FAA issues aircraft registrations according to eligibility requirements prescribed by federal statute in support of International Civil Aviation Organization requirements that every aircraft engaged in international air navigation must bear its appropriate nationality and registration marks. Specifically, the law requires that the aircraft may not be registered under the laws of a foreign country and must be owned by (1) a citizen of the United States, (2) a foreign citizen lawfully admitted for permanent residence in the United States, (3) a noncitizen corporation that is organized and doing business under the laws of the United States or a state if the aircraft is based and primarily used in the United States, or (4) the U.S. government, District of Columbia government, or the government of a U.S. state, territory, or possession. By law and FAA policy, FAA imposes safety obligations on all owners of registered aircraft. To meet these obligations, an owner must maintain current information about the identity and whereabouts of the operators of an aircraft and location and nature of the aircraft’s operation on an ongoing basis. In doing so, the owner is to retain the ability to provide the operator with safety-critical information in a timely manner, and to obtain information responsive to FAA inquiries, including investigations of alleged violations of FAA regulations. Such information supports FAA’s ability to carry out its oversight obligations under U.S. and international law. FAA’s aircraft registry is an owner registry; it is not intended to include aircraft operator information. Only an aircraft’s owner may apply for registration, and a registration is not valid if the interest of the applicant in the aircraft was created by a transaction that was not entered into in good faith, but rather was made to avoid registration requirements. In addition, anyone who knowingly and willfully submits documents to FAA with false, misleading, or fraudulent information could be subject to criminal penalties and revocation of the aircraft registration. To register an aircraft for a 3-year period, in addition to a $5 application fee, applicants must submit to FAA at least two primary documents: (1) a completed application form and (2) a bill of sale or other evidence of aircraft ownership. A sample aircraft registration submission for an individual owner is shown in figure 1 below. For additional information about required documentation based on registration type, see appendix III. According to FAA officials, in 2018 FAA received approximately 71,000 registration applications. FAA also issues dealer certificates, also known as dealer licenses, in support of aviation commerce. Individuals and legal entities who are U.S. citizens can apply for an aircraft dealer certificate. The dealer certificate is valid for 1 year at a cost of $10 for the initial certificate and $2 for additional certificates. The certificates allow manufacturers and dealers to demonstrate and merchandize aircraft for prospective buyers and to make flight tests without a standard aircraft registration certificate. A dealer may obtain one or more certificates and may use a certificate for any aircraft the dealer owns. Dealer certificates require the applicant to be a U.S. citizen, identify an established place of business in the United States, provide a mailing and physical address, and substantially engage in manufacturing or selling of aircraft. Among other things, a dealer certificate is generally valid when the dealer, his or her agent or employee, or prospective buyer within the United States operate the aircraft, and only for flights that are required for testing of the aircraft or necessary for, or incident to, the sale of the aircraft. In 2018, there were 9,864 dealer certificates in the aircraft registry, primarily issued to corporations, limited liability companies (LLC), or individuals. FAA’s aircraft registration application form identifies eight registration types, including individual, corporation, and government. In 2018, there were 294,221 aircraft registered with FAA across all registration types (see fig. 2). The various registration types are associated with different types of aircraft ownership structures. Individuals who are U.S. citizens or resident aliens can register aircraft in the United States as individual owners or as part of a legal entity, such as a corporation or LLC. Legal entities that meet certain requirements can also register aircraft in the United States. For most types of legal entities, the entity must qualify as a U.S. citizen. For example, a corporation may own and register an aircraft as a U.S. citizen if (1) it is organized under the laws of the United States or a state, District of Columbia, or a territory or possession of the United States; (2) the president and at least two-thirds of the board of directors and other managing officers are citizens of the United States; (3) it is under the actual control of citizens of the United States; and (4) at least 75 percent of the voting interest is owned or controlled by persons that are citizens of the United States. Depending on the type of legal entity, additional requirements may apply, and in some cases additional documentation must be provided to FAA. For some legal entities, the registered owners of aircraft may not be the beneficial owners—the persons who ultimately own and control an aircraft. See appendix III for further information about the types of registrations and an additional ownership structure, along with associated documentation requirements beyond the aircraft registration application form, bill of sale, and $5 registration fee. If necessary, a corporation may use a voting trust to establish the fourth element of citizenship noted above for the purposes of registering an aircraft. Generally, a voting trust legally transfers the voting control in the corporation from a foreign citizen to a U.S. citizen who holds those interests in trust; however, the exact requirements are governed by the law of the state in which the trust is created. FAA regulations have included requirements around the use of voting trusts since 1980. When promulgating the relevant regulations, FAA explained that use of a voting trust allows a domestic corporation to come within legal compliance by placing the “voting interest of the stock of the corporate applicant . . . in the hands of U.S. citizens as voting trustees that the trustees have a valid, independent, and bona fide control of the voting interest.” As a result, if a voting trust is used by the domestic corporation to meet the fourth element of citizenship, the corporation must submit to FAA a copy of the voting trust agreement, which identifies the voting interests and must be binding upon all parties to the transaction, as well as an affidavit from each voting trustee, which represents that the voting trustee is an independent actor. A sample aircraft registration submission for a corporation using a voting trust is shown in figure 3 below. Trusts are not a registration type on the FAA aircraft registration application form; however, trusts are a legal structure that may own property such as an aircraft and therefore may be used to register an aircraft. As of June 2019, according to FAA data, there were 11,364 trusts in the aircraft registry. Depending on whether the trustee is an individual or an entity as well as on the specific terms of the trust, the aircraft’s owner in the FAA registry may be listed as an individual or as a corporation (see fig. 4). A trust may own and register an aircraft if each of the trustees is a U.S. citizen or resident alien, and 75 percent of the control of the trust must be vested in U.S. citizens or resident aliens. Specifically, each trustee must affirm that trust beneficiaries who are not U.S. citizens or resident aliens do not have more than 25 percent of the aggregate power to influence or limit the exercise of the trustee’s authority. However, foreign citizens who are not resident aliens may have more than 25 percent of the beneficial interest in the trust. Trusts for which foreign citizens have a majority of the beneficial interest are generally referred to as “noncitizen trusts,” even though legal title in the aircraft remains owned by one or more U.S. citizen or resident alien trustees. In a 1979 rulemaking, FAA cited “increased activities of foreign investors in aircraft financing” as a reason for updating its regulations related to noncitizen trusts. In the ensuing decades, FAA experienced problems obtaining important operational and maintenance information concerning aircraft owned by noncitizen trusts from the owner trustees, prompting FAA in 2011 to begin a review of its policies and practices regarding the registration of such aircraft. After a series of public meetings and receipt of written public comments, FAA issued a notice of policy clarification for noncitizen trusts in 2013. Among other things, the policy clarification confirmed that the “FAA does not consider the status of the trustee as the owner of the aircraft under a trust agreement as having any differing effect on its responsibilities for regulatory compliance issues compared to other owners of a U.S.-registered aircraft,” and that “FAA is not aware of any basis for treating one type of owner—such as a trustee under a noncitizen trust—differently from any other owner of a civil aircraft on the U.S. registry when considering issues of regulatory compliance.” FAA collects, stores, and makes publicly available aircraft registration information. FAA collects basic aircraft registration data from the application form, which are available and searchable on FAA’s website or in imaged records in portable document format (PDF). FAA data available on its website include aircraft registration number (tail or N- number), serial number, aircraft make and model, owner name, owner’s address, and registration status. According to FAA officials, FAA stores scanned images in two key systems: (1) aircraft records, which includes documents such as registration application forms and bills of sale, and (2) ancillary files, which includes documents such as trust agreements. FAA officials told us that aircraft record files are accessible to the LEAU, FAA LEAP, and aviation safety inspectors who access aircraft records files via a web-based portal. Ancillary files must be accessed on-site at the FAA Aeronautical Center in Oklahoma City, Oklahoma. The LEAU has direct access to the ancillary files and provides aircraft record and ancillary file information to law-enforcement agencies, FAA LEAP, and aviation safety inspectors. Additionally, all records are accessible to the public in FAA’s public documents room located at the FAA Aeronautical Center or upon request. Figure 5 shows collection, storage, and availability of FAA’s aircraft registration documentation. Within FAA’s Aviation Safety office, the Flight Standards Service manages the Civil Aviation Registry and is the primary user of aircraft registry information. Registry staff process registrations for U.S. civil aircraft, issue aircraft registration numbers, and record conveyances affecting interest in aircraft. Internal FAA users of registration information include officials from ASH, LEAP, and SEIT, and aviation safety inspectors. FAA LEAP and SEIT coordinate closely with registry officials to request registration information in support of their missions on security and law-enforcement assistance. Apart from FAA, major users of aircraft registry information are organizations serving the aviation industry, international civil aviation agencies, federal safety officials, and law- enforcement agencies (see table 1). In 1964, FAA issued updated aircraft registration regulations and set the aircraft registration fee at $5. In 1988, Congress passed the Federal Aviation Administration Drug Enforcement Assistance Act of 1988 (FAA DEA Act), which declared that it is FAA policy to assist law-enforcement agencies in the enforcement of laws relating to the regulation of controlled substances and, among other things, required FAA to promulgate regulations that would require individuals to provide their driver’s license number and entities to provide a tax identification number in their registration application. In 1990, FAA issued a proposed rulemaking that, among other things, required a driver’s license number for an individual and a tax identification number for others. In 2005, FAA issued a notice of proposed rulemaking withdrawal, stating that it fulfilled the requirements of the FAA DEA Act, with certain exceptions, through changes to its system and procedures used by the FAA Civil Aviation Registry, such as by providing law-enforcement agencies access to the registry data. With regard to the requirement to provide a driver’s license number or tax identification number, FAA determined that the requirement would be detrimental to users of aircraft records and potentially to the aircraft owners, and cause an unnecessary burden on aircraft owners and government, and that this information was not necessary for law-enforcement agencies to carry out their responsibilities. In 2010, to improve the quality of registry data and to provide more accurate information to law-enforcement agencies and other users, FAA started requiring aircraft registration renewal. Such renewals must occur every 3 years. In 2018, the FAA Reauthorization Act of 2018 required FAA to modernize the Civil Aviation Registry’s information technology (IT) systems. The act also required FAA to initiate a rulemaking to extend the registration duration for noncommercial general aviation aircraft from 3 to 7 years. Beneficial ownership and legal information can assist law-enforcement and safety authorities by identifying those natural persons who may be responsible for the underlying activity of concern, or who may have relevant information to further an investigation. The Financial Action Task Force (FATF)—an international standards-setting body for combating money laundering, financing of terrorism, and other related threats to the integrity of the international financial system—has examined how legal and beneficial ownership information can assist law- enforcement and other competent authorities. FATF was established by the group of seven economic summit partners, known as the G7, of which the United States is a member, and the Treasury’s Office of Terrorist Financing and Financial Crimes leads the U.S. delegation to FATF. FATF developed a series of 40 recommendations, last updated in 2019, that are recognized as the international standard for combating of money laundering and the financing of terrorism and proliferation of weapons of mass destruction. Specifically, FATF Recommendations 24 and 25 call on member countries to ensure the availability of adequate, accurate, and timely information on the beneficial ownership of corporate vehicles that can be accessed by competent authorities in a timely fashion. To the extent that such information is made available, it may help financial institutions and other organizations to implement the due-diligence requirements on corporate vehicles including to identify the beneficial owner and to identify and manage financial crimes risks, including sanctions requirements. Internal controls help entities fulfill their mission and objectives while safeguarding assets and ensuring proper stewardship of public resources. According to federal internal control standards, managers are responsible for an effective internal control system, which increases the likelihood that an entity will achieve its objectives. Additionally, managers are responsible for proactively managing risks, including fraud risks and misconduct such as waste and abuse, to facilitate the entity’s mission and strategic goals by ensuring that taxpayer dollars and government services are being used for their intended purposes. The Fraud Reduction and Data Analytics Act of 2015, enacted in June 2016, required federal agencies to establish financial and administrative controls for managing fraud risks. These requirements are aligned with leading practices outlined in A Framework for Managing Fraud Risks in Federal Programs (Fraud Risk Framework). GAO’s Fraud Risk Framework outlines leading practices to prevent, detect, and respond to fraud risks. As depicted by the larger circle for prevention in the sidebar, preventive activities generally offer the most cost-efficient use of resources, since they enable managers to avoid costly and inefficient recovery activities following fraudulent transactions. Therefore, leading practices for strategically managing fraud risks emphasize risk-based preventive activities. FAA reviews registry applicant information for completeness and compliance with regulations—generally accepting self-certification of eligibility and aircraft ownership—but does not verify this information or collect key information on applicants and aircraft owners, according to our review of the registry process. This limits FAA’s ability to prevent fraud and abuse in aircraft registrations, which has enabled aircraft-related criminal, national security, or safety risks, according to our case-study review. Specifically, FAA’s review of aircraft registrations and dealer certifications primarily focuses on ensuring that applicants provide required documents and that forms are complete. Additionally, FAA requires limited personally identifiable information (PII), and it generally does not use that information to verify applicant information. The registry is further vulnerable to fraud and abuse when applicants register aircraft using opaque ownership structures that limit transparency into beneficial owners of aircraft. FAA’s approach has focused on obtaining and recording the required documents, and consequently, FAA has not identified fraud risks, their likelihood and impact, the suitability of controls, and other aspects of a fraud risk assessment that would support fraud prevention activities. As a result, FAA is limited in its ability to ensure registrant eligibility and prevent fraud and abuse and associated criminal, national security, and safety risks involving U.S.-registered aircraft. FAA generally accepts certification by applicants of their eligibility and aircraft ownership and performs limited review of applicant information to identify potential fraud or abuse. Specifically, FAA requires applicants to submit signed documents that attest to the requirements relevant to their registration type, including U.S. citizenship, resident alien status, or eligibility as a noncitizen corporation. Where owners are LLCs or trusts, applicants submit documentation that the entity is organized under U.S. or state laws. Additionally, applicants must submit evidence of aircraft ownership, such as a bill of sale, and attest to their ownership of the aircraft. According to FAA policy, by signing the application form, applicants certify to the truthfulness and accuracy of the information provided and that they understand that knowingly and willfully submitting documents to FAA with false, misleading, or fraudulent information could subject the person to criminal penalties and revocation of the aircraft registration. FAA collects applicants’ name and address, although according to officials, it accepts this information as factually valid and does not make an attempt to detect intentional fraud at the time of application. FAA does not require or collect other PII, such as the applicant’s date of birth or driver’s license information for individual applicants, or taxpayer identification numbers and state of incorporation for legal and corporate entities, for identity verification or record keeping. FAA collects some PII in the airmen registry, such as for pilot licensing, but it does not use this information for aircraft registration verification purposes. Use of PII is a key way federal programs verify the identity and eligibility of potential beneficiaries. FAA’s policy is to review documents for acceptability during the initial registration. This includes, for example, checking for internal discrepancies within the documents submitted, ensuring that documents are complete, and that the self-certification is signed. For previously registered aircraft, FAA also reviews prior bill of sale documents for inconsistencies in the chain of ownership. Where owners are corporations with complex ownership structures, such as LLCs that are owned by other LLCs, registry officials may request review by FAA’s legal counsel to confirm eligibility. FAA’s legal counsel may also review documentation provided by noncitizen corporations as well as trust agreements and related documents for registrations involving noncitizen trusts, statutory trusts, and corporations using voting trusts to meet U.S. citizenship requirements at the time of registration. In these cases, according to FAA officials, FAA legal counsel reviews documentation to ensure that the entity is organized under U.S. or state laws and may periodically perform spot checks by contacting a Secretary of State office to confirm the existence of an entity. However, where the owner is a U.S.-citizen corporation, FAA generally does not request or review articles or certificates of incorporation to ensure the entity is organized under U.S. or state laws. In addition, FAA does not require or review additional documentation for individual, partnership, and government registration types. For these applicants, FAA checks (1) all sections of the application form for completeness, (2) chain of ownership, and (3) that applicants self-certify their U.S. citizenship. Further, according to FAA officials, when FAA informs applicants of its unfavorable determination, such as when reviewing LLC documentation, for example, applicants are generally provided an opportunity to remedy deficiencies and resubmit their applications. According to FAA officials, FAA applies the same scrutiny to resubmissions as it does to initial applications. In addition, FAA does not review documents for eligibility when individuals certify that there have not been any changes since initial registration. As with aircraft registrations, FAA does not verify dealer identity, check for prior relevant violations, or enforce requirements associated with dealer certificates, such as verifying that dealers are substantially engaged in manufacturing or selling aircraft or only operating domestically, except when delivering an aircraft to a foreign purchaser. Furthermore, FAA regulations do not prescribe enforcement mechanisms to ensure continued dealer eligibility once approved or at the time of certificate renewal. Law-enforcement and FAA LEAP agents told us that dealer certificates is an area in need of greater oversight because dealer certificate applications have been falsified similar to other aircraft registrations, as discussed below. Additionally, FAA LEAP agents told us that they have identified instances of dealers acting as nominees on behalf of foreign entities, registering aircraft under their U.S. dealer certificate. The use of a nominee is an invalid means to register an aircraft, including for dealers. FAA LEAP agents noted that, in their experience, this practice may have enabled otherwise ineligible foreign entities to meet aircraft registration citizenship requirements. In our case studies and interviews with FAA, we identified examples of fraudulent registrations and potential abuse of the registry that occurred within the context of FAA’s current practice of limited verification and review of applicant information. In addition, our analysis of address data and investigation of selected addresses highlights the risks of abuse arising from FAA’s approach of not verifying address information. The examples below illustrate some of the risks associated with FAA not verifying: (1) applicant identity, (2) ownership, and (3) address information. Applicants falsified identities and registration self-certification. A 2017 case involving an aircraft registered through a falsified identity illustrates inherent risks of not verifying applicants’ information and identities, such as through PII or other checks. According to FAA documents, an applicant registered an aircraft as an LLC owner with supporting documents identifying two individual members. In registration documents, the applicant provided the name of a stolen identity for the first LLC member’s name and “John Doe” for the second. FAA accepted the registration information as factually valid and the aircraft remained legitimately registered for about 1 year. A DEA and FAA LEAP investigation of aircraft operating outside the United States eventually discovered the falsification. When FAA LEAP agents contacted the first named individual of the LLC, he affirmed that he was not a member of the LLC, never owned an aircraft, and never executed any documents to register an aircraft in his individual capacity or on behalf of a business entity. FAA LEAP determined that the stolen identity had been used to submit aircraft registration paperwork without the individual’s knowledge or consent. Accordingly, FAA revoked the aircraft registration, finding that the registration was invalid because the applicant’s interest in the aircraft was created by a transaction that was not entered into in good faith. This revocation was associated with a broader effort by DEA and FAA involving international operations of multiple U.S.-registered aircraft that resulted in aircraft and cocaine seizures, discussed later in this report. Aircraft broker fraudulently registered multiple aircraft for bank loan fraud scheme. A 2013 case involving an aircraft sales broker and dealer who was convicted of making a false statement to FAA in registering aircraft, among other convictions, illustrates risks associated with FAA’s reliance on self-certification and limited review of ownership information. In this case, the broker submitted fraudulent registration applications and bills of sale to FAA using forged signatures for over 20 aircraft as part of a multi-million-dollar bank fraud scheme. FAA accepted the broker’s self- certification as factually valid. The broker used the registration certificates that FAA had provided as an asset to support a loan application that resulted in a $3 million bank loan for his failing aircraft sales business. The bank uncovered the fraud over a year after the sales broker first submitted to the bank fraudulent aircraft registration documents to execute the bank loan. A subsequent investigation by the Federal Bureau of Investigation revealed the extent of the fraud, namely that the main thrust of the fraud scheme was to pledge 22 aircraft as collateral, which neither the broker nor his company owned, in order to obtain money from the bank. As a result of the fraud, some of the rightful owners of the aircraft experienced difficulty reinstating aircraft registrations in their names. For example, one owner told federal investigators that he could not fly his aircraft for 2 years because the registration of his aircraft was in the name of the fraudulent broker. This aircraft broker was also a licensed dealer, who held and renewed a dealer certificate during the time he was perpetrating his illicit scheme submitting fraudulent aircraft registrations to FAA. Noncompliant addresses. We also identified registrations with potentially noncompliant addresses and addresses that did not match USPS postal verification data in our analysis of FAA’s publicly available and ancillary registry data files. Our analysis illustrates noncompliance risks associated with FAA’s approach of not verifying physical address information as well as safety and security risks associated with FAA’s ability to readily identify or contact owners when issues arise. FAA regulations require that owners submit physical address information in their application forms. According to FAA policy, a physical address is needed so that the owner can be located, if necessary, for security or safety reasons. According to FAA officials, FAA will accept the use of a mail drop or a registered agent’s address as a mailing address, provided the physical address is included. However, our analysis of 2018 physical and mailing address data shows that over 2,000 (about 1 percent) of addresses list a mail drop location without a physical address, which does not comply with FAA’s requirement. We selected seven of these cases for further verification using online and subscription database research, including three for site inspection. In our review of seven selected cases based on categories of addresses and locality, we identified three cases in which a physical address was not provided by registrants. Through a site inspection for one of the selected cases, we were able to confirm a UPS Store location was provided as the mailing address, and no physical address was provided as required by FAA policy. (See sidebar.) For the remaining two cases, the registrants provided the addresses of the registered agents that likely facilitated the application on behalf of the registrants, but no physical addresses were provided. The address of one of these registered agents is the same address we identified in a case study discussed later in this report. In that case, FAA registry officials were not able to get in contact with the owner, who used a registered agent address, after the aircraft had crashed outside the United States. The aircraft was being operated by a foreign government, following its seizure on drug trafficking charges. FAA sent multiple letters to the owner to deregister the aircraft and also when the aircraft registration was expiring, but all were returned as refused by the registered agent. As discussed later, the use of a registered agent address may provide a layer of anonymity in aircraft ownership and pose challenges when FAA or law-enforcement agencies need to contact registered owners. The address of this mail drop location was used in one of the aircraft registration cases we selected for postal address verification, inconsistent with Federal Aviation Administration policy. Additionally, we selected five dealer addresses for further review. We found that in three cases physical addresses were provided on the certificate application forms as required. In two remaining cases, we cannot make any conclusions regarding the validity of the physical addresses provided because we could not confirm through our online and subscription databases whether the companies were or were not located at the physical addresses provided to the registry. In addition to fraud and abuse risks posed by limited verification and review of applicant information, the registry faces risks associated with nominee registrations. As noted above, use of a nominee is an invalid means to register an aircraft and involves a person or business acting on behalf of an ineligible owner, as shown in the following example. Fraudulently registered aircraft linked to notorious cartel. A 2016 case involving the use of a nominee to register an aircraft on behalf of an ineligible owner illustrates risks of registration fraud by individuals and entities misrepresenting their aircraft ownership. In this case, law- enforcement officials received information that an aircraft was in the process of being purchased by a foreign national. A U.S. corporation, acting on behalf of entities known to have ties to the Sinaloa Cartel, purchased the aircraft, filed registration documents for it, and represented itself as the aircraft owner. According to court documents, by registering as the aircraft owner, the nominee corporation concealed the otherwise ineligible non–U.S. citizen ownership of the aircraft by entities with Mexican drug cartel ties. FAA accepted the registration and registered the aircraft in 2014. A law-enforcement agency, which was aware of the scheme, seized the aircraft shortly after final payment was made on it. Law-enforcement investigation into this case also revealed that some of the same entities had previously been involved in similar schemes involving aircraft purchases and registration associated with drug trafficking. The aircraft was subsequently forfeited to the federal government because its registration was fraudulent and it was purchased with assets derived from wire fraud, money laundering, or other unlawful activities. As part of its IT modernization effort, FAA identified some risks to the aircraft registry, such as financial fraud and terrorist access. FAA officials have also pointed to various FAA LEAP and law-enforcement activities directed at managing these risks, as discussed later in this report. These are reactive measures, and the current process—which accepts applicant information at face value—is not designed to identify and prevent fraud and abuse. Preventive activities generally offer the most cost-efficient use of resources because they enable managers to avoid a costly and inefficient “pay-and-chase” approach. According to federal internal control standards, managers should identify, analyze, and respond to risks. Furthermore, GAO’s Fraud Risk Framework emphasizes risk-based preventive activities that are based on a comprehensive, documented risk assessment that identifies risks, assesses them, and develops a strategy to address analyzed risks, including periodic assessments to evaluate continuing effectiveness of the risk response. To identify risks, managers should consider the types of risks, including both inherent and residual risks. To assess risks, managers should estimate the significance of a risk by considering the magnitude of impact, likelihood of occurrence, nature, and tolerance of the risk. Managers should then design overall risk responses for the analyzed risks based on the significance of the risk and defined risk tolerance. According to FAA officials, FAA has not conducted such an assessment, which would better position it to design and implement risk-based preventive and other controls to manage these risks. As our case studies and illustrative examples demonstrate, this has enabled illicit actors to defraud and abuse the registry, with criminal and national security consequences. In addition, federal internal control standards call for agency management to design control activities to achieve objectives and respond to risks, including designing a variety of transaction controls, which may include verifications, reconciliations, and authorizations. As discussed in the Fraud Risk Framework, a leading practice to effectively prevent instances of potential fraud is for managers to take steps to verify reported information, particularly self-reported data and other key data necessary to determine eligibility. According to FAA officials, the law directs FAA to register an aircraft or issue a dealer certificate that meets eligibility requirements, but does not require FAA to verify the accuracy of the information included in the registration application. Yet without such a review to verify applicants’ information, FAA cannot be assured it is appropriately determining eligibility for the approximately 71,000 applications the registry processes annually. In turn, this limits FAA’s ability to prevent fraud and abuse of the registry from registrants engaged in illicit activities. Aircraft Registration and Dealer Fees Aircraft registration costs $5 and a dealer certificate costs $10 for initial application and $2 for additional certificates. While these fees are attractive to aircraft owners and dealers for economic reasons, we previously determined that the registration fee, in place since 1964, did not cover the cost of reviewing and processing an application. Considering only inflation adjustment, the $5 fee would be $41 in 2019 dollars, which may still be short of what the Federal Aviation Administration (FAA) would need to cover its expenses. FAA has been working to increase registration-related fees since 2013. According to FAA officials, FAA is evaluating regulatory strategy in light of registry information technology modernization and considering other regulatory priorities. According to FAA officials, although they have the authority to collect information for verification purposes, they do not have the tools and resources to do so. With respect to tools, as noted earlier, FAA is making plans to modernize registry operations by implementing streamlined and automated processes where registration information is submitted electronically. According to FAA officials, this is expected to improve online data availability and allow for cross-checking information with other data sources, such as other government databases. With respect to resources, FAA collects a fee that is intended to cover registration processing activities. However, the registration fee has remained the same—$5—since 1964, and for many years has not covered FAA costs associated with registration processing. In a 1993 report, we estimated that FAA had forgone about $6.5 million in fees since 1968 because the registration fee did not cover the cost of reviewing and processing an application. Since that time, U.S. taxpayers have subsidized the processing of aircraft registrations and dealer certificates, including legal analysis, and covering the costs of labor, technology, postage, and other direct and indirect expenses. GAO’s federal user fee guide states that fee collections should be sufficient to cover the intended portion of program costs over time, including factors such as inflation. (See sidebar.) Without a fee that keeps pace with inflation and covers the cost of collecting and verifying applicant information for these high-value assets, FAA passes these costs on to U.S. taxpayers and limits the resources available for applicant verification. Individuals or entities may use opaque ownership structures—a legitimate means to register aircraft—to disguise potential ineligibility or hide illicit activity, according to our illustrative case and intermediary research, and interviews with FAA and law-enforcement officials. Opaque ownership structures are legitimate business structures that are widely used by corporations and individuals to facilitate commerce as well as for asset and tax management. However, we identified cases where these structures were used to name legal entities or trusts as the owner of an aircraft to disguise potential ineligibility or provide layers of anonymity in support of illicit activity. The lack of transparency related to these registrations also creates challenges for safety and law-enforcement investigators seeking information about beneficial owners of aircraft to support timely investigations, according to these officials. On the basis of interviews with FAA LEAP, SEIT, and law-enforcement officials, we identified four types of ownership structures that can be used to register an aircraft so that the beneficial owner is not transparent. The four types can be used alone or in combination and include the use of (1) LLCs, (2) shell companies, (3) noncitizen trusts, and (4) U.S. citizen corporations using voting trusts. According to our analysis of the registry’s calendar year 2018 data, although not mutually exclusive, there were 54,549 aircraft registered to LLCs; approximately 2,300 aircraft registered to likely shell companies; 3,300 registered as noncitizen trusts, and 4,200 registered to U.S. citizen corporations using voting trusts. The four types of opaque ownership structures are often established by intermediaries— individuals and entities that facilitate aircraft registration for a fee, such as by establishing legal structures and submitting aircraft registration applications and renewals. (See sidebar.) The use of intermediaries adds a layer of opacity to aircraft registrations. Intermediaries may not know, and most are not required to know, beneficial owners of aircraft they help to register. However, intermediaries that are banks are required to establish due diligence procedures for accepting and monitoring their clients as part of banks’ anti-money-laundering requirements under the Bank Secrecy Act and its amendments. To obtain beneficial ownership information, banks must identify and verify the identity of any individual who owns 25 percent or more of a legal entity, and an individual who controls the legal entity. Other intermediaries are not required to establish due-diligence procedures for accepting and monitoring their clients. Another approach that adds opacity to aircraft registrations is when applicants use the address of a registered agent—a person or entity authorized to accept service of process or other important legal and tax documents on behalf of a business—as the applicant’s address. Although the use of opaque ownership structures, intermediaries, and registered agents can serve legitimate purposes, they can also be abused in the context of aircraft registration to disguise potential ineligibility or hide illicit activity, according to our analysis of registry data and research. (See app. IV for additional details on the use of opaque ownership structures for aircraft registration.) In our analysis of illustrative cases involving U.S.-registered aircraft and our intermediary research, we identified examples where opaqueness and complexities of aircraft registrations using the ownership structures hindered FAA’s ability to prevent abuse of the registry to facilitate other criminal activity. In these examples, intermediaries used mechanisms allowable under current registration requirements to register aircraft, sometimes using multiple ownership structures for the same registration. The first example, based on our review of FAA registration records, illustrates opaqueness of information contained in FAA registration records and includes the use of multiple intermediaries and jurisdictions for an aircraft associated with asset forfeiture. The second example illustrates the use of an intermediary in establishing opaque ownership structures for several aircraft involved in illicit activities, including actions subject to U.S. sanctions. Use of multiple intermediaries and jurisdictions to obscure ownership of aircraft. According to our review of registry documents for this case, an intermediary registered the aircraft in 2010 using a noncitizen trust, providing limited information about the corporate trustor, whose beneficial owner was a high-net-worth foreign national. To register the aircraft, the intermediary—a bank providing corporate owner trustee services for aircraft registrations—established the noncitizen trust. The trust agreement identified the trustor as a company established in the British Virgin Islands. The trustor’s address for correspondence was listed as a post office box in Switzerland, with an email address indicating another trust company. Signatures of two trustors, identified as directors of two other apparent intermediary companies, were illegible and omitted printed names of individuals (see fig. 6). In 2019, the foreign national consented to the forfeiture of this aircraft and other property to DOJ in exchange for the release of certain other frozen assets, with both parties agreeing that the agreement did not constitute a finding of guilt, fault, liability, or wrongdoing. Use of an intermediary to obscure ownership of multiple aircraft. Between 2011 and 2018, an intermediary set up various corporations to facilitate aircraft registrations. The intermediary was an attorney who established the corporations using a registered agent service and also established voting trusts for those corporations to meet U.S. citizenship requirements for the aircraft registrations. Acting as director of these corporations, which have indicators of being shell companies, he registered two aircraft in 2011 and 2013. In 2019, individuals associated with these companies were sanctioned by OFAC as part of a U.S. sanctions program. Specifically, the individuals were designated in connection with paying bribes and involvement in a corruption scheme designed to take advantage of Venezuela’s currency exchange practices. The intermediary facilitated an aircraft sale about a month prior to the OFAC sanction designation for one aircraft and resigned from his position as director of the other company upon the OFAC announcement. Another aircraft registered by a company with the assistance of this intermediary in 2012 was seized in 2016 and forfeited to the U.S. government as part of the black-market currency exchange scheme. The investigation revealed that the aircraft had been purchased by a U.S. corporation whose sole beneficial owner was a Venezuelan individual using proceeds from a scheme that involved black-market currency exchange. The U.S. government seized the aircraft, alleging it was purchased with assets traceable to money laundering or other illegal activities, and the aircraft was later forfeited. Through our research on intermediaries, we identified another aircraft in which this intermediary had been similarly involved. Registration documents for this aircraft indicate a pattern of activity associated with potential trade-based money laundering. We are making a referral to DHS HSI for further investigation to determine whether individuals associated with the aircraft may have engaged in unlawful activity. Opaque ownership structures pose challenges for law-enforcement investigations. According to the 2018 National Money Laundering Risk Assessment, federal law-enforcement agencies noted that misuse of legal entities posed a significant money laundering risk and that law- enforcement efforts to uncover beneficial owners of companies can be resource-intensive, especially when ownership trails lead outside the United States or involve numerous layers. Law-enforcement officials across multiple agencies and FAA ASH, LEAP, and SEIT officials noted that challenges identifying beneficial owners of aircraft can impede their investigations. According to FAA LEAP agents, it is an ongoing challenge for them to identify beneficial owners. For example, according to FAA LEAP agents, a secretary of a company frequently registers aircraft on the company’s behalf and it takes time to determine the identity of the company’s beneficial owner. Limited PII in the registry records further impedes law-enforcement efforts. FAA LEAP agents and law-enforcement officials from DHS HSI and DEA described challenges they experience in their investigative work because aircraft registration records do not contain relevant PII, as noted above. For example, according to LEAP agents, they experience daily challenges identifying individuals without PII, particularly those with common names, hyphenated names, and multiple last names. This can be particularly difficult when aircraft are registered through legal structures, and, as DHS HSI officials noted, penetrating through the layers of ownership can take time, slowing down investigations. Further, one DEA official stated that without PII, identifying beneficial owners of aircraft is a challenge in his investigations, and in two cases he was ultimately unable to identify beneficial owners of aircraft. In prior work, we reported on challenges that law-enforcement officials face in their investigations when information is not available, particularly company ownership information such as names of directors or officers. As discussed earlier, the FAA DEA Act required FAA to promulgate regulations—in consultation with other federal agencies, law-enforcement officials, and representatives of the general aviation industry—that would require individuals to provide driver’s license and taxpayer identification numbers, but did not require applicants to provide date of birth. FAA’s approach, however, did not require applicants to submit driver’s license and taxpayer identification numbers. In part to serve the aviation community, which relies on publicly available registration information for the purchase and sale of aircraft, in 2005 FAA determined that adding PII to the records would require restricting access to them and therefore it would be detrimental to users of aircraft records, burdensome on aircraft owners and the government, and not necessary for law enforcement. FAA’s IT Modernization The Federal Aviation Administration (FAA) is making plans to modernize its information technology (IT) infrastructure for the registry, including potentially revising relevant regulations. According to FAA, it plans, among other things, to (1) enhance service delivery through process improvement and automation for near real-time access to accurate information; (2) utilize technology to reduce or eliminate mail, fax, or paper-driven service requests, processing, and information delivery; and (3) utilize technology to mine data to support risk-based decision-making, including the use of business intelligence algorithms to eliminate fraud, inaccurate information, and inappropriate use. In a May 2019 report, the Department of Transportation (DOT) Office of Inspector General (OIG) assessed FAA’s efforts and plans and determined that the agency has not identified costs, schedule, or an acquisition strategy for IT modernization. DOT OIG recommended, among other things, that FAA develop a timeline for making key decisions to implement IT modernization. See Department of Transportation, Office of Inspector General, FAA Plans To Modernize Its Outdated Civil Aviation Registry Systems, but Key Decisions and Challenges Remain, AV2019052 (May 8, 2019) We recognize the concerns for federal agencies associated with collecting and storing PII as well as the potential burden for applicants to submit such information. However, according to FAA officials, the IT modernization for which FAA is currently in its planning stages is intended to provide FAA the technical capability to adjust the level of access to registry records for various users, restricting PII access for some while allowing broader access to authorized users such as law-enforcement agencies. (See sidebar.) Industry associations and corporate registry users we interviewed expressed concerns about client privacy; however they also indicated openness to future technology improvements of FAA systems. Additionally, as noted earlier, use of PII is a key way federal programs verify the identity and eligibility of potential beneficiaries. Including in the planning stages of IT modernization basic elements of PII such as name, date of birth, physical address, and a driver’s or pilot’s license could provide FAA with the initial capability to verify applicant information while it develops a risk-based approach informed by its risk assessment. According to federal internal control standards, managers should use quality information to achieve the entity’s objectives, including obtaining relevant data from reliable internal and external sources in a timely manner. By not collecting and recording PII at the time of application and renewal, FAA has limited assurance of registrants’ eligibility, and lacks information that could support its oversight and law-enforcement officials’ ability to identify relevant persons and entities as part of investigations involving registered aircraft. As with applicant PII, FAA does not require applicants to submit information on beneficial owners of aircraft—individuals and certain entities that own more than 25 percent of the aircraft. In addition to the federal internal control standards for managers to use quality information to achieve the entity’s objectives, U.S. implementation of international standards for combating money laundering and terrorism financing would need to ensure availability of adequate, accurate, and timely information on beneficial ownership of high-value assets. By not collecting and recording information on beneficial owners in an electronic format that facilitates data analytics, FAA has limited assurance of registrants’ eligibility, and lacks information that could support its oversight and law- enforcement officials’ ability to identify relevant persons and entities as part of investigations involving registered aircraft. FAA makes some use of registry information on a case-by-case basis to detect potential fraud and abuse. FAA LEAP agents, in addition to supporting law-enforcement officials by providing access to registry information and specialized guidance related to aviation issues, have conducted registry analyses to identify suspicious and potentially illicit actors. For example, in 2018, FAA LEAP agents and registry officials started a project to flag aircraft registrations for FAA LEAP monitoring when applications are filed by entities or individuals, such as multiple shell companies associated with a certain individual, suspected of abusing registry processes. Additionally, one FAA LEAP agent told us that he reviews aircraft registrations filed the previous day and checks them against other information sources to determine suspicious activity, sharing leads identified through this analysis with law-enforcement officials for further investigation. However, this case-by-case review is limited to the data and information FAA currently collects, and is further hindered by a data format that does not support data analytics for fraud and abuse detection. FAA collects some information that could support fraud and abuse detection and oversight. As described earlier, FAA collects information on aircraft owners from the registration application, such as name and address, and these data are searchable and electronically analyzable. In April 2018, FAA also began tracking aircraft registrations that use voting trusts to meet U.S. citizenship requirements and trusts with noncitizen trustors, which are opaque ownership structures discussed earlier. This included recording in ancillary files the names of individuals and entities with potentially significant responsibilities for aircraft ownership, such as trustors and voting trustees. Additionally, according to FAA and some industry officials, the 3-year registration renewal implemented in 2010 has helped improve the quality of registry data that FAA collects. According to FAA officials, in addition to updating owner address information, registration renewal improves data quality as it prompts (1) reports of unreported aircraft sales, (2) new registrations due to ownership changes, and (3) cancelations due to destruction, scrapping, and exports. However, the benefits of registration renewal for data-quality purposes could diminish when the renewal period for noncommercial general aviation aircraft changes from 3 to 7 years, in alignment with new requirements from the FAA Reauthorization Act of 2018. Nevertheless, most of the information that FAA collects in the ancillary files and elsewhere is not recorded in a format that facilitates data analytics, according to our review of FAA’s registry system. Specifically, data on individuals and legal entities with potentially significant responsibilities for aircraft ownership such as trustors, beneficiaries, stockholders, directors, and managers are stored as imaged PDF records that, due to information-system limitations, cannot facilitate data analytics. For example, information on LLC directors and managers as well as directors, managers, and stockholders of U.S. citizen corporations that use voting trusts is stored in imaged records. Our intermediary research identified an aircraft registered to a company whose sole stockholder was subject to U.S. sanctions; however, FAA currently stores data on foreign stockholders of U.S. citizen corporations that use voting trusts in PDF records, preventing it from being able to conduct data analysis to identify such individuals or entities for all registrations. Such data may be useful in identifying entities and individuals subject to U.S. sanctions, as discussed below. Additionally, the current system configuration limits FAA to viewing individual records within the ancillary files. This configuration prevents agency officials from tracking aircraft registration numbers—a common identifier—across records or linking them to the registration data portion of the registry. Further, FAA internally tracks noncitizen trusts and U.S. citizen corporations using voting trusts as one category within registry data, preventing analysis and monitoring of each group of registrations. Lastly, FAA stores records of declarations of international operations— requests that expedite registration processing for aircraft intending to travel outside the United States—as imaged PDF records, so information about the aircraft, owner’s name, departure and destination locations, date of intended travel, and name of the individual submitting the declaration are not in a format that facilitates data analytics. According to 2017–2018 analysis of information from declarations of international operations with checks against flight history data, FAA SEIT identified patterns of activity that could be used in support of safety and law- enforcement investigations, as discussed later in this report. Furthermore, due to manual data entry and lack of verification, the registry’s postal data may not support effective data analytics and oversight. FAA staff also have the option to override the formatting prompts produced by its address validation software. Our analysis of 2018 physical and mailing address data found that about 25,000 (9 percent) of all registrant addresses did not match a valid address in the USPS postal verification data, while just over 300 (about 3 percent) of all dealer addresses did not match. Of the seven aircraft registration cases we selected based on address category and locality, we found three registrant addresses that indicated a registry data-quality issue and one that did not. Specifically, our review of the application forms for two registrants showed that a physical address was provided by the registrants, but was not recorded in the physical address file. In another case, our review of five registration records for one company showed that FAA revoked registrations for the five aircraft in 1971, but did not deregister them until 2019, sending deregistration notification letters to the original address, which were returned as undeliverable. We did not find any noncompliance in the last case and, based on our review of aircraft registration documents, determined that a change of address form was provided to FAA following the most-recent renewal, but the new address had not yet been updated at the time we received the physical address data. As described earlier, FAA is taking steps to modernize its IT system for the registry because it is outdated. According to a recent DOT OIG report, the system had its last significant upgrade in 2008, is approaching the end of its service life, suffers intermittent outages, and uses an outdated programming language. According to FAA, the future system is expected to streamline and automate processes, allow for the submission of electronic forms, improve online data availability, and implement additional security controls, such as software that can cross-check aircraft registrations with other government databases. In December 2018 and June 2019, FAA issued requests for information to conduct a market survey and to develop a strategy based on feedback received, respectively. As of November 2019, FAA was making plans to issue a request for proposal, but did not identify specific time frames. Registry system modernization presents an opportunity to mitigate data format limitations as FAA designs new systems and controls. According to federal internal control standards, managers should use quality information to achieve the entity’s objectives. Managers can do that by designing processes and identifying information requirements needed to achieve objectives and address risks as well as by processing obtained data into quality information that supports the internal control system. This could include electronically analyzable information from declarations of international operations and information on owners and related individuals and entities with potential significant responsibilities for aircraft ownership such as beneficial owners, trustors, trustees, stockholders, directors, and managers. Without analyzable data on significant parties involved in aircraft registrations that can be linked through a common identifier, FAA is limited in its ability to exercise its domestic and international oversight functions and fully support safety and law-enforcement investigations. Use of data analytics to detect suspicious activity, anomalies, or patterns is one of the leading practices identified in GAO’s Fraud Risk Framework. However, registry officials primarily use collected data to send automated notifications, such as for aircraft renewals, and current use of data to support oversight is limited, in part hindered by data format limitations described earlier. In addition, registry officials do not analyze various external data sources against registry data to detect patterns of potential fraud or abuse. Risk indicators identified through such analyses may serve as points of inquiry for a broader fraud risk assessment, or for further examination of conduct that may pose criminal, national security, or safety risks. To demonstrate how FAA could identify registrations with indicators of potential fraud or abuse that may enable criminal activity, national security, and safety risks, we analyzed aircraft registry and related data. Specifically, we analyzed aircraft registry data from publicly available and ancillary files, as well as matched registry data against other datasets to identify (1) registrations using registered agent address, (2) registrations using opaque ownership structures, (3) aircraft registration addresses located in countries identified by the Department of State as associated with major illicit drug production and money laundering, (4) OFAC data on individuals and entities subject to U.S. sanctions, and (5) NTSB safety accident and incident reports. Based on this analysis, we found over 17,000 registrations out of approximately 300,000 registrations associated with one or more risk indicators for fraud or abuse. The majority of registrations (over 15,000 or about 90 percent) were associated with one risk indicator, about 2,000 registrations (10 percent) were associated with two risk indicators, and the remaining 140 (1 percent) were associated with three or more risk indicators. The results of our various analyses are described below. Use of registered agent address. As discussed earlier, registered agents are authorized to accept legal documents on behalf of a business. According to FAA officials, FAA will accept the use of a registered agent’s address as a mailing address, provided the owner’s physical address is also included. Our analysis of registry data identified cases where a registered agent’s address was recorded as the registrant’s physical address. The registry data do not specifically identify registered agents, but by analyzing address information for calendar year 2018, we identified at least 4,080 cases using registered agents’ addresses. For one of the registered agents we were able to confirm, we identified 965 associated registrations, including about 300 registrations associated with characteristics of a likely shell company or that were a noncitizen trust or a U.S. citizen corporation using a voting trust. Further, for this one registered agent, we identified about 280 unique business names, associated with about 760 registrations, which used this registered agent’s address on aircraft registration applications. Additionally, based on our analysis of postal address data provided by FAA as well as verification of selected cases, we identified and confirmed through site inspections two additional registered agents whose addresses were used in over 100 registrations and over 3,220 registrations, respectively. Use of registered agent addresses, when not accompanied by physical address information, particularly in combination with opaque ownership structures, provides a layer of anonymity to beneficial owners of aircraft and may mask ineligibility or illicit actors. Noncitizen trusts and U.S. citizen corporations using voting trusts. We reviewed internal FAA trust data from April 2018 through May 2019— the full range of data available at the time of our review—to identify the number of registrants that were noncitizen trusts or were U.S. citizen corporations using a voting trust. In total, we found about 6,800 such registrations contained in the registry data. Of these registrations, two were associated with individuals subject to U.S. sanctions, four were associated with an FAA revocation or suspension, and 16 appeared to be shell companies. FAA regulations allow for registrations using noncitizen trusts and U.S. citizen corporations using voting trusts as valid means of enabling registrants to meet FAA’s citizenship requirements. However, as discussed earlier and according to FAA and law-enforcement officials, registrations using noncitizen trusts and U.S. citizen corporations using voting trusts may also mask ineligibility or illicit actors. Consistent with their program-management responsibilities, if FAA registry officials detect aircraft owners, dealers, or intermediaries potentially abusing registration requirements or abusive use of noncitizen or voting trusts, they may send them warnings of denial of future services if observed abusive actions continue. For example, if registry officials suspect that an entity applying for registration is misrepresenting its citizenship, officials could request citizenship information as appropriate for the president, board of directors, and managing officers. If the inquiry results in a determination that the entity does not qualify as a citizen, FAA could deny the application or issue a letter of apparent ineffectiveness for an existing registration. However, according to FAA officials, they take mitigation actions on a case-by-case basis because they do not have a systematic way to analyze data and detect potential fraud and abuse. Department of State country lists associated with major illicit drug production and money laundering. We analyzed registry address data using lists of countries associated with major illicit drug production and money laundering published by the Department of State to identify aircraft registrations associated with such countries. We found 251 registrations with addresses located in countries on the Department of State’s list of money laundering jurisdictions that were registered as noncitizen trusts or corporations using voting trusts. Countries identified in the Department of State’s lists do not necessarily indicate that a registration is associated with criminal activity. However, the risk of abuse or illicit activity with these registrations may be increased when combined with the use of opaque ownership structures, another risk indicator that, according to FAA and law-enforcement officials, may mask ineligibility or illicit activity. U.S. sanctions. We analyzed and matched registry data to U.S. sanctions data that contain information on blocked assets and sanctioned entities and individuals. Through this data analysis as well as illustrative case and intermediary research, we identified six aircraft owned by entities subject to Venezuela-related U.S. sanctions from 2017 to February 2019. These six aircraft involved registrations established by intermediaries using noncitizen trusts or by U.S. citizen corporations using voting trusts, where aircraft were beneficially owned by noncitizen trustors or stockholders of companies using voting trusts to meet U.S. citizenship registration requirements. However, as discussed earlier, trust agreements that contain information on aircraft owners and related individuals and entities with potentially significant responsibilities for aircraft ownership are stored in PDF format that are not electronically analyzable, potentially inhibiting detection of sanctioned individuals or entities. Additionally, our analysis identified limitations in the sharing of sanctions information within FAA, specifically between the aircraft registry and dealer records. These limitations present the risk of registry abuse or illicit activity through sanctions violations while potentially impeding effective coordination between FAA and Treasury’s OFAC, which administers U.S. sanctions programs. On the basis of U.S. national security and foreign policy goals, OFAC can impose controls on transactions and block or freeze assets under U.S. jurisdiction, including aircraft. By blocking an asset such as an aircraft, its title remains with the targeted individual or entity; however, these individuals and entities cannot exercise the powers and privileges normally associated with ownership unless authorized by OFAC. Certain activities related to the use of the aircraft may violate the relevant sanctions program. Additionally, OFAC regulations generally prohibit persons and entities within the United States from engaging in transactions involving blocked property—including U.S-incorporated companies and aircraft—of sanctioned individuals and entities. OFAC-Sanctioned Aircraft One of the U.S.-registered aircraft about which Treasury’s Office of Foreign Assets Control (OFAC) notified the Federal Aviation Administration (FAA) was used as part of an illicit narcotics trafficking scheme. According to its 2017 announcement, OFAC designated a high-ranking Venezuela government official as a Specially Designated Narcotics Trafficker pursuant to the Foreign Narcotics Kingpin Designation Act (“Kingpin Act”) for playing a significant role in international narcotics trafficking. According to OFAC, the sanctioned official used a front man who laundered drug proceeds and purchased assets. In addition to a network of international companies, according to OFAC, the front man owned or controlled five U.S. companies, including a limited liability company (LLC) that registered an aircraft with FAA and used a voting trust to meet U.S. citizenship requirements. As part of its action, OFAC identified the U.S.-registered aircraft and the LLC as blocked property. FAA deregistered the aircraft in 2019 after registration renewal documentation submitted to FAA contained numerous errors. However, because the flags placed on sanctioned individuals’ and entities’ registration records do not extend to dealer records, FAA issued a dealer certificate to the blocked LLC after the OFAC designation and without coordination with OFAC, according to FAA records and officials. The blocked LLC held the dealer certificate for a year until the certificate expired. (See app. I.) FAA relies on OFAC to share information on sanctions and does not check whether applicants and aircraft are subject to U.S. sanctions or blocking at registration, at renewal, or on a periodic basis. Specifically, FAA does not proactively obtain and use OFAC data to detect (1) blocked aircraft, (2) entities or individuals subject to sanctions, or (3) those with potentially significant responsibilities for aircraft ownership, such as intermediaries registering on behalf of blocked aircraft or entities. Our analysis of the six cases revealed that OFAC officials initiated coordination with FAA, notifying FAA about four of the six cases. According to FAA officials, when FAA finds out about a blocking action from OFAC, it internally flags registry records and will withhold registration processing actions until further communication with OFAC. However, according to FAA officials, FAA does not have the authority to deny or revoke a registration solely because the registration is associated with an individual subject to OFAC sanctions. Accordingly, in those instances, FAA would register the aircraft or the aircraft’s registration would remain valid. In addition, although FAA flags sanctioned individuals’ and entities’ registry records, the flags do not extend to dealer certificate records. As a result, sanctioned individuals or entities flagged in aircraft registration records are not flagged by FAA for OFAC coordination before receiving a dealer certificate, which could allow operation of blocked aircraft under that certificate. One of the six cases we identified illustrates the criminal and national security risks involved with the use of U.S.-registered aircraft by OFAC-sanctioned individuals and entities, as well as risk-management challenges associated with dealer certificates. (See sidebar.) OFAC efforts to identify aircraft assets associated with sanctioned individuals and entities can encounter obstacles. According to OFAC officials, they search the publicly available FAA registry to identify aircraft for potential blocking. Where OFAC is aware that a sanctioned individual has control of a company, and the company had directly registered an aircraft, a search of the public database can provide relevant information about the aircraft. However, according to OFAC officials, identifying aircraft is more challenging when, for example, a voting trust or a shell company is the registered owner. As a result, OFAC does not have all the information from FAA it might need to support its investigations or enforcement when aircraft associated with sanctioned entities and individuals are not readily identifiable. FAA’s IT modernization provides an opportunity for FAA to link flagged records across aircraft registration and dealer systems and to proactively check OFAC sanctions data. OFAC provides information on individuals and entities subject to sanctions on its website that can be checked using online searches or by downloading data, but FAA officials said that checking sanctions designations would require resources and extend processing time for aircraft registrations. However, automated linkages across aircraft registration and dealer systems, and checks of OFAC information, could be achieved through FAA IT modernization, which aims to automate near-real time access to accurate information. An aspect of the modernization project could involve automatically cross-referencing sanctions data, which are dynamic and updated in real time in response to U.S. sanctions programs, with aircraft registration information on owners and related individuals and entities with potentially significant responsibilities for aircraft ownership, such as intermediaries. FAA noted that it does not have authority to deny or revoke a registration based solely on an OFAC sanctions designation. Nevertheless, records that are flagged across aircraft registration and dealer systems, as well as awareness of blocked aircraft, sanctioned owners, or intermediaries doing business with sanctioned entities, would help to ensure coordinated actions with OFAC. Such coordination would allow OFAC to seek a delay from FAA of the registration or dealer certification, to alert law- enforcement agencies to determine aircraft location, or to coordinate with its U.S. partner agencies on investigations as appropriate. By not linking flagged records across systems and not proactively checking OFAC sanctions data, FAA and OFAC may be unaware of, and therefore not well-positioned to manage, risks associated with registration of blocked aircraft, sanctioned entities, or intermediaries operating in violation of U.S. sanctions. In addition, FAA misses opportunities to address abuse of the registry for illicit purposes, as well as to provide information to OFAC in support of U.S. efforts to curb drug trafficking, corruption, and other illicit activity. Aircraft primarily operating outside the United States. According to our analysis of NTSB data, we identified 303 cases of U.S.-registered aircraft involved in accidents and incidents outside the United States from calendar years 2010 to 2018. According to FAA officials and our illustrative case research, U.S.-registered aircraft that are primarily based and operated outside the United States may be associated with risk of registration abuse. For example, FAA SEIT and LEAP officials told us that they were aware of numerous cases of aircraft operated primarily outside the United States that were registered to nominee buyers. In addition, they noted international operation of aircraft that were associated with illicit activity and registration violations such as bills of sale identifying foreign owners and cloned registrations. A 2010 case involving a U.S.-registered aircraft seized for alleged drug trafficking by the Panamanian government highlights registration violation risks related to aircraft primarily operating outside the United States. After Panama seized the aircraft, it was turned over to the country’s civil aviation authority (CAA), which registered the aircraft in Panama and painted a Panamanian registration number on it. According to FAA officials, the CAA did not seek to deregister the aircraft from the United States, and the new registration was likely invalid under international law. According to FAA officials, the Panamanian CAA operated the aircraft for about 1 year before it crashed. During that time, the aircraft remained registered to the original U.S. owner at a registered agent address. FAA sent multiple letters to the owner to deregister the aircraft and also when the aircraft registration was expiring, but all were returned as refused by the registered agent. Multiple Safety Violations Contributed to the Crash of an Aircraft Primarily Operating Outside the United States Our research identified a case where safety violations contributed to a fatal accident in the Caribbean involving a U.S.-registered aircraft in 2016. A Jamaican aviation training center was operating the aircraft since 2015 and at the time of the crash. The accident investigation by Jamaican authorities identified multiple safety deficiencies as the causes and contributing factors of the crash. This included falsified aircraft maintenance records, an engine replacement that did not conform to aircraft model and type, and the use of non-U.S.-certified maintenance programs. (See app. I.) Furthermore, aircraft that are based and primarily operated outside the United States may pose safety risks by not meeting FAA aircraft maintenance standards. Once registered with FAA, aircraft owners must continue to meet eligibility requirements and, along with operators, comply with certain maintenance responsibilities in order to operate, regardless of their location. According to FAA officials, U.S.-registered aircraft operating outside the United States may receive less scrutiny and inspections from other countries’ CAAs, and nefarious actors prefer a U.S. registration when aircraft are inspected abroad. Additionally, FAA SEIT and LEAP officials told us that they were aware of many U.S.- registered aircraft primarily operating in Latin American countries that may not be following required U.S. maintenance programs, thus posing aviation safety risks. One of our case studies highlights safety risks related to U.S.-registered aircraft that are primarily based and operated outside the United States. (See sidebar.) In another example involving 2011 and 2013 FAA examinations, an FAA maintenance inspector conducted inspections of U.S.-registered helicopters and airplanes located in Panama at the request of the Panama CAA and found multiple violations. According to FAA, the inspection of 16 aircraft initially found that, in addition to registration issues such as flying with a temporary registration, ten aircraft had maintenance issues, including maintenance performed by nonauthorized personnel. At least seven of the issues identified during this inspection resulted in FAA enforcement actions. According to this official, two of the aircraft had significant maintenance concerns and were not airworthy. On the basis of his experience inspecting aircraft domestically, safety violations among the aircraft inspected in Panama were more significant. In combination with other data sources and information, flight history data can provide indications of safety risks associated with aircraft based and primarily operated outside the United States. However, according to registry officials, they do not use these data to identify such risks. To examine specific registrations based on the entire risk-indicator data analysis, we also reviewed randomly selected aircraft registrations across each overall risk-indicator category. Our review of 20 selected registrations generally confirmed the risk-indicator characteristics we had identified for analysis. We did not identify further indicators of risk as part of this review except for the OFAC cases described earlier. Analysis of various data sources, alone or in combination, can help detect patterns of potential fraud or abuse. As demonstrated by our analysis, FAA data, such as postal addresses, information on dealers, noncitizen corporations, intermediaries, and entities with significant responsibilities for aircraft ownership, among others, along with various external databases could be used for such a purpose. FAA also has access to flight history data, currently used on an ad hoc basis, but which could also serve for (1) routine oversight functions such a verifying aircraft are based and primarily operating in the United States for certain registrant types or (2) to detect patterns of activity associated with declarations of international operations that could be used in support of safety and law- enforcement investigations. In addition, our analysis of registry data against external data sources, such as OFAC sanctions lists, illustrates the utility of such analyses for detecting registrant risks. FAA currently does not use internal or external information for such analysis or to assist in safety or law-enforcement oversight responsibilities across multiple aircraft, registrations, or dealer certificates. This is due, in part, to data limitations, but also because, according to registry officials, their role is primarily focused on recording of aircraft registration information. Aircraft registration data made available through IT modernization, as well as other currently available data, could support ongoing monitoring and risk- based oversight by FAA. Federal internal control standards call on managers to establish and operate activities to monitor the internal control system and evaluate results. By not analyzing available internal and external data, FAA is missing opportunities to identify registrant risks, conduct oversight, and safeguard the registry from potential fraud and abuse. Furthermore, while FAA registry officials may take risk-based mitigation actions, such as by sending warnings letters or denying services if abusive actions are detected, it generally does not take such action. According to FAA officials, the registry focuses on recording information, while it is currently the responsibility of other FAA organizations, such as ASH, LEAP, and SEIT, to detect fraud. However, federal internal control standards require managers to respond to risks by remediating internal control deficiencies on a timely basis. Without timely and measured risk-based mitigation actions, the aircraft registry continues to be vulnerable to fraud and abuse. In this context, as the key program office, aircraft registry is best positioned to manage fraud and abuse risks—by preventing, detecting, and responding to risks—in close coordination with stakeholder organizations such as ASH, LEAP, and SEIT. FAA and law-enforcement agencies have a variety of enforcement mechanisms to respond to instances of suspected fraud and abuse in aircraft registrations. For example, FAA can use administrative actions, such as aircraft registration suspensions and revocations, and law- enforcement agencies can use civil actions and criminal prosecutions to seize aircraft, among other enforcement actions. Law-enforcement agencies such as DEA, DHS HSI, and DOT OIG have authority to investigate criminal activity and take actions to seize aircraft when warranted. Recognizing the need for better dialogue and coordination, in August 2017 FAA LEAP agents launched the Aircraft Registry Task Force to discuss ideas and solutions for dealing with potentially fraudulent aircraft registrations and to improve FAA processes to assist the law-enforcement community. The first meeting, in August 2017, included participants from FAA—aircraft registry officials, legal counsel, ASH, LEAP, and SEIT—as well as other federal agencies, including DEA and DHS HSI. This meeting was the first time these various units came together to discuss aircraft registry vulnerabilities. FAA and law-enforcement officials presented cases associated with fraudulent aircraft registrations, highlighting safety implications. Participants also discussed issues related to deregistration, and aircraft seizures, among others. According to aircraft registry officials and FAA LEAP agents, the task force meeting discussions resulted in several changes, including revisions to the signature block in the aircraft application form, addition of a separate registration type for LLCs for tracking purposes, and sharing of declarations of international operations with FAA LEAP and SEIT. Specifically, regarding modifications to the signature block, in 2018 FAA added a statement requiring applicants to certify that information they provide is true and accurate while also identifying specific penalties for false information. The subsequent task force meeting, held in October 2018, included only FAA participants. Aircraft registry officials, legal counsel, ASH, LEAP, and SEIT, among others, discussed follow-up from the previous meeting and covered topics associated with ongoing concerns such as falsification of registration documents, incomplete applications, and proof of citizenship, among others. According to FAA officials, since the October 2018 meeting, the task force has not met. FAA and DEA have also established informal mechanisms to address registration violations and safety risks associated with aircraft based and operated outside the United States. For example, in 2016 and 2017, DEA and FAA LEAP and SEIT officials conducted a joint initiative at the request of the government of Guatemala to examine multiple U.S.- registered aircraft located in Guatemala. According to FAA, a total of 81 U.S.-registered aircraft were inspected through this effort as of April 2017. During the inspections, FAA identified more than 25 registration violations and numerous safety violations resulting in approximately 31 condition notices. Additionally, authorities seized eight aircraft with an approximate value of $2.5 million as well as over 400 kilograms of cocaine. According to FAA, registration violations identified during this effort included inconsistencies with trust agreements and associated documentation, violations involving U.S. corporations having individuals listed as president who do not meet U.S. citizenship requirements, and documentation allowing non-U.S. citizens to control U.S.-citizen entities that had registered aircraft. Since then, according to FAA officials, on the basis of the results of this initiative, DEA and FAA officials have conducted similar visits to other countries in Latin America and the Caribbean. The visits typically include training for local CAA officials on authorities to inspect U.S.-registered aircraft, ramp checks of U.S.- registered aircraft located in these countries, and maintenance inspections. FAA and DHS HSI also use informal collaboration mechanisms to support law-enforcement investigations. According to DHS HSI officials, they have a robust relationship with an FAA LEAP agent with whom they communicate on a daily basis. This agent has helped to investigate aircraft sale transactions and other cases and also provided leads to DHS HSI officials. Declarations of International Operations The Convention on International Civil Aviation requires registration certificates for international operations. The Federal Aviation Administration’s typical registration process takes 16–20 working days, during which applicants may fly domestically using a temporary registration. Registry officials have put in place declarations of international operations for applicants to notify the registry of the intent to operate internationally thereby expediting typical processing time to the same day or next day. FAA registry officials have been sharing expedited registration filings— declarations of international operations to expedite registration processing for aircraft intending to travel internationally—with FAA LEAP and SEIT officials for monitoring and analysis purposes. (See sidebar.) However, this informal collaboration does not extend to FAA sharing of declarations of international operations with DHS HSI or DEA. According to law- enforcement officials, declarations of international operations present challenges. Specifically, DEA officials noted that expedited registrations limit the amount of time law enforcement can effectively query appropriate sources of information to determine that payment for the aircraft is not derived from illicit proceeds. In addition, according to DEA officials, expedited registrations shorten the amount of time investigators have to determine whether the aircraft is being used to facilitate drug crimes and to identify beneficial owners of the aircraft, which, as discussed earlier in this report, can be a time-consuming process. The lack of notification about declarations of international operations further compounds these challenges. DHS HSI officials explained that they have experienced challenges not receiving information from expedited registrations, which could have allowed some illicit actors to expediently move or export aircraft out of the country, including as part of trade-based money laundering or trafficking schemes. According to these officials, aircraft can be purchased with illicit proceeds to launder money as well as used to smuggle illicit cargo such as persons, cash, cigarettes, and liquor. DHS HSI officials stated that, in one case, which resulted in aircraft seizure, the aircraft potentially could have been seized 2 years earlier if they had received declaration of international operations at the time of aircraft registration. Additionally, according to DHS HSI officials, information from declarations of international operations could help to generate leads, including information on planned travel to countries that are associated with illicit drug trafficking or money laundering. For example, they noted that in investigations of trade-based money laundering schemes, information from declarations of international operations can be used to check against shipping export declarations and trade data from other countries. Separately, in our analysis of aircraft registered to entities subject to U.S. sanctions described earlier, we found that five of the six aircraft registrations received expedited processing. Although not a precise indicator of actual travel, information from declarations of international operations could provide timely information about potential planned movement of aircraft in time-sensitive situations as well as bring awareness for longer-term investigative purposes. Expedited registrations provide more immediate opportunity to move aircraft out of the country and information on applicants’ intention to do so, which can inform monitoring and law-enforcement action. However, FAA does not provide declarations of international operations to DHS HSI or DEA. Without declarations of international operations, these law-enforcement entities may be missing opportunities to generate leads that would ultimately support FAA’s interests in addressing abuse of the registry for illicit purposes and support detection and response to potential trade-based money laundering and other cross-border schemes. Our prior work on interagency collaboration identified practices that can help enhance and sustain collaboration among federal agencies, including written agreements and use of liaison positions. Agencies that articulate their agreements in formal documents, such as memorandums of understanding, can strengthen their commitment to working collaboratively. Additionally, articulating a common outcome and roles and responsibilities in a written document can facilitate coordination. Similarly, the use of liaison positions, when an employee of one organization is assigned to work primarily or exclusively with another agency, can enhance coordination. For example, by providing direct access to agency information, liaison positions have helped to facilitate sharing of information and coordination of missions and activities. As relatively new and unofficial collaboration mechanisms, the Aircraft Registry Task Force and other efforts have not been fully utilized or leveraged some of the enhanced collaboration practices such as written agreements or liaison positions at law-enforcement agencies. While FAA LEAP agents coordinate with law-enforcement officials, these are not liaison positions as suggested by leading practices for collaboration, wherein an employee is assigned to or works primarily with another agency and has direct access to agency staff and information, and arrangements are formally outlined, such as in memorandums of understanding. Rather, FAA LEAP agents are assigned to FAA and do not have formal agreements for collaboration. The Aircraft Registry Task Force holds potential for FAA to work collaboratively internally and externally by formalizing various informal coordination efforts, such as international inspections by FAA and DEA and sharing of declarations of international operations with law-enforcement agencies, to bring together varied perspectives, functions, and skill sets necessary to mitigate aircraft registry vulnerabilities going forward. Leading practices in risk management also call for involvement of relevant stakeholders as part of risk-assessment and risk-mitigation activities. In the FAA context, the aircraft registry is best positioned to develop preventive measures and controls in coordination with FAA LEAP, SEIT, and law-enforcement stakeholders. FAA’s aircraft registry, the largest in the world, is preferred by aircraft owners for safety, economic, and financial reasons. Accordingly, the integrity of owner information for registry users is important to support these benefits. It is also important to ensure the registry is not exploited for fraudulent purposes or to support illicit activity involving U.S.- registered aircraft. FAA’s current process does not include strong controls to prevent ineligible registrants and potential fraud and abuse, instead allowing registrants to self-certify their information with limited independent review. A comprehensive registry risk assessment could help to manage risks of fraud and abuse, which enable criminal, national security, and other risks. Such a risk assessment, which considers inherent and residual risks as well as determination of likelihood, impact, and risk tolerance, would support the development of a risk-based strategy and approach to guide registry actions in preventing, detecting, and responding to fraud and abuse risks. To support its eligibility determinations, FAA currently obtains limited PII from individual registrants, aircraft dealers, or those entities (e.g., trustors) who might have a significant role in aircraft registrations. Additionally, the registry lacks information about beneficial owners of aircraft. Further, the registry generally accepts self-certification of eligibility and aircraft ownership and does not verify the information it receives. Such an approach may be appropriate for the majority of law-abiding registrants, but it leaves the registry vulnerable to exploitation by those who wish to circumvent eligibility requirements, disregard safety standards, or pursue criminal activities. Limited transparency into who beneficially owns aircraft has also precluded FAA from maximizing its collaboration with partners in the law-enforcement and safety communities to support detection and investigation of criminal, national security, and safety risks associated with registered aircraft. U.S. taxpayers have subsidized the costs of aircraft registration for several decades. Without a change to aircraft registration and dealer fees, the costs of FAA labor, technology, coordination, and risk-based oversight for these high-value assets would continue to be borne by the public and limit resources available for applicant verification. The absence of more and electronically analyzable information has substantially hindered FAA’s ability to use the registry as a tool to detect potential fraud and abuse and to oversee registered aircraft. As part of its ongoing IT modernization, FAA has an opportunity to collect such data and record them in a format that facilitates data analytics. These data could help FAA detect potential fraud and abuse and conduct preventive, risk-based monitoring and oversight of aircraft registrations as well as dealer certifications to ensure the integrity of the registry. They would also support a risk-based approach for verifying information provided by some registry applicants as well as for taking corrective actions. Additional information would position FAA to more broadly prevent, detect, and respond to risks associated with the aircraft registry and to facilitate data analytics by FAA and stakeholders for oversight, safety, and law- enforcement purposes. For example, FAA officials could analyze data patterns for potential fraud and abuse, as well as share data across dealer and aircraft records and to check OFAC sanctions data to ensure that they coordinate about owners with sanctions designations, as appropriate. Lastly, FAA lacks formal agreements with other federal entities to respond to risks. Specifically, FAA can provide additional support to law- enforcement and safety investigations by sharing quality information about individuals and entities with potentially significant responsibilities in aircraft registrations, as well as other registration information, such as declarations of international operations. FAA’s Aircraft Registry Task Force positions FAA to work collaboratively internally—among officials from the aircraft registry, legal counsel, ASH, LEAP, and SEIT—and with external law-enforcement to share information and to take advantage of collaborative mechanisms to formalize coordination. We are making the following 15 recommendations to FAA: The Administrator of FAA should conduct and document a risk assessment that considers inherent and residual fraud and abuse risks that may enable criminal, national security, or safety risks. (Recommendation 1) The Administrator of FAA should determine impact, likelihood, and risk tolerance as part of a risk assessment. (Recommendation 2) The Administrator of FAA should develop a strategy that outlines specific actions to address analyzed risks, including periodic assessments to evaluate continuing effectiveness of the risk response. (Recommendation 3) The Administrator of FAA should collect and record information on individual registrants, initially including name, address, date of birth, and driver’s license or pilot’s license, or both, with subsequent PII elements informed by the risk assessment, once completed. (Recommendation 4) The Administrator of FAA should collect and record information on legal entities not traded publicly—on each individual and entity that owns more than 25 percent of the aircraft; for individuals: name, date of birth, physical address, and driver’s license or pilot’s license, or both; and for entities: name, physical address, state of residence, and taxpayer identification number. (Recommendation 5) The Administrator of FAA should verify aircraft registration applicants’ and dealers’ eligibility and information. (Recommendation 6) The Administrator of FAA should increase aircraft registration and dealer fees to ensure the fees are sufficient to cover the costs of FAA efforts to collect and verify applicant information while keeping pace with inflation. (Recommendation 7) The Administrator of FAA should ensure, as part of aircraft registry IT modernization, that information currently collected in ancillary files or in PDF format on (1) owners and related individuals and entities with potentially significant responsibilities for aircraft ownership (e.g., beneficial owners, trustors, trustees, beneficiaries, stockholders, directors, and managers) and (2) declarations of international operations is recorded in an electronic format that facilitates data analytics by FAA and its stakeholders. (Recommendation 8) The Administrator of FAA should link information on owners and related individuals and entities with significant responsibilities for aircraft ownership through a common identifier. (Recommendation 9) The Administrator of FAA should, as part of IT modernization, develop an approach to check OFAC sanctions data on owners and related individuals and entities with potentially significant responsibilities for aircraft ownership for coordination with OFAC and to flag sanctioned individuals and entities across aircraft registration and dealer systems. (Recommendation 10) The Administrator of FAA should use data collected as part of IT modernization as well as current data sources to identify and analyze patterns of activity indicative of fraud or abuse, based on information from declarations of international operations, postal addresses, sanctions listings, and other sources, and information on dealers, noncitizen corporations, and individuals and entities with significant responsibilities for aircraft ownership. (Recommendation 11) The Administrator of FAA should develop and implement risk-based mitigation actions to address potential fraud and abuse identified through data analyses. (Recommendation 12) The Administrator of FAA should develop mechanisms, including regulations if necessary, for dealer suspension and revocation. (Recommendation 13) The Administrator of FAA, in coordination with relevant law-enforcement agencies, should enhance coordination within the Aircraft Registry Task Force through collaborative mechanisms such as written agreements and use of liaison positions. (Recommendation 14) The Administrator of FAA, in coordination with relevant law-enforcement agencies, should develop a mechanism to provide declarations of international operations for law-enforcement purposes. (Recommendation 15) We provided a draft of this product to DOT, DOJ, DHS, and Treasury for review and comment. DOT provided written comments, which are reproduced in appendix V. DOT concurred with our recommendations. Specifically, DOT stated that it supports other government agencies in addressing illegal activities and enforcing U.S. sanctions and agreed that enhancements to the accuracy of registry information would expedite enforcement actions and reduce the risk of ineligible aircraft registrations. FAA and DHS provided technical comments, which we incorporated as appropriate. DOJ and Treasury did not have any comments. We are sending copies of this report to the appropriate congressional committees, the Secretary of Transportation, the Attorney General, the Secretary of Homeland Security, the Secretary of the Treasury, and other interested parties. In addition, the report is available at no charge on the GAO website at http://www.gao.gov. If you or your staff members have any questions about this report, please contact me at 202-512-6722 or shear@gao.gov. Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this report. GAO staff who made major contributions to this report are listed in appendix VI. We conducted illustrative case research related to U.S.-registered aircraft generally covering the 2010–2018 period, including over 1,200 publications and reports from cases investigated by law-enforcement agencies, news articles, and agency and safety investigation reports. We selected six case studies for in-depth review across three categories of risk enabled by aircraft registration fraud and abuse—criminal activity, national security, and safety (see app. II for additional details on the selection methodology). All selected cases are intended for the purpose of illustrating fraud and abuse vulnerabilities associated with the aircraft registration process. These cases may not represent all existing vulnerabilities and are not generalizable to the Federal Aviation Administration (FAA) registry population as a whole. From 2010 to 2011, an aircraft sales broker obtained multiple registration certificates from FAA for aircraft he did not rightfully own or possess. According to court records associated with this case, the broker submitted to FAA fraudulent registration applications and bills of sale with forged signatures for 22 aircraft as part of a multi-million-dollar bank fraud scheme. He used the registration documents that FAA provided as an asset to support a loan application that ultimately resulted in an approximately $3 million bank loan used to float his failing aircraft-sales business. The bank uncovered the fraud over a year after the sales broker first submitted the fraudulent aircraft registration documents to execute the loan. A subsequent investigation by the Federal Bureau of Investigation revealed the extent of the fraud, namely that the main thrust of the fraud scheme was to pledge as collateral 22 aircraft that neither the broker nor his company owned, in order to obtain money from the bank. Court records reveal that law-enforcement officials interviewed some of the rightful owners of the aircraft, who stated that the aircraft were always in their possession and they had never sold the aircraft to the fraudulent broker. These owners identified the signatures on the bills of sale used to register the aircraft as forged. In 2013, the broker pled guilty to bank fraud, making a false statement to a federally insured financial institution, and making a false statement to FAA in the registration of aircraft. As a result of the fraud, some of the rightful owners of the aircraft experienced difficulty in reinstating the aircraft registrations in their name. For example, one owner told federal investigators that he could not fly his aircraft for 2 years because the registration of his aircraft was in the name of the fraudulent broker. Another owner stated that he incurred thousands of dollars in legal fees to reinstate the registration of the aircraft in his name. Additionally, the court ordered the broker to pay approximately $2.4 million in restitution to the bank. In 2014, a U.S.-registered aircraft was seized by and subsequently forfeited to the U.S. government in 2016 because the aircraft had been fraudulently registered and it was purchased with assets derived from wire fraud, money laundering, or other unlawful activities, according to court records associated with this case. The registration was found to be fraudulent because at the time of registration, the applicant was not the true owner of the aircraft. Rather, the U.S. corporation that registered the aircraft acted as a nominee to purchase and register the aircraft on behalf of entities known to have ties to the Sinaloa Cartel, one of the world’s most notorious criminal enterprises. Law-enforcement officials were aware of the scheme and seized the aircraft shortly after final payment was made on it. Court records reveal that this corporation had been previously investigated for violations related to false and fictitious U.S. registration of aircraft on behalf of a criminal organization, and that the corporation’s owner was well known to members of law-enforcement agencies for his suspected role in multiple illegal activities. The aircraft was ultimately forfeited to the U.S. government because it had been purchased with proceeds traceable to illegal activities. In 2012, an intermediary established a U.S. corporation for a foreign national beneficial owner, and the company registered the aircraft. The foreign national was engaged in the black-market currency exchange, which is a common scheme used in trade-based money laundering. In this case, the foreign national conspired with another individual to fraudulently purchase millions of dollars in Venezuela at a rate preferred by the Venezuelan government that was reportedly established as a control to prevent capital flight from Venezuela. Court records show that the aircraft was purchased with illicit proceeds from this fraudulent scheme. In 2016, U.S. law enforcement seized the aircraft, and in 2018 it was forfeited to the U.S. government. In 2017, as the result of a multiyear investigation, the Department of the Treasury’s Office of Foreign Assets Control (OFAC) designated the Executive Vice President of Venezuela as a Specially Designated Narcotics Trafficker pursuant to the Foreign Narcotics Kingpin Designation Act for playing a significant role in international narcotics trafficking. According to the 2017 OFAC announcement on this case, this Venezuelan government official facilitated shipments of narcotics with the final destinations of Mexico and the United States, including control over airplanes and ports used in drug trafficking in Venezuela. According to OFAC, in previous government positions, this official oversaw and partially owned large narcotics shipments destined for the United States. Further, this official also used a front man who laundered drug proceeds and purchased assets. In addition to a network of international companies, according to OFAC, the front man owned or controlled five U.S. companies, including a limited liability company (LLC) that registered an aircraft with FAA using a voting trust to meet U.S. citizenship requirements. As part of its action, OFAC also designated the front man for providing material assistance, financial support, or goods or services in support of the international narcotics trafficking activities of, and acting for or on behalf of, the Venezuelan Executive Vice President. OFAC also identified as blocked property the U.S.-registered aircraft as well as the LLC used to register the aircraft. According to FAA officials, the agency does not have the legal authority to deny a registration solely because of a sanctions designation. OFAC notified FAA of the designation, and FAA flagged the aircraft in its system. FAA deregistered the aircraft in 2019 after registration renewal documentation submitted to FAA contained numerous errors. However, because the flags placed on sanctioned individuals’ and entities’ registration records do not extend to dealer records, FAA issued a dealer certificate to the blocked LLC after the OFAC designation and without coordination with OFAC, according to FAA records and officials. The blocked LLC held the dealer certificate for a year until the certificate expired. In 2011, an aircraft registered to a U.S. citizen with a registered agent address disappeared and was reported to have crashed off the coast of Panama with six fatalities. At the time of the crash, the government of Panama was operating the aircraft while it was still under the U.S. registration of the owner. According to FAA officials and documents we reviewed, the aircraft was in the possession of the Panamanian government because it had been seized by Panamanian authorities in 2010 on allegations that it had been used to traffic narcotics from Panama into Colombia. According to an FAA official knowledgeable about this case, as part of the seizure, a Panamanian court assigned the aircraft to the Panamanian civil aviation authority, which then registered the aircraft in Panama and painted a Panamanian registration number on it. However, the Panamanian civil aviation authority did not take the actions to first deregister the aircraft in the United States, so the new registration was likely invalid under international law. When told this by an FAA official, Panamanian authorities removed the Panamanian registration number from the plane and replaced it with the original N-number. FAA sent multiple letters to the owner to deregister the aircraft and also when the aircraft registration was expiring, but all were returned as refused by the registered agent. According to an FAA official we interviewed about this case, the Panamanian civil aviation authority operated the aircraft under U.S. registration for approximately 1 year until its crash. According to this official, at the time of the crash the aircraft was reportedly operated by the Panamanian civil aviation authority for the purposes of radar maintenance missions in that country. In 2016, an aircraft registered to a U.S.-based LLC crashed in the Caribbean, resulting in fatal injuries to all three people aboard. According to the accident report, the aircraft was operated by a foreign entity, an aviation training center located in Jamaica. The Jamaican civil aviation authority, the entity responsible for investigating the accident, found multiple safety deficiencies as the causes and contributing factors of the fatal crash. These deficiencies include the aircraft’s engine replacement not conforming to its design type; engine parts showing signs of wear ranging from worn to extremely worn conditions exhibiting heavy corrosion; and falsified maintenance records. FAA, by law, imposes safety obligations on all owners of aircraft. To meet these obligations, an owner must maintain current information about the identity and whereabouts of the actual operators of an aircraft and location and nature of the operation on an ongoing basis, thereby allowing that owner to provide the operator with safety-critical information in a timely manner, and to obtain information responsive to FAA inquiries, including investigations of alleged violations of FAA regulations. Such information is an essential element in FAA’s ability to carry out its oversight obligations under U.S. and international law. The safety deficiencies cited in the accident report indicate that, as the registered owner of the aircraft, the LLC may not have been fulfilling its safety obligations. Our objectives were to assess the Federal Aviation Administration’s (FAA) (1) actions to prevent fraud and abuse in aircraft registrations, (2) ability to detect potential fraud and abuse in aircraft registrations, and (3) actions and coordination with law-enforcement entities to respond to aircraft registry–related fraud and abuse risks. To address all objectives, we reviewed laws, regulations, and FAA policies pertaining to the aircraft registration eligibility requirements and processes. We also reviewed standard operating procedures, policy statements, and guidance for staff charged with processing aircraft registrations and addressing administrative compliance actions— including FAA Order 2150.3C issuing enforcement actions per its compliance and enforcement program, FAA Aircraft Examiner’s Guidelines outlining the steps for processing aircraft registrations, and published International Civil Aviation Organization civil aviation standards. We also reviewed prior GAO reports and Department of Transportation (DOT) Office of Inspector General (OIG) reports regarding the quality and utility of registry data, risks, and ongoing challenges associated with the registry’s information technology (IT) system. For all objectives, we interviewed FAA officials from: aircraft registry, legal counsel, FAA’s Security and Hazardous Materials Safety (ASH), FAA’s Law Enforcement Assistance Program (LEAP), and FAA’s Special Emphasis Investigation Team (SEIT). We also interviewed aviation safety, foreign policy, and law-enforcement officials to obtain broader perspectives, where applicable, on the registration process, challenges, and vulnerabilities, including officials from the National Transportation Safety Board (NTSB), the Department of the Treasury’s (Treasury) Office of Foreign Assets Control (OFAC) and Internal Revenue Service Criminal Investigations, the Department of Justice’s (DOJ) Drug Enforcement Administration (DEA), the Department of Homeland Security’s (DHS) Homeland Security Investigations (HSI), and DOT’s OIG. We interviewed aviation industry associations, selected based on a range of aviation interests, such as general aviation and equipment leasing. We also interviewed aircraft registry intermediaries—individuals and entities that facilitate aircraft registrations for others—such as trust companies, banks, and a registered agent, selected based on our analysis of aircraft registry data across types of intermediaries and number of registrations. We also reviewed relevant international standards on countering money laundering and issues related to transparency of corporate structures and beneficial ownership of assets. We performed a descriptive analysis of the registry data from calendar year 2010 through 2018. To do this, we first performed an in-depth review of the calendar year 2018 registry master data—which contains the most-current registration information for our review period—and selected key fields such as aircraft registration number and registrant name information for further analysis. For the remaining calendar years 2010 to 2017 annual files, we focused on identifying any substantive differences occurring between years for the selected key fields. We developed frequencies of the selected key fields to determine the number of registered aircraft, registration types and ownership structures (such as corporations, trusts, and dealers) used to register aircraft, and registration status across the 9-year period of our review. In September 2018 we conducted a site visit to the FAA Registry facility located at the Mike Monroney Aeronautical Center in Oklahoma City, Oklahoma. During the site visit, we interviewed officials from FAA’s major components responsible for processing aircraft registrations and addressing administrative compliance actions, including registry data analysts and managers for the aircraft and airmen systems, FAA ASH officials, and an Office of the Chief Counsel attorney. We also observed firsthand the registry’s process for receiving, sorting, scanning, and recording aircraft registration and renewal application packages. To determine potential fraud and abuse in aircraft registration and FAA actions to prevent them, we analyzed and synthesized a variety of information, including agency reports, registration, postal, and sanctions data, and news articles, among other sources. Our review of information generally spanned fiscal years 2010 through 2018. To identify illustrative cases of potential fraud and abuse, we conducted a literature review that included sources such as Lexis Nexis news articles, DOJ press releases, and investigative reports published by DOT OIG, FAA LEAP, Internal Revenue Service Criminal Investigations, and DHS HSI. We also searched the NTSB publicly available online database of aviation accidents and incidents for examples of safety-related cases. Our literature search yielded over 900 publications and over 300 aviation accident reports for further screening. We then applied two levels of criteria to filter the results for case narrative selections. For the first level, we identified 66 cases from fiscal years 2010 to 2018 involving U.S.- registered aircraft related to three categories of risk enabled by fraud and abuse—criminal activity, national security, and safety. Next, we performed a secondary level of review and selected 28 illustrative cases that included case details, such as entity names and aircraft registration numbers, to facilitate further research including legal review to ensure that selected case studies were adjudicated by a court of law, where applicable. Of those 28 cases, we selected six case studies for in-depth review. We also drew examples from our research of intermediaries of the registry, including selected banks, trust companies, and registered agents. For our in-depth research of these cases, we reviewed available information contained in the FAA Civil Aviation Registry, FAA Electronic Document Retrieval System, and ancillary files; aircraft flight plans; NTSB accident report information; state business registration data; court records; and GAO’s internal resources that included a mix of government and corporate databases. All selected cases are intended for the purpose of illustrating fraud and abuse vulnerabilities associated with the aircraft registration process and may not represent all existing vulnerabilities, nor are they generalizable to the FAA registry population as a whole. To further determine potential fraud and abuse in aircraft registrations, we analyzed FAA aircraft registry address data from calendar year 2018. Using registry address information, we performed a match to United States Postal Service (USPS) data to identify examples of potentially unverified and noncompliant addresses provided to the registry. To analyze postal address data, we used the address fields contained in the FAA registry master and dealer data to verify address information and identify examples of invalid addresses provided to the registry in calendar year 2018, which is the most-current registry data included in our review. Additionally, we obtained data from an internal registry physical address report that we then matched to the calendar year 2018 registry master data to replace mail drop boxes with physical address information, where available. We then performed a match of this updated address file to the USPS Address Matching System as of June 2019 to identify examples of potentially invalid addresses. Our match results revealed a number of commercial mail drop locations, including post office boxes, and addresses that did not match to the postal data. We selected seven aircraft registration addresses and five dealer addresses (total of 12 match results) using a randomized list filtered by locality. We then manually verified the match results for these selected cases using publicly available online geo-mapping tools such as Google Maps and company listings such as White Pages. On the basis of the results of those searches, we selected three aircraft registrations and three dealer certifications that highlight examples of potentially noncompliant addresses provided to the registry in violation of FAA regulations and policy. We conducted subscription database searches and reviewed FAA registration documents for these selected cases based on categories of addresses, such as mail drop boxes, and verified three addresses selected based on locality through site inspections by GAO investigators. Finally, we analyzed the costs associated with aircraft and dealer certificate registrations. To do this, we reviewed an FAA internal report that assessed the costs of FAA’s registration processing, and compared proposed fees to the current fee values for aircraft registrations and dealer certificates. We also reviewed GAO’s federal user fee guide provision that states that fee collections should be sufficient to cover the intended portion of program costs over time, including accounting for factors such as inflation. We reviewed a prior 1993 GAO report in which we determined that the registration fee, in place since 1964, did not cover the cost of reviewing and processing a registration application. Finally, we performed an inflation analysis of the 1964 fee level adjusted for inflation based on the Consumer Price Index. To assess FAA’s ability to detect potential fraud and abuse in aircraft registrations, we examined FAA aircraft registry data collection and storage as well as oversight actions based on registry information and data. We also conducted data mining and matching to identify registrations with indicators of potential fraud or abuse that may enable criminal activity, national security, and safety risks by analyzing FAA aircraft registry master data from calendar years 2010 through 2018, as well as other registry-based and external data sets. We selected five risk indicators, which were informed by interviews with FAA and law- enforcement officials and our background research, for analysis of registry-related data and for matching to a selection of external data sets. We analyzed FAA aircraft registry data to identify registrations with characteristics that matched one or more risk indicators, such as registrations using opaque ownership structures—corporation- and trust- based ownership that disguises the beneficial owner—and registration addresses in countries identified by the Department of State as associated with major illicit drug production and money laundering, among other factors. The risk indicators do not prove fraud or that any unlawful activity has occurred. Alone or together, the risk indicators may serve as points of inquiry for further examination of conduct that may run counter to the interests of the federal government by posing potential criminal, national security, or safety risks. On the basis of the results of our risk-indicator analysis using registry data, we selected a total of five items as potential risk indicators. We selected three risk indicators based on public and internal aircraft registry data. We compared the registry master data to the list of countries published in the latest Department of State narcotics control and financial crimes watch lists. Additionally, we reviewed nonpublic extracts of FAA registry voting trusts used by U.S. citizen corporations and noncitizen trusts from April 2018 through May 2019—the most complete data available at the time of our review—due to their opaque ownership structures and potential for abuse as registration vehicles. We also performed an analysis of types of intermediaries and selected a registered agent as a risk indicator based on confirmed misuse of its address as a means for corporate entities to register aircraft. To establish our population of corporate entities for outreach, we selected four corporate codes contained in the registry data. Next, we developed selection criteria that included geographic distribution (U.S.-based or foreign-based); registrant size based on thresholds that reflect the distribution of registered aircraft (small, medium, or large); and finally, registrant type (bank, trust company, or registered agent). Based on these criteria, we randomly selected two U.S.-based banks and four U.S.- based and foreign trust companies to interview. To identify registered agents, which are not specifically coded in the registry data, we summarized the registry address information and selected all entities with two or more aircraft registrations per address for further screening. We then randomly selected one established registered agent entity for outreach. We analyzed extracts from two external selected data sources for the risk indicator data matching—Treasury OFAC lists of sanctioned entities and individuals, and an NTSB accidents and incidents report—covering the period January 2010 through March 2019, where available. To do this, we used key fields to match the selected data sources to the FAA registry master and trust data, and selected additional risk indicators based on our analysis of the match file results. We matched aircraft registry data to the OFAC lists of sanctioned entities and individuals as of March 2019 to identify aircraft, individuals, and entities subject to U.S. sanctions. We combined five cases identified from our OFAC data match with one additional case identified through our illustrative case and intermediary research to report on our findings of U.S.-sanctioned individuals and aircraft. We included all NTSB-reported accidents and incidents of U.S.- registered aircraft taking place outside the United States as a safety risk indicator. Using the FAA registry aircraft registration number and registrant name fields as the primary match keys, we performed a final merge of all risk indicators identified through our multiple analysis steps described above. Our combined risk flag match returned over 17,000 records, which we used to develop totals for each risk indicator category that we identified. Next, we randomized the list generated from our combined match and applied criteria to filter cases for further review. These criteria included cases with multiple risk indicators, as well as prioritization of risk based on a combined evaluation across all risk indicator categories, among other filters. In total, we selected 20 cases for agency follow-up and in-depth file reviews based on a comprehensive assessment of risk flag categories described above. However, without reviewing a generalizable sample of cases across all categories, we were unable to determine the extent of risk such cases may represent as a proportion of total registrations. Therefore, we used the results of our file reviews for these 20 cases solely to illustrate examples of the risk indicators that we identified. We assessed the reliability of each data set described above for the purposes of generating high-level totals, as well as identifying and tracking potential risk-indicator cases across time. To do this, we performed electronic tests using reports from eight information systems to determine the completeness and accuracy of key fields contained in the data files. We also submitted to the overseeing offices for all eight information systems general data-quality questions regarding the purpose of the data, their structure, definitions and values for selected fields, automated and manual data-quality checks to ensure the accuracy of the data, and limitations. Overall, we found that the data were generally reliable for the purpose of performing a cross-comparison of current registrations associated with safety and compliance violations over the nine-year period of our review. To assess FAA’s actions and coordination with law-enforcement agencies to respond to registration-related risks, in addition to the interviews noted above, we reviewed FAA policies pertaining to the aircraft registration process and documents about FAA and law-enforcement efforts to address registry-related vulnerabilities. We reviewed FAA enforcement actions and government-wide data on aircraft seizures. To generate government-wide totals for aircraft seizures and forfeitures over time, we obtained data extracts from the DOJ Consolidated Asset Tracking System and DHS Customs and Border Protection Seized Assets and Case Tracking System from fiscal years 2010 through 2018. We limited our Consolidated Asset Tracking System data request to aircraft adjudicated as either seized and forfeited, or seized and substituted for cash forfeiture, while the report from the Seized Assets and Case Tracking System contains all seizures recorded by Customs and Border Protection during our review period. Therefore, the reports represent different populations, and we opted to report the totals for the two databases separately. Where feasible, we assessed the reliability of data in each system described above for the purposes of generating high-level totals. Our data-quality testing of selected data elements showed that the primary fields of interest were well-populated and sufficiently reliable for our purposes. We conducted this performance audit from November 2017 to March 2020 in accordance with generally accepted government auditing standards. Those standards require that we plan and perform the audit to obtain sufficient, appropriate evidence to provide a reasonable basis for our findings and conclusions based on our audit objectives. We believe that the evidence obtained provides a reasonable basis for our findings and conclusions based on our audit objectives. We conducted our related investigative work in accordance with investigation standards prescribed by the Council of the Inspectors General on Integrity and Efficiency. In addition to an aircraft registration application form, evidence of ownership, and $5 registration fee, the Federal Aviation Administration (FAA) requires additional documentation based on the type of individual or entity that owns the aircraft, as discussed in table 2 below. Opaque ownership structures are legitimate business structures that are widely used by corporations and individuals to facilitate commerce as well as for asset and tax management. However, the lack of transparency related to aircraft registrations using opaque ownership structures also creates challenges for safety and law-enforcement investigators seeking information about beneficial owners to support timely investigations. The Financial Action Task Force (FATF) and other international organizations have determined that beneficial ownership information can be obscured through, among other things, the use of shell companies (which can be established with various forms of ownership structures) especially in cases where there is foreign ownership that is spread across jurisdictions; complex ownership and control structures involving many layers of shares registered in the name of other legal entities; formal nominee shareholders and directors where the identity of the beneficial owner is undisclosed; trusts and other legal arrangements that enable a separation of legal ownership and beneficial ownership of assets; and use of intermediaries in forming legal entities, including professional intermediaries. Shell companies, one of the opaque ownership structures, may be formed for legitimate purposes to obtain financing prior to starting operations. In the aircraft ownership context, shell companies may own aircraft by holding title for registration purposes. However, shell companies may also be used to conceal the beneficial owner’s identity for illicit purposes. For example, according to Federal Aviation Administration (FAA) officials, some aircraft registrations have “stacked” company ownership, where shell companies own each other. Such ownership arrangement can be used for illicit purposes to conceal the identity of foreign-based beneficial owners and create challenges for investigators, according to law- enforcement officials. Further, shell companies may use a registered agent’s mailing address on their aircraft application forms, further obscuring aircraft ownership information. Table 3 describes the four opaque ownership structures, their legitimate uses, and how they can be vulnerable to abuse, according to our illustrative case and intermediary research, and interviews with FAA and law-enforcement officials. In the example and figure below, we illustrate opaqueness and complexities of aircraft registrations using intermediaries and opaque ownership structures. It is based on an actual case from our review of aircraft registration documents and research from corporate filings and other databases. Apparent shell company and noncitizen trust used to register aircraft for unknown foreign beneficial owner. In this case, a foreign company obtained U.S. aircraft registration through an intermediary, using opaque ownership structures. This is allowable under current registration requirements and there is no identified wrongdoing in this case. The application, depicted in figure 13, shows the involvement of an intermediary, who used various legal entities and took a number of steps to facilitate aircraft registration for a beneficial owner who is unknown. The intermediary listed himself as the director of a corporation, N003 Inc., which was established using a company that provides company formation and registered agent services. Among other indicators, N003 Inc. appeared to be a shell company established shortly before the filing of the aircraft registration. The intermediary also used the mailing address of the registered agent as the owner’s address on the aircraft registration application. Further, the intermediary established a noncitizen trust for aircraft ownership. The trust agreement identified N003 Inc. as the owner trustee of the aircraft, and a foreign corporation, DEF Ltd., as the trustor. As such, the role of the intermediary, the use of apparent shell company and noncitizen trust ownership structures, and use of the registered agent’s mailing address worked to obscure the foreign beneficial owner of the aircraft while facilitating access to U.S. aircraft registration. Rebecca Shea, (202) 512-6722 or shear@gao.gov In addition to the contact named above, Tonita Gillich (Assistant Director), Irina Carnevale (Analyst-in-Charge), James Ashley, Priyanka Sethi Bansal, Gary Bianchi, Daniel Bibeault, Kimberley Bynum, Steven Campbell, Colin Fallon, Robert Graves, Ying Long, Olivia Lopez, Maria McMullen, James Murphy, George J. Ogilvie, Sean Peck, and April Van Cleef made key contributions to this report.
The U.S. aircraft registry, managed by FAA, maintains information on approximately 300,000 civil aircraft. FAA issues aircraft registration to individuals and entities that meet eligibility requirements, such as U.S. citizenship or permanent legal residence. Registry fraud and abuse hinders the ability of law-enforcement and safety officials to use the registry to identify aircraft and their owners who might be involved in illicit or unsafe operations. GAO was asked to examine registry fraud and abuse. This report assesses FAA's actions to (1) prevent, (2) detect, and (3) respond to fraud and abuse risks in aircraft registrations. GAO reviewed relevant laws, regulations, and FAA policies; reviewed reports, DOJ press releases, and court cases that illustrated risks associated with the registry; analyzed aircraft registry data from fiscal year 2010 through 2018 to identify registrations with risk indicators; and interviewed FAA registry, legal, law-enforcement liaison, and safety officials, as well as officials from DOJ and DHS. To register civil aircraft, the Federal Aviation Administration (FAA) generally relies on self-certification of registrants' eligibility and does not verify key information. According to GAO's review of the registry process, there are risks associated with FAA not verifying applicant identity, ownership, and address information. The registry is further vulnerable to fraud and abuse when applicants register aircraft using opaque ownership structures that afford limited transparency into who is the actual beneficial owner (i.e., the person who ultimately owns and controls the aircraft). Such structures can be used to own aircraft associated with money laundering or other illegal activities (see example in figure). FAA has not conducted a risk assessment that would inform its eligibility review and collection of information to manage risks. Without a risk assessment, FAA is limited in its ability to prevent fraud and abuse in aircraft registrations, which enable aircraft-related criminal, national security, or safety risks. FAA makes some use of registry information to detect risks of fraud and abuse, but the format of the data limits its usefulness. Specifically, most data on individuals and entities with potentially significant responsibilities for aircraft ownership, such as trustors and beneficiaries, are stored in files that cannot be readily analyzed due to system limitations. As FAA modernizes its information-technology systems, it has an opportunity to develop data analytics capabilities to detect indicators of fraud and abuse in the registry. FAA takes administrative actions, such as registration revocations, to respond to registration violations and coordinates with law-enforcement agencies on investigations and enforcement actions such as aircraft seizures. Since 2017, FAA has coordinated with the Departments of Justice (DOJ) and Homeland Security (DHS) as part of an Aircraft Registry Task Force to address aircraft registry vulnerabilities. However, this coordination is informal, and other mechanisms for joint enforcement actions, sharing of information, and use of liaison positions are not in place, GAO is making 15 recommendations to FAA, including that it collect and verify key information on aircraft owners; undertake a risk assessment of the registry; leverage information-technology modernization efforts to develop data analytics approaches for detecting registry fraud and abuse; and formalize coordination mechanisms with law-enforcement agencies. FAA agreed with all recommendations.