FinCEN oversees the administration of the Bank Secrecy Act and related AML regulations, and has authority to enforce BSA, including through civil money penalties. FinCEN issues regulations and interpretive guidance, provides outreach to regulated industries, conducts examinations, supports select examinations performed by federal and state agencies, and pursues civil enforcement actions when warranted. FinCEN’s other responsibilities include collecting, analyzing, and disseminating information received from covered institutions, and identifying and communicating financial crime trends and methods. See figure 1 for federal supervisory agencies involved in the BSA/AML framework. FinCEN primarily relies on supervisory agencies and other entities to conduct examinations of U.S. financial institutions to determine compliance with BSA/AML requirements (see table 1). FinCEN delegated BSA/AML examination authority to these supervisory agencies, including the banking regulators, SEC, CFTC, and IRS. IRS has been delegated authority to examine certain financial institutions (such as money services businesses) not examined by the federal functional regulators for BSA compliance. The SROs that SEC and CFTC oversee—such as FINRA and NFA respectively—have BSA/AML compliance responsibilities for the activities of their members. Apart from their delegated examination authority under the BSA, the federal functional regulators and SROs have their own regulatory authority to examine institutions they supervise for compliance with BSA. FinCEN, the banking regulators, and SEC may assess civil money penalties for BSA violations and take enforcement actions for noncompliance. The SROs have established BSA-related rules or requirements for their members based on federal requirements and may take disciplinary actions against them for violations of these rules. IRS issues letters of noncompliance to institutions it oversees and generally relies on FinCEN for formal civil enforcement action, but IRS-CI has the authority to investigate criminal violations. Other law enforcement agencies (for example, DOJ Criminal Division, FBI, and ICE- HSI) also can conduct criminal investigations of BSA violations. More generally, law enforcement agencies and prosecutors may review and start investigations into a variety of criminal matters based on BSA reporting filed in their areas of jurisdiction. According to FinCEN, BSA recordkeeping and reporting requirements establish a financial trail for law enforcement investigators to follow as they track criminals, their activities, and their assets. Finally, DOJ prosecutes financial institutions and individuals for violations of federal criminal money laundering statutes. U.S. financial institutions can assist government agencies in the detection and prevention of money laundering and terrorist financing by complying with BSA/AML requirements such as maintaining effective internal controls and reporting suspicious financial activities. BSA regulations include recordkeeping and reporting requirements, such as to keep records of cash purchases of negotiable instruments, file CTRs on cash transactions exceeding $10,000, and file SARs when institutions suspect money laundering, tax evasion, or other criminal activities. Law enforcement agencies and prosecutors (through FinCEN) may utilize the 314(a) program to locate accounts and transaction information from U.S. financial institutions when terrorism or money laundering activity is reasonably suspected based on credible evidence. Most financial institutions must develop, administer, and maintain effective AML programs. At a minimum, those financial institutions must establish a system of internal controls to ensure ongoing compliance with the BSA and its implementing regulations; provide AML compliance training for appropriate personnel; provide for independent testing; and designate a person or persons responsible for coordinating and monitoring day-to-day compliance. In addition to these requirements, FinCEN issued a final rule in 2016 requiring banks, brokers or dealers in securities, mutual funds, futures commission merchants, and introducing brokers in commodities to establish risk-based procedures for conducting customer due diligence. More specifically, covered financial institutions are to establish and maintain written policies and procedures designed to (1) identify and verify the identity of customers; (2) identify and verify the identity of the beneficial owners of legal entity customers opening accounts; (3) understand the nature and purpose of customer relationships to develop customer risk profiles; and (4) conduct ongoing monitoring to identify and report suspicious transactions and, on a risk basis, maintain and update customer information. For example, covered financial institutions must collect from the customer the name, birthdate, address, and Social Security number or equivalent of any beneficial owners. The financial institutions covered by this rule—which do not include money services businesses, casinos, or insurance companies—had until May 11, 2018, to comply. Supervisory agencies and SROs oversee financial institutions’ compliance with BSA/AML requirements primarily through compliance examinations, which, for banking regulators, can be components of regularly scheduled safety and soundness examinations. All supervisory agencies and SROs we interviewed that examine financial institutions for BSA/AML compliance have established BSA/AML examination manuals or procedures. For example, to ensure consistency in the application of BSA requirements, in 2008 FinCEN issued a BSA examination manual for use in reviewing money services businesses, including for IRS and state regulators. According to FinCEN officials, FinCEN has been updating the entire manual and completed a draft of the update in the fourth quarter of fiscal year 2018, with the goal of finalizing the updated manual by the end of fiscal year 2019. Similarly, in 2005 the federal banking regulators collaborated with FinCEN on a BSA/AML examination manual issued by the Federal Financial Institutions Examination Council (FFIEC). The entire FFIEC manual has been revised several times since its release (most recently in 2014). In May 2018, FFIEC also issued new examination procedures to address the implementation of the 2016 customer due diligence and beneficial ownership rule, discussed earlier. These updated customer due diligence examination procedures replaced the existing chapter in the FFIEC BSA/AML examination manual and added a new section “Beneficial Ownership Requirements for Legal Entity Customers—Overview and Examination Procedures.” In addition, the FFIEC has been working on an update of the entire FFIEC manual, which is expected to be complete by the end of the calendar year 2019 or early 2020. SEC and FINRA, as well as CFTC’s respective SROs, have nonpublic procedures for conducting examinations of the institutions they oversee. SEC, FINRA, and NFA officials all stated that they have updated procedures to address the new customer due diligence regulations that were applicable beginning in May 2018. We discuss examination activities of the supervisory agencies in more detail later in this report. FinCEN and supervisory agencies consider risk when planning BSA/AML examinations and all utilized BSA data to some extent to scope and plan examinations (see table 2). As we reported in prior work, BSA/AML examinations are risk-based—examiners have the flexibility to apply the appropriate level of scrutiny to business lines that pose a higher level of risk to the institution. Covered financial institutions are expected to complete a BSA/AML risk assessment to identify specific products, services, and customers, which supervisory agencies can use to evaluate the compliance programs of financial institutions and scope their examinations. Most officials from supervisory agencies and SROs said they also consider asset size, among other factors, to determine examination frequency and scope. For example, the federal banking regulators implemented less frequent examination cycles for smaller, well-capitalized financial institutions. FinCEN is the administrator of BSA and delegated BSA/AML examination authority to the supervisory agencies. FinCEN officials told us they have been considering how regulators of financial institutions of different size and risk assess BSA/AML compliance and continue to work with federal regulators to identify better ways to supervise examinations. For example, in a February 2019 speech, the Director of FinCEN stated that one of FinCEN’s current regulatory reform initiatives was reviewing the risk- based approach to the examination process. Although supervisory agencies with delegated authority conducted the vast majority of BSA/AML compliance examinations, FinCEN has conducted a few of its own examinations in areas it considers a high priority. FinCEN officials told us it mostly considers risk (not size) when conducting its own examinations because even small institutions could pose money laundering risk. FinCEN states that it uses an intelligence- driven approach to target examinations in high-risk areas. For example, FinCEN officials told us they have conducted BSA/AML compliance examinations of financial institutions on issues such as virtual currencies and data breaches in domestic branches of foreign banks. In an August 2018 speech, the Director of FinCEN noted that FinCEN, working closely with BSA examiners at IRS, had examined more than 30 percent of identified registered virtual currency exchangers and administrators since 2014—totaling about 30 examinations, according to FinCEN officials. FinCEN officials said they conducted a total of five BSA/AML examinations with IRS in fiscal years 2017 and 2018. In addition, FinCEN conducted a BSA/AML examination in fiscal year 2018 of a branch of a foreign bank that had been previously examined by its banking regulator to review the effectiveness of the bank’s BSA compliance department. All of the banking regulators with which we spoke stated they considered risk and, to some extent, asset size to determine examination frequency and scope. The FFIEC BSA/AML examination manual establishes a risk- based approach for bank examinations, including incorporating a review of BSA/AML risk assessments of a financial institution in the scoping and planning of an examination. In considering asset size to determine the frequency of examinations, all of the banking regulators adopted rules to reduce the frequency of examinations for small, well-capitalized financial institutions—as seen in table 2. In addition, in their annual reports to FinCEN the banking regulators provide a description of the criteria used for determining the timing and scope of BSA/AML examinations, such as risk and asset size. For instance, FDIC and the Federal Reserve noted in their annual reports to FinCEN that the timing and scope of their BSA/AML examinations are primarily determined by an institution’s BSA/AML risk profile and factors such as its condition, overall rating, and asset size. OCC, in its annual report, said that examination scope included consideration of the bank’s BSA/AML risk assessment, quality of validated independent testing (internal and external audit), previous examination reports, BSA reports, and other relevant factors, including data from the OCC’s Money Laundering Risk System. OCC officials said the system identifies potential indicators of BSA/AML risk by measuring the extent to which various types of products, services, customers, and geographies are offered or served by supervised banks. For banks that report into that system, OCC officials said they factor information from the system into developing an examination strategy that helps determine resource allocation and expertise needs. According to NCUA, each credit union must receive a BSA examination each examination cycle—although the frequency and scope of these examinations may vary based on the credit union’s size and other risk factors. For example, small credit unions with assets under $50 million may be subject to a defined-scope examination (which includes a BSA examination) where the risk areas have already been identified and the scope is pre-determined. NCUA also provides a BSA questionnaire that is publicly accessible to assist its examiners in implementing BSA examinations (for example, to help examiners assess the BSA risk of the credit union and scope the examination). Factors considered in the questionnaire include prior violations, correspondence from law enforcement related to BSA compliance, whether or not the credit union conducted a risk-assessment, and high-risk accounts. While the FFIEC BSA/AML examination manual and other federal banking documentation discuss considering BSA/AML risk when determining the scope and frequency of examinations, officials from all four banking associations with whom we spoke said, in practice, examiners do not always use a risk-based approach when assessing BSA compliance. Nearly all said examiners may take a zero-tolerance approach when conducting examinations. For example, representatives from two industry associations said that although failure to file a single SAR or unintentional errors should be treated differently than egregious, intentional noncompliance, or a pattern of negligence (in terms of level of noncompliance), that sometimes has not been the case. Federal Reserve officials noted that each examination is specific to the facts and circumstances of that examination and that systemic deficiencies in a bank’s BSA/AML compliance program are generally treated differently than nonsystemic deficiencies. As discussed earlier, FFIEC has been working on updating its entire FFIEC BSA/AML examination manual, including updates to more clearly state the agencies’ approach to risk-based supervision, according to OCC officials. Representatives from two of the four banking associations with which we spoke with stated they were involved in providing input on recent updates to FFIEC’s examination manual and all four had provided input to the effort to implement the customer due diligence and beneficial ownership rule. For example, OCC officials said that the risk-based approach is most clearly discussed in the opening pages of the current FFIEC manual and could be more directly incorporated throughout the manual to provide enhanced guidance to examiners. These officials stated that the agencies have been drafting proposed edits for drafting group consideration. More generally, FFIEC undertook its Examination Modernization Project as a follow-up to reviews required under the Economic Growth and Regulatory Paperwork Reduction Act. One of the project’s efforts seeks feedback from selected supervised institutions and examiners on ways to improve the examination process. For example, the FFIEC examination modernization project reviewed, compared, and identified common principles and processes for risk-focusing examinations of community financial institutions. FFIEC members also committed to issue reinforcing and clarifying examiner guidance on these risk-focused examination principles. In addition, Treasury, FinCEN, and the banking regulators established a working group to identify ways to improve the efficiency and effectiveness of BSA/AML regulations and supervision. In October 2018, the working group issued a joint statement to address instances in which banks with less complex operations and lower-risk BSA/AML profiles may decide to enter into collaborative arrangements with other banks to share resources to manage their BSA/AML obligations in order to increase efficiency and reduce burden. In December 2018, the working group issued another joint statement that recognized that banks may use existing tools in new ways or adopt new technologies to more effectively and efficiently meet their BSA/AML obligations. SEC shares responsibility for broker-dealer examinations with SROs, but has sole responsibility for examinations of mutual fund companies and maintains supervisory authority over SROs. SEC’s Office of Compliance Inspections and Examinations conducts risk-based examinations of regulated entities including mutual funds (under the Investment Adviser/Investment Company Examination Program) and broker-dealers (under the Broker-Dealer Exchange Examination Program). According to SEC documentation, the scope of examinations is based on a risk assessment of various factors such as the type of business a firm engages in and its customer base. This includes consideration of whether the firm engages in high-risk activities. The Office of Compliance Inspections and Examinations assesses the risks from information sources such as tips, complaints and referrals, FinCEN BSA data, pre- examination due diligence, and previous examination history. During the period we reviewed, BSA/AML examinations of mutual funds accounted for less than 1 percent of all securities BSA/AML examinations and no mutual funds were cited for violations of BSA. SEC staff said investors primarily purchase shares of mutual funds through a distributor (such as a broker-dealer) and, in these cases, mutual funds do not know, and are not required to know, the identities of individual investors. In these cases, the broker-dealer distributor has more information about the individual investors and may be examined for BSA compliance as part of FINRA and SEC BSA examinations. FINRA conducts the majority of examinations of broker-dealer firms and imposes anti-money laundering rules on its members. FINRA officials told us that they use a risk-based approach for AML examinations, which considers the size, complexity, customer types, and risks posed by business activities in assessing potential BSA/AML risk. These risk factors affect the timing of their reviews (for example, if a broker-dealer is deemed to be higher-risk, it will be examined in the same year it was assessed). According to FINRA officials they have different expectations for firms’ AML programs, based on size (larger firms typically are expected to have more complex AML programs than smaller firms). FINRA publishes a template for small firms to help them fulfill their responsibilities to establish an AML compliance program. The template provides text examples, instructions, relevant rules, websites, and other resources useful for plan development. However, representatives from a securities industry association told us that BSA/AML rulemaking and examinations sometimes do not take into account the varying levels of risk of different types of business models and activities among firms. Furthermore, these representatives stated that sometimes compliance expectations are communicated through enforcement actions rather than through rulemaking or guidance. As noted previously, one of FinCEN’s has been reviewing the risk-based approach to the examination process. According to a February 2019 speech by the Director of FinCEN, FinCEN’s initiatives also included reviewing agencies’ approach to supervision and enforcement and identifying better ways to communicate priorities. Representatives from this securities industry association also identified certain training and tools on BSA/AML compliance and implementation that FINRA and SEC staff provide as helpful to the securities industry in identifying priorities and compliance deficiencies. For example, SEC’s Office of Compliance Inspections and Examinations and FINRA publish annual examination priorities, which identified both customer due diligence and suspicious activity monitoring as key areas for 2019. According to SEC staff, SEC and FINRA examination priorities have identified suspicious activity monitoring as a key area for the past several years and have identified customer due diligence as a priority since the implementation of the customer due diligence rule in 2018. FINRA published examination findings for the first time in 2017 and again in 2018, including selected findings related to BSA/AML compliance, which representatives from the industry association said have been very useful because they describe specific BSA/AML compliance deficiencies identified by FINRA across the industry and can assist firms in improving their compliance programs. Additionally, FINRA and SEC included an AML-topic in their 2017 National Compliance Outreach Program for broker-dealers. SEC also occasionally publishes risk alerts on its website and participates in industry outreach efforts. The SROs that conduct the majority of examinations of futures firms use a risk-based approach. CFTC has authority to examine futures commission merchants and futures and commodities introducing brokers, but does not routinely conduct examinations of the firms it supervises. Instead, CFTC oversees the examinations conducted by its SROs. CFTC delegated examination authority to two SROs—NFA and the CME Group. NFA conducts the majority of BSA examinations and is the only SRO that examines independent introducing brokers. During the period we reviewed, NFA was assigned the majority of futures firms and conducted a majority of AML examinations. NFA and CME Group stated in CFTC’s annual reports to FinCEN that they utilize a risk-based approach for AML examinations. CME Group reported that it determined both the frequency and the scope of examinations through an overall assessment of the financial and operational risks posed by a futures commission merchant. NFA is required to examine futures commission merchants annually, but reported that the timing and frequency of introducing broker examinations were based predominately on the risks present with a firm. NFA’s risk models measure the riskiness of each firm, and firms are prioritized for examination based on the output from the risk model. In an interpretative notice, NFA recognized that financial institutions vary in size and complexity, and that firms should consider size, among other factors (such as the nature of business and its risks to money laundering) in designing a program to implement requirements such as customer verification and suspicious activity reporting. Representatives from a futures industry association told us that there is a one-size-fits-all approach to BSA/AML compliance in that the rules are broadly applied to varying types of financial institutions. They noted that BSA/AML guidance tends to focus on banks and treat other types of financial institutions (money service business, casinos, and others) as one group, despite their diversity. In relation to the futures industry, the representatives stated that this makes it difficult for futures commission merchants to implement requirements because the rules or guidance do not necessarily take into consideration their unique business structure. CFTC staff told us that BSA requirements could be applied differently to different types of firms and were supportive of tailoring or reducing requirements where the obligations were duplicative, overly burdensome, and BSA-related risks were low. For example, CFTC staff recommended that FinCEN relieve (1) certain introducing brokers known as voice brokers and (2) futures commission merchants that are initial clearing firms from customer identification program requirements because they have limited interaction with the customer and do not have access to customer information that would allow them to perform customer due diligence. CFTC staff told us they have been working with FinCEN on implementing these recommendations. In July 2019, FinCEN issued additional guidance on the application of the customer identification program rule and the beneficial ownership rule to certain introducing brokers, which stated that an introducing broker that has neither customers nor accounts as defined under the customer identification program rule has no obligations under that rule or the beneficial ownership rule. IRS examination staff use a risk-based approach to examine for BSA/AML compliance. In 2008, FinCEN and IRS issued a manual for use by IRS (and state regulator) examiners who perform risk-based examinations of money services businesses, which are a category of nonbank financial institutions. The BSA/AML manual for money services businesses states that examiners should determine the appropriate depth and scope of the examination procedures based on their assessment of the risks of the businesses. Specifically, the manual also states examiners should scope their examinations based on their assessment of the risks, which they can assess by analyzing information including the business’ BSA/AML risk assessment and AML compliance program, and then conduct selective transaction testing to determine if the AML program is effective. The amount of transaction testing will vary based on the assessed level of risk—the amount of testing would be reduced if the examiner determined the risks were minimal. IRS officials said that IRS examiners do not perform scheduled examinations of all money services businesses every year; rather, they review a percentage of businesses each year based on risk-related factors such as a history of noncompliance, high-risk geographic areas, and financial institutions identified by referrals. Thus, there may be some money services businesses that are not examined for years and some that are examined much more frequently. As discussed earlier, FinCEN has been updating the BSA/AML Manual for money services businesses. According to the manual, IRS examiners should consider size, among other things, as a factor in their examination approach. IRS officials with whom we spoke said that smaller money transmitters may not have the resources or understand monitoring methods necessary to implementing BSA/AML compliance programs such as suspicious activity monitoring and reporting. IRS procedures state that it is the responsibility of BSA examiners to ensure the financial institution is informed of reporting, registration, recordkeeping, and compliance program requirements of the BSA. IRS officials further explained that they share methods of detecting suspicious activity with small money transmitters to help them meet their requirements. FinCEN enforcement actions can be based on sources that include referrals from examining authorities, information from financial institutions, interviews, and leads from law enforcement. Supervisory agencies, including the federal banking regulators, SEC, CFTC, and their respective SROs are to promptly notify FinCEN of any significant potential BSA violations. IRS also makes referrals to FinCEN for violations it identifies in its BSA examinations, such as willful violations of AML program requirements and recordkeeping and reporting regulations and structuring. Additionally, financial institutions can self-report violations, DOJ or other law enforcement agencies may provide leads, and FinCEN personnel can refer potential violations to FinCEN’s Enforcement Division to be investigated. According to FinCEN officials, after receiving a referral FinCEN’s Enforcement Division opens a case in the Financial Intelligence Repository System, and Enforcement Division staff and management evaluate the circumstances of the alleged violation and provide a written recommendation for action. FinCEN generally resolves its referrals through one of three ways: (1) closing the case without contacting the subject of the referral, (2) issuing a letter of warning or caution to the subject institution or individual, or (3) assessing a civil monetary penalty. According to FinCEN officials, management in the Enforcement Division approve which action will be taken to close the referral, and if the recommendation is to pursue some type of civil enforcement action—the Director of FinCEN and the Office of Chief Counsel would be involved in that determination. FinCEN officials said that factors the Enforcement Division considers when determining which action to recommend or take include: any impact or harm to FinCEN’s mission by identified violations; pervasiveness of the violations; the gravity and duration of the violations; the institution’s history of violations; continuation of the activity; possible obstruction or concealment; any remedial actions taken by institution; and whether the institution received financial gain or benefit from violation. According to FinCEN officials, the Enforcement Division maintains an administrative record for all cases that result in an enforcement action, and when the action is complete, the Financial Intelligence Repository System is updated to reflect that the referral is closed. From January 1, 2015, to September 25, 2018, FinCEN received 419 referrals directly from supervisory agencies (see table 3). Two reports have noted some issues associated with referrals to FinCEN, including delays in reporting by an agency and inconsistent status updates from FinCEN to agencies. A 2018 report by the Treasury Inspector General for Tax Administration found FinCEN had long delays in processing IRS referrals and assessed penalties on a small proportion of referrals. For example, 49 of 80 cases referred by IRS during fiscal years 2014–2016 remained open as of December 31, 2017, and FinCEN assessed penalties in six of the 80 referrals. In response, FinCEN management said the primary reason for not processing referrals was the “age” of the violations when the referral was made to FinCEN, which according to FinCEN officials impedes a thorough investigation of the violations due to an imminent expiration of the applicable statute of limitations. The report recommended that IRS consider having its FinCEN referral process reviewed by process experts to make it more efficient because delays in submitting cases to FinCEN could lead to FinCEN taking longer to process referrals or not considering cases for further civil penalty. In response to the recommendation, IRS stated that it completed a process improvement review of its FinCEN referral process, and had since updated its internal guidelines (in February 2019) to reflect the improved procedures. The Office of Inspector General of Treasury reported in 2016, among other findings, that several federal and state regulators told it that FinCEN did not routinely inform them of the status of their referred cases. The Office of Inspector General recommended that FinCEN implement a process to periodically notify federal and state regulators of the status of and actions taken on referred cases. In its response, FinCEN agreed with the recommendation, and stated that it follows its standard operating procedures for case processing. FinCEN’s response stated that its case processing procedures provide that in all FinCEN enforcement actions taken in coordination with other government partners (including other regulators), FinCEN’s Enforcement Division will provide regulators with a copy of FinCEN’s consent order that details the violations, factual findings, and proposed settlement terms. FinCEN also noted that its Enforcement Division holds standing and ad hoc meetings with each of its federal regulatory partners to discuss, among other matters, the status of top priority referrals. Treasury’s Office of Inspector General closed the recommendation based on FinCEN’s response and its review of FinCEN’s standard operating procedures—which it said included procedures to provide regulators with a copy of FinCEN’s approved consent order and proposed settlement terms in the case of formal enforcement actions. FinCEN officials also told us that FinCEN has been working to update and finalize its policies and procedures to further address the recommendation from Treasury’s Office of Inspector General, but did not have a time frame for completion. When FinCEN assesses a penalty for BSA violations, it may do so independently or concurrently with supervisory agencies. In a concurrent action, FinCEN will assess a penalty with the other regulator and has sometimes deemed the penalty (or a portion of its penalty) satisfied by a payment to the regulator. FinCEN took 26 enforcement actions over the period we reviewed (from fiscal year 2015 through the second quarter of fiscal year 2018), five of which were concurrent with supervisory agencies. Casinos, depository institutions, and money services businesses each had eight enforcement actions and a precious metals firm and a securities/futures firm had one each. In December 2018, FinCEN assessed a $14.5 million civil monetary penalty against UBS Financial Services, $5 million of which was paid to Treasury and the remainder satisfied by payment of penalties for similar or related conduct imposed by SEC and FINRA. Federal banking regulators identify and cite violations of BSA/AML requirements as part of the supervision process, including the examination process. The regulators employ progressive enforcement regimes to address supervisory concerns that arise during the examination cycle or through other supervisory activities. If the institution does not respond to the concern in a timely manner, the regulators may take informal or formal enforcement action, depending on the severity of the circumstances. Informal enforcement actions include obtaining an institution’s commitment to implement corrective measures under a memorandum of understanding. Formal enforcement actions include issuance of a cease-and-desist order or assessment of a monetary penalty, among others. Some factors that the banking regulators reported considering when determining whether to raise an informal enforcement action to a formal enforcement action include the severity of the weakness and the bank’s commitment to correct the identified deficiencies. See appendix II for recent data on enforcement actions taken by the banking regulators. All SEC enforcement actions and all SRO disciplinary actions are public. SEC has authority to enforce compliance with BSA for mutual funds and broker-dealers. If SEC examiners find significant deficiencies with a firm’s BSA program, the examiners may refer the finding to SEC’s Division of Enforcement or an SRO for enforcement. In addition, SEC’s BSA Review Group in the Division of Enforcement’s Office of Market Intelligence may refer matters identified through the review of BSA reports to staff in SEC’s Division of Enforcement and in the Office of Compliance Inspections and Examinations for further consideration and potential follow-up. SEC’s Division of Enforcement will assess whether to proceed with an investigation, determine whether a violation has occurred, and if so, whether an enforcement action should be recommended against the firm or any individuals. In certain cases, SEC’s Division of Enforcement may undertake an investigation where there has been a widespread or systemic failure to file SARs or systemic omission of material information from SARs. When making this assessment, SEC staff said SEC considers a number of factors including: the egregiousness of the conduct, the length of time over which the violations occurred, number of SARs that were not filed or that omitted material information, the disciplinary history of the firm, and adherence to any internal policies and procedures. FINRA has enforcement authority that includes the ability to fine, suspend, or bar brokers and firms from the industry and has two separate procedures (settlement and formal complaint) through which it applies enforcement actions. Through a settlement, a firm or broker in violation can offer to settle with FINRA through a Letter of Acceptance, Waiver, and Consent. A formal complaint is filed with and heard before FINRA’s Office of Hearing Officers. See appendix II for recent data on enforcement actions taken by SEC and FINRA. Although CFTC delegated examination authority to NFA and the CME Group, it retained authority to pursue enforcement actions against futures firms. While CFTC does not typically conduct BSA/AML examinations, it does have a BSA review team that reviews SARs to identify potential violations of futures laws, and CFTC has taken enforcement actions based on leads developed from SARs reviewed. SROs generally conduct BSA examinations of futures firms, and at the conclusion of an examination, the SROs will issue a report to the futures firm to notify the firm of any deficiencies in its AML program. If the deficiencies are not significant, NFA officials stated NFA will cite the deficiency in the examination report and close the examination with no disciplinary action but require corrective action before closing it. If examination findings are significant, then NFA may issue a warning letter or recommend that its Business Conduct Committee issue a formal complaint charging the firm with violating NFA’s AML requirements (which is an enforcement action). NFA officials told us it resolves most enforcement actions related to violations of NFA’s BSA/AML rules through settlement agreements that assess a fine. NFA may take other types of actions for violations of their rules, such as suspension of membership or expulsion. See appendix II for recent data on informal and formal actions SROs took. Although FinCEN has delegated authority to IRS to conduct civil BSA/AML examinations for a variety of nonbank financial institutions and individuals, IRS does not have authority to enforce most civil BSA violations identified. If IRS Small Business/Self-Employed Division examiners find BSA violations when examining an institution, the division can send a letter of noncompliance—a letter 1112—with a summary of examination findings and recommendations to the institution, which also includes an acceptance statement for the institution to sign. Additionally, if IRS Small Business/Self-Employed Division examiners identify significant civil violations during a BSA/AML examination, such as willful violations of BSA reporting and record-keeping requirements, they may refer civil violations to FinCEN or refer certain violations of potential criminal activity to IRS-CI. See appendix II for recent data, including the number of institutions issued a letter 1112. In recent years, Treasury and FinCEN have led efforts to identify BSA goals and priorities such as issuing a national strategy and risk assessments for combating illicit financing crimes. They also established key mechanisms for BSA/AML collaboration, such as interagency working groups, information-sharing agreements, and liaison positions that encompass multiple federal, state, and local agencies and private-sector participants. However, these key mechanisms have been less inclusive of the futures industry than other financial sectors. Treasury and FinCEN led collaborative efforts to identify BSA goals and priorities, including the following: National Strategy. In December 2018, Treasury issued the National Strategy for Combating Terrorist and Other Illicit Financing as required by 2017 legislation. The national strategy discussed various agencies’ BSA-related goals and objectives, including those of the supervisory agencies and law enforcement groups with which we spoke for our review. It also laid out key priorities, such as protecting the United States from terrorist attacks, simplifying the BSA regulatory framework to work more effectively and efficiently, and ensuring the stability of domestic and global markets by reducing fraud, money laundering, and other economic crimes. The strategy also discussed interagency coordination and information-sharing mechanisms (including public-private information sharing). For example, the national strategy states that FBI provided a classified briefing twice a year to selected personnel from the 20 largest financial institutions in the United States to share information on terrorist financing trends. In addition, the national strategy provided data on prosecutions related to money laundering. For example, in fiscal years 2015–2017, DOJ annually charged on average 2,257 defendants with money laundering. Risk assessments. Congress also directed Treasury and relevant agencies to evaluate the effectiveness of existing efforts that address the highest level of risks associated with illicit finance. In December 2018, Treasury issued three risk assessments that identified money laundering, terrorist financing, and proliferation financing risks and describe Treasury’s and relevant agencies’ efforts to address these risks. The three risk assessments underpin the 2018 National Strategy. Treasury involved multiple agencies in the development of the risk assessments, including supervisory agencies, SROs, and several law enforcement agencies. The terrorist financing and money laundering risk assessments built on previous Treasury-led risk assessments issued in 2015, but the 2018 proliferation financing risk assessment was the first ever issued. Treasury’s Strategic Plan (2018–2022) and other guidance. Prior to the publication of the National Strategy, Treasury issued a strategic plan in February 2018 that identified strategies, goals, measures, and indicators of success to meet its strategic goal for preventing terrorists and other illicit actors from using the U.S. and international financial systems. FinCEN also issued advisories or guidance that identify BSA and law enforcement priorities. For example, in February 2014 FinCEN issued guidance that clarified how financial institutions should align their BSA reports to meet federal and state law enforcement priorities if the institutions provide services to marijuana-related businesses. The related federal and state law enforcement priorities included preventing the proceeds of marijuana sales from going to criminal enterprises, gangs, and cartels. Two industry associations (with which we spoke before the issuance of the December 2018 national strategy and risk assessments) noted the importance of establishing BSA priorities to better inform industry. For example officials from one industry association said that Treasury’s risk assessments identified priorities and suggested that it produce these types of reports more frequently (for example annually). This may be addressed, in part, by Congress’ requirement that the national strategy— including a discussion on goals, objectives, and priorities—be updated in 2020 and 2022. In addition, Treasury has been conducting a broad review of BSA/AML laws, regulations, and supervision—focusing on how effectively current requirements and related activities achieve the underlying goals of the BSA. Interagency working groups, interagency memorandums of understanding, and liaison positions, as shown in table 4, are key BSA/AML collaborative mechanisms that were identified through our interviews with officials from FinCEN, supervisory agencies and law enforcement agencies and in agency documents. Bank Secrecy Act Advisory Group (BSAAG). Congress directed Treasury to create BSAAG in 1992. The group, led by FinCEN, is the primary and longest-established BSA/AML collaboration mechanism and is used to share information and receive feedback on BSA administration. The advisory group meets twice a year and includes working groups on BSA/AML-related issues that may meet more frequently. BSAAG recently has been focusing on improving the effectiveness and efficiency of the regulatory and supervisory regime. SEC and Federal Reserve officials told us that BSAAG is a helpful and effective collaborative mechanism to discuss BSA/AML issues. However, as we discuss later, representatives from CFTC, the primary futures SRO, and a futures industry association expressed concerns that the futures industry was not as well represented on BSAAG as other industries. FinCEN invites the public to nominate financial institutions and trade groups for 3-year membership terms on BSAAG. In making selections, the Director of FinCEN retains discretion on all membership decisions and seeks to complement current BSAAG members in terms of affiliations, industry, and geographic representation. Memorandums of understanding (MOU). FinCEN established interagency agreements—information-sharing and data-access MOUs— relating to BSA data. For example, FinCEN entered into an information- sharing MOU with the federal banking regulators in 2004 and has since established similar MOUs with other supervisory agencies, including many state supervisory agencies. FinCEN consolidates the data from the four federal banking regulators and told us that it shares the consolidated reports with banking regulators. In addition, FinCEN officials told us they use data from the information-sharing agreements to help in certain initiatives and training. For example, FinCEN officials told us that a recently funded initiative focused on nonbank financial institutions will use information from the MOUs to proactively identify risks and better inform related compliance efforts. All the supervisory agencies told us they informally update and monitor their information-sharing MOUs through frequent meetings and regular communication with FinCEN. For example, FinCEN officials told us they have been working to update how they collect information on violations related to the customer due diligence and beneficial ownership rule. In addition, FinCEN contracts an annual MOU satisfaction survey that FinCEN officials said helps them monitor the effectiveness of the MOUs. In the survey, respondents were asked about their satisfaction with their MOU and scored their satisfaction around 80 out of 100 in 2017. FinCEN also has more than 400 data-access MOUs with federal, state, and local law enforcement agencies as well as with federal and state regulatory agencies. FinCEN has data-access MOUs, or provides direct data access, with or to all the federal supervisory agencies and with FINRA, a securities SRO—but not with NFA, a futures SRO. As discussed previously, supervisory agencies use these data primarily to help scope and conduct their BSA/AML compliance examinations. In a later section, we discuss access issues in relation to supervision of the futures industry. Law enforcement agencies use BSA data to assist in ongoing investigations and when initiating new investigations. Liaison positions. FinCEN has used on-site liaison positions for more than a decade to help avoid overlap and duplication of efforts. According to FinCEN officials, as of April 2019, FinCEN had 18 law enforcement liaisons from 10 law enforcement agencies. Some law enforcement officials with which we spoke said the liaison position allowed feedback and information exchange between law enforcement and FinCEN. Supervisory agencies generally told us that the liaison program was for law enforcement agencies and that they did not participate. FinCEN officials said that while FinCEN does not have on-site liaisons from supervisory agencies that are comparable in scope to the law enforcement liaisons, they work closely with the supervisory agencies. For example, FinCEN currently has a part-time detailee from FDIC who collaborates on-site at FinCEN with FinCEN analysts. FinCEN officials said they hosted a temporary on-site detailee from NCUA in 2017. NCUA officials told us that they also expressed an interest to FinCEN to implement routine detailing of staff. SEC staff told us that in the past they had a FinCEN detailee onsite working with SEC’s Division of Enforcement, which allowed SEC to better understand FinCEN’s methodology and approaches, and assess their own approaches to BSA enforcement. SEC staff expressed interest in hosting another FinCEN detailee, and the agency has been considering a FinCEN request to send an SEC liaison to FinCEN. There are also other BSA/AML collaborative mechanisms among regulatory or law enforcement agencies, such as the FFIEC BSA/AML working group, SAR review teams, and geographic targeting orders (see table 4). We also obtained perspectives on collaboration from FinCEN and relevant key law enforcement and regulatory agencies on three selected BSA criminal cases, which are discussed in appendix III. The futures industry has been less represented in key mechanisms for BSA/AML collaboration (those related to BSAAG and data-access agreements) than other industries. Representatives from CFTC, the primary futures industry SRO, and a futures industry association expressed concerns that the futures industry was not as well represented on BSAAG as other industries. CFTC, as the delegated supervisory agency, always has been a member of BSAAG. However, the primary futures industry SRO—which has developed rules to implement AML requirements for its members and conducts a majority of AML examinations of futures firms—and futures industry associations have had less consistent participation. Officials from the primary futures SRO expressed concern that they were not a regular member of BSAAG. They noted that they were a BSAAG member in the mid-2000s but then not selected as a member of BSAAG for almost 5 years (from 2014) until they were invited to be a member again in March 2018, at which point, the futures industry association’s BSAAG membership was not renewed when its term expired. Representatives from all key federal supervisory agencies have been regular members of BSAAG. In particular, the securities industry, which also uses SROs to monitor BSA compliance, has had its primary SRO as a member of BSAAG since 2008. Representatives from the primary securities SRO said that their participation in BSAAG allowed them to coordinate BSA/AML efforts. Representatives from the primary futures SRO said that their role regarding oversight of the futures industry was similar to the primary securities SRO. These representatives stated that they adopted AML rules; were the only SRO with jurisdiction over all futures entities subject to AML requirements; and conducted a majority of AML examinations. Accordingly, representatives said that they were in the unique position of seeing first-hand how AML requirements are implemented in the futures industry and identifying issues, as well as potential gaps in implementation. CFTC staff said that all significant representative groups for the futures industry should participate in BSAAG—in particular, the primary futures SRO because it supervises all types of registered firms in the futures industry and the leading industry association for the futures, options, and centrally cleared derivatives markets. In addition, representatives from industry associations we spoke with from other industries have been regular members of BSAAG including banking associations and the primary securities industry association. The primary securities industry association has been a member since 2008, concurrent with the primary securities SRO (also a member since 2008). Representatives from this association said that BSAAG is a mechanism that FinCEN uses to solicit feedback from the industry. Officials from the futures industry association that had previously participated in BSAAG, told us that their current lack of participation may prevent FinCEN from obtaining an in-depth understanding of futures industry issues and may prevent the futures industry from obtaining information on BSA/AML goals and priorities and other key communications. CFTC staff said that in addition to the primary futures SRO, BSAAG also should include a primary industry association. FinCEN officials told us that there is a limit on the number of BSAAG representatives allowed and that they have had a futures representative that was not always an active participant. In addition, FinCEN officials said that when selecting BSAAG members they need to consider the top money laundering risk areas as well as the appropriate number of members to have productive discussions. They added that because membership rotates, additional futures representatives could be added based on needs and topic areas. Furthermore, FinCEN officials told us that although the most recent BSAAG (October 2018) did not include a futures industry association, it did include the primary futures industry SRO and six large diversified financial firms that are listed as members of the key futures industry association. However, these firms represent a small percentage of the association’s membership and are not smaller firms or clearing organizations, exchanges, and global and regional executing brokers. As noted in Treasury’s 2018 national strategy, BSAAG is the main AML information conduit and policy coordination mechanism among regulators, law enforcement, and industry and has been focusing on improving the effectiveness and efficiency of the regulatory and supervisory regime. Without regular participation by the primary futures SRO that has developed AML rules and conducts the majority of BSA examinations for the futures industry, FinCEN may be missing opportunities to better understand compliance in the futures industry and the SRO may not be fully up to date on BSA/AML compliance issues and related initiatives that may affect the AML rules it develops. Furthermore, without representation on BSAAG by the key futures industry association, the diverse array of futures industry participants may not be fully represented, informed, or updated on key BSA/AML information. Standards for Internal Control in the Federal Government state that management should externally communicate the necessary quality information to achieve the entity’s objective. In addition, the statutory purpose of BSAAG includes informing private-sector representatives of how BSA reports have been used and receiving advice on how reporting requirements should be modified. Additional futures industry representation on BSAAG could enhance both regulator and industry awareness of BSA/AML compliance issues and potential money laundering risks. In addition, NFA, the SRO conducting the majority of BSA examinations for the futures’ industry, does not have direct access to BSA data—unlike all key supervisory agencies and FINRA. In our 2009 report, we recommended that FinCEN expand data-access MOUs to SROs conducting BSA examinations that did not already have direct access to BSA data. In 2014, FinCEN completed a data access MOU with FINRA. But it did not pursue an MOU with NFA because, at that time, CFTC did not ask FinCEN to arrange an MOU with NFA. However, CFTC staff, as of April 2019, told us that access to BSA data would enhance the tools that NFA has to perform its functions, including its ability to scope and perform BSA/AML examinations, and to use BSA data more extensively and more frequently. Currently, when conducting its examinations, NFA must obtain SAR information from CFTC, as well as reviewing SARs provided by a firm while conducting an on-site examination. FinCEN officials told us that NFA has not requested direct access to BSA data. However, NFA representatives told us they welcomed a discussion with CFTC and FinCEN on the benefits and drawbacks of having direct access to BSA data. FinCEN officials said they would need to better understand any negative impacts of NFA not having direct access and NFA would need to meet the required criteria to obtain direct access. Standards for Internal Control in the Federal Government state that management should externally communicate the necessary quality information to achieve the entity’s objectives. Supervisory agencies with direct data access all have utilized BSA data to some extent to scope and plan examinations. Direct access to BSA data would enhance NFA’s ability to scope BSA examinations and generally conduct its oversight responsibilities for BSA in the futures industry. FinCEN and two law enforcement agencies with which we spoke generated metrics on the usefulness of BSA reporting—such as the number of BSA reports that led to new investigations. But FinCEN, whose role it is to collect and disseminate BSA data, has not consistently communicated these metrics—instead only communicating some available metrics on an ad-hoc basis through methods such as published speeches or congressional testimonies. FinCEN and nearly all the law enforcement agencies with which we spoke provided some feedback to financial institutions on how to make BSA reports more useful through formal mechanisms (such as conferences and training sessions) and informal relationships. However, institution-specific feedback, which all industry groups said their members preferred, has not been widely provided. Two of the six law enforcement agencies (IRS-CI and FBI) we interviewed produced metrics on the usefulness of BSA reporting (for example, percentage of investigations utilizing BSA data). However, FinCEN (which has statutory responsibilities for the central collection, analysis, and dissemination of BSA data) did not consistently communicate this information, but rather communicated on an ad hoc basis through published speeches or congressional testimony. IRS-CI annually publishes a report with data on investigations, including those generated by BSA reports. For example, in fiscal year 2018, IRS-CI reported that 515 BSA investigations were initiated (see table 5). FinCEN’s website generally did not refer to IRS-CI metrics, but in a November 2018 congressional testimony, the Director of FinCEN included information on the percentage of IRS-CI investigations that began with a BSA source— 24 percent in fiscal year 2017. In addition, IRS-CI also tracks the work of SAR review teams and has created some metrics on the usefulness of BSA reporting, including: the number of investigations initiated, indictments, convictions, sentenced, and total dollars seized based on the work of the SAR review teams (see table 6). While this information is not routinely reported publicly, IRS officials said they have shared information about results from SAR review teams’ during presentations to the public, law enforcement, and financial industries. FBI analyzes BSA filings to support existing cases and initiate new investigations, and FBI and FinCEN have reported related metrics to the public, but not routinely. FBI created a BSA Alert System that searches subjects’ names, dates of birth, Social Security numbers, telephone numbers, email addresses, and other identifying information across BSA filings, and automatically emails the results to agents. In a November 2018 congressional testimony, the FBI section chief of its Criminal Investigative Division stated that these searches produce an average of 2,000 alerts per month and provided statistics on the results of the agency’s use of BSA data. From January 2017 to June 2018, BSA reporting was directly linked to the main subject of approximately 25 percent of pending FBI investigations (up from 8.9 percent in 2012). The November 2018 FBI testimony also described FBI’s use of SARs data analysis to identify new cases. For example, FBI analysts run a series of search terms and criteria related to money laundering, terrorist financing, human trafficking, fraud, corruption, transnational organized crime, and other schemes against SAR filings. The persons identified through the searches are automatically searched against FBI case files and watchlist data, and the results incorporated into reports to appropriate field offices. FinCEN also communicated some of the FBI metrics in an August 2018 speech by the FinCEN director. For example, the director said more than 20 percent of FBI investigations utilized BSA data and for some types of crime, like organized crime, nearly 60 percent of FBI investigations used BSA data. The other four law enforcement agencies with which we spoke did not generate metrics on the usefulness of BSA reporting due to confidentiality or data reliability concerns, among other reasons, but some tracked other BSA-related efforts. DHS officials said that while they do not have any metrics on the usefulness of BSA reports, the agency provided data on the usefulness of ICE-HSI’s Cornerstone outreach program—in which ICE-HSI provided training to financial institutions on issues such as trends in how criminals earn, move, and store illicit proceeds. ICE-HSI reported that in fiscal year 2017, based on the Cornerstone outreach program, special agents initiated more than 72 financial investigations, made 55 criminal arrests, and seized almost $2 million in illicit proceeds. Secret Service officials said that they have been trying to develop an internal tracking system for their use of BSA reports, but were not tracking any metrics as of April 2019. They told us that they use BSA data for investigative purposes only and they do not discuss or report it, because they consider it confidential information—thus making it difficult for them to gather metrics on the use of BSA reports. An official from DOJ’s Criminal Division said that the division has not established any performance measures or collected any statistics that measure the effectiveness of BSA record-keeping and reporting requirements (for example, because the success of investigations depending on multiple factors not just BSA reporting, and other challenges described later in this report). However, the official said that the division recognizes the usefulness of BSA data in criminal investigations because the data help them with prosecutions of crimes. Officials from DOJ Executive Office for United States Attorneys said that they track the number of cases with statutory provisions relating to BSA in which the U.S. Attorney’s Offices prosecuted or enforced BSA violations. However, the officials said their case management system does not track if BSA filings were used to initiate or assist the case. Supervisory agencies we interviewed generally said FinCEN and law enforcement are better positioned to compile metrics on the usefulness of BSA reporting because FinCEN and law enforcement agencies are the primary users of BSA reports. However, two of the seven supervisory agencies in our review that also have law enforcement functions—SEC and CFTC—have their own BSA review teams, which analyze SARs to identify potential violations of federal laws, including BSA violations, and refer matters for further examination or investigation as appropriate. For example, on average, from fiscal years 2016 to 2018, SEC’s BSA review team reviewed about 27,000 SARs each year that related to current or potential investigative matters, or entities regulated by SEC. CFTC staff told us they review an estimated 7,500–8,000 SARs annually. On average, in about 100 instances a year, CFTC’s BSA review team refers SARs to investigative teams in support of new or existing investigations. As of December 2018, CFTC staff said they had taken 33 enforcement actions based on leads developed from SARs, with two of the actions related to BSA/AML violations. FinCEN collected some metrics on the usefulness of BSA data through annual surveys and other initiatives; however, the survey results are not public and other metrics are not regularly published. FinCEN contracts an annual survey that includes questions to BSA data users (such as federal and state law enforcement and regulators) about the usefulness of BSA data to, among other things, provide new information or supplement known information or identify new leads or investigations. BSA data users are asked to score the value and impact of BSA data and scored it at about 80 out of 100 for both 2016 and 2017. FinCEN contracts another survey that solicits feedback on the 314(a) program. The 2017 survey found the respondents that utilized the 314(a) program gave it high scores for its usefulness—close to 90 out of 100 for 2016, and 2017. The results from both surveys are not publicly available. In addition, FinCEN periodically publishes a 314(a) Fact Sheet that contains some data on the usefulness of the 314(a) program—such as the number of 314(a) requests and the percentage of requests that contributed to arrests or indictments. Based on information FinCEN collected from law enforcement, approximately 95 percent of 314(a) requests contributed to arrests or indictments. In addition, FinCEN reported the number of cases submitted and related subjects of interest identified in 314(a) requests for each 2-week period from January 5, 2016, to January 29, 2019. For example, for the 2-week period starting on January 29, 2019, 16 requests resulted in 162 subjects of interest. FinCEN contracted a study on the value of BSA reporting—which began in January 2019 and is to be completed by the end of 2019—with the goal of identifying common attributes of BSA value among stakeholders; assessing how to use available data to establish metrics for evaluating and calculating the value of BSA; identifying gaps in data and other information needed to measure the value of BSA reporting; and proposing actions to improve FinCEN’s ability to identify, track , and measure the value of BSA reporting. However, the performance work statement for FinCEN’s BSA value study, which outlines the objectives for the study, does not include actions related to communicating such metrics. As discussed above, FinCEN has not consistently communicated available metrics. FinCEN officials told us their current approach was to communicate metrics through mechanisms such as speeches and congressional testimonies. FinCEN officials told us that it has an ongoing initiative to create a new communication strategy incorporating the results of the BSA value study—but had no time frame for its completion. Our prior work found that agencies can implement a number of practices that can enhance or facilitate the use of performance information— including communicating performance information frequently and routinely. In addition, Standards for Internal Control in the Federal Government state that management should externally communicate the necessary quality information to achieve the entity’s objectives. Officials from some supervisory agencies and most industry associations also told us they would like FinCEN to provide them with more aggregated data on the usefulness of SARs filed by financial institutions. By consistently communicating currently available metrics on the usefulness of BSA reporting to industry, and any metrics later identified by FinCEN’s BSA value study, financial institutions may be able to more fully understand the importance and outcomes of their efforts. FinCEN and nearly all of the law enforcement agencies with which we spoke provided some feedback to financial institutions on how to make BSA reports more useful through formal mechanisms (such as conferences and training sessions) and informal relationships. However, institution-specific feedback, which all industry groups said their members preferred, has not been provided on a regular basis and only on a small scale. FinCEN’s feedback mechanisms include a new information exchange program, advisories, and BSAAG. For example: FinCEN Exchange. On December 4, 2017, FinCEN publicly launched the FinCEN Exchange, a public-private program that brings together law enforcement, FinCEN, and different types of financial institutions to share information to help identify vulnerabilities and disrupt money laundering, terrorist financing, and other financial crimes. As of December 2018, FinCEN convened more than a dozen briefings with law enforcement agencies across the country, involving more than 40 financial institutions. According to Treasury’s 2018 national strategy, the information provided by financial institutions through SARs after the briefings helped FinCEN map and target weapons proliferators, sophisticated global money laundering operations, human trafficking and smuggling rings, and corruption and trade-based money laundering networks, among others. FinCEN officials told us that these exchanges provide a forum in which law enforcement can request specific information and provide information on typologies to financial institutions that allows financial institutions to improve their BSA monitoring and reporting. FinCEN advisories. FinCEN issues public and nonpublic advisories to financial institutions to help financial institutions better detect and report suspicious activity related to a particular risk and related typology. For example, in October 2018 FinCEN posted an advisory on its website to alert U.S. financial institutions of the increasing risk that proceeds of political corruption from Nicaragua might enter the U.S. financial system. It also posted an advisory on the Iranian regime’s illicit activities and attempts to exploit the financial system. These advisories included specific instructions on how to file SARs related to this type of suspicious activity. Some of the industry associations with which we spoke had positive feedback on FinCEN advisories and said they would like to see more red flags and specific guidance to help improve their BSA monitoring programs. BSAAG. Among its functions, the advisory group serves as a forum for industry, supervisory agencies, and law enforcement to communicate about how law enforcement uses SARs and other BSA data. For example, sometimes law enforcement agencies present specific cases using BSA data or information on money laundering and terrorist financing threats. Many of the industry associations and supervisory agencies with which we spoke cited BSAAG as a useful feedback mechanism. As discussed previously, the advisory group is only open to those invited and not a public forum, so not all financial institutions receive or can provide feedback at these meetings. Law enforcement awards. FinCEN officials said that annual law enforcement awards ceremonies are one of the mechanisms they use to provide financial institutions with feedback on the usefulness or effectiveness of BSA/AML information. The award ceremonies highlight successful cases utilizing BSA data. FinCEN officials told us that FinCEN also sends thank you letters to the selected financial institutions that provided the underlying financial data used in the awarded cases, publishes overviews of the cases for which law enforcement agencies received awards, and documents nominated cases. FinCEN issues press releases about the winning cases as another way to share information with financial institutions. Outreach events. FinCEN representatives regularly have participated in outreach events about BSA/AML issues, such as by sharing information at BSA/AML conferences. According to FinCEN officials, the conferences allow FinCEN representatives to both formally (speeches, presentations) and informally (personal interactions) solicit and offer feedback on how financial institutions can improve BSA reporting. Additionally, Treasury reported that its Office of Terrorism and Financial Intelligence regularly engages public and private-sector practitioners and leaders, both domestic and international, on money laundering and terrorist financing issues. For example, the office convenes multilateral and bilateral public-private sector dialogues with key jurisdictions and regions to discuss mutual anti-money laundering and counter-terrorist financing issues of concern. Representatives from nearly all of the federal law enforcement agencies we interviewed said that they conducted outreach events and developed relationships with financial institutions to solicit and provide feedback on their BSA reports including providing feedback on ways to improve BSA reporting and to enhance BSA compliance by financial institutions. Conferences. Law enforcement agencies have presented at conferences on BSA/AML topics and host conferences for financial institutions. For example, for more than a decade ICE-HSI, FBI, Secret Service, IRS-CI, and the Drug Enforcement Administration jointly have hosted an annual conference that includes speakers from law enforcement, supervisory agencies, FinCEN, and financial institutions. According to an ICE-HSI official, the intent of the conference is to educate the private financial sector. FBI officials also said they conduct outreach, such as hosting and participating in conferences, and said that this type of outreach reached more than 6,000 people in the last year (as of August 2018). Briefings and financial institution-specific training. Some law enforcement agencies have their own outreach programs on BSA topics for financial institutions. For example, ICE-HSI has the Cornerstone Outreach Program that began to work with the private sector in 2003 to identify money laundering vulnerabilities in the financial system. The program is to encourage partnerships with the private sector by sharing distinguishing traits or forms of criminal behavior (either crime-centered or person-centered) and methods, and providing training to financial institutions. ICE-HSI officials said they conducted about 300 Cornerstone Outreach presentations in fiscal year 2018. FBI officials also told us they host a couple of meetings annually for financial institutions and sometimes conduct institution-specific training upon request, such as on SAR usefulness. FBI officials told us that for the institution-specific SAR trainings, they change the information on the SARs for training purposes and highlight how institutions can improve SAR filings. They also provide some summary-level statistics and work with the financial institution’s SAR teams to train them on trends. They estimated they conduct from about eight to 10 such sessions annually (as of April 2019). Informal relationships with financial institutions. Officials from nearly all the law enforcement agencies with whom we spoke said they have informal relationships with financial institutions to solicit and provide feedback on their BSA reports. Most supervisory agencies we interviewed said that they did not provide feedback to financial institutions on the usefulness of their BSA reporting due to factors such as law enforcement being better positioned to provide feedback and SAR confidentiality restrictions. However, CFTC staff noted that their BSA review team communicates the general usefulness of SARs filed by their institutions at conferences and through telephone contacts with the filer after the relevant case is filed. SEC staff told us they do not reach out directly to provide financial institutions specific feedback on the usefulness of SARs, but provide training on what makes a good or bad SAR through routine interaction with the primary securities industry association and presentations at BSAAG. As discussed earlier, some supervisory agencies regard FinCEN and law enforcement as the primary end users of BSA reports, and thus, in a better position to provide feedback to financial institutions on BSA reporting. Additionally, many supervisory agencies told us that it would be helpful if FinCEN and law enforcement could provide more frequent or systematic feedback on financial institutions’ SAR reporting. Some supervisory agencies, industry associations, and law enforcement agencies with which we spoke identified limitations with some of FinCEN’s feedback mechanisms, including FinCEN Exchange and law enforcement awards. Representatives from all the industry associations we spoke with indicated that financial institutions would like to see more institution-specific feedback on their SARs to improve their monitoring systems and reporting. FinCEN Exchange. Some industry associations appreciated FinCEN’s outreach, but noted that the new FinCEN Exchange program was on a small-scale and industry associations had not been invited to participate or provide feedback. An official from one industry association said that the association could help identify banks, such as community banks, that could be a good fit for the program. Supervisory agencies also generally said they were not involved in the FinCEN Exchange program. Officials from OCC said that they would like to be involved because they are the primary regulator for many of the financial institutions in the program and thought their participation would add value. Some law enforcement agencies had some concerns about the FinCEN Exchange program, such as private-sector representatives not being properly vetted or the risk of talking about ongoing investigations. For example, officials from ICE-HSI and FBI told us their institution-specific training included only vetted or trusted financial institutions. FinCEN officials said that they collaborated with regulators on the FinCEN Exchange and solicited feedback on the program from certain industry associations. In addition, FinCEN posts frequently asked questions about the FinCEN Exchange program on its website and encourages feedback from financial institutions on how they can support FinCEN priorities such as information sharing. FinCEN officials said that the FinCEN Exchange is an invitation-based program and that FinCEN vets information received from financial institutions and consults with law enforcement, as appropriate, to convene a briefing. Furthermore, FinCEN’s frequently asked questions about the program note that financial institutions that voluntarily participate in a FinCEN Exchange briefing must adhere to the terms noted in FinCEN’s invitation, including any requirement of confidentiality given the sensitivity of information provided. Awards. Representatives from CFTC, FBI, and three industry associations with whom we spoke made suggestions for expanding FinCEN’s law enforcement awards and related thank you letter initiatives. For example, CFTC suggested that FinCEN expand the awards program to include civil cases as well as criminal cases. FinCEN officials also told us in April 2019 that they were considering awards for civil cases. Industry associations generally said their member financial institutions appreciated receiving thank you letters, but some noted that there were limitations with these letters. For example, a representative from one industry association said that only a small percentage of financial institutions receive the awards, and representatives from another industry association said that the letters should provide more specific feedback. Two other industry associations said that the confidential nature of SARs makes it difficult to share the success of the financial institution that submitted the reporting. Many law enforcement agencies with which we spoke said that the law enforcement awards were a good idea, and FBI officials recommended creating awards for the financial institutions as well. FinCEN officials stated that due to SAR confidentiality rules, it cannot publicize awards to financial institutions. Institution-specific feedback. Representatives from all the industry associations with whom we spoke told us, or have publically stated that financial institutions would like to see more institution-specific feedback on their SARs to improve their monitoring systems and reporting. SAR reporting is labor-intensive for financial institutions because it requires researching and drafting narratives for a SAR filing and justifying cases where a SAR is not filed, according to many industry association representatives. However, many representatives said that financial institutions get little institution-specific feedback on their SAR reporting. We found that while law enforcement conducts some small group briefings that industry associations said were useful, these briefings cover a small number of financial institutions in relation to the size of the U.S. financial industry. ICE-HSI stated that it conducted 302 institution-specific trainings and briefings in fiscal year 2018, and FBI, as discussed previously, estimated it has conducted from about eight to 10 institution- specific SAR reporting trainings annually in relation to the more than 10,000 depository institutions, more than 26,000 money services businesses registered with FinCEN, and almost 4,000 active broker- dealers registered (as of January 2019). The American Bankers Association, Independent Community Bankers of America, and The Clearing House all have issued papers—recommending more institution- specific feedback on financial institution SAR reporting. Some industry associations and other stakeholders pointed to international efforts that provided feedback through public-private partnerships. For example, the United Kingdom’s Joint Money Laundering Intelligence Taskforce (joint task force), formally established in May 2016, includes regulators, law enforcement, and more than 40 major United Kingdom and international banks conducting a large proportion of financial activity in the United Kingdom (89 percent of the volume of personal accounts in the United Kingdom). The joint task force has a system in place to routinely convene these partners, included vetted banking representatives, to set AML priorities and share intelligence. According to the intergovernmental Financial Action Task Force’s (FATF) mutual evaluation report of the United Kingdom, financial institutions involved in the joint task force are required to file SARs for suspicious activity identified through the program, and these SARs are considered to be of high value. FATF’s report also noted that the joint task force is considered to be best practice in public-private information sharing. According to Treasury’s 2018 national strategy, FinCEN collaborated with the United Kingdom’s joint task force in implementing the FinCEN Exchange program. In prior work, we reported that FinCEN recognized that financial institutions do not generally see the beneficial impacts of their BSA/AML efforts. FinCEN, law enforcement, and some industry associations with which we spoke identified challenges in providing institution-specific feedback to financial institutions on the usefulness of their BSA reporting. In addition to the large number of financial institutions in the United States, officials from FinCEN and law enforcement agencies told us that law enforcement cases may be sensitive and time-consuming, and the unauthorized disclosure of SARs or sharing of certain information with financial institutions might compromise ongoing investigations. Two industry associations also identified the confidential nature of SARs as a challenge for FinCEN and law enforcement to provide institution-specific feedback to financial institutions. As we have discussed, FinCEN has been undertaking a study to better understand the value and effectiveness of BSA. In addition, FinCEN and some law enforcement agencies have made efforts to provide some institution-specific feedback through various methods on BSA reporting, but the feedback has been periodic, sometimes only at the request of financial institutions, and provided on a small scale. FATF standards on information sharing state that anti-money laundering authorities should provide feedback to financial institutions to assist them in complying with anti-money laundering requirements—these mechanisms can include feedback loops, whereby more consistent and more fully explained feedback is provided to the private sector on suspicious transaction reports. FinCEN’s statutory duties also include information sharing with financial institutions in the interest of detection, prevention, and prosecution of terrorism, organized crime, money laundering, and other financial crimes. As discussed, other countries have put in place mechanisms (such as the United Kingdom’s joint task force) to provide regular feedback on AML reporting (including SAR-like instruments) to financial institutions representing a large portion of the country’s financial activity. Additional and more regular institution-specific feedback, designed to cover different types of financial institutions and those with significant financial activity, may enhance the U.S. financial industry’s ability to effectively target its efforts to identify suspicious activity and provide quality BSA reporting. FinCEN, numerous supervisory agencies (covering various financial sectors), and law enforcement agencies are responsible for enforcing the BSA/AML regulatory framework with the end goal of detecting and preventing money laundering and other financial crimes. While these agencies have processes and mechanisms in place to collaborate on key BSA/AML issues, such collaboration and information sharing could be enhanced by additional and more regular involvement of representatives of the futures industry—a complex and unique financial markets sector. Unlike the other key federal supervisory agencies and securities SRO involved in BSA compliance, the primary futures SRO was not consistently included in BSAAG. Thus, FinCEN may be missing opportunities to better understand compliance in the futures industry and the SRO may not be updated on related BSAAG initiatives. The key futures industry association also has had less consistent participation in BSAAG, and although it has been a member of BSAAG in the past, it was not a member concurrently with the futures SRO—thereby, potentially missing opportunities to engage FinCEN and other agencies on BSA issues in futures markets. In addition, by providing NFA with direct access to BSA data (similar to the access the key securities SRO already has) FinCEN could facilitate NFA oversight and enable it to scope examinations proactively to address BSA risks. Some federal agencies have taken steps to provide metrics and institution-specific feedback on the usefulness of BSA reporting to industry; however, metrics were not provided regularly and feedback efforts were provided on a small scale. Additionally, challenges to expanding and enhancing metrics and feedback remain (such as those related to measuring the usefulness of BSA reporting, providing feedback to thousands of individual institutions, and the sensitive nature of ongoing law enforcement investigations). FinCEN has an ongoing effort to identify additional measures of the value and usefulness of BSA reporting, which is expected to be completed at the end of 2019. But opportunities exist to enhance feedback and reporting before that date and in general. For example, in the interim FinCEN routinely could communicate currently available metrics on usefulness to help financial institutions more fully understand the importance and value of their efforts to report BSA-related information. Furthermore, with today’s rapidly changing financial markets and potential changes to money laundering risks, it is important that FinCEN and federal agencies take steps to provide institution-specific feedback—while keeping in mind any confidentiality concerns—to cover different types of financial institutions and those with significant financial activity. Increasing the feedback on BSA reporting could help make the BSA reporting of financial institutions more targeted and effective and enhance collaboration among key stakeholders in U.S efforts to combat illicit financial crime. We are making the following four recommendations to FinCEN: The Director of FinCEN, after consulting with CFTC, should consider prioritizing the inclusion of the primary SRO conducting BSA examinations in the futures industry in the Bank Secrecy Act Advisory Group (BSAAG) on a more consistent basis and also making the primary futures industry association a concurrent member. (Recommendation 1) The Director of FinCEN, after consulting with CFTC, should take steps to explore providing direct BSA data access to NFA. (Recommendation 2) The Director of FinCEN should review options for FinCEN to more consistently and publicly provide summary data on the usefulness of BSA reporting. This review could either be concurrent with FinCEN’s BSA value study or through another method. (Recommendation 3) The Director of FinCEN should review options for establishing a mechanism through which law enforcement agencies may provide regular and institution-specific feedback on BSA reporting. Options should take into consideration providing such feedback to cover different types of financial institutions and those with significant financial activity. This review could either be part of FinCEN’s BSA value study or through another method. (Recommendation 4) We provided a draft of this report to Treasury/FinCEN, CFTC, NCUA, DHS, DOJ, the Federal Reserve, FDIC, IRS, OCC, and SEC for their review and comment. FinCEN, CFTC, and NCUA provided written comments, which are reproduced in appendixes IV, V, and VI. FinCEN, DHS, the Federal Reserve, FDIC, OCC, and SEC provided technical comments on the draft report, which we incorporated as appropriate. In emails, DOJ and IRS audit liaisons stated that the agencies did not have any formal or technical comments. In its written response, FinCEN concurred with one recommendation, disagreed with two, and agreed with the spirit of one recommendation but noted some concerns. Specifically, FinCEN concurred with the recommendation that FinCEN more consistently and publicly provide summary data on the usefulness of BSA reporting (Recommendation 3). FinCEN disagreed with the draft report’s recommendation that FinCEN, after consulting with CFTC, should ensure that the primary SRO conducting BSA examinations in the futures industry is a regular member of BSAAG and also should consider making the primary futures industry association a concurrent member (Recommendation 1). FinCEN’s written response stated that while the primary futures SRO presently is a BSAAG member, only federal agencies are considered permanent members, and FinCEN will not make future membership commitments to any specific SRO or any other nonfederal organization. As such, we modified the recommendation to give FinCEN more flexibility to address the issues that prompted our recommendation. We continue to believe that prioritizing futures representation in BSAAG to be consistent with securities industry representation would help FinCEN better understand BSA compliance in the futures industry and keep the futures industry updated on related BSAAG initiatives. As noted in the report, the primary securities SRO has been a member of BSAAG since 2008 and a key securities industry association has been a concurrent member. FinCEN disagreed with the recommendation that FinCEN, after consulting with CFTC, explore providing direct BSA data access to NFA (Recommendation 2) because FinCEN said it has not received a request from CFTC or NFA to engage on this matter. FinCEN also said it would review any future request for direct access in accordance with established procedures, stating it must ensure that proper controls are in place and that direct access to the BSA database is limited to those who truly need it. As discussed in our report, CFTC stated that NFA’s direct access to BSA data would enhance NFA’s ability to scope and perform BSA/AML examinations, and to use BSA data more extensively and more frequently to perform its functions, including conducting the majority of BSA examinations for the futures industry. NFA representatives also told us they welcomed a discussion with CFTC and FinCEN on the benefits and drawbacks of having direct access to BSA data. We continue to believe the recommendation is valid as it provides FinCEN flexibility to explore providing NFA data access and would not preclude FinCEN from ensuring that NFA had proper controls in place. In its written responses, FinCEN neither agreed nor disagreed with the recommendation that FinCEN review options for establishing a mechanism through which law enforcement agencies may provide regular and institution-specific feedback on BSA reporting (Recommendation 4). FinCEN said it agreed with the spirit of this recommendation—that law enforcement feedback on the value and usefulness of BSA information is important—and stated that FinCEN regularly takes necessary steps to review options for establishing additional mechanisms through which law enforcement agencies can provide regular feedback. FinCEN also stated that it provides a consolidated view of law enforcement feedback as well as feedback on the value and usefulness of institution-specific BSA information. However, as discussed in the report, we found that the current institution-specific feedback mechanisms were not occurring on a regular basis or were on a relatively small scale. In its response, FinCEN also noted that unless mandated by Congress, law enforcement feedback will be voluntary and that FinCEN cannot compel law enforcement compliance with feedback initiatives. We continue to believe the recommendation is valid as it allows FinCEN flexibility in reviewing options for establishing a mechanism through which law enforcement may choose to provide regular feedback to reach a larger number of financial institutions from diverse industries, without requiring FinCEN to compel law enforcement agencies to participate. In its written responses, CFTC agreed with all our recommendations. In particular, CFTC agreed that the primary futures SRO should be a regular member of BSAAG (Recommendation 1). CFTC added that FinCEN should consider making another futures SRO a concurrent member. In a later discussion, a CFTC Assistant General Counsel said that, in general, CFTC would like to see more futures participation in BSAAG, including SROs and industry associations. CFTC also agreed with our recommendation that the Director of FinCEN, after consulting with CFTC, explore providing NFA direct access to BSA data (Recommendation 2). In its written response, NCUA also agreed with all of our recommendations, which it stated would enhance coordination and collaboration and increase visibility about the value of BSA reporting requirements. As agreed with your office, unless you publicly announce the contents of this report earlier, we plan no further distribution until 30 days from the report date. At that time, we will send copies of this report to the appropriate congressional committees, the Secretary of the Treasury, the Attorney General, the Acting Secretary of Homeland Security, the Commissioner of IRS, the Chairman of CFTC, the Chairman of FDIC, the Chairman of the Federal Reserve, the Chairman of NCUA, the Comptroller of the Currency, the Chairman of SEC, and other interested parties. This report will also be available at no charge on our website at http://www.gao.gov. If you or your staff have any questions about this report, please contact me at (202) 512-8678 or ClementsM@gao.gov. Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this report. GAO staff who made key contributions to this report are listed in appendix VII. The objectives of this report were to:(1) describe how the Financial Crimes Enforcement Network (FinCEN) and supervisory agencies supervise, examine for, and enforce Bank Secrecy Act and related anti- money laundering requirements (collectively, BSA/AML) compliance; (2) discuss how FinCEN, supervisory agencies, and law enforcement collaborated on implementing and enforcing BSA/AML requirements; and (3) examine the extent to which FinCEN, supervisory agencies, and law enforcement established metrics and provided feedback to financial institutions on the usefulness of their BSA reporting. For this report, we identified the key agencies and entities, including FinCEN, a bureau in the Department of the Treasury (Treasury), which is responsible for the administration of BSA, and the supervisory agencies that oversee BSA compliance. The supervisory agencies include the federal banking regulators—Federal Deposit Insurance Corporation (FDIC), Board of Governors of the Federal Reserve System (Federal Reserve), National Credit Union Administration (NCUA), Office of the Comptroller of the Currency (OCC)—as well as the Internal Revenue Service (IRS), Commodity Futures Trading Commission (CFTC), and Securities and Exchange Commission (SEC). Self-regulatory organizations (SRO) for the securities and futures industries—including the Financial Industry Regulatory Authority (FINRA) and National Futures Association (NFA)—also have BSA/AML responsibilities and conduct BSA examinations of their members. The Department of Justice may pursue investigations and prosecutions of financial institutions and individuals for both civil and criminal violations of BSA/AML regulations. To address the first objective, we reviewed relevant laws—including the Bank Secrecy Act, its related statutes, and key provisions of the USA PATRIOT Act—regulations, and agency documentation. To better understand how supervisory agencies conduct their examinations, we reviewed the following BSA/AML examination manuals: the 2014 BSA/AML Examination Manual, developed by the Federal Financial Institutions Examination Council (FFIEC); the Bank Secrecy Act/Anti- Money Laundering Examination Manual for Money Services Business (developed by FinCEN and IRS); and SEC’s nonpublic manual and futures SROs nonpublic examination procedures. We reviewed and analyzed data from FinCEN summary reports on the examination and enforcement activities of supervisory agencies for fiscal years 2015 through 2018 (second quarter), which were the most recent data available at the time of our analysis. We also reviewed FinCEN’s enforcement actions for this time period as provided on its website, to identify the number and types of financial institutions, and the number of concurrent actions FinCEN brought jointly with a regulator. We also reviewed and analyzed FinCEN referral data from January 1, 2015, to September 25, 2018. Referrals are potential BSA violations or deficiencies referred by supervisory agencies, the Department of Justice, or state regulators. We assessed the reliability of the FinCEN summary report data and referral data by reviewing documentation related to these datasets, interviewing knowledgeable officials, and conducting manual data testing for missing data, outliers, and obvious errors. We determined the data to be sufficiently reliable for reporting on supervisory agency, SRO, and FinCEN BSA/AML compliance and enforcement activities. For this and our other objectives, we interviewed officials at Treasury’s Office of Terrorism and Financial Intelligence and FinCEN, the other supervisory agencies, and two SROs—FINRA and NFA. To address the second objective, we judgmentally selected six law enforcement agencies based on their (1) focus on financial crimes, (2) role in investigating or prosecuting recent large criminal cases we selected involving financial institutions with BSA violations, (3) participation in FinCEN’s liaison program, and (4) identification by FinCEN as a key user of BSA data. We selected the following law enforcement agencies: the Criminal Division (Money Laundering and Asset Recovery Section), the U.S. Attorney’s Offices (through the Executive Office for United States Attorneys), and the Federal Bureau of Investigation in the Department of Justice; IRS Criminal Investigation in the Department of Treasury; and U.S. Immigration and Customs Enforcement-Homeland Security Investigations and the U.S. Secret Service in the Department of Homeland Security. The views of selected law enforcement agencies are not generalizable. To identify key collaborative mechanisms used to implement BSA/AML responsibilities, we reviewed agency documentation (such as strategic plans, national strategies, and risk assessments) and prior GAO reports that contained discussions of collaborative mechanisms, and we interviewed agency officials from FinCEN, supervisory agencies, SROs, and selected law enforcement agencies. We obtained agency documentation and data related to the identified collaboration mechanisms and interviewed officials from FinCEN, supervisory agencies, and selected law enforcement agencies for their perspectives on these efforts. We compared agencies’ collaboration efforts to criteria in federal internal control standards on management communication. To gain further insight into the collaboration process, we also reviewed documentation on three criminal cases involving BSA/AML violations by financial institutions to illustrate how law enforcement investigates and prosecutes BSA violations and coordinates with FinCEN and other supervisory agencies. We selected the cases on the basis of recent occurrence (calendar year 2017 or 2018) and on their having involved criminal violations of BSA by financial institutions, required coordination on penalties among multiple supervisory agencies and law enforcement, and resulted in a large monetary penalty. While not generalizable, the cases helped provide additional context for our review. To obtain additional perspectives on the effectiveness of BSA/AML collaboration processes, we interviewed representatives of seven selected industry associations based on their published work and relevant experience and for coverage of key financial industries (banking, securities, futures, and the money services business). While not generalizable, these interviews helped provide context for how industry views the effectiveness of BSA/AML collaboration efforts. For the third objective, we reviewed agency documentation and data on metrics related to BSA reporting and feedback mechanisms that FinCEN, the supervisory agencies, or the six selected law enforcement agencies had established. Key documents we reviewed included Treasury’s most recent strategic plan, national strategy for combating illicit financing, and related risk assessments. For all agencies we interviewed, we requested any available metrics. We reviewed agency websites, annual reports, and recently published speeches and testimonies on BSA/AML-related topics to identify any metrics. We also requested and reviewed contract documentation from FinCEN, such as the performance work statement for a study that FinCEN commissioned on how to establish metrics for and identify the value of BSA data. We compared metrics on the usefulness of BSA and how they were communicated against key criteria for enhancing or facilitating the use of performance metrics that GAO previously identified and federal internal control standards on management communication. For feedback mechanisms, we obtained documentation on any steps FinCEN, supervisory agencies, or the selected law enforcement agencies took to provide feedback on BSA reporting to financial institutions and we interviewed agency representatives on these efforts. The documents we reviewed included those identified above related to metrics, as well as agency advisories, guidance, and rulemaking. We compared the feedback efforts against Treasury’s information-sharing statutory duties and strategic plan, and international anti-money laundering standards and guidance. To gain industry perspectives on the usefulness of BSA reporting and on feedback received from FinCEN, supervisory agencies, and law enforcement, we conducted seven interviews with the selected industry associations. While not generalizable, the interviews helped provide context for financial industry perspectives on BSA/AML reporting and feedback. We conducted this performance audit from February 2018 to August 2019 in accordance with generally accepted government auditing standards. Those standards require that we plan and perform the audit to obtain sufficient, appropriate evidence to provide a reasonable basis for our findings and conclusions based on our audit objectives. We believe that the evidence obtained provides a reasonable basis for our findings and conclusions based on our audit objectives. As part of its oversight of supervisory agencies, the Financial Crimes Enforcement Network (FinCEN) routinely collects data from supervisory agencies as established in information-sharing memorandums of understanding (MOU). The MOUs establish that supervisory agencies should provide FinCEN with examination data such as the number of Bank Secrecy Act /anti-money laundering (BSA/AML) violations, informal actions, and formal enforcement actions (on a quarterly basis). Finally, the Internal Revenue Service (IRS) told us it has MOUs with some state regulators to obtain state examinations, which IRS officials said help to identify issues among and plan examinations of money services businesses and determine if the businesses had addressed prior deficiencies. The following sections provide more information on each supervisory agency’s (1) examinations, (2) violations, and (3) enforcement actions. Also see appendix I for more information on the types of data we collected for each agency and any data limitations. From fiscal year 2015 to the second quarter of fiscal year 2018, the most common BSA violations cited by the federal banking regulators were violations of requirements to report suspicious activities, 314(a) information-sharing requirements, rules for filing of reports, BSA training, and a system of internal controls. For example, regulators could cite a violation if a financial institution failed to file a required suspicious activity report (SAR), failed to file a SAR in a timely manner, or failed to maintain confidentiality of SARs. Violations of internal controls include a financial institution failing to establish a system of internal controls to ensure ongoing compliance, including staff adherence to the financial institution’s BSA/AML policies. From fiscal year 2015 to 2018 (second quarter), the federal banking regulators cited thousands of violations (11,752) and brought 116 formal enforcement actions (see table 7). The number of informal enforcement actions compared to the number of formal enforcement actions varied by banking regulator. For example, in fiscal year 2017 the National Credit Union Administration (NCUA) brought 1,077 informal enforcement actions and no formal enforcement actions. In the same period, the Office of the Comptroller of the Currency (OCC) brought two informal enforcement actions and six formal enforcement actions. SEC and its SROs took 71 formal enforcement actions against broker- dealers from fiscal year 2015 through the second quarter of fiscal year 2018 (see table 8). FINRA took the majority of enforcement actions against broker-dealers. From fiscal year 2015 to the second quarter of fiscal year 2018, SEC and the SROs for broker-dealers most frequently cited violations of FINRA AML program rules. They included violations of policies and procedures relating to reporting suspicious activity, internal controls, and annual independent testing, as well as BSA violations of AML program requirements for brokers or dealers and customer identification programs for brokers or dealers. From fiscal year 2015 to the second quarter of fiscal year 2018, the National Futures Association (NFA) cited all BSA/AML violations, and took all informal and formal enforcement actions for BSA/AML deficiencies for the futures industry (see table 9). The violations NFA most commonly cited were against introducing brokers and fell under its AML program rules that related to policies and procedures for internal controls, training, and annual independent testing, and BSA requirements for AML programs and customer identification programs. The CME Group did not cite any futures commission merchants for violations during this period. In response to violations, NFA brought almost 200 informal enforcement actions and a few (10) formal enforcement actions over the period of our review. For example, in 2017 NFA took 64 informal and four formal enforcement actions. IRS referred more than 100 cases to FinCEN from fiscal year 2015 through the second quarter of 2018 and issued letter 1112s to thousands of institutions, which contain a summary of examination findings and recommendations to the institution for corrective action (see table 10). From fiscal year 2015 to the second quarter of fiscal year 2018, the most common violations cited by IRS fell under general AML program requirements for money services businesses, which require such businesses to develop, implement, and maintain an effective AML program (one designed to prevent a business from being used to facilitate money laundering and the financing of terrorist activities). AML program requirements have several subcomponent violations. Among the most commonly cited subcomponent violations were those related to overall program deficiencies; policies, procedures, and internal controls; training of appropriate personnel to identify suspicious transactions; and providing for independent testing of the AML program. The Financial Crimes Enforcement Network (FinCEN) and supervisory agencies may be asked to provide information as part of law enforcement investigations and can take parallel, but separate, enforcement actions against the same institutions to address Bank Secrecy Act/anti-money laundering (BSA/AML) concerns. FinCEN and supervisory agencies may refer potential violations of a criminal nature an appropriate federal law enforcement agency or to the Department of Justice (DOJ)—and within DOJ, the U.S. Attorney’s Office—and may be asked to assist law enforcement investigations. For example, supervisory agencies may be asked to interpret financial institution documents or serve as expert witnesses and records custodians in a trial. FinCEN, supervisory agencies, and law enforcement agencies have conducted parallel civil and criminal investigations. Federal law enforcement and supervisory agency officials have told us that such investigations should remain separate and independent. We selected three recent cases in which FinCEN, supervisory agencies, and law enforcement collaborated to conduct parallel investigations and took concurrent but separate civil and criminal BSA enforcement actions. Officials with whom we spoke from agencies that were involved in these cases said the agencies coordinated with each other (for example, by establishing liaison positions, scheduling regular conference calls, and coordinating on global settlements). Rabobank National Association (Rabobank). On February 7, 2018, DOJ and the Office of the Comptroller of the Currency (OCC) both announced actions against Rabobank for deficiencies in its BSA/AML compliance program and obstruction of the primary regulator (OCC). DOJ announced that Rabobank pleaded guilty to a felony conspiracy charge for impairing, impeding, and obstructing its primary regulator OCC by concealing deficiencies in its AML program and for obstructing OCC’s examination of Rabobank. The bank agreed to forfeit $368,701,259 for allowing illicit funds to be processed through the bank without adequate BSA/AML review and OCC issued a $50 million civil money penalty against Rabobank for deficiencies in its BSA/AML compliance program. DOJ’s Money Laundering and Asset Recovery Section Bank Integrity Unit, the U.S. Attorney’s Office of the Southern District of California, U.S. Immigration and Customs Enforcement-Homeland Security Investigations (ICE-HSI) within the Department of Homeland Security, Internal Revenue Service Criminal Investigation (IRS-CI), and the Financial Investigations and Border Crimes Task Force conducted the criminal investigation. The investigation occurred in parallel with OCC’s regulatory investigation and the investigation by FinCEN’s Enforcement Division. OCC officials told us they collaborated extensively with other agencies over a 4-year period, participated in numerous calls and meetings, and provided law enforcement with examination information and access to OCC examiners for interviews. Officials from the U.S. Attorney’s Office of the Southern District of California said that a practice they found helpful in this case was establishing a liaison with the agencies involved. The liaisons allowed the different parties to share information effectively, provided access to data as needed, and responded to questions in a timely manner. U.S. Bancorp. On February 15, 2018, DOJ, OCC, and FinCEN announced actions against U.S Bancorp and its subsidiary U.S. Bank, N.A., for violations of several provisions of BSA, including an inadequate BSA/AML program and failure to file suspicious activity reports (SAR) and currency transaction reports (CTR). Under a deferred prosecution agreement with the U.S. Attorney’s Office of the Southern District of New York, U.S Bancorp and its subsidiary agreed to pay $528 million for BSA violations and agreed to continue to reform its AML program. Of the $528 million, $75 million was satisfied by a penalty paid to the Department of the Treasury as part of OCC’s civil money penalty assessment, which cited the bank in a 2015 consent order for failure to adopt and implement a program that covered required BSA/AML program elements. FinCEN also reached an agreement with U.S. Bank to resolve related regulatory actions, which required U.S. Bank to pay an additional $70 million for civil violations of the BSA. On the same day as the FinCEN agreement, the Board of Governors of the Federal Reserve System (Federal Reserve) imposed a $15 million penalty against U.S. Bancorp for deficiencies (including BSA violations) related to the bank under its supervision. According to officials from the U.S. Attorney’s Office of the Southern District of New York, their office, OCC, FinCEN and the Federal Reserve coordinated the terms of their respective resolutions to avoid the unnecessary imposition of duplicative penalties. OCC officials told us that the U.S. Attorney’s Office of the Southern District of New York contacted them to obtain additional information about its examination conclusions that supported OCC’s 2015 cease and desist order. OCC provided examination documents and information to the U.S. Attorney’s Office of the Southern District of New York for 2 years, including making OCC examiners available for interviews with the U.S. Attorney’s Office personnel and to answer follow-up inquiries. Federal Reserve officials said they coordinated in the U.S. Bancorp case through a global resolution with the firm. Banamex. In May 2017, Banamex admitted to criminal violations and entered into a non-prosecution agreement, which included an agreement to forfeit $97.44 million. The bank also admitted that it should have improved its monitoring of money services businesses’ remittances, but failed to do so. The investigation was conducted by the Bank Integrity Unit of DOJ’s Money Laundering and Asset Recovery Section, U.S. Attorney’s Office of the District of Massachusetts, IRS-CI, Drug Enforcement Administration, and the Federal Deposit Insurance Corporation’s (FDIC) Office of Inspector General. The agencies consulted on a general level, but the agencies’ investigations were at all times kept separate from the criminal investigation. In July 2015, FDIC and the California Department of Business Oversight assessed civil money penalties against Banamex requiring a total payment of $140 million to resolve separate BSA regulatory investigations. In February 2017, FDIC also announced enforcement actions against four former senior bank executives relating to BSA violations. IRS-CI officials stated that involvement by the Bank Integrity Unit of DOJ’s Money Laundering and Asset Recovery Section in financial institution investigations is extremely helpful as the unit bring a wealth of knowledge and resources. DOJ officials told us there was close collaboration between all agencies involved. DOJ officials said that all agencies had meetings frequently and created a liaison position to encourage interagency collaboration as the case progressed. In May 2018, DOJ issued a new policy to encourage coordination among DOJ and supervisory agencies during corporate investigations. In a May 2018 speech, the DOJ Deputy Attorney General identified the Securities and Exchange Commission, Commodity Futures Trading Commission, Federal Reserve, FDIC, OCC, and the Department of the Treasury’s Office of Foreign Assets Control as agencies with which DOJ works to be better able to detect sophisticated financial fraud schemes and deploy adequate penalties and remedies to ensure market integrity. He noted that many federal, state, local, and foreign authorities that work with DOJ were interested in further coordination with DOJ. DOJ’s new policy encourages coordination and consideration of the amount of fines, penalties, or forfeiture paid among DOJ components and other law enforcement or other federal, state, local, or foreign enforcement authorities seeking to resolve a case with a company for the same misconduct. Similarly, in June 2018, the Federal Reserve, FDIC, and OCC issued a joint statement on coordination among federal banking agencies during formal enforcement actions. In addition to the contact named above, Allison Abrams (Assistant Director), Verginie Tarpinian (Analyst in Charge), Peter Beck, Joseph Cruz, Brian James, Moira Lenox, Benjamin Licht, Robert Lowthian, Marc Molino, Ifunanya Nwokedi, Barbara Roesmann, Tyler Spunaugle, Farrah Stone, and Sarah Veale made key contributions to this report.
Illicit finance activity, such as terrorist financing and money laundering, can pose threats to national security and the integrity of the U.S. financial system. FinCEN is responsible for administering BSA and has delegated examination responsibility to supervisory agencies. FinCEN also is to collect and disseminate BSA data. BSA requires that financial institutions submit reports, which may be used to assist law enforcement investigations. Industry perspectives on BSA reporting have included questions about its usefulness. This report examines, among other objectives, how FinCEN and supervisory and law enforcement agencies (1) collaborate and (2) provide metrics and feedback on the usefulness of BSA reporting. GAO reviewed related laws and regulations; agency documentation; examination and enforcement action data; and interviewed FinCEN, supervisory agencies, and a nongeneralizable selection of six law enforcement agencies and seven industry associations. The Financial Crimes Enforcement Network (FinCEN)—within the Department of Treasury—supervisory agencies (such as banking, securities, and futures regulators), and law enforcement agencies collaborate on implementing Bank Secrecy Act/anti-money laundering (BSA/AML) regulations, primarily through cross-agency working groups, data-sharing agreements, and liaison positions. FinCEN and law enforcement agencies provided some metrics and institution-specific feedback on the usefulness of BSA reporting (such as suspicious activity reports) to the financial industry but not regularly or broadly. FinCEN and some agencies have metrics on the usefulness of BSA reports. One law enforcement agency annually publishes aggregate metrics on BSA reports that led to investigations and indictments. But FinCEN did not consistently communicate available metrics; it generally did so on an ad-hoc basis such as through published speeches. In 2019, FinCEN began a study to identify measures on the value and usefulness of BSA reporting—to be completed by the end of 2019. By consistently communicating currently available metrics (summary data), and any later identified by the study, FinCEN may assist financial institutions in more fully understanding the importance of their efforts. Industry associations GAO interviewed noted financial institutions would like to receive more institution-specific feedback on the usefulness of their BSA reporting; they also identified suspicious activity reports as labor-intensive. In 2017, FinCEN began providing such feedback and some law enforcement agencies have ongoing efforts to provide institution-specific briefings. But these efforts have not been regularly made and involved relatively few institutions. Additional and more regular feedback, designed to cover different types of financial institutions and those with significant financial activity, may enhance the ability of the U.S. financial industry to effectively target efforts to identify suspicious activity and provide quality BSA reporting. GAO makes four recommendations, including that FinCEN review options to consistently communicate summary data and regularly provide institution-specific feedback on its BSA reporting. FinCEN concurred with the recommendation on summary data and agreed with the spirit of the recommendation on feedback. FinCEN raised concerns with the need for the two other recommendations. GAO continues to believe the recommendations have merit, as discussed in the report.