Following the September 11 terrorist attacks, Congress passed the USA  PATRIOT Act, which was enacted on October 26, 2001. In addition to requiring  regulations for information sharing and customer identification programs,  Title III of the PATRIOT Act expands Treasury’s authority to regulate the  activities of U.S. financial institutions and requires a wide variety of types  of financial institutions to maintain anti-money laundering programs. Key challenges related to implementing section 326 included  developing regulations that could be applied consistently across a financial  industry that has diverse business models, customer relationships, and  financial products. Figure 2 illustrates requirements for  identification and verification procedures. Treasury and the Federal Financial Regulators Have Reached Out to the Financial Industry to Assist It in Implementing CIP and Section 314 Rules, but Industry Concerns Remain

Treasury and the federal financial regulators have taken several steps to  help the financial industry understand and comply with the CIP and 314  information sharing regulations; however, the need for agency coordination  has slowed the issuance of additional guidance. Industry Officials Expressed Some Confusion about Types of Suspicious Activity That Can Be Shared under Section 314(b)

Although industry officials said section 314(b) is a helpful tool and has  enabled them to share information in a new way, some officials said it is  not always easy to determine if the suspicious activity is money laundering  or terrorist activity or other financial crimes. Examinations and Enforcement Actions Highlight Progress and Difficulties in Overseeing Compliance with the CIP Requirement and Section 314

The federal financial regulators and SROs responsible for examining  financial institutions’ compliance with anti-money laundering laws and  regulations have conducted examinations that cover compliance with, and  have taken enforcement actions concerning, violations of both the CIP  requirement and section 314 and its corresponding regulations, but  coverage of these requirements varied in the examinations we reviewed. When we reviewed the examinations for coverage of the CIP requirement,  we specifically looked for documentation that the examiner assessed  whether (1) the financial institution had developed a CIP and written  procedures for CIP; (2) the CIP procedures included collecting appropriate  customer information including the minimum requirements, such as date of  birth for individuals; (3) the CIP procedures included verifying customer  information using documentary or nondocumentary methods; (4) the  financial institution was using risk-based procedures for verification, such  as determining how much information to verify depending on its  assessment of the risk of the customer or type of account or collecting  additional information; and (5) the CIP had been adequately implemented  by testing a sample of accounts. The Results of Our Examination Review Highlighted Some Difficulties in Understanding CIP Requirements

Our review of some of the examinations in the sample revealed that  examiners and financial institutions may not always understand the  requirements for CIP or interpret them in the same way. NYSE examinations did not always cover  section 314(a) procedures, in part, because NYSE examination procedures  were not clear about how examiners should review section 314(a)  procedures. The sharing of information with other financial  institutions pursuant to section 314(b) is voluntary. Law Enforcement Officials Believe That the Section 314(a) Process Has Improved Coordination with Financial Institutions and Has Led to More Efficient Investigations

Officials from the Department of Justice and other law enforcement  agencies told us that the 314(a) process has improved coordination  between law enforcement agencies and financial institutions and has  increased the speed and efficiency of investigations. FinCEN also reported that 314(a) feedback from  law enforcement requesters has been overwhelmingly positive. One  prosecutor told us that the 314(a) process had been used 3 or 4 times  during investigations of terrorist financing or money laundering cases. To determine the extent to which the federal financial regulators and SROs  have updated examination guidance and trained examiners on CIP and  section 314, we reviewed copies of draft and final versions of guidance;  collected information on examiner training courses related to anti-money  laundering and the number of examiners trained in 2002, 2003, and 2004;  and interviewed officials on their examination guidance and training  programs.
Why GAO Did This Study

Title III of the USA PATRIOT Act of 2001, passed after the September 11 terrorist attacks, amended U.S. anti-money laundering laws and imposed new requirements on financial institutions. Section 326 of the act required the development of minimum standards for verifying the identity of financial institution customers. Section 314 required the development of regulations encouraging the further sharing of information between law enforcement agencies and the financial industry and between the institutions themselves. Because of concerns about the implementation of these new provisions, GAO determined how (1) the government developed the regulations, educated the financial industry on them, and challenges it encountered; (2) regulators have updated guidance, trained examiners, and examined firms for compliance; and (3) the new regulations have affected law enforcement investigations.

What GAO Found

Treasury (including its Financial Crimes Enforcement Network (FinCEN)), the federal financial regulators, and self-regulatory organizations (SRO) overcame challenges to create regulations that apply consistently to a diverse financial sector and have used several outreach mechanisms to help the financial industry understand and comply with Customer Identification Program (CIP) requirements under section 326 and information sharing requirements under section 314. However, several implementation challenges remain. Industry officials told us some of their concerns have been addressed but they are still concerned about (1) how some CIP requirements will be interpreted during compliance examinations, (2) the lack of feedback from law enforcement on information provided by financial institutions through section 314(a), and (3) the extent to which they can share information with each other under section 314(b). The six federal financial regulators and five SROs in our review have issued examination guidance covering sections 326 and 314, subsequently trained examiners, and begun examining financial institutions for compliance with CIP and section 314. GAO's review of examinations showed progress, but coverage varied in part because the examinations were conducted during early implementation. One aspect of CIP that was not always covered in examinations was whether financial institutions had adequately developed a CIP appropriate for their business lines and types of customers. However, this aspect of CIP is critical for ensuring that the identification and verification procedures are appropriate for types of customers and accounts that are at higher risk of being linked to money laundering or terrorist activities. Some examinations also revealed implementation difficulties related to CIP that could lead to inconsistencies in the way examiners conduct examinations. For example, some examiners did not differentiate between the CIP requirement and other procedures that require customer identification information. Coverage in the examinations GAO reviewed of how institutions had implemented section 314 requirements was somewhat lower than for CIP, in part, because CIP received more attention from examiners and information sharing between financial institutions is voluntary. In the examinations GAO reviewed, apparent violations of the CIP requirement and section 314(a) regulations were mostly addressed through informal actions between the institution and the regulator. Officials from the Department of Justice and other law enforcement agencies told us that CIP and section 314 have assisted them in the investigation of money laundering and terrorist financing cases. Some officials said that CIP has been useful because financial institutions have more information on their customers so they obtain more useful information when issuing grand jury subpoenas and other requests for information. Many officials said the 314(a) process had improved coordination between the law enforcement community and the financial industry and increased the speed and efficiency of investigations.