For example, in 2005 over 16 million BSA  reports were filed by financial institutions. FinCEN and IRS Have Distinct Roles in Implementing BSA, but Share Some Responsibilities

FinCEN’s role is to oversee administration of BSA government wide. However, FinCEN also relies on other  agencies in implementing the BSA framework, including (1) ensuring  compliance with BSA requirements to report certain financial  transactions, (2) conducting investigations of criminal financial activity,  and (3) collecting and storing the reported information IRS is involved in  all three of these areas. FinCEN and IRS Continue to Face Challenges in Identifying the Population of NBFIs Subject to BSA Requirements

Several efforts have been made to estimate the NBFI population, but all of  these estimates have weaknesses. However, IRS and other knowledgeable  observers agree that IRS has only identified a portion of the population. IRS has  identified 107,000 potential NBFIs, but has not been able to determine how  many of these businesses are subject to BSA. IRS Is Developing a Statistically Valid Risk- Based Approach to Selecting Businesses for Compliance Examinations, but Limitations Will Continue to Exist

IRS does not have a statistically valid risk-based approach for targeting  NBFIs for BSA compliance examinations, but it is working on developing  such an approach for a segment of MSBs. A risk-based approach is  important for selecting NBFIs for compliance examinations because IRS  only has resources to examine a small fraction of NBFIs each year. For  example, in 2005, IRS completed 3,712 examinations— 3.5 percent of the  107,246 potential NBFIs in its database. IRS’s research project is a step in the right direction. IRS’s research study was not designed to be representative of all the  potential MSBs identified by IRS. Identifying unknown NBFIs is inherently challenging and gradual—no  easy solution exists for addressing this problem. FinCEN and IRS Lack a Documented and Coordinated Strategy for Improving NBFI Compliance with BSA Requirements

FinCEN and IRS have taken a number of steps to improve efforts to ensure  that NBFIs comply with BSA, but they lack a documented and coordinated  strategy for moving forward. Missed Opportunities for Effective Planning and Poor Project Management and Oversight Have Hampered FinCEN’s Efforts to Reengineer BSA Data Management Activities

In 2003 FinCEN began an effort to reengineer BSA data management  activities However, the cornerstone of FinCEN’s reengineering effort, BSA  Direct R&S, was permanently halted because of a multitude of problems. The Commissioner of Internal Revenue should direct the Office of  Fraud/BSA to    build upon the study to validate compliance risk factors by developing a  plan to assess the noncompliance risks posed by all NBFIs;    establish time frames for finalizing and publishing the Internal Revenue  Manual with updated BSA compliance program policies and procedures;    develop a NBFI compliance examiner’s manual that examiners can use to  guide examinations and businesses can use to ensure they are in  compliance with BSA requirements, and establish time frames for its  publication;    create a more functional and secure mechanism for storing and accessing  the information contained in the Title 31 database; and    use the results of the forthcoming risk factor validation study to estimate  the compliance rate for the population of MSBs from which the study  sample was drawn. This plan, at a minimum, should  take a broad and crosscutting approach to the reengineering effort, and  not focus solely on one component, such as BSA Direct;  include short- and intermediate-term goals for reengineering BSA data  management processes, including the transition of IRS’s data management  responsibilities to FinCEN; and  incorporate collaboration strategies into the plan by clearly defining the  role of IRS’s ECC-DET in the transition process and more actively  involving it as a key stakeholder in the reengineering effort. Appendix I: Objectives, Scope, and Methodology

To describe the Internal Revenue Service’s (IRS) and the Financial Crimes  Enforcement Network’s (FinCEN) Bank Secrecy Act (BSA) related roles  and responsibilities, we reviewed and summarized relevant legislative and  regulatory authorities.
Why GAO Did This Study

In 2005, over 16 million Bank Secrecy Act (BSA) reports were filed by more than 200,000 U.S. financial institutions. Enacted in 1970, BSA is the centerpiece of the nation's efforts to detect and deter criminal financial activities. Treasury's Financial Crimes Enforcement Network (FinCEN) and the Internal Revenue Service (IRS) play key roles in BSA compliance, enforcement, and data management. GAO was asked to describe FinCEN's and IRS's roles and assess their effectiveness at ensuring BSA compliance and efforts to reengineer BSA data management.

What GAO Found

FinCEN and IRS have distinct roles, but share some responsibilities in implementing BSA. FinCEN's role is to oversee the administration of BSA by numerous agencies including IRS. IRS's role is to (1) examine nonbank financial institutions (NBFI), such as money transmitters and check cashers, for compliance with BSA; (2) investigate potential criminal BSA violations; and (3) collect and store BSA reported data by all financial institutions. IRS continues to face challenges in identifying NBFIs subject to BSA and then using its limited resources to ensure compliance. First, IRS has identified approximately 107,000 potential NBFIs, yet FinCEN, IRS, and others agree there is a portion of the NBFI population IRS has not identified. Identifying NBFIs is inherently challenging and made even more difficult because FinCEN regulations about who is covered are confusing, especially for smaller businesses. Second, IRS currently lacks, but is working to develop, a statistically valid risk-based approach for selecting NBFIs for compliance examinations. IRS only examines a small fraction of NBFIs, less than 3.5 percent in 2005, highlighting the need for building risk into the selection process. IRS is statistically validating a risk-based approach for targeting compliance examinations on certain NBFIs suspected of noncompliance. IRS's validation study is a step in the right direction, but IRS's approach will continue to have limitations because the study was not designed to be representative of all potential NBFIs. And lastly, IRS established a new office accountable for BSA compliance, and is working to improve examination guidance. However, IRS's management of BSA compliance has limitations, such as a lack of a compliance rate measure and a comprehensive manual that NBFIs can use to develop anti-money laundering programs compliant with BSA. Addressing program challenges, such as identifying NBFIs and examining those of greatest risk of noncompliance will take time and require prioritizing actions and identifying resource needs. However, FinCEN and IRS lack a documented and coordinated strategy with time frames, priorities, and resource needs for improving NBFI compliance with BSA requirements. FinCEN has undertaken a broad and long-term effort to reengineer, and transition from the IRS, all BSA data management activities. FinCEN, however, missed opportunities to effectively plan this effort and to coordinate its implementation with IRS. For example, FinCEN began making significant investments in information technology projects before a comprehensive plan to guide the reengineering effort was in place. When a key project--BSA Direct Retrieval and Sharing--failed, it jeopardized the future of the broader reengineering effort. After investing over $14 million (nearly $6 million over the original budget) in a failed project, FinCEN is now reassessing BSA Direct but does not yet have a plan for moving forward with the broader effort to reengineer BSA data management activities.