BSA, enacted by Congress in 1970, authorizes the Secretary of the Treasury to issue regulations requiring financial institutions to retain records and file reports useful in criminal, tax, and regulatory investigations. Following the September 11, 2001 terrorist attacks, Congress passed the USA PATRIOT Act, which, among other things, amended BSA and expanded the number of industries subject to BSA regulation. Title III of the act expanded BSA powers to combat terrorist financing and required financial institutions to establish proactive anti- money laundering programs. In addition, the act expanded reporting requirements and allowed the records and reports collected under BSA to be used in the conduct of intelligence or counterintelligence activities and to protect against international terrorism. The BSA framework focuses on financial institutions’ record keeping and reporting requirements to create a paper trail of financial transactions that federal agencies can trace to deter illegal activity and apprehend criminals. Under the BSA framework, primary responsibility rests with the financial institutions themselves in gathering information and passing it to federal officials. “Financial institutions” include both banking institutions and NBFIs. Banking institutions include commercial banks and trusts, savings and thrifts, branches of foreign chartered banks doing business in the United States, and credit unions. NBFIs include MSBs, casinos, and some credit unions. MSBs include businesses that transmit money, cash checks, and engage in certain financial transactions. MSBs are the largest and most diverse group of entities that qualify as NBFIs. Table 1 describes the different types of entities that qualify as NBFIs not otherwise regulated by a federal functional regulator. All financial institutions subject to BSA requirements must implement internal controls, policies, and procedures; maintain records of transactions; and file reports of cash transactions over the $10,000 dollar threshold and suspicious activities. The USA PATRIOT Act required all financial institutions to develop written anti-money laundering compliance programs that detail internal policies, procedures and internal controls. Each program must designate a compliance officer, provide ongoing employee training of pertinent personnel, and provide for independent reviews whose scope and frequency is commensurate with the risk of the financial services provided. Registration, record keeping, and reporting are the core elements of anti- money laundering requirements for MSBs. Certain MSBs are required to register with the Secretary of the Treasury and renew those registrations every 2 years. In addition, MSBs that sell money orders, travelers’ checks, or other instruments for cash must verify the identity of each customer and create and maintain a record of each purchase when the purchase is cash from $3,000 to $10,000. Also, financial institutions and certain types of businesses are required to submit reports on cash transactions over the $10,000 threshold and transactions of a suspicious nature. Millions of these reports are filed each year. For example, in 2005 over 16 million BSA reports were filed by financial institutions. Certain civil and criminal penalties can be levied against financial institutions for violating BSA reporting requirements, with fines ranging from $500 for negligence to $500,000, 10 years in jail, or both for certain willful violations. , Appendix III discusses the compliance reporting responsibilities in more detail. FinCEN’s role is to oversee administration of BSA government wide. In this role, FinCEN develops policy and provides guidance to other agencies, as shown in figure 1. However, FinCEN also relies on other agencies in implementing the BSA framework, including (1) ensuring compliance with BSA requirements to report certain financial transactions, (2) conducting investigations of criminal financial activity, and (3) collecting and storing the reported information IRS is involved in all three of these areas. As administrator of BSA, FinCEN’s compliance role is to develop regulatory policies for agencies that examine financial institutions and businesses for compliance with BSA laws, and when appropriate, assess civil penalties against noncompliant institutions. FinCEN develops and issues BSA regulatory requirements and provides guidance to financial institutions that are subject to those requirements. FinCEN is also responsible for overseeing agency compliance examination activities and provides these agencies with assistance in educating institutions on their BSA responsibilities. As highlighted in the compliance examiners section of figure 1, IRS is one of eight agencies that actually conduct the compliance examinations that FinCEN oversees. The Office of Fraud/BSA, within SB/SE, conducts examinations of NBFIs, including MSBs, which are not regulated by another federal agency. Appendix III discusses the compliance responsibilities of MSBs in more detail. FinCEN is responsible for supporting and networking law enforcement at the federal, state, and local levels. FinCEN’s network exceeds 180 law enforcement agencies, and includes CI, the Federal Bureau of Investigation, the Drug Enforcement Administration, Immigration and Customs Enforcement, state and local police departments and investigative bureaus, attorney general and district attorney offices, and foreign authorities. FinCEN provides investigative leads to support financial criminal investigations and offers a variety of analytical products on trends and patterns that can be used by law enforcement to more effectively target their investigations. As the enforcement arm of IRS, CI has the authority to investigate criminal violations of BSA laws. Like other law enforcement agencies, CI uses financial intelligence, including data provided on BSA reports, to build investigations and prepare cases for prosecution. The law enforcement section of figure 1 highlights how FinCEN, IRS CI, and the broader law enforcement community fit into the BSA framework. FinCEN has responsibility for overseeing the management of BSA data, but from an operational standpoint does not collect, store, or maintain the official data that are reported by financial institutions. IRS’s Enterprise Computing Center at Detroit (ECC-DET), under a long-standing cooperative arrangement with FinCEN, has been the central point of collection and storage of these data. ECC-DET maintains the infrastructure needed to collect the reports, convert paper and magnetic tape submissions to electronic media, and correct errors in submitted forms through correspondence with filers. As illustrated in the data management section of figure 1, BSA data are processed and warehoused in IRS’s Currency Banking and Retrieval System are accessed through a Web-based interface. The system is called WebCBRS. IRS examiners and investigations officials access WebCBRS directly through IRS’s intranet. Non-IRS law enforcement users access BSA data through FinCEN’s Gateway computer system. Secure Outreach functions as a portal through FinCEN’s information technology infrastructure to BSA data housed at ECC-DET. Despite many improvements, IRS does not yet have an effective BSA compliance program. An effective IRS compliance program would require identifying the population of NBFIs and then periodically testing whether these NBFIs are complying with their reporting and other BSA requirements. Several efforts have been made to estimate the NBFI population, but all of these estimates have weaknesses. However, IRS and other knowledgeable observers agree that IRS has only identified a portion of the population. No recent studies have been conducted that estimate the total population of NBFIs; however, a number of efforts have been made to estimate the number of MSBs, the largest group of NBFIs subject to BSA requirements. A 1997 study conducted by a FinCEN consultant estimated the existence of approximately 158,000 MSBs. One IRS official within the Office of Fraud/BSA estimates there may be approximately 160,000 MSBs. In 2005, another FinCEN study estimated the population to be as high as 200,000. Officials from FinCEN, IRS, Treasury, TIGTA, and Treasury’s OIG agree that IRS has only identified part of the NBFI population. Several factors contribute to IRS’s difficulty in identifying NBFIs. NBFIs, especially MSBs, are inherently difficult to identify because of the wide range of sizes, structures, and financial activities they conduct. Unlike traditional financial institutions, such as federally insured banks, many MSBs are small, independently owned businesses in which financial services are offered as a secondary business activity. For example, many grocery stores, convenience stores, gas stations, and liquor stores would be considered MSBs because they offer check cashing, money order, or wire transfer services, even though the primary activity of these businesses is the sale of consumer goods. In a 2005 report, the OIG cited language barriers and the limited financial proficiency of some business owners as reasons many MSBs are not registered, and therefore have not been identified. The OIG also found that regulations and guidance for MSBs can be confusing and easily misinterpreted, thus contributing to the challenge of identifying MSBs. The report states that the distinction FinCEN makes between a MSB principal and an agent of that principal is not always understood by the MSB population and is difficult to verify other than through an on-site examination. Some BSA rules, such as the registration requirement, are applicable to principals—the entities issuing financial instruments—and some are applicable to agents—businesses authorized to sell the issuers’ financial instruments. Another confusing aspect of the MSB requirements is that businesses whose daily money services transactions are less than $1,000 per day per person are generally not considered MSBs. As with the agent exemption, the dollar threshold is difficult to verify other than through an on-site examination. The OIG found that FinCEN had plans to assess whether agents of MSBs should be required to register; however, FinCEN has not taken action to implement these plans. IRS officials in the Office of Fraud/BSA support a change that requires all MSBs to register, regardless of whether they are principals or agents, because it would make identification easier. FinCEN officials, however, said that their first priority is to ensure that the current list of MSB registrations is accurate. Therefore, FinCEN does not have a time- frame for revising MSB regulations and guidance, including registration requirements. Identifying NBFIs, and particularly MSBs, is challenging and resource intensive—both FinCEN and IRS have responsibility in this area.