewed, the assets were either cash or financial instruments. Under the statutes and regulations that guide the assessment amounts for fines, penalties, and forfeitures, each federal agency has the discretion to consider the financial institution’s cooperation and remediation of their BSA/AML internal controls, among other factors. The FCPA contains both antibribery and accounting provisions that apply to issuers of securities, including financial institutions. The antibribery provisions prohibit issuers, including financial institutions, from making corrupt payments to foreign officials to obtain or retain business. The accounting provisions require issuers to make and keep accurate books and records and to devise and maintain an adequate system of internal accounting controls, among other things. SEC and DOJ are jointly responsible for enforcing the FCPA and have authority over issuers, their officers, directors, employees, stockholders, and agents acting on behalf of the issuer for violations, as well as entities that violate the FCPA. Both SEC and DOJ have civil enforcement authority over the FCPA’s antibribery provisions as well as over accounting provisions that apply to issuers. DOJ also has criminal enforcement authority. Generally, financial sanctions programs create economic penalties in support of U.S. policy priorities, such as countering national security threats. Sanctions are authorized by statute or executive order, and may be comprehensive (against certain countries) or more targeted (against individuals and groups such as regimes, terrorists, weapons of mass destruction proliferators, and narcotics traffickers). Sanctions are used to, among other things, block assets, impose trade embargos, prohibit trade and investment with some countries, and bar economic and military assistance to certain regimes. For example, financial institutions are prohibited from using the U.S. financial system to make funds available to designated individuals or banks and other entities in countries targeted by sanctions. Financial institutions are required to establish compliance and internal audit procedures for detecting and preventing violations of U.S. sanction laws and regulations, and are also required to follow OFAC reporting requirements. Financial institutions are to implement controls consistent with their risk assessments, often using systems that identify designated individuals or entities and automatically escalate related transfers for review and disposition. Institutions may also have a dedicated compliance officer and an officer responsible for overseeing blocked funds, compliance training, and in-depth annual audits of each department in the bank. Treasury, DOJ, and federal banking regulators all have roles in implementing U.S. sanctions programs requirements relevant to financial institutions. Specifically, Treasury has primary responsibility for administering and enforcing financial sanctions, developing regulations, conducting outreach to domestic and foreign financial regulators and financial institutions, identifying sanctions violations, and assessing the effects of sanctions. Treasury and DOJ also enforce sanctions regulations by taking actions against financial institutions for violations of sanctions laws and regulations, sometimes in coordination with the federal and state banking regulators. As part of their examinations of financial institutions for BSA/AML compliance, banking regulators and SEC also review financial institutions to assess their compliance programs for sanction laws and regulations. Treasury and DOJ maintain funds and accounts for fines, penalties, and forfeitures that are collected. Expenditure of these funds is guided by statute, and Treasury and DOJ are permitted to use the revenue from their funds to pay for expenses associated with forfeiture activities. Treasury administers and maintains the Treasury General Fund and TFF. Treasury General Fund receipt accounts hold all collections that are not earmarked by law for another account for a specific purpose or presented in the President’s budget as either governmental (budget) or offsetting receipts. It includes taxes, customs duties, and miscellaneous receipts. The TFF is a multidepartmental fund that is the receipt account for agencies participating in the Treasury Forfeiture Program (see table 1).The program has four primary goals: (1) to deprive criminals of property used in or acquired through illegal activities; (2) to encourage joint operations among federal, state, and local law enforcement agencies, as well as foreign countries; (3) to strengthen law enforcement; and (4) to protect the rights of the individual. Treasury’s Executive Office for Asset Forfeiture is responsible for the management and oversight of the TFF. DOJ administers and maintains deposit accounts for the penalties and forfeitures it assesses, including the AFF and the Crime Victims Fund. The AFF is the receipt account for forfeited cash and proceeds from the sale of forfeited assets generated by the Justice Asset Forfeiture Program (see table 2). A primary goal of the Justice Asset Forfeiture Program is preventing and reducing crime through the seizure and forfeiture of assets that were used in or acquired as a result of criminal activity. The Crime Victims Fund is the receipt account for criminal fines and special assessments collected from convicted federal offenders, as well as federal revenues from certain other sources. It was established to provide assistance and grants for victim services throughout the United States. In addition, the Consolidated Appropriations Act, 2016, established a new forfeiture fund—the United States Victims of State Sponsored Terrorism Fund—to receive the proceeds of forfeitures resulting from sanctions- related violations. Specifically, the fund will be used to receive proceeds of forfeitures related to violations of the International Emergency Economic Powers Act and the Trading with the Enemy Act, as well as other offenses related to state sponsors of terrorism. Since 2009, financial institutions have been assessed about $12 billion in fines, penalties, and forfeitures for violations of BSA/AML, FCPA, and U.S. sanctions program requirements. Specifically, from January 2009 through December 2015, federal agencies assessed about $5.2 billion for BSA violations, $27 million for FCPA violations, and about $6.8 billion for violations of U.S. sanctions program requirements. Of the $12 billion, federal agencies have collected all of these assessments, except for about $100 million. The majority of the $100 million that was uncollected was assessed in 2015 and is either subject to litigation, current deliberations regarding the status of the collection efforts, or bankruptcy proceedings. From January 2009 to December 2015, DOJ, FinCEN, and federal financial regulators (the Federal Reserve, FDIC, OCC, and SEC), assessed about $5.2 billion and collected about $5.1 billion in penalties, fines, and forfeitures for various BSA violations. Financial regulators assessed a total of about $1.4 billion in penalties for BSA violations for which they were responsible for collecting, and collected almost all of this amount (see fig. 1). The amounts assessed by the financial regulators and Treasury are guided by statute and based on the severity of the violation. Based on our review of regulators’ data and enforcement orders, the federal banking regulators assessed penalties for the failure to implement or develop adequate BSA/AML programs, and failure to identify or report suspicious activity. Of the $1.4 billion, one penalty (assessed by OCC) accounted for almost 35 percent ($500 million). This OCC enforcement action was taken against HSBC Bank USA for having a long-standing pattern of failing to report suspicious activity in violation of BSA and its underlying regulations and for the bank’s failure to comply fully with a 2010 cease-and-desist order. Financial regulators assess penalties for BSA violations both independently and concurrently with FinCEN. In a concurrent action, FinCEN will jointly assess a penalty with the regulator and deem the penalty satisfied with a payment to the regulator. Out of the $1.4 billion assessed, $651 million was assessed concurrently with FinCEN to 13 different financial institutions. FinCEN officials told us that it could take enforcement actions independently, but tries to take actions concurrently with regulators to mitigate duplicative penalties. During this period, SEC also assessed about $16 million in penalties and disgorgements against broker-dealers for their failure to comply with the record-keeping and retention requirements under BSA. SEC’s penalties ranged from $25,000 to $10 million—which included a $4.2 million disgorgement. As of December 2015, SEC had collected about $9.4 million of the $16 million it has assessed. In the case resulting in a $10 million assessment, Oppenheimer & Company Inc. failed to file Suspicious Activity Reports on an account selling and depositing large quantities of penny stocks. In addition, FinCEN assessed about $108 million in penalties that it was responsible for collecting. Based on our analysis, almost all of the $108 million was assessed in 2015 of which $9.5 million has been collected as of December 2015. Of the $108 million FinCEN assessed, three large penalties totaling $93 million—including a $75 million penalty—were assessed in 2015 and, according to FinCEN officials, have not been collected due to litigation, current deliberations regarding the status of the collection efforts, or pending bankruptcy actions. FinCEN’s penalty assessments amounts ranged from $5,000 to $75 million for this period and are guided by statute and regulations, the severity of the BSA violation, and other factors. For example, in a case resulting in a $75 million penalty assessment against Hong Kong Entertainment (Overseas) Investments, FinCEN found that the casino’s weak AML internal controls led to the concealment of large cash transactions over a 4-year period. We found that institutions were assessed penalties by FinCEN for a lack of AML internal controls, failure to register as a money services business, or failure to report suspicious activity as required. Through fines and forfeitures, DOJ, in cooperation with other law enforcement agencies and often through the federal court system, collected about $3.6 billion from financial institutions from January 2009 through December 2015 (see fig. 2). Almost all of this amount resulted from forfeitures, while about $1 million was from fines. As of December 2015, $1.2 million had not been collected in the cases we reviewed. These assessments consisted of 12 separate cases and totaled about 70 percent of all penalties, fines, and forfeitures assessed against financial institutions for BSA violations. DOJ’s forfeitures ranged from about $240,000 to $1.7 billion, and six of the forfeitures were at least $100 million. According to DOJ officials, the amount of forfeiture is typically determined by the amount of the proceeds of the illicit activity. In 2014, DOJ assessed a $1.7 billion forfeiture—the largest penalty related to a BSA violation—against JPMorgan Chase Bank. DOJ cited the bank for its failure to detect and report the suspicious activities of Bernard Madoff. The bank failed to maintain an effective anti-money-laundering program and report suspicious transactions in 2008, which contributed to their customers losing about $5.4 billion in Bernard Madoff’s Ponzi scheme. For the remaining cases, financial institutions were generally assessed fines and forfeitures for failures in their internal controls over AML programs and in reporting suspicious activity. From January 2009 through December 2015, SEC collected approximately $27 million in penalties and disgorgements from two financial institutions for FCPA violations. SEC assessed $10.3 million in penalties, $13.6 million in disgorgements, and $3.3 million in interest combined for the FCPA violations. The penalties were assessed for insufficient internal controls and FCPA books and records violations. SEC officials stated the fact that they had not levied more penalties against financial institutions for FCPA violations than they had against other types of institutions may be due, in part, to financial institutions being subject to greater regulatory oversight than other industries. While DOJ and SEC have joint responsibility for enforcing FCPA requirements, DOJ officials stated that they did not assess any penalties against financial institutions during the period of our review. From January 2009 through December 2015, OFAC independently assessed $301 million in penalties against financial institutions for sanctions programs violations.The $301 million OFAC assessed was comprised of 47 penalties, with penalty amounts ranging from about $8,700 to $152 million. Of the $301 million, OFAC has collected about $299 million (see fig. 3). OFAC’s enforcement guidelines provide the legal framework for analyzing apparent violations. Some of the factors which determine the size of a civil money penalty include the sanctions program at issue and the number of apparent violations and their value. For example, OFAC assessed Clearstream Banking a $152 million penalty because it made securities transfers for the central bank of a sanctioned country. DOJ, along with participating Treasury offices and other law enforcement partners, assessed and enforced criminal and civil forfeitures and fines totaling about $5.7 billion for the federal government for sanctions programs violations. This amount was the result of eight forfeitures that also included two fines. Of the $5.7 billion collected for sanctions programs violations, most of this amount was collected from one financial institution—BNP Paribas. In total, BNP Paribas was assessed an $8.8 billion forfeiture and a $140 million criminal fine in 2014 for willfully conspiring to commit violations of various sanctions laws and regulations. BNP Paribas pleaded guilty to moving more than $8.8 billion through the U.S. financial system on behalf of sanctioned entities from 2004 to 2012. Of the $8.8 billion forfeited, $3.8 billion was collected by Treasury’s Executive Office for Asset Forfeiture, with the remainder apportioned among participating state and local agencies. In addition to BNP Paribas, DOJ and OFAC assessed fines and forfeitures against other financial institutions for similar violations, including processing transactions in violation of the International Emergency Economic Powers Act, OFAC regulations, and the Trading with the Enemy Act. From January 2009 through December 2015, the Federal Reserve independently assessed and collected about $837 million in penalties from six financial institutions for U.S. sanctions programs violations. The Federal Reserve assessed its largest penalty for $508 million against BNP Paribas for having unsafe and unsound practices that failed to prevent the concealing of payment information of financial institutions subject to OFAC regulations. It was assessed as part of a global settlement with DOJ for concealing payment information of a financial institution subject to OFAC regulations. Federal Reserve officials stated that the remaining assessed penalties related to OFAC regulations were largely for similar unsafe and unsound practices. FinCEN and financial regulators have processes in place for receiving penalty payments from financial institutions—including for penalties assessed for the covered violations—and for depositing these payments. These payments are deposited into accounts in Treasury’s General Fund and are used for the general support of federal government activities. From January 2009 through December 2015, about $2.7 billion was collected from financial institutions for the covered violations and deposited into Treasury General Fund accounts. DOJ and Treasury also have processes in place for collecting forfeitures, fines, and penalties related to BSA and sanctions violations. Depending on which agency seizes the assets, forfeitures are generally deposited into two accounts— either DOJ’s AFF or Treasury’s TFF. From January 2009 through December 2015, about $3.2 billion was deposited into the AFF and $5.7 billion into the TFF, of which $3.8 billion related to a sanctions case was rescinded in the fiscal year 2016 appropriation legislation. Funds from the AFF and TFF are primarily used for program expenses, payments to third parties—including the victims of the related crimes—and equitable sharing payments to law enforcement agencies that participated in the efforts resulting in forfeitures. For the cases in our review, as of December 2015, DOJ and Treasury had distributed about $1.1 billion in payments to law enforcement agencies and approximately $2 billion is planned to be distributed to victims of crimes. The remaining funds from these cases are subject to general rescissions to the AFF and TFF or may be used for program or other law enforcement expenses. DOJ officials stated that DOJ determines criminal fines on a case-by-case basis, in consideration of the underlying criminal activity and in compliance with relevant statutes. FinCEN and financial regulators deposit collections of penalties assessed against financial institutions—including for the covered violations—into Treasury’s General Fund accounts (see fig. 4). FinCEN deposits the penalty payments it receives in accounts in Treasury’s General Fund. First, FinCEN sends financial institutions a signed copy of the final consent order related to the enforcement action it has taken along with instructions on how and when to make the penalty payment. Then, Treasury’s Bureau of Fiscal Service (BFS) collects payments from financial institutions, typically through a wire transfer. OFAC officials explained that BFS also collects and tracks, on behalf of OFAC, payments for civil money penalties that OFAC assesses. BFS periodically notifies OFAC via e-mail regarding BFS’s receipt of payments of the assessed civil monetary penalties. FinCEN officials said that its Financial Management team tracks the collection of their penalties by comparing the amount assessed to Treasury’s Report on Receivables, which shows the status of government-wide receivables and debt collection activities and is updated monthly. Specifically, FinCEN staff compares their penalty assessments with BFS’s collections in Treasury’s Report on Receivables to determine if a penalty payment has been received or is past due. Once Treasury’s BFS receives payments for FinCEN- and OFAC-assessed penalties, BFS staff deposits the payments into the appropriate Treasury General Fund accounts. Financial regulators also have procedures for receiving and depositing these collections into Treasury’s General Fund accounts, as the following examples illustrate: SEC keeps records of each check, wire transfer, or online payment it receives, along with a record of the assessed amount against the financial institution, the remaining balance, and the reasons for the remaining balance, among other details related to the penalty. For collections we reviewed from January 2009 to December 2015 for BSA and FCPA violations, SEC had deposited all of them into a Treasury General Fund receipt account. Upon execution of an enforcement action involving a penalty, the Enforcement and Compliance Division within OCC sends a notification of penalties due to OCC’s Office of Financial Management. When the Office of Financial Management receives a payment for a penalty from a financial institution, it compares the amount with these notifications. The Office of Financial Management records the amount received and sends a copy of the supporting documentation (for example, a wire transfer or check) to the Enforcement and Compliance Division. OCC holds the payment in a civil money penalty account—an account that belongs to and is managed by OCC—before it deposits the payment in a Treasury General Fund receipt account on a monthly basis. The Federal Reserve directs financial institutions to wire their penalty payment to the Federal Reserve Bank of Richmond (FRBR). The Federal Reserve then verifies that the payment has been made in the correct amount to FRBR, and when it is made, FRBR distributes the penalty amount received to a Treasury General Fund receipt account. Federal Reserve officials explained that when they send the penalty to Treasury, they typically e-mail Treasury officials to verify that they have received the payment. They noted that when Treasury officials receive the penalty payment, they send a verification e-mail back to the Federal Reserve. According to officials, to keep track of what is collected and sent to the Treasury General Fund, FRBR retains statements that document both the collection and transfer of the penalty to a Treasury General Fund receipt account. FDIC has similar processes in place for collecting penalties related to BSA violations. When enforcement orders are executed, financial institutions send all related documentation (the stipulation for penalty payment, the order, and the check in the amount of the penalty payment) to FDIC’s applicable regional office Legal Division staff, which in turn sends the documentation to Legal Division staff in Washington, D.C. If the payment is wired, FDIC compares the amount wired to the penalty amount to ensure that the full penalty is paid. If the payment is a check, FDIC officials make sure the amount matches the penalty, document receipt of the payment in an internal payment log, and then send the check to FDIC’s Department of Finance. Once a quarter, FDIC sends penalty payments it receives to a Treasury General Fund receipt account. In addition to the processes we discuss in this report for penalty collections, SEC, Federal Reserve, OCC, and FDIC all have audited financial statements that include reviews of general internal controls over agency financial reporting, including those governing collections. From January 2009 through December 2015, FinCEN, OFAC, and financial regulators collected in total about $2.6 billion from financial institutions for the covered violations but they did not retain any of the penalties they collected. Instead, the collections were deposited in Treasury General Fund accounts and used to support various federal government activities. Officials from these agencies stated that they have no discretion over the use of the collections, which must be transmitted to the Treasury. Once agencies deposit their collections into the Treasury General Fund, they are unable to determine what subsequently happens to the money, since it is commingled with other deposits. Treasury Office of Management officials stated that the collections deposited into the General Fund accounts are used according to the purposes described in Congress’s annual appropriations. More specifically, once a penalty collection is deposited into a receipt account in the Treasury General Fund, only an appropriation by Congress can begin the process of spending these funds. Appropriations from Treasury General Fund accounts are amounts appropriated by law for the general support of federal government activities. The General Fund Expenditure Account is an appropriation account established to record amounts appropriated by law for the subsequent expenditure of these funds, and includes spending from both annual and permanent appropriations. Treasury Office of Management officials explained that the Treasury General Fund has a general receipt account that receives all of the penalties that regulators and Treasury agencies collect for BSA, FCPA, and sanctions violations. Treasury officials explained that to ensure that the proper penalty amounts are collected, Treasury requires agency officials to reconcile the amount of deposits recorded in their general ledger to corresponding amounts recorded in Treasury’s government- wide accounts. If Treasury finds a discrepancy between the General Ledger and the government-wide accounts, it sends the specific agency a statement asking for reconciliation. Treasury’s Financial Manual provides agencies with guidance on how to reconcile discrepancies and properly transfer money to the general receipt account. Treasury officials explained that they cannot associate a penalty collected for a specific violation with an expense from the General Fund as collections deposited in General Fund accounts are comingled. Forfeitures—including those from financial institutions for violations of BSA/AML and U.S. sanctions programs requirements—are deposited into three accounts depending in part on the agency seizing the assets (DOJ and other law enforcement agencies use the AFF, Treasury and the Department of Homeland Security use the TFF, and U.S. Postal Inspection Service uses the Postal Service Fund). In the cases we reviewed, financial institutions forfeited either cash or financial instruments, which were generally deposited into the AFF or the TFF. Figure 5 shows the processes that govern the seizure and forfeiture of assets for the Justice Asset Forfeiture Program and the Treasury Forfeiture Program. The Justice Asset Forfeiture Program and the Treasury Forfeiture Program follow similar forfeiture processes. Under the Justice Asset Forfeiture Program, a DOJ investigative agency seizes an asset (funds in the cases we reviewed), and the asset is entered into DOJ’s Consolidated Asset Tracking System. The asset is then transferred to the U.S. Marshals Service for deposit into the Seized Asset Deposit Fund. The U.S. Attorney’s Office or the seizing agency must provide notice to interested parties and conduct Internet publication prior to entry of an administrative declaration of forfeiture or a court-ordered final order of forfeiture. Once the forfeiture is finalized, the seizing agency or the U.S. Attorney’s Office enters the forfeiture information into the Consolidated Asset Tracking System. U.S. Marshals Service subsequently transfers the asset from the Seized Asset Deposit Fund to the AFF. Similarly, the asset forfeiture process for the Treasury Forfeiture Program involves a Department of Homeland Security or Treasury investigative agency seizing the asset (funds, in the cases we reviewed). The seizing agency takes custody of the asset, enters the case into their system of record, and transfers the asset to the Treasury Suspense Account. Once forfeiture is final, the seizing agency subsequently requests that Treasury’s Executive Office for Asset Forfeiture staff transfer the asset from the Treasury Suspense Account to the TFF. According to Treasury’s Executive Office for Asset Forfeiture staff, each month, TFF staff compares deposits in the TFF with records from seizing agencies to review whether the amounts are accurately recorded. From January 2009 through December 2015, for the cases we reviewed, nine financial institutions forfeited about $3.2 billion in funds through the Justice Asset Forfeiture Program due to violations of BSA/AML and U.S. sanctions programs requirements. AFF expenditures are governed by the law establishing the AFF, as we have previously reported. Specifically, the AFF is primarily used to pay the forfeiture program’s expenses in three major categories: 1. program operations expenses in 13 expenditure categories such as asset management and disposal, storage and destruction of drugs, and investigative expenses leading to a seizure; 2. payments to third parties, including payments to satisfy interested parties such as owners or lien holders, as well as the return of funds to victims of crime; and 3. equitable sharing payments to state and local law enforcement agencies that participated in law enforcement efforts resulting in the forfeitures. In addition, after DOJ obligates funds to cover program expenses, any AFF funds remaining at the end of a fiscal year may be declared an excess unobligated balance and used for any of DOJ’s authorized purposes, including helping to cover rescissions. Court documents and DOJ data indicate that forfeitures from the Justice Asset Forfeiture Program cases we reviewed will be used to compensate victims and have been used to make equitable sharing payments. Although DOJ data showed that DOJ has not yet remitted payments to any victims in the cases we reviewed, court documents and comments from DOJ officials indicated that approximately $2 billion of the forfeited funds deposited in the AFF would be remitted to victims of fraud. For example, according to Asset Forfeiture and Money Laundering Section officials, DOJ has set up the Madoff Victim Fund in part from the related $1.7 billion forfeited by JPMorgan Chase to collect and review victim claims related to the Ponzi scheme operated by Bernard Madoff. DOJ intends to distribute the funds to eligible victims of Madoff’s fraud. Additionally, DOJ data for seven cases showed that it had made approximately $660 million in equitable sharing payments. From January 2009 through December 2015, for the cases we reviewed, seven financial institutions forfeited about $5.7 billion in funds due to violations of BSA/AML and U.S. sanctions programs requirements through the Treasury Forfeiture Program. These forfeitures have been deposited in the TFF and can be used for certain purposes as specified by law. In the cases we identified, all seized and forfeited assets were cash. TFF expenditures are governed by the law establishing the TFF and, as we have previously reported, are primarily used to pay the forfeiture program’s expenses in major categories including program operation expenses, payments to third parties including crime victims, equitable sharing payments to law enforcement partners, and other expenses. Of the $5.7 billion contained in the TFF, the $3.8 billion paid by BNP Paribas as part of the bank’s settlement with DOJ was permanently rescinded from the TFF and is unavailable for obligation. The remaining funds, if not subject to general rescissions, can be used for a variety of purposes. As of December 2015, DOJ was considering using approximately $310 million in TFF forfeitures for victim compensation and, according to Treasury officials, Treasury had made approximately $484 million in equitable sharing payments and obligated a further $119 million for additional equitable sharing payments. As with the AFF, after Treasury obligates funds to cover program expenses, any TFF funds remaining at the end of a fiscal year, if not rescinded, may be declared an excess unobligated balance. These funds can be used to support a variety of law enforcement purposes, such as enhancing the quality of investigations. DOJ has litigated court cases against financial institutions for criminal violations of BSA/AML and U.S. sanctions programs requirements resulting in criminal fines ordered by the federal courts. According to DOJ officials, DOJ determines criminal fines on a case-by-case basis, in consideration of the underlying criminal activity and in compliance with relevant statutes. Court documents, such as court judgments and plea agreements, communicate the amount of the criminal fine to the financial institution. DOJ U.S. Attorneys’ Offices are primarily responsible for collecting criminal fines. They begin the collection process by issuing a demand letter to the financial institution. Upon receipt of the demand letter, the financial institution makes the payment to the Clerk of the Courts. According to officials from the Administrative Office of the U.S. Courts, the Clerk of the Courts initially collects the payments which are deposited into a Treasury account for DOJ’s Crime Victims Fund. Funds in the Crime Victims Fund can be used for authorized purposes including support of several state and federal crime victim assistance–related grants and activities, among other things. DOJ officials told us that all criminal fines, with a few exceptions, are deposited into the Crime Victims Fund. This may include criminal fines related to violations of BSA/AML requirements and U.S. sanctions regulations. In the cases we identified from January 2009 through December 2015, the court ordered about $141 million in criminal fines for violations of BSA/AML and U.S. sanctions programs requirements. The $140 million fine assessed against BNP Paribas was deposited into the Crime Victims Fund. Additionally, in the cases we reviewed, DOJ had litigated a court case against a financial institution for civil violations of U.S. sanctions programs requirements which resulted in a civil penalty. The civil penalty collection process is similar to the criminal fine collection process, but the financial institution makes the payment to DOJ’s accounts in the Treasury General Fund instead of to the Clerk of the Courts. As previously discussed in this report, monies in the Treasury General Fund are used according to the purposes described in Congress’s annual appropriations. Civil penalties are also eligible to be assessed up to a 3 percent fee for disbursement to DOJ’s Three Percent Fund, which is primarily used to offset DOJ expenses related to civil debt collection. Of the cases we identified, one case involved a civil penalty of $79 million against Commerzbank for violating U.S. sanctions program requirements. DOJ collected the Commerzbank civil penalty, deposited it into DOJ’s accounts in the Treasury General Fund, and assessed a nearly 3 percent fee (about $2.3 million) that was deposited into the Three Percent Fund. We provided a draft of this report to Treasury, DOJ, SEC, OCC, FDIC, and the Federal Reserve for review and comment. Treasury, DOJ, OCC, FDIC, and the Federal Reserve provided technical comments, which we incorporated as appropriate. As agreed with your offices, unless you publicly announce the contents of this report earlier, we plan no further distribution until 30 days from the report date. At that time, we will send copies to Treasury, DOJ, SEC, OCC, FDIC, and the Federal Reserve, and interested congressional committees and members. In addition, the report will be available at no charge on the GAO website at http://www.gao.gov. If you or your staffs have any questions about this report, please contact Lawrance Evans at (202) 512-8678 or evansl@gao.gov or Diana C. Maurer at (202) 512-9627 or maurerd@gao.gov. Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this report. GAO staff who made major contributions to this report are listed in appendix II. This report describes the fines, penalties, and forfeitures federal agencies have collected from financial institutions for violations of Bank Secrecy Act and related anti-money-laundering requirements (BSA/AML), Foreign Corrupt Practices Act of 1977 (FCPA), and U.S. sanctions programs requirements. Specifically, our objectives in this report were to describe (1) the amount of fines, penalties, and forfeitures that the federal government has collected for these violations from January 2009 through December 2015; and (2) the process for collecting these funds and the purposes for which they are used. To address these objectives, we reviewed prior GAO and Office of the Inspector General reports and relevant laws and regulations. We also reviewed data and documentation and interviewed officials from key agencies responsible for implementing and enforcing BSA/AML, FCPA, and U.S. sanctions programs requirements. The agencies and offices included in this review were: (1) offices within the Department of the Treasury’s (Treasury) Office of Terrorism and Financial Intelligence, including officials from the Financial Crimes Enforcement Network (FinCEN), Office of Foreign Assets Control (OFAC), and Treasury Executive Office for Asset Forfeiture, and Treasury’s Office of Management; (2) Securities and Exchange Commission (SEC); (3) the federal banking regulators—Board of Governors of the Federal Reserve System (Federal Reserve), Federal Deposit Insurance Corporation (FDIC), National Credit Union Administration (NCUA), and the Office of the Comptroller of the Currency (OCC); and (4) the Department of Justice (DOJ). To respond to our first objective, we identified and analyzed these agencies’ data on enforcement actions taken against financial institutions that resulted in fines, penalties, or forfeitures for violations of BSA/AML, FCPA, and U.S. sanctions programs requirements. Specifically, we analyzed publicly available data from January 2009 through December 2015 on penalties assessed against financial institutions by the Federal Reserve, FDIC, OCC, SEC, and the Financial Crimes Enforcement Network (FinCEN), a bureau within Treasury, for violations of BSA/AML requirements. NCUA officials we spoke with explained that they had not assessed any penalties against financial institutions for violations of BSA/AML requirements from January 2009 through December 2015. FDIC and SEC provided us with a list of enforcement actions they took for BSA/AML violations since 2009, as we were not able to identify all of their actions through their publicly available data. We also reviewed Federal Reserve data on penalties for violations of U.S. sanctions programs requirements and data that SEC provided on FCPA violations. In addition, we reviewed enforcement actions listed on Treasury’s Office of Foreign Assets Control (OFAC) website to identify penalties assessed against financial institutions for violations of U.S. sanctions programs requirements enforced by OFAC. To identify enforcement actions taken against financial institutions from the actions listed on OFAC’s website, we applied Treasury’s definition of financial institutions, which covers regulated entities in the financial industry. To identify criminal cases against financial institutions for violations of BSA and sanctions-related requirements, we reviewed press releases from DOJ’s Asset Forfeiture and Money Laundering Section, associated court documents, and enforcement actions taken against financial institutions from the actions listed on OFAC’s website (see table 3 for a list of these cases). We developed this approach in consultation with DOJ officials as their data system primarily tracks assets forfeited by the related case, which can include multiple types of violations, rather than by a specific type of violation, such as BSA or sanctions-related violations. Therefore, this report does not cover the entire universe of such criminal cases as they may not have all been publicized through this channel. However, this approach does include key cases for the period under our review that involved large amounts of forfeitures. We obtained data from DOJ’s Consolidated Asset Tracking System to determine the amounts forfeited for these cases, and verified any Treasury-related data in DOJ’s system by obtaining information from the Treasury Executive Office for Asset Forfeiture. DOJ had not brought any criminal cases against financial institutions for violations of FCPA. We assessed the reliability of the data we used in this report by reviewing prior GAO assessments of these data, interviewing knowledgeable agency officials, and reviewing relevant documentation, such as agency enforcement orders for the assessments. To verify that these amounts had been collected, we requested verifying documentation from agencies confirming that these assessments had been collected, and also obtained and reviewed documentation for a sample of the data to verify that the amount assessed matched the amount collected. As a result, we determined that these data were sufficiently reliable for our purposes. We also assessed the reliability of the DOJ data fields we reported on by reviewing prior GAO and DOJ evaluations of these data and interviewing knowledgeable officials from DOJ. We determined that these data were also sufficiently reliable for our report. To respond to our second objective—to describe how funds for violations of BSA/AML, FCPA, and U.S. sanctions programs requirements were collected—we identified and summarized documentation of the various steps and key agency internal controls for collection processes, such as procedures for how financial institutions remit payments. We also obtained documentation, such as statements documenting receipt of a penalty payment, for a sample of penalties. We interviewed officials from each agency about the process used to collect payments for assessed fines or penalties and, for relevant agencies, the processes for collecting cash and assets for forfeitures and where funds were deposited. To describe how these collections were used, we reviewed documentation on the types of expenditures that can be authorized from the accounts and funds they are deposited in. Specifically, we obtained documentation on the authorized or allowed expenditures for accounts in the Treasury General Fund, Treasury Forfeiture Fund (TFF), and DOJ’s Assets Forfeiture Fund (AFF) and Crime Victims Fund. We also reviewed relevant GAO and Office of Inspector General reports, and laws governing the various accounts. We conducted this performance audit from July 2015 to March 2016 in accordance with generally accepted government auditing standards. Those standards require that we plan and perform the audit to obtain sufficient, appropriate evidence to provide a reasonable basis for our findings and conclusions based on our audit objectives. We believe that the evidence obtained provides a reasonable basis for our findings and conclusions based on our audit objectives. In addition to the contacts named above, Allison Abrams (Assistant Director), Tarek Mahmassani (Analyst-in-Charge), Bethany Benitez, Chloe Brown, Emily R. Chalmers, Chuck Fox, Tonita Gillich, Thomas Hackney, Valerie Kasindi, Dawn Locke, Jeremy Manion, Joshua Miller, John Mingus, and Jena Sinkfield made significant contributions to this report.

Summary: Over the last few years, billions of dollars have been collected in fines, penalties, and forfeitures assessed against financial institutions for violations of requirements related to financial crimes. These requirements are significant tools that help the federal government detect and disrupt money laundering, terrorist financing, bribery, corruption, and violations of U.S. sanctions programs. GAO was asked to review the collection and use of these fines, penalties, and forfeitures assessed against financial institutions for violations of these requirements—specifically, BSA/AML, FCPA, and U.S. sanctions programs requirements. This report describes (1) the amounts collected by the federal government for these violations, and (2) the process for collecting these funds and the purposes for which they are used. GAO analyzed agency data, reviewed documentation on agency collection processes and on authorized uses of the funds in which collections are deposited, and reviewed relevant laws. GAO also interviewed officials from Treasury (including the Financial Crimes Enforcement Network and the Office of Foreign Assets Control), Securities and Exchange Commission, Department of Justice, and the federal banking regulators. GAO is not making recommendations in this report. Since 2009, financial institutions have been assessed about $12 billion in fines, penalties, and forfeitures for violations of Bank Secrecy Act/anti-money- laundering regulations (BSA/AML), Foreign Corrupt Practices Act of 1977 (FCPA), and U.S. sanctions programs requirements by the federal government. Specifically, GAO found that from January 2009 to December 2015, federal agencies assessed about $5.2 billion for BSA/AML violations, $27 million for FCPA violations, and about $6.8 billion for violations of U.S. sanctions program requirements. Of the $12 billion, federal agencies have collected all of these assessments, except for about $100 million. Collections of Fines, Penalties, and Forfeitures from Financial Institutions for Violations of Bank Secrecy Act/Anti-Money Laundering, Foreign Corrupt Practices Act, and U.S. Sanctions Programs Requirements, Assessed in January 2009–December 2015 Agencies have processes for collecting payments for violations of BSA/AML, FCPA, and U.S. sanctions programs requirements and these collections can be used to support general government and law enforcement activities and provide payments to crime victims. Components within the Department of the Treasury (Treasury) and financial regulators are responsible for initially collecting penalty payments, verifying that the correct amount has been paid, and then depositing the funds into Treasury's General Fund accounts, after which the funds are available for appropriation and use for general support of the government. Of the approximately $11.9 billion collected, about $2.7 billion was deposited into Treasury General Fund accounts. The BSA and U.S. sanctions-related criminal cases GAO identified since 2009 resulted in the forfeiture of almost $9 billion through the Department of Justice (DOJ) and Treasury. Of this amount, about $3.2 billion was deposited into DOJ's Asset Forfeiture Fund (AFF) and $5.7 billion into the Treasury Forfeiture Fund (TFF), of which $3.8 billion related to a sanctions case was rescinded in fiscal year 2016 appropriations legislation. Funds from the AFF and TFF are primarily used for program expenses, payments to third parties, including the victims of the related crimes, and payments to law enforcement agencies that participated in the efforts resulting in forfeitures. As of December 2015, DOJ and Treasury had distributed about $1.1 billion to law enforcement agencies and about $2 billion was planned for distribution to crime victims. Remaining funds from these cases are subject to general rescissions to the TFF and AFF or may be used for program or other law enforcement expenses.