Loading…

Enforcing AML Laws: Significant Potential for Money Laundering? Or Potential for Significant Money Laundering?

On August 13 the federal banking agencies issued a joint statement on updates to their guidance on enforcing BSA/AML requirements. See https://www.fdic.gov/news/press-releases/2020/pr20091a.pdf. There is some new language that may be relevant for most financial institutions.

The FDIC and OCC press releases provided that the joint statement is:

… updating their existing enforcement guidance to enhance transparency regarding how they evaluate enforcement actions that are required by statute when financial institutions fail to meet Bank Secrecy Act/anti-money laundering (BSA/AML) obligations. The statement clarifies that isolated or technical violations or deficiencies are generally not considered the kinds of problems that would result in an enforcement action. The statement also addresses how the agencies evaluate violations of individual components (known as pillars) of the BSA/AML compliance program. It also describes how the agencies incorporate the customer due diligence regulations and recordkeeping requirements issued by the U.S. Department of the Treasury as part of the internal controls pillar of the financial institution’s BSA/AML compliance program. The statement, issued by the Board of Governors of the Federal Reserve System, the Federal Deposit Insurance Corporation, the National Credit Union Administration, and the Office of the Comptroller of the Currency, updates and supersedes the Interagency Statement on Enforcement of BSA/AML Requirements issued on July 19, 2007, to promote a consistent approach to the application of Section 8(s) of the Federal Deposit Insurance Act and Section 206(q) of the Federal Credit Union Act. The Financial Crimes Enforcement Network simultaneously issued a “Statement on Enforcement of the Bank Secrecy Act” that sets forth its approach to enforcement in circumstances of non-compliance with the BSA.

In fact, FinCEN didn’t issue its statement until August 18th. The FinCEN press release provides:

As the primary regulator and administrator of the Bank Secrecy Act (BSA), the Financial Crimes Enforcement Network (FinCEN) today issued a statement that sets forth its approach to enforcing the rules and regulations within the BSA. Through this statement, FinCEN aims to provide clarity and transparency to its approach when contemplating compliance or enforcement actions against covered financial institutions that violate the BSA.  Today’s statement outlines the administrative actions available to FinCEN, and provides an overview of the information FinCEN analyzes in order to determine the appropriate outcome to violations of the BSA.  FinCEN also encourages financial institutions to voluntarily and promptly report violations, and to candidly and completely cooperate with any investigation. “FinCEN is committed to being transparent about its approach to BSA enforcement.  It is not a ‘gotcha’ game,” said FinCEN Director Kenneth A. Blanco.  “The information required by the BSA saves lives, and protects our communities and people from harm.  It is a national security issue.” The statement describes FinCEN’s enforcement authorities, dispositions, and the factors it evaluates in determining the appropriate response and enforcement of BSA violations.

FinCEN’s statement is very different than the prudential regulators’ statement. FinCEN sets out the six possible actions it can take – from no action, to a civil money penalty, to referring a matter for criminal prosecution – and the ten factors it will take into consideration when assessing possible violations. The key factors are:

  1. Nature and seriousness of the violations;
  2. Pervasiveness of wrongdoing within an entity, including management’s complicity in, condoning or enabling of, or knowledge of the conduct underlying the violations;
  3. History of similar violations, or misconduct in general, including prior criminal, civil, and regulatory enforcement actions;
  4. Presence or absence of prompt, effective action to terminate the violations upon discovery, including self-initiated remedial measures;
  5. Timely and voluntary disclosure of the violations to FinCEN;
  6. Quality and extent of cooperation with FinCEN and other relevant agencies, including as to potential wrongdoing by its directors, officers, employees, agents, and counterparties.

Number 6 is important: FinCEN expects that institutions’ cooperation includes identifying potential individual wrongdoers. This is consistent with federal criminal prosecution. The Department of Justice Manual includes a lengthy section on the criminal prosecution of companies, and that (i) prosecutors should first consider the criminal liability of those involved in or responsible for the criminal activity of the company; and (ii) a company cannot get “cooperation credit” without providing to the DOJ the names and particulars of all those employees (or directors) involved in or responsible for the conduct in question. So here, FinCEN is letting financial institutions know that for those institutions to get cooperation credit they need to provide the names and particulars of the people involved in the regulatory violations.

But back to the prudential regulators’ updated and clarified guidance.

First, the prudential regulators did not include anything about the liability of directors, officers, or employees in their joint statement. They could have, as the statutory provision the agencies rely on – section 8(s) of the FDI Act, codified at 12 USC s. 1818(s) – allows for cease and desist orders, and civil money penalties, against institutions and against institution-affiliated parties.

Second, although the interagency statement indicated that it “updates and supersedes the Interagency Statement on Enforcement of BSA/AML Requirements issued on July 19, 2007”, it did not indicate that the 2007 statement has been part of the FFIEC BSA/AML Exam Manual since 2007. It is the current Appendix R in the 2014 edition of the Exam Manual.

Since the agencies indicated that the August 2020 statement updates and supersedes the 2007 statement, which is set out in Appendix R, I compared the August 2020 joint statement with Appendix R to see what differences there were (it’s pretty common for the agencies to publish a new statement or rule that is purported to simply update or clarify an existing statement or rule, when in fact there are substantive changes). There were many small changes in wording, and the 2020 joint statement incorporates the new customer due diligence and beneficial ownership rules that were issued in May 2016. The 2020 joint statement included two new examples of when a mandatory cease and desist order would issue: both of those are particularly relevant to financial institutions.

The first addition relates to rapid foreign expansion. The second addition relates to a failure to resolve issues relating to customer risk rating. What is important is that these are additions to the existing language, which means they are key or at least current concerns of the regulators.

Rapid Foreign Expansion

“An institution would also be subject to a cease and desist order if the institution fails to implement a BSA/AML compliance program that adequately covers the required program components or pillars. For example, an institution rapidly expands its business relationships through its foreign affiliates and businesses:

  • without identifying its money laundering and other illicit financial transaction risks;
  • without an appropriate system of internal controls to verify customers’ identities, conduct customer due diligence, or monitor for suspicious activity related to its products and services;
  • without providing sufficient authority, resources, or staffing to its designated BSA officer to properly oversee its BSA/AML compliance program;
  • with deficiencies in independent testing that caused it to fail to identify problems; and
  • with inadequate training exemplified by relevant personnel not understanding their BSA/AML responsibilities.

Although these bullets are framed as failures (in the negative), they can be turned around and framed positively to provide a roadmap or checklist for an institution’s foreign expansion plans:

“For BANK NAME to continue to expand its business relationships through its foreign affiliates and businesses, it must implement a BSA/AML compliance program that adequately covers the required program components or pillars, including:

  • identifying its money laundering and other illicit financial transaction risks;
  • implementing an appropriate system of internal controls to verify customers’ identities, conduct customer due diligence; and monitor for suspicious activity related to the products and services;
  • providing sufficient authority, resources, and staffing to its designated BSA officer to properly oversee BANK NAME’s in-country and in-region BSA/AML compliance programs;
  • independent testing; and
  • adequate training exemplified by relevant personnel understanding their BSA/AML responsibilities.”

Failure to Resolve Issues Relating to Customer Risk Profiles

The joint statement provides:

“An Agency will ordinarily not issue a cease and desist order under sections 8(s) or 206(q) for failure to correct a BSA/AML compliance program problem unless the problems subsequently found by the Agency are substantially the same as those previously reported to the institution. For example, during a previous examination, an institution’s system of internal controls was considered inadequate as a result of substantive deficiencies related to customer due diligence and suspicious activity monitoring processes. Specifically, the institution had not developed customer risk profiles to identify, monitor, and report suspicious activities related to the institution’s higher-risk businesses lines. These substantive deficiencies were identified in the previous report of examination as a problem requiring board attention and management’s correction. The subsequent report of examination determined that management had not addressed the previously reported problem with the institution’s BSA/AML compliance program. Customer risk profiles remained undeveloped to identify, monitor, and report suspicious activity related to the institution’s higher-risk business lines. As a result, the institution would be subject to a cease and desist order for failure to correct a previously reported problem with its BSA/AML compliance program.”

This is important language for any financial institution: a financial institution’s end-to-end high risk customer management program must address the importance of having “customer risk profiles to identify, monitor, and report suspicious activities related to the institution’s higher-risk businesses lines”.

Other Changes

There was some curious language, or changes in language, in the section on when a mandatory C&D will issue. Note that this August 2020 Joint Statement was signed by the top lawyers at each of the regulatory agencies: lawyers choose their words very carefully, and any changes in wording are deliberate and thought out.

A mandatory cease and desist order will be issued in three situations: (1) where the institution fails to have a written program that adequately covers the pillars; (2) where the institution fails to implement that program; or (3) there are defects in one or more pillars of the program and those deficiencies are coupled with other aggravating factors (and both the 2020 joint statement and 2014 appendix R have four aggravating factors). The first aggravating factor was about suspicious activity creating a potential for money laundering or terrorist financing:

2014 Appendix R – “highly suspicious activity creating a significant potential for unreported money laundering or terrorist financing …”.

2020 Joint Statement – “highly suspicious activity creating a potential for significant money laundering, terrorist financing, or other illicit financial transactions …”.

Two points.

First, the modifier “highly” suggests that the regulators aren’t concerned about run-of-the-mill cases and SARs (or failure to open cases or file SARs) on low-end, low-dollar activity.

Second is the shift in what I’ll call the “likelihood and severity” of the activity. The old standard was a low likelihood but high severity: “a potential for significant money laundering”, while the new standard is a high likelihood but low severity: “significant potential for unreported money laundering”. It is unlikely that this difference in language will create a different regulatory experience and outcome, either for any one institution or all institutions, but it is interesting nonetheless, and seems to support the agencies’ statement “that isolated or technical violations or deficiencies are generally not considered the kinds of problems that would result in an enforcement action.”

Summary & Conclusion

No substantive or immediate changes are needed to most institution’s program. All institutions must remain vigilant around foreign expansion, and ensure AML/CFT controls “keep pace” with any foreign expansion. “Expansion” includes new products and services in existing jurisdictions, not just expansion into new jurisdictions. Also, don’t forget that in order to get cooperation credit from FinCEN or the Department of Justice, an institution will need to provide authorities with the names and particulars of all persons involved in or responsible for the impugned conduct. And that includes MLROs and BSA Officers.

A GAO Report on GTOs Reveals the Underlying Flaws In the Entire American BSA/AML Regime

The General Accountability Office, or GAO, issued a Report on August 14, 2020 titled “FinCEN Should Enhance Procedures for Implementing and Evaluating Geographic Targeting Orders”.[1] The Geographic Targeting Orders, or GTOs, subject to this report are a series of nine GTOs issued since 2016 targeting all-cash (or non-financed) purchases of residential real estate in certain areas of the country over a certain amount.

Most people will read this report for what it is – a full-fledged year-long, not-very-positive audit of FinCEN’s management of the real estate Geographic Targeting Order program. But the GTO program, and FinCEN’s management of it (which, by the way, I don’t think FinCEN got enough credit from the GAO for taking the initiative in the first place), are lesser issues than a single observation the GAO reported more than half way through (on page 22) the Report:

“Officials from five federal law enforcement agencies told us that their agencies do not systematically track the specific types of BSA reports used in investigations …”.

The GAO didn’t indicate which five federal law enforcement agencies these were, but the agencies interviewed for the Report were the DEA, FBI, ICE-HSI, IRS-CI, the DOJ’s Criminal Division, the US Attorneys Offices for the Southern District of New York and Southern District of Florida, FinCEN, and two task forces (OCDETF and El Dorado). So it’s likely that at least four of the five agencies that do not systematically track which Bank Secrecy Act or BSA reports are used in investigations are the “big four” of AML/CFT: the FBI, DEA, Homeland Security, and IRS.

Why is this important?

The entire purpose of the BSA regime is for the private sector to provide timely, actionable intelligence to law enforcement in order to protect the financial system, and society at large, from underlying criminal and terrorist activity. In the “Background” section of the Report, on page 5, the GAO explained the purpose behind the BSA:

“The BSA authorizes the Secretary of the Treasury to issue regulations requiring financial institutions to keep records and file reports the Secretary determines ‘have a high degree of usefulness in criminal, tax, or regulatory investigations or proceedings, or in the conduct of intelligence or counterintelligence activities, including analysis, to protect against international terrorism.’ The Secretary also is authorized to impose AML program requirements on certain financial institutions. The authority of the Secretary to administer the BSA has been delegated to the Director of FinCEN.” [citations omitted][2]

Approximately 20 million BSA reports are filed by tens of thousands of private sector financial institutions every year: the most common are Currency Transaction Reports or CTRs (roughly 16 million) and Suspicious Activity Reports, or SARs (roughly 2.7 million). Those institutions are spending billions of dollars in running BSA programs intended to allow them to prepare and file those 20 million reports, and they face regulatory and even criminal sanctions for failing to maintain an adequate program or failing to detect and report suspicious activity or large currency transactions. And yet the primary users of those reports, the federal law enforcement agencies, “do not systematically track the specific types of BSA reports used in investigations …”.

It is time that the public sector consumers of BSA reports – primarily law enforcement agencies – provide feedback to the private sector producers of BSA reports – tens of thousands of financial institutions – on exactly which reports “have a high degree of usefulness in criminal, tax, or regulatory investigations or proceedings, or in the conduct of intelligence or counterintelligence activities, including analysis, to protect against international terrorism”. It’s not enough for the private sector to know anecdotally that the reports it is filing are generally useful to law enforcement. In this age of machine learning and artificial intelligence, financial institutions are using these tools to teach and train their monitoring, surveillance, and alerting systems that churn through millions or billions of customer, account, and transaction data, in an effort to be more effective and efficient. And all of those machine learning and artificial intelligence efforts are for naught if the private sector doesn’t have the training data needed to identify those reports that are providing tactical and/or strategic value. Training a surveillance and alerting system against the SARs that are filed is a fool’s errand if you don’t know whether that SAR has ever been looked at by law enforcement, whether it was useful, whether it provided tactical or strategic value.

Lack of Law Enforcement Feedback Is One of the Two Main Flaws in the US BSA/AML Regime: the Other is the Lack of Corporate Transparency

The United States does not have an effective beneficial ownership regime. Even the Treasury Secretary calls this a “glaring hole in our system”, and I have written about this on a number of occasions. See, for example, https://regtechconsulting.net/beneficial-ownership-customer-due-diligence/lack-of-beneficial-ownership-information-a-glaring-hole-in-our-system-says-treasury-secretary/. And this GAO Report includes a section on the lack of a true beneficial ownership regime (notwithstanding FinCEN’s 2016 rule on customer due diligence and beneficial ownership), and how a FATF-compliant beneficial ownership regime would enhance the US AML/CFT regime and be complimentary to the real estate GTO.

The other flaw, as described in this article, is lack of law enforcement feedback. I have been writing about this flaw in our system for years. See my article from November 2019 https://regtechconsulting.net/fintech-financial-crimes-and-risk-management/like-sam-loves-free-fried-chicken-law-enforcement-loves-free-suspicious-activity-reports-but-what-if-law-enforcement-had-to-earn-the-right-to-use-the-private-sector/ and my article from July 2020 https://regtechconsulting.net/aml-regulations-and-enforcement-actions/anti-money-laundering-act-of-2020-pay-to-play-arrives-and-perhaps-we-have-an-answer-to-the-whereabouts-of-section-314d/. Both of these articles reference other articles I’ve written on this subject. The July 2020 article offers some solutions.

This is not a criticism of law enforcement or the intelligence community. They simply haven’t had the means to provide feedback to the private sector. Bills, or provisions in bills, currently before Congress aim to address this issue and provide the means for the public sector to begin the process of providing feedback to the private sector. If the purpose of the multi-billion dollar anti-money laundering regime is to compel the private sector to provide law enforcement and the intelligence agencies with timely, actionable reports of cross-border flows of cash, foreign bank accounts, suspicious activity, possible terrorist financing activity, and large cash transactions, then it is incumbent on law enforcement and the intelligence agencies to provide feedback on which of those reports have a high degree of usefulness in criminal, tax, or regulatory investigations or proceedings, or in the conduct of intelligence or counterintelligence activities, including analysis, to protect against international terrorism. Without that feedback, both the private and public sector, and society at large, will fail in their collective efforts to keep our financial system safe and secure. And for law enforcement and the intelligence community to get the means to provide that feedback, it is incumbent on Congress to act and pass the necessary legislation.

We all know what needs to be done to make the BSA/AML regime more effective and more efficient. Now Congress must act.

[1] See GAO-20-546 available at https://www.gao.gov/assets/710/708115.pdf

[2] The language “high degree of usefulness in criminal, tax, or regulatory investigations or proceedings, or in the conduct of intelligence or counterintelligence activities, including analysis, to protect against international terrorism” is pulled directly from the purpose statement of the main “BSA” statute, 31 USC section 5311.

What Does It Take to Run a BSA Program? Not Much, According to the FDIC

Unfortunately, the FDIC’s estimate of the time and effort it takes to run a BSA/AML compliance program is … laughable.

Let’s start with some background information.

FDIC-Supervised Banks

There are about 5,200 FDIC-insured banks in the United States. And the FDIC is the primary regulator for about 3,340 of these banks – those that are “state-chartered”.

The FDIC has placed those banks into three buckets, based on their size (as measured by total assets of the bank. Note that loans are always the biggest category of asset that banks have on their books, and the asset “loans” is generally offset by the liability of “deposits” … balance sheets of most banks aren’t that complicated).

  • Small Institutions – are those with assets of less than $500 million. About 75% of state-chartered and FDIC-supervised banks, or 2,523 banks, are in this category. FDIC data suggests that the average bank in this category has 40 to 50 employees.
  • Medium Institutions – are hose with assets between $500 million and $10 billion. About 23% of state-chartered and FDIC-supervised banks, or 774 banks, are in this category. FDIC data suggests that the average bank in this category has about 270 employees.
  • Large Institutions – are those with assets of more than $10 billion. Only about 2% of state-chartered and FDIC-supervised banks, or 47 banks, are in this category. FDIC data suggests that the average bank in this category has about 2,500 employees.

One other bench mark. A full-time employee, or FTE, has about 250 work days in a year (52 weeks, 5 days a week, less 10 statutory or legal holidays). Let’s also assume they take four weeks vacation – so we’re at about 230 days.  At 8 hours a day, that’s 1,840 hours. To keep the math simple, let’s use 1,800 hours as the bench mark for how many hours any one employee, or FTE, has available in a year.

Bank Secrecy Act (BSA) Program Requirements

All financial institutions in the United States – banks, credit unions, broker dealers, insurance companies, check cashers, and more – are required to have written BSA compliance programs. The requirements around these programs are so onerous that the regulatory agencies have published a manual that gives their examiners a roadmap on how to examine or supervise those institutions to ensure they do, in fact, have adequate programs. That manual, the FFIEC BSA/AML Examination Manual, is now over 420 pages long.

What are the program requirements? As the FDIC notes, the banks it supervises must “establish and maintain procedures designed to monitor and ensure their compliance with the requirements of the Bank Secrecy Act and the implementing regulations promulgated by the Department of Treasury at 31 CFR Chapter X. Respondents must also provide training for appropriate personnel.” The Manual gives some more detail. Banks must do a risk assessment to understand their customer, product and service, and geographical risks. That risk assessment must be updated as the bank’s profile changes over time. Banks must also have a Customer Identification Program, or CIP. Banks must have a written, board-approved program that includes, at a minimum, certain “pillars” – preventive and detective controls, a BSA compliance officer, independent testing or auditing of the program, and training. And those preventive and detective controls include the ability to monitor for, and alert on, unusual activity, and to investigate and report suspicious activity.

How Much Time Does it Take to Build and Maintain a BSA Compliance Program?

Let’s use a “Medium” institution as a benchmark. Those are the 774 FDIC-supervised institutions that have about 270 employees, on average. We’ll also assume that they have a full-time BSA Officer with a staff of four people. Those five people are responsible for writing policies and procedures and distributing those down to the business and operations people; for establishing customer onboarding requirements; for setting up and maintaining the transaction monitoring systems; for generating and dispositioning any alerts from those systems; for investigating and reporting possible suspicious activity; for designing and conducting training for the other 265 employees; for managing the audits and FDIC examinations of the program; and for doing the required reporting to senior management and the board.

Those five people can’t do everything themselves. They depend on front-line staff to onboard customers and handle the documentation of transactions. They depend on the audit group for the independent testing. The in-house law department is likely involved and providing legal and compliance-related advice. So let’s assume that there may be 20 or 30 other people that spend 20% of their time managing one or more aspects of the BSA/AML compliance program. That’s another 5 FTE. So we’re up to 10 FTE.

10 FTE is 18,400 hours of time. And let’s not forget training. Assume that everyone goes through 1 hour of training a year. Now we’re up to 18,670 hours of time. It’s probably safe to build in a 5% +/- cushion, in case these estimates are off a little bit. And it makes the math easier. It’s fair to say that …

A medium-size bank will spend 20,000 hours a year running its BSA/AML compliance program

What about small and large banks? If we simply extrapolate the 20,000 hours for the average medium-sized bank out to the average small and large bank, we’d get the following estimates:

Small Bank – 3,700 hours or 2 FTE to run a BSA/AML compliance program

Medium Bank – 20,000 hours or 10 FTE to run a BSA/AML compliance program

Large Bank – 185,000 hours or 100 FTE to run a BSA/AML compliance program

What does the FDIC have to say about that?

According to the FDIC, a bank will spend between 35 and 450 hours a year running its BSA/AML compliance program!

What?

On June 2, 2020, the FDIC published a request for comment in the Federal Register – https://www.govinfo.gov/content/pkg/FR-2020-06-02/pdf/2020-11855.pdf. The FDIC, as part of its obligations under the Paperwork Reduction Act of 1995 (PRA), invited the general public and other Federal agencies to comment on the renewal of the then-existing burden on FDIC-supervised banks to “establish and
maintain procedures designed to monitor and ensure their compliance with the requirements of the Bank Secrecy Act and the implementing regulations promulgated by the Department of Treasury at 31 CFR Chapter X” and to “provide training for appropriate
personnel.”

At that time, here’s what the FDIC estimated were the burdens for its supervised banks:

As can be seen here, the FDIC estimated that the burden on 75% of its supervised banks – the smallest banks – was 35 hours a year. That’s one person spending less than one week a year to run a BSA/AML compliance program – all the policies, procedures, customer onboarding, monitoring, investigating, reporting, auditing, and examining. And for the largest banks, where, if you believe my estimate that it takes the equivalent of about 185,000 people-hours to run a BSA/AML compliance program, the FDIC estimates that it takes about 0.2% of that time to actually run the program.

There’s a disconnect.

But, as the FDIC points out in its most recent Federal Register notice, which will be formally published tomorrow (August 7, 2020) but is available today (August 6th), it didn’t receive any comments from the private or public sector about its estimates of the burden of running a BSA/AML compliance program! See https://s3.amazonaws.com/public-inspection.federalregister.gov/2020-17330.pdf

But there is still an opportunity to comment. The FDIC is giving us another 30 days to submit comments. I encourage people to do so.

Anti-Money Laundering Act of 2020 – “Pay to Play” Arrives and Perhaps We Have An Answer to the Whereabouts of Section 314(d)

The Senate Banking Committee’s top Republican (Senator Crapo from Idaho) and top Democrat (Senator Brown from Ohio) have joined forces to draft the Anti-Money Laundering Act of 2020 as an amendment to the National Defense Authorization Act. It takes some of what the House passed in HR2513, the Corporate Transparency Act, and replicates most of what the Senate has been horse-trading on with the ILLICIT CASH Act (S2563), and adds a few other provisions: 214 pages of provisions.

If enacted, it would be the biggest revision to the U.S. AML/CFT regime since the USA PATRIOT Act of 2001. The main legislation for the AML/CFT regime is found in Title 31 of the US Code. 31 USC 5311 (the purpose of the BSA) and 5318 (the program and reporting requirements) will materially change, four new sections (5333-5336) will be added, two new BSAAG subcommittees will be created, and of course a FinCEN database of beneficial ownership information will be created to house some legal entity beneficial ownership information (more on that in another article).

Anti-Money Laundering Act of 2020

The proposed AML Act of 2020 would be tacked on to the back end – Division E – of the 2021 Defense Appropriations bill. So the titles for the Act begin at title 51 – actually the Roman numeral LI. There are five titles:

  • Title LI – Strengthening Treasury Financial Intelligence, Anti-Money Laundering [AML], and Countering the Financing of Terrorism [CFT] Programs
  • Title LII – Modernizing the AML and CFT Systems
  • Title LIII – Improving AML and CFT Communication, Oversight, and Processes
  • Title LIV – Establishing Beneficial Ownership Reporting Requirements
  • Title LV – Miscellaneous

Section 5201 – Annual Reporting Requirements

This article focuses solely on section 5201 of Title LII. Why? It includes my long-sought-after SAR feedback from law enforcement, while at the same time resurrects the long-forgotten section 314(d) of the USA PATRIOT Act.

In a nutshell, section 5201 is a “pay to play” requirement imposed on law enforcement and the intelligence community. At requires the Attorney General, on behalf of federal and state prosecutors and law enforcement agencies, to deliver an annual report and, once every five years a broader long-term trending report, to the Secretary of the Treasury, setting out statistics, metrics, and other information on the use of BSA reports. The annual report must include:

  1. The frequency with which the BSA reports contains actionable information that leads to, among other things, actions by law enforcement agencies such as grand jury subpoenas, and actions by intelligence, national security, and homeland security agencies;
  2. Calculations on the time between the BSA reporting and the use of the data by law enforcement or intelligence agencies;
  3. An analysis of the transactions associations with the BSA reports, including whether the accounts were held by legal entities or persons, and any trends or patterns in cross-border activity;
  4. The number of legal entities and persons identified by the BSA reports;
  5. The extent to which arrests, indictments, convictions, etc., were related to the reports; and
  6. Data on state and federal investigations that resulted from the reports.

The five-year report would focus on longer-term trends, patterns and threats: retrospective trends and emerging patterns and threats.

And what would the Secretary of the Treasury do with these reports? That is covered by subsection (d) of section 5201, which provides that the Secretary shall use these reports

  1. To help assess the usefulness of BSA reports;
  2. “to enhance feedback and communications with financial institutions and other entities subject to the requirements under the BSA, including by providing more detail in the reports published and distributed under section 314(d) of the USA PATRIOT Act (31 USC s. 5311 note);
  3. to assist FinCEN in considering revisions to the reporting requirements promulgated under section 314(d) of the USA PATRIOT Act (31 USC s. 5311 note).

The result? This July 2020 proposed AML legislation would require the public sector consumers of BSA reports to provide feedback to the private sector producers of those reports – essentially a “pay to play” requirement, and that feedback would be through the almost 20-year old provision of the USA PATRIOT Act, section 314(d).

I’ve written about both of these things.

On July 30, 2019 I published an article titled “SAR Feedback? What Ever Happened to Section 314(d)?” See https://regtechconsulting.net/aml-regulations-and-enforcement-actions/sar-feedback-what-ever-happened-to-section-314d/ I wrote:

Wouldn’t it be great if Treasury published a report, perhaps semi-annually, that contained a detailed analysis identifying patterns of suspicious activity and other investigative insights derived from suspicious activity reports (SARs) and investigations conducted by federal, state, and local law enforcement agencies (to the extent appropriate) and distributed that report to financial institutions that filed those SARs?

To get Treasury to do that, though, would probably require Congress to pass a law compelling it to do so.

Hold it. Congress did pass that law.  Almost 18 years ago. And, by all accounts, it’s still on the books. What happened to those semi-annual reports? When did they begin? If they began, when did they end?

Section 314(d) – Its Origins

What became 314(d) was introduced in the House version of what became the USA PATRIOT Act. The House version, the Financial Anti-Terrorism Act, was introduced on October 3, 2001. It was marked up by the House Financial Services Committee on October 11. The Senate version, originally titled the Uniting and Strengthening America Act, or USA Act, was introduced on October 4th and had sections 314(a) (public to private sector information sharing), 314(b) (cooperation among financial institutions, or private-to-private sector information sharing), and 314(c) (“rule of construction”). There was no 314(d) in that early version.

On October 17th, HR 3004, the Financial Anti-Terrorism Act, was passed by the House 412-1. Title II was “public-private cooperation”. Section 203 was:

“Reports to the Financial Services Industry on Suspicious Financial Activities – at least once each calendar quarter, the Secretary shall (1) publish a report containing a detailed analysis identifying patterns of suspicious activity and other investigative insights derived from suspicious activity reports and investigations conducted by federal, state, and local law enforcement agencies to the extent appropriate; and (2) distribute such report to financial institutions as defined in section 5312 of title 31, US code.”

The Senate and House versions were reconciled, and on October 23rd the House Congressional Record shows a consideration of what was then the USA PATRIOT Act. That version of the bill then included what had been section 203 and was now 314(d). It was the same, except instead of a quarterly report it was a semi-annual report (“at least once each calendar quarter” was changed to “at least semiannually”).

SAR Activity Review – Was That The Answer to 314(d)?

The ABA has written, and at least one former FinCEN employee has stated that the “SAR Activity Review – Trends, Tips, and Issues” was the response to 314(d). The SAR Activity Reviews were excellent resources. They contained sections on SAR statistics, national trends and analysis, law enforcement cases, tips on SAR form preparation and filing, issues and guidance, and an industry forum. The first SAR Activity Review noted that it was published under the auspices of the BSAAG, was to be published semi-annually in October and April, and was “the product of a continuing collaboration among the nation’s financial institutions, federal law enforcement, and regulatory agencies to provide meaningful information about the preparation, use, and utility of SARs.”  Although that certainly sounds like it is responsive to section 314(d), there is no reference to 314(d).

And the first SAR Activity Review was published more than a year before 314(d) was passed. Even the first SAR Activity Review published after the enactment of the USA PATRIOT Act and section 314(d) – the 4th issue published on July 31, 2002 – didn’t make any reference to 314(d). Beginning with the 6th issue of the SAR Activity Review, published in October 2003, the authors broke out the statistics from the “Trends, Tips & Issues” document and published a separate, and more detailed, “SAR Activity Review – By The Numbers”. The last SAR Activity Review (the 23rd) and the last “By The Numbers” (the 18th) were published on April 30, 2013. None of those forty-one publications referenced 314(d). After the SAR Activity Reviews stopped, FinCEN continued to publish “SAR Statistics”, and did so three times from June 2014 through March 2017.  For the last few years, FinCEN has maintained SAR Stats on its website – https://www.fincen.gov/reports/sar-stats  – that is updated on a monthly basis. Those statistics are useful, but cannot be thought of as “containing a detailed analysis identifying patterns of suspicious activity and other investigative insights derived from suspicious activity reports and investigations conducted by federal, state, and local law enforcement agencies to the extent appropriate”, quoting the 314(d) language.

Does Anyone Know What Happened to 314(d)?

I don’t have the answer to that question. Perhaps 314(d) is seen as satisfied by the accumulation of advisories, guidance, bulletins, etc., published by FinCEN and other Treasury bureaus and agencies and departments from time to time. Perhaps there is a Treasury Memorandum out there that I’m not aware of that provides a simple explanation. Perhaps not: most BSA/AML experts I speak with are not even aware of 314(d), and if the SAR Activity Review did satisfy the spirit and intent of 314(d), the last one was published more than six years ago. But everyone in the private sector BSA/AML risk management space has been clamoring for more feedback from law enforcement and FinCEN on the effectiveness and usefulness of their SAR filings. Perhaps a renewed (or any) focus on 314(d) is the answer.  The revival of 314(d) could give FinCEN the mandate they’ve been looking for to provide more valuable information to the private sector producers of Suspicious Activity Reports. We would all benefit.

Public Sector is Going to Have to Pay in Order to Play With the Private Sector’s BSA Reports

On November 21, 2019 I wrote an article titled “Like Sam Loves Free Fried Chicken, Law Enforcement Loves ‘Free’ Suspicious Activity Reports … But What If Law Enforcement Had to Earn the Right to Use the Private Sector’s ‘Free’ SARs?” See https://regtechconsulting.net/fintech-financial-crimes-and-risk-management/like-sam-loves-free-fried-chicken-law-enforcement-loves-free-suspicious-activity-reports-but-what-if-law-enforcement-had-to-earn-the-right-to-use-the-private-sector/. That article provided:

Eleven year-old Sam Caruana of Buffalo, New York waited outside a Chick-fil-A restaurant in the freezing cold in order to be one of the 100 people given free fried chicken for one year (actually, one chicken sandwich a week for fifty-two weeks). In a video that went viral (Sam Caruana YouTube – Free Chicken), young Sam explained that he simply loved fried chicken, and he’d stand in the cold for free fried chicken.

Just as Sam loves free fried chicken, law enforcement loves free Suspicious Activity Reports, or SARs. In the United States, over 30,000 private sector financial institutions – from banks to credit unions, to money transmitters and check cashers, to casinos and insurance companies, to broker dealers and investment advisers – file more than 2,000,000 SARs every year. And it costs those financial institutions billions of dollars to have the programs, policies, procedures, processes, technology, and people to onboard and risk-rate customers, to monitor for and identify unusual activity, to investigate that unusual activity to determine if it is suspicious, and, if it is, to file a SAR with the Treasury Department’s Financial Crimes Enforcement Network, or FinCEN. From there, hundreds of law enforcement agencies across the country, at every level of government, can access those SARs and use them in their investigations into possible tax, criminal, or other investigations or proceedings. To law enforcement, those SARs are, essentially, free. And like Sam loves free fried chicken, law enforcement loves free SARs. Who wouldn’t?

But should those private sector SARs, that cost billions of dollars to produce, be “free” to public sector law enforcement agencies? Put another way, should the public sector law enforcement agency consumers of SARs need to provide something in return to the private sector producers of SARs?

I say they should. And here’s what I propose: that in return for the privilege of accessing and using private sector SARs, law enforcement shouldn’t have to pay for that privilege with money, but with effort. The public sector consumers of SARs should let the private sector producers know which of those SARs provide tactical or strategic value.

A recent Mid-Size Bank Coalition of America (MBCA) survey found the average MBCA bank had: 9,648,000 transactions/month being monitored, resulting in 3,908 alerts/month (0.04% of transactions alerted), resulting in 348 cases being opened (8.9% of alerts became a case), resulting in 108 SARs being filed (31% of cases or 2.8% of alerts). Note that the survey didn’t ask whether any of those SARs were of interest or useful to law enforcement. Some of the mega banks indicate that law enforcement shows interest in (through requests for supporting documentation or grand jury subpoenas) 6% – 8% of SARs.

I argue that the Alert/SAR and even Case/SAR ratios are all of interest, but tracking to SARs filed is a little bit like a car manufacturer tracking how many cars it builds but not how many cars it sells, or how well those cars perform, how long they last, and how popular they are. And just like the automobile industry measuring how many cars are purchased, the better measure for AML programs is “SARs purchased”, or SARs that provide value to law enforcement.

Also, there is much being written about how machine learning and artificial intelligence will transform anti-money laundering programs. Indeed, ML and AI proponents are convinced – and spend a lot of time trying to convince others – that they will disrupt and revolutionize the current “broken” AML regime. Among other targets within this broken regime is AML alert generation and disposition and reducing the false positive rate. The result, if we believe the ML/AI community, is a massive reduction in the number of AML analysts that are churning through the hundreds and thousands of alerts, looking for the very few that are “true positives” worthy of being labelled “suspicious” and reported to the government. But the fundamental problem that every one of those ML/AI systems has is that they are using the wrong data to train their algorithms and “teach” their machines: they are looking at the SARs that are filed, not the SARs that have tactical or strategic value to law enforcement.

Tactical or Strategic Value Suspicious Activity Reports – TSV SARs

The best measure of an effective and efficient financial crimes program is how well it is providing timely, effective intelligence to law enforcement. And the best measure of that is whether the SARs that are being filed are providing tactical or strategic value to law enforcement. How do you determine whether a SAR provides value to law enforcement? One way would be to ask law enforcement, and hope you get an answer. That could prove to be difficult.  Can you somehow measure law enforcement interest in a SAR?  Many banks do that by tracking grand jury subpoenas received to prior SAR suspects, law enforcement requests for supporting documentation, and other formal and informal requests for SARs and SAR-related information. As I write above, an Alert-to-SAR rate may not be a good measure of whether an alert is, in fact, “positive”. What may be relevant is an Alert-to-TSV SAR rate.

A TSV SAR is one that has either tactical value – it was used in a particular case – or strategic value – it contributed to understanding a typology or trend. And some SARs can have both tactical and strategic value. That value is determined by law enforcement indicating, within seven years of the filing of the SAR (more on that later), that the SAR provided tactical (it led to or supported a particular case) or strategic (it contributed to or confirmed a typology) value.  That law enforcement response or feedback is provided to FinCEN through the same BSA Database interfaces that exist today – obviously, some coding and training will need to be done (for how FinCEN does it, see below). If the filing financial institution does not receive a TSV SAR response or feedback from law enforcement or FinCEN within seven years of filing a SAR, it can conclude that the SAR had no tactical or strategic value to law enforcement or FinCEN, and may factor that into decisions whether to change or maintain the underlying alerting methodology. Over time, the financial institution could eliminate those alerts that were not providing timely, actionable intelligence to law enforcement. And when FinCEN shares that information across the industry, others could also reduce their false positive rates.

FinCEN’s TSV SAR Feedback Loop

FinCEN is working to provide more feedback to the private sector producers of BSA reports. As FinCEN Director Ken Blanco recently stated:[1]

“Earlier this year, FinCEN began the BSA Value Project, a study and analysis of the value of the BSA information we receive. We are working to provide comprehensive and quantitative understanding of the broad value of BSA reporting and other BSA information in order to make it more effective and its collection more efficient. We already know that BSA data plays a critical role in keeping our country strong, our financial system secure, and our families safe from harm — that is clear. But FinCEN is using the BSA Value Project to improve how we communicate the way BSA information is valued and used, and to develop metrics to track and measure the value of its use on an ongoing basis.”

FinCEN receives every SAR. Indeed, FinCEN receives a number of different BSA-related reporting: SARs, CTRs, CMIRs, and Form 8300s. It’s a daunting amount of information. As FinCEN Director Ken Blanco noted in the same speech:

FinCEN’s BSA database includes nearly 300 million records — 55,000 new documents are added each day. The reporting contributes critical information that is routinely analyzed, resulting in the identification of suspected criminal and terrorist activity and the initiation of investigations.

“FinCEN grants more than 12,000 agents, analysts, and investigative personnel from over 350 unique federal, state, and local agencies across the United States with direct access to this critical reporting by financial institutions. There are approximately 30,000 searches of the BSA data taking place each day. Further, there are more than 100 Suspicious Activity Report (SAR) review teams and financial crimes task forces across the country, which bring together prosecutors and investigators from different agencies to review BSA reports. Collectively, these teams reviewed approximately 60% of all SARs filed.

Each day, law enforcement, FinCEN, regulators, and others are querying this data:  7.4 million queries per year on average. Those queries identify an average of 18.2 million filings that are responsive or useful to ongoing investigations, examinations, victim identification, analysis and network development, sanctions development, and U.S. national security activities, among many, many other uses that protect our nation from harm, help deter crime, and save lives.”

This doesn’t tell us how many of those 55,000 daily reports are SARs, but we do know that in 2018 there were 2,171,173 SARs filed, or about 8,700 every (business) day. And it appears that FinCEN knows which law enforcement agencies access which SARs, and when. And we now know that there are “18.2 million filings that are responsive or useful to ongoing investigations, examinations, victim identification, analysis and network development, sanctions development, and U.S. national security activities” every year. But which filings?

The law enforcement agencies know which SARs provide tactical or strategic value, or both. So if law enforcement finds value in a SAR, it should acknowledge that, and provide that information back to FinCEN. FinCEN, in turn, could provide an annual report to every financial institution that filed, say, more than 250 SARs a year (that’s one every business day, and is more than three times the number filed by the average bank or credit union). That report would be a simple relational database indicating which SARs had either or both tactical or strategic value. SAR filers would then be able to use that information to actually train or tune their monitoring and surveillance systems, and even eliminate those alerting systems that weren’t providing any value to law enforcement.

Why give law enforcement seven years to respond? Criminal cases take years to develop. And sometimes a case may not even be opened for years, and a SAR filing may trigger an investigation. And sometimes a case is developed and the law enforcement agency searches the SAR database and finds SARs that were filed five, six, seven or more years earlier. Between record retention rules and practical value, seven years seems reasonable.

Law enforcement agencies have tremendous responsibilities and obligations, and their resources and budgets are stretched to the breaking point. Adding another obligation – to provide feedback to the banks, credit unions, and other private sector institutions that provide them with reports of suspicious activity – may not be feasible. But the upside of that feedback – that law enforcement may get fewer, but better, reports, and the private sector institutions can focus more on human trafficking, human smuggling, and terrorist financing and less on identifying and reporting activity that isn’t of interest to law enforcement – may far exceed the downside.

Free Suspicious Activity Reports are great. But like Sam being prepared to stand in the freezing cold for his fried chicken, perhaps law enforcement is prepared to let us know whether the reports we’re filing have value.

Conclusion

As of this writing – July 3, 2020 – it remains to be seen whether the Anti-Money Laundering Act of 2020 will become law, or what parts of the Act will become law. But section 5201, which requires the public sector consumers of the BSA reports produced by the private sector to provide feedback to the private sector on the usefulness of those reports. This is a critically important, long-awaited development in the US AML/CFT regime.

For more on alert-to-SAR rates, the TSV feedback loop, machine learning and artificial intelligence, see other articles I’ve written:

The TSV SAR Feedback Loop – June 4 2019

AML and Machine Learning – December 14 2018

Rules Based Monitoring – December 20 2018

FinCEN FY2020 Report – June 4 2019

FinCEN BSA Value Project – August 19 2019

BSA Regime – A Classic Fixer-Upper – October 29 2019

[1] November 15, 2019, prepared remarks for the Chainalysis Blockchain Symposium, available at https://www.fincen.gov/news/speeches/prepared-remarks-fincen-director-kenneth-blanco-chainalysis-blockchain-symposium

FinCEN’s Estimate of the Costs and Burden of Filing SARs Is Evolving, But Needs Private Sector Input

For years, FinCEN has used a one-size-fits-all-SARs method of determining the costs and burden of filing Suspicious Activity Reports (SARs): a flat two hours, or 120 minutes. With a new-found ability to slice-and-dice its SAR data, FinCEN has now determined that the back half of the SAR filing process takes between 45 and 315 minutes, depending on the type of SAR. And it’s looking for feedback from the private sector on how to enhance this estimate.

Posted June 2, 2020

On May 26, 2020, FinCEN published a notice in the Federal Register titled “Proposed Updated Burden Estimate for Reporting Suspicious Transactions Using FinCEN Report 111 – Suspicious Activity Report”. This is a notice required under the Paperwork Reduction Act, or PRA: agencies are required to periodically assess and estimate the burdens and costs of their regulatory regimes.

This is a ground-breaking notice, for it is the first such notice where: (1) FinCEN has been able to analysis the SAR Database to quantitatively assess the numbers, characteristics, and types of SARs, by institution type, by type of work required to be done, and by what types of involved positions; and (2) perhaps just as important, FinCEN has shown a willingness to provide this information and to seek feedback from the private sector on other available information that could be incorporated into future analyses. FinCEN must be commended for both.

In prior PRA notices, FinCEN has simply estimated that the SAR filing process takes a total of two hours for each and every SAR filed. With this notice, FinCEN identified and attempted to capture burden and cost estimates for, five categories of SARs, two types of filing (batch and discrete), the six stages in the SAR filing process, and the four types of positions involved in the process.

Five categories of SARs: (1) depository institutions’ (banks and credit unions) original SARs with standard content; (2) depository institutions’ original SARs with extended content; (3) non-depository institutions’ original SARs with standard content; (4) non-depository institutions’ original SARs with extended content; and (5) all filers’ continuing activity SARs. The standard and extended content analysis looked at combinations of (1) the number of named suspects; (2) the number of suspicious activities’ categories marked on the SAR form; (3) the length and make-up of the narrative; and (4) whether there was an attachment.

Six stages in the SAR filing process: (1) maintaining a monitoring system; (2) reviewing alerts; (3) transforming alerts into cases; (4) case review; (5) documentation of the SAR/no SAR determination; and (6) the SAR filing process. The current two-hour per SAR PRA estimate only considered the 6th stage: this notice added the 4th and 5th stage, and FinCEN acknowledged that it needs further data, and comments from the private sector, in order to include the 1st, 2nd, and 3rd stages.

Four types of people: (1) general supervision (oversight); (2) direct supervision; (3) clerical (SAR investigation); and (4) clerical (filing).

With this notice, FinCEN is changing its PRA burden estimate of 120 minutes per SAR to an estimate ranging from 25 minutes to 315 minutes per SAR for the last 3 of the 6 stages in the SAR filing process, and is inviting comments on these new estimates and on how to include and estimate the first 3 of the 6 stages.

Comments from the public are due by July 27, 2020.

Below is my analysis and commentary on the FinCEN notice. The text of the Notice is in regular font: my analysis and comments are in red italics.

Renewal Without Change of the Bank Secrecy Act Reports by Financial Institutions of Suspicious Transactions

https://www.govinfo.gov/content/pkg/FR-2020-05-26/pdf/2020-11247.pdf

Agency Information Collection Activities; Proposed Renewal; Comment Request;

AGENCY: Financial Crimes Enforcement Network (FinCEN), Treasury.

ACTION: Notice and request for comments.

SUMMARY: As part of its continuing effort to reduce paperwork and respondent burden, FinCEN invites comments on the proposed renewal, without change, of currently approved information collections relating to reports of suspicious transactions. Under the Bank Secrecy Act regulations, financial institutions are required to report suspicious transactions using FinCEN Report 111 (the suspicious activity report, or SAR). Although no changes are proposed to the information collections themselves, this request for comments covers a proposed updated burden estimate for the information collections.

This request for comments is made pursuant to the Paperwork Reduction Act of 1995.

DATES: Written comments are welcome, and must be received on or before [INSERT

DATE 60 DAYS AFTER THE DATE OF PUBLICATION OF THIS DOCUMENT IN THE FEDERAL REGISTER.]

JRR Comment: Very simply, FinCEN is proposing updates to the way it estimates the burden – both time and cost – for preparing and filing Suspicious Activity Reports, and is seeking comments on these proposed updates. FinCEN’s newfound ability to analyze the data it has seems to have allowed it to shift from a two-hours-for-all-SARs approach to a much more nuanced, data-driven approach.

ADDRESSES: Comments may be submitted by any of the following methods:

  • Federal E-rulemaking Portal: http://www.regulations.gov. Follow the instructions for submitting comments. Refer to Docket Number FINCEN-2020-0004 and the specific Office of Management and Budget (OMB) control numbers 1506-0001, 1506-0006, 1506-0015, 1506-0019, 1506-0029, 1506-0061, and 1506-0065.
  • Mail: Policy Division, Financial Crimes Enforcement Network, P.O. Box 39, Vienna, VA 22183. Refer to Docket Number FINCEN-2020-0004 and OMB control numbers 1506-0001, 1506-0006, 1506-0015, 1506-0019, 1506-0029, 1506-0061, and 1506-0065.

Please submit comments by one method only. Comments will also be incorporated into FinCEN’s review of existing regulations, as provided by Treasury’s 2011 Plan for Retrospective Analysis of Existing Rules. All comments submitted in response to this notice will become a matter of public record. Therefore, you should submit only information that you wish to make publicly available.

FOR FURTHER INFORMATION CONTACT: The FinCEN Regulatory Support Section at 1-800-767-2825 or electronically at frc@fincen.gov.

SUPPLEMENTARY INFORMATION:

I. Statutory and Regulatory Provisions

The legislative framework generally referred to as the Bank Secrecy Act (BSA) consists of the Currency and Financial Transactions Reporting Act of 1970, as amended by the Uniting and Strengthening America by Providing Appropriate Tools Required to Intercept and Obstruct Terrorism Act of 2001 (USA PATRIOT Act) (Public Law 107– 56) and other legislation. The BSA is codified at 12 U.S.C. 1829b, 12 U.S.C. 1951–1959, 31 U.S.C. 5311–5314 and 5316–5332, and notes thereto, with implementing regulations at 31 CFR Chapter X.

The BSA authorizes the Secretary of the Treasury, inter alia, to require financial institutions to keep records and file reports that are determined to have a high degree of usefulness in criminal, tax, and regulatory matters, or in the conduct of intelligence or counter-intelligence activities, to protect against international terrorism, and to implement counter-money laundering programs and compliance procedures.[1] Regulations implementing Title II of the BSA appear at 31 CFR Chapter X. The authority of the Secretary to administer the BSA has been delegated to the Director of FinCEN.[2] Under 31 U.S.C. 5318(g), the Secretary of the Treasury is authorized to require financial institutions to report any suspicious transaction relevant to a possible violation of law or regulation. Regulations implementing 31 U.S.C. 5318(g) are found at 31 CFR 1020.320, 1021.320, 1022.320, 1023.320, 1024.320, 1025.320, 1026.320, 1029.320, and 1030.320. The information collected under these requirements are made available to appropriate agencies and organizations as disclosed in FinCEN’s Privacy Act System of Records Notice relating to BSA Reports.[3]

II. Paperwork Reduction Act (PRA)[4]

Title: Reports by Financial Institutions of Suspicious Transactions (31 CFR 1020.320, 1021.320, 1022.320, 1023.320, 1024.320, 1025.320, 1026.320, and 1029.320). OMB Control Numbers: 1506-0001, 1506-0006, 1506-0015, 1506-0019, 1506-0029, 1506-0061, and 1506-0065.[5]

Report Number: FinCEN Report 111 – Suspicious Activity Report (SAR).

Abstract: FinCEN is issuing this notice to renew the OMB control numbers for the SAR regulations and the SAR report.

Type of Review: Renewal without change of currently approved information collections.

Affected Public: Businesses or other for-profit institutions, and non-profit institutions.

SAR Regulations

Estimated Burden: An administrative burden of one hour is assigned to each of the SAR regulation OMB control numbers in order to maintain the requirements in force.[6]

JRR Comment: One hour is the current “administrative burden” of preparing and filing a SAR.

The reporting and recordkeeping burden is reflected in FinCEN Report 111 – SAR, under OMB control number 1506-0065. The rationale for assigning one burden hour to each of the SAR regulation OMB control numbers is that the annual burden hours would be double counted if FinCEN estimated burden in the industry SAR regulation OMB control numbers and in the FinCEN Report 111 – SAR OMB control number.

FinCEN Report 111 – SAR

Type of Review:

  • Propose for review and comment a re-calculation of the portion of the PRA burden that has been subject to notice and comment in the past (the “traditional annual PRA burden”).
  • Propose for review and comment a method to estimate the portion of the PRA burden that FinCEN previously had not included (the “supplemental annual PRA burden”).

JRR Comment: FinCEN is acknowledging that its current burden estimate (i) needs to be re-calculated, and (ii) needs to be augmented.  And it now has the means to do so through its BSA Value Project.

Frequency: As required.

Estimated Number of Respondents: 12,148 financial institutions.[7]

JRR Comment: The estimated number of respondents – 12,148 financial institutions – and the accompanying footnote is the first interesting nugget of information. The footnote includes the phrase “not all financial institutions identify suspicious activity that would warrant a SAR filing”. This is a benign phrase, hidden in a footnote, that could be the headline of a GAO report: arguably, every regulated financial institution, no matter how small, should identify and report at least one suspicious transaction in any given year. See my comments below Table 1.

Estimated Reporting and Recordkeeping Burden:

In this notice, FinCEN introduces two substantial modifications to the scope and the methodology we previously used to estimate the annual PRA burden associated with the SAR. First, with respect to the scope of the estimate, FinCEN’s traditional annual PRA burden estimate associated with the SAR included only the filer’s annual operational burden and cost associated with (a) producing and filing the report, and (b) storing a copy of the filed report. Starting with this notice, FinCEN intends to add a supplemental annual PRA burden estimate that reflects the annual costs involved in (a) determining whether alerts that were elevated for further review merit filing a SAR, and (b) documenting the decision not to file a SAR when a case does not merit it.[8]

JRR Comment: This is where FinCEN explains what it is proposing to do. FinCEN recognizes that there is a complex process to monitor for and alert on unusual activity, determine whether to investigate that activity, to investigate that activity and, if it is suspicious to prepare and file a SAR or if not suspicious to document why it is not suspicious. Later, FinCEN describes these as the six stages in the SAR filing process. In Footnote 8, though, FinCEN acknowledges that it “lacks the granular data to estimate the costs of certain steps in that process”. In fact, it lacks the data to include the burdens for steps 1-3, which arguably may be the most burdensome from both time and cost perspectives.

Second, with respect to the methodology underlying the PRA burden and cost estimates, rather than continuing to allocate a single PRA burden and cost to the completion, submission, and storage of any type of SAR, FinCEN proposes to estimate the individual PRA burden and cost of different categories of SARs, grouped by the SARs’ estimated degree of complexity. Because there is no direct way to measure the complexity and related effort and cost of producing each SAR, FinCEN uses key features of SARs filed in 2019 to categorize them based on similar combinations of those key features, under the assumption that such combinations of key features reflect similar levels of effort and cost necessary to produce the SARs.

JRR Comment: This is where FinCEN is acknowledging that not all SARs are the same. Later, FinCEN identifies five types of SARs for its burden estimates, differentiated by (i) whether they are original SARs or “continuing activity” SARs; (ii) whether filed by banks and credit unions (collectively, “depository institutions” or “DIs”) or all other types of filers (“Non-DIs”); (iii) whether they are “standard” complexity or “extended” complexity; and (iv) whether they were batch-filed or filed as a discrete, stand-alone SAR.

Part 1 below sets out the breakdown of the SARs filed during 2019 according to the key features that are used to group SARs into categories subject to similar PRA burden and cost. Part 1 also contains the analysis of how some combinations of key features worked or failed to work as proxies for a SAR’s complexity and, therefore, burden and cost.

Part 2 uses the results of the analysis in Part 1 to estimate the individual and total annual PRA burden and cost of each category of SARs. The methodology described in Part 2 covers both the traditional and the supplemental annual PRA burden estimate.

Part 1. Breakdown of the 2019 SAR Filings

In 2019, 12,148 financial institutions (the “filing population”) submitted 2,751,694 SARs (the 2019 SAR submissions).[9] The distribution of the 2019 SAR submissions, by type of filing (original or continuing),[10] type of financial institution,[11] number of reports per filer per year, and method of filing (batch or discrete),[12] is presented in Table 1 below:

Table 1 shows that banks submitted slightly over half of the total number of SARs filed in 2019. Money services businesses (MSBs) and credit unions contributed 32.9% and 7.3% of the total, respectively. Approximately 85% of the filings from all financial institutions consisted of original reports. In addition, approximately 85% of the reports were batch filed.

JRR Comment: The most interesting aspect of Table 1 is not what is included in the Table – which is the number of financial institutions, by type, that filed SARs in 2019, but what is not included in the Table – the total number of financial institutions, by type.

  • Banks – FDIC data shows that there were 5,186 banks at the end of 2019. So 95% of banks filed at least one SAR in 2019, which means that 5% or 250 banks didn’t file a single SAR in 2019.
  • Credit Unions – NCUA data shows that there were 5,236 credit unions at the end of 2019. Using this data, 62% of credit unions filed at least one SAR in 2019, which means that 38% or 2,001 credit unions didn’t file a single SAR in 2019. 
  • Securities/Futures – In this “catch all” category, FinCEN’s May 11, 2016 Final Rule for CDD/Beneficial Ownership provided that there were 16,404 entities in this class. SEC data suggests ~3,800 registered entities. At best, 15% of the regulated financial institutions in the Securities/Futures class are filing SARs.
  • Money Services Businesses (MSBs) – There are 22,736 MSBs registered with FinCEN. So less than 10% of registered MSBs filed at least one SAR in 2019.

To determine the concentration of 2019 SAR submissions among the filing population, FinCEN grouped filers in tranches according to the number of SARs filed during the year. Table 2 sets out the number of reports per tranche,[13] and Table 3 sets out (i) each tranche as a percentage of the total filer population, and (ii) each tranche’s reports as a percentage of the 2019 SAR submissions.[14]

JRR Comment: It is useful to group filers according to the number of SARs filed. But what would be more useful is to group them by size of institution. The problem, though, is determining what “size” is across diverse institution types. Total deposits might be the best proxy for banks and credit unions (better than total assets, which can be located outside the United States and aren’t tied to transactions as much as deposits are), but that measure doesn’t work for MSBs or Casinos.

However, 95% of SARs are filed by Depository Institutions (62%) and MSBs (33%). I would propose that Depository Institutions be grouped by tranches of Total Deposits, and MSBs be grouped by number of domestic agent locations.

Ten filers (six banks and four MSBs) made up the first tranche (00_LARGEST FILERS). As set out in Table 3, these ten filers accounted for nearly half of the 2019 SAR submissions. Slightly less than 2% of the filing population (Tranches 00 to 03) submitted 81% of all the reports. Additionally, out of the filing population, 81% contributed slightly less than 4% of the filings, while 56% submitted fewer than 10 reports per year.

JRR Comment: These two tables are critical. First, though, is some much-needed context for banks and credit unions. Of the 5,236 credit unions, only 10 have assets greater than $10 billion, and the largest is $90 billion. 90% of credit unions have less than $565 million in assets. Of the 5,186 banks, 143 have assets of more than $10 billion, 32 are larger than $90 billion, and the 4 largest are all over $1.5 trillion in assets. But most banks, like credit unions, are very small: 75% of banks have less than $565 million in assets.

Looking at 50 or fewer SARs filed per year – or less than one per week – shows that 80% of banks and 81% of credit unions that filed SARs in 2019 filed fewer than 1 per week on average. And almost 60% of each filed fewer than 10 in the entire year. The 10 largest filers – 6 banks and 4 MSBs – filed more than 700 per week on average. The top 2% of banks and credit unions filed more than 80% of the SARs.

Question – is it time for a bifurcated regulatory approach, similar to the CCAR/DFAST approach taken for capital and liquidity purposes?

JRR Comment: The main flaw in the approach of grouping institutions by the number of SARs filed is that you could have a $100 million asset (deposits) institution, or a 10-agent MSB appropriately filing 50 SARs a year, and a $100 billion asset institution or a 100-agent MSB inappropriately filing 50 SARs a year, yet they are included in the same tranche.

Unlike currency transaction reports, for example, which are more easily categorized because they are filed based on objective criteria (i.e., transaction type and threshold), each SAR may require a widely disparate level of effort depending largely on the amount of research and subjective analysis required to determine: (a) whether to file a report; (b) how to attribute the suspicious behavior to money laundering, financing of terrorism, or fraud typologies; (c) who the main persons involved in the activity are; and (d) how to explain in concise terms the rationale that led the filer to decide to file a SAR.

As FinCEN has no direct way to gauge the amount of work involved in the production of each SAR, FinCEN broke down the 2019 SAR submissions by additional key features, so that, individually or in combination, these additional key features could serve as a proxy to group SARs with similar levels of estimated complexity, and therefore, with similar estimated PRA burden. The additional key features in the SARs that FinCEN has concentrated its analysis on are: (a) the number of persons identified as subjects; (b) the number of distinct suspicious activities selected;[15] (c) the length of the narrative section; and (d) whether or not the report contains an attachment.[16]

JRR Comment: One can debate whether these are the best proxies for complexity, but this is a tremendous first step in determining relative complexity and estimated PRA burden.

  • Number of Subjects/Suspects – this is a good proxy. As a general rule, the more suspects, the more complex the underlying activity.
  • Number of distinct suspicious activities selected – Footnote 15 indicates that the SAR has 18 categories of suspicious activities. I’m not sure where that number comes from. There are 11 categories of suspicious activity, each with 1 or more sub-types of activity (a total of 79 sub-types plus “other” for each category). There are also 10 instrument types and 21 product types. I recommend that FinCEN use some AI/Machine Learning techniques to analyze the combinations of suspicious activity types, instruments, and products. FinCEN attempted this in its “tractable segmentation” approach, below.
  • Length of narrative – FinCEN recognizes some of the shortcomings of this attribute, and adjusts for it, but this is a good first step.
  • Attachment – FinCEN recognizes the shortcomings, adjusts for it … and it is a good first step.

I didn’t see anything about the amount being reported (with more reported activity indicating more complexity), or the period of time between the first reported activity and the last reported activity (the greater the period of activity indicating more complexity), or the period of time between the first reported activity and the date of the SAR (which could indicate a lookback or review).

Once FinCEN identifies the combination of key features that are common to the largest number of reports submitted by a given type of filer (the “standard content” for that type of filer), FinCEN may take such combination as a proxy for the content and estimated complexity of a “standard” SAR for that filer type. Reports submitted by filers of the same type that contain different features (more subjects, more suspicious activities, a longer narrative) may represent SARs with “extended content” that are more complex, and therefore carry a larger PRA burden and cost for that filer type. Based on the data available, FinCEN is considering only two levels of SAR complexity.

Table 4A shows a breakdown of the 2019 SAR submissions by type of financial institution and narrative length. Table 4B shows the percentage of reports with and without attachments, by type of financial institution, and narrative length.

Table 5 breaks down the 2019 SAR submissions by type of financial institution and number of suspicious activities identified in each report.[17]

JRR Comment: The differences in the number of selected suspicious activities can be caused by differences in style, practices, or training from one institution to another. For example, one filer may consider a check fraud involving an elderly customer to be one category (check fraud), another two categories (check fraud, Elder Financial Exploitation), another six categories (check fraud, identity theft, providing questionable or false documentation, Elder Financial Exploitation, forgeries, identity theft).

I would combine the “tranche and type” data from Tables 2 and 3 with the number of suspicious activity categories from Table 5: the data may show that the fewer SARs an institution files, the fewer suspicious activity categories there are.

Approximately 44% of the SARs submitted by all filers have narratives not exceeding 2,000 characters (half a page), and another 39% have narratives above half a page but not exceeding one page. Most SARs (60%) identify up to two suspicious activities, while another 38% list between three and five.

FinCEN analyzed key features of the 2019 SAR submissions described in Tables 1 through 5 to generate a tractable segmentation of the SAR universe into different levels of burden. FinCEN based this segmentation on the following observations:

  • FinCEN was not able to limit the criteria for selecting categories of SAR burden to the type of financial institution or the tranche of a filer alone because of large variations in the combination of features within each type of financial institution or tranche. It was possible, however, to arrive at a small number of complexity categories by combining key features that highlight significant differences between depository institution filers (banks and credit unions), MSBs, and other types of financial institution filers (non-depository institutions).
  • Based on the analyzed complexity features as well as FinCEN’s extensive use of SARs in its work, in general and on average,[18] the content of SARs shows the following general features:
  1. There appears to be a positive correlation between the number and complexity of a financial institution’s main business lines, and the value registered by some of the key features selected: the higher the number and complexity of the filer’s business lines, the higher the number of suspicious transactions identified and the longer the narrative.
  2. In general, non-depository institutions with a single primary business line (i.e., loan and finance companies or casinos) file reports that (a) list up to two suspicious transactions involving one subject and a single transaction or a small number of transactions over a short period of time, and (b) use relatively short narratives of up to half a page to explain the basis for their suspicion.
  3. Some SARs filed by non-depository institutions have features indicating complexity, particularly longer narratives, despite the SARs not being complex. A sample of the SARs filed by two of the largest non-depository institutions showed that in 94% of the SARs with longer narratives, the increased length was due to listing transactions the filer appeared to have tracked automatically. Six percent of those SARs appeared to have required greater analytical effort. To estimate the number of SARs with extended content filed by non-depository institutions in 2019, FinCEN therefore applied the six percent threshold to the total number of SARs with narratives over one page filed by non-depository institutions.
  4. Nearly three quarters of original SARs filed by depository institutions report only up to two subjects involved in up to five suspicious activities, described in a narrative that does not exceed one page, and on their face do not appear complex.

JRR Comment: This is one of the most important statements in this Notice. Essentially, FinCEN is saying that ¾ of the 2.7 million SARs filed are not complex. Can these SARs be filed without human intervention with little, if any, material loss in utility or value to law enforcement?

Many SARs filed by depository institutions, however, have features indicating complexity. This may reflect any combination of the factors laid out in the tables above – number of subjects per SAR, number of suspicious transactions listed per SAR, length of the narrative, and presence of an attachment. However, some SARs that appear complex based on these features often are not in reality. Depository institutions, which in general tend to offer many business lines mostly to established customers, sometimes include in SARs a comparison of other information they maintain. This can increase the apparent complexity of SARs analyzed against the complexity factors FinCEN identified without necessarily being indicative of a SAR requiring extensive research. FinCEN controlled for this by removing from the complex category SARs that had a high ratio of digits to non-digit text in the SAR narrative, because a high ratio of digits often indicates the algorithmic inclusion of transaction data in the SAR narrative.

JRR Comment: This was a great catch by FinCEN. And below might have been a miss by FinCEN. Whether “continuing activity” SARs require “substantially less effort”, or any less effort than original SARs, is worth exploring.

  • For all financial institutions, FinCEN estimates that the review of cases documenting the need to file continuing SARs, and the filing of the continuing SARs themselves, will require substantially less effort than the review of cases leading to the filing of original SARs, and the actual filing of such original SARs.
  • Lastly, FinCEN assumes that financial institutions that batch file SARs have a degree of automation they can employ to the partial filling of the report. Batch filers will also store electronic files that may contain several reports per file. Based on these assumptions, FinCEN allocates a lower PRA burden per report to these filers. This burden consists of the actual time of submission per report (which may be close to instantaneous), and the administrative and supervisory tasks involved in this stage.

As noted, reflecting the observations above, FinCEN identified five categories of SARs to generate a tractable segmentation of complexity for analyzing estimated PRA burden: (a) continuing SARs; (b) original SARs with standard content filed by nondepository institutions; (c) original SARs with extended content filed by non-depository institutions; (d) original SARs with standard content filed by depository institutions; and (e) original SARs with extended content filed by depository institutions.

JRR Comment: This is the first of three steps FinCEN takes in estimating the SAR burden – identifying the five categories of SARs. The second and third steps follow: identifying the six stages in the SAR filing process, and the four types of people involved in that process, respectively.

Part 2. PRA Burden and Cost Estimates

Based on industry input, including input obtained over the past year in a project assessing how to improve the effectiveness of BSA data and measure its value for each stakeholder group, FinCEN understands that the SAR filing process comes at the end of a larger process that varies in complexity depending on the type and size of the financial institution:[19]

JRR Comment: On the following page is FinCEN’s six-stage SAR production process. This is a good first step, but I disagree with the approach that, for purposes of the PRA burden and cost estimates, the SAR process is distinct from the overall BSA/AML program process (and burden and cost). The singular purpose of the BSA/AML program regime is to provide timely, actionable intelligence to law enforcement and the intelligence community by way of BSA reports and recordkeeping – primarily SARs and CTRs. Therefore, integral to the SAR production process are the program requirements of risk assessment, CIP/CDD, training, independent testing, examination management, etc. These costs will be included in future notices.

Stage 1 – Maintaining a Monitoring System: Commensurate with the size of the filer and the complexity of its operations, each filer will run, update, and upgrade a monitoring system that reflects its assessment of risk. This monitoring system will vary in complexity from a manual review process to a fully automated one.[20]

JRR Comment: The use of the singular “monitoring system” minimizes the complexity of even the smallest institution’s program to have employees escalate unusual activity (referrals), to have manual or automated monitoring systems identify unusual activity (alerts), and the regulatory and operational requirements to run, update, and upgrade those systems. Larger, more complex institutions will run dozens of monitoring and surveillance systems.

Stage 2 – Reviewing Alerts: When the monitoring system issues an alert, the filer will have to determine whether the alert reveals a true potential risk event, or is a false positive.

JRR Comment: As FinCEN explains below, it is not including this stage in its burden and cost estimate “due to the lack of the necessary granular information”. Transaction monitoring and customer surveillance systems, and the alerts that are generated, are a major part of the burden and cost of AML programs. The issue of high false positive rates – anecdotally 95 percent or more of alerts are so-called “false positives” – is often-discussed, always-lamented, and remains an intractable problem. See: https://regtechconsulting.net/uncategorized/rules-based-monitoring-alert-to-sar-ratios-and-false-positive-rates-are-we-having-the-right-conversations/. Also see: https://regtechconsulting.net/uncategorized/flipping-the-three-aml-ratios-with-machine-learning-and-artificial-intelligence-why-bartenders-and-aml-analysts-will-survive-the-ai-apocalypse/

Stage 3 – Transforming Alerts into Cases: If, based on the filer’s analysis, the alert points to a true potential risk event, the filer will gather additional information to present the case to the reviewing level that will eventually decide whether the event merits the filing of a SAR.

JRR Comment: FinCEN has done a good job recognizing that many institutions have an alert review or alert triage process to determine if an alert should “go to case” or not. But like stages 1 and 2, this third stage is not included in the burden and cost analysis at this time.

Stage 4 – Case Review: The appropriate level will review the case to determine whether or not the event constitutes a suspicious activity that must be reported.

Stage 5 – Documentation of Determination: This notice takes into account that filers document decisions they make as part of Stage 4 that lead them to conclude that an event does not warrant the filing of a SAR.

Stage 6 – SAR Filing Process: If an event warrants the filing of a SAR, the filer will follow its SAR filing process, including: (a) selecting supporting documentation; (b) completing the report, including drafting the narrative; (c) filing the report through batch or discrete filing; and (d) storing the filed report and supporting documentation in physical or electronic form.

Each stage requires the filer’s use of human and technological resources, which combination will vary according to the sophistication of the filer. Previously, FinCEN limited its annual SAR PRA burden estimate to Stage 6 mentioned above, the SAR filing process (the “traditional annual PRA burden”). In this notice, FinCEN expands its PRA burden estimate to include Stages 4 and 5 listed above (the “supplemental annual PRA burden”).

JRR Comment: Stages 4 and 5 are the “supplemental annual PRA burden” that FinCEN is adding. Until now, FinCEN only included Stage 6 in its PRA estimate. Now FinCEN is considering Stages 4, 5, and 6.

FinCEN is not addressing the burden associated with Stages 1 to 3 above due to the lack of the necessary granular information. Notably, FinCEN would need information regarding: (i) the levels of burden and cost attributed to differing monitoring systems; (ii) varying levels of complexity in determining whether alerts represent true alerts; and (iii) the amount of research involved in assembling cases to determine whether true alerts warrant the filing of a SAR. Furthermore, FinCEN would need additional information to identify the proportion of these costs that are strictly connected to the filing of a SAR relative to the same costs associated with a filer’s other regulatory or business requirements. FinCEN intends to address the information required for the estimate of the burden and cost of Stages 1 to 3 in a future notice. FinCEN acknowledges that each stage of the SAR production contributes to the next (including those stages of the process not included in this notice). FinCEN assesses, however, that the information provided by this notice, though not a complete estimate of the SAR PRA burden, improves the estimate and creates a foundation for a future estimate of the costs of all six stages.

JRR Comment: It is incumbent on the industry to provide FinCEN with data and information on Stages 1, 2, and 3 of the process, as well as on the other aspects of a program that are not reflected in these six stages: the program requirements of risk assessment, CIP/CDD, training, independent testing, examination management, etc., that are integral to, and part of, the SAR production and filing process.

FinCEN recognizes that SAR cases that are more complex may take a longer time to review at multiple stages, such as the case investigation point in Stage 4 and the SAR filing point in Stage 6. However, for ease of presentation, FinCEN calculated the extra burden of handling complex cases in our burden estimate for Stage 6, and attributed a burden that represents our estimate of the standard administrative work connected to continuing and original SARs to Stages 4 and 5. Therefore, the total estimate proposed in this notice will be the aggregate of the following estimates of the PRA burden related to:

  • Evaluating cases for potential SAR filing (Stage 4). This will be part of the supplemental annual PRA burden calculation.
  • Recordkeeping of cases not converted into SARs (Stage 5). This will be part of the supplemental annual PRA burden calculation.
  • The SAR filing process (Stage 6). This will be part of the traditional annual PRA burden calculation and will include the PRA burden associated with the filing of (i) continuing SARs, (ii) original SARs filed by non-depository financial institutions, and (iii) original SARs filed by depository financial institutions.

JRR Comment: Up to this point, FinCEN has introduced the first two of the three components of its PRA burden and cost estimate: the five categories of SARs, and the six stages of the SAR filing process. Now FinCEN turns to the third component: the people involved in the process. FinCEN has identified four.

FinCEN identified four staff positions and corresponding roles involved in the SAR process in order to estimate the hourly costs associated with the burden hour estimates calculated in this part. Those are: (i) general supervision (providing process oversight); (ii) direct supervision (reviewing operational-level work and cross-checking all or a sample of the filings against their supporting documentation); (iii) clerical work (engaging in case evaluation to support the determination of whether a SAR must be filed); and (iv) clerical work (engaging in producing, filing, and storing SARs and supporting documentation).

JRR Comment: This is where the private sector should provide detailed comments. It has not been my experience that fraud investigators and AML analysts are performing “clerical work”, classified by the Bureau of Labor Statistics as “Financial Clerks” with a mean (average) hourly wage of $20.40. Based on that same data, the mean annual wage is $43,500, with a broad range across the US of $25,980 to $60,600. The same job code for the financial services NAICS (522000) shows an annual mean salary of $44,500 and a 90th percentile salary of $62,330 (10% of the people in that category make more than $62,330). Data from the private sector will (I believe) show that the annual average salary for financial crimes investigators and analysts will be more than $62,330.  

FinCEN calculated the fully loaded hourly wage for each of these four roles by taking the median wage as estimated by the U.S. Bureau of Labor Statistics (BLS), and computing an additional benefits cost as follows:[21]

JRR Comment: Financial institutions must provide comments (supported by data and information) to FinCEN on these four roles and the range and median salaries for those roles. For example, the BLS data shows that the average salary for the Compliance Officer position is $66,236 with a broad range of $39,790 to $111,640. Data should show that most compliance officers earn in excess of $100,000. And differentiating between Depository Institutions, Securities/Futures, and Non-DIs will be critical.

FinCEN estimates that, in general and on average, each role would spend different amounts of time on each stage of the process covered by this notice, as described in the specific estimates below.

1. Estimate of the burden and cost of evaluating cases for potential SAR filing

To estimate the PRA burden involved in evaluating each case generated by one or more alerts, FinCEN starts with the number of cases that, after review, resulted in the filing of 2,751,694 SARs in 2019. As set out in Table 1 above, of that total number of filings, 2,335,559 reports were original SARs, and 416,135 were continuing SARs.

JRR Comment: This may not be an accurate assumption. Again, the private sector needs to provide comments (supported by data) on the burdens and costs of filing continuing activity SARs. 

In the case of continuing SARs, FinCEN assumes that the filer will be monitoring the specific transactions of the previously identified subject, and filing a continuing SAR every ninety days (if the subject did not discontinue the activity), and noting the cumulative monetary amount involved in the suspicious activity. FinCEN therefore assesses that the number of continuing suspicious activity cases will equal the number of continuing SARs.

In the case of original SARs, however, a filer may need to review a large number of cases to determine which cases justify the filing of a report. A paper issued by the Bank Policy Institute in 2018 (the “BPI Paper”)[22] contains the estimates of 13 large, midsize, and small banks (with assets under management of more than $500 billion, between $200 to $500 billion, and between $50 and $200 billion, respectively) about their average conversion rate[23] of cases to SARs. The BPI Paper states that, on average, banks filed SARs on 42% of alerts turned into cases (i.e., alerts that are not considered false positives).[24] In the absence of similar data for other types of financial institutions, FinCEN adopts the bank average conversion rate from cases to SARs set out in the BPI Paper (42%) to approximate the number of cases that could have generated the number of original SARs filed in 2019. If 42% of cases result in the filing of a SAR, the total filing population would have had to review approximately 5,560,854 cases[25] to report the 2,335,559 original SARs submitted in 2019.[26]

JRR Comment: FinCEN got the case-to-SAR conversion rate of 42 percent from the BPI paper. FinCEN refers to pages 5-7 of the BPI paper. Notably, the BPI survey respondents were 19 banks that all had assets of $50 billion or more: there are only 43 such banks. These 19 banks were grouped into small ($50 – $200 billion, at which time there were 33 such banks in total), midsize ($200 – $500 billion in assets, at which time there were 6 such banks in total), and large (greater than $500 billion, at which the time there were 4 such banks). Thirteen (13) of the 19 banks provided data on Alert-to-Case-to-SAR numbers:

  • Large Banks – generated 2.8 million alerts of which 20% (560,000) became cases, of which 42% (235,200) became SARs;
  • Midsize banks – generated 117,000 alerts of which 9.5% (11,115) became cases, of which 54% (6,002) became SARs;
  • Small banks – generated 107,000 alerts of which 8% (8,560) because cases, of which 53% (4,537) became SARs.

Combined, the three tranches of banks generated 3,024,000 alerts which resulted in 579,675 cases, which eventually became 245,739 SARs. This overall Case-to-SAR conversion rate was 42%.

FinCEN estimates that the average burden involved in considering whether a case merits filing an original SAR, for all types of financial institutions and for any type of suspicious transactions, would be 20 minutes per case. FinCEN estimates that the average burden involved in reviewing cases involving continuing SARs will be much lower, at 3 minutes per case.

JRR Comment: These two assumptions – 20 minutes to determine whether a case merits filing an original SAR, and 3 minutes to determine whether continuing activity merits filing a continuing activity SAR – should be tested by financial institutions’ comments to FinCEN. These are important assumptions which may not prove true. 

FinCEN assumes that the review of cases will involve the participation of three of the roles described above, as follows:[27]

Table 7

JRR Comment: Once a case is opened, the common practice is to assign it to a fraud investigator or AML analyst to determine whether the overall activity of the customer meets the definition of “suspicious activity”. If it does, the analyst will then prepare a SAR: if the analyst determines that a SAR is not warranted, they will document their decisioning and close the case. Depending on the type of case, there may be procedures for reviewing those decisions.

Financial institutions should review their data and provide comments to FinCEN: the data will likely show that 80%-90% of the total time spent determining whether a SAR is merited is on case review, 10%-20% on direct supervision, and 0%-10% on indirect supervision.

Footnote 27 below is confusing to me: in my experience, fraud investigators and AML analysts – those people that are working cases, determining whether a SAR should be filed, and preparing and filing the SAR – are not maintaining agendas, documenting minutes of meetings, or assembling files for review by SAR committees.

The total annual PRA burden of this stage involving cases related to both continuing and original SARs would be 1,874,424 hours, at a total cost of $91,846,776, as described in Tables 8A and 8B below.

Tables 8A, 8B

2. Estimate of the burden and cost of documenting cases not converted into SARs

With 2,335,559 cases resulting in SAR filings and an estimated conversion rate of 42%, out of the estimated 5,560,854 cases, 3,225,295 would be cases involving a decision not to file. FinCEN estimates that the average burden hours of documenting the rationale as to why a case does not merit filing a SAR, for all types of financial institutions and in the context of any type of suspicious transactions, would be 25 minutes per report.

JRR Comment: FinCEN is estimating that it takes 20 minutes to determine whether a SAR is merited, and an extra 5 minutes to document the reasons for not filing a SAR if a SAR is not merited. Financial institutions should provide comments, supported by data and information, on these estimates.   

FinCEN assumes that documenting the rationale for not filing a SAR and the storage of the case documents will involve the participation of three of the roles described above, as follows:

Table 9

JRR Comment: In Table 7, FinCEN is estimating that the work done to determine whether a SAR is merited, and a SAR results, involves 10% indirect supervision, 60% indirect supervision, and 30% clerical work. In Table 9, FinCEN is estimating that the work done to determine whether a SAR is merited, and a SAR does not result, involves 1% indirect supervision, 19% indirect supervision, and 80% clerical work. However, with the exception of documenting no-SAR decisions, this is the same work performed by the same fraud investigators or AML analysts, supervised by the same direct supervisors. The ratios of work should be the same, or roughly the same, for both processes.    

The total annual PRA burden of this stage would be 1,343,872 hours, at a total cost of $38,972,288, as described in Table 10 below:

Table 10

3. Estimate of the burden of the SAR filing process

JRR Comment: To this point, FinCEN has laid out the five categories of SARs, the six stages of the SAR filing process, and the four types of positions involved in that process. FinCEN has also described the updated or new burden and cost estimate of evaluating cases for potential SAR filing and, for those cases that result in a “no-SAR” decision, the burden and cost of documenting that decision. In this section, FinCEN turns to the burden and cost estimate of the process of preparing and filing a SAR once the decision has been made that the case merits a SAR.

But first FinCEN describes its current estimate, made ten years ago before mandatory electronic filing, before attachments were allowed, and based on the old SAR forms. That estimate, or estimates, are crude and simple: two hours for the 99% and more of SARs filed by single financial institutions, and 2.5 hours for the rare (less than 1% of the SARs) filings made jointly by two or more financial institutions.

FinCEN’s prior estimate of the traditional average burden hours associated with the SAR filing process[28] was based on a 2010 assessment of the manual effort involved in the drafting, writing, filing, and storing of a paper-based SAR with a standard narrative of 4,000 characters (i.e., one page), and the storing or segregation of paper-based supporting documentation. Since 2011, financial institutions have been able to (a) file SARs electronically either in batch or discrete format, and (b) include with their SARs an attachment containing tabular data such as transaction data providing additional suspicious activity information not suitable for inclusion in the narrative. This attachment must be an MS Excel-compatible comma separated value (CSV) file with a maximum size of 1 megabyte. These new features contribute to a substantial decrease in the hourly burden of the mechanical aspects of the filing and storage of SARs and supporting documentation.

As set out in the estimates above, the review of approximately 5,560,854 cases would result in the closing out of 3,225,295 cases, and the filing of 2,335,559 original and 416,135 continuing SARs. In the previous part, FinCEN identified a tractable segmentation of SAR complexity: (a) continuing SARs; (b) original SARs with standard content filed by non-depository institutions; (c) original SARs with extended content filed by non-depository institutions; (d) original SARs with standard content filed by depository institutions; and (e) original SARs with extended content filed by depository institutions. In all cases, the estimate represents the administrative burden involved in producing and reviewing a SAR, overseeing the process of filing a SAR, and the actual filing of a SAR, and not just the mechanical process of generating, submitting, and storing the SAR (which might be very small for fully-automated filers using the batch filing method).

FinCEN assumes that the SAR filing process involves the following four roles described in Table 6, in varying proportions depending on whether the burden accounts for the reporting or the recordkeeping stage of the process:

JRR Comment: Tables 11A, 11B, and 12 set out FinCEN’s estimates for the percentage of time and resulting cost that it takes, by role, for drafting, writing, and submitting “Standard Content” SARs (Table 11A); for drafting, writing, and submitting “Extended Content” or complex SARs (Table 11B); and for the recordkeeping required for both (Table 12). Where there were stark differences in the SAR/No SAR determinations, FinCEN estimates that there are only subtle differences in the ratio of time/cost for standard or simple SARs and extended or complex SARs. Financial institutions should assess their data and information and provide comments to FinCEN: my experience is that complex investigations are often handled by more experienced investigators/analysts, and not necessarily more supervision.

3.1. Continuing SARs

In the case of a suspicious transaction that continues over time, filers must submit continuing SARs every ninety days. Financial institutions filed 416,135 continuing SARs as part of the 2019 SAR submissions. FinCEN estimates that, on average, the burden involved in filing a continuing SAR will be relatively low, and will be substantially the same among all types of financial institutions. The estimated hourly burden and its cost for continuing SARs are as follows:

JRR Comment: FinCEN phrases these as “estimates”, but they appear to be assumptions unsupported by data rather than estimates based on data. Financial institutions should provide comments to FinCEN on the burden and costs of continuing activity SARs compared to original SARs.  

3.2. Original SARs filed by non-depository institutions

Based on the application of the percentage described in Part 1 to SARs with narratives over one page filed by non-depository institution, FinCEN identified 988,377 reports with standard content and 6,897 with extended content.

Original SARs filed by non-depository institutions (standard content)

For the purpose of calculating the burden of original SARs with standard content filed by non-depository institutions, FinCEN estimates that the average burden involved in the filing of original SARs will be higher than that of continuing SARs. Specifically, FinCEN uses an estimate of 40 minutes per batch-filed report and 60 minutes per discrete-filed report for drafting, writing, and submitting the SARs, and 5 minutes per batch-filed reports and 15 minutes per discrete-filed report for storing filed reports and supporting documentation.

JRR Comment: FinCEN has developed a much more nuanced and granular estimate of the burden and cost of filing SARs. The old methodology was a single 120 minutes (2 hours) per SAR. With this new approach, there is a low estimate of 25 minutes for batch-filed, standard content continuing SARs, all the way to 315 minutes (more than 5 hours) for discrete-filed, extended content original SARs.  All of the combinations are set out in the following sections: Depository Institution versus Non-Depository Institution; standard content versus extended content; batch-filing versus discrete-filing; and drafting, writing, and submitting SARs versus recordkeeping for SARs.

The estimated hourly burden and its cost for this subset of SARs are therefore as follows:

Original SARs filed by non-depository institutions (extended content)

For the purpose of calculating the burden of original SARs with extended content filed by non-depository institutions, FinCEN estimates that the average burden will be several times higher than that of standard content SARs, and the related cost will include a larger proportion of the levels of the organization with higher fully-loaded hourly wages (those representing indirect and direct supervision). The estimated hourly burden and its cost for this subset of SARs are therefore as follows:

3.3. Original SARs filed by depository institutions

Based on the segmentation described in Part 1 of depository institution SARs into standard content and extended content, FinCEN identified 1,313,774 reports with standard content, and 26,513 that included extended content.

The estimate of the reporting and recordkeeping burden of these two SAR subsets is as follows, using the per-SAR burden estimates included in the tables:

JRR Comment: This is another significant estimate. Of the 1,340,287 original SARs filed by banks and credit unions (roughly half of all SARs filed), only 26,513 had “extended content”, which is FinCEN’s proxy for complex or, perhaps, significant SARs.

Less than 2% of the original depository institution SARs had extended content or were otherwise complex or significant SARs. The 2018 Bank Policy Institute survey of 19 large banks found that less than 4% of those SARs garnered law enforcement interest.   

Estimated Reporting and Recordkeeping Burden:

The estimated reporting and recordkeeping burden by type of process and report is as follows:

JRR Comment: At the end of this document I have included a chart that visualizes the different estimated time burdens for the twelve (12) combinations of SAR filings: Original versus Continuing Activity; DI versus Non-DI; standard content versus extended content; and batch- versus discrete-filing.

Estimated Total Annual Reporting and Recordkeeping Burden:

The total estimated reporting and recordkeeping burden and cost per type of process and type of report are as follows. As detailed in Table 22 below, the total estimated recordkeeping and reporting annual PRA burden for the case review and SAR filing process of the seven OMB control numbers covered by this notice is 5,462,026 hours, for a total cost of $206,422,989.

JRR Comment: FinCEN estimates that the total costs of the SAR filing process (or at least the last three of the six stages of the SAR filing process) costs $206,422,989. The Bank Policy Institute survey of 19 large banks found that 14 of those banks (that responded to the survey questions on costs) reported that they spent, on aggregate, $2,400,000,000 on AML and CFT (Countering the Financing of Terrorism) compliance. FinCEN’s estimates for 12,148 SAR filers has captured less than 10% of what 14 large banks have reported in a private survey. There is some work to be done to reconcile these numbers. FinCEN acknowledges that there is work still to be done: and I acknowledge and applaud the work that FinCEN has done to date.

The distribution of the total estimated annual PRA burden and cost, by type of financial institution and SAR (original or continuing), and by SAR production process stage is as follows:[29]

FinCEN acknowledges that some of the partial estimates may over- or under-state the burden and cost of some the stages of the SAR production process covered by this notice, due to generalization and lack of more detailed information. FinCEN wishes to emphasize that the total burden presented in Table 22 is spread across a number of different SAR reporting requirements involving different types of financial institutions. Indeed, in the case of depository institutions, both FinCEN and the Federal banking agencies have regulations requiring SAR reporting.[30] However, only one SAR form is filed in satisfaction of the rules of both FinCEN and the Federal banking agencies. FinCEN has historically never attempted to allocate the burden between agencies for SARs required by the rules of more than one agency. FinCEN intends to conduct more granular studies of the filing population in the near future, to arrive at more realistic estimates that take into consideration a more specific breakdown of the SAR production process, including estimating the burden to financial institutions of Stages 1 to 3, which may include the inter-agency burden allocation referred to above. The data obtained in these studies may result in a significant variation of the estimated total annual PRA burden.

An agency may not conduct or sponsor, and a person is not required to respond to, a collection of information unless the collection of information displays a valid OMB control number. Records required to be retained under the BSA must be retained for five years.

Part 3. Request for Comments

JRR Comment: This is the most important part of the notice. FinCEN has six specific requests for comments, and also invites general comments. Financial institutions must take this opportunity to provide FinCEN with actual data and information: anecdotes that “the SAR regime costs too much and doesn’t produce tangible, direct benefits to financial institutions” must be replaced with data-driven information. Only then can better collective, public/private sector decisions be made.

a. Specific Requests for Comments:

Comments submitted in response to this notice will be summarized and/or included in the request for OMB approval. All comments will become a matter of public record. Comments are invited on the calculation of the total PRA burden of filing the SAR, under the current regulatory requirements. Specifically, comments are invited on the following issues:

1. FinCEN has based the estimates contained in this notice on the actual SARs filed in 2019. We have restricted the analysis to features we could measure and statements we were able to support with data extracted from the 2019 filers and submissions, using limited external data for estimates of parameters such as labor costs and conversion rates for alerts into filed SARs. FinCEN is not able to factor in its estimate of the PRA burden the burden of portions of the process for which FinCEN lacks information in filed reports or reliable existing studies. All requests for comments ask the public to suggest other factors that may affect the burden and cost of SAR reporting. Suggested factors that FinCEN could quantify by analyzing the contents of the BSA database, or by referring to statistical information publicly available, and without conducting a formal survey of the reporting financial institutions would be especially appreciated.

JRR Comment: FinCEN is looking for data and information that comes from (i) the BSA Database (accessible on FinCEN’s website) and other publicly available, reliable sources. FinCEN does not seem interested in survey-based information, such as the BPI survey that FinCEN has, in fact, relied on for this notice.

2. FinCEN proposes to expand the annual PRA burden estimate to cover three stages of the SAR production process: (a) the review of cases based on monitoring alerts considered true positives; (b) the documentation of the decision not to turn a case into a SAR; and (c) the SAR filing process. A sample conversion rate of cases that lead to SARs for depository institutions was used to calculate how many total cases at all financial institutions would have to be evaluated to produce the total number of original SARs filed in 2019. FinCEN invites comments on the characterization of these three stages, the general case conversion rate utilized, and the existence of other generally available research documents that may show different case conversion rates for different financial institution types.

JRR Comment: This is the critical issue. FinCEN is inviting financial institutions (and their trade associations and other interested parties) to provide comments, supported by data, on the first three stages of the SAR process that are not currently included in the PRA burden and cost estimate. Those three stages are: (1) maintaining a monitoring system; (2) reviewing alerts; and (3) transforming alerts into cases.

3. FinCEN estimates that, in general, the cost of labor involved in the three stages of the SAR production process covered by this notice will depend on the level of involvement in each stage of at least four different types of labor within the organization (general supervision, direct supervision, clerical work for evaluation, and clerical work for recordkeeping). Is this a reasonable identification of the roles involved in the SAR process? Has FinCEN calculated labor costs reasonably? Within the calculations of PRA burden, has FinCEN reasonably estimated the involvement of the different kinds of labor identified?

JRR Comment: FinCEN is also seeking comments on the four types of people, or positions, in the SAR filing process, their costs (salaries and benefits), and the relative time each spends on the five types of SARs across the six stages of the SAR filing process. The data in the Bureau of Labor Statistics materials, cited by FinCEN should be analyzed and compared against what FinCEN has used. See my comments above: hourly rates of $15 to $60 per hour for all participants in the SAR process appear to be materially low.

4. FinCEN arrived at estimates for (i) the hour burden of the review of all cases based on true positive alerts, and (ii) the decision not to file SARs based on the proportion of the cases that were not converted into original SARs. In general and on average, are these estimates reasonable?

JRR Comment: As indicated, this is really two issues that FinCEN is seeking comments on. One could argue that any estimate made in good faith is, in general and on average, reasonable. But I believe FinCEN is looking for something to support a higher standard than generally, on average, reasonable. It is incumbent on financial institutions to provide FinCEN with data and information to support a higher standard.

5. FinCEN segmented the universe of SAR filings into several different categories for purposes of estimating SAR complexity: (a) continuing SARs; (b) original SARs with standard content filed by non-depository institutions; (c) original SARs with extended content filed by non-depository institutions; (d) original SARs with standard content filed by depository institutions; and (e) original SARs with extended content filed by depository institutions. For each of these categories, FinCEN adjusted the estimated SAR filing burden depending on the filing method (batch or discrete). Is this segmentation reasonable? Are there other categories of SARs which FinCEN could quantify by analyzing the contents of the BSA database and without conducting a formal survey of the reporting financial institutions?

JRR Comment: Money Services Businesses (MSBs) were bucketed into the “non-depository institution” category along with the securities/futures industries’ institutions, casinos, card clubs, housing agencies, insurance companies, loan companies, and the “undetermined”. Given that 33% of all SARs were filed by MSBs, it may be better to have three categories: Depository Institutions, MSBs, and Other Non-Depository Institutions.

6. Are the other assumptions FinCEN made to calculate the burden associated with filing the different categories of SARs reasonable, such as the number of minutes required for each category of report?

b. General Request for Comments:

Comments submitted in response to this notice will be summarized and/or included in the request for OMB approval. All comments will become a matter of public record. Comments are invited on: (1) whether the collection of information is necessary for the proper performance of the functions of the agency, including whether the information shall have practical utility; (2) the accuracy of the agency’s estimate of the burden of the collection of information; (3) ways to enhance the quality, utility, and clarity of the information to be collected; (4) ways to minimize the burden of the collection of information on respondents, including through the use of automated collection techniques or other forms of information technology; and (5) estimates of capital or start-up costs and costs of operation, maintenance, and purchase of services to provide information.

Summary of the total time to prepare, file, and record a SAR: FinCEN PRA burden and cost estimate

Endnotes

[1] Section 358 of the USA PATRIOT Act added language expanding the scope of the BSA to intelligence or counter-intelligence activities to protect against international terrorism.

[2] Treasury Order 180-01 (re-affirmed January 14, 2020).

[3] FinCEN’s System of Records Notice for the BSA Reports System was most recently published at 79 FR 20969 (April 14, 2014).

[4] Public Law 104-13, 44 U.S.C. 3506(c)(2)(A).

[5] The SAR regulatory reporting requirements are currently covered under the following OMB control numbers: 1506-0001 (31 CFR 1020.320 – Reports by banks of suspicious transactions); 1506-0006 (31 CFR 1021.320 – Reports by casinos of suspicious transactions); 1506-0015 (31 CFR 1022.320 – Reports by money services businesses of suspicious transactions); 1506-0019 (31 CFR 1023.320 – Reports by brokers or dealers in securities of suspicious transactions, 31 CFR 1024.320 – Reports by mutual funds of suspicious transactions, and 31 CFR 1026.320 – Reports by futures commission merchants and introducing brokers in commodities of suspicious transactions); 1506-0029 (31 CFR 1025.320 – Reports by insurance companies of suspicious transactions); and 1506-0061 (31 CFR 1029.320 – Reports by loan or finance companies of suspicious transactions). The PRA does not apply to reports by one government entity to another government entity. For that reason, there is no OMB control number associated with 31 CFR 1030.320 – Reports of suspicious transactions by housing government sponsored enterprises. OMB control number 1506-0065 applies to FinCEN Report 111 – SAR.

[6] One hour of burden is estimated under each of the following OMB control numbers: 1506-0001, 1506- 0006, 1506-0015, 1506-0019, 1506-0029, and 1506-0061.

[7] See Table 1 below for a breakdown of the types of financial institutions that filed SARs in 2019. Note that all banks, casinos and card clubs, money services businesses, brokers or dealers in securities, mutual funds, providers of covered insurance products, futures commission merchants and introducing brokers in commodities, loan or finance companies, and housing government sponsored enterprises are required to comply with the SAR regulatory requirements; however, not all financial institutions identify suspicious activity that would warrant a SAR filing. See 31 CFR 1020.320 (banks), 31 CFR 1021.320 (casinos and card clubs), 31 CFR 1022.320 (money services businesses), 31 CFR 1023.320 (brokers or dealers in securities), 31 CFR 1024.320 (mutual funds), 31 CFR 1025.320 (insurance companies), 31 CFR 1026.320 (futures commission merchants and introducing brokers in commodities), 31 CFR 1029.320 (loan or finance companies), and 31 CFR 1030.320 (housing government sponsored enterprises).

[8] Despite the expanded scope, FinCEN has not presented in this notice an estimate of the entire burden that is associated with SAR filings because, as described further in Part 2, FinCEN lacks the granular data to estimate the costs of certain steps in that process.

[9] Numbers are based on actual 2019 filings as reported to the BSA E-Filing System, as of 12/31/2019. Assumptions and estimates are also based on actual 2019 SAR filings.

[10] An original (or initial) report is the first SAR filed on suspicious activity no later than 30 days after the date of initial detection by the filer. (See e.g., 31 CFR 1020.320(a)(3)). A continuing SAR must be filed on suspicious activity that continues after an initial SAR is filed. Continuing reports must be filed on successive 90-day review periods until the suspicious activity ceases, but may be filed more frequently if circumstances warrant. For more information on continuing reports, see page 142 of the FinCEN Suspicious Activity Report (FinCEN SAR) Electronic Filing Requirements – XML Schema 2.0. https://bsaefiling.fincen.treas.gov/docs/XMLUserGuide_FinCENSAR.pdf

[11] In Table 1, the category “Securities/Futures” includes brokers or dealers in securities, mutual funds, futures commission merchants, and introducing brokers in commodities. The category “Undetermined” includes filers with missing, incomplete, or contradictory information about the type of financial institution to which they belong.

[12] In batch filing, a filer submits a single electronic file containing several reports. In discrete filing, the filer fills in an electronic report individually, using a data entry screen that FinCEN provides. While exceptions apply, batch filing is generally used by large-volume filers that have automated the filing process, while discrete filing is generally employed by filers that submit fewer reports per year and rely more on manual data entry methods.

[13] The category “Other” in Table 2 includes securities and futures, housing government sponsored enterprises, providers of covered insurance products, and filers for which the type of financial institution was still being determined at the moment of publication of this notice, as defined above. We adopt the same criteria for the rest of the tables contained in the notice, such as in Tables 4A, 4B, and 5 below.

[14] The percentage of filers contained in each tranche, and the percentage of reports submitted by those filers, are contained in the fields “pct_filers” and “pct_forms”, respectively. The cumulative percentage of filers contained in all tranches up to and including the current one, and the cumulative percentage of reports submitted by such filers, are shown in the fields “cumm_pct_filers” and “cumm_pct_forms”, respectively.

[15] FinCEN Report 111 – SAR contains checkboxes that allow filers to identify a variety of suspicious activities, such as structuring, terrorist financing, fraud, money laundering, and a cyber-event. FinCEN Report 111 – SAR has 18 categories of suspicious activities.

[16] Some filers attach a supplemental file to the report that in general contains a list of individual transactions that raised the alert about a potential suspicious transaction. The length of the narrative is sometimes impacted by whether the filer submits an attachment to the report listing these transactions, or uses the narrative section of the report to include such a list.

[17] The number of suspicious activities identified in each report represents the number of check boxes selected by the filer.

[18] By “in general,” FinCEN is speaking without regard to outliers (e.g., reports exhibiting features that are uncommonly higher or lower than those of the population at large), or that apply to a very narrow type of filer or type of transaction. By “on average,” FinCEN means the mean of the distribution of each subset of the population (although FinCEN uses median labor cost data to calculate weighted hourly worker compensation allocated to each PRA burden hour in Table 6 below).

[19] FinCEN acknowledges that the description of the SAR production process in this notice seems to imply that the process is always linear, with each stage following the previous one. While this situation may reflect a large proportion of the cases reviewed and SARs filed, certain situations will require the filer to return to an earlier stage (such as requiring additional information from the case managers, or drafting several versions of a narrative). The breakdown of the SAR production process in a discrete number of linear stages is intended as a conceptual framework to guide FinCEN’s estimates of the different levels of PRA burden. Such framework does not involve or imply any modification to, or new interpretation of the actual rule text of BSA regulations. The details provided in each stage of the framework serve only as a list of the features FinCEN did or did not consider when estimating the PRA burden of such stage. While FinCEN believes the tasks described in the framework represent the work generally required to produce a SAR, there is no obligation for a financial institution to adopt either formally or informally a process such as the one presented by the framework.

[20] FinCEN recognizes that filers may use the monitoring system to comply with additional BSA and non-BSA regulatory requirements, as well as for other business purposes such as protecting against reputational risks of money laundering and fraud against the filer or the filer’s customers.

[21] See U.S. Bureau of Labor Statistics, Occupational Employment Statistics-National, May 2019, available at https://www.bls.gov/oes/tables.htm . The most recent data from the BLS corresponds to May 2019. For the benefits component of total compensation, see U.S. Bureau of Labor Statistics, Employer’s Cost per Employee Compensation as of December 2019, available at https://www.bls.gov/news.release/ecec.nr0.htm . The ratio between benefits and wages for financial activities, credit intermediation and related activities is $15.80 (hourly benefits)/$31.45 (hourly wages) = 0.502. The benefit factor is 1 plus the benefit/wages ratio, or 1.502. Multiplying each hourly wage by the benefit factor produces the fully-loaded hourly wage per position.

[22] ‘Getting to Effectiveness – Report on U.S. Financial Institution Resources Devoted to BSA/AML and Sanctions Compliance’, Bank Policy Institute, October 29, 2018, available at https://bpi.com/wp-content/uploads/2018/10/BPI-AML-Sanctions-Study-vF.pdf . See pages 5-7.

[23] The average conversion rate represents the percentage of the total number of cases that, after receiving further review and consideration, warranted the filing of a SAR.

[24] Ibid. The BPI Paper identifies several provisos regarding the correlation among the different metrics (such as the number of alerts related to AML issues only, while the number of SARs filed included both fraud and AML-related transactions). FinCEN considers that these qualifications do not affect the rationale of applying the bank conversion rate of cases into SARs to the full filer population.

[25] The number of original SARs submitted in 2019 (2,335,559) divided by the 42% conversion rate.

[26] FinCEN acknowledges that this estimate simplifies the conversion, stipulating that one case will generate or fail to generate one SAR, when in practice several cases may be reported in a single SAR. It is also possible, while not very probable, that a single case may require the filing of more than one simultaneous SAR.

[27] FinCEN’s assumption is that the clerical work involved in the case review stage would include general administrative and coordination responsibilities, such as the maintaining of agendas, documentation of minutes, assembly of files to be presented to the appropriate authority (for example, a filer’s SAR Committee), and the summarization of the reasons not to file.

[28] FinCEN’s estimate of the traditional average burden hours involved in the SAR filing process was 2 hours for SARs filed individually (60 minutes attributed to reporting, and 60 minutes attributed to recordkeeping), and 2.5 hours per SAR for joint filings (90 minutes attributed to reporting, and 60 minutes attributed to recordkeeping). Joint filings are a single SAR filed by two or more separate financial institutions. This type of filing constitutes less than 1% of total filings.

[29] FinCEN obtained the breakdown by applying the percentages of continuing and original SARs by type of financial institution listed in Table 1, to the burden and cost estimates contained in Tables 8A, 8B, 10, and 13 to 20. Financial institutions the type of which is “undetermined” are included in the “Other nondepository” category in Tables 23 and 24.

[30] See 12 CFR 208.62, 211.5(k), 211.24(f), and 225.4(f) (Federal Reserve Board); 12 CFR 353.3 (Federal Deposit Insurance Corporation); 12 CFR 748.1(c) (National Credit Union Administration); 12 CFR 21.11 and 12 CFR 163.180 (Office of the Comptroller of Currency); and 31 CFR Chapter X (FinCEN).

The Perfect Storm: More Alerts, Fewer Investigators, & More False Positives

The Focus Has Always Been On the Increase in Fraud

Natural disasters bring out the best in some people and the worst in others. Almost fifteen years ago, in the wake of Hurricane Katrina, the Department of Justice formed the National Center for Disaster Fraud[1] to coordinate the investigations and prosecutions of benefits, charities, and cyber-related frauds that sprang up when billions of dollars in federal disaster relief poured into the Gulf Coast region. In October 2017, after a series of hurricanes in the southeast US and Caribbean (Harvey, Irma, and Maria), and California wildfires, the Financial Crimes Enforcement Network (FinCEN) issued an “Advisory to Financial Institutions Regarding Disaster-Related Fraud” that described some of the same fraud scams and instructed firms how to identify and report that activity.

FinCEN Recognizes The Strain on Resources

On March 16, 2020, three days after the President declared a National Emergency in response to COVID-19, FinCEN issued a press release (not an Advisory) encouraging financial institutions to (1) communicate concerns related to the “coronavirus disease 2019 (COVID-19)”, and (2) to remain alert to related illicit financial activity.[2]

Specifically, FinCEN requested that financial institutions contact FinCEN and their functional regulator as soon as practicable if it “has concern about any potential delays in its ability to file required Bank Secrecy Act (BSA) reports.”

This is an important acknowledgment by FinCEN. The previous Advisory focused on the increase in fraud as a result of natural disasters. This press release adds another element: at the same time fraud is increasing, the ability of financial institutions to manage that increase is impacted because of the “shelter in place” or work from home requirements. To put it in simple terms, where a bank may have had 1,000 fraud alerts handled by 50 investigators prior to the pandemic, it may now have 2,000 alerts being handled by only 20 investigators.

The Third Issue – Your Existing Fraud Alerting Logic May Produce More False Positives

Not only will the alerting “numerator” be going up (that is the transactions that a financial institution’s rules find are anomalous) but the denominator, or the volume of and types of transactions, is also changing. Very simply, people transact differently because of the pandemic. There will be more cash withdrawals (both numbers and amounts), and more activity (transactions and interactions) will shift from in-person to mobile, online, and telephone.

Elder fraud is a good example of the impact of the pandemic. The older population is most at risk from COVID-19, and most at risk of various fraud schemes. The alerting logic a bank had programmed was based on historical data relating to, say, changes in elderly customers’ use of online and mobile channels. With the pandemic, elderly customers are using those channels more often, and those alerts will now be hitting on anomalous but now-expected activity. This new current activity will be different than the historical activity on which the bank based its alerting logic.

And all of this at a time when banks have fewer investigators able to handle the output: they’re at home and either unable to access bank systems or less efficient in doing so.

Communication is the Key

As FinCEN points out, financial institutions need to communicate with their regulators if they’re finding that their investigations teams cannot keep up with the increase in fraud cases. One aspect a bank needs to consider is whether it should – and can – move analysts and investigators from AML over to fraud and sanctions screening. Sanctions screening and fraud monitoring requires real- and near-time screening and monitoring to prevent transactions from occurring – whether those are transactions with sanctioned entities, possible Business E-mail Compromise (BEC) frauds, or other frauds. Sanctions and fraud analysts and investigators need to be able to prevent certain transactions and investigate others in real- or near-time. AML analysts and investigators do not operate in the same time-sensitive environment: as a general rule, an AML alert generated in March will involve activity that occurred in February, it will be investigated in April in order to determine whether it was “suspicious”, then a SAR will be filed in May. So part of the external and internal communications a bank will need to have will involve shifting its AML resources over to sanctions and fraud monitoring and investigations.

But more important are the communications banks need to have with their clients and customers to warn them about common disaster-related frauds, and the communications within the bank to adapt to the changes in overall customer activity. How will the changes in customer activity impact the sanctions and fraud monitoring, detection, and alerting systems?

It’s the perfect storm: more alerts, more false positives, fewer investigators.

[1] https://www.justice.gov/disaster-fraud

[2] https://www.fincen.gov/news/news-releases/financial-crimes-enforcement-network-fincen-encourages-financial-institutions

When it comes to BSA/AML compliance programs, success has a hundred fathers, but failure is, apparently, an orphan

“FinCEN Penalizes U.S. Bank Official for Corporate Anti-Money Laundering Failures”

In 1961 President John F. Kennedy commented on the failed Bay of Pigs invasion: “victory has a hundred fathers and defeat is an orphan”. This statement came to mind as I read the Treasury Department’s March 4, 2020 assessment of a $450,000 penalty against the former Chief Operational Risk Officer of US Bank for the bank’s failures to implement and maintain an effective anti-money laundering (AML) program. And although the bank itself, and its holding company US Bancorp, were sanctioned and paid hundreds of millions of dollars in penalties, it appears that no other officers or directors of US Bank were personally sanctioned.

I have previously written that running an AML program in an American financial institution is like Winston Churchill’s description of Russia in 1939: a riddle, wrapped in a mystery, inside an enigma. The riddle is how to meet your obligations to provide law enforcement with actionable, effective intelligence (the stated purpose of the US AML laws set out in Title 31 of the US Code). That riddle is wrapped in the mystery of how to satisfy the multiple regulatory agencies’ “safety and soundness” requirements set out in Title 12 of the US Code. And the enigma is the personal liability you face for failing to satisfy either or both of those things.

And that enigma of personal liability was recently brought front and center with the March 4, 2020, announcement from FinCEN that the former Chief Operational Risk Officer of US Bank, Michael LaFontaine, was hit with a $450,000 penalty for his failure to prevent BSA/AML violations during his seven to ten year tenure.

Before going further, keep this in mind: it is inconceivable that a single person could run an AML program in one of the largest banks in the United States. They would need hundreds if not thousands of others to help design, implement, modify, test, audit, oversee, and examine that program. Everyone from a first-year analyst to the Board of Directors. But it is equally inconceivable – with all the checks and balances built into the US financial sector regulatory regime, with the three lines of defense, and all the auditors, examiners, and directors – that a single person could single-handedly screw up that same AML program over a period of five years. Yet that is the conclusion that seems to have been made: no matter how many people were responsible for US Bank’s AML program over a five year period, only one was held accountable for it.

“FinCEN Penalizes U.S. Bank Official for Corporate Anti-Money Laundering Failures” – FinCEN Press Release

March 04, 2020

WASHINGTON—The Financial Crimes Enforcement Network (FinCEN) has assessed a $450,000 civil money penalty against Michael LaFontaine, former Chief Operational Risk Officer at U.S. Bank National Association (U.S. Bank), for his failure to prevent violations of the Bank Secrecy Act (BSA) during his tenure.  U.S. Bank used automated transaction monitoring software to spot potentially suspicious activity, but it improperly capped the number of alerts generated, limiting the ability of law enforcement to target criminal activity.  In addition, the bank failed to staff the BSA compliance function with enough people to review even the reduced number of alerts enabling criminals to escape detection.

“Mr. LaFontaine was warned by his subordinates and by regulators that capping the number of alerts was dangerous and ill-advised.  His actions prevented the proper filing of many, many SARs, which hindered law enforcement’s ability to fully combat crimes and protect people,” said FinCEN Director Kenneth A. Blanco.  “FinCEN encourages technological innovations to help fight money laundering, but technology must be used properly.”

In February 2018, FinCEN, in coordination with the Office of the Comptroller of the Currency (OCC) and the U.S. Department of Justice, issued a $185 million civil money penalty against U.S. Bank for, among other things, willfully violating the BSA’s requirements to implement and maintain an effective anti-money laundering (AML) program and to file Suspicious Activity Reports (SARs) in a timely manner.

Mr. LaFontaine was advised by two subordinates that they believed the existing automated system was inadequate because caps were set to limit the number of alerts.  The OCC warned U.S. Bank on several occasions that using numerical caps to limit the Bank’s monitoring programs based on the size of its staff and available resources could result in a potential enforcement action, and FinCEN had taken previous public actions against banks for the same activity.

Mr. LaFontaine received internal memos from staff claiming that significant increases in SAR volumes, law enforcement inquiries, and closure recommendations, created a situation where the AML staff “is stretched dangerously thin.”  Mr. LaFontaine failed to take sufficient action when presented with significant AML program deficiencies in the Bank’s SAR-monitoring system and the number of staff to fulfill the AML compliance role.  The Bank had maintained inappropriate alert caps for at least five years.

FinCEN has coordinated this action with the OCC and appreciates the assistance it provided.

FinCEN’s March 2020 action against Mr. LaFontaine was the third of a series of actions in the last five years against US Bank, its parent US Bancorp, and now, one of its former officers.

The US Bank Cases – 2015, 2018, and 2020

In October 2015 the OCC and US Bank entered into a Cease & Desist Order (on consent) for longstanding and extensive BSA/AML program failures and failures relating to suspicious activity monitoring and reporting. US Bank was compelled to perform a lengthy list of remedial actions, including a “look-back” of activity. Apparently, US Bank eventually satisfied the OCC, and in November 2018 that Order was lifted or terminated. But no individuals were singled out.

In February 2018 US Bank was hit with a series of orders and actions relating to (1) those aforementioned BSA/AML program and SAR failures, and (2) a multi-billion dollar, multi-year payday lending fraud that was effectuated, in part, through the fraudster’s accounts at US Bank (the so-called “Scott Tucker” fraud). Among other orders and penalties, US Bank and/or its parent US Bancorp paid a $75 million fine to the OCC, a $70 million fine to FinCEN, a $15 million fine to the Federal Reserve, and forfeited $453 million to the Department of Justice (and those forfeited funds were later distributed to the victims of the Scott Tucker fraud) in a federal civil case filed in the Southern District of New York (civil case no. 18CV01357). US Bank also consented to a one-count criminal charge and entered into a two-year Deferred Prosecution Agreement (DPA) with the US Attorney for the Southern District of New York. Finally, the Treasury Department brought a civil case against US Bank, also in the Southern District, to “reduce” the FinCEN $70 million penalty to a civil judgment: that was civil case no. 18CV01358. Again, no individuals were singled out.

The (former) Chief Operational Risk Officer was held personally accountable: but who is actually responsible for a bank’s BSA/AML compliance program?

US Bank – the 5th Largest Bank in the United States

Based on all the orders and civil and criminal complaints, it appears that the core period of time the government was concerned about were the years 2010 through 2014. Based on the Annual Reports of US Bank, during that period the bank had:

  • Between thirteen and fifteen directors each year. Eleven of those directors served from at least 2009 through 2014
  • A Managing Committee made up of:
    • 1 Chairman and CEO (the same person for the entire period);
    • Eight to ten Vice-Chairmen each year, one of which was the Chief Risk Officer in 2014; and
    • Four to six Executive Vice-Presidents each year, one of which was the Chief Risk Officer from 2005 through 2013, and one of which was Michael LaFontaine as Chief Operational Risk Officer in the 2012 and 2013 annual report

It’s fair to say that since US Bank listed these people – the Board of Directors and the Managing Committee – in its Annual Reports, these people were seen as being collectively responsible for overseeing and managing the affairs of US Bank.

OCC’s Regulations for BSA/AML Compliance – Title 12 of the Code of Federal Regulations

US Bank’s primary regulator is the OCC. The OCC’s regulations for a BSA/AML compliance program are set out at 12 CFR § 21.21. Subsection (a) describes the “purpose” for the section: “to assure that all national banks and savings associations establish and maintain procedures reasonably designed to assure and monitor their compliance with the requirements of subchapter II of chapter 53 of title 31, United States Code, and the implementing regulations promulgated thereunder by the Department of the Treasury at 31 CFR Chapter X.” So the purpose of the OCC’s BSA/AML program requirement is to assure that banks meet their requirements under FinCEN’s legislation and regulations.

12 CFR § 21.21 continues. Subsection (c) goes beyond mere procedures and compels banks to “develop and provide for the continued administration of a program reasonably designed to assure and monitor compliance with the recordkeeping and reporting requirements set forth in subchapter II of chapter 53 of title 31, United States Code and the implementing regulations issued by the Department of the Treasury at 31 CFR Chapter X. The compliance program must be written, approved by the national bank’s or savings association’s board of directors, and reflected in the minutes of the national bank or savings association.”

And then subsection (d) sets out the minimum contents that the program shall have. It shall:

(1) Provide for a system of internal controls to assure ongoing compliance;

(2) Provide for independent testing for compliance to be conducted by national bank or savings association personnel or by an outside party;

(3) Designate an individual or individuals responsible for coordinating and monitoring day-to-day compliance; and

(4) Provide training for appropriate personnel.

So the OCC’s regulations tell us how a bank’s program is documented, who approves it (the board of directors), and what it must contain (at a minimum, the four “pillars” from subsection (d) – internal controls, independent testing, a BSA compliance officer, and training). Those OCC regulations don’t specifically set out who is responsible for the program. But they do refer to subchapter II of chapter 53 of title 31, United States Code and the implementing regulations issued by the Department of the Treasury at 31 CFR Chapter X. What do those provide? Do those laws and regulations set out who is responsible for a bank’s BSA/AML program?

FinCEN’s Regulations for BSA/AML Compliance – Title 31 of the Code of Federal Regulations

31 CFR Part X, specifically § 1010.210, provides that “each financial institution (as defined in 31 U.S.C. 5312(a)(2) or (c)(1)) should refer to subpart B of its chapter X part for any additional anti-money laundering program requirements.” The subpart B for national banks, like US Bank, provides as follows:

31 CFR § 1020.210

Anti-money laundering program requirements for financial institutions regulated only by a Federal functional regulator, including banks, savings associations, and credit unions. A financial institution regulated by a Federal functional regulator that is not subject to the regulations of a self-regulatory organization shall be deemed to satisfy the requirements of 31 U.S.C. 5318(h)(1) if the financial institution implements and maintains an anti-money laundering program that:

(a) Complies with the requirements of §§1010.610 and 1010.620 of this chapter;

(b) Includes, at a minimum:

(1) A system of internal controls to assure ongoing compliance;

(2) Independent testing for compliance to be conducted by bank personnel or by an outside party;

(3) Designation of an individual or individuals responsible for coordinating and monitoring day-to-day compliance;

(4) Training for appropriate personnel; and

(5) Appropriate risk-based procedures for conducting ongoing customer due diligence, to include, but not be limited to:

(i) Understanding the nature and purpose of customer relationships for the purpose of developing a customer risk profile; and

(ii) Conducting ongoing monitoring to identify and report suspicious transactions and, on a risk basis, to maintain and update customer information. For purposes of this paragraph (b)(5)(ii), customer information shall include information regarding the beneficial owners of legal entity customers (as defined in §1010.230 of this chapter); and

(c) Complies with the regulation of its Federal functional regulator governing such programs.

So, other than the OCC regulation having only four pillars while the FinCEN regulation has five, neither the OCC nor the FinCEN BSA/AML program regulations specifically describe who, if anyone, in a bank, is actually responsible for the BSA/AML program. But we know from the Michael LaFontaine case that the Chief Operational Risk Officer was found personally accountable for the failures of the program.

Regulatory Guidance – the FFIEC BSA/AML Examination Manual

So if the answer isn’t in the regulation, perhaps it can be found in regulatory guidance. For BSA/AML purposes, the golden source for regulatory guidance is set out in the Federal Financial Institutions Examination Council (FFIEC) BSA/AML Examination Manual. All five editions of the Manual (from 2005 through 2014) provide: “The board of directors, acting through senior management, is ultimately responsible for ensuring that the bank maintains an effective BSA/AML internal control structure, including suspicious activity monitoring and reporting.” (At page 29 of the most recent (2014) edition).

Hmmm … that appears to indicate that the board of directors is ultimately responsible, but the “acting through senior management” interjection is confusing. But the details that follow (again, the same language since 2005) provide clarity:

BSA Compliance Officer

The bank’s board of directors must designate a qualified individual to serve as the BSA compliance officer.[1] The BSA compliance officer is responsible for coordinating and monitoring day-to-day BSA/AML compliance. The BSA compliance officer is also charged with managing all aspects of the BSA/AML compliance program and with managing the bank’s adherence to the BSA and its implementing regulations; however, the board of directors is ultimately responsible for the bank’s BSA/AML compliance.

While the title of the individual responsible for overall BSA/AML compliance is not important, his or her level of authority and responsibility within the bank is critical. The BSA compliance officer may delegate BSA/AML duties to other employees, but the officer should be responsible for overall BSA/AML compliance.  The board of directors is responsible for ensuring that the BSA compliance officer has sufficient authority and resources (monetary, physical, and personnel) to administer an effective BSA/AML compliance program based on the bank’s risk profile.

This seems pretty clear: the board of directors is ultimately responsible for the bank’s BSA/AML compliance program, and for ensuring that the BSA compliance officer has the tools to do their job.

In addition, the Manual makes it clear that the BSA Officer cannot be “layered”: the BSA Officer must directly report to and take direction from the Board. The Manual provides:

“The line of communication should allow the BSA compliance officer to regularly apprise the board of directors and senior management of ongoing compliance with the BSA.  Pertinent BSA-related information, including the reporting of SARs filed with FinCEN, should be reported to the board of directors or an appropriate board committee so that these individuals can make informed decisions about overall BSA/AML compliance.  The BSA compliance officer is responsible for carrying out the direction of the board and ensuring that employees adhere to the bank’s BSA/AML policies, procedures, and processes.”

Although banking and financial crimes regulations don’t specifically spell out who is responsible for a bank’s BSA/AML program, written guidance makes it clear that the Board of Directors is responsible for ensuring that a bank implements and maintains an effective BSA/AML program.

But that isn’t what has happened in this case. The former Chief Operational Risk Officer – not the Board of Directors, nor the BSA compliance officer(s) that should have reported directly to the Board, nor anyone on the Managing Committee of the bank – was held accountable. Why was that? The answer may lie in FinCEN’s assessment against Mr. LaFontaine.

The March 4, 2020 FinCEN Assessment of Civil Money Penalty

What were the allegations against Mr. LaFontaine?

Page 2 – “Mr. LaFontaine at various times had responsibility for overseeing U.S. Bank’s compliance program and therefore shares responsibility for the Bank’s violations of the requirements to implement and maintain an effective AML program and file SARs in a timely manner.”

So it appears from this that Mr. LaFontaine shared responsibility for the program violations. Who did he share that responsibility with? Some detail is provided on page 3:

Page 3 – “Beginning in or about January 2005, and continuing through his separation from U.S. Bank in or about June 2014, Mr. LaFontaine held senior positions within the Bank’s AML hierarchy, involving oversight of the Bank’s AML compliance functions, from approximately 2008 through April 2011, and then from October 2012 through June 2014. He was the Chief Compliance Officer (CCO) of the Bank from 2005 through 2010, at which time he was promoted to Senior Vice President and Deputy Risk Officer. Thereafter, in October 2012, Mr. LaFontaine was promoted again to Executive Vice President and Chief Operational Risk Officer. In this latter position, which Mr. LaFontaine held throughout the remainder of his employment at the Bank, he reported directly to the Bank’s Chief Executive Officer (CEO) [Footnote: From early 2014 to the end of his tenure, Mr. LaFontaine reported to the Bank’s new Chief Risk Officer and had direct communications with the Bank’s Board of Directors.] As Chief Operational Risk Officer, Mr. LaFontaine oversaw the Bank’s AML compliance department (which was referred to internally as Corporate AML), and he supervised the Bank’s CCO, AML Officer (AMLO), [Footnote: The AMLO did not report directly to Mr. LaFontaine following the hiring of new Chief AML and BSA officers in the spring and summer of 2012. After these hirings, the AMLO reported to the Bank’s CCO, who reported to Mr. LaFontaine] and AML staff.”

We don’t know why the Board of Directors, any one or more of the directors (and there were at least eleven of them that were directors during the entire period in question), or any other senior officers of US Bank (and there were about a dozen of them every year), weren’t held accountable. And in this case, in at least six (6) regulatory, civil, and criminal orders running to hundreds of pages filed over a five (5) year period, we didn’t find out who the government felt was responsible for this bank’s BSA/AML compliance program. Other than Mr. LaFontaine, who was held accountable.

But one of those documents had an interesting take on responsibility. Paragraph 18 of the Treasury Department’s civil complaint against US Bank (Case No 18CV01357, filed February 15, 2018) referenced the FFIEC BSA/AML Manual. The paragraph provided:

“18. Under the BSA/AML Manual, a bank’s risk profile informs the steps it must take to comply with each of the BSA’s requirements. To develop appropriate policies and controls, banks must identify “banking operations . . . more vulnerable to abuse by money launderers and criminals . . . and provide for a BSA/AML compliance program tailored to manage risks. Similarly, while banks must designate an individual officer responsible for ensuring compliance with the BSA, such designation is not alone sufficient. Instead, the BSA/AML Manual notes that banks are responsible for ensuring that their compliance functions have ‘resources (monetary, physical, and personnel) [necessary] to administer an effective BSA/AML compliance program based on the bank’s risk profile.’”

In fact, as set out above, that is not what the Manual provides: according to the Manual, published by the OCC and FinCEN, among many other FFIEC agencies, the board of directors is responsible for ensuring that the bank implements and maintains an effective AML program. Not the “bank”, nor, in this case, the Chief Operational Risk Officer.

Paragraph 31 of the February 15, 2018 civil complaint provided that “US Bank delegated the responsibility for ensuring that it met its obligations under the BSA to its AML compliance department, which it referred to internally as Corporate AML.”

It would have been more accurate to write “US Bank attempted to delegate the responsibility for ensuring that it met its obligations under the BSA to its AML compliance department, which it referred to internally as Corporate AML; but the Board of Directors retained ultimate responsibility.” As the Manual provides, the board of directors maintains ultimate responsibility for the bank’s BSA/AML compliance, with their board-appointed BSA compliance officer “charged with managing all aspects of the BSA/AML compliance program and with managing the bank’s adherence to the BSA and its implementing regulations.”

Based on everything that is in the various pleadings, orders, and press releases, it appears that Mr. LaFontaine didn’t do that part of his job that involved managing Corporate AML. As one of the senior officers in the chain of command of US Bank’s risk organization, and as a member of the Managing Committee in 2012 and 2013, he had some responsibility and accountability: he appears to have organizationally been positioned somewhere between the BSA officers and the Board, and apparently thwarted or ignored the warnings of the AML Officer and/or BSA Officer(s) – who should have been reporting to the Board.

There is much we don’t know about this case. No one person – not even a CEO or Chairman of the Board – has the ability to run an AML program, let alone screw up that program. But apparently the Government has concluded that one person alone can be found accountable for the failures of a mega-bank’s AML program. Which begs a few questions …

Question 1 – Did the OCC inform the Board of Directors that BSA/AML risks weren’t being managed?

Paragraph 58 of the February 2018 civil complaint provided that “… despite recommendations and warnings from the OCC dating back to 2008, the Bank failed to have [the transaction monitoring system] independently validated.”

The phrase “warnings from the OCC dating back to 2008” could be explored. In the section in the Manual titled “Examiner Determination of the Bank’s BSA/AML Aggregate Risk Profile” is the following: “when the risks are not appropriately controlled, examiners must communicate to management and the board of directors the need to mitigate BSA/AML risk.” At this point, we don’t know what the OCC told the board, or when. We do know that the OCC issued a public Cease & Desist Order (on consent) in 2015.

Question 2 – Where was Internal Audit?

Independent testing, or internal audit, is one of the four (Title 12) or five (Title 31) required (minimum) pillars of a BSA/AML compliance program. And the Exam Manual provides that “the persons conducting the BSA/AML testing should report directly to the board of directors or to a designated board committee comprised primarily or completely of outside directors.” (see page 30 of the 2006 Manual, page 12 of the 2014 Manual). Which begs the question: where was US Bank’s audit team during the six+ years that there was capping of alerts and staffing issues? Shouldn’t the audit function have reported to the Board that there were long-standing issues with the transaction monitoring system and AML staffing, and that the OCC had made recommendations and warnings that went unheeded?

Question 3 – Where were the BSA Officers?

As a former BSA Officer, this was the question that was most on my mind as I read the March 4, 2020 FinCEN Assessment, and re-read the 2015 OCC order and the orders and complaints from February 2018. Indeed, I was relieved when the March Assessment came out and it was not against any of the former BSA Officers. The 2015 and 2018 documents showed an organization that appeared to organizationally bury its BSA officers, didn’t empower them, didn’t give them the required access to the Board, and certainly didn’t provide sufficient resources to allow for an effective program (all of which has been corrected with US Bank’s current BSA Officer and organization). And the March 2020 FinCEN Assessment describes two AML Officers and one Chief Compliance Officer, all reporting directly or indirectly into Mr. LaFontaine, who raised serious concerns over a number of years. At page 10 of the Assessment is this:

“In or about November 2013, a meeting was scheduled, at the request of the Bank’s CEO, so that the AMLO and CCO could update the CEO on the Bank’s AML program. In advance of that meeting, the AMLO and CCO prepared a PowerPoint presentation that began with an “Overview of Significant AML Issues,” the first of which was “Alert volumes capped for both [Security Blanket] and [Q]uery detection methods.” The AMLO and CCO put the alert caps issue first because, from their perspective, it was the most pressing of the Bank’s AML issues.  The PowerPoint identified the alert caps as a “[c]overage gap” that “could potentially result in missed Suspicious Activity Reports.” It also said that the “[s]ystem configuration and use could be deemed a program weakness, with potential formal actions including fines, orders, and historical review of transactions.” Prior to the meeting with the CEO, Mr. LaFontaine reviewed the PowerPoint, yet failed to raise the issue of the alert caps with the CEO during the meeting, choosing instead to prioritize other compliance-related issues.”

This suggests that the CEO wanted to meet with the AMLO and CCO, yet eventually met only with their boss, Mr. LaFontaine. Who took the opportunity to bury the primary message that his BSA Officer wanted the CEO to hear: that they were capping the number of alerts coming from the transaction monitoring system.

A financial institution must not organizationally “bury” its BSA Officer (AML officer): their organizational reporting line must be no more than “two-down” from the CEO and within an independent risk organization (e.g., the BSA Officer reports to the Chief Risk Officer, who reports to the CEO) and – critically – the BSA Officer must personally and directly report to the Board.[2]

It appears from the US Bank documents that neither the organizational structure nor the lines of communication allowed the BSA Officer(s) to “apprise the board of directors and senior management of ongoing compliance with the BSA … so that these individuals can make informed decisions about overall BSA/AML compliance”, as the Exam Manual requires. And it wasn’t the Chief Operational Risk Officer that was “responsible for carrying out the direction of the board and ensuring that employees adhere to the bank’s BSA/AML policies, procedures, and processes” … it was the BSA Officer(s). But it appears those BSA Officer(s) were organizationally and/or culturally stymied from directly communicating to the Board. In fact, the paragraph immediately after the description of the CEO meeting provides that “[t]he above-described conduct by Mr. LaFontaine continued until May 2014 when the AMLO bypassed Mr. LaFontaine and sent an email to the Bank’s then-Chief Risk Officer referencing the alert caps issue.”] A BSA officer must not be forced to bypass or do end-runs around a blocking boss in order to raise issues.

But whose responsibility is it to ensure that the BSA officer has the organizational stature and resources to do their job, and to ensure that the BSA officer has direct access to senior management and the board? It is the responsibility of the Board of Directors. The Manual is clear: “The board of directors is responsible for ensuring that the BSA compliance officer has sufficient authority and resources (monetary, physical, and personnel) to administer an effective BSA/AML compliance program based on the bank’s risk profile.” It shouldn’t take the regulators and, perhaps, a whistle blower to get the bank to act (page 11 of the 2020 Assessment includes: “The Bank did not begin to address its deficient policies and procedures for monitoring transactions and generating alerts until June 2014, when questions from the OCC and reports from an internal complainant caused the Bank’s Chief Risk Officer to retain outside counsel to investigate the Bank’s practices.”).

But maybe the directors weren’t aware that they were responsible for ensuring that the bank implemented and maintained an effective AML program. Which then begs the question …

Question 4 – Where was the Law Department?

Boards rely heavily on in-house counsel. Among other duties, in-house counsel must ensure that the directors understand their legal and regulatory obligations. In the case of BSA/AML, as the Exam Manual clearly sets out, the BSA program must be in writing and approved by the Board. The Board must designate a qualified individual to serve as the BSA compliance officer. The Board is responsible for ensuring that the BSA compliance officer has sufficient authority and resources (monetary, physical, and personnel) to administer an effective BSA/AML compliance program.

The first and last thing in-house counsel should leave the Board with when they are conducting their annual board training and awareness is this: “folks, if you remember one thing, remember this: as directors, you are ultimately responsible for the bank’s BSA/AML compliance.”

Question 5 – Where were the other senior managers of the bank?

The most vexing thing about this is not what is written in the FinCEN assessment or accompanying press release, but what is not written. Anyone who has spent any time in AML compliance in a mid-size to large financial institution knows that there are hundreds to thousands of people involved in designing, implementing, testing, maintaining, auditing, overseeing, and examining an AML program. Nothing happens – or doesn’t happen – without the involvement of modelers, testers, auditors, examiners, and committees; without endless finance meetings, HR meetings, “credible challenge” meetings; without senior management buy-in and support; and without the monthly or quarterly meetings with the board of directors (or a committee of the board) and the annual review and approval of the program and appointment, or re-appointment, of the BSA compliance officer.

The Government has singled out one senior manager in the 5th largest bank in the country for failures in a critical risk program that occurred over a five or six year period: where were the other senior managers?

Which takes us back full circle to the Board of Directors …

Question 6 – If the Board of Directors is responsible for a BSA compliance program, how come the Directors were not held accountable for its failures?

We simply don’t know what the US Bank board of directors knew or didn’t know when it came to the five or six years that the bank’s AML program was, apparently, not meeting regulatory requirements. We don’t know what they approved (or didn’t approve) annually. We don’t know what management, or audit, was reporting (or not reporting) to them. We don’t know whether they understood their responsibilities under the BSA regulations and regulatory guidance. We don’t know whether their annual approval of the AML program and appointment of the BSA Officer was a rubber-stamp or a fair and credible challenge of the program, the BSA Officer, and whether the BSA Officer had the monetary, physical, and personnel resources necessary to administer an effective BSA/AML compliance program based on the bank’s risk profile (paraphrasing the Manual). But it’s fair to assume that the Government found it difficult to find anyone liable where they simply failed to do their appointed task well. “We didn’t know the AML transaction monitoring system had been capped”, or “no one told us that the AML investigations team was grossly under-staffed”, or “none of the audit reports that came to the board indicated there were any problems with the AML program” become reasonably solid defenses when someone is looking to assign blame. It is much easier to find someone liable when they were presented with a problem and failed to address it, or even worse, took actions to hide it.  That said, it may simply go back to this:

“Success has many fathers; failure is an orphan”

Michael LaFontaine was considered a rising star in the banking world. The Minneapolis/St. Paul Business Journal included him in its “40 under 40 – 2014” class. In a March 21 2014 Video Clip for the “40 Under 40” program he said “success doesn’t happen alone”. Unfortunately, it appears that the opposite is true: he appears to have been singled out and left alone when it comes to finding one person responsible for something that many were accountable for. As President Kennedy said, “victory has a hundred fathers and defeat is an orphan”. More than a dozen directors had responsibility for US Bank’s AML program; eleven served from 2009-2014; and four of those are still directors. But none were held accountable.

Conclusion

The point of this article is not to encourage the Government to impose fines on all the directors, senior management, auditors, and BSA Officers involved in a program that has failures and regulatory violations. Rather, it is to point out to all the Boards of Directors out there that they are responsible for their bank’s AML program, and with that responsibility comes accountability. Knowing that, those Boards will push the management of those banks to implement and maintain effective AML programs … and hopefully prevent another individual from the horrors of personal liability.

[1] Footnote 34 in 2014 Manual: “The bank must designate one or more persons to coordinate and monitor day-to-day compliance.  This requirement is detailed in the federal banking agencies’ BSA compliance program regulations: 12 CFR 208.63, 12 CFR 211.5(m), and 12 CFR 211.24(j) (Federal Reserve); 12 CFR 326.8 (FDIC); 12 CFR 748.2 (NCUA); 12 CFR 21.21 (OCC).”

[2] There is a third question. It doesn’t involve responsibility and accountability for a BSA program, but is important nonetheless. And that is … how do you get SAR filing rates of 30% to 80% from below-the-Line testing? Both the 2018 civil complaint and March 2020 FinCEN Assessment describe the results of a look-back conducted in 2011. Paragraph 41 of the February 2018 civil complaint provides, in part: “… in November 2011, the Bank’s AML staff concluded that, during the past year, the SAR filing rates for below threshold testing averaged between 30% and 80%. In other words, between 30% and 80% of the transactions that were reviewed during the below-threshold testing resulted in the filing of a SAR.” The most efficient transaction monitoring systems have alert-to-SAR rates of 20% – 30%. In fact, the industry laments that the “false positive” rate for most transaction monitoring systems is 95% or more, for a true positive rate of 5% or less. So having a false negative rate (which is a below-the-line testing rate) of 30% to 80% makes no sense at all. Particularly since paragraph 64 of the complaint provides that 2,121 SARs were filed as a result of a six-month look back of 24,179 alerts: an alert-to-SAR rate of about 9%. [NOTE: the average value of these “look-back” SARs was over $339,000].

Lack of Beneficial Ownership Information: a “Glaring Hole in our System” Says Treasury Secretary

On February 12, 2020, Treasury Secretary Mnuchin testified before the Senate Finance Committee on the President’s Fiscal Year 2021 budget. At the 75:22 mark of the hearing, Senator Mark Warner (D. VA) began a series of statements and questions about the lack of beneficial ownership information. Senator Warner observed that the just-submitted (February 6th) 2020 National Strategy for Combating Terrorist and Other Illicit Financing – National Strategy  – indicated that the number one vulnerability facing the U.S. efforts to combat terrorism, money laundering, and proliferation financing was the lack of beneficial ownership requirements at the time of company formation.

Senator Warren noted that “one of the key vulnerabilities identified in the report is the lack of a legally binding requirement to collect beneficial ownership at the time of company formation.” At the 76:50 mark, the Senator posed the following question:

Mr. Secretary, do you agree that one of our most urgent national security and regulatory problems is that the US Government still has no idea who really controls shell companies?

At the 77:25 mark Secretary Mnuchin replied:

“This is a glaring hole in our own system.”

What did the National Strategy have to say about lack of beneficial ownership information?

2020 National Strategy for Combating Terrorist and Other Illicit Financing – Key Vulnerability is Lack of Beneficial Ownership Information

The National Strategy listed 10 vulnerabilities. In the “Vulnerabilities Overview” section (page 12), the first of the “most significant vulnerabilities in the United States exploited by illicit actors” was “the lack of a requirement to collect beneficial ownership information at the time of company formation and after changes in ownership.” The Strategy goes on:

“Misuse of legal entities to hide a criminal beneficial owner or illegal source of funds continues to be a common, if not the dominant, feature of illicit finance schemes, especially those involving money laundering, predicate offences, tax evasion, and proliferation financing.

*****

More than two million corporations and limited liability companies (LLCs) are formed in the United States every year. Domestic shell companies continue to present criminals with the opportunity to conceal assets and activities through the establishment of a seemingly legitimate U.S. businesses. The administrative ease and low-cost of company formation in the United States provide important advantages and should be preserved for legitimate investors and businesses. However, the current lack of disclosure requirements gives both U.S. and foreign criminals a method of obfuscation that they can and have repeatedly used, here and abroad, to carry out financial crimes. There are numerous challenges for federal law enforcement when the true beneficiaries of illicit proceeds are concealed through shell or front companies. Money launderers and others involved in commercial activity intentionally conduct transactions through corporate structures in order to evade detection, and may layer such structures, much like Matryoshka dolls, across various secretive jurisdictions. In many instances, each time an investigator obtains ownership records for a domestic or foreign entity, the newly identified entity is yet another corporate entity, necessitating a repeat of the same process. While some federal law enforcement agencies may have the resources required to undertake complex (and costly) investigations, the same is often not true for state, local, and tribal law enforcement.

*****

To address a major aspect of this recognized vulnerability, FinCEN issued a Customer Due Diligence (CDD) Rule, which became fully enforceable for covered financial institutions on May 11, 2018. This rule requires, among other things, more than 23,000 covered financial institutions to identify and verify the identities of beneficial owners of legal entity customers at the time of account opening and defined points thereafter.

*****

While the CDD Rule addressed the gap of collecting beneficial ownership information at the time of account opening, there remains no categorical obligation at either the state or federal level that requires the disclosure of beneficial ownership information at the time of company formation. Treasury currently does not have the authority to require the disclosure of beneficial ownership information at the time of company formation without legislative action. The CDD
Rule is an important risk-mitigating measure for financial institutions and an equally important resource for law enforcement, but it is not a comprehensive solution to the problem and a crucial gap remains.

The United Sates is traditionally the global leader on AML/CFT. But the lack of a legally-binding requirement to collect beneficial ownership information at the time of company formation hinders the ability of all regulated sectors to mitigate risks and law enforcement’s ability to swiftly investigate those entities created to hide ownership. Crucially, this deficiency drives significant costs and delays for both the public and private sectors. The 2016 Financial Action Task Force (FATF) Mutual Evaluation Report (MER) underscored the seriousness of this deficiency. Indeed, this gap is one of the principal reasons for the United States’ failing grade regarding the efficacy of its mechanisms for beneficial ownership transparency.” (citations omitted)

Key Priorities of the US Government in Combating Terrorism, Money Laundering, and Proliferation Financing

After setting out the threats and vulnerabilities, the 2020 National Strategy turned to the US Government’s three key priorities in fighting terrorist and other illicit financial activity:

“To make this 21st century AML/CFT regime a practical reality, the U.S. government will continue to review and pursue the following key priorities: (1) modernize our legal framework to increase transparency and close regulatory gaps; (2) continue to improve the efficiency and effectiveness of our regulatory framework for financial institutions; and (3) enhance our current AML/CFT operational framework. This will include the supporting actions discussed below.” (page 39)

Priority 1: Increase Transparency and Close Legal Framework Gaps

This first priority has four supporting actions: (i) require collection of beneficial ownership information by the government at time of company formation and after ownership changes; (ii) minimize the risks of the laundering of illicit proceeds through real estate purchases; (iii) extend AML program obligations to certain financial institutions and intermediaries currently outside the scope of the BSA; and (iv) clarify or update our regulatory framework to expand coverage of digital assets.

Supporting Action: Require the Collection of Beneficial Ownership Information by the Government at Time of Company Formation and After Ownership Changes

Currently, there is no categorical obligation at the state or federal level that requires the disclosure of beneficial ownership information at the time of company formation. Also, Treasury does not have the authority to require the disclosure of beneficial ownership information at the time of company formation without legislative action. Having immediate access to accurate information about the natural person behind a company or legal entity is essential for law enforcement and other authorities to disrupt complex money laundering and proliferation financing networks. However, this must be balanced with individual privacy concerns and not be unduly burdensome for small businesses.

The Administration believes that congressional proposals to require the collection of beneficial ownership information of legal entities by FinCEN, including the Corporate Transparency Act represents important progress in strengthening national security, supporting law enforcement, and clarifying regulatory requirements. The Administration is working with Congress. The aim—pass beneficial ownership legislation in 2020. It is important that any law enacted should closely align the definition of “beneficial owner” to that in FinCEN’s CDD Rule, protect small businesses from unduly burdensome disclosure requirements, and provide for adequate access controls with respect to the information gathered under this bill’s new disclosure regime.

The ILLICIT CASH Act – A Solution to the Beneficial Ownership Vulnerability

The 2020 National Strategy refers to congressional proposals. One of those was mentioned by Senator Warren, who referred to the bipartisan support that exists in Congress for addressing this vulnerability through a Senate bill, the ILLICIT CASH Act, S.2563 before the Senate Banking Committee. Senator Warren noted that the ILLICIT CASH Act, or Improving Laundering Laws & Increasing Comprehensive Information Tracking of Criminal Activity in Shell Holdings Act (clearly one of the great “backronyms” of all time!) had the support of 4 Democrats and 4 Republicans. Title IV of that bill set out “Beneficial Ownership Disclosure Requirements”, and included provisions to establish beneficial ownership reporting requirements. Although there is bipartisan and Administration support for the bill, not everyone is as supportive: the American Bar Association, for one, opposes the bill.

The American Bar Association – Supportive of Reasonable Measures to Combat Money Laundering, But Not the ILLICIT CASH Act

The American Bar Association – ABA Position on Combating Financial Crime  – “supports reasonable and necessary domestic and international measures designed to combat money laundering and terrorist financing. However, the Association opposes legislation and regulations that would impose burdensome and intrusive gatekeeper requirements on small businesses or their attorneys or undermine the attorney-client privilege, the confidential attorney-client relationship, or the right to effective counsel.” With respect to the ILLICIT CASH Act, the ABA opposes key provisions, and expressed that opposition in a June 19, 2019 letter to the Chairman and Ranking Member of the Senate Banking Committee. ABA Letter Opposing the ILLICIT CASH Act. And on their webpage:

“The ILLICIT CASH Act would require anyone involved in a real estate purchase or sale to file a detailed report with the Treasury Department containing the name of the natural person purchasing the real estate, the amount and source of the funds received, the date and nature of the transaction, and other data. Because attorneys often represent clients in real estate transactions, the ILLICIT CASH Act would compel many attorneys to disclose confidential client information to the government, a result plainly inconsistent with state court ethics rules.”

Conclusion – Courage to Compromise Is Needed if We Are to Make Inroads in the Fight Against Terrorism, Money Laundering, and Proliferation Financing

The ABA’s concerns about burdensome and intrusive requirements and undermining the attorney-client privilege are understandable. The Treasury Department’s concerns about the vulnerabilities of, and need to amend, the broken beneficial ownership regime are understandable. Democrats and Republicans in the House and Senate, and Republicans in the White House, will need to come together to draft, pass, and enact laws to fix the broken beneficial ownership regime. All of these groups, and more, will need the courage to compromise if we are to fill the most glaring hole in our AML system.

OCC Comptroller Talks About AML “False Negatives” and Technology

Whether “False Negatives” or “False Positives”, the Answer May Not Lie Just in New or Improved Technologies, but in an Improved Mix of New Technologies and More Forgiving Regulatory Requirements


On January 24, 2020, Jo Ann Barefoot had Thomas Otting, Comptroller of the Currency, as her guest on her podcast. The link is available at Barefoot Otting Podcast. Among other things, the Comptroller talked about BSA/AML, or as he put it “AML/BSA”.

Approximately 12:00 minutes into the podcast, the Comptroller had this to say about BSA/AML:

“Are we doing it the most effective way? … what we’re doing, is it helping us catch the bad guys as they’re coming into the banking industry and taking advantage of it?”

In a discussion on technology trends, the Comptroller spoke about how banks are using new technologies to learn about their customers and for risk management. Beginning at the 20:45 mark, he stated:

“Today our AML/BSA relies upon a lot of systems to kick out a lot of data that often has an enormous amount of false negatives associated with it that requires a lot of resources to go through that false negative, and I think if we can get to the point where we have better fine-tuned data with artificial intelligence about tracking information is and the type of activities that are occurring, I think ultimately we’ll have better risk management practices within the institutions as well.”

Having been a guest on Jo Ann’s podcast myself (see Richards Podcast), I know how unforgiving the literal transcript of a podcast can be, so it is fair to write that the Comptroller’s point was that the current systems kick out a lot of false negatives that require a lot of manual investigations; and better data and artificial intelligence could reduce those false negatives, resulting in greater efficiencies and better risk management.

But it is curious that he refers to “false negatives” – which are transactions that do not alert but should have alerted – rather than “false positives” – which are transactions that did alert and, after being investigated, prove not to be suspicious and therefore falsely alerted.  The Comptroller has many issues to deal with, and it’s easy to confuse false negatives with false positives. In fairness, his ultimate point was well made: the current regulatory requirements and expectations around AML monitoring, alerting, investigations, and reporting have resulted in a regime that is not efficient (he didn’t addressed the effectiveness of the SAR regime).

At the 21:30 mark, Jo Ann Barefoot commented on the recent FinTech Hackathon she hosted that looked at using new technology to make suspicious activity  monitoring and reporting more efficient and effective, and stated that “we need to get rid of the false flags in the system” (I got the sense that she was uncomfortable with using the Comptroller’s phrase of “false negatives” – Jo Ann is well-versed in BSA and AML and familiar with the issue of high rates of false positives). Comptroller Otting replied:

“If you think just in the SARs space, that 7 percent of transactions kind of hit the tripwire, and then ultimately about 2 percent generally have SARs filed against them, that 5 percent is an enormous amount of resources that organizations are dedicating towards that compliance function that I’m convinced that with new technology we can improve that process.”

Again, podcast transcripts can be unforgiving, and I believe the point that the Comptroller was making was that a small percentage of transactions are alerted on by AML monitoring systems, and an even smaller percentage of those alerts are eventually reported in SARs. His percentages, and math, may not foot back to any verifiable data, but his point is sound: the current AML monitoring, alerting, investigations, and reporting system isn’t as efficient as it should be and could be (again, he didn’t address its effectiveness).

I don’t believe that the inefficiencies in the current AML system are wholly caused by outdated or poorly deployed technology. Rather, financial institutions are (rightfully) deathly afraid of a regulatory sanction for missing a potentially suspicious transaction, and will err on the side of alerting and filing on much more than is truly suspicious. For larger institutions, it will cost them a few million dollars more to run at a 95% false positive rate rather than an 85% rate, or 75% rate (I address the question of what is a good false positive rate in one of the articles, below), but those institutions know that by doing so, they avoid the hundreds of millions of dollars in potential fines for missing that one big case, or series of cases, that their regulator, with hindsight, determines should have been caught.

Running an AML monitoring and surveillance program that produces 95% false positives is not “helping us catch the bad guys that are taking advantage of the banking industry” as the Comptroller noted at the beginning of the podcast. Perhaps a renewed and coordinated, cooperative effort between technologists, bankers, BSA/AML professionals, law enforcement, and the Office of the Comptroller of the Currency can lead us to a monitoring/surveillance regime enhanced with more effective technologies and better feedback on what is providing tactical and strategic value to law enforcement … and, hopefully, tempered by a more forgiving regulatory approach.

Below are two articles I’ve written on monitoring, false positive rates, the use of artificial intelligence, among other things. Let’s work together to get to a more effective and efficient AML regime.

Rules-Based Monitoring, Alert to SAR Ratios, and False Positive Rates – Are We Having The Right Conversations?

This article was published on December 20, 2018. It is available at RegTech Article – Are We Having the Right Conversations?

There is a lot of conversation in the industry about the inefficiencies of “traditional” rules-based monitoring systems, Alert-to-SAR ratios, and the problem of high false positive rates. Let me add to that conversation by throwing out what could be some controversial observations and suggestions …

Current Rules-Based Transaction Monitoring Systems – are they really that inefficient?

For the last few years AML experts have been stating that rules-based or typology-driven transaction monitoring strategies that have been deployed for the last 20 years are not effective, with high false positive rates (95% false positives!) and enormous staffing costs to review and disposition all of the alerts.  Should these statements be challenged? Is it the fact the transaction monitoring strategies are rules-based or typology-driven that drives inefficiencies, or is it the fear of missing something driving the tuning of those strategies? Put another way, if we tuned those strategies so that they only produced SARs that law enforcement was interested in, we wouldn’t have high false positive rates and high staffing costs.  Graham Bailey, Global Head of Financial Crimes Analytics at Wells Fargo, believes it is a combination of basic rules-based strategies coupled with the fear of missing a case. He writes that some banks have created their staffing and cost problems by failing to tune their strategies, and by “throwing orders of magnitude higher resources at their alerting.”  He notes that this has a “double negative impact” because “you then have so many bad alerts in some banks that they then run into investigators’ ‘repetition bias’, where an investigator has had so many bad alerts that they assume the next one is already bad” and they don’t file a SAR. So not only are the SAR/alert rates so low, you run the risk of missing the good cases.

After 20+ years in the AML/CTF field – designing, building, running, tuning, and revising programs in multiple global banks – I am convinced that rules-based interaction monitoring and customer surveillance systems, running against all of the data and information available to a financial institution, managed and tuned by innovative, creative, courageous financial crimes subject matter experts, can result in an effective, efficient, proactive program that both provides timely, actionable intelligence to law enforcement and meets and exceeds all regulatory obligations. Can cloud-based, cross-institutional, machine learning-based technologies assist in those efforts? Yes! If properly deployed and if running against all of the data and information available to a financial institution, managed and tuned by innovative, creative, courageous financial crimes subject matter experts.

Alert to SAR Ratios – is that a ratio that we should be focused on?

A recent Mid-Size Bank Coalition of America (MBCA) survey found the average MBCA bank had: 9,648,000 transactions/month being monitored, resulting in 3,908 alerts/month (0.04% of transactions alerted), resulting in 348 cases being opened (8.9% of alerts became a case), resulting in 108 SARs being filed (31% of cases or 2.8% of alerts). Note that the survey didn’t ask whether any of those SARs were of interest or useful to law enforcement. Some of the mega banks indicate that law enforcement shows interest in (through requests for supporting documentation or grand jury subpoenas) 6% – 8% of SARs.

So I argue that the Alert/SAR and even Case/SAR (in the case of Wells, Package/Case and Package/SAR) ratios are all of interest, but tracking to SARs filed is a little bit like a car manufacturer tracking how many cars it builds but not how many cars it sells, or how well those cars perform, how well they last, and how popular they are.  The better measure for AML programs is “SARs purchased”, or SARs that provide value to law enforcement.

How do you determine whether a SAR provides value to Law Enforcement? One way would be to ask Law Enforcement, and hope you get an answer. That could prove to be difficult.  Can you somehow measure Law Enforcement interest in a SAR?  Many banks do that by tracking grand jury subpoenas received to prior SAR suspects, Law Enforcement requests for supporting documentation, and other formal and informal requests for SARs and SAR-related information. As I write above, an Alert-to-SAR rate may not be a good measure of whether an alert is, in fact, “positive”. What may be relevant is an Alert-to-TSV SAR rate (see my previous article for more detail on TSV SARs).  What is a “TSV SAR”? A SAR that has Tactical or Strategic Value to Law Enforcement, where the value is determined by Law Enforcement providing a response or feedback to the filing financial institution within five years of the filing of the SAR that the SAR provided tactical (it led to or supported a particular case) or strategic (it contributed to or confirmed a typology) value. If the filing financial institution does not receive a TSV SAR response or feedback from law enforcement or FinCEN within five years of filing a SAR, it can conclude that the SAR had no tactical or strategic value to law enforcement or FinCEN, and may factor that into decisions whether to change or maintain the underlying alerting methodology. Over time, the financial institution could eliminate those alerts that were not providing timely, actionable intelligence to law enforcement, and when that information is shared across the industry, others could also reduce their false positive rates.

Which leads to …

False Positive Rates – if 95% is bad … what’s good?

There is a lot of lamenting, and a lot of axiomatic statements, about high false positive rates for AML alerts: 95% or even 98% false positive rates.  I’d make three points.

First, vendors selling their latest products, touting machine learning and artificial intelligence as the solution to high false positive rates, are doing what they should be doing: convincing consumers that their current product is out-dated and ill-equipped for its purpose by touting the next, new product. I argue that high false positive rates are not caused by the current rules-based technologies; rather, they’re caused by inexperienced AML enthusiasts or overwhelmed AML experts applying rules that are too simple against data that is mis-labeled, incomplete, or simply wrong, and erring on the side of over-alerting and over-filing for fear of regulatory criticism and sanctions.

If the regulatory problems with AML transaction monitoring were truly technology problems, then the technology providers would be sanctioned by the regulators and prosecutors.  But an AML technology provider has never been publicly sanctioned by regulators or prosecutors … for the simple reason that any issues with AML technology aren’t technology issues: they are operator issues.

Second, are these actually “false” alerts? Rather, they are alerts that, at the present time, based on the information currently available, do not rise to the level of either (i) requiring a complete investigation, or (ii) if completely investigated, do not meet the definition of “suspicious”. Regardless, they are now valuable data points that go back into your monitoring and case systems and are “hibernated” and possibly come back if that account or customer alerts at a later time, or there is another internally- or externally-generated reason to investigate that account or customer.

Third, if 95% or 98% false positive rates are bad … what is good? What should the target rate be? I’ll provide some guidance, taken from a Treasury Office of Inspector General (OIG) Report: OIG-17-055 issued September 18, 2017 titled “FinCEN’s information sharing programs are useful but need FinCEN’s attention.” The OIG looked at 314(a) statistics for three years (fiscal years 2010-2012) and found that there were 711 314(a) requests naming 8,500 subjects of interest sent out by FinCEN to 22,000 financial institutions. Those requests came from 43 Law Enforcement Agencies (LEAs), with 79% of them coming from just six LEAs (DEA, FBI, ICE, IRS-CI, USSS, and US Attorneys’ offices). Those 711 requests resulted in 50,000 “hits” against customer or transaction records by 2,400 financial institutions.

To analogize those 314(a) requests and responses to monitoring alerts, there were 2,400 “alerts” (financial institutions with positive matches) out of 22,000 “transactions” (total financial institutions receiving the 314(a) requests). That is an 11% hit rate or, arguably, a 89% false positive rate. And keep in mind that in order to be included in a 314(a) request, the Law Enforcement Agency must certify to FinCEN that the target “is engaged in, or is reasonably suspected based on credible evidence of engaging in, terrorist activity or money laundering.” So Law Enforcement considered that all 8,500 of the targets in the 711 requests were active terrorists or money launderers, and 11% of the financial institutions positively responded.

With that, one could argue that a “hit rate” of 10% to 15% could be optimal for any reasonably designed, reasonably effective AML monitoring application.

But a better target rate for machine-generated alerts is the rate generated by humans. Bank employees – whether bank tellers, relationship managers, or back-office personnel – all have the regulatory obligation of reporting unusual activity or transactions to the internal bank team that is responsible for managing the AML program and filing SARs. For the twenty plus years I was a BSA Officer or head of investigations at large multi-national US financial institutions, I found that those human-generated referrals resulted in a SAR roughly 40% to 50% of the time.

An alert to SAR ratio goal of machine-based alert generation systems should be to get to the 40% to 50% referral-to-SAR ratio of human-based referral generation programs.

Flipping the Three AML Ratios with Machine Learning and Artificial Intelligence (why Bartenders and AML Analysts will survive the AI Apocalypse)

This article was posted on December 14, 2018. It remains the most viewed article on my website. It is available at RegTech Article – Flipping the Ratios

Machine Learning and Artificial Intelligence proponents are convinced – and spend a lot of time trying to convince others – that they will disrupt and revolutionize the current “broken” AML regime. Among other targets within this broken regime is AML alert generation and disposition and reducing the false positive rate (more on false positives in another article!). The result, if we believe the ML/AI community, is a massive reduction in the number of AML analysts that are churning through the hundreds and thousands of alerts, looking for the very few that are “true positives” worthy of being labelled “suspicious” and reported to the government.

But is it that simple? Can the job of AML Analyst be eliminated or dramatically changed – in scope and number of positions – by machine learning and AI? Much has been and continues to be written about the impact of artificial intelligence on jobs.  Those writers have categorized jobs along two axes – a Repetitive-to-Creative axis, and an Asocial-to-Social axis – resulting in four “buckets” of jobs, with each bucket of jobs being more or less likely to be disrupted or even eliminated:

A good example is the “Social & Repetitive” job of Bartender: Bartenders spend much of their time doing very routine, repetitive tasks: after taking a drink order, they assemble the correct ingredients in the correct amounts, and put those ingredients in the correct glass, then present the drink to the customer. All of that could be more efficiently and effectively done with an AI-driven machine, with no spillage, no waste, and perfectly poured drinks. So why haven’t we replaced bartenders? Because a good bartender has empathy, compassion, and instinct, and with experience can make sound judgments on what to pour a little differently, when to cut-off a customer, when to take more time or less with a customer. A good bartender adds value that a machine simply can’t.

Another example could be the “Asocial & Creative” (or is it “Social & Repetitive”?) job of an AML Analyst: much of an AML Analyst’s time is spent doing very routine, repetitive tasks: reviewing the alert, assembling the data and information needed to determine whether the activity is suspicious, writing the narrative. So why haven’t we replaced AML Analysts? Because a good Analyst, like a good bartender, has empathy, compassion, and instinct, and with experience can make sound judgments on what to investigate a little differently, when to cut-off an investigation, when to take more time or less on an investigation. A good Analyst adds value that a machine simply can’t.

Where AI and Machine Learning, and Robot Process Automation, can really help is by flipping the three currently inefficient AML ratios:

  1. The False Positive Ratio– the currently accepted, but highly axiomatic and anecdotal, ratio is that 95% to 98% of alerts do not result in SARs, or are “false positives” … although no one has ever boldly stated what an effective or acceptable false positive rate is (even with ROC curves providing some empirical assistance), perhaps the ML/AI/RPA communities can flip this ratio so that 95% of alerts result in SARs. If they can do this, they can also convince the regulatory community that this new ratio meets regulatory expectations (because as I’ll explain in an upcoming article, the  false positive ratio problem may be more of a regulatory problem than a technology problem).
  2. The Forgotten SAR Ratio– like false positive rates, there are anecdotes and some evidence that very few SARs provide tactical or strategic value to law enforcement. Recent Congressional testimony suggests that ~20% of SARs provide TSV (tactical or strategic value) to law enforcement … perhaps the ML/AI/RPA communities can help to flip this ratio so that 80% of SARs are TSV SARs. This also will take some effort from the regulatory and law enforcement communities.
  3. The Analysts’ Time Ratio– 90% of an AML Analyst’s time can be spent simply assembling the data, information, and documents needed to investigate a case, and only 10% of their time thinking and using their empathy, compassion, instinct, judgment, and experience to make good decisions and file TSV SARs … perhaps the ML/AI/RPA communities can help to flip this ratio so that Analysts spend 10% of their time assembling and 90% of their time thinking.

We’ve seen great strides in the AML world in the last 5-10 years when it comes to applying machine learning and creative analytics to the problems of AML monitoring, alerting, triaging, packaging, investigations, and reporting. My good friend and former colleague Graham Bailey at Wells Fargo designed and deployed ML and AI systems for AML as far back as 2008-2009, and the folks at Verafin have deployed cloud-based machine learning tools and techniques to over 1,600 banks and credit unions.

I’ve outlined three rather audacious goals for the machine learning/artificial intelligence/robotic process automation communities:

  1. The False Positive Ratio – flip it from 95% false positives to 5% false positives
  2. The Forgotten SAR Ratio – flip it from 20% TSV SARs to 80% TSV SARs
  3. The Analysts’ Time Ratio – flip it from 90% gathering data to 10% gathering data

Although many new AML-related jobs are being added – data scientist, model validator, etc. – and many existing AML-related jobs are changing, I am convinced that the job of AML Analyst will always be required. Hopefully, it will shift over time from being predominantly that of a gatherer of information and more of a hunter of criminals and terrorists. But it will always exist. If not, I can always fall back on being a Bartender. Maybe …

PETITION DENIED – The US Supreme Court Defends the SAR Safe Harbor!

Updated February 24, 2020 – The US Supreme Court denied a petition that challenged the SAR Safe Harbor

On September 13, 2020 a petition was filed with the US Supreme Court asking the Court to take up a case to decide whether the so-called “safe harbor” provision gives banks and bank employees absolute immunity from any liability when filing a Suspicious Activity Report, or SAR, or something less than absolute immunity.  The case is AER Advisors, Inc., Deutsche et al., Petitioners v. Fidelity Brokerage Services, LLC, petition for writ of certiorari, Docket 19-347 (US Supreme Court).[1] It was “distributed for conference” on January 22, 2020, and the conference – or meeting of the Justices – was scheduled for, and held on, February 21, 2020. On February 24th the Court published its decision: PETITION DENIED!

This was a critical case for the US anti-money laundering regime. In this case, the Court of Appeals for the First Circuit held that Fidelity had absolute immunity in filing Suspicious Activity Reports, and dismissed the petitioners’ claims against Fidelity that it filed a SAR against the petitioners in bad faith. The petitioners sought review by way of a petition for writ of certiorari – basically, an appeal – to the US Supreme Court.

The petitioners framed the main question as whether 31 USC section 5318(g), added by the Annunzio-Wylie Money Laundering Act of 1992, confers (a) absolute immunity for any disclosure; or (b) immunity only if the disclosure is an objectively possible criminal violation and/or is made in good faith and/or is not fraudulent.[2] The respondent Fidelity framed the main question differently: Is a financial institution immune from private suit under the Bank Secrecy Act when it files a Suspicious Activity Report as required by the Act?

The section in question is unequivocal:

31 USC s. 5318(g)(3) Liability for Disclosures

(A) In general. –Any financial institution that makes a voluntary disclosure of any possible violation of law or regulation to a government agency or makes a disclosure pursuant to this subsection or any other authority, and any director, officer, employee, or agent of such institution who makes, or requires another to make any such disclosure, shall not be liable to any person under any law or regulation of the United States, any constitution, law, or regulation of any State or political subdivision of any State, or under any contract or other legally enforceable agreement (including any arbitration agreement), for such disclosure or for any failure to provide notice of such disclosure to the person who is the subject of such disclosure or any other person identified in the disclosure.

Leaving aside all the legal arguments, Fidelity’s Opposition Brief includes an interesting description of the policy considerations favoring absolute immunity for financial institutions for filing Suspicious Activity Reports (beginning on page 18, the policy consideration began with “if financial institutions face liability for filing a report …”). As I began reading that section, I (as a former large bank BSA Officer responsible for the filing of well over one million SARs over the years) immediately thought of two things.

First, counsel was (rightly) focused on his client, the financial institution. But as I read the case, I was thinking “what about the BSA Officer who is the FIRST person the plaintiff’s lawyer is going to sue?!” And “who cares about the financial institution that makes a gazillion dollars a year … what about the poor BSA Officer?!”.

After recovering from that, I then thought that the obvious policy consideration favoring absolute immunity was the chilling effect that anything but absolute immunity would have on the way a BSA program is run. Without that absolute immunity, you would need to have multiple layers of review of every possible SAR, quality assurance reviews, testing requirements, auditing of those processes, etc. You would need to have multiple sign-offs on every SAR, then checking and testing of the policies and procedures and processes supporting those sign-offs. You would have checkers checking checkers checking checkers. And with large banks filing hundreds of SARs every business day, the process and personnel requirements to review every SAR for a “good faith” standard, could double the number of people needed to investigate, prepare, and file SARs. (my mind then drifted back to the personal liability of the BSA Officer overseeing such a program and of the supervisors and managers reviewing SARs).

In short, BSA Officers and AML investigations teams would be overwhelmed with oversight, to the point of paralysis. The effect of a limited or qualified immunity would be to have no immunity, and the BSA regime as we know it – monitoring for unusual activity, investigating that activity, and to the best of your ability and based on all the available facts, filing reports of suspicious activity – would end.

But none of that was on the mind of the lawyers. No, they weren’t worried about the potential impact on the suspicious activity reporting regime itself, or the BSA personnel in financial institutions facing personal ruin from plaintiffs/ law suits, they were worried about the burden on the financial institutions and on the institutions’ lawyers and the cost of those lawyers. At page 18 counsel for Fidelity wrote:

“… policy considerations favor absolute immunity. ‘Any qualification on immunity poses practical problems.’ Id. The most immediate problem is ‘a risk of second guessing.’ Id. If financial institutions face liability for filing a report, they may delay reporting or under report. Id. But even where a financial institution has a good-faith belief that a law has been violated, the institution may still think twice before reporting if Petitioners’ view of the law prevailed … In the face of potential litigation burdens of this magnitude, there is a substantial risk that financial institutions would be chilled in the filing of suspicious activity reports. Institutions will certainly think twice before reporting if expensive litigation is the cost of complying with the law. And because institutions file millions of these reports a year, if these reports were subject to litigation, financial institutions would be overwhelmed.”

Now, this is not to say that counsel is wrong. Indeed, he is right: institutions will certainly think twice before reporting suspicious activity if expensive litigation is the cost of doing so. But as a former BSA Officer, I would have felt better if one of the policy considerations favoring absolute immunity for filing Suspicious Activity Reports – even the primary policy consideration – was to protect the men and women on the front lines of financial institutions’ AML programs from second-guessing and personal liability for doing their jobs as best they can: for filing the Suspicious Activity Reports that give law enforcement and intelligence agencies the actionable, timely intelligence they need to protect the financial system from money laundering, terrorism, and other crimes. Not to protect the lawyers.

Interpreting statutes – what does the Supreme Court look at?

There is plenty of case law on how courts interpret a statute, or a part of a statute. An example is a famous case* the US Supreme Court decided in 2015, King et al v Burwell et al, 576 US 988 (2015). This is the “ObamaCare” decision where the Supreme Court was considering the requirement in the law that people had to purchase insurance on an exchange established by their state, or, if there was no such state exchange, the federal exchange. In particular, the Court was considering whether a tax credit was available to individuals who purchased insurance on the federal exchange. The phrase in question was “an Exchange established by the State”, because tax credits were only available to those who purchased insurance on “an Exchange established by the State”. The decision of the majority of the Court was 21 pages long. At the end was the following:

Reliance on context and structure in statutory interpretation is a “subtle business, calling for great wariness lest what professes to be mere  rendering becomes creation and attempted interpretation of legislation becomes legislation itself.” Palmer v. Massachusetts, 308 U. S. 79, 83 (1939).
For the reasons we have given, however, such reliance is appropriate in this case, and leads us to conclude that Section 36B allows tax credits for insurance purchased on any Exchange created under the Act. Those credits are necessary for the Federal Exchanges to function like their State Exchange counterparts, and to avoid the type of calamitous result that Congress plainly meant to avoid.
* * *
In a democracy, the power to make the law rests with those chosen by the people. Our role is more confined—“to say what the law is.” Marbury v. Madison, 1 Cranch 137, 177 (1803). That is easier in some cases than in others. But in every case we must respect the role of the Legislature, and take care not to undo what it has done. A fair reading of legislation demands a fair understanding of the legislative plan. Congress passed the Affordable Care Act to improve health insurance markets, not to destroy them. If at all possible, we must interpret the Act in a way that is consistent with the former, and avoids the latter. Section 36B can fairly be read consistent with what we see as Congress’s plan, and that is the reading we adopt.

The judgment of the United States Court of Appeals for
the Fourth Circuit is Affirmed.

* The case is famous not only because it upheld a main provision of the Affordable Care Act, but also because of the blistering dissent of Justice Antonin Scalia, a dissent that included his famous phrase “interpretive jiggery-pokery”. Among other things, Justice Scalia wrote:

“The Court holds that when the Patient Protection and Affordable Care Act says “Exchange established by the State” it means “Exchange established by the State or the Federal Government.” That is of course quite absurd, and the Court’s 21 pages of explanation make it no less so.” (Dissent, page 1)

Then, after almost 8 pages of examples of the poor reasoning of the majority, Justice Scalia unloads his famous line:

“The Court’s next bit of interpretive jiggery-pokery involves other parts of the Act that purportedly presuppose the availability of tax credits on both federal and state Exchanges.”

Page 12 was, perhaps, an even better line: “For its next defense of the indefensible, the Court turns to the Affordable Care Act’s design and purposes.” And at page 17 is: “Perhaps sensing the dismal failure of its efforts to show that “established by the State” means “established by the State or the Federal Government,” the Court tries to palm off the pertinent statutory phrase as “inartful drafting.” Ante, at 14. This Court, however, has no free-floating power “to rescue Congress from its drafting errors.” Lamie v. United States Trustee, 540 U. S. 526, 542 (2004) (internal quotation marks omitted). Only when it is patently obvious to a reasonable reader that a drafting mistake has occurred may a court correct the mistake.”

And in closing on page 21: “The somersaults of statutory interpretation they have performed (“penalty” means tax, “further [Medicaid] payments to the State” means only incremental Medicaid payments to the State, “established by the State” means not established by the State) will be cited by litigants endlessly, to the confusion of honest jurisprudence. And the cases will publish forever the discouraging truth that the Supreme Court of the United States favors some laws over others, and is prepared to do whatever it takes
to uphold and assist its favorites.  I dissent.”

How did the Supreme Court rule?

The Supreme Court simply denied the petition. But in the original article that appeared on this site, I asked that the US Supreme Court “refuse to take this case up and send it back to the 1st Circuit with an affirmation of the Safe Harbor for banks, lawyers, and BSA Officers alike” and:

To John Roberts and the Supremes, as you consider whether to take this case, please remember the words of Diana Ross and the Supremes:

Stop! In the name of love
Before you break my heart
Think it over
Think it over

[1] https://www.supremecourt.gov/search.aspx?filename=/docket/docketfiles/html/public/19-347.html

[2] An interesting quirk appeared in Annunzio-Wylie. Section 1517, titled “suspicious transactions and enforcement programs”, intended to add subsections (g) and (h) to section 5318 of title 31. As AML practitioners know, 5318(g) is the suspicious activity reporting requirement, and 5318(h) is the AML program requirement. However, section 1517 of Annunzio-Wylie had a typographical error, and instead of adding (g) and (h) to section 5318, it added them to section 5314, the section requiring records and reports on foreign financial agency transactions (the so-called “FBAR” section, or Foreign Bank Account Report section). This typo wasn’t corrected until two years later by section 330017(b) of the Violent Crime Control & Law Enforcement Act of 1994, PL 103-322, enacted on September 13, 1994. That section provided: “Amendment relating to Title 31, U.S.C.— (1) Effective as of the date of enactment of the Annunzio Wylie Anti-Money Laundering Act, section 1517(b) of that Act is amended by striking ‘‘5314’’ and inserting ‘‘5318’’.” In another oddity, one day after the Violent Crime Control Act was sent to the President to be signed, the Money Laundering Suppression Act (MLSA) was sent to the President. The MLSA also included a section to correct the 1992 typo; in fact, section 413(b)(1) of the MLSA was identical to section 330017(b) of the Violent Crime Control Act. Congress made doubly sure to fix the typo!