Bank Secrecy Act
Increased Use of Exemption Provisions Could Reduce Currency Transaction Reporting While Maintaining Usefulness to Law Enforcement Efforts Gao ID: GAO-08-355 February 21, 2008To aid law enforcement efforts against financial crimes, under the Bank Secrecy Act (BSA) depository institutions must file the Treasury Department's Financial Crimes Enforcement Network's (FinCEN) currency transaction report (CTR) form on their customers' cash transactions of more than $10,000. While FinCEN's regulations allow institutions to exempt certain customers, over 15 million CTRs were filed in 2006. Public Law 109-351 directed GAO to report on (1) the usefulness of CTRs to law enforcement; (2) depository institutions' costs of meeting CTR requirements; and (3) ways to encourage use of exemptions to avoid unnecessary CTRs. Among other things, GAO obtained data from FinCEN on CTRs and exemptions from 2004 to 2006, surveyed 115 state and local law enforcement agencies and 680 depository institutions, held structured interviews with officials of federal agencies and depository institutions, and reviewed relevant laws and regulations.
According to federal, state, and local law enforcement officials, CTRs provide unique and reliable information essential to a variety of efforts, and recent advances in technology have enhanced law enforcement agencies' ability to use CTR data by integrating it with other information. In addition to supporting specific investigations, CTR requirements aid law enforcement by forcing criminals attempting to avoid reportable transactions to act in ways that increase chances of detection through other methods. Linking law enforcement's use of CTRs to specific outcomes is difficult, however, because agencies do not track their use of CTRs, which are typically one of many information sources used in investigations. FinCEN does not routinely publish summary information on law enforcement uses of CTR data--as it does for other data required under the BSA--that could help depository institutions understand the value of CTRs. While fewer than 30 of the largest U.S. depository institutions accounted for over half of new CTRs filed during the period GAO examined, all of the nation's approximately 17,000 institutions incur some costs to meet CTR requirements. Institutions must have processes and staff in place to identify when and if a CTR is required, as well as the ability to aggregate same-day cash transactions by or on behalf of the same person; file CTRs correctly; and, if desired, establish and maintain exemptions for certain customers. Institutions GAO contacted were generally unable to quantify these costs, in large part because they use the same processes and staff for other purposes. While automation has made CTR tasks less difficult, almost all institutions reported that they have not completely automated all steps, such as reviews of CTRs by institution officials. GAO's work identified a number of factors that deter use of exemptions, as well as opportunities for increasing their use, thereby reducing the number of CTRs that are likely of little or no value to law enforcement efforts. As reasons for not exempting eligible customers, institutions cited uncertainty about the documentation required to demonstrate that some customers are in fact eligible, along with concern that federal banking regulators (who examine institutions for compliance with CTR requirements) would find fault. Institutions also cited as deterrents the need to meet FinCEN's regulatory requirements to (1) file an exemption form, and annually review the supporting data, particularly for hundreds of customers that are specifically exempted by statute; and (2) biennially renew eligibility for some customers--a process that as a practical matter duplicates the required annual reviews for those customers. Institution officials indicated that additional guidance from FinCEN, as well as Web-based material to help train their staff in making exemption determinations, could increase the use of exemptions. Removing regulatory deterrents and providing additional guidance and Web-based material could help depository institutions avoid filing unnecessary CTRs without harming law enforcement efforts.
RecommendationsOur recommendations from this work are listed below with a Contact for more information. Status will change from "In process" to "Open," "Closed - implemented," or "Closed - not implemented" based on our follow up work.
Director: Team: Phone:GAO-08-355, Bank Secrecy Act: Increased Use of Exemption Provisions Could Reduce Currency Transaction Reporting While Maintaining Usefulness to Law Enforcement Efforts
This is the accessible text file for GAO report number GAO-08-355
entitled 'Bank Secrecy Act: Increased Use of Exemption Provisions Could
Reduce Currency Transaction Reporting While Maintaining Usefulness to
Law Enforcement Efforts' which was released on February 21, 2008.
This text file was formatted by the U.S. Government Accountability
Office (GAO) to be accessible to users with visual impairments, as part
of a longer term project to improve GAO products' accessibility. Every
attempt has been made to maintain the structural and data integrity of
the original printed product. Accessibility features, such as text
descriptions of tables, consecutively numbered footnotes placed at the
end of the file, and the text of agency comment letters, are provided
but may not exactly duplicate the presentation or format of the printed
version. The portable document format (PDF) file is an exact electronic
replica of the printed version. We welcome your feedback. Please E-mail
your comments regarding the contents or accessibility features of this
document to Webmaster@gao.gov.
This is a work of the U.S. government and is not subject to copyright
protection in the United States. It may be reproduced and distributed
in its entirety without further permission from GAO. Because this work
may contain copyrighted images or other material, permission from the
copyright holder may be necessary if you wish to reproduce this
material separately.
Report to Congressional Committees:
February 2008:
Bank Secrecy Act:
Increased Use of Exemption Provisions Could Reduce Currency Transaction
Reporting While Maintaining Usefulness to Law Enforcement Efforts:
GAO-08-355:
GAO Highlights:
Highlights of GAO-08-355, a report to congressional committees.
Why GAO Did This Study:
To aid law enforcement efforts against financial crimes, under the Bank
Secrecy Act (BSA) depository institutions must file the Treasury
Department‘s Financial Crimes Enforcement Network‘s (FinCEN) currency
transaction report (CTR) form on their customers‘ cash transactions of
more than $10,000. While FinCEN‘s regulations allow institutions to
exempt certain customers, over 15 million CTRs were filed in 2006.
Public Law 109-351 directed GAO to report on (1) the usefulness of CTRs
to law enforcement; (2) depository institutions‘ costs of meeting CTR
requirements; and (3) ways to encourage use of exemptions to avoid
unnecessary CTRs. Among other things, GAO obtained data from FinCEN on
CTRs and exemptions from 2004 to 2006, surveyed 115 state and local law
enforcement agencies and 680 depository institutions, held structured
interviews with officials of federal agencies and depository
institutions, and reviewed relevant laws and regulations.
What GAO Found:
According to federal, state, and local law enforcement officials, CTRs
provide unique and reliable information essential to a variety of
efforts, and recent advances in technology have enhanced law
enforcement agencies‘ ability to use CTR data by integrating it with
other information. In addition to supporting specific investigations,
CTR requirements aid law enforcement by forcing criminals attempting to
avoid reportable transactions to act in ways that increase chances of
detection through other methods. Linking law enforcement‘s use of CTRs
to specific outcomes is difficult, however, because agencies do not
track their use of CTRs, which are typically one of many information
sources used in investigations. FinCEN does not routinely publish
summary information on law enforcement uses of CTR data”as it does for
other data required under the BSA”that could help depository
institutions understand the value of CTRs.
While fewer than 30 of the largest U.S. depository institutions
accounted for over half of new CTRs filed during the period GAO
examined, all of the nation‘s approximately 17,000 institutions incur
some costs to meet CTR requirements. Institutions must have processes
and staff in place to identify when and if a CTR is required, as well
as the ability to aggregate same-day cash transactions by or on behalf
of the same person; file CTRs correctly; and, if desired, establish and
maintain exemptions for certain customers. Institutions GAO contacted
were generally unable to quantify these costs, in large part because
they use the same processes and staff for other purposes. While
automation has made CTR tasks less difficult, almost all institutions
reported that they have not completely automated all steps, such as
reviews of CTRs by institution officials.
GAO‘s work identified a number of factors that deter use of exemptions,
as well as opportunities for increasing their use, thereby reducing the
number of CTRs that are likely of little or no value to law enforcement
efforts. As reasons for not exempting eligible customers, institutions
cited uncertainty about the documentation required to demonstrate that
some customers are in fact eligible, along with concern that federal
banking regulators (who examine institutions for compliance with CTR
requirements) would find fault. Institutions also cited as deterrents
the need to meet FinCEN‘s regulatory requirements to (1) file an
exemption form, and annually review the supporting data, particularly
for hundreds of customers that are specifically exempted by statute;
and (2) biennially renew eligibility for some customers”a process that
as a practical matter duplicates the required annual reviews for those
customers. Institution officials indicated that additional guidance
from FinCEN, as well as Web-based material to help train their staff in
making exemption determinations, could increase the use of exemptions.
Removing regulatory deterrents and providing additional guidance and
Web-based material could help depository institutions avoid filing
unnecessary CTRs without harming law enforcement efforts.
What GAO Recommends:
GAO recommends that the Secretary of the Treasury direct FinCEN to
consider routinely publishing summary information on CTR use, revise
certain regulations that deter exemptions, and provide additional
guidance and Web-based material to help depository institutions
interpret exemption requirements. FinCEN concurred with our regulatory
and guidance recommendations and stated that it will consider options
for providing feedback on CTR use.
To view the full product, including the scope and methodology, click on
[hyperlink, http://www.GAO-08-355]. To view the results of GAO's
surveys, click on GAO-08-385SP. For more information, contact David G.
Wood at (202) 512-6878 or woodd@gao.gov.
[End of section]
Contents:
Letter:
Results in Brief:
Background:
CTR Requirements Are Useful to Law Enforcement Efforts in a Variety of
Ways, but Measuring Their Impact Is Difficult:
Financial Institutions Incur Some Costs to Meet Requirements Regardless
of the Number of CTRs They File:
Uncertainty about Required Documentation and Some Regulatory
Requirements May Unnecessarily Discourage Use of Exemptions:
Conclusions:
Recommendations for Executive Action:
Agency Comments and Our Evaluation:
Appendixes:
Appendix I: Objectives, Scope, and Methodology:
Appendix II: Law Enforcement Agencies' Use of CTR Data:
Appendix III: Information on CTRs Filed from 2004 to 2006 :
Appendix IV: Additional Information on Depository Institutions' Use of
Exemptions:
Appendix V: Comments from the Financial Crimes Enforcement Network:
Appendix VI: Comments from Federal Banking Regulators:
Appendix VII: GAO Contact and Staff Acknowledgments:
Related GAO Products:
99:
Tables Tables:
Table 1: Statutory and Regulatory Provisions That Determine Which
Customers May Be Exempted:
Table 2: CTR Views by Agencies, Fiscal Years 2004 through 2006:
Table 3: Exemption Violations Cited in BSA Examinations by FDIC,
Federal Reserve, and OCC, 2005 and 2006:
Table 4: Federal Agencies We Interviewed and Number of CTR Views,
Fiscal Year 2006:
Table 5: Number of CTRs Filed by Asset Size Category of Depository
Institutions in 2006:
Table 6: Survey Population and Response Rate:
Table 7: Number and Percentage of CTRs Filed by Institution Type, 2004-
2006:
Table 8: Mean and Median Numbers of CTRs Filed by Size of Institution,
2004-2006:
Table 9: Number of CTRs Based on Aggregated Transactions, 2004-2006:
Table 10: Number and Percentage Amount of Cash-In Transactions Recorded
by CTRs, 2004-2006:
Table 11: Number and Percentage of Cash-Out Transactions Recorded by
CTRs, 2004-2006:
Table 12: Number and Percentage of Phase I Exemptions Filed by
Depository Institutions, 2006:
Table 13: Number and Percentage of Phase II Exemptions Filed by
Depository Institutions, 2006:
Table 14: FinCEN's CTR and Exemption-Related Enforcement Actions on
Depository Institutions, 1997-2006:
Figures:
Figure 1: Extent to Which State and Local Agencies Found That CTRs
Assisted Them in Verifying Known or Obtaining Previously Unknown
Information:
Figure 2: Purposes for Which State and Local Agencies Reported Using
CTRs and How They Rated CTRs' Usefulness:
Figure 3: CTRs Filed in 2006 by Banks and Credit Unions, by Asset Size:
Figure 4: General Process for Filing CTRs:
Figure 5: Extent to Which Steps in the CTR Process Were Automated at
Surveyed Institutions:
Figure 6: Median Time, in Minutes, to Accomplish Each CTR Filing Step:
Figure 7: Factors That Surveyed Institutions Reported as of Great or
Very Great Importance to Their Decision to Exempt Phase I and Phase II
Customers:
Figure 8: Percentage of Depository Institutions with Customers Eligible
for Phase I and II Exemptions and Extent to Which They Filed Exemptions
in 2006:
Figure 9: An Overview of the Reveal Data Mining System:
Figure 10: States That Viewed CTR Data, by Number of CTRs Viewed in the
Gateway Program, Fiscal Year 2006:
Figure 11: CTRs Filed in 2006, by Institution Asset Size:
Figure 12: CTRs Filed in 2006, by County:
Figure 13: Factors That Institutions Considered to Be of Very Great or
Great Importance When Deciding Not to Exempt a Phase I Eligible
Customer:
Figure 14: Factors That Institutions Considered to Be of Very Great or
Great Importance When Deciding Not to Exempt a Phase II-Eligible
Customer:
Abbreviations:
BSA: Bank Secrecy Act:
CBRS: Currency Banking and Retrieval System:
CMIR: Report of International Transportation of Currency or:
Monetary Instruments:
CTR: currency transaction report:
DEA: Drug Enforcement Administration:
FBI: Federal Bureau of Investigation:
FDIC: Federal Deposit Insurance Corporation:
FinCEN: Financial Crimes Enforcement Network:
HIDTA: High Intensity Drug Trafficking Area:
HIFCA: High-Intensity Money Laundering and Related Financial Crimes
Area:
ICE: Immigration and Customs Enforcement:
IRS: Internal Revenue Service:
NCUA: National Credit Union Administration:
OCC: Office of the Comptroller of the Currency:
OCDETF: Organized Crime Drug Enforcement Task Force:
OTS: Office of Thrift Supervision:
TECS: Treasury Enforcement Communications System:
SAR: Suspicious Activity Report:
Letter February 21, 2008:
The Honorable Christopher J. Dodd:
Chairman:
The Honorable Richard C. Shelby:
Ranking Member:
Committee on Banking, Housing, and Urban Affairs:
United States Senate:
The Honorable Barney Frank:
Chairman:
The Honorable Spencer Bachus:
Ranking Member:
Committee on Financial Services:
House of Representatives:
To assist law enforcement agencies in their efforts to combat money
laundering, the financing of terrorist activities, and other crimes,
financial institutions are required to provide the federal government
with information on customers engaging in certain currency transactions
under the Bank Secrecy Act (BSA).[Footnote 1] Among other things, the
BSA--administered by the U.S. Department of the Treasury's Financial
Crimes Enforcement Network (FinCEN)--and its implementing regulations
require financial institutions to file currency transaction reports
(CTR) when their customers make large cash transactions, currently
defined by regulation as those exceeding $10,000.[Footnote 2] In 2006,
the government received about 15 million CTRs, the vast majority of
which were filed by depository institutions (banks, thrifts, and credit
unions).
To reduce the number of CTRs with limited usefulness to law enforcement
efforts, in 1994 Congress enacted provisions allowing depository
institutions to exempt two broad categories of customers that meet
specified criteria.[Footnote 3] For these exempted customers, the
institutions do not have to file CTRs, because the customers' cash
transactions would likely be of little or no value to law enforcement
efforts. First, the law required FinCEN to provide appropriate
exemptions for customers that are another depository institution;
governmental entities, including state and local governments; certain
other entities exercising U.S., state, and local governmental
authority; and "any business or category of business the reports on
which have little or no value for law enforcement purposes," which
FinCEN has defined through regulations to generally include companies
that are listed on any of three stock exchanges (listed companies) and
subsidiaries that are 51 percent or more owned by a listed company.
Second, the law authorized FinCEN to establish, through regulation,
exemptions for "qualified business customers" that maintain an account
at the depository institution, frequently engage in large cash
transactions, and meet other criteria specified by regulation. FinCEN's
regulations provide that certain qualified business customers may not
derive more than 50 percent of their gross revenue from activities or
lines of business specifically deemed ineligible, such as the purchase
or sale of automobiles or gaming of most kinds. Because FinCEN
promulgated the regulations for these two categories in separate rule-
making phases, the exemptions are commonly referred to as "Phase I" and
"Phase II" exemptions, respectively.[Footnote 4] It is up to the
depository institutions as to whether they actually exempt each of
their customers who are eligible for exemption; if they do, the
institutions must file an exemption form documenting the customer's
eligibility and must review and verify eligibility at least once each
year.
Depository institutions have expressed concerns about the cost and
effort required to meet CTR filing requirements--including the steps
needed to establish and maintain exemptions for their customers--as
well as doubts about the usefulness of CTRs to law enforcement
agencies. They note that they are also required, under the BSA, to file
with FinCEN Suspicious Activity Reports (SAR) in cases of certain
transactions that may involve violations of law or regulation,
including money laundering. However, law enforcement officials have
maintained that the CTR requirements help deter money laundering and
that CTRs provide information that is highly useful to their
investigations. Data from CTRs are aggregated and stored electronically
in a large database accessible to law enforcement agencies and
maintained for FinCEN by the Internal Revenue Service (IRS). The
database also includes information about customers for which
institutions have filed exemption forms.
The Financial Services Regulatory Relief Act of 2006 required that we
examine several aspects of CTRs, including their usefulness to law
enforcement and the burden on depository institutions filing them, and
to determine whether CTR filing rules could be modified without harming
law enforcement operations.[Footnote 5] This report discusses (1) the
usefulness of CTRs to federal, state, and local law enforcement
agencies; (2) the costs to depository institutions of meeting CTR
requirements; and (3) factors that affect depository institutions'
decisions to exempt or not exempt eligible customers, including
opportunities for encouraging use of exemptions while maintaining the
usefulness of CTR data to law enforcement agencies.
To examine the usefulness of CTRs to federal, state, and local law
enforcement agencies, we first obtained data from both FinCEN and IRS
indicating the frequency of access to the CTR database by specific
agencies. We conducted structured interviews with officials of 12
federal agencies and organizations--including those that most
frequently accessed CTR data in 2006, such as FinCEN, IRS, the Federal
Bureau of Investigation (FBI), the Drug Enforcement Administration
(DEA), and the U.S. Department of Homeland Security's Immigration and
Customs Enforcement (ICE). In addition, we used a Web-based instrument
to survey all 115 state and local law enforcement agencies that had
access to CTR data as of May 2007; our overall response rate was 77
percent. We supplemented the survey by interviewing officials of 12
state and 5 local law enforcement agencies, selected to achieve a mix
of agencies that had accessed CTR data frequently and agencies that had
not. We asked officials at the law enforcement agencies to identify how
information provided by CTRs is useful to their efforts and how
technological changes have affected the use of CTR data. To
understanding filing trends and obtain information on depository
institutions' costs to meet CTR requirements, we first analyzed
FinCEN's CTR and exemption data covering 3 calendar years--2004, 2005,
and 2006--to identify the numbers of CTRs and exemptions filed by
depository institutions of different sizes. For this purpose, we
established four size categories (based on the dollar value of
institutions'assets) for banks and thrifts and three categories for
credit unions.[Footnote 6] To obtain specific information on the costs
of meeting CTR requirements, we conducted 35 structured interviews with
officials of depository institutions of different sizes. We asked the
officials whether they use manual or automated processes and what costs
they incur to meet CTR requirements, including the costs of filing
individual CTRs and exemption forms. Finally, to identify the factors
affecting depository institutions' exemption decisions, as well as
opportunities for potentially increasing the use of exemptions, we used
a Web-based instrument to survey 680 of the 3,880 depository
institutions that filed at least 120 CTRs in 2006, stratified by asset
size category. Our overall response rate was 68 percent. When
presenting the survey results, all percentage estimates in this report
have 95 percent intervals of within plus or minus 8 percentage points
of the estimate, unless otherwise noted. This report does not contain
all of the results of our surveys of law enforcement agencies and
depository institutions, but the surveys and a more complete tabulation
of the results can be viewed at [hyperlink, http://www.gao.gov/cgi-
bin/getrpt?GAO-08-385SP]. We also analyzed statutory and regulatory
filing requirements and interviewed officials and examiners from the
five federal banking regulators to obtain their viewpoints on the
difficulties, if any, institutions might confront in meeting the CTR
and exemption filing requirements.[Footnote 7] We also obtained data on
BSA examinations conducted by each of the regulators for 2005 and 2006,
particularly data on their citations of depository institutions for
noncompliance with CTR requirements. Additional details on our methods
are presented in appendix I. We conducted this performance audit from
November 2007 through February 2008 in accordance with generally
accepted government auditing standards. Those standards require that we
plan and perform the audit to obtain sufficient, appropriate evidence
to provide a reasonable basis for our findings and conclusions based on
our audit objectives. We believe that the evidence obtained provides a
reasonable basis for our findings and conclusions based on our audit
objectives.
Results in Brief:
Federal, state, and local law enforcement officials we interviewed and
surveyed described a variety of ways in which CTR requirements are
useful to their efforts; however, measuring their impact is difficult.
Recent advances in technology, along with FinCEN's distribution of BSA
data in bulk to certain federal agencies, have enhanced the ability to
access and integrate CTR data with information from other sources.
According to law enforcement officials, CTRs provide unique and
reliable information that is essential to supporting investigations and
detecting criminal activities, in part because CTRs provide information
that is often unavailable elsewhere or is more objective or up-to-date
than that obtained from other sources. In addition to supporting
individual cases, law enforcement agencies use aggregated CTR data to
help detect patterns or trends; for example, FinCEN analysts routinely
analyze CTR data in conjunction with other information to develop "big
picture" views of suspicious financial activity. Law enforcement
officials noted that CTR requirements also aid their efforts by making
it more difficult for criminals to get their illicit proceeds into the
financial system and forcing them to act in ways that increase chances
of detection--such as smuggling cash or "structuring" their cash
transactions to avoid CTRs, which often prompts depository institutions
to file a Suspicious Activity Report. Linking law enforcement's use of
CTRs to specific impacts is difficult, however, because agencies do not
track their use of CTRs, which are typically one of many sources of
information used to support investigations. FinCEN does not routinely
publish any summary information on law enforcement's use of CTR data--
such as identified trends and case examples--as it does for Suspicious
Activity Reports. Although concerns about revealing investigatory
sources and methods limit dissemination of detailed information on how
law enforcement agencies use CTR data, our interviews with financial
institution officials suggest that they would better understand the
value of meeting their requirements if the institutions were provided
with similar summary information on CTR use.
Our analysis of CTR data for 2004 to 2006 shows that a large proportion
was filed by a small number of the largest depository institutions--for
example, fewer than 30 very large banks accounted for 55 percent of new
CTRs during the period--and while these institutions likely incur the
greatest expenditure of time and resources to meet CTR requirements,
all depository institutions incur some costs regardless of the number
of CTRs they file. This is because institutions must have processes and
trained staff in place to identify when and if a CTR is required,
including the ability to aggregate same-day cash transactions made by
or on behalf of the same person, and to file CTRs correctly. While
automation has made these tasks less difficult, most institutions
reported that their processes still include "manual" steps; for
example, most institutions reported that their CTRs are reviewed by
branch managers or compliance officers before being sent electronically
to FinCEN or by mail to IRS. Institutions we contacted were generally
unable to quantify their costs for meeting CTR requirements, in large
part because they use the same personnel and processes for meeting
other BSA requirements or for other purposes and do not separately
account for CTR-related costs. However, they noted that personnel costs
include the cost of training staff on meeting CTR requirements, as well
as the cost of labor involved in filing CTRs. Reflecting the range of
numbers of staff that may be involved, officials provided a wide
variance of estimated personnel costs. For example, while one very
large bank that filed almost 1 million CTRs in 2006 estimated personnel
costs, including tellers and compliance officers, of about $5.4
million, a large bank that filed just under 5,000 CTRs in 2006
estimated personnel costs at $76,000. Officials at institutions with
automated processes also cited technology as a significant cost.
Our survey of depository institutions and interviews with officials
identified a variety of factors that deter the use of exemptions, as
well as opportunities for increasing their use without diminishing the
usefulness of CTR requirements to law enforcement. Our survey results
showed that many financial institutions with customers considered
eligible for exemptions do not actually exempt them, but instead
continue to file CTRs on the customers' transactions--despite the
institutions' recognition that making use of the exemption provisions
would enable them to file fewer CTRs. The reasons they cited included
uncertainty about the documentation needed to demonstrate that certain
customers are in fact eligible for exemptions, accompanied by concern
that the federal banking regulators would deem the documentation
insufficient and cite them for noncompliance with BSA requirements. For
example, depository institutions that chose to use the Phase II
exemption relied on various methods--sometimes to a considerable
extent--to determine and document the portion of the customer's
revenues derived from ineligible activities, including asking the
customer for financial statements, tax records, or other documentation
such as a letter certifying its revenue sources. While our review of
data from the banking regulators showed relatively few violations
compared with the number of BSA examinations conducted, we found
variations in the types of documentation the regulators find
acceptable. For example, officials from two of the banking regulators
said that a letter from a customer self-certifying its revenue sources
could be acceptable to document eligibility for a Phase II exemption,
while officials from two other regulators indicated that such a letter
alone would be inadequate documentation. Both the difficulties cited by
the institutions and the variation among examiners indicate that
further CTR guidance from FinCEN could be helpful in this regard. Other
factors discouraging the use of exemptions were the cost and effort
involved in meeting FinCEN's regulatory requirements to (1) file an
exemption form, and annually review and update the information,
particularly for certain customers that are required to be exempted by
statute as appropriate; and (2) biennially file a form to document the
continued eligibility of customers that have been exempted under the
Phase II regulation, which many institutions viewed as redundant in
light of the required annual review process. Eliminating these
requirements could encourage institutions to make greater use of
exemptions. Other opportunities to encourage the use of exemptions
include (1) shortening the waiting period--currently a full year under
FinCEN's regulations--before exempting certain customers with frequent
cash transactions that exceed the $10,000 threshold, and (2) making
available from FinCEN Web-based material to help train and guide
depository institutions' staff in making exemption determinations.
While FinCEN currently provides such material--such as answers to
frequently asked questions, rulings, and guidance--for other BSA
requirements, the information on CTR exemption requirements is very
limited; and about 50 percent of respondents to our survey indicated
that the availability of such Web-based material from FinCEN would
increase their use of exemptions. Because the transactions of exempt
customers are likely to be of little or no value to law enforcement,
these actions could avoid the burden of filing some CTRs without
harming law enforcement efforts.
We are recommending that the Secretary of the Treasury direct FinCEN to
consider routinely publishing summary information on law enforcement
uses of CTRs, provide additional guidance on the documentation needed
to demonstrate eligibility for some customers, revise certain
regulations that deter exemptions, and provide Web-based material to
help depository institutions interpret exemption requirements. In
written comments on a draft of this report, the Director of FinCEN
concurred with our recommendations seeking regulatory amendments and
those related to guidance and materials to aid industry in making
eligibility determinations for CTR exemptions, and said that FinCEN
will consider options to provide industry with additional feedback on
the use of CTRs by law enforcement. We also received written comments
from the Board of Governors of the Federal Reserve System (Federal
Reserve), Federal Deposit Insurance Corporation (FDIC), National Credit
Union Administration (NCUA), and Office of Thrift Supervision (OTS)
that, in a joint letter, reaffirmed their support for effective
administration of the BSA and said they believe that streamlining and
clarifying the exemption regulations, as we recommend, would be a
positive step.
Background:
According to BSA's objectives, CTRs are to have a "high degree of
usefulness" and their uses include criminal, tax, or regulatory
investigations or proceedings. In 2001, the USA PATRIOT Act added a
fourth purpose: the conduct of intelligence or counterintelligence
activities, including analysis, to protect against international
terrorism.[Footnote 8] CTRs are intended to provide a paper trail for
federal, state, and local law enforcement agencies in their
investigations and, thus, potentially hinder using financial
institutions as intermediaries for the transfer or deposit of money
derived from criminal activity.[Footnote 9] A CTR records account cash
withdrawals and deposits, as well as currency exchanges, and wire
transfers purchased with cash, when the amount of the transaction is
more than $10,000. In addition to the dollar amount of the cash
transaction, a CTR records information about the account owner,
including the owner's occupation, and the identity of the person
actually conducting the transaction (the conductor), if not the account
holder. A depository institution must file a CTR for transactions that
collectively exceed $10,000 during the course of a day if the
institution has knowledge that they are for or on behalf of the same
person.
The Money Laundering Suppression Act of 1994 provided basic criteria
for establishing and maintaining exemptions and authorized Treasury to
establish further requirements.[Footnote 10] FinCEN has done so through
both regulations and "interpretative letters" that supplement the
regulations to provide further guidance. Table 1 summarizes the
requirements as outlined in the statute, implementing regulations, and
interpretive letters.
Table 1: Statutory and Regulatory Provisions That Determine Which
Customers May Be Exempted:
Statutory provision: Customers eligible for exemptions under Phase I:
Another depository institution;
Regulatory provision: Customers eligible for exemptions under Phase I:
A bank, to the extent of such bank's domestic operations.
Statutory provision: Customers eligible for exemptions under Phase I: A
department or agency of the United States, any state, or any political
subdivision of any state;
Regulatory provision: Customers eligible for exemptions under Phase I:
The same as statutory provision.
Statutory provision: Customers eligible for exemptions under Phase I:
Certain other entities exercising governmental authority on behalf of
the United States, any state or political subdivision of any state;
Regulatory provision: Customers eligible for exemptions under Phase I:
The same as statutory provision.
Statutory provision: Customers eligible for exemptions under Phase I:
Any business or category of business the reports on which have little
or no value for law enforcement purposes;
Regulatory provision: Customers eligible for exemptions under Phase I:
Any entity, other than a bank, whose common stock is listed on the New
York, American, or NASDAQ Stock Exchange, with some exceptions (a
"listed entity"); and any subsidiary, other than a bank, of any "listed
entity" that is organized under U.S. law and at least 51 percent of
whose common stock is owned by the listed entity.
A nonbank financial institution meeting these criteria may be extended
only to the extent of its domestic operations.
Statutory provision: Eligibility criteria for business customers under
Phase II: Maintains a transaction account at the depository
institution, and;
Regulatory provision: Eligibility criteria for business customers under
Phase II: A commercial enterprise that has maintained a transaction
account at the bank for at least 12 months.
Statutory provision: Eligibility criteria for business customers under
Phase II: Frequently engages in transactions with the depository
institution that are subject to the CTR reporting requirements, and;
Regulatory provision: Eligibility criteria for business customers under
Phase II: Frequently (defined in an Interpretive Letter as at least 8
times within a 12-month period, excepting certain "seasonal" customers)
engages in cash transactions in excess of $10,000.
Statutory provision: Eligibility criteria for business customers under
Phase II: Meets other criteria which the Secretary determines are
sufficient to ensure the purposes of the BSA are carried out;
Regulatory provision: Eligibility criteria for business customers under
Phase II: Is incorporated or organized under U.S. law, or state law, or
is registered as and eligible to do business in the United States or a
state, to the extent of its domestic operations, and to the extent that
no more than 50 percent of its gross revenues come from activities
specified as non-eligible business activities.
Statutory provision: Customers not eligible for exemption: FinCEN must
establish guidelines, which may include a description of the type of
business for which no exemption will be granted;
Regulatory provision: Customers eligible for exemptions under Phase I:
Businesses for which no exemption as a nonlisted business will be
granted are those engaged primarily in;
* serving as financial institutions or agents thereof;
* purchase or sale of motor vehicles, vessels, aircraft, farm equipment
or mobile homes;
* practice of law, accountancy, or medicine;
* auctioning of goods;
* chartering or operation of ships, buses, or aircraft;
* gaming of any kind (other than pari-mutuel betting at race tracks);
* investment advisory services or investment banking services;
* real estate brokerage;
* pawn brokerage;
* title insurance and real estate closing;
* trade union activities; and;
* any other activities that may be specified by FinCEN.
Source: GAO analysis of 31 U.S.C. § 5313(d) and (e), and 31 C.F.R. §
103.22(d).
Note: Phase II exemptions also include a second category referred to as
"payroll businesses," which are defined in 31 U.S.C. §
103.22(d)(2)(vii).
[End of table]
Legislative proposals would alter the basis for establishing
exemptions, as well as raise the reporting threshold amount above
$10,000. For example, in January 2007, the U.S. House of
Representatives passed the Seasoned Customer CTR Exemption Act of 2007
(H.R. 323), which would require the Secretary of the Treasury to (1)
prescribe regulations for exempting "qualified customers," including
criteria for suspending, rejecting, or revoking exemptions; and (2)
periodically review the threshold amount and adjust it for inflation as
appropriate. H.R. 1447, the CTR Modernization Act, introduced in March
2007, would raise the threshold amount for insured depository
institutions to $30,000.
FinCEN's role is to oversee administration of the BSA throughout the
federal government. Pursuant to this role, FinCEN, among other things,
develops policy and provides guidance to other agencies and analyzes
BSA data for trends and patterns. FinCEN relies on the regulators of
depository institutions--the Federal Reserve Board (Federal Reserve),
Federal Deposit Insurance Corporation (FDIC), National Credit Union
Administration (NCUA), Office of the Comptroller of the Currency (OCC),
and Office of Thrift Supervision (OTS)--to ensure that depository
institutions comply with BSA reporting requirements. In addition to
CTRs, depository institutions are required by BSA and its implementing
regulations to make available information on their customers'
transactions in certain circumstances:
* Depository institutions are required to file Suspicious Activity
Reports (SAR) with FinCEN if a transaction involves or aggregates at
least $5,000 in funds or other assets, and the institution knows,
suspects, or has reason to suspect that the transaction is designed to
evade any requirements of the BSA.[Footnote 11]
* Under Section 314(a) of the USA PATRIOT Act, federal law enforcement
agencies, through FinCEN, can reach out to financial institutions to
locate accounts and transactions of persons suspected of engaging in
terrorism or money laundering.[Footnote 12]
FinCEN is responsible for providing these agencies with assistance in
educating institutions on their BSA responsibilities. To focus and
direct their efforts in supporting the effectiveness of BSA compliance,
FinCEN's strategic plan for fiscal years 2006-2008 outlines several
goals. For example, to assist law enforcement, the plan calls for
FinCEN to reduce the number of CTRs filed on legitimate financial
transactions that are of little or no value to law enforcement; and, to
assist financial institutions, the plan calls for FinCEN to revise its
data collection forms, regulations, and practices to ensure that FinCEN
collects the information necessary to meet its mission while minimizing
reporting burdens on the financial industry. In addition, FinCEN
indicated in its plan that it would consider providing guidance on BSA
requirements through written and Web-based materials and by means of a
call center to respond to specific questions.
FinCEN, together with the IRS, is responsible for managing and storing
the BSA data that financial institutions report. Financial institutions
that submit CTRs in paper form mail them directly to IRS's Enterprise
Computing Center in Detroit. Institutions that submit data
electronically transmit them directly to FinCEN, which in turn
transmits them to the center. The center collects and stores all BSA
data in its Currency Banking and Retrieval System (CBRS).[Footnote 13]
For fiscal year 2007, the IRS estimated the total cost of processing
CTRs to be about $7 million, including about $3.5 million to convert
CTRs submitted on paper to an electronic format. IRS examiners and
investigators access BSA data directly through IRS's Intranet, while
FinCEN has a direct connection to the Enterprise Computing Center.
Staff at other law enforcement agencies can access BSA data via the
Internet, and certain federal agencies also periodically receive bulk
data downloads of BSA data for use at their agencies, as described
later in this report.
CTR Requirements Are Useful to Law Enforcement Efforts in a Variety of
Ways, but Measuring Their Impact Is Difficult:
Federal, state, and local law enforcement officials we interviewed and
surveyed said that information in CTRs provided unique and reliable
information essential to a variety of efforts and that recent advances
in technology, along with FinCEN's distribution of BSA data in bulk,
have enhanced their ability to use and analyze CTR information. Law
enforcement officials stated that, in addition to supporting specific
investigations, CTR requirements aid their efforts by making it more
difficult for criminals to get their illicit proceeds into the
financial system and forcing them to act in ways that increase chances
of detection. Linking law enforcement's use of CTRs to specific
outcomes is difficult, however, because agencies do not track their use
of CTRs, which are typically one of many sources of information used to
support investigations. FinCEN does not routinely publish any summary
information on law enforcement's use of CTR data as it does for
Suspicious Activity Reports, such as identified trends and case
examples. Although concerns about revealing investigatory sources and
methods limit dissemination of detailed information on how law
enforcement agencies use CTR data, our interviews with depository
institution officials suggest that they would better understand the
value of meeting their requirements if the institutions were provided
with similar summary information on CTR use.
CTRs Provide Unique Information for Investigating Cases and Detecting
Criminal Activities:
In part due to advances in technology that have enhanced access to, and
analysis of, CTR data, law enforcement officials use CTR data to help
investigate a variety of crimes, including tax evasion, customs
violations, and drug trafficking. They use CTR data both "reactively"-
-that is, to support existing investigations of one or more suspects--
and "proactively"--to analyze patterns or trends that can serve as the
basis for initiating new investigations.
Technological Advances Have Increased Access and Analytic Capability:
In 1993, we reported that CTRs were not used to their full extent by
law enforcement agencies because the large volume of reports made
meaningful analysis difficult and access to the data, particularly at
the state level, was limited and cumbersome.[Footnote 14] However,
access to BSA data at the federal, state, and local levels has improved
and technological advances have made meaningful analysis of large BSA
data sets possible. Consistent with its strategic goal of facilitating
information sharing through electronic means, FinCEN has increased
access to CTR (and other BSA) data in two ways.
First, FinCEN began providing selected federal agencies with access to
"bulk" CTR data--essentially all of the data resulting from CTRs. In
2004, FinCEN first provided the FBI with bulk transfer of data, and
during 2005 and 2006 FinCEN agreed to provide two federal agencies--the
Secret Service and ICE--and a multiagency program established by the
Department of Justice (the Organized Crime Drug Enforcement Task Force,
or OCDETF Fusion Center) with access to a bulk data set.[Footnote 15]
Receiving these data in bulk, rather than accessing the database
remotely and querying it for specific records, allows agencies to
conduct more sophisticated analyses by combining the BSA data with
other data sets, as can be seen in the following examples.
* The FBI has combined bulk BSA data into its Investigative Data
Warehouse, a collection of more than 50 multisource data sets that
includes counter terrorism data. According to the FBI, access to BSA
bulk data has significantly increased its usage of CTR data (the bureau
reported data that indicated approximately 194,000 CTR views from 2004
through 2006 of the downloaded data). According to FBI officials, about
40 percent of all FBI terrorism subjects appeared on CTRs that were
filed between January 1, 2000, and June 30, 2006; further, CTR data
were the most viewed data in the warehouse.
* OCDETF's Fusion Center integrated bulk BSA data with drug, financial,
and gang-related investigative data provided by several other federal,
state, and local law enforcement agencies. According to OCDETF
officials, as of June 2007, CTR data had appeared in 61 percent of the
Fusion Center's analytical products.
* ICE has combined BSA data with import and export data for selected
countries to help identify and detect discrepancies or anomalies in
international commerce that might indicate trade-based money
laundering.
Second, FinCEN improved Internet access to CTR data. FinCEN provides
and grants access using its "Gateway" program, through which law
enforcement staff may access the database using a system known as
WebCBRS.[Footnote 16] With WebCBRS, users can download large volumes of
CTR data--up to 20,000 CTRs on a single query--and export it to a
spreadsheet application, such as Excel. This allows users to more
readily conduct proactive analyses, such as identifying transaction
trends by categories. Most of the law enforcement officials with whom
we spoke, as well as officials of state and local agencies we surveyed,
confirmed that WebCBRS is more user friendly than its predecessor and
has greatly improved their ability to search for and analyze CTR
data.[Footnote 17] (More detailed information about the technological
advances enabling greater use of CTR data, along with examples of use
in specific investigations, is presented in appendix II. Our survey of
law enforcement agencies and a more complete tabulation of the results
can be viewed at [hyperlink, http://www.gao.gov/cgi-bin.getrpt?GAO-08-
385SP.])
Perhaps reflecting improvements in the ability to access and analyze
CTR data, the number of agencies using CTR data has increased, and
officials at some agencies noted that they have incorporated a search
of CTR data as a routine part of their investigations. For example,
from 2004 through 2006, the number of agencies that viewed CTR data
through the Gateway program increased from 109 to 136 and, as of
October 2007 requests from an additional 110 agencies for access to CTR
data were pending FinCEN's review.
Agencies Value CTRs as a Source of Unique, Reliable, and Timely Data:
Officials from law enforcement agencies we interviewed emphasized that
CTRs are important because they provide information that is often
unavailable from other sources, or is more objective or up-to-date than
that obtained from other sources. They cited ways in which CTRs provide
more comprehensive or timely information about a suspect's banking
transactions than they can obtain using other provisions of law.
More specifically, law enforcement officials frequently identified the
name of the currency transaction's conductor--the person who actually
carries out a cash transaction at a financial institution, but who is
not the holder of the affected accounts--as useful information that is
unique to CTRs. For example, an FBI official noted a case in which
analysis of information obtained by searching the CTR database
conductor field provided the agency with the investigative lead needed
to track the banking activities of persons who, according to the FBI
official, were involved in a cocaine distribution ring. The conductor
information was useful because the main person under investigation in
the ring had associates open bank accounts in their own names at
different banks and then made large currency transactions into these
accounts, resulting in CTRs that recorded the main person under
investigation as the conductor. Further, FinCEN and other law
enforcement officials explained that because multiple individuals may
use the same account to conduct transactions, CTRs often could be used
to identify unknown persons associated with suspects, thereby expanding
the scope of investigations. For example, during a 4-year FBI
investigation, analysis of CTRs showed where suspects were banking as
they opened and closed accounts, and on which day of the week suspects
typically made their deposits, allowing the FBI to better plan its
surveillance.
Law enforcement officials also noted that CTRs provide a unique source
of information on the occupations of account holders that often proves
useful. For example, a DEA official reported that analyzing CTRs by the
information in the occupation field has allowed him to identify whether
medical companies or doctors--lines of businesses that typically would
not be dealing in high volumes of cash--were diverting controlled
substances for illegal use. Finally, officials from several federal law
enforcement agencies, including the Bureau of Alcohol, Tobacco,
Firearms, and Explosives, IRS-Criminal Investigation, ICE, and DEA,
commented that because depository institutions are required to file
CTRs soon after a reportable transaction occurs, the CTR database
provides up-to-date information on large cash transactions.[Footnote
18] Many federal, state, and local officials we interviewed commented
that CTRs provided them with ready access to information that they
could not otherwise obtain in a timely manner.
Officials contrasted these useful aspects of information from CTRs with
information they may be able to obtain on suspects' banking activities
under other provisions of the BSA or other laws:
* Suspicious Activity Reports (SAR) also provide useful information;
however, depository institutions have some discretion in determining
whether a transaction or customer is "suspicious," and therefore the
institutions determine whether to file a SAR and, if so, what
information to include. Thus, a SAR might not capture the same level of
information about specific transactions that a CTR routinely would
provide. Further, criminals may use several different banks to conduct
their transactions, and a SAR would reflect the suspicious activity
only within the bank filing the SAR.
* The Section 314(a) process, under which federal law enforcement
agencies may reach out to financial institutions to locate accounts and
transactions of persons of interest, is reserved for significant money-
laundering or terrorist-financing investigations, and agencies may make
such requests only upon approval by FinCEN, which limits the number of
subjects on the list. Further, according to FinCEN, the request
provides lead information only--law enforcement agencies must meet the
legal standards that apply to the investigative tool that it chooses to
use to obtain documents, such as a subpoena. In addition, officials at
FinCEN and the IRS noted that the 314(a) process provides law
enforcement access only to transactions conducted within the last 6
months, or accounts held within the last 12 months, while the CTR (and
other BSA) data provide access to data going back 10 years.
* Obtaining bank records through subpoenas could take months or be
difficult. Further, in order to subpoena a specific institution,
officials would need to know that a suspect banked at that institution.
A majority (55 percent) of the state and local law enforcement
officials we surveyed noted that it would be "somewhat more" or "much
more" difficult to obtain information from bank records in this fashion
than from using CTRs.
* Other methods of obtaining information about a suspect's bank
accounts--including "mail covers" (copies, obtained from the U.S.
Postal Service, of the fronts of envelopes delivered to a suspect),
subpoenas for credit reports, and surveillance--are time consuming and
less likely to provide needed information about a bank account,
according to law enforcement officials. ICE and state officials from
New York and Texas noted that their agencies could wait days to obtain
mail covers, with no guarantee of receiving one bearing an address of
the suspect's financial institution. New York state law enforcement
officials said that the next best alternative would be to subpoena a
suspect's credit report, a process that could take 30 days. While the
credit report may provide useful leads--for example, a suspect's
mortgage application--that the agency might then subpoena, the time
required would further lengthen the investigation.
Agencies Reported Using CTR Data to Support a Wide Variety of
Investigative Cases:
Most officials of law enforcement agencies we contacted indicated that
they most often use CTRs reactively, and many routinely review CTRs at
the beginning of each investigation.[Footnote 19] For example, tax
investigators in IRS routinely query BSA data to identify CTRs with
information that suggests situations such as a business paying
employees in cash (and thus not withholding taxes). However, law
enforcement agencies typically did not use CTRs in isolation to develop
a case; rather, they used CTR data to identify leads for further
investigation, in part by comparing CTR information with information
from other sources. As explained by law enforcement officials, the
information in CTRs is useful in corroborating information contained in
other BSA reports. For example, agencies may compare information from
the CTR database to that obtained from Reports of International
Transportation of Currency or Monetary Instruments (CMIR), which report
currency transported into the United States, to track how businesses
dispose of cash.[Footnote 20] Agencies also consult CTR data to obtain
more detailed information after reviewing SARs. For example, officials
from a High Intensity Money Laundering and Related Financial Crimes
Areas (HIFCA) noted that they used CTR data for 105 of the 120 reports
they filed over a recent 1-year period on investigations initiated
after reviewing SARs.[Footnote 21] In this regard, many law enforcement
officials, including those from ICE, IRS, and the U.S. Attorney's
office, noted that raising the CTR filing threshold of $10,000 would
affect adversely their ability to deter money laundering, because the
CTR threshold corresponds to those set in other anti-money-laundering
provisions. For example, officials from the U.S. Attorney's office
indicated that the CTR threshold works in tandem with three other
statutorily mandated reporting thresholds, which are also set at
$10,000: the CMIR requirement; the Form 8300 requirement; and the bulk
cash smuggling statute.[Footnote 22]
That no CTRs have been filed on business activities that might be
expected to generate them also provides valuable leads to law
enforcement. For instance, FinCEN, ICE, and DEA conduct analyses
comparing known cash flows documented through other sources with cash
flows they would expect CTRs to document. Officials at both FinCEN and
ICE reported that a search of BSA data for information on a cash
business revealing no CTRs could alert investigators that the business
was not using traditional depository institutions and direct their
focus to nonbank financial institutions such as money services
businesses or to the possibility of currency smuggling. Similarly, the
lack of CTRs relating to particular individuals or businesses can
provide investigative leads. For example, officials from FinCEN and a
Florida law enforcement agency said that the presence of a CMIR,
coupled with an absence of related CTRs, could provide intelligence
that currency transported into the country was subsequently laundered
into the financial mainstream through "structuring" (making a series of
cash transactions in amounts less than $10,000). Another law
enforcement official from Florida indicated that a lack of CTRs
corroborated findings from her agency's surveillance operations that
certain laundromats, dry cleaners, and travel agencies had laundered
millions of dollars.
As shown in figure 1, the state and local law enforcement agencies we
surveyed found CTRs to be of most use when developing leads for
existing investigations. Officials from law enforcement agencies in
California, New York, and Texas--states that were among the highest
users of CTR data--indicated that their investigators typically used
CTRs to identify a subject's bank account numbers and associates who
might be conducting transactions on behalf of the subject. An official
from one of these agencies indicated that no other source of
information enabled investigators to "map" the financial links between
members of a criminal organization as well as the CTR.
Figure 1: Extent to Which State and Local Agencies Found That CTRs
Assisted Them in Verifying Known or Obtaining Previously Unknown
Information:
This figure is a bar graph showing extent to which state and local
agencies found that CTRs assisted them in verifying known or obtaining
previously unknown information.
[See PDF for image]
Source: GAO.
[End of figure]
Regarding types of investigations involving CTR data, officials of
state and local agencies we surveyed reported that they primarily use
CTRs for money-laundering, fraud, and drug investigations (see fig. 2).
State law enforcement officials we interviewed told us that they use
CTRs for a wide variety of investigations relating to money laundering,
drugs, workers compensation fraud, Medicaid fraud, mortgage fraud, and
white collar crime.
Figure 2: Purposes for Which State and Local Agencies Reported Using
CTRs and How They Rated CTRs' Usefulness:
This figure is a bar graph showing purposes for which state and local
agencies reported using CTRs and how they rated CTRs' usefulness.
[See PDF for image]
Source: GAO.
[End of figure]
State and local officials also indicated that the current threshold
amount of $10,000 was important to the usefulness of CTRs.
Specifically, about 58 percent of the state and local officials we
surveyed stated that increasing the CTR filing threshold would result
in a "very great" or "great" reduction in the usefulness of the CTR
filing requirement to their work. A law enforcement investigator from
Illinois indicated that many of the CTRs that his agency's criminal
intelligence center reviewed were those that documented total
transaction amounts between $10,000 and $20,000. Similarly, an
investigator with a Minnesota law enforcement agency indicated that the
overwhelming majority of CTRs that he found to be of use to his
investigations were for transactions between $10,000 and $20,000.
Law Enforcement Agencies Use Aggregated CTR Data to Help Detect
Patterns or Trends:
Law enforcement agencies noted that CTR information also contributes to
pattern and trend analyses. For example, at the request of DEA, FinCEN
analyzed CTRs filed by institutions in California by ZIP code,
providing a statistical overview of financial activity occurring within
those areas that, combined with other law enforcement intelligence,
allowed DEA analysts to assess threats on a statewide basis. FinCEN
officials indicated that their analysts routinely analyze information
from CTRs in conjunction with information from SARs or other BSA
reports to develop "big picture" views of suspicious financial
activity. In addition, ICE officials noted that their analysts often
analyze the "conductor" and account holder information from CTRs to
identify individuals moving the largest sums of money on behalf of
particular account-holders over time to spot any unusual trends.
Further, ICE officials commented that they proactively search CTR
information to identify individuals moving large sums of money using
the same Social Security number with different personal or business
names (according to the officials, name variations is a common
technique criminals use to hide their activities and avoid detection).
According to FinCEN and IRS officials, analytical tools such as data
mining--the application of database technology and techniques, such as
statistical analysis and modeling, to uncover hidden patterns and
subtle relationships in data--have enhanced their investigative efforts
by improving their ability to identify data patterns and trends
indicative of money laundering and other financial crimes.
CTR Requirements Can Cause Criminals to Act in Ways That Increase
Chances of Detection:
According to federal law enforcement officials, criminals are forced to
undertake more risky and suspicious methods of money laundering than
depositing cash into depository institutions because they are well
aware of the $10,000 filing threshold for CTRs and the investigative
paper trail that it creates. While criminals can use a variety of means
to launder their money, law enforcement officials we interviewed
pointed to three primary methods that criminals use to avoid the CTR
filing requirement: structuring; bulk cash smuggling, or physically
moving cash across borders via courier or secreted in cargo; and trade-
based money laundering, the process of disguising the proceeds of crime
and moving value through the use of trade transactions.
Many federal law enforcement officials said that the CTR reporting
requirement was critical in supporting the ability of depository
institutions, as well as their own investigators, to identify
suspicious activity based on the structuring of financial transactions
to avoid CTRs. The BSA makes it illegal to structure transactions to
avoid triggering otherwise applicable reporting requirements, such as
the CTR, allowing federal prosecutors to file charges against
individuals who structure their cash transactions.[Footnote 23] The
structuring in which criminals engage to avoid CTRs may cause a
depository institution to file a SAR. FinCEN analysis of SARs filed by
depository institutions from April 1, 1996, through December 31, 2006,
showed that 1.5 million SARs, or 48 percent of all SARs filed by
depository institutions during this period, were filed based on
suspicious activity related to structuring or money
laundering.[Footnote 24]
Many law enforcement agencies routinely review SARs for evidence of
structuring. For example, IRS-Criminal Investigation officials said
that their agents are required to review SARs that report structuring.
Officials we interviewed at several law enforcement organizations,
including three associated with HIFCAs, indicated that they had formed
teams to review SARs to generate leads for cases based on structuring
and said that they regarded the CTR filing requirement as essential to
supporting the ability of depository institutions to identify
suspicious activity. Federal law enforcement officials also emphasized
that the $10,000 CTR threshold played a key role, by forcing criminals
to make many more and smaller transactions than otherwise would be
required--thus making them more vulnerable to being reported for
structuring. Officials from IRS, ICE, FBI, and U.S. Attorneys Offices
indicated that they believed large cash transactions have become more
uncommon as consumer access to credit and electronic payment options
increased in the 30 years since the threshold was established, making
the $10,000 threshold still relevant.
The existence of the CTR filing requirement also can force criminals
into riskier activities such as bulk cash smuggling.[Footnote 25]
According to an ICE official, smuggling illegal proceeds in bulk cash
form makes criminals more vulnerable to detection because it is easier
for agents of law enforcement to interdict bulk cash shipments.
Similarly, an official associated with the Chicago High Intensity Drug
Trafficking Area (HIDTA) reported observing an increase in bulk cash
smuggling because criminals would rather take their chances smuggling
their proceeds in bulk cash to Mexico.[Footnote 26] In response, the
HIDTA has formed a highway patrol to interdict these cash shipments.
Officials from ICE, FinCEN, and the Justice Department also reported
that the increase in recent years of bulk cash smuggling across the
U.S.-Mexican border was an indicator of CTR success in deterring
criminals from depositing cash into domestic financial
institutions.[Footnote 27]
Measuring Usefulness of CTRs Is Difficult:
Linking law enforcement's use of CTRs to specific outcome measures is
difficult because agencies do not track their use of CTRs, which are
typically only one of many sources of information used to support
investigations. FinCEN does not routinely publish any information on
law enforcement's use of CTR data as it does for other information that
financial institutions provide under the BSA. Although concerns about
revealing investigatory sources and methods limit dissemination of
detailed information on how law enforcement agencies use CTR data, our
interviews with depository institution officials suggest that they
would better understand the value of meeting their requirements if the
institutions were provided with summary information on CTR use.
Agencies Have Difficulties Linking CTRs to Specific Investigation
Outcomes:
While CTRs appear to be valuable for law enforcement purposes, linking
their use to specific case outcomes, such as indictments or
convictions, is problematic. First, no requirement exists to track the
use of CTR data in investigations, and almost all of the officials from
the federal, state, and local law enforcement agencies we contacted
reported that their agencies did not track their use of CTRs or how the
CTRs contributed to case outcomes.[Footnote 28]
As a potential indicator of use, we obtained data from FinCEN and IRS
on the number of CTR "views"--that is, the number of times that
agencies accessed an individual CTR record. IRS tabulates views that
occur when agencies access the database through WebCBRS, including its
own views through its Intranet access, while FinCEN tabulates views
occurring through the Gateway program.[Footnote 29] For example, data
show over 1.6 million views of CTRs by federal, state, and local
agencies in 2006 (see table 2).
Table 2: CTR Views by Agencies, Fiscal Years 2004 through 2006:
Agency: IRS;
Number of CTR views: 2004: 1,466,518;
Number of CTR views: 2005: 1,231,345;
Number of CTR views: 2006: 912,405;
Number of CTR views: Total: 3,610,268.
Agency: ICE;
Number of CTR views: 2004: 213,608;
Number of CTR views: 2005: 241,692;
Number of CTR views: 2006: 207,325;
Number of CTR views: Total: 662,625.
Agency: FinCEN;
Number of CTR views: 2004: 208,609;
Number of CTR views: 2005: 105,266;
Number of CTR views: 2006: 136,090;
Number of CTR views: Total: 449.965.
Agency: DEA;
Number of CTR views: 2004: 111,294;
Number of CTR views: 2005: 108,845;
Number of CTR views: 2006: 108,507;
Number of CTR views: Total: 328,646.
Agency: FBI;
Number of CTR views: 2004: 48,364;
Number of CTR views: 2005: 62,487;
Number of CTR views: 2006: 54,290;
Number of CTR views: Total: 165,141.
Agency: Federal banking regulators[A];
Number of CTR views: 2004: 31,408;
Number of CTR views: 2005: 54,039;
Number of CTR views: 2006: 58,006;
Number of CTR views: Total: 143,453.
Agency: All other agencies[B];
Number of CTR views: 2004: 141,602;
Number of CTR views: 2005: 182,181;
Number of CTR views: 2006: 171,943;
Number of CTR views: Total: 495,726.
Agency: Total;
Number of CTR views: 2004: 2,221,403;
Number of CTR views: 2005: 1,985,855;
Number of CTR views: 2006: 1,648,566;
Number of CTR views: Total: 5,855,824.
Source: GAO analysis of IRS and Department of Homeland Security data.
Notes: Number of CTR views does not include those from bulk downloads
by the FBI.
[A] The Federal Reserve, OCC, OTS, FDIC, and NCUA.
[B] Other agencies include the Bureau of Alcohol, Tobacco, Firearms,
and Explosives; United States Secret Service; United States Postal
Inspection Service; U.S. Attorneys Offices; and the Securities and
Exchange Commission; state regulatory agencies; and state and local law
enforcement agencies.
[End of table]
According to FinCEN data, among users who accessed the CBRS database
through the Gateway program, state and local law enforcement agencies
accounted for about 33 percent and 3 percent of the total CTR views,
respectively. These users include state bureaus of investigation and
criminal prosecuting offices, such as state offices of attorneys
general and county prosecutors' offices. The number of these CTR views
was concentrated among a few agencies; for example, 10 agencies from 8
states accounted for almost 64 percent of the total CTR views made by
state and local law enforcement agencies, according to FinCEN's data.
(For a map showing views by state, see app. II.)
However, the numbers of views do not provide any indication of CTRs'
usefulness to any specific law enforcement effort or establish a link
to any specific outcome of an investigation. Moreover, data on views
during this period may not reflect future trends because of the changes
in access to the CTR database discussed previously. For example, the
numbers of CTRs viewed by state and local users may increase due to the
expanding number of users with access and with more understanding of
how CTRs can assist their efforts.[Footnote 30] Several officials from
state and local law enforcement agencies we interviewed indicated that
they believed the use of CTR data through Gateway probably would
increase as users better understand the value of BSA data. Also, as
noted, FinCEN has recently made bulk downloads of data available to
several federal agencies.
A second difficulty in measuring the impact specifically of CTR
requirements involves the way that CTRs are used--primarily to support
investigations that also draw upon many other sources of information.
Officials from the federal investigative agencies we interviewed
generally stated that outcome measures, such as indictments or
convictions, cannot be linked exclusively to CTRs because they are
typically one of many leads used to develop an investigation.
Similarly, most--about 82 percent--of the state and local agencies we
surveyed indicated that the number of investigative leads provided by
CTRs was the best outcome measure of their CTR use. Further, officials
from several local law enforcement agencies noted that attorneys often
negotiate plea agreements with the defendant long before a case goes to
trial; thus, no matter how critical the role played by a CTR in the
investigation, there would be no trial in which CTRs could be used as
evidence. In addition, federal, state, and local law enforcement
officials reported that they were more likely to use CTRs as a basis
for obtaining subpoenas to access specific bank account records than to
use CTRs themselves as evidence in court. Officials from IRS, DEA, and
Justice said that by the time a case moves to the trial phase, the
prosecution is more likely to use bank records as evidence because
those records are generally a more convincing form of evidence of a
defendant's transactions. However, investigators would use the CTR to
locate the defendant's bank accounts and identify the correct bank
records to subpoena. Further, according to an IRS official, CTRs
generally were presented in court only when bank records were not
available or could not be made available in a timely manner.
FinCEN officials reported that the agency does not have outcome
measures related to CTR use and analysis because many of the cases
FinCEN supported were complex and might not result in tangible success
for several years. Officials cited the example of "Operation Cash-Out,"
where FBI authorities eventually charged persons with attempting to
provide funding to al Qaeda. During this investigation, conducted
between 2000 and 2006, FinCEN identified more than 14,000 CTRs relating
to the investigation.
FinCEN Does Not Publish Information on CTR Uses As It Does for Other
BSA Data:
Although FinCEN has taken some steps to promote awareness of CTRs and
their value to the financial community and law enforcement agencies, it
does not systematically report information about the numbers of CTRs
filed or results of CTR use. Bank officials we interviewed and those
responding to our survey strongly questioned whether the CTRs they were
filing, especially on customers that they had determined to be at low
risk for financial crimes, provided any value to law enforcement. Some
officials stated that their resources would be better directed at
filing SARs, which they viewed as having greater value to law
enforcement. Other institution officials noted that law enforcement
agencies had never contacted them.
Law enforcement officials have given presentations at banking industry
conferences on how BSA data helps them in their investigations. These
industry conferences typically include presentations on how law
enforcement uses BSA data, but they are not necessarily CTR specific.
Officials we interviewed and those responding to our survey stated that
they largely did not understand how the CTRs they filed were being used
by law enforcement.
In contrast to this general lack of information on CTR use, FinCEN
routinely publishes information on the numbers of SARs filed and
examples of how they have been used by law enforcement agencies. Since
October 2000, in conjunction with law enforcement and regulatory
agencies, FinCEN has been issuing the SAR Activity Review, which
provides information about the preparation, use, and value of SARs that
depository institutions, as well as other financial institutions,
filed. For example, the October 2007 edition contained expanded
descriptions of law enforcement cases to demonstrate the value of BSA
data to the law enforcement community, including cases that were
proactively initiated as a result of BSA reports, as well as trends in
certain crimes identified through SARs. FinCEN also includes some
information on the results of requests to financial institutions under
section 314(a) of the USA PATRIOT Act. FinCEN officials told us that
limited resources currently precluded the agency from routinely
analyzing and publishing trend information about CTRs filed by
depository institutions. However, the officials noted that the agency
recently completed a study of CTR trends and patterns, and they were
considering whether to include information on CTRs in the SAR Activity
Review. Many officials we interviewed and those responding to our
survey indicated that they were genuinely interested in how CTRs were
being used. Further, our interviews with depository institution
officials suggest that they would better understand the value of
meeting their requirements if the institutions were provided with some
information on CTR use, similar to that reported on uses of SARs.
Financial Institutions Incur Some Costs to Meet Requirements Regardless
of the Number of CTRs They File:
Our analysis of CTRs filed during calendar years 2004 to 2006 shows
that a large proportion was filed by a small number of the largest
depository institutions. While these institutions therefore likely
incur the greatest expenditure of time and resources, all depository
institutions incur some costs to meet CTR requirements, regardless of
the number of CTRs they file. This is because institutions must have
processes and trained staff in place to identify when and if a CTR is
required, including the ability to aggregate same-day cash transactions
made by or on behalf of the same person, and to file CTRs correctly.
While automation has made these tasks less difficult, many institutions
reported that their processes still include "manual" steps.
Institutions we contacted were generally unable to quantify their costs
for meeting CTR requirements, in large part because they use the same
processes and staff for meeting other BSA requirements or for other
purposes.
While Most Depository Institutions File CTRs, a Small Number of the
Largest Institutions Account for the Majority:
Our analysis of FinCEN's data on the numbers of CTRs filed annually
shows that, from 2004 to 2006, a relatively small number of the
nation's approximately 17,000 depository institutions accounted for the
large majority of CTRs filed. For example, in 2006, fewer than 30 very
large banks (those with assets of $50 billion or more) accounted for
over half (55 percent) of new CTRs during this period, while banks with
assets between $1 billion and $50 billion accounted for another 30
percent.[Footnote 31] The largest credit unions--those with assets of
$100 million or more--accounted for only 1 percent of new CTRs, and
credit unions in total accounted for less than 2 percent. (For
illustrative purposes, the remainder of this section focuses on CTRs
filed in 2006. Details on the numbers of CTRs filed during the 3-year
period, including analyses by institutions of different sizes, appear
in app. III.)
In 2006, nearly two-thirds of depository institutions filed at least
one CTR--89 percent of banks and 42 percent of credit unions. However,
the CTRs were concentrated among the larger institutions (see fig. 3).
For example, the 27 very large banks (representing less than one-half
of 1 percent of all banks) filed 55 percent of the CTRs filed.
Figure 3: CTRs Filed in 2006 by Banks and Credit Unions, by Asset Size:
This figure is a combination of bar graphs showing CTRs filed in 2006
by banks and credit unions, by asset size.
[See PDF for image]
Source: GAO.
Notes: The size categories are based on institutions' assets, as
follows: very large banks (greater than $50 billion); large banks
(greater than $1 billion - $50 billion); midsize banks (greater than
$100 million - $1 billion); small banks ($100 million or less); large
credit unions ($100 million or more); midsize credit unions ($10
million to less than $100 million); and small credit unions (less than
$10 million).
[A] The actual percentage for very large banks was 0.2.
[B] The actual percentage for small credit unions was about 0.01. The
actual percentage for midsized credit unions was about 0.2 percent.
[End of figure]
Further analysis of the CTRs filed in 2006 revealed that the 100
largest depository institutions filed 7.8 million CTRs, or 65 percent
of the total. One institution--the single largest filer--accounted for
1.7 million CTRs (14 percent of the total). The median number of CTRs
filed by banks in each size category was as follows: very large banks,
125,202; large, 1,889; midsize, 154; and small, 17.
Regardless of the Number of CTRs Filed, Institutions Incur Costs to
Establish and Maintain a CTR Filing Process:
Some institutions may rarely file CTRs--for example, our analysis
showed that over 5,900 institutions did not file any CTRs in 2006--but
nevertheless incur costs to establish a filing process and train their
staff to meet CTR requirements. All of our survey and interview
respondents reported that they had established processes to file CTRs
and thus incurred costs associated with these processes.[Footnote 32]
While the following briefly summarizes and depicts a typical process,
we found much variation both within institutions--for example,
procedures for filing CTRs resulting from aggregated transactions
differed from those applicable to a single transaction--and among
institutions.
At most institutions, the CTR filing process typically involves a
number of steps and staff members (see fig. 4). The staff may include
tellers, branch supervisors, and compliance officers.[Footnote 33] A
teller typically inputs the information needed to fill out the CTR
form, during or immediately following a cash transaction greater than
$10,000. The teller completes the form, either by hand or through an
automated system, and passes it to a branch-level supervisor for
review. Once this review is complete, the CTR is sent either
electronically or in hard copy to the institution's compliance office
for an additional review and compliance check. Once the compliance
check is complete, the CTR is signed and sent either electronically to
FinCEN or by mail to the IRS.
Figure 4: General Process for Filing CTRs:
This figure is a flowchart showing the general process for filing CTRs.
[See PDF for image]
Source: GAO (analysis); Art Explosion (images).
[End of figure]
To identify cases in which a CTR may be needed if certain individual
transactions are aggregated and for other purposes, depository
institutions generally keep a daily report of transactions across their
branches and service centers and aggregate the transactions by
customers' tax identification numbers.[Footnote 34] Typically,
compliance office staff review the aggregation report to see if any of
the aggregated transactions made by or on behalf of the same person
meet the CTR filing threshold. Some depository institution officials we
interviewed said that reviewing this aggregation report could take from
1 to 2 hours a day, while others noted that it was a time-consuming
process because it was a manual or partly manual process. Further, if
information is missing, additional time is required to obtain it. Our
analysis of CTR data shows that in 2006, 65 percent of all CTRs filed
resulted from aggregated, rather than single, transactions.
Many of our survey and interview respondents said that, in general,
their CTR process was not complex: Fifty percent said the process was
very or somewhat simple for their institution to complete. However, 21
percent of the survey respondents said their process was very or
somewhat complex. Officials we interviewed and surveyed also noted
that, in general, a number of variations to the basic process outlined
in figure 4 exist, depending on circumstances. For example, additional
time and effort is needed to fill in any required information that a
teller failed to obtain at the time of a transaction. Similarly, if an
institution filed a CTR with an error, subsequently filing an amended
CTR may involve collecting additional information about the
transaction; and "backfiling" (cases in which an institution files a
CTR after discovering one needed to be filed) may require time-
consuming review of an account's transactions over a period of time.
In addition, we found that while most depository institutions generally
follow the same process for filing CTRs, significant variations can
exist among them, which may be attributed to the quantity of CTRs
filed, the number of staff involved, the degree of automation, or
institutional preferences in reviewing and processing CTRs.
Technology Has Expedited Some Steps in the Filing Process, but
Institutions Have Not Automated All Steps:
Technology has helped some depository institutions expedite and
streamline many or some parts of the CTR process. Overall, 78 percent
of institutions responding to our survey reported that at least one
part of their CTR filing process was mostly or fully automated. Many of
the institutions we spoke with have software systems that prompt the
teller when a CTR is necessary for a transaction, and some institutions
have systems that allow tellers to electronically access the CTR form
at their workstation and enter the necessary information. Additionally,
some depository institutions reported that they had software systems
that automatically fill in some parts of the form. Also, some banks
have invested in software that processes CTRs for final reviews by
their compliance office staff.
However, the extent of automation varied widely among specific steps in
the process (see fig. 5), and no survey respondents reported a
completely automated CTR process. For instance, 35 percent of survey
respondents said they had a mostly or fully automated process for their
tellers to fill out CTR forms, while 48 percent reported this step was
largely manual and 16 percent used a mix of manual and automated steps.
The step that was most likely to be automated was the aggregating of
daily cash transactions: 68 percent of survey respondents reported that
their systems automatically generate this aggregation report. The step
least likely to be automated was the supervisory review of CTRs; about
10 percent of survey respondents reported that the review processes at
the branch level had been automated. While we did not obtain data
showing how the extent of automation compares with the volume of CTRs
filed, our structured interviews with officials from depository
institutions suggest that institutions filing the most CTRs (generally
the larger institutions) were more likely to have highly automated
processes than smaller institutions filing fewer CTRs. Because of the
cost, many smaller banks that do not file as many CTRs may choose not
to invest in systems that could provide a greater degree of automation.
Figure 5: Extent to Which Steps in the CTR Process Were Automated at
Surveyed Institutions:
This figure is a combination bar graph showing the extent to which
steps in the CTR process were automated at surveyed institutions.
[See PDF for image]
Source: GAO.
[End of figure]
The extent of automation could influence the time needed to process
CTRs. Overall, survey respondents reported a median time of 25.2
minutes to complete a CTR in 2007 (see fig. 6). In 1998, FinCEN
estimated that it took about 24 minutes to complete a CTR.[Footnote 35]
Figure 6: Median Time, in Minutes, to Accomplish Each CTR Filing Step:
This figure is a bar graph showing median time, in minutes, to
accomplish each CTR filing step.
[See PDF for image]
Source: GAO.
Note: The median values for each of the steps have been rounded to the
nearest 0.5 minute. The median values for each step do not necessarily
sum to the total median time. The 95 percent confidence interval for
"teller fills out CTR" is from 4.9 to 8 minutes, the interval for "CTR
sent to IRS" is from 2.6 to 4.1 minutes, and the interval for the
median time total is from 24.4 to 28.8 minutes.
[End of figure]
Although FinCEN has taken steps to encourage institutions to file CTRs
electronically, 76 percent of our survey respondents said that they
filed CTRs by mail, while 14 percent reported that they filed
electronically, 6 percent filed by magnetic media, and 4 percent a
combination of these methods.[Footnote 36] However, institutions that
do not file CTRs electronically may account for a small proportion of
all CTRs. According to FinCEN data, 47 percent of all CTRs filed by
financial institutions in 2006 were filed electronically, while 22
percent were filed by mail, and 31 percent were filed by magnetic
media. Further, the use of electronic filing appears to be growing; in
fiscal year 2003, only about 5 percent of CTRs were filed
electronically. Some depository institution officials said the ability
to e-file has made filing CTRs much easier at their institution. Others
stated that they choose not to file electronically because the volume
of CTRs they filed did not justify the required time and effort
involved. According to FinCEN, electronic filing is best suited for
institutions that file a larger volume of CTRs; however, the overall
benefits of e-filing to lower-volume filers--for example, the e-filing
system provides the institution submitting the CTR with an electronic
confirmation of its receipt--in many instances may outweigh development
costs.
Depository Institutions Could Not Quantify Costs Specific to CTR
Requirements:
Although they provided some anecdotal estimates, officials of
depository institutions we interviewed had difficulty separating costs
for meeting CTR requirements from other BSA costs, such as preparing
Suspicious Activity Reports.[Footnote 37] In particular, we found that
at some banks, some staff and automated systems were used to meet CTR
and other BSA filing requirements. While we asked institutions we spoke
with to provide estimates of costs based on categories such as
personnel, training, and technology, not all institutions were able to
do so because they do not typically account for CTR costs in this way.
However, officials from institutions we interviewed did describe
general types of costs and provided some estimates.
In general, personnel costs associated with CTRs may include the cost
of training staff on meeting CTR requirements, as well as the cost of
labor involved in filing CTRs. They may include salary expenses for
tellers, branch managers, and BSA compliance staff. Most institutions
said they provide annual training on when and how to file CTRs, and
that staff members, including tellers, spent an average of about 1 hour
each in CTR training. At smaller institutions, fewer staff may receive
training; for example, a compliance officer at one smaller bank told us
that 26 staff members received four hours of BSA training annually, a
portion of which is dedicated to CTRs. In contrast, the BSA officer at
a very large bank said that 1 hour of CTR training is provided annually
to 160,000 staff; officials from a very large bank said it registers
about 40,000 hours in CTR training each year among its staff. Many
depository institutions indicated that training on CTR requirements was
part of a larger BSA training course, while a few said they offered
training modules focused on CTRs. For example, at a cost of $15,000,
one bank has purchased access to a Web-based training program that
offers courses on CTRs, as well as other areas of BSA. Furthermore,
officials at one very large institution noted that, in particular, they
had to conduct training more often for tellers because of high rates of
turnover in teller positions.
While all institutions incur some level of costs for training their
staff, our interviews suggest that typically the higher the number of
CTRs an institution filed, the higher the number of associated
personnel--and therefore presumably training costs. Similarly, the
labor costs associated with actually preparing CTRs would be expected
to be larger among the institutions that file the most CTRs--though, as
noted, such costs are also affected by the type of process used,
including the degree of automation. The highest-volume CTR filers
reported having staff solely dedicated to filing CTRs and exemptions;
for example, one very large bank employed more than 190 staff at CTR
operations centers, and representatives of another very large bank
reported 60 staff members who worked exclusively on CTRs. Conversely,
representatives of one midsized bank said that they had one and a half
full-time equivalent positions in their compliance office dedicated to
CTRs.
Reflecting the range of numbers of staff that may be involved,
officials provided a wide variance of estimated personnel costs. For
example, the very large bank with more than 190 dedicated staff (which
filed over 1 million CTRs in 2006) estimated the cost to be "several"
million dollars. Other large filers also reported high costs for staff
salaries that ranged from just less than $1 million to over $5 million.
For example, one very large bank that filed almost 1 million CTRs in
2006 estimated the cost at $5.4 million--$3.6 million for the
approximately 25,000 tellers involved and $1.8 million in personnel
costs for staff dedicated to CTRs. In comparison, officials from one
large bank that filed just fewer than 5,000 CTRs in 2006 estimated that
personnel costs for tellers and compliance office staff were slightly
more than $76,000 for the year. Similarly, the midsize bank that
reported one and a half full-time equivalent positions dedicated to
CTRs, and filed approximately 2,300 CTRs in 2006, estimated personnel
costs of about $31,000 for the compliance office staff but was unable
to provide an estimate for the costs associated with the tellers' time.
Officials from smaller institutions we spoke with generally estimated
lower costs and indicated that CTR filing responsibilities at their
institutions were handled by staff that had other responsibilities, as
well; one estimated that staff time for filing 65 CTRs in 2006 cost a
little less than $2,000.
As noted above, institutions have automated processes for meeting CTR
requirements to differing extents, and officials cited technology as a
significant cost. For example, one large bank was considering adding a
CTR module to its current software at a cost of between $60,000 and
$70,000; another large bank reported recently spending about $30,000 to
purchase a new software component. However, because many of the
institutions we spoke with also used these systems for other processes,
they were not able to break out the costs exclusively for CTRs. For
example, some officials told us their systems cost in the thousands of
dollars but that they used the systems for monitoring cash transactions
for suspicious activities, as well as for preparing CTRs. As a result,
officials we interviewed said that, even if CTR requirements were
eliminated, their institutions would still incur both personnel and
systems costs because of other BSA compliance activities. An official
of a very large bank said that if the CTR requirement were eliminated,
the bank would be able to eliminate or reassign 14 staff to other
activities but still would need to prepare many of the same reports,
such as aggregation reports, because they are used for other purposes,
such as identifying suspicious activity. An official of a large bank
told us if there were no CTR filing requirement, the bank would realize
reductions in some technology costs but would retain staff involved for
their expertise and skills in other parts of its BSA program.
Uncertainty about Required Documentation and Some Regulatory
Requirements May Unnecessarily Discourage Use of Exemptions:
FinCEN data show that depository institutions filed about 31,500 Phase
I and 39,300 initial Phase II exemptions during 2004-2006.[Footnote 38]
However, according to our survey results, many financial institutions
with customers considered eligible for exemptions do not actually
exempt them but instead continue to file CTRs on the customers'
transactions--despite the institutions' recognition that making use of
the exemption provisions would enable them to file fewer CTRs.
(Complete survey results can be viewed at [hyperlink,
http://www.gao.gov/cgi-bin.getrpt?GAO-08-385SP.] Among the reasons
cited by institutions was uncertainty about the documentation required
to demonstrate that some customers are in fact eligible, accompanied by
some concern that examiners from the federal banking regulators would
deem the documentation insufficient and cite them for BSA
noncompliance. Our discussions with examiners revealed variations in
the types of documentation they find acceptable, although our review of
data from the banking regulators showed relatively few violations
concerning exemptions compared with the number of BSA examinations
conducted. Other factors discouraging use of exemptions were the cost
and effort involved in meeting FinCEN's regulatory requirements to (1)
file an exemption form, and annually review and update the information,
particularly for certain customers that are specifically exempted by
statute, as appropriate; and (2) biennially file a form to document the
continued eligibility of customers that have been exempted under the
Phase II regulations--which as a practical matter duplicates the
required annual review process for those customers. Factors the
institutions indicated might encourage use of exemptions included (1)
shortening the waiting period--currently a full year under FinCEN's
regulations--before exempting certain customers with a relatively large
volume of cash transactions, and (2) making Web-based material
available to help train and guide depository institutions' staff in
making exemption determinations. Because the transactions of exempt
customers are likely to be of little or no value to law enforcement,
actions to encourage depository institutions to make greater use of
exemptions could avoid the burden of filing some CTRs without harming
law enforcement efforts.
While Recognizing the Benefits of Exemptions, Depository Institutions
Do Not Exempt All Eligible Customers:
Exemptions allow institutions to avoid filing CTRs for the exempt
customers, but the institutions are not required to exempt eligible
customers. According to the results of our survey, institutions that
made use of exemptions primarily did so because it allowed them to file
fewer CTRs, was cost-effective, and the determinations involved were
fairly easy. As shown in figure 7 below, the reasons generally were
consistent for both Phase I and Phase II exemptions.
Figure 7: Factors That Surveyed Institutions Reported as of Very Great
or Great Importance to Their Decision to Exempt Phase I and Phase II
Customers:
This figure is a combination bar graph showing factors that surveyed
institutions reported as of very great or great importance to their
decision to exempt Phase I and Phase II customers.
[See PDF for image]
Source: GAO.
Note: For the category "other factors," the 95 percent confidence
intervals for the very great/great importance and some/little or no
importance estimates are within +/-12 percentage points.
[End of figure]
The primary reason cited for using the exemption process was that it
allowed institutions to file fewer CTRs. While it would be difficult
for an institution to track the number of CTRs it "saved" or avoided by
exempting a customer, some had; for example, a smaller institution
reported that it recently began using exemptions more extensively, and
by exempting five more Phase II eligible customers, the institution
anticipated filing almost 200 fewer CTRs. (However, the effect of
exempting a single customer on the number of CTRs filed cannot be
generalized; for example, an exemption might avoid 8 CTRs or 100,
depending on the volume of cash transactions in which the customer
typically engaged.) Institutions also frequently cited the cost-
effectiveness of using exemptions; while they had difficulty estimating
the cost of establishing exemptions, just as they did for the costs of
filing CTRs, some institutions regarded exempting customers as less
costly than filing CTRs. Officials at other institutions we interviewed
cited recent advances in commercial software systems that made
exemptions easier. For example, software can identify the customers
potentially eligible for the Phase II exemption due to the volume of
high cash transactions they engaged in during the year. In addition, at
least one software vendor makes available for purchase a database of
companies listed on stock exchanges that are eligible for the Phase I
exemption.
Despite the cost-effectiveness of using exemptions, institutions
responding to our survey did not exempt all of their eligible
customers. For example, while 77 percent of the institutions reported
having customers eligible for the Phase I exemption, only 45 percent
reported that they always or usually filed Phase I exemptions.
Similarly, 83 percent of the institutions reported having customers
eligible for the Phase II exemption, but only 49 percent reported that
they always or usually filed Phase II exemptions (see fig. 8).
Figure 8: Percentage of Depository Institutions with Customers Eligible
for Phase I and II Exemptions and Extent to Which They Filed Exemptions
in 2006:
This figure is a combination pie and bar graph showing percentage of
depository institutions with customers eligible for Phase I and II
exemptions and extent to which they files exemptions in 2006.
[See PDF for image]
Source: GAO.
Note: The shaded portion of each circle equals the percentage of
institutions reporting that they had customers eligible for the
exemptions.
[End of figure]
Some institutions that file large numbers of CTRs--and, therefore,
might realize the greatest savings by avoiding CTRs--do not file many
exemptions. Some of the reasons for this are discussed in the following
sections. (Further details on the results of our survey, including the
percentages of institutions that cited specific factors affecting their
decisions to exempt or not exempt customers, are presented in app. IV
and in GAO-08-385SP.)
Uncertainty about Documentation Needed to Demonstrate Eligibility,
Accompanied by Concerns of BSA Noncompliance, Deterred Some Exemptions:
The leading reason identified by survey respondents that choose not to
file Phase II exemptions was difficulty in determining the percentage
of a customer's gross revenue derived from lines of business not
eligible for exemption. This difficulty--along with other concerns,
including that federal banking regulators would deem documentation
insufficient--contributed to a reluctance to exempt customers that the
institutions considered potentially eligible.
The responses of officials of institutions we interviewed were
consistent with our survey results. Officials explained that a fair
amount of research was required on their part to determine eligibility
under the Phase II regulations--for example, examining a business's tax
returns or financial statements--and that it was not always clear if
the customer qualified for the exemption because it was difficult to
determine which part of a business customer's revenue was derived from
which activity. The depository institutions that chose to use the Phase
II exemption used various methods to document the portion of revenues
derived from ineligible activities. Officials of several institutions
we interviewed said they arrived at this determination after conducting
what they said was exhaustive research, which included analyzing
financial statements, searching the Internet, and reviewing available
documents if the institution had a lending relationship with the
customer, or asking the customer for documents. Officials of other
institutions used less labor-intensive methods; for example, an
official of one midsize institution indicated that the account officer
simply asked customers about the source of their gross revenue and made
a notation in the customer's file. Several institutions reported using
a letter from the customer to self-certify that no more than 50 percent
of their gross revenue came from activities or lines of business
ineligible for exemption.
Officials from the federal banking regulators generally indicated that
they did not have a standardized expectation for what documentation
(such as financial statements or tax documents) an institution might
use to demonstrate the portion of revenues derived from ineligible
activities. They further noted that examiners have some flexibility in
determining what level of documentation is required, based on guidance
in the:
BSA/AML Examination Manual.[Footnote 39] The same manual is used by
each of the five federal banking regulators and is available to
depository institutions to help guide their BSA compliance activities.
However, our interviews with officials and examiners indicated
differences among them regarding the type of documentation acceptable.
For example, federal regulators and examiners we interviewed had
different views about the use of a self-certifying letter and whether
depository institutions ought to provide other documentation. While
Federal Reserve and FDIC officials said the acceptance of a self-
certifying letter would depend on the circumstances, they generally
noted that examiners had flexibility in deciding what level of
documentation would be acceptable. Officials from OTS and OCC, on the
other hand, indicated that a self-certification letter alone would be
inadequate to show eligibility. Because, in this instance, the federal
banking regulators examine institutions for compliance with FinCEN's
regulations, additional guidance from FinCEN could help reduce the
difficulties that depository institutions face in making this
determination and clarifying, for both the institutions and the
regulators, the types of documentation acceptable for demonstrating
eligibility.
Officials and examiners we interviewed from all of the federal banking
regulators indicated that they have found few problems with exemptions,
and our review of available violation data for 2005 and 2006 indicated
that examiners cited relatively few violations for exemptions. We asked
the regulators to disaggregate their data on violations to distinguish
those related specifically to exemptions; only the Federal Reserve,
FDIC, and OCC were able to provide this level of detail. These three
agencies are responsible for examining about 7,800 depository
institutions, including the largest banks that likely account for the
greatest numbers of CTRs. As shown in table 3, the three agencies
collectively found violations associated with exemptions in less than 5
percent of the BSA exams they conducted--a combined total of 227
violations for exemptions in 2005 and 113 violations for exemptions in
2006.
Table 3: Exemption Violations Cited in BSA Examinations by FDIC,
Federal Reserve, and OCC, 2005 and 2006:
2005;
Agency: FDIC;
Number of BSA examinations conducted: 3,029;
Number of exemption violations issued: 178;
Percentage of exemption violations per examination: 5.9.
2005;
Agency: Federal Reserve;
Number of BSA examinations conducted: 678;
Number of exemption violations issued: 10;
Percentage of exemption violations per examination: 1.5.
2005;
Agency: OCC;
Number of BSA examinations conducted: 1,510;
Number of exemption violations issued: 39;
Percentage of exemption violations per examination: 2.6.
2005;
Agency: Total;
Number of BSA examinations conducted: 5,217;
Number of exemption violations issued: 227;
Percentage of exemption violations per examination: 4.4.
2006;
Agency: FDIC;
Number of BSA examinations conducted: 2,825;
Number of exemption violations issued: 80;
Percentage of exemption violations per examination: 2.8.
2006;
Agency: Federal Reserve;
Number of BSA examinations conducted: 815;
Number of exemption violations issued: 6;
Percentage of exemption violations per examination: .7.
2006;
Agency: OCC;
Number of BSA examinations conducted: 1,547;
Number of exemption violations issued: 27;
Percentage of exemption violations per examination: 1.7.
2006;
Agency: Total;
Number of BSA examinations conducted: 5,187;
Number of exemption violations issued: 113;
Percentage of exemption violations per examination: 2.2.
Source: GAO analysis of Federal Reserve, FDIC, and OCC data.
[End of table]
Similarly, we asked FinCEN for data on BSA enforcement actions it has
taken against depository institutions related to exemptions. (While
FinCEN generally coordinates with the federal banking regulators, it
may independently take enforcement actions, including imposing
penalties and fines, for BSA violations.[Footnote 40]) FinCEN data show
that, over the 10-year period 1997 to 2006, it took 110 BSA enforcement
actions related to exemptions, 4 of which included fines. (More
detailed information on FinCEN's enforcement actions is presented in
app. IV.)
The fairly low incidence of violations associated with exemptions may
reflect depository institutions' decisions to simply not grant
exemptions, thus avoiding potential violations. (Some examiners noted
that they sometimes encouraged depository institutions to use the
exemption process, for example, if the institution was filing many CTRs
on customers that were potentially eligible for the exemption.)
However, our survey and interviews demonstrate that a lack of clear
guidance from FinCEN for documenting eligibility, and the differing
interpretations among the federal banking regulators, have the effect
of dissuading depository institutions from more frequently using the
Phase II exemption. A minority of our survey respondents indicated that
they "always" exempt eligible customers--33 percent reported doing so
for Phase I-eligible customers and 26 percent for Phase II-eligible
customers. Some depository institution officials noted that any
compliance deficiency found by BSA examiners was a cause for concern.
(About 10 percent of survey respondents reported that they had received
a CTR violation or had been fined since 2000.) An official from the
very large bank that filed more than 150,000 CTRs in 2006 said it was
the bank's official policy not to exempt any new customers that were
eligible for the Phase II exemption because, among other things, the
bank faced reputation risk if it was cited for a BSA violation, and use
of the exemption process opened the bank to examiner criticism and
fines. An official from a large community bank said that the bank did
not file Phase II exemptions because of concerns about regulatory risk.
Officials from several depository institutions we interviewed
specifically said it was not clear to them what level of support was
needed, and some indicated that they would rather file CTRs than take
the risk of not satisfying an examiner.
In a 2002 report on the exemption process mandated by section 366 of
the USA PATRIOT Act, FinCEN concluded that it should work with the
federal banking regulators, as well as banks, to reduce "fear of
adverse regulatory consequences from making incorrect exemption
determinations."[Footnote 41] Exemptions are addressed in the BSA/AML
Examination Manual, which was first published in 2005 and, as noted, is
used by the banking regulators and is available to depository
institutions. However, 68 percent of our survey respondents said that
difficulty in determining whether companies derive more than 50 percent
of their revenues from ineligible business activities was a "very
great" or "great" factor in their decision not to exempt Phase II-
eligible customers. Guidance that could help institutions make greater
use of this exemption would help avoid unnecessary CTRs that are of
little or no use to law enforcement.
Biennial Renewals, Which Duplicate Annual Reviews, Discourage Use of
Some Phase II Exemptions:
FinCEN's regulations require that depository institutions (1) annually-
-at least once a year--review and verify the information supporting any
exemptions that they have filed for either Phase I or Phase II
customers, and (2) biennially file--on March 15 of the second calendar
year following the initial exemption--a renewal form to continue the
exemption of Phase II customers. The purpose of the annual review is to
ensure that the customers continue to qualify for exemption; according
to FinCEN, the biennial renewal provides formal notification to FinCEN
that the institution has monitored the customers' transactions as
required. About 49 percent of our survey respondents indicated that the
time-consuming nature of the biennial renewal was of great or very
great importance in contributing to their decision not to exempt
customers eligible for Phase II exemptions.[Footnote 42] An official
from the very large bank that filed more than 150,000 CTRs in 2006 said
it was the bank's official policy not to exempt any new customers that
were eligible for the Phase II exemption because of the costs
associated with the biennial renewals and the need to keep track of
which exemptions had to be renewed in each year. Officials from
depository institutions we interviewed, particularly those that did not
exempt customers, also said that the need to conduct this review
discouraged their use of the exemption.
Officials of some depository institutions questioned the value added by
biennial renewals, observing that they were already conducting the
annual review as well as monitoring all of their customers for
suspicious activities, which is part of a strong anti-money-laundering
program pursuant to section 352 of the USA PATRIOT Act. Even officials
of institutions that nevertheless filed and maintained exemptions
considered the requirement to be redundant. For example, officials at
one of the very large banks--which had more than 1,900 Phase II
exemptions on file--said they filed the "biennial" renewal form every
year for every customer, because the bank went through the same steps
for the biennial renewals as it did for each required annual review and
did not want to risk failing to file a biennial renewal form in the
correct year. Further, our analysis of FinCEN data revealed that some
institutions file biennial renewal forms on Phase I customers, although
they are required only for Phase II customers (in 2006, depository
institutions filed 1,382 biennial renewals on Phase I customers).
FinCEN established the biennial renewal requirement based on its
interpretation of the Money Laundering Suppression Act. Specifically,
the act requires the Secretary of the Treasury to prescribe regulations
requiring that depository institutions review, at least annually, the
qualified business customers that they have exempted and to "resubmit
information about such customers" to the Secretary.[Footnote 43]
According to FinCEN, the implementing regulations provided for the
information to be resubmitted biennially, rather than annually, because
the statute does not explicitly set a time frame for the
resubmission.[Footnote 44] Further, FinCEN officials believe that the
Secretary has general authority to prescribe appropriate exemptions to
requirements under the BSA, including revising the regulations to
eliminate the biennial renewals.[Footnote 45]
FinCEN officials said that the biennial renewal form provides them with
evidence that the exempt business remains eligible for the exemption
and that the institution has been monitoring the business for
suspicious activity. In addition, they reported that FinCEN routinely
analyzes biennial renewal forms (along with other information) filed on
and by specific depository institutions that are the subjects of
compliance or enforcement actions by the federal banking regulators to
determine if the institutions properly granted exemptions to eligible
customers. However, these activities essentially duplicate those of the
bank examiners who, as part of the examination process, ascertain
whether institutions properly grant exemptions and monitor their
customers for suspicious activity.[Footnote 46] Examiners from a few of
the banking regulators indicated that the biennial renewal requirement
results in depository institutions collecting the same kinds of
information that they collect as part of the annual review of
exemptions. Further, all biennial renewals must be filed on March 15,
regardless of when the exemption was filed. Officials from the Federal
Reserve noted that meeting both requirements can impose significant
compliance costs on the institutions, yet the duplication provides no
offsetting benefit for supervisory efforts. Eliminating the requirement
for biennial renewals could encourage more institutions to make use of
Phase II exemptions and reduce the burden associated with filing
unnecessary CTRs.
Current Regulations Require Institutions to File Exemptions for
Customers That Are Statutorily Exempt:
Recognizing that the cash transactions of customers that are depository
institutions or governmental entities would likely be of little or no
use to law enforcement efforts, the Money Laundering Suppression Act
specifically directed that the Secretary of the Treasury exempt
depository institutions, as appropriate, from filing CTRs on the
transactions of these customers. FinCEN did so, but its regulations
require depository institutions to file exemption forms if they choose
to exempt these types of customers--and to annually review and verify
the information supporting the exemption. The statute does not mandate
annual reviews for these customers.
In essence, the regulations treat these entities like all other
customers eligible for Phase I exemptions, including listed companies
and majority-owned subsidiaries. Accordingly, if depository
institutions choose to exempt these customers, they must perform the
same steps and incur costs for annual reviews as they do for other
customers they exempt. But depository institutions and governmental
entities, in contrast to other Phase I entities such as publicly traded
companies, are unlikely to change those characteristics that initially
qualified them for exemption.[Footnote 47] For example, a governmental
entity is unlikely to become a private company. In any case, a change
in the status of a governmental entity or bank would most likely
require that the exempted bank account be closed and a new one be
opened--triggering a new consideration for exemption.
Few institutions we interviewed cited difficulty in determining
eligibility for their customers that are other depository institutions
or government entities, and many said that, in these cases, they exempt
all eligible customers. However, they would have incurred some cost to
file the form and to annually review the supporting information. In
response to our survey, officials of depository institutions reported
that their staff took a median time of about 34 minutes to exempt a
Phase I customer, and about 14 minutes for the annual review
process.[Footnote 48] Further, some depository institutions do not
exempt these customers and continue to incur the cost of filing CTRs.
For example, our analysis of FinCEN data shows that, in 2006, almost
87,000 CTRs were filed on over 2,900 depository institutions, and about
45,000 CTRs were filed on some 5,500 government entities.[Footnote 49]
These CTRs are unnecessary in that the cash transactions of these
entities are not likely to have a high degree of usefulness for law
enforcement.
According to FinCEN officials, the information provided on the
exemption forms for these entities is not required for analytical
purposes per se but rather serves as the basis for recording which
financial institutions had chosen to exempt specific depository
institutions and governmental agencies. However, depository
institutions are separately required to keep records of customers'
transactions for BSA purposes.[Footnote 50] Federal Reserve officials
specifically noted that they believed that the automatic exemption of
domestic depository institutions from the CTR filing requirement should
be considered and that eliminating the need to file an exemption and
keep it current for these entities would make the CTR process more
efficient. Continuing to require depository institutions to file forms
on these entities--and to incur the cost and effort of annually
reviewing the information supporting the exemption--discourages use of
the exemption, resulting in CTRs that are likely to be of little or no
value to law enforcement.
Length of Time Allowed Before Frequent Customers Can Be Exempted May
Result in Unnecessary CTRs:
FinCEN's Phase II exemption regulations specify that, in order to be
eligible for exemption, among other things customers must have held an
account for at least 1 year and must have "frequently" engaged in
currency transactions in excess of $10,000. In a November 2002 guidance
memorandum, FinCEN defined "frequently" as at least eight large
currency transactions in a 1-year period (with an exception for
seasonal customers).[Footnote 51] Officials of several banks we
surveyed said that their use of exemptions for Phase II customers would
increase if they were permitted to exempt businesses with frequent cash
transactions in less than 12 months.
As explained by an official of one institution, a year seems to be an
unnecessarily long time if the business is by nature cash-intensive and
not suspicious, and the institution regularly files CTRs on the
business. Or, as other officials noted, a waiting period of less than 1
year would be appropriate if the ownership of a business changed but
the transaction activity remained relatively similar to that under the
previous owner, or if known customers chose to form new businesses. We
analyzed FinCEN's data to identify the numbers and frequency of CTRs
filed on customers that were subsequently exempted. We found that,
among customers that were initially exempted in 2006, the median number
of CTRs filed in the 12 months preceding the exemption was 14; the
median number filed in the 8 months preceding exemption was 11; and in
the preceding 6 months, it was 9.[Footnote 52] This analysis
demonstrates that many customers that were later exempted engaged in
more than the 8 transactions in a 12-month period required by FinCEN--
generating thousands of unnecessary CTRs.
FinCEN promulgated its regulations establishing the 12-month
requirement before enactment of the USA PATRIOT Act. That law provided
for customer identification programs, for which FinCEN regulations
require depository institutions to collect sufficient information to
verify the identity of customers when they first open an
account.[Footnote 53] Thus, depository institutions must require new
business customers to provide their name, physical location, and
taxpayer identification number, at a minimum, at account opening.
Furthermore, as noted above, BSA compliance programs require depository
institutions to monitor their customers for suspicious activity. Thus,
continuing to require a 12-month period before allowing otherwise
nonsuspicious customers with large numbers of cash transactions to be
exempted may needlessly cause depository institutions to file CTRs that
are not highly useful to law enforcement efforts.
Material to Help Train Institutions on Requirements Could Increase Use
of Exemptions:
FinCEN currently provides material on its Web site, such as answers to
frequently asked questions, rulings and guidance, and information on
BSA requirements. However, the responses to frequently asked questions
and rulings and guidance concerning exemptions are limited and
dated.[Footnote 54] Forty-eight percent of respondents to our survey
indicated that the availability of Web-based material from FinCEN would
greatly or moderately increase their use of the Phase I exemption, and
51 percent of respondents said it would greatly or moderately increase
their use of the Phase II exemption. Such material would help train
respondents' staff and guide them in interpreting and applying the
exemption requirements. Officials of depository institutions we
interviewed generally indicated that they currently purchase training
modules from vendors, hire trainers, or have their compliance officers
develop in-house training.
Our work suggests that material to help train staff could assist
depository institutions in making some eligibility determinations under
both the Phase I and Phase II regulations and help overcome
difficulties that often dissuade institutions from greater use of the
exemptions. As previously discussed, our survey results and interviews
with depository institution officials highlighted difficulties in
determining the portion of a customer's gross revenue derived from
lines of business not eligible for the exemption, which dissuaded some
institutions from using the Phase II exemption. Similarly, about 39
percent of survey respondents indicated that difficulties in
determining eligibility was a factor of great or very great importance
in their decision not to exempt a customer eligible for the Phase I
exemption.[Footnote 55] The difficulties included determining whether
customers are "listed" (publicly traded) companies or are majority-
owned subsidiaries of such companies. FinCEN's regulations provide that
institutions may, among other things, rely on documents filed with the
Securities and Exchange Commission or listings of the three stock
exchanges published in newspapers or available on Web sites.[Footnote
56] However, officials we interviewed stated that verifying the
publicly traded status of customers was not always straightforward, and
it is sometimes difficult to determine ownership structures. For
example, officials from one bank explained that the bank held a number
of accounts for a large publicly traded video rental chain; some of the
stores were corporately owned while others were independent franchises.
While the company-owned stores would be part of the publicly traded
company, the franchise operations were not likely to be publicly
traded. The bank did not exempt any of these accounts, however, to
avoid the risk of exempting a customer that was not eligible for the
Phase I exemption. Further, some survey respondents stated they had
difficulty determining eligibility when a customer is a subsidiary of a
listed company. One respondent noted that his institution would not
attempt to exempt such a customer because it was too difficult to
document eligibility in this case.
In addition, our analysis of FinCEN's data on exemptions filed from
2004 through 2006 suggests that institutions might benefit from the
availability of Web-based material from FinCEN. For example, we found
that some institutions were filing biennial renewals for Phase I
exemptions, even though FinCEN regulations require renewals only for
Phase II exemptions. Also, our interviews with examiners from the
federal banking regulators indicated that further training might
encourage appropriate use of exemptions. For example, examiners from
FDIC and OCC reported that some institutions had difficulty
distinguishing between businesses eligible for the Phase I and Phase II
exemptions. Some examiners reported that they were educating depository
institution staff about the exemption requirements, as well as credit
union examiners in particular, on the use of Phase I exemptions for
correspondent banks.[Footnote 57]
Treasury's 2002 report on the uses of CTRs noted the importance of
making the exemption system easier for bank personnel to understand. In
preparing that report, FinCEN relied in part on a contractor's survey
of depository institutions, including their exemption practices and the
reasons underlying them. The contractor concluded that FinCEN should
offer a Web-based training module on its Web site to clarify the
exemption process. Our work for this report indicates Web-based
material that would help train staff could encourage institutions to
make greater use of exemptions, thereby avoiding the filing of CTRs
that are of little or no use to law enforcement efforts. Providing such
material on FinCEN's Web site would be a cost-effective way to help
ensure that all institutions have available up-to-date information on
how to meet the requirements.
Conclusions:
Since GAO reported over a decade ago that the large volume of CTR
reports had made analysis difficult, expensive, and time consuming,
developments in information technology have provided law enforcement
with the capacity to simultaneously analyze large quantities of CTR
data and link these with other data sets. These technological
advancements, as well as the advent of bulk data downloads and expanded
access to CTR data by state and local users, have provided law
enforcement agencies with greater potential to make use of CTR data in
their investigations of a wide variety of financial and related crimes.
Further, in addition to supporting specific investigations, CTR
requirements aid law enforcement by forcing criminals--who attempt to
avoid reportable transactions--to act in ways that increase chances of
detection through other methods. Given the multiplicity of sources that
federal law enforcement officials may tap in their investigations, and
the variety of possible case outcomes, it is understandably difficult
to link the use of CTRs with specific outcomes. However, information
that law enforcement agencies could provide on how CTRs contribute to
their efforts, similar to information they provide on their use of
Suspicious Activity Reports, is not systematically provided to
depository institutions or shared with state and local law enforcement
agencies that have more recently gained access to BSA data. Many
depository institutions indicated a desire for some assurance that the
information they provide is actually useful to law enforcement efforts.
FinCEN routinely collects and makes available information on how
Suspicious Activity Reports have contributed to investigations through
publication of its SAR Activity Review. A similar approach for
collecting and publishing CTR information could provide financial
institutions with evidence that their efforts are contributing to
detecting and deterring money laundering and other crimes. While
recognizing that this effort would entail an investment of resources,
we believe it would prove beneficial by providing depository
institutions with greater awareness that CTRs are a valuable source of
data for law enforcement investigations.
With the partial exception of institutions that file the largest
numbers of CTRs and have personnel dedicated to that function, most
institutions are not able to quantify their costs of complying with CTR
requirements, largely because they use the same personnel and automated
systems for a variety of purposes. Nevertheless, depository
institutions expend what could be considered to be significant amounts
of time and resources to meet the requirements. Most depository
institutions, based on over 35 years of collective experience in filing
CTRs, have established processes that have allowed the filing of most
CTRs to become fairly routine. Yet, while technology has helped them
meet filing requirements more efficiently, it is clear that most
institutions' processes involve steps that cannot be completely
automated. These include reviews by compliance officers or other
officials to provide assurance that CTRs are correct and will not
unduly expose their institutions to risk of being cited for BSA
noncompliance by their examiners. Further, because all institutions are
subject to compliance with CTR requirements, all incur some costs--for
example, in training their staff--regardless of the numbers of CTRs
they file. While impacts could therefore vary among institutions
depending on the numbers of CTRs they currently file as well as the
processes they use, steps to reduce the number of unnecessary CTRs
filed could avoid some costs.
Increasing use of exemptions would help depository institutions avoid
filing unnecessary CTRs, as well as reduce the government's costs to
process them. Institutions we surveyed told us they do not exempt all
customers they consider eligible. Because the transactions of exempt
customers are likely to be of little use to law enforcement efforts,
steps to encourage the use of exemptions among depository institutions
would not be harmful to law enforcement and could avoid some CTR filing
costs. Our work indicates that FinCEN can take several steps that could
increase the use of the exemption process. While some involve changes
to regulations, they are largely consistent with goals outlined in
FinCEN's 2006-2008 strategic plan:
* The uncertainty surrounding the level of documentation required to
demonstrate the portion of a business's gross revenue that is derived
from ineligible sources appears to unduly restrict the use of the Phase
II exemption. Institutions reported using a variety of types of
documentation, and the federal banking regulators did not have
consistent views on what is required to demonstrate eligibility. In
this regard, clearer guidance from FinCEN on acceptable documentation,
made available to depository institutions and their examiners, could
increase the use of exemptions without increasing the risk of being
cited for a violation.
* The regulatory requirement to biennially renew Phase II exemptions
causes institutions who elect to exempt their customers to undertake
steps that duplicate those required for annual reviews (also required
by regulation) in order to file a form on March 15, regardless of the
date of the original exemption. While FinCEN requires the biennial
renewals to ensure that banks are properly monitoring their customers
for suspicious activity and properly granting exemptions as required,
the federal banking regulators address both of these requirements as
part of their BSA examination process. Further, as a practical matter,
institutions must "know their customers" under provisions of the USA
PATRIOT Act--enacted after FinCEN promulgated the CTR exemption
regulations--that require the institutions to verify the customers'
identities and monitor their transactions.[Footnote 58] The biennial
renewal thus appears to provide no additional benefit, and eliminating
the requirement could encourage institutions who have not exempted
customers for this reason to do so. According to FinCEN, it has
authority under existing statutes to revise the regulations to
eliminate the biennial renewals. To the extent that its authority is
not sufficient, it could seek such authority from the Congress through
legislation.
* To exempt certain customers that the Money Laundering Suppression Act
mandated be exempted, as appropriate--governmental agencies and other
depository institutions--FinCEN's regulations require depository
institutions to file the same form, and annually review the supporting
documentation, as it does for public companies and their majority-owned
subsidiaries. Yet, governmental agencies and other depository
institutions are not likely to undergo changes that would affect their
eligibility for exemption, and all CTRs filed on such entities are
likely to be of little or no use to law enforcement efforts. Removing
the requirement to file the form and annually review the supporting
information could encourage greater use of this exemption and avoid
unnecessary CTRs.
* While institutions can currently exempt otherwise eligible customers
with frequent cash transactions, FinCEN's regulations require that they
can do so only after the customer has had an account for 1 year. During
this time, the institution must continue filing CTRs on the customer's
transactions, even when from the institution's perspective the customer
is eligible but for the fact that the 12-month period had not elapsed.
Permitting institutions to exempt businesses with frequent cash
transactions within a time period of less than 1 year could help avoid
the need to file unnecessary CTRs.
* Finally, a significant percentage of our survey respondents indicated
that the availability of Web-based material to train and guide their
staff would increase their use of both Phase I and Phase II exemptions.
Our work shows that difficulties institutions experience in
interpreting requirements often dissuaded them from greater use of the
exemptions. In addition, institutions reported that they incur costs to
train significant numbers of staff annually, and the availability of
Web-based material on exemption requirements could help to alleviate
some of these costs. Web-based material would be an effective way for
FinCEN to assist institutions in making exemption determinations and
could ensure that all institutions had the most up-to-date information
on exemption requirements.
Recommendations for Executive Action:
To help depository institutions better understand the value of CTRs to
law enforcement efforts, we recommend that the Secretary of the
Treasury direct FinCEN to consider routinely providing summary
information on the use of CTRs in law enforcement efforts, similar to
that provided on the use of Suspicious Activity Reports.
To encourage greater use of CTR exemption provisions and avoid the
burden of filing CTRs that are likely to be of little or no value to
law enforcement efforts, we recommend that the Secretary of the
Treasury direct FinCEN to take the following five actions:
* Provide guidance for depository institutions and federal banking
regulators on the documentation needed to demonstrate the portion of a
business's gross revenue that is derived from activities ineligible for
the exemption.
* Remove the regulatory requirement that depository institutions
biennially renew Phase II exemptions--seeking legislation to provide
additional authority, if needed.
* Remove the regulatory requirement that depository institutions file
exemption forms, and annually review the supporting information, for
banks; federal, state, and local governmental agencies; and entities
exercising federal, state, and local governmental authority.
* Consider changing the regulatory provisions in order to permit
depository institutions to exempt otherwise-eligible nonlisted
customers who frequently engage in large cash transactions within a
period of time shorter than 12 months.
* Provide Web-based material to help train and guide staff of
depository institutions in determining eligibility for exemptions.
Agency Comments and Our Evaluation:
We provided a draft of this report for review and comment to the heads
of Departments of Homeland Security, Justice, and the Treasury; the
Federal Reserve; FDIC; NCUA; OCC; and OTS. We received written comments
from FinCen and, in a joint letter, from the Federal Reserve, FDIC,
NCUA, and OTS. These comments are summarized below and reprinted in
appendixes V and VI. The Departments of Homeland Security, Justice, and
the Treasury, the Federal Reserve, and FDIC also provided technical
comments, which we incorporated into this report, where appropriate.
In its written comments, FinCEN said that the report's findings based
upon information gathered from law enforcement reinforce the value law
enforcement gains through active use of CTRs. FinCEN concurred with the
recommendations seeking regulatory amendments and the recommendations
related to providing guidance and materials to aid industry in making
eligibility determinations for CTR exemptions. Finally, with regard to
our recommendation that FinCEN consider routinely providing summary
information on the use of CTRs in law enforcement efforts, FinCEN said
it will consider options to provide industry with additional feedback
on the use of CTRs by law enforcement.
In their joint letter, the Federal Reserve, NCUA, OTS, and FDIC
reaffirmed their support for effective administration of the BSA and
said they believe that streamlining and clarifying the exemption
regulations, as we recommend, would be a positive step.
We are sending copies of this report to interested congressional
committees, the Secretaries of the Treasury and Homeland Security, the
Attorney General, and the heads of the Federal Reserve, FDIC, IRS,
NCUA, OCC, and OTS. We will also make copies available to others on
request. In addition, the report will be available at no charge on the
GAO Web site at [hyperlink, http://www.gao.gov].
If you or your staff have any questions about this report, please
contact me at (202) 512-6878 or woodd@gao.gov]. Contact points for our
Offices of Congressional Relations and Public Affairs may be found on
the last page of this report. GAO staff who made key contributions to
this report are listed in appendix VII.
Signed by:
David G. Wood:
Director, Financial Markets and Community Investment:
[End of section]
Appendix I: Objectives, Scope, and Methodology:
As mandated by the Financial Services Regulatory Relief Act of 2006, we
examined several aspects of currency transaction reports (CTR),
including their usefulness to law enforcement, the burden on depository
institutions for filing them, and potential changes to the exemption
process. Specifically, our objectives were to determine: (1) the
usefulness of CTR requirements to federal, state, and local law
enforcement agencies; (2) the costs to depository institutions of
meeting CTR requirements; and (3) factors that affect depository
institutions' decisions to exempt or not exempt eligible customers,
including opportunities for encouraging use of exemptions while
maintaining the usefulness of CTR data to law enforcement agencies. We
conducted this performance audit in Washington, D.C., and Miami from
November 2007 through February 2008 in accordance with generally
accepted government auditing standards. Those standards require that we
plan and perform the audit to obtain sufficient, appropriate evidence
to provide a reasonable basis for our findings and conclusions based on
our audit objectives. We believe that the evidence obtained provides a
reasonable basis for our findings and conclusions based on our audit
objectives.
Assessing the Usefulness of CTR Requirements to Law Enforcement:
We relied on two primary methods to obtain information: (1) structured
interviews with federal law enforcement agencies and (2) a survey of
all state and local agencies that access CTR data through FinCEN's
Gateway portal, supplemented by structured interviews. We used
structured interviews to obtain specific information on the usefulness
of CTRs, how changes in technology have affected their usefulness, and
what changes could be made to CTR filing requirements that likely would
not harm their usefulness to law enforcement. In addition, the
Financial Crimes Enforcement Network (FinCEN), Immigration and Customs
Enforcement (ICE), the Federal Bureau of Investigation (FBI), and the
Organized Crime Drug Enforcement Task Force (OCDETF) provided
demonstrations of how they apply their software to analyze bulk CTR
data, and FinCEN provided demonstrations of how the Gateway program can
be used to access Bank Secrecy Act (BSA) data through WebCBRS.
We selected federal law enforcement agencies to interview largely based
on their level of CTR usage, as measured by the number of "views" of
CTR records in 2006 and whether they had received access to bulk data
sets (see table 4 for a list of these agencies.) While FinCEN and the
Internal Revenue Service (IRS) could provide the number of CTRs viewed
through the Gateway program, we also obtained data from Department of
Homeland Security for the number of CTRs viewed through the Treasury
Enforcement Communications System (TECS) and the IRS for the number of
CTRs viewed directly from WebCBRS. While the number of times an agency
has "viewed" a CTR is not a measure of "usefulness" or "utility" of a
CTR, it does provide an indication of how frequently CTRs were
consulted as part of an ongoing investigation. In addition, we
interviewed officials from Criminal Division/Asset Forfeiture and Money
Laundering Section because this group is the focal point for money
laundering and asset forfeiture matters within the Department of
Justice, as well as officials from the OCDETF Fusion Center, which
analyzes CTR data in bulk to improve OCDETF's ability to disrupt and
dismantle drug trafficking organizations and their financial
components.
Table 4: Federal Agencies We Interviewed and Number of CTR Views,
Fiscal Year 2006:
Federal agency: Internal Revenue Service[A];
Bulk user: Yes;
Gateway program user: No;
TECS user: Yes;
Number of CTR views: 912,405.
Federal agency: U.S. Immigration and Customs Enforcement;
Bulk user: Yes;
Gateway program user: Yes;
TECS user: Yes;
Number of CTR views: 207,325.
Federal agency: Financial Crimes Enforcement Network;
Bulk user: Yes;
Gateway program user: No;
TECS user: Yes;
Number of CTR views: 136,090.
Federal agency: U.S. Drug Enforcement Administration[B];
Bulk user: No;
Gateway program user: Yes;
TECS user: No;
Number of CTR views: 108,507.
Federal agency: Federal Bureau of Investigation[C];
Bulk user: Yes;
Gateway program user: Yes;
TECS user: Yes;
Number of CTR views: 54,290.
Federal agency: Bureau of Alcohol, Tobacco, Firearms, and Explosives;
Bulk user: No;
Gateway program user: Yes;
TECS user: Yes;
Number of CTR views: 10,124.
Federal agency: United States Secret Service;
Bulk user: Yes;
Gateway program user: Yes;
TECS user: Yes;
Number of CTR views: 9,424.
Federal agency: United States Postal Inspection Service;
Bulk user: No;
Gateway program user: Yes;
TECS user: No;
Number of CTR views: 3,586.
Federal agency: United States Attorneys Offices;
Bulk user: No;
Gateway program user: Yes;
TECS user: No;
Number of CTR views: 1,814.
Federal agency: U.S. Securities and Exchange Commission;
Bulk user: No;
Gateway program user: Yes;
TECS user: No;
Number of CTR views: 1,195.
Source: GAO analysis of IRS, FinCEN, and Department of Homeland
Security data.
Notes: While the way that the three agencies define views is generally
similar, how they actually count them may vary. The number of views of
CTRs includes those filed by all financial institutions, for example,
depository institutions and money services businesses.
[A] We interviewed officials from IRS-Small Business/Self-Employed and
IRS-Criminal Investigation, the two units within IRS with the most CTR
views.
[B] DEA includes CTRs viewed by the El Paso Intelligence Center, which
is a DEA program.
[C] FBI includes CTRs viewed by the National Crime Information Center.
[End of table]
To obtain the viewpoints of state and local law enforcement agencies on
the usefulness of CTRs, we conducted a Web-based survey of all state
and local law enforcement agencies that had access to CTR data through
FinCEN's Gateway program as of May 2007.[Footnote 59] Eighty-nine of
the 115 agencies we surveyed completed the questionnaire for an overall
response rate of 77 percent. During the development of our
questionnaire, we pretested it with 7 law enforcement agencies from
Florida, Maryland, New Jersey, Virginia, and Washington, D.C, and one
regulatory agency from Kansas. We obtained the e-mail addresses and the
names of contacts from FinCEN and opened the survey on July 5, 2007.
During the course of the survey, we sent three follow-up e-mails to
nonrespondents and then made telephone follow-up calls to remaining
nonrespondents to address any problems they had and to encourage
response. To learn more about agencies' responses, and to obtain more
information on other agencies to which our surveyed agencies had
provided BSA data access, we conducted short follow-up interviews by
telephone or exchanged e-mail with six respondents. We closed the
survey on August 17, 2007.
Although this survey was conducted with all of the state and local law
enforcement agencies in our population, and therefore is not subject to
sampling error, the practical difficulties of conducting any survey may
introduce other errors. For example, difficulties in interpreting a
particular question or sources of information available to respondents
can introduce unwanted variability or bias into the survey results.
Nonresponse to the interview or certain questions can also result in
increased variability or bias. We took steps in developing the
questionnaire, and collecting and analyzing the data, to minimize such
nonsampling errors. While the response rate of 77 percent is high, if
those not responding differed materially from those responding on any
particular question we analyzed, our analysis may not accurately
represent the group surveyed. Our results therefore best represent only
those responding to our survey.
To provide more specific information about the usefulness of CTRs than
we could obtain by survey, we also interviewed state and local law
enforcement officials. We interviewed 14 law enforcement agencies from
California, Florida, Illinois, New Jersey, New York, and Texas because
many of these agencies numbered among the highest users of CTRs and
were located in states where a higher proportion of CTRs were filed in
2006. In addition, we interviewed 3 law enforcement agencies from
Kentucky, Minnesota, and New Mexico, states where the viewing of CTRs
was less frequent. Finally, we interviewed officials from four High
Intensity Money Laundering and Related Financial Crimes Areas (HIFCA)-
-Chicago, New York, the Southwest Border, and the California Southern
District--to identify whether and how CTRs were useful to law
enforcement task forces with specific money-laundering
responsibilities.
Costs to Depository Institutions of Meeting CTR Requirements:
Overall, we used questionnaires, structured interviews, and other
methods to obtain information on the time and resources depository
institutions expend to meet CTR requirements. (Depository institutions
include institutions regulated by the Federal Deposit Insurance
Corporation (FDIC), Federal Reserve Board (Federal Reserve), Office of
the Comptroller of the Currency (OCC), Office of Thrift Supervision
(OTS), and state regulatory officials, and credit unions regulated by
National Credit Union Administration (NCUA) and state regulatory
authorities.)
CTR and Depository Institution Analysis:
To meet the mandate's data analysis requirements, we obtained from
FinCEN data on the CTRs and exemptions filed for 3 calendar years. This
data consisted of all of the CTRs and designation of exempt person
reports submitted by depository institutions during calendar years
2004, 2005, and 2006. We chose this period because these were the 3
most recent years for which FinCEN had complete data. To ensure that we
only tracked CTRs that were filed by the depository institutions within
a given year, we only analyzed CTRs that could be clearly identified as
being from that year. We excluded a total of 1,977,092 CTRs, or about
4.8 percent of the total number of CTRs that FinCEN's data showed as
being filed in 2004, 2005, and 2006. We also separated the remaining
38,829,864 CTRs into new (37,784,310) and amended (1,045,554) CTRs. We
analyzed these data to identify the characteristics of CTRs and
exemptions filed. For example, we identified the number of CTRs filed
for withdrawals and deposits, the number based on aggregated rather
than single transactions, and the median number of CTRs filed by
institutions of different sizes. For exemptions, among other analyses,
we identified the numbers filed for Phase I and Phase II exemptions.
In order to construct a population of depository institutions that file
CTRs, we needed to combine data files from several sources. We obtained
year-end data for the names and asset sizes as measured in dollars of
all banking depository institutions (banks) from the Federal Reserve
Board. In addition, we obtained from NCUA the names and asset size of
all credit unions insured by the National Credit Union Insurance Fund.
We matched the CTR data from FinCEN and with information on depository
institutions provided by the Federal Reserve and NCUA to create a
single data set. Approximately 1 percent of CTRs that we received from
FinCEN (number of CTRs) could not be matched and were excluded from our
analysis.
Table 5 summarizes the distribution of institutions and percentage of
CTRs across several size categories for banks and credit unions.
Table 5: Number of CTRs Filed by Asset Size Category of Depository
Institutions in 2006:
Institution asset size category: Very large banks (greater than $50
billion);
Total number of depository institutions in each category: 27;
Percentage of all depository institutions filing CTRs: .2.
Institution asset size category: Large banks ($1 billion to less than
$50 billion);
Total number of depository institutions in each category: 575;
Percentage of all depository institutions filing CTRs: 5.0.
Institution asset size category: Midsize banks ($100 million to less
than $1 billion);
Total number of depository institutions in each category: 4,264;
Percentage of all depository institutions filing CTRs: 36.9.
Institution asset size category: Small banks (less than $100 million);
Total number of depository institutions in each category: 3,032;
Percentage of all depository institutions filing CTRs: 26.2.
Institution asset size category: Credit unions ($100 million or more);
Total number of depository institutions in each category: 1,190;
Percentage of all depository institutions filing CTRs: 10.3.
Institution asset size category: Credit unions ($10 million to less
than $100 million;
Total number of depository institutions in each category: 2,137;
Percentage of all depository institutions filing CTRs: 18.5.
Institution asset size category: Credit unions (less than $10 million);
Total number of depository institutions in each category: 344;
Percentage of all depository institutions filing CTRs: 3.0.
Source: GAO.
Note: We were unable to classify 82 institutions by asset size category
because of inconsistencies between the FinCEN and depository
institution data.
[End of table]
Selection of Depository Institutions and Examiners to Be Interviewed:
The primary purpose of the structured interviews, which were conducted
by phone and in person by GAO analysts, was to obtain detailed
information about the CTR process, as well as the personnel,
technology, and training costs associated with filing CTRs and
exemptions. As part of our pretesting, we determined that information
on costs could not be reliably collected by means of a self-
administered Web survey because banks had difficulties in estimating
their costs in the same way unless we prompted them with specific
questions and adjusted our questions to match their accounting
practices.
In determining which depository institutions to interview, we primarily
considered their asset size. Because the number of banks we categorized
as very large was small (27), we interviewed the top 5 filers of CTRs,
who alone accounted for 36 percent of CTRs filed. In addition, we
conducted 18 structured interviews with banks and credit unions that
were categorized as small, midsize, and large in terms of assets. To
select which institutions to interview, we conducted a random sample of
small, midsize, and large institutions included in our CTR database.
While the results of our interviews are not statistically
representative of all institutions in their size category, this method
enabled us to capture the viewpoints of some of the small institutions
that may have been excluded from our survey.
Factors Affecting Use of Exemptions and Opportunities to Increase Use:
To identify the factors affecting depository institutions' decisions
regarding use of CTR exemption provisions, we surveyed a sample of
institutions. (Complete survey results can be viewed at hyperlink,
http://www.gao.gov/cgi-bin.getrpt?GAO-08-385SP.]) We also obtained and
analyzed data on the results of BSA examinations from, and interviewed
officials of, the five federal banking regulatory agencies. We used
information from these sources, along with a review of CTR filing and
exemption regulations, to identify opportunities for potentially
increasing use of exemptions.
Selection of Depository Institutions to Be Surveyed and Survey Response
Rate:
The survey was primarily designed to elicit the viewpoints of bank and
credit union officials on the amount of time it takes their institution
to meet CTR filing requirements and their use of the Phase I and Phase
II exemption process. In addition, the survey asked about possible
changes that could be made to the exemption process to reduce some of
the potential burden financial institutions may face in meeting the
exemption requirements and increase the likelihood institutions would
use the exemption process.
We conducted a Web-based survey of a sample of depository institutions
located in the 50 states and the District of Columbia. Our study
population consisted of 3,880 banks and credit unions we were able to
identify as having filed at least 120 CTRs in 2006 and whose size (as
measured by the dollar value of their assets) in 2006 we were able to
determine. Since institutions must file a minimum of 8 CTRs on a
business over the course of a year before the business becomes eligible
for the exemption, we excluded those institutions that filed fewer than
120 CTRs in 2006 from our survey to minimize the number of institutions
that would have relatively fewer opportunities to file exemptions. As a
result of applying this selection criterion, about 85 percent of the
smallest banks and 90 percent of credit unions filing CTRs were
excluded from our survey. To obtain the viewpoints of these
institutions to at least some extent, we included them in our universe
used to sample institutions for structured interviews.
We selected a stratified random sample of 680 from this study
population, where the strata were defined by a combination of asset
size and type of institution (bank or credit union).[Footnote 60] Table
6 summarizes the population size, sample size, and disposition of
sample separately by stratum. Whenever possible, we sent the survey to
each institution's compliance officer because we believed this officer
would be best positioned facilitate a response from the institution. We
obtained a listing of these officers and their e-mail addresses from
their respective regulator. The overall response rate to our survey was
68 percent. The survey estimates included in this report were formed by
weighting the survey data to account for both sample design and the
response rates for each stratum. In addition, the response rate varied
by question, however, since not all questions were asked of all
institutions, and institutions could skip questions.
Table 6: Survey Population and Response Rate:
Institution asset size category: Very large banks (greater than $50
billion);
Number filing at least 120 CTRs per year: 24;
Number included in our survey sample: 24;
Number responding to the survey: 19.
Institution asset size category: Large banks ($1 billion to less than
$50 billion);
Number filing at least 120 CTRs per year: 508;
Number included in our survey sample: 138;
Number responding to the survey: 90.
Institution asset size category: Midsize banks ($100 million to less
than $1 billion);
Number filing at least 120 CTRs per year: 2,563;
Number included in our survey sample: 252;
Number responding to the survey: 169.
Institution asset size category: Small banks (less than $100 million);
Number filing at least 120 CTRs per year: 453;
Number included in our survey sample: 141;
Number responding to the survey: 92.
Institution asset size category: Credit unions ($100 million or more);
Number filing at least 120 CTRs per year: 332;
Number included in our survey sample: 125;
Number responding to the survey: 99.
Total;
Number filing at least 120 CTRs per year: 3,880;
Number included in our survey sample: 680;
Number responding to the survey: 469.
Source: GAO.
[End of table]
Since the primary focus of the survey was to obtain viewpoints on the
exemption process, most of our questions focused on institutions' use
of exemptions. To develop the questions in the questionnaire, we
interviewed representatives of depository institutions, their trade
organizations, and their regulators; and FinCEN. The questionnaire also
included proposals on how to modify the exemption system. To develop
these proposals, we reviewed (1) the legislative history relating to
the Money Laundering Suppression Act of 1994 and the subsequent rule-
making process, (2) reports that previously assessed opportunities to
modify the exemption process, and (3) current proposals to modify the
exemption process, including those proposed by trade groups and
depository institutions that we interviewed.[Footnote 61] Finally, we
pretested the questionnaire with the representatives of eight banks and
two credit unions to check that (1) the questions were clear and
unambiguous, (2) terminology was used correctly, (3) the questionnaire
did not place an undue burden on institutions, (4) the information
could feasibly be obtained, and (5) the survey was comprehensive and
unbiased. We made changes to the content and format of the
questionnaire after each of the first pretests, based on the feedback
we received.
Our probability sample is used to produce estimates of the population
of 3,880 institutions that filed more than 120 CTRs in 2006. As with
all sample surveys, our results contain sampling error--potential error
that arises from not collecting responses from all of the institutions
that we surveyed. Because we followed a probability procedure based on
random selections, our sample is only one of a large number of samples
that we might have drawn. Since each sample could have provided
different estimates, we express our confidence in the precision of our
particular sample's results as a 95 percent confidence interval (e.g.,
plus or minus 8 percentage points). This is the interval that would
contain the actual population value for 95 percent of the samples we
could have drawn. As a result, we are 95 percent confident that each of
the confidence intervals in this report will include the true values in
the study population. All percentage estimates in this report have 95
percent confidence intervals of within plus or minus 8 percentage
points of the estimate, unless otherwise noted. Other numerical
estimates (for example, medians or means) have 95 percent confidence
intervals of within plus or minus 8 percent of the value of the
estimate, unless otherwise noted. In addition to sampling error, the
practical difficulties of conducting any survey may introduce errors.
For example, difficulties in interpreting a particular question or
sources of information available to respondents can introduce unwanted
variability into the survey results. We took steps in developing the
questionnaire, collecting the data, and analyzing them to minimize such
nonsampling error. To minimize nonresponse error we sent 3 follow-up e-
mail messages to those who had not yet responded. Then we attempted to
contact all remaining nonrespondents by telephone. It is possible that
characteristics of responding institutions could differ from
characteristics of institutions that did not respond to our survey. To
the extent that this is the case, our sample estimates may differ from
the actual values of the population as a whole.
Selection of Examiners and Violation Data:
To obtain the viewpoints of bank and credit union examiners on how CTR
regulations are applied, and the types of problems that CTR
examinations surface, we interviewed 15 examiners located in field
offices, and officials located in the headquarters offices, of the
federal banking regulators, as well as state regulators from
California, Florida, and New York. To determine how many CTR violations
resulted from BSA examinations, we obtained data from each of the
federal banking regulators. In addition, we obtained data on FinCEN's
fines and enforcement actions. We selected regulator field offices in
which to interview examiners based on whether they were located in
areas where high concentrations of CTRs were filed in 2006. These areas
were largely in California, Florida, New York, and Illinois. However,
the examiners we interviewed from these field offices could also speak
to their experiences with banks that were located in other geographic
locations and institutions that filed low numbers of CTRs in the
geographic areas for which they had responsibility:
Opportunities for Improving the Exemption System:
Survey responses from depository institutions indicated potential ways
to encourage use of exemptions. To obtain additional viewpoints and to
understand the implications of making specific changes to the current
exemption-filing requirements, we obtained the viewpoints of officials
from FinCEN and the federal banking regulators. To understand how
changes would need to be implemented, we analyzed the statutory
requirements in the Money Laundering Suppression Act, the regulatory
requirements, and guidance issued by FinCEN to identify which
regulatory requirements were specifically rooted in statute.
[End of section]
Appendix II: Law Enforcement Agencies' Use of CTR Data:
Technological Advances Have Increased Potential Uses:
Access to bulk BSA data, including CTRs, allows law enforcement
agencies to conduct more sophisticated analyses by combining the BSA
data with other data sets. Both FinCEN and IRS's Criminal Investigation
unit (IRS-CI) have this capability--FinCEN since 2002 and IRS-CI since
2005--enabling them to analyze BSA data in conjunction with their own
data sets. FinCEN reports that its analysts have access to four primary
data sources: BSA data, databases of criminal reports from other
federal law enforcement agencies, FinCEN's own database of
investigations, and commercial databases that contain identifying
information on individuals and businesses. IRS-CI investigators have
access to BSA data, tax data, and counterterrorism data. For instance,
IRS uses its Reveal system to identify financial crimes, including
individual and corporate tax frauds, and terrorist activity.[Footnote
62] The system allows users to establish a profile of the actions and
persons associated with the search and develop reports that include
graphical depictions of the data (see fig. 9). For example, IRS can
search Reveal to identify when a car dealer deposited large amounts of
cash, as recorded by CTRs, but also to determine whether the car dealer
filed any Form 8300s, which document the source of that cash.
Figure 9: An Overview of the Reveal Data Mining System:
This figure is a flowchart showing an overview of the reveal data
mining system.
[See PDF for image]
Source: GAO analysis of agency data; Art Explosion (clip art).
[End of figure]
FinCEN has also provided bulk data access to the Secret Service. The
Secret Service received its first test data in January 2006 and is in
the process of combining BSA data with information relating to
financial investigations, including data on identity theft, credit card
fraud, and counterfeit U.S. currency. Secret Service officials told us
that all 3,200 staff across the agency will be granted access to the
Secret Service database that will house the bulk BSA data.
Among agencies that continue to access BSA data through the Internet,
many officials commented that WebCBRS had given them greater
capabilities to analyze CTR data, because they could download large
volumes of data and analyze them at their desktops. IRS and Securities
and Exchange Commission officials commented that the new system was
easier to use because it displayed CTR data in a format that closely
resembled the actual CTR document. State law enforcement officials from
agencies in New York and Illinois that coordinate requests for BSA data
reported that the new system made it easier for them to distribute CTR
data to law enforcement agencies, because they could easily download
and export the data directly into a PDF file or spreadsheet
application. (In contrast, officials said that under the old CBRS
system, a user had to copy, paste, and manually format each CTR record
prior to distribution.) In 2007, FinCEN added a new feature to WebCBRS
that allows users to download and export BSA data to a commercial
database application, where users can use link analysis techniques to
explore associations between various data sets.[Footnote 63] According
to FinCEN officials, technology such as this will likely be useful for
the proactive analysis of CTR data, particularly at the state and local
law enforcement level.
In general, many law enforcement officials indicated that the
technological advances had already increased their use of CTRs or would
continue to do so.
* Investigators with the New York County District Attorney's Office
told us that they added 10 new Gateway user accounts last year because
they were getting more requests for BSA data. They noted that
prosecutors had been requesting CTR data more often as word of mouth
spread about the value of CTRs as corroborating sources of evidence.
* A Gateway coordinator for New York told us he had conducted training
sessions across the state with local police departments on the value of
CTR data and the importance of searching for CTR data at the beginning
of an investigation.
* An official associated with a HIFCA said she had been promoting
awareness of the WebCBRS download feature and creative ways to
proactively analyze CTR data, such as an analysis of CTRs filed for
certain occupations.
DEA officials noted that as a result of a DEA directive mandating that
all of the agency's investigations include a financial component, the
number of its Gateway users increased by 34 percent from the end of
calendar year 2004 to the end of calendar year 2006.
Data from FinCEN indicate that state and local use of CTR data has been
somewhat concentrated. Figure 10 shows the numbers of CTR "views"
through FinCEN's Gateway program in 2006. (Gateway is the primary means
of access to BSA data for state and local law enforcement users.)
Figure 10: States That Viewed CTR Data, by Number of CTRs Viewed in the
Gateway Program, Fiscal Year 2006:
This figure is a map showing states that viewed CTR data, by Number of
CTRs viewed in the Gateway program, fiscal year 2006.
[See PDF for image]
Source: GAO (analysis); Art Explosion (map).
[End of figure]
Case Examples Illustrate CTRs' Usefulness to Federal, State, and Local
Law Enforcement Investigations:
The examples below illustrate the varied roles that CTRs can play in
federal, state, and local law enforcement investigations. CTRs filed by
depository institutions helped initiate or support the investigations,
which include tax, money laundering, fraud, and narcotics cases.
(Because of the sensitive nature of this information, references to
subjects' names and other identifiers have been removed.)
Examples from IRS:
* IRS investigators initiated a case based on a call from a bank
security officer who reported that a bank customer was receiving large
tax refunds into his accounts and withdrawing the funds in cash. Using
known bank account numbers, the investigators searched the agency's
Currency Banking and Retrieval System (CBRS), which contains CTR data,
and identified CTRs showing large "cash outs." The investigators found
data that they believed indicated that 30 different bank accounts were
used to perpetuate the tax refund scheme, and 23 refunds went into
accounts identified through CTRs. Moreover, the CTRs identified
accounts controlled by relatives of the bank customer. Consequently,
the CTRs provided probable cause to obtain and execute a search warrant
at the residence of a relative. Ultimately, investigators learned that
the scheme involved about 125 tax returns and more than $500,000 in
false claims. According to IRS, the CTRs helped narrow the focus of the
investigation and saved valuable time in identifying the responsible
parties in the scheme. IRS further noted that without the CTRs, the
investigation would have been delayed for weeks or months, allowing the
scheme to continue and potentially resulting in substantial additional
loss to the government.
* IRS initiated a tax investigation from a Suspicious Activity Report
(SAR) disclosing that business receipts had been deposited into a
personal account. According to IRS, the dollar amount reported in the
SAR was not substantial, and based on the SAR information alone, the
investigation would not have proceeded. However, queries of CBRS
identified more than 125 CTRs related to the person under
investigation, which were filed over a 3-year period for amounts in
excess of $3.5 million. Further investigation determined that the
person failed to report almost all of the $3.5 million gross receipts
on his business tax returns. The person further concealed these
transactions by failing to file personal income tax returns or, in some
years, misreported the income to IRS. When confronted with the evidence
developed from the CTRs, the person cooperated with IRS and assisted
with an undercover operation. According to IRS, without the CTR
information, IRS may not have opened the investigation.
* Investigators searched CBRS for information relating to a person
suspected of trafficking narcotics, including all of the person's known
relatives and associates. A depository institution had filed a CTR on
the person's sister, reporting a deposit of $100,000 in cash into her
account. The financial investigation on the sister revealed that she
did not have enough legitimate income to justify a deposit of $100,000
in cash. Based on the CTR, investigators subpoenaed bank records, which
showed evidence of a real estate purchase in Florida using the $100,000
as a down payment. Further investigation showed that the person had
conducted the entire real estate transaction, and the sister had been
used as a nominee (that is, a person in whose name assets are
transferred). These transactions were the basis for money-laundering
charges against the person. The evidence in the CTR implicated the
sister, and was instrumental in obtaining a guilty plea by the person.
The person received a 20-year prison sentence and forfeited more than
$500,000 in assets.
Examples from Immigration and Customs Enforcement:
* Following the September 11 attacks, ICE investigators in Texas
proactively analyzed CTR data and identified an unlicensed hawala
sending money to several Middle Eastern countries. (A hawala is an
informal banking system that provides a mechanism for the remittance of
currency or other forms of monetary value without physical
transportation or the use of contemporary monetary instruments.)
Multiple same-day cash deposits, with each deposit less than $10,000,
were being made into the hawala's bank account at various branches of
the same bank across Texas. According to ICE, this illegal activity
would not have been detected without CTRs because the bank activity was
spread across 11 counties. As a result of the investigation, the hawala
was shut down, and a total of $346,701 was seized and forfeited.
* ICE investigators in New York received information that an illegal
money-laundering operation was being operated out of a phone card booth
in Manhattan. Standard preliminary steps to identify the persons
involved had failed because of the nicknames used by them, variations
in translations of the names (which were foreign), and the persons'
immigration status. However, investigators searched for CTR data and
found approximately 1,300 CTRs had been filed on the suspected
business. The volume of CTRs revealed accounts held at multiple banks.
Although most of the accounts had been closed, the CTRs provided
crucial details of the alleged illegal activity and assisted in
identifying members of the involved organization; for example,
information on the CTRs was used in an affidavit for a search warrant
for the target business and to obtain grand jury subpoenas for bank
accounts. Two principal persons allegedly involved were arrested and
charged with money laundering, alien smuggling, and conspiracy. These
arrests were conducted simultaneously with the arrests of 35 members of
an Asian criminal gang in Manhattan who were identified as having been
involved in the money-laundering operation.
* ICE investigators in Chicago initiated an investigation of a local
business based on information in CTRs and SARs that showed different
individuals making deposits into several bank accounts controlled by
the business and possible structuring violations. The investigation
revealed that the business may have been operating as an illegal money
transmitter. The business owner instructed his customers to deposit
money into his bank account, charged a nominal fee to remit money on
their behalf, and arranged for the transfer of money on computers
located in his apartment. The business owner was arrested and charged
with operating an unlicensed money services business.
* SARs filed on a business located in New York suspected of trafficking
counterfeit goods showed that certain persons may have been structuring
cash deposits into the business's account to avoid CTRs being filed.
However, on many occasions the persons deposited more than $10,000, and
the depository institution filed CTRs. The CTRs were instrumental in
identifying the co-conspirators apparently involved in the illegal
operation, and investigators used the CTR information to apply for
grand jury subpoenas, which produced bank account records of the
alleged conspirators and provided further evidence of money laundering.
The CTRs also were used in the affidavit for a seizure warrant for bank
accounts. The investigation revealed that during a 1-year period, the
alleged conspirators had laundered approximately $5 million to China
through wire transfers. In total, seven individuals were charged with
money laundering and trafficking in counterfeit goods and the funds in
the six accounts belonging to the members of the conspiracy were
seized.
Examples from the Drug Enforcement Administration:
* Surveillance of a suspected drug "stash house" led to the discovery
of a vehicle registered to a business located in central California. A
search of BSA data revealed the existence of approximately 1,600 CTRs
filed on the business over a 3-year period. Later, DEA intelligence
revealed that similarly registered vehicles had been observed during
other surveillance operations in central and Southern California. The
earlier CTRs identified all of the conductors of the transactions as
individuals, but later cash deposits were being made by armored
carrier. DEA ultimately determined that the evidence indicated that the
business represented the cash side of the drug trade and the business
was being used to deposit the illicit proceeds. Investigators
discovered that more than 2,000 CTRs documenting in excess of $100
million in cash deposits had been filed on the business over a 5-year
period. However, no SARs were ever filed.
* A DEA office provided another DEA office with information suggesting
that a certain person was involved in drug trafficking, money
laundering, and terrorist financing in the receiving office's area of
responsibility. The only leads the receiving office had were the
person's name, date of birth, and Social Security number. Investigators
searched CBRS and found CTRs. These CTRs helped indicate to them that
the person was engaging in criminal activity. The CTRs identified the
person's place of employment, bank account numbers, and other
individuals that had conducted cash transactions on behalf of the
person under investigation.
Examples from the Federal Bureau of Investigation:
* CTRs assisted FBI investigators in unraveling a complex case
involving Medicare fraud. Over a 2-year period, the Medicare system
paid several million dollars to dozens of "front" durable medical
equipment companies that in turn wrote checks to nonexistent medical
equipment supply companies. These checks were allegedly cashed at
several check-cashing businesses, which all maintained bank accounts at
the same local bank. The review of CTRs filed by the bank revealed
several hundred million dollars paid out in the form of cash to the
check cashers over a relatively short period. Approximately 90 percent
of this bank's revenues were derived from its check-cashing business
client base. At the suggestion of the FBI, the bank's regulator started
an examination of the bank, which uncovered evidence that a bank
insider was participating in an illegal money services business. The
bank was fined and ultimately ceased operations.
* A search of BSA data in support of a narcotics money-laundering
investigation produced more than 3,000 reports, the vast majority of
which were CTRs. Through further analysis of the CTRs, the FBI was able
to confirm and document a critical suspected link between certain
persons under investigation in different states.
Example from the Secret Service:
* CTRs assisted Secret Service investigators in identifying a person
that had allegedly committed investment fraud. The victims of the fraud
had given checks to the person for investments; however, the person
would either cash or deposit the checks. Depository institutions filed
CTRs on these transactions, which provided a direct link to the person.
Further investigation disclosed that the person had been involved in a
similar scheme in another part of the same state and had pending arrest
warrants. The total estimated loss in the case was more than $400,000.
Authorities also conducted asset seizures and forfeitures in this case.
Examples from State or Local Governments:
* Investigators with the Chicago Police Department searched for CTRs on
a business suspected of laundering drug money in the mid-1990s and
identified a CTR that reported a cash withdrawal of $17,000 by a fork-
lift driver. Investigators subsequently issued a subpoena for related
bank records and discovered that the bank account, a personal checking
account, had received more than $52 million in deposits through wire
transfers over an 18-month period. Funds deposited into this account
then were redistributed through checks drawn on the account and
negotiated across southern Texas. Investigators contacted IRS-CI and
identified this lead to a nationwide major drug money-laundering case.
* Investigators with the California Department of Justice used CTRs to
identify bank accounts for a subpoena of bank records in support of an
investigation on health care fraud. The CTRs linked several physicians
to Russian organized crime figures that had set up a series of
storefront clinics and medical diagnostic test companies. Some of the
CTRs showed evidence of structuring, while others showed the
involvement of family members, such as a 19-year-old son on record as
the "corporation president," when in reality he was fronting for his
parents. The information on the CTRs also led the investigators to
consult corporate fraud investigators, who were helpful in providing
SARs about these same activities.
[End of section]
Appendix III: Information on CTRs Filed from 2004 to 2006:
The Financial Services Regulatory Relief Act of 2006 asked us to
analyze CTR filing data and to categorize these data according to the
size of financial institutions, in groups of 100. Figure 11 shows that
the 100 largest institutions accounted for 65 percent of all CTRs filed
in 2006, while the portion of CTRs filed by smaller institutions (in
categories of 100) diminished along with institution size.
Figure 11: CTRs Filed in 2006, by Institution Asset Size:
This figure is a combination bar and pie chart showing CTRs filed in
2006, by institution asset size.
[See PDF for image]
Source: GAO.
[End of figure]
Table 7 shows CTR filing data, aggregated for 2004 through 2006, by
institution size category.
Table 7: Number and Percentage of CTRs Filed by Institution Type, 2004-
2006:
Institution: Bank: less than $100 million;
New CTRs: Number: of CTRs: 711,007;
New CTRs: Percentage: of CTRs: 1.9;
Amended CTRs: Number: of CTRs: 90,379;
Amended CTRs: Percentage: of CTRs: 8.6.
Institution: Bank: $100 million to less than $1 billion;
New CTRs: Number: of CTRs: 4,872,316;
New CTRs: Percentage: of CTRs: 12.9;
Amended CTRs: Number: of CTRs: 398,574;
Amended CTRs: Percentage: of CTRs: 38.1.
Institution: Bank: $1 billion to less than $50 billion;
New CTRs: Number: of CTRs: 11,545,642;
New CTRs: Percentage: of CTRs: 30.6;
Amended CTRs: Number: of CTRs: 268,073;
Amended CTRs: Percentage: of CTRs: 25.6.
Institution: Bank: $50 billion or more;
New CTRs: Number: of CTRs: 20,161,126;
New CTRs: Percentage: of CTRs: 53.4;
Amended CTRs: Number: of CTRs: 191,784;
Amended CTRs: Percentage: of CTRs: 18.3.
Institution: Credit union: less than $10 million;
New CTRs: Number: of CTRs: 3,771;
New CTRs: Percentage: of CTRs: 0;
Amended CTRs: Number: of CTRs: 2,216;
Amended CTRs: Percentage: of CTRs: 0.2.
Institution: Credit union: $10 million to less than $100 million;
New CTRs: Number: of CTRs: 102,892;
New CTRs: Percentage: of CTRs: 0.3;
Amended CTRs: Number: of CTRs: 28,185;
Amended CTRs: Percentage: of CTRs: 2.7.
Institution: Credit union: $100 million or more;
New CTRs: Number: of CTRs: 387,556;
New CTRs: Percentage: of CTRs: 1;
Amended CTRs: Number: of CTRs: 66,343;
Amended CTRs: Percentage: of CTRs: 6.3.
Institution: Total;
New CTRs: Number: of CTRs: 37,784,310;
New CTRs: Percentage: of CTRs: 100;
Amended CTRs: Number: of CTRs: 1,045,554;
Amended CTRs: Percentage: of CTRs: 100.
Source: GAO.
Note: An amended CTR is a correction to an initial CTR filed by the
financial institution.
[End of table]
Table 8 shows the mean averages and the median numbers of CTRs filed by
institution size category.
Table 8: Mean and Median Numbers of CTRs Filed by Size of Institution,
2004-2006:
Institution: Bank: less than $100 million;
2004: Mean: 83;
2004: Median: 22;
2005: Mean: 78;
2005: Median: 23;
2006: Mean: 67;
2006: Median: 17.
Institution: Bank: $100 million to less than $1 billion;
2004: Mean: 428;
2004: Median: 195;
2005: Mean: 428;
2005: Median: 193;
2006: Mean: 349;
2006: Median: 154.
Institution: Bank: $1 billion to less than $50 billion;
2004: Mean: 8,451;
2004: Median: 2,282;
2005: Mean: 7,438;
2005: Median: 2,278;
2006: Mean: 6,334;
2006: Median: 1,889.
Institution: Bank: $50 billion or more;
2004: Mean: 288,193;
2004: Median: 148,545;
2005: Mean: 289,599;
2005: Median: 142,295;
2006: Mean: 243,736;
2006: Median: 125,202.
Institution: Credit union: less than $10 million;
2004: Mean: 4;
2004: Median: 1;
2005: Mean: 5;
2005: Median: 1;
2006: Mean: 4;
2006: Median: 1.
Institution: Credit union: $10 million to less than $100 million;
2004: Mean: 24;
2004: Median: 5;
2005: Mean: 13;
2005: Median: 5;
2006: Mean: 14;
2006: Median: 5.
Institution: Credit union: $100 million or more;
2004: Mean: 99;
2004: Median: 43;
2005: Mean: 118;
2005: Median: 49;
2006: Mean: 117;
2006: Median: 47.
Total;
2004: Mean: 1,137;
2004: Median: 43;
2005: Mean: 1,177;
2005: Median: 46;
2006: Mean: 1,061;
2006: Median: 41.
Source: GAO.
Note: In statistics, both the mean and the median are measures of
central tendency and are also referred to as averages. The median is
the midpoint in a distribution; in this case, half of the institutions
in each size category filed more than the median number of CTRs, and
half filed fewer.
[End of table]
Table 9 shows the total number of CTRs that were based on multiple
transactions--that is, transactions that in the aggregate amounted to
more than $10,000 on the same day for a single account.
Table 9: Number of CTRs Based on Aggregated Transactions, 2004-2006:
2004;
Number of CTRs based on multiple transactions: 8,710,754;
Percentage of all CTRs filed: 66.9.
2005;
Number of CTRs based on multiple transactions: 9,047,781;
Percentage of all CTRs filed: 65.8.
2006;
Number of CTRs based on multiple transactions: 8,158,049;
Percentage of all CTRs filed: 65.4.
2004-2006 total;
Number of CTRs based on multiple transactions: 25,916,584;
Percentage of all CTRs filed: 66.
Source: GAO.
[End of table]
Tables 10 and 11 show the number of CTRs filed for transactions in
which the depository institution received cash (cash-in transactions)
and dispensed cash (cash-out transactions), respectively, categorized
by the dollar values of the transactions.
Table 10: Number and Percentage Amount of Cash-In Transactions Recorded
by CTRs, 2004-2006:
CTR amount: $10,000 or less;
2004: Number of: cash-in: CTRs: 19,765;
2004: Percentage of cash-in: CTRs: 0.2;
2005: Number of: cash- in: CTRs: 19,419;
2005: Percentage of all: CTRs: 0.2;
2006: Number of: cash-in: CTRs: 15,017;
2006: Percentage of all: CTRs: 0.2.
CTR amount: $10,001 to $15,000;
2004: Number of: cash-in: CTRs: 4,165,255;
2004: Percentage of cash-in: CTRs: 42.3;
2005: Number of: cash-in: CTRs: 4,321,651;
2005: Percentage of all: CTRs: 42.2;
2006: Number of: cash-in: CTRs: 3,844,261;
2006: Percentage of all: CTRs: 42.
CTR amount: $15,001 to $20,000;
2004: Number of: cash-in: CTRs: 1,856,088;
2004: Percentage of cash-in: CTRs: 18.8;
2005: Number of: cash-in: CTRs: 1,945,226;
2005: Percentage of all: CTRs: 19;
2006: Number of: cash-in: CTRs: 1,738,266;
2006: Percentage of all: CTRs: 19.
CTR amount: $20,001 to $25,000;
2004: Number of: cash-in: CTRs: 969,947;
2004: Percentage of cash-in: CTRs: 9.8;
2005: Number of: cash-in: CTRs: 1,010,589;
2005: Percentage of all: CTRs: 9.9;
2006: Number of: cash-in: CTRs: 900,627;
2006: Percentage of all: CTRs: 9.8.
CTR amount: $25,001 to $30,000;
2004: Number of: cash-in: CTRs: 612,969;
2004: Percentage of cash-in: CTRs: 6.2;
2005: Number of: cash-in: CTRs: 636,812;
2005: Percentage of all: CTRs: 6.2;
2006: Number of: cash-in: CTRs: 566,071;
2006: Percentage of all: CTRs: 6.2.
CTR amount: $30,001 to $35,000;
2004: Number of: cash-in: CTRs: 401,850;
2004: Percentage of cash-in: CTRs: 4.1;
2005: Number of: cash-in: CTRs: 417,913;
2005: Percentage of all: CTRs: 4.1;
2006: Number of: cash-in: CTRs: 369,215;
2006: Percentage of all: CTRs: 4.
CTR amount: $35,001 to $40,000;
2004: Number of: cash-in: CTRs: 292,981;
2004: Percentage of cash-in: CTRs: 3;
2005: Number of: cash-in: CTRs: 302,029;
2005: Percentage of all: CTRs: 2.9;
2006: Number of: cash-in: CTRs: 269,586;
2006: Percentage of all: CTRs: 2.9.
CTR amount: $40,001 to $45,000;
2004: Number of: cash-in: CTRs: 212,212;
2004: Percentage of cash-in: CTRs: 2.2;
2005: Number of: cash-in: CTRs: 218,732;
2005: Percentage of all: CTRs: 2.1;
2006: Number of: cash-in: CTRs: 195,482;
2006: Percentage of all: CTRs: 2.1.
CTR amount: $45,001 to $50,000;
2004: Number of: cash-in: CTRs: 168,452;
2004: Percentage of cash-in: CTRs: 1.7;
2005: Number of: cash-in: CTRs: 174,690;
2005: Percentage of all: CTRs: 1.7;
2006: Number of: cash-in: CTRs: 156,774;
2006: Percentage of all: CTRs: 1.7.
CTR amount: More than $50,000;
2004: Number of: cash-in: CTRs: 1,148,599;
2004: Percentage of cash-in: CTRs: 11.7;
2005: Number of: cash-in: CTRs: 1,199,836;
2005: Percentage of all: CTRs: 11.7;
2006: Number of: cash-in: CTRs: 1,090,745;
2006: Percentage of all: CTRs: 11.9.
Total;
2004: Number of: cash-in: CTRs: 9,848,118;
2004: Percentage of cash-in: CTRs: 100;
2005: Number of: cash-in: CTRs: 10,246,897;
2005: Percentage of all: CTRs: 100;
2006: Number of: cash-in: CTRs: 9,146,044;
2006: Percentage of all: CTRs: 100.
Source: GAO.
[End of table]
Table 11: Number and Percentage of Cash-Out Transactions Recorded by
CTRs, 2004-2006:
CTR amount: $10,000 or less;
2004: Number of: cash-out: CTRs: 30,142;
2004: Percentage of cash-out: CTRS: 0.9;
2005: Number of: cash-out: CTRs: 28,364;
2005: Percentage of cash-out: CTRS: 0.8;
2006: Number of: cash-out: CTRs: 20,240;
2006: Percentage of cash-out CTRs: 0.6.
CTR amount: $10,001 to $15,000;
2004: Number of: cash-out: CTRs: 1,122,836;
2004: Percentage of cash-out: CTRS: 33.3;
2005: Number of: cash-out: CTRs: 1,289,605;
2005: Percentage of cash-out: CTRS: 34.5;
2006: Number of: cash-out: CTRs: 1,237,693;
2006: Percentage of cash-out CTRs: 34.9.
CTR amount: $15,001 to $20,000;
2004: Number of: cash-out: CTRs: 611,869;
2004: Percentage of cash-out: CTRS: 18.2;
2005: Number of: cash-out: CTRs: 677,749;
2005: Percentage of cash-out: CTRS: 18.1;
2006: Number of: cash-out: CTRs: 635,963;
2006: Percentage of cash-out CTRs: 17.9.
CTR amount: $20,001 to $25,000;
2004: Number of: cash-out: CTRs: 289,851;
2004: Percentage of cash-out: CTRS: 8.6;
2005: Number of: cash-out: CTRs: 319,485;
2005: Percentage of cash-out: CTRS: 8.5;
2006: Number of: cash-out: CTRs: 296,953;
2006: Percentage of cash-out CTRs: 8.4.
CTR amount: $25,001 to $30,000;
2004: Number of: cash-out: CTRs: 238,613;
2004: Percentage of cash-out: CTRS: 7.1;
2005: Number of: cash-out: CTRs: 261,010;
2005: Percentage of cash-out: CTRS: 7;
2006: Number of: cash-out: CTRs: 244,157;
2006: Percentage of cash-out CTRs: 6.9.
CTR amount: $30,001 to $35,000;
2004: Number of: cash-out: CTRs: 130,609;
2004: Percentage of cash-out: CTRS: 3.9;
2005: Number of: cash-out: CTRs: 140,668;
2005: Percentage of cash-out: CTRS: 3.8;
2006: Number of: cash-out: CTRs: 130,827;
2006: Percentage of cash-out CTRs: 3.7.
CTR amount: $35,001 to $40,000;
2004: Number of: cash-out: CTRs: 136,177;
2004: Percentage of cash-out: CTRS: 4;
2005: Number of: cash-out: CTRs: 148,137;
2005: Percentage of cash-out: CTRS: 4;
2006: Number of: cash-out: CTRs: 139,199;
2006: Percentage of cash-out CTRs: 3.9.
CTR amount: $40,001 to $45,000;
2004: Number of: cash-out: CTRs: 79,128;
2004: Percentage of cash-out: CTRS: 2.3;
2005: Number of: cash-out: CTRs: 84,758;
2005: Percentage of cash-out: CTRS: 2.3;
2006: Number of: cash-out: CTRs: 79,081;
2006: Percentage of cash-out CTRs: 2.2.
CTR amount: $45,001 to $50,000;
2004: Number of: cash-out: CTRs: 100,180;
2004: Percentage of cash-out: CTRS: 3;
2005: Number of: cash-out: CTRs: 107,915;
2005: Percentage of cash-out: CTRS: 2.9;
2006: Number of: cash-out: CTRs: 102,515;
2006: Percentage of cash-out CTRs: 2.9.
CTR amount: More than $50,000;
2004: Number of: cash-out: CTRs: 628,961;
2004: Percentage of cash-out: CTRS: 18.7;
2005: Number of: cash-out: CTRs: 682,254;
2005: Percentage of cash-out: CTRS: 18.2;
2006: Number of: cash-out: CTRs: 662,877;
2006: Percentage of cash-out CTRs: 18.7.
CTR amount: Total;
2004: Number of: cash-out: CTRs: 3,368,366;
2004: Percentage of cash-out: CTRS: 100;
2005: Number of: cash-out: CTRs: 3,739,945;
2005: Percentage of cash-out: CTRS: 100;
2006: Number of: cash-out: CTRs: 3,549,505;
2006: Percentage of cash- out CTRs: 100.
Source: GAO.
[End of table]
Figure 12 shows the geographic dispersion of CTRs filed in 2006, by
county.
Figure 12: CTRs Filed in 2006, by County:
This figure is a map of CTRs filed in 2006, by county.
[See PDF for image]
Source: GAO (analysis); Map Resources (map).
[End of figure]
[End of section]
Appendix IV: Additional Information on Depository Institutions' Use of
Exemptions:
Table 12 shows the total number of Phase I exemptions filed during 2006
by type of customer (bank, government, listed company, or listed
government subsidiary), by institutions of different sizes. While
depository institutions are not required to file biennial renewals for
Phase I customers, the data show that some institutions did so.
Table 12: Number and Percentage of Phase I Exemptions Filed by
Depository Institutions, 2006:
[See PDF for image]
Source: GAO.
[End of table]
Table 13 shows the total number of Phase II initial exemptions and
biennial renewals filed during 2006, by type of customer (nonlisted
businesses and payroll customers), by institutions of different sizes.
Table 13: Number and Percentage of Phase II Exemptions Filed by
Depository Institutions, 2006:
[See PDF for image]
Source: GAO.
[End of table]
Depository Institutions Not Using Phase I or Phase II Exemptions Cited
a Number of Similar Factors for Not Using the Exemptions:
As shown in figures 13 and 14 below, respondents to our survey cited a
number of similar factors that were important in their decision not to
exempt customers eligible for Phase I and Phase II exemptions. Concern
that examiners would find that the exemption was not done correctly was
the top concern among banks that did not exempt Phase I customers and
the second-ranked concern among banks that did not exempt Phase II
customers. Difficulty in determining eligibility was ranked second for
those not exempting Phase I customers and fifth for those not exempting
Phase II. Banks also responded that another major reason for not using
the exemption was that it was easier to file CTRs than to go through
the exemption process. Finally, those not exempting Phase I or Phase II
customers responded that the time-consuming nature of the annual
reviews was a major reason they did not use the exemption.
Figure 13: Factors That Institutions Considered to Be of Very Great or
Great Importance When Deciding Not to Exempt a Phase I Eligible
Customer:
This figure is a bar graph showing factors that institutions considered
to be of very great or greater importance when deciding not to exempt a
phase I eligible customer.
[See PDF for image]
Source: GAO.
Note: The 95 percent confidence intervals for these estimates are
within +/-15 percentage points, except for "other factors," which is
within +/-26 percentage points of the estimate.
[End of figure]
Institutions that did not exempt customers that were eligible for the
Phase I exemption cited difficulty determining eligibility as a reason
for not using the Phase I exemption. More specifically, survey
respondents and officials we interviewed noted that verifying the
publicly traded status of customers could be difficult (see fig. 13).
Typically, to verify this information, staff of depository institutions
would need to check the listing information from three exchanges as
well as use a search engine called EDGAR on the Securities and Exchange
Commission Web site to search for public filings that the company
made.[Footnote 64] On average, officials of institutions we surveyed
said conducting this research took about 1 hour per exemption. However,
verification of listing status and ownership represents only a portion
of the effort involved in ascertaining eligibility for an exemption.
Many officials we interviewed said that staff in the compliance office
made the exemption determinations after reviewing a customer's account
history. For instance, a respondent from a very large bank explained
that it was the institution's policy to conduct background checks on
the principals of the business being considered for exemption. Another
respondent noted that the compliance officer would send a questionnaire
to the manager of the branch where the customer held the account; the
manager then had to complete the questionnaire and provide supporting
documents, including the financial statement for the business of the
customer being considered for exemption. In addition, respondents from
one very large bank noted that its board had to approve exemption
decisions, increasing the time and effort involved.
As shown in Figure 14, difficulty in determining whether companies
derived more than 50 percent of their gross revenue from ineligible
business activities was the primary factor affecting Phase II exemption
decisions.
Figure 14: Factors That Institutions Considered to Be of Very Great or
Great Importance When Deciding Not to Exempt a Phase II-Eligible
Customer:
This figure is a bar graph showing factors that institutions considered
to be of very great or great importance when deciding not to exempt a
phase II eligible customer.
[See PDF for image]
Source: GAO.
Note: The 95 percent confidence intervals for these estimates are
within +/-12 percentage points except for the "other factors," which is
within +/-24percentage points of the estimate.
[End of figure]
Table 14 provides data on FinCEN's CTR-related (excluding exemptions)
and exemption-related enforcement actions over the period 1997 to 2006.
The data show that relatively few enforcement actions involved fines
against the institutions.
Table 14: FinCEN's CTR and Exemption-Related Enforcement Actions on
Depository Institutions, 1997-2006:
Year: 1997;
Number of BSA actions: 2;
Number of CTR-related actions without fines: 0;
Number of CTR-related actions with fines: 0;
Number of exemption-related actions without fines: 1;
Number of exemption- related actions with fines: 1.
Year: 1998;
Number of BSA actions: 7;
Number of CTR-related actions without fines: 2;
Number of CTR-related actions with fines: 0;
Number of exemption-related actions without fines: 5;
Number of exemption- related actions with fines: 0.
Year: 1999;
Number of BSA actions: 13;
Number of CTR-related actions without fines: 6;
Number of CTR-related actions with fines: 0;
Number of exemption-related actions without fines: 7;
Number of exemption- related actions with fines: 0.
Year: 2000;
Number of BSA actions: 30;
Number of CTR-related actions without fines: 17;
Number of CTR-related actions with fines: 0;
Number of exemption-related actions without fines: 11;
Number of exemption- related actions with fines: 2.
Year: 2001;
Number of BSA actions: 22;
Number of CTR-related actions without fines: 8;
Number of CTR-related actions with fines: 0;
Number of exemption-related actions without fines: 14;
Number of exemption- related actions with fines: 0.
Year: 2002;
Number of BSA actions: 47;
Number of CTR-related actions without fines: 24;
Number of CTR-related actions with fines: 1;
Number of exemption-related actions without fines: 22;
Number of exemption- related actions with fines: 0.
Year: 2003;
Number of BSA actions: 15;
Number of CTR-related actions without fines: 8;
Number of CTR-related actions with fines: 2;
Number of exemption-related actions without fines: 5;
Number of exemption- related actions with fines: 0.
Year: 2004;
Number of BSA actions: 17;
Number of CTR-related actions without fines: 9;
Number of CTR-related actions with fines: 1;
Number of exemption-related actions without fines: 7;
Number of exemption- related actions with fines: 0.
Year: 2005;
Number of BSA actions: 58;
Number of CTR-related actions without fines: 36;
Number of CTR-related actions with fines: 1;
Number of exemption-related actions without fines: 21;
Number of exemption- related actions with fines: 0.
Year: 2006;
Number of BSA actions: 38;
Number of CTR-related actions without fines: 24;
Number of CTR-related actions with fines: 0;
Number of exemption-related actions without fines: 13;
Number of exemption- related actions with fines: 1.
Source: GAO analysis of FinCEN data.
Note: The actions without fines represent letters that FinCEN's Office
of Compliance or Office of Enforcement sent to depository institutions.
These actions also were independent actions by FinCEN (that is, not
imposed jointly with other regulators). Of the actions with fines, one
action in 2003 was imposed jointly with the Federal Reserve, and the
sole action in 2004 was accompanied by a joint and concurrent penalty
that OCC assessed.
[End of table]
[End of section]
Appendix V: Comments from the Financial Crimes Enforcement Network:
Department Of The Treasury:
Financial Crimes Enforcement Network:
Director:
February 8, 2008:
Mr. David G. Wood:
Director, Financial Markets and Community Investment:
U.S. Government Accountability Office:
441 G Street N.W.:
Washington, D.C. 20515:
Dear Mr. Wood:
Thank you for the opportunity to review and comment on the Government
Accountability Office (GAO) draft report entitled, Bank Secrecy Act:
Increased Use of Exemption Provisions Could Reduce Currency Transaction
Reporting While Maintaining Usefulness to Law Enforcement Efforts.
Currency Transaction Reports (CTRs), as well as other Bank Secrecy Act
(BSA) reports, play a vital role in our efforts to protect the
financial system. The report's findings based upon the information
gathered from law enforcement reinforce the value they gain through
active utilization of CTRs. Both law enforcement and depository
institutions provided extensive information to support your findings
that is consistent with the feedback we routinely receive in our
collaborative efforts.
FinCEN concurs with the three recommendations seeking regulatory
amendments. These three recommendations are consistent with our
commitment to a risk-based regulatory approach, and are part of our
ongoing efforts to make our administration of the BSA more effective
and efficient. Additionally, FinCEN concurs with the two
recommendations related to guidance and materials to aid industry in
making eligibility determinations for CTR exemptions. These
recommendations will allow industry to better understand and comply
with regulatory requirements, and also increase consistency among
regulators. Finally, FinCEN remains committed to providing feedback
responsive to industry's needs and will consider options to provide
industry with additional feedback on the use of CTRs by law
enforcement.
I appreciate the efforts of GAO's audit team in reviewing these
important issues. If you have any questions, please feel free to
contact Diane Wade, Associate Director for FinCEN's Management Programs
Division, at 703-905-5061.
Sincerely,
Signed by:
James H. Freis, Jr.
cc: The Honorable Stuart Levey (Under Secretary, Office of Terrorism
and Financial Intelligence):
[End of section]
Appendix VI: Comments from Federal Banking Regulators:
Board of Governors of the Federal Reserve System:
Federal Deposit Insurance Corporation:
National Credit Union Administration:
Office of Thrift Supervision:
February 7, 2008:
Mr. David Wood, Director:
Financial Markets and Community Investments:
U.S. Government Accountability Office:
441 G Street, NW:
Washington, D.C. 20548:
Dear Mr. Wood;
Thank you for the opportunity to review and comment on the Government
Accountability Office's (GAO) report entitled, Bank Secrecy Act ”
Increased Use of Exemption Provisions Could Reduce Currency Transaction
Reporting While Maintaining Usefulness to Law Enforcement Efforts (GAO
08-355). This report reviews the regulatory process wherein depository
institutions must file with the Treasury Department's Financial Crimes
Enforcement Network (FinCEN) currency transaction reports (CTRs) on
customer currency transactions of more than $10,000 as required by the
Bank Secrecy Act (BSA), and the rules relating to exemption from this
requirement.
FinCEN, as administrator of the BSA, relies upon the examination
programs of the Board of Governors of the Federal Reserve System
(Board), Federal Deposit Insurance Corporation (FDIC), National Credit
Union Administration (NCUA), Office of the Comptroller of the Currency,
and the Office of Thrift Supervision (OTS) to review for BSA
compliance, inclusive of the CTR and associated customer exemption
processes. These agencies examine supervised financial institutions to
ensure compliance with the reporting rules that enable federal, state,
and local law enforcement authorities to receive reliable information
to support investigative efforts in detecting and deterring financial
crime.
The GAO recommends that the Secretary of Treasury direct FinCEN to
consider several actions, including publication of summary information
and industry guidance, to promote understanding of CTR utility and
clarity of regulatory requirements. The GAO also recommends revision to
certain regulations that potentially deter the usage of exemptions from
the currency transaction reporting process.
The Board, FDIC, NCUA, and OTS appreciate the opportunity to respond to
this mandated review and are strongly committed to our role in ensuring
that financial institutions establish and maintain programs to comply
with the requirements of the BSA. The Board, FDIC, NCUA, and OTS
reaffirm our support for effective and efficient administration of the
BSA and believe that streamlining and clarifying the exemption
regulations, as the GAO recommends, would be a positive step.
Sincerely,
Signed by:
Roger T. Cole:
Director:
Division of Banking Supervision and Regulation:
Board of Governors of the Federal Reserve System:
Signed by:
Sandra L. Thompson:
Director:
Division of Supervision and Consumer Protection:
Federal Deposit Insurance Corporation:
Signed by:
J. Leonard Skiles:
Executive Director:
National Credit Union Administration:
Signed by:
Timothy T. Ward:
Deputy Director, Examinations, Supervision, and Consumer Protection:
Office of Thrift Supervision:
[End of section]
Appendix VII: GAO Contact and Staff Acknowledgments:
GAO Contact:
David G. Wood, (202) 512-6878 or w [Hyperlink, woodd@gao.gov]
oodd@gao.gov:
Staff Acknowledgments:
In addition to the contact named above, Barbara I. Keller (Assistant
Director), Sonja Bensen, John W. Mingus Jr., Eric E. Petersen, Carl
Ramirez, Linda S. Rego, Barbara M. Roesmann, Rachel E. Siegel, and
Monica L. Wolford made key contributions to this report.
[End of section]
Related GAO Products:
Bank Secrecy Act: FinCEN and IRS Need to Improve and Better Coordinate
Compliance and Data Management Efforts. GAO-07-212. December 15, 2006.
Bank Secrecy Act: Opportunities Exist for FinCEN and the Banking
Regulators to Further Strengthen the Framework for Consistent BSA
Oversight. GAO-06-386. Washington, D.C.: April 28, 2006.
Terrorist Financing: Better Strategic Planning Needed to Coordinate
U.S. Efforts to Deliver Counter-Terrorism Financing Training and
Technical Assistance Abroad. GAO-06-19. Washington, D.C.: October 24,
2005.
USA PATRIOT Act: Additional Guidance Could Improve Implementation of
Regulations Related to Customer Identification and Information Sharing
Procedures. GAO-05-412. Washington, D.C.: May 6, 2005.
Information Security: IRS Needs to Remedy Serious Weaknesses over
Taxpayer and Bank Secrecy Act Data. GAO-05-482. Washington, D.C.: April
15, 2005.
Anti-Money Laundering: Issues Concerning Depository Institution
Regulatory Oversight. GAO-04-833T. Washington, D.C.: June 3, 2004.
Combating Terrorism: Federal Agencies Face Continuing Challenges in
Addressing Terrorist Financing and Money Laundering. GAO-04-501T.
Washington, D.C.: March 4, 2004.
Terrorist Financing: U.S. Agencies Should Systematically Assess
Terrorists' Use of Alternative Financing Mechanisms. GAO-04-163.
Washington, D.C.: November 14, 2003.
Combating Money Laundering: Opportunities Exist to Improve the National
Strategy. GAO-03-813. Washington, D.C.: September 26, 2003.
Internet Gambling: An Overview of the Issues. GAO-03-89. Washington,
D.C.: December 2, 2002.
Money Laundering: Extent of Money Laundering through Credit Cards Is
Unknown. GAO-02-670. Washington, D.C.: July 22, 2002.
Anti-Money Laundering: Efforts in the Securities Industry. GAO-02-111.
Washington, D.C.: October 10, 2001.
[End of section]
Footnotes:
[1] Pub. L. No. 91-508, titles I and II, 84 Stat. 1114 to 1124 (Oct.
26, 1970), as amended, codified at 12 U.S.C. §§ 1829b, 1951-1959, and
31 U.S.C. §§ 5311 et seq.
[2] 31 U.S.C. § 5313(a); 31 C.F.R. § 103.22(b).
[3] The Money Laundering Suppression Act of 1994, Pub. L. No. 103-325,
title IV, 108 Stat. 2243 (Sept. 23, 1994). See 31 U.S.C. § 5313(d)
(mandatory exemptions) and (e) (discretionary exemptions).
[4] 62 Fed. Reg. 47141 (Sept. 8, 1997) and 63 Fed. Reg. 50147 (Sept.
21, 1998).
[5] Pub. L. No. 109-351 § 1001, 120 Stat. 1966, 2007-2009 (Oct. 13,
2006).
[6] See appendix I for more information on the asset size categories.
We included only three categories of credit unions because they are
generally smaller institutions, compared with banks and thrifts;
further, credit unions filed less than 2 percent of all CTRs filed by
depository institutions from 2004 through 2006.
[7] To ensure compliance with the BSA and other laws and regulations,
banks, thrifts, and credit unions are subject to oversight (including
on-site examinations) at the federal and state level. Federal
regulators of these institutions include the Board of Governors of the
Federal Reserve System, the Office of the Comptroller of the Currency,
the Office of Thrift Supervision, the Federal Deposit Insurance
Corporation, and the National Credit Union Administration. In this
report, we refer to these agencies as the federal banking regulators.
[8] The Uniting and Strengthening America by Providing Appropriate
Tools Required to Intercept and Obstruct Terrorism (USA PATRIOT ACT)
Act of 2001, Pub. L. No. 107-56 § 358, 115 Stat. 272, 326 (Oct. 26,
2001). We refer to the act as the USA PATRIOT Act.
[9] In addition to depository institutions, casinos, money services
businesses, and futures commission merchants are required to file
currency transaction reports. Money services businesses are businesses
that, among other things, transmit money; cash checks; issue, sell, or
redeem traveler's checks or money orders; or deal or exchange currency.
[10] Prior to the 1994 law, Treasury had procedures in place for filing
CTR exemptions, but they were considered cumbersome and difficult to
understand. H. R. Conf. Rep. No. 103-652 (1994), reprinted in 1994
U.S.C.C.A.N. 1977, 2016. See also 61 Fed. Reg. 18204, 18205 (Apr. 24,
1996).
[11] 31 U.S.C. § 5318(g)(1) and 31 C.F.R. §§ 103.15-103.21. Depending
on the type of financial institution, the threshold amount may vary.
For example, money services businesses generally must file a SAR if a
transaction involves or aggregates $2,000 in funds or other assets. 31
C.F.R. § 103.20. SAR forms must be filed for certain suspicious
transactions involving possible violation of law or regulation,
including transactions that are broken up for the purpose of evading
the BSA reporting and recordkeeping requirements. See FinCEN Ruling
2005-6 Suspicious Activity Reporting (Structuring) (July 15, 2005).
[12] Additionally, Section 314(a) of the USA PATRIOT Act required the
Secretary of the Treasury to adopt regulations to encourage regulatory
authorities and law enforcement authorities to share with financial
institutions information regarding individuals, entities, and
organizations engaged in, or reasonably suspected of engaging in,
terrorist acts or money laundering activities.
[13] For more information on the center's activities, see GAO, Bank
Secrecy Act: FinCEN and IRS Need to Improve and Better Coordinate
Compliance and Data Management Efforts, GAO-07-212 (Washington, D.C.:
Dec. 15, 2006).
[14] GAO, Money Laundering: The Use of Bank Secrecy Act Reports by Law
Enforcement Could Be Increased, GAO/T-GGD-93-31 (Washington, D.C.: May
26, 1993).
[15] The Department of Justice established the OCDETF program in 1982
to conduct comprehensive attacks on major drug trafficking and money
laundering organizations. This program combines the resources and
expertise of several federal agencies, including DEA, IRS, FBI, and
ICE. The OCDETF Fusion Center stores drug and related financial
investigative information for analysis. ICE officials noted that while
it participates in OCEDTF, it does not participate in the Fusion
Center.
[16] Agencies without direct Gateway access may visit FINCEN's offices
and access BSA data directly; these users are referred to as "platform
users."
[17] About 79 percent of survey respondents reported that WebCBRS had
made a "very great" or "great" improvement in their ability to access
CTR data, as measured by "ease of use" or "query response time."
[18] A completed CTR must be filed with FinCEN within 15 days after the
date of the transaction (31 C.F.R. § 103.27(a)(1)). Treasury has
determined that CTRs filed on magnetic media or electronically will be
considered filed in a timely manner if received within 25 days.
[19] About 55 percent of the survey respondents tended to use CTR data
more reactively than proactively, and 28 percent used CTR data
completely reactively.
[20] Individuals or businesses are required to file a CMIR to report
the transportation, whether physically or through the mail, of currency
or other monetary instruments into or out of the United States, on any
one occasion, in excess of $10,000. (31 U.S.C. § 5316; 31 C.F.R. §
103.23).
[21] HIFCAs were conceived in the Money Laundering and Financial Crimes
Strategy Act of 1998 as a means of concentrating law enforcement
efforts at the federal, state, and local levels in areas of high-
intensity money laundering. HIFCAs were first announced in the 1999
National Money Laundering Strategy. Pub. L. No. 105-310, 112 Stat. 2941
(Oct. 30, 1998) codified at 31 U.S.C. §§ 5340-5342 and 5351-5355.
[22] Under BSA provisions, individuals involved in trades or businesses
that are not financial institutions--such as car dealerships or
jewelers--are required to file a Form 8300 to report a cash payment
over $10,000. (31 U.S.C. § 5331). The USA PATRIOT Act created a new
money laundering offense: bulk cash smuggling. The new statute
prohibits the concealment and transfer of more than $10,000 across the
border with the intent to evade reporting requirements. (31 U.S.C. §
5332). The Money Laundering Control Act of 1986 criminalized money
laundering, including knowingly engaging in a monetary transaction of
more than $10,000 with property derived from criminal activity. Pub. L.
No. 99-570, title I, subtitle H, § 1352(a), 100 Stat. 3207 (Oct. 27,
1986) (codified at 18 U.S.C. § 1957).
[23] 31 U.S.C. § 5324.
[24] FinCEN, The SAR Activity Review-By the Numbers, Issue 8 (June
2007). In addition, according to FinCEN analysis, for fiscal years
2004, 2005, and 2006, about 25 percent of SARs filed by depository
institutions on average included references to structuring.
[25] According to the 2007 National Drug Threat Assessment, bulk cash
smuggling is the principal method used by drug traffickers for moving
drug money out of the United States. Bulk cash associated with the sale
of illegal drug proceeds is typically smuggled across the southwestern
border into Mexico.
[26] The Anti-Drug Abuse Act of 1988 first authorized the High
Intensity Drug Trafficking Area program to reduce drug trafficking in
the most critical areas of the country. Pub. L. No. 100-690, title I, §
1005, 102 Stat. 4181 (Nov. 18, 1988). Administered by the Office of
National Drug Control Policy, the program has expanded to 31 areas
since the original designation of five HIDTAs in 1990. See 21 U.S.C. §
1706.
[27] According to the 2007 National Money Laundering Strategy, federal
law enforcement agencies believe bulk cash smuggling may be on the rise
due in part to increasingly effective anti-money-laundering policies
and procedures at U.S. financial institutions.
[28] Eighty-three percent of state and local law enforcement agencies
we surveyed reported that they did not have any data that would support
how often CTRs have provided investigative leads or contributed to any
other outcome measures.
[29] Data from the two agencies differed somewhat but showed a
consistent pattern. The agencies were not able to explain differences
in their data on the number of views.
[30] According to FinCEN, there are Gateway coordinators in each state
authorized to respond to requests for BSA data from local law
enforcement agencies throughout the state, and these coordinators are
required to conduct outreach to local police organizations within their
states.
[31] FinCEN distinguishes "new" CTRs from those that result from
amendments (correcting a previously-filed CTR). The data in this
section are based on the 37,784,310 new CTRs that FinCEN data indicate
were filed during 2004 to 2006, and exclude the 1,045,554 amendments
filed during the period. For further details, see appendix III.
[32] We surveyed institutions that filed at least 120 CTRs in 2006. To
obtain the viewpoints of smaller institutions and those that filed
fewer than 120 CTRs, we relied on structured interviews.
[33] The Bank Secrecy Act requires depository institutions to have a
designated BSA compliance officer to help assure that the institution
adheres to anti-money-laundering and other requirements. 31 U.S.C. §
5318(h)(1)(B).
[34] A federal tax identification number, also known as an employer
identification number, issued by the IRS, is used to identify a
business entity. Generally, businesses need a tax identification
number.
[35] FinCEN estimated the time needed for completing the CTR at 19
minutes and the associated record keeping at 5 minutes per CTR (63 Fed.
Reg. 50147, 50155 (Sept. 21, 1998).
[36] Magnetic media include discs or tapes containing the data on one
or more CTRs.
[37] Others who have surveyed depository institutions in an effort to
quantify costs report that banks they surveyed had difficulty
estimating BSA costs. Two studies, one conducted by KPMG, Global Anti-
Money Laundering Survey 2007: How Banks Are Facing Up to the Challenge,
and a second, Report on FinCEN's Survey on Bank Secrecy Act Costs and
Exemption Procedures, by Deloitte and Touche (October 2002), found that
depository institutions generally had difficulty estimating their costs
of BSA compliance.
[38] An initial exemption is the first one filed on behalf of a
specific customer. These totals do not include subsequent renewals for
these or previously exempted customers.
[39] The manual requires that the examiner should "determine whether
the bank maintains documentation to support that the 'non-listed'
businesses it has designated as exempt from CTR reporting do not
receive more than 50 percent of gross revenue from ineligible business
activities."
[40] 31 U.S.C. § 5321; see GAO, Bank Secrecy Act: Opportunities Exist
for FinCEN and the Banking Regulators to Further Strengthen the
Framework for Consistent BSA Oversight, GAO-06-386 (Washington, D.C.:
Apr. 28, 2006).
[41] Department of the Treasury, Use of Currency Transaction Reports
(Washington, D.C., October 2002).
[42] The 95 percent confidence interval for this estimate is within +/
-11 percentage points.
[43] 31 U.S.C. § 5313(e)(5).
[44] 63 Fed. Reg. 50147, 50153 (Sept. 21, 1998) (FinCEN interpreted the
statute as not explicitly setting a time for the filing of updated
information after an annual review when it issued the final rule
requiring banks to renew the status of Phase II exemptions every 2
years).
[45] 31 U.S.C. § 5318(a)(6).
[46] The examination procedures as outlined in the BSA/AML Examination
Manual require that examiners assess whether ongoing and reasonable due
diligence is performed, including annual reviews, to determine whether
a customer is eligible for the exemption designation.
[47] According to FinCEN, if such a Phase I exempted entity was
"delisted," the relevant bank could immediately exempt the customer
from CTR reporting requirements pursuant to a Phase II exemption
providing that the necessary requirements were met.
[48] The 95 percent confidence interval for the total time to exempt a
customer is 31.2 to 40.5 minutes and for the annual review process is
from 11.7 to 17.3 minutes.
[49] We identified government entities by searching the name fields on
the CTRs; accordingly, we identified only entities that could be
explicitly identified based on their names. The numbers we report
represent a minimum number of entities for whom CTRs might have been
filed.
[50] 31 C.F.R. §§ 103.33 and 103.34.
[51] According to the guidance, this means at least 1 CTR transaction
every 6 weeks. For seasonal businesses, the guidance allows
institutions to have engaged in at least eight large transactions
during a portion of the year, provided the customer has had an account
with the institution for at least 1 year.
[52] This analysis is based on the 10,305 initial Phase II exemptions
filed in 2006 (76 percent of all such exemptions) that (1) could be
linked to a depository institution and (2) for which at least 1 CTR had
been filed.
[53] 31 C.F.R. §103.121(b)(2). The regulations stipulate that, under
the USA PATRIOT Act, the Customer Identification Program must include
risk-based procedures for verifying a customer's identity that enable
the depository institution to form a reasonable belief that it knows
the true identity of the customer.
[54] The majority of responses to frequently asked questions and
guidance on the FinCEN Web site related to CTR exemptions are largely
technical and dated from 2000 through 2002.
[55] The 95 percent confidence interval for this estimate is within +/
-15 percentage points.
[56] The Securities and Exchange Commission requires public companies
to disclose meaningful financial and other information to the public,
which provides a public source for all investors to use to judge for
themselves if a company's securities are a good investment. These
reports are publicly available through the EDGAR database on the
Securities and Exchange Commission's Web site.
[57] A correspondent bank is a financial institution that performs
financial services for another financial institution, such as a bank or
credit union.
[58] Under provisions of the USA PATRIOT Act, certain institutions must
have and implement policies, procedures, and internal controls, for
example, to verify customers' identities and file necessary BSA
reports.
[59] These agencies were located in the 50 states, the District of
Columbia, and Puerto Rico. They included law enforcement agencies, such
as police departments and state bureaus of investigation, legal
agencies such as prosecutor's offices, and regulatory agencies such as
state banking departments.
[60] We originally selected a sample of 699 institutions, but 19 of
these institutions were excluded for various reasons, such as bank
mergers.
[61] Reports on the exemption procedures included the report submitted
by Deloitte & Touche in October 2002 to FinCEN on the Bank Secrecy Act
and exemption procedures, and FinCEN's subsequent report, Report to the
Congress, Use of Currency Transaction Reports, submitted by FinCEN on
behalf of the Department of the Treasury (October 2002).
[62] For more information, see GAO, Data Mining: Agencies Have Taken
Key Steps to Protect Privacy in Selected Efforts, but Significant
Compliance Issues Remain, GAO-05-866 (Washington, D.C.: Aug. 15, 2005).
[63] According to FinCEN, link analysis is a technique used to explore
associations among a large collection of data of different types. In
the case of financial data, the connections might include, for example,
names, addresses, bank accounts, businesses, and cash deposits.
Combining and linking these pieces of data from multiple sources add
layers of understanding to the behavior the data represents.
[64] The Phase I eligibility for publicly traded companies generally
applies to any entity (other than a bank) whose common stock is listed
on the New York, American, or NASDAQ stock exchanges or any subsidiary
of any "listed entity" that is organized under U.S. law and at least 51
percent of whose common stock is owned by a listed entity. The
Securities and Exchange Commission's Web site makes available to the
public the Electronic Data Gathering Analysis and Retrieval (EDGAR)
system database, which includes disclosure documents that public
companies are required to file with the commission. EDGAR
electronically receives, processes, and disseminates more than 500,000
financial statements every year.
GAO's Mission:
The Government Accountability Office, the audit, evaluation and
investigative arm of Congress, exists to support Congress in meeting
its constitutional responsibilities and to help improve the performance
and accountability of the federal government for the American people.
GAO examines the use of public funds; evaluates federal programs and
policies; and provides analyses, recommendations, and other assistance
to help Congress make informed oversight, policy, and funding
decisions. GAO's commitment to good government is reflected in its core
values of accountability, integrity, and reliability.
Obtaining Copies of GAO Reports and Testimony:
The fastest and easiest way to obtain copies of GAO documents at no
cost is through GAO's Web site [hyperlink, http://www.gao.gov]. Each
weekday, GAO posts newly released reports, testimony, and
correspondence on its Web site. To have GAO e-mail you a list of newly
posted products every afternoon, go to [hyperlink, http://www.gao.gov]
and select "Subscribe to Updates."
Order by Mail or Phone:
The first copy of each printed report is free. Additional copies are $2
each. A check or money order should be made out to the Superintendent
of Documents. GAO also accepts VISA and Mastercard. Orders for 100 or
more copies mailed to a single address are discounted 25 percent.
Orders should be sent to:
U.S. Government Accountability Office:
441 G Street NW, Room LM:
Washington, D.C. 20548:
To order by Phone:
Voice: (202) 512-6000:
TDD: (202) 512-2537:
Fax: (202) 512-6061:
To Report Fraud, Waste, and Abuse in Federal Programs:
Contact:
Web site: [hyperlink, http://www.gao.gov/fraudnet/fraudnet.htm]:
E-mail: fraudnet@gao.gov:
Automated answering system: (800) 424-5454 or (202) 512-7470:
Congressional Relations:
Ralph Dawn, Managing Director, dawnr@gao.gov:
(202) 512-4400:
U.S. Government Accountability Office:
441 G Street NW, Room 7125:
Washington, D.C. 20548:
Public Affairs:
Chuck Young, Managing Director, youngc1@gao.gov:
(202) 512-4800:
U.S. Government Accountability Office:
441 G Street NW, Room 7149:
Washington, D.C. 20548:
