Private banking has been broadly defined as financial and related services provided to wealthy clients. It is difficult to measure precisely how extensive private banking is in the United States, partly because the area has not been clearly defined and partly because financial institutions do not consistently capture or publicly report information on their private banking activities. We do know, however, that domestic and foreign banks operating in the United States have been increasing their private banking activities and their reliance on income from private banking. The target market for private banking—individuals with high net worth—is also growing and becoming more sophisticated with regard to their product preferences and risk appetites. of the largest monetary penalty ever imposed on a bank in a money laundering-related case. More recent investigations of private bankers at Citibank and BankBoston continue to keep private banking in the forefront of public attention. Such cases, which can involve the illicit transfer of millions of dollars, underscore the crucial importance of private banking and its potential vulnerability to money laundering. Federal banking regulators may review banks’ efforts to prevent or detect money laundering in their private banking activities during examinations,including recent examinations focused on their private banking activities. During these examinations, regulators focus on a bank’s compliance program; internal controls; and, in particular, on its KYC policies. Regulators instruct their examiners to determine whether banks have implemented sound KYC policies in general and to ensure that these policies extend to their private banking activities. Until recently, U.S. regulators were attempting to incorporate KYC requirements as uniform regulations. However, the proposed KYC regulation, which was published for comment in December 1998, was met with an overwhelming public response that raised concerns about the government’s scrutiny of personal banking accounts. In the face of these concerns, U.S. regulators have since withdrawn the proposed regulations. Nevertheless, regulators we interviewed for this statement told us that, during the course of examinations, they continue to verify that banks have prudent banking policies, including KYC policies, that ensure compliance with the Bank Secrecy Act. Although regulatory efforts to establish uniform KYC requirements have stopped, Congress continues to look for ways to reinforce current anti- money-laundering laws and, more specifically, to promote due diligence in customer banking relationships. For example, the Chairman of the House Committee on Banking and Financial Services recently introduced legislation that would, among other things, require financial institutions that open or maintain a U.S. account for a non-publicly-traded foreign entity to maintain a record of identity for each beneficial owner of the account. The legislation would also prohibit U.S. depository institutions from maintaining banking relationships with banks that are not licensed to provide services in their home countries. The growing importance of private banking over the last several years led the Federal Reserve Bank of New York (FRBNY) to undertake a special initiative focusing on private banking that disclosed a number of key weaknesses in selected institutions’ internal controls for detecting or preventing money laundering. In 1996 and 1997, FRBNY attempted to review private banking activities at about 40 domestic and foreign banking institutions in the New York district. During the course of these reviews, examiners focused on assessing each bank’s ability to recognize and manage money laundering risks associated with inadequate knowledge of its clients’ personal and business backgrounds, their sources of wealth, and their use of their private banking accounts. FRBNY officials explained to us that most of the banks reviewed had adequate anti-money-laundering programs for their private banking activities, although a few were antiquated and vulnerable to money laundering. Deficiencies identified in the private banking area primarily involved poor internal controls, such as insufficient documentation and inadequate due diligence standards. In a systemwide study conducted during 1998, the Federal Reserve assessed the risk management practices at seven banks with private banking activities. The study found that internal controls and oversight practices over private banking activities were generally strong at banks that focused on high-end domestic clients, while similar controls and oversight practices were seriously weak at banks that focused on higher risk Latin American and Caribbean clients. In the latter part of 1997, the Office of the Comptroller of the Currency began targeting national banks’ private banking activities based on law enforcement leads or on the bank activities meeting OCC’s high-risk criteria. A primary focus of these reviews has been the banks’ implementation of sound KYC policies and procedures. In these reviews, OCC targeted 10 high risk national banks for expanded Bank Secrecy Act examinations, three of which focused on the banks’ private banking activities. OCC found that only one bank had diligently developed processes to manage the risks associated with anti-money-laundering and KYC issues, while the anti-money-laundering processes of the remaining two banks were classified as weak or needing improvement. A second major area for our work was regulatory efforts to oversee offshore private banking activities, including the types of procedures regulators use and the deficiencies they have identified during examinations. Federal banking regulators and law enforcement officials have raised concerns about offshore private banking activities and their potential to be the private banking “soft spot” for money laundering. Although banking regulators believe that customers generally use offshore entities to establish or maintain private banking accounts for legitimate reasons, they are concerned that this practice may also serve to camouflage money laundering and other illegal acts. Offshore entities, including private investment companies and offshore trusts, provide customers with a high degree of confidentiality and anonymity while offering such other benefits as tax advantages, limited legal liability, and ease of transfer. Detecting or preventing money laundering by offshore entities can pose special difficulties because documentation identifying the individual or group that controls these offshore entities and their U.S. private banking accounts (referred to as their “beneficial owners”) is frequently maintained in the offshore jurisdiction rather than in the United States. Regulators recognize that the use of offshore entities to establish or maintain U.S. private banking accounts tends to obscure the account holders’ true identities. Consequently, they instruct their examiners to look for specific KYC procedures that enable banks to identify and profile the beneficial owners of these offshore entities. In the course of examinations, examiners may test the adequacy of beneficial-owner documentation maintained in the United States. At the time of our earlier review in 1998, with the exception of FRBNY, we found no evidence that examiners had attempted to examine the documentation that banks maintain in offshore secrecy jurisdictions. also a way to induce banks to develop or improve their systems for maintaining appropriately detailed information on the beneficial owners of offshore entities that maintain U.S. accounts. Other Federal Reserve and OCC examiners we contacted in 1998 expressed different views about accessing such documentation during examinations. Some examiners, for example, said that they do not see a need to examine offshore documents if they are confident about the bank’s commitment to combating money laundering. Since that time, according to a Federal Reserve official, its examiners have routinely attempted to examine documents maintained in offshore jurisdictions. Offshore branches are extensions of U.S. banks and are subject to supervision by U.S. regulators, primarily the Federal Reserve or OCC, as well as host countries. However, such branches are generally not subject to this country’s Bank Secrecy Act. For this reason, U.S. banking regulators do not attempt to determine whether offshore branches are in compliance with specific anti-money-laundering provisions contained in the Bank Secrecy Act, such as the one requiring that suspicious transactions be reported to U.S. authorities. Instead of monitoring formal compliance, U.S. banking regulators try to identify what efforts the branches are making to combat money laundering and to determine whether the banks’ corporate KYC policies are being applied to activities, such as private banking activities, that the offshore branches may engage in. Although examiners are able to review the written policies and procedures being used in these branches, they must rely primarily on the banks’ internal audit functions to verify that the procedures are actually being implemented in offshore branches where U.S. regulators may be precluded from conducting on-site examinations. They may also rely on external audits, but are less prone to do so because external audits tend to focus on financial, rather than anti-money-laundering, issues. beneficial owners of these offshore entities, maintaining such information in clients’ U.S. files, or having the ability to bring it on-shore in a reasonable amount of time, promotes sound private banking practices, according to the Federal Reserve. Our review in 1998 of FRBNY and OCC examinations found that examiners identified a number of general private banking deficiencies that also pertained to the banks’ offshore private banking activities. Two such deficiencies were inadequate client profiles and weak management information systems. For example, examiners found that some banks’ client profiles contained little or no documentation on the client’s background, source of wealth, or expected account activity, or on client contacts and visits by bank representatives. Examiners also found that some banks’ management information systems did not track client activity or did not allow bankers to systematically examine all accounts related to a given client. Both of these deficiencies make it difficult for banks to monitor clients’ accounts for unusual or suspicious activity, according to the banking regulators. At the time of our review in 1998, we noted that most banks with deficiencies identified during FRBNY’s private banking initiative had started to take corrective actions to address these deficiencies. For example, during follow-up examinations, examiners found that banks had started to make progress on improving client profiles. Some bank officials we interviewed during this assignment expressed concerns that securities brokers and dealers are not subject to the same regulations covering suspicious activity reports or to the same regulatory reviews of KYC policies that banks are subject to. They indicated that this inconsistency creates an “uneven playing field” that they felt was unfair, particularly since brokers and dealers are engaged in private banking activities similar to those of the banks themselves. Officials from the Securities and Exchange Commission and Treasury’s Financial Crimes Enforcement Network have indicated that they have been working together since 1997 to develop regulations for brokers and dealers regarding suspicious activity reports. As of October 1999, however, such regulations had not yet been issued. The third major area for our work was barriers to regulators’ efforts to oversee offshore banking activities in general. We found that secrecy laws in many offshore jurisdictions represent key barriers to U.S. oversight of offshore banking activities. According to U.S. and international agencies and organizations, all of the 20 offshore jurisdictions we reviewed have secrecy laws that protect the privacy of individual account owners, and 16 of them impose criminal sanctions for breaking those laws. While secrecy laws are intended to preserve the privacy of bank customers, they also restrict U.S. regulators from accessing individual account information and often prevent regulators from conducting on-site examinations at U.S. bank branches in offshore jurisdictions. In our earlier work in 1998, we reviewed nine jurisdictions in depth because of their private banking activities. Updated information on these nine jurisdictions showed that five would allow U.S. regulators to conduct on-site examinations of banking institutions in their jurisdictions and that only two of these five would provide some access to individual bank account information. Each of the jurisdictions had secrecy laws to protect the privacy of individual account owners. However, some jurisdictions provided for an exception to their secrecy laws when criminal investigations were involved. We were told that these jurisdictions had established judicial processes through which U.S. and other foreign law enforcement officials could obtain access to individual bank account or customer information. However, U.S. law enforcement officials we contacted expressed concerns about the difficulty they have in obtaining information from offshore secrecy jurisdictions, including those with established judicial processes. They noted, for example, that it can take an inordinate amount of time to obtain information requested through mutual legal assistance treaties. international anti-money-laundering efforts. However, the report notes that (1) a more aggressive legislative approach is needed to address the conditions that encourage a destabilizing level of capital flight and money laundering, and (2) Russia supervises its banks poorly. Details on the 20 jurisdictions are presented in attachment I. U.S. banking regulators are attempting to work around barriers created by offshore secrecy laws, but limitations hamper their efforts. For example, a limitation in some jurisdictions is that since regulators have been precluded from conducting on-site examinations, they rely primarily on banks’ internal audits to determine how well KYC policies and procedures are being applied to offshore branches of U.S. banks. Our 1998 review of examination reports, however, found several instances in which examiners noted that the bank’s internal audit of the offshore branch inadequately covered KYC issues pertaining to its private banking activities at these branches. Regulators’ reliance on internal audits for overseeing offshore branches is also impeded by their inability to review banks’ internal audit workpapers in some offshore jurisdictions that require that such workpapers be kept in the jurisdiction. Examiners explained that, without access to supporting audit workpapers, it is difficult to verify that audit programs were followed and to assess the general quality of internal audits of offshore branches. Also, without access to bank documents or internal audit workpapers, it is difficult to explain to bank management the basis for regulatory concerns about particular activities conducted in their offshore branches. All but 1 of the 20 offshore jurisdictions we reviewed were engaged in some type of anti-money-laundering activities. Twelve of the 20 jurisdictions were members of either the Basle Committee on Banking Supervision or the Offshore Group of Banking Supervisors, two international groups formed to foster cooperation among banking supervisory authorities. Both of these groups place special emphasis on the on-site monitoring of banks to ensure, for example, that they have effective KYC policies. Sixteen of the 20 offshore jurisdictions were also members of the Financial Action Task Force, the Caribbean Financial Action Task Force, or the Council of Europe Select Committee on Money Laundering, three international task forces created to develop and promote anti-money-laundering policies. (See attachment II.) Membership in any of these three task forces implies that the jurisdiction has stated its intention to work towards the task force’s principles and recommendations, including those related to establishing KYC policies and policies on reporting suspicious transactions. It is important to point out that membership in these task forces does not necessarily mean that these principles and recommendations are adequately being followed by the jurisdiction’s financial institutions or monitored by its government authorities. The State Department’s International Narcotics Control Strategy Report (INCSR) for 1998, for one, identifies 11 of the 20 offshore jurisdictions as having weak or nonexistent regulatory supervisory structures. Attachment III provides information on the 20 jurisdictions’ anti-money-laundering practices and the State Department’s classification of the extent to which the jurisdictions may be vulnerable to money laundering. Several challenging questions confront U.S. policymakers and others involved in ongoing domestic and international efforts to combat money laundering through offshore banking activities. A number of these questions are specific to offshore private banking activities of banks and offshore banking in general. Despite the recent anti-money-laundering activities of some key offshore jurisdictions, one central question is whether secrecy laws will continue to represent barriers to U.S. and other foreign regulators. A number of related questions follow from this question. For example, do the offshore jurisdictions that have enacted new money laundering laws have the regulatory infrastructure and adequate regulatory and law enforcement personnel to enforce the new laws? Another key question with important implications is how effective are the efforts of international task forces and supervisory groups to combat money laundering. A related question is what needs to be done to ensure that offshore jurisdictions give sufficient emphasis to preventing and detecting money laundering. An equally important, if narrower, question that grows out of the GAO work described here is what needs to be done to ensure that offshore jurisdictions allow the U.S. and other foreign governments adequate access to information needed for supervisory and law enforcement purposes. Other questions remain, related to the domestic oversight of banking and money laundering—especially with regard to the adequacy of current examination procedures, including knowing your customer. The National Money Laundering Strategy for 1999 marks a new stage in the government’s fight against money laundering. A major goal is to enhance regulatory oversight while making it cost-effective, with measurable results. We believe such a goal is worth achieving. U.S. law enforcement and judicial authorities allowed access to individual customer information x x x x x x x x x x x x x x x xCriminal sanctions exist for unauthorized disclosures, but “safe harbor” is provided for specific authorized disclosures to certain entities. Financial Action Task Force (FATF) Caribbean Financial Action Task Force (CFATF) Council of Europe Select Committee on Money Laundering x x x x x Bahrain is not a member country of FATF It is, however, a member of the Gulf Cooperation Council, one of two regional organizations that are members of FATF. Does the jurisdiction have KYC policies or guidelines for banks? Does the jurisdiction require banks to report suspicious transactions? Does the jurisdiction have corporate secrecy laws that include criminal sanctions? Does INCSR describe supervisory structure of the jurisdiction as weak or nonexistent? Information is for Guernsey, one of four islands known as the Channel Islands. The first copy of each GAO report and testimony is free. Additional copies are $2 each. Orders should be sent to the following address, accompanied by a check or money order made out to the Superintendent of Documents, when necessary. VISA and MasterCard credit cards are accepted, also. Orders for 100 or more copies to be mailed to a single address are discounted 25 percent. U.S. General Accounting Office P.O. Box 37050 Washington, DC 20013 Room 1100 700 4th St. NW (corner of 4th and G Sts. NW) U.S. General Accounting Office Washington, DC Orders may also be placed by calling (202) 512-6000 or by using fax number (202) 512-6061, or TDD (202) 512-2537. Each day, GAO issues a list of newly available reports and testimony. To receive facsimile copies of the daily list or any list from the past 30 days, please call (202) 512-6000 using a touch- tone phone. A recorded menu will provide information on how to obtain these lists.

Summary: Pursuant to a congressional request, GAO discussed money laundering in relation to private banking and highlighted some regulatory issues related to the vulnerability of selected offshore jurisdictions to money laundering, focusing on: (1) regulators' oversight of private banking in general; (2) regulators' oversight of private banking in selected offshore jurisdictions; (3) barriers that have hampered regulators' oversight of offshore banking; and (4) future challenges that confront regulators' efforts to combat money laundering in offshore jurisdictions. GAO noted that: (1) federal banking regulators have overseen private banking through examinations that, among other things, focus on banks' "know your customer" policies; (2) these policies enable banks to understand the kinds of transactions a particular customer is likely to engage in and to identify any unusual or suspicious transactions; (3) federal banking regulators have examination procedures that cover private banking activities conducted by banks operating in the United States; (4) in cases that involve private banking activities conducted by branches of U.S. banks operating in offshore jurisdictions, examiners rely primarily on banks' internal audit functions; (5) GAO found that the key barriers to U.S. regulators' oversight of offshore banking activities are secrecy laws that restrict access to banking information or that prohibit on-site examinations of U.S. bank branches in offshore jurisdictions; and (6) an important challenge that confronts efforts to combat money laundering is the extent to which such secrecy laws will continue to be barriers to U.S. and foreign regulators.