Background BSA/AML Requirements and Key Agencies Involved in Their Enforcement The BSA established reporting, recordkeeping, and other AML requirements for financial institutions. As the delegated administrator of the BSA, FinCEN has issued implementing regulations. In complying with BSA/AML requirements, U.S. financial institutions assist government agencies in detecting and preventing money laundering and terrorist financing by, among other things, establishing and maintaining compliance programs, conducting ongoing monitoring of customers and transactions, and reporting suspicious activity. Oversight and enforcement of compliance with the BSA involve several federal agencies, including FinCEN and the Internal Revenue Service (IRS). FinCEN has overall authority for administering and enforcing compliance under the BSA and may seek civil penalties and injunctions to compel compliance. In addition, each of the federal banking regulators has independent authority to initiate enforcement actions against supervised institutions for violations of law and to seek civil money penalties for BSA violations, among other things. FinCEN has delegated authority to IRS to investigate most criminal violations of the BSA. The Department of Justice prosecutes violations of federal criminal money-laundering statutes, including violations of the BSA, and several law enforcement agencies conduct BSA-related criminal investigations. The federal banking regulators have also issued BSA/AML regulations that require banks to establish and maintain a BSA/AML compliance program that includes, among other things, policies, procedures, and processes to identify and report suspicious activity. The banking regulators are required to review banks’ compliance with BSA/AML requirements and regulations, which they generally do every 1 to 2 years as a part of their routine safety and soundness examinations. FinCEN has also delegated examination authority for BSA/AML compliance for certain entities, including money transmitters, to IRS. In general, money transmitters must register with FinCEN and provide certain information on their structure and ownership. According to Treasury, in all but one state, money transmitters are required to obtain licenses from states in which they are incorporated or conduct business. State supervisory agencies also may conduct BSA/AML examinations of licensed money transmitters. To ensure consistency in the application of BSA/AML requirements, in 2005 the federal banking regulators collaborated with FinCEN on developing an examination manual that was issued by FFIEC for federal bank examiners conducting BSA/AML examinations of banks. The examination manual has been revised several times since its release, and the most recent comprehensive revision was released in 2014. According to the examination manual, a key function of the federal banking regulators’ BSA/AML examinations is to assess whether banks have established the appropriate policies, procedures, and processes based on their BSA/AML risk to identify and report suspicious activity. The supervisory process also assesses whether banks provide sufficient detail in reports to law enforcement agencies to make the reports useful for investigating suspicious transactions that are reported. Moreover, federal banking regulators conduct risk-focused BSA/AML examinations of banks—that is, they review key BSA/AML risks or specific risk areas identified by the bank and tailor examination procedures based on each bank’s risk profile. Among other things, examiners review whether banks have an adequate system of internal controls to ensure ongoing compliance with BSA/AML regulations. Similarly, in 2008 FinCEN issued a BSA examination manual to guide reviews of money transmitters and other types of MSBs, including reviews by IRS and state regulators. Both the FFIEC and FinCEN examination manuals are publicly available. Components of BSA/AML Compliance Programs for Money Transmitters and Banks under the BSA Money transmitters and banks are subject to requirements under the BSA. They are generally required to design and implement a written AML compliance program, report certain transactions to Treasury, and meet recordkeeping (including identity documentation) requirements for transfers of $3,000 or more. At a minimum, each AML compliance program must establish a system of AML compliance policies, procedures, and internal controls to ensure ongoing compliance; designate an individual to coordinate and monitor day-to-day provide training for appropriate personnel; and provide for an independent audit function to test for compliance. Additionally, banks must include appropriate risk-based procedures for conducting ongoing customer due diligence as part of their AML compliance program. BSA/AML regulations require that each bank or money transmitter tailor a compliance program that is specific to its own risks based on factors such as the products and services offered and the customers and locations served. BSA/AML compliance programs for banks—including those that service money transmitters—are expected to include the following: Customer identification program. Banks must have written procedures for opening accounts and must specify what identifying information they will obtain from each customer. At a minimum, the bank must obtain the following identifying information from each customer before opening the account: name, date of birth, address, and identification number, such as a Social Security number or a passport number. Banks’ customer identification programs must also include risk-based procedures for verifying the identity of each customer to the extent reasonable and practicable. Additionally, a bank’s customer identification program should contain procedures for circumstances when a bank cannot verify the customer’s identity, including procedures for when the bank should not open an account and when the bank should close an account. Customer due diligence procedures. These procedures assist banks in determining when transactions are potentially suspicious. Procedures must be designed to achieve two minimum regulatory requirements: (1) understanding the nature and purpose of customer relationships so customer risk profiles can be developed and (2) conducting ongoing monitoring, based on the level of risk associated with the customer, to identify and report suspicious activity and to maintain and update customer information on a risk-basis. Additional due diligence procedures. Due diligence procedures also should define when and what additional customer information will be collected for customers who banks determine may pose a higher risk for money laundering or terrorist financing. Procedures should be based on each customer’s risk profile and specific risks posed. Banks review higher-risk customers and their transactions more closely at account opening and more frequently throughout the term of their relationship with the bank. In addition, banks and money transmitters must also have policies and procedures to monitor transactions and identify suspicious activity. Monitoring generally includes (1) manual review of transaction summary reports to identify suspicious transactions or (2) automated monitoring systems that use computer algorithms to identify patterns of unusual activity. As we previously reported, banks with large transaction volumes typically use automated monitoring systems. Banks and money transmitters also must comply with certain reporting requirements: Currency Transaction Reports. Banks and money transmitters must electronically file this type of report for each transaction or a combination of transactions in a single day—such as a deposit, withdrawal, exchange, or other payment or transfer—in currency of more than $10,000. Suspicious Activity Reports (SAR). Under FinCEN regulation, banks and money transmitters are required to file this type of report when (1) a transaction involves or aggregates at least $5,000 in funds or other assets for banks or at least $2,000 in funds or other assets for money transmitters and (2) the institution knows, suspects, or has reason to suspect that the transaction is suspicious. In addition, banks’ compliance programs generally include policies and procedures that describe criteria for deciding to close or not to open an account. For example, although there is no requirement for a bank to close an account that is the subject of a SAR filing, a bank should develop criteria in policies and procedures that indicate when it will escalate issues identified through repeat SAR filings on accounts, including criteria on when to close an account. The federal banking regulators generally do not direct banks to open, close, or maintain individual accounts. Transfers through Money Transmitters The money transfer industry is diverse, ranging from Fortune 500 companies with numerous outlets worldwide to small, independent money transmitters. Some money transmitters are in communities with population concentrations that do not necessarily have access to traditional banking services. Money transmitters may send and receive funds domestically—intrastate or interstate—or internationally. Money transmitters typically work through agents—separate business entities generally authorized to send and receive money transfers. Most money transfers are initiated in person at retail outlets. Money transmitters generally operate through their own retail storefronts or through grocery stores, financial service outlets, convenience stores, and other retailers that serve as agents. In one common type of money transmitter transaction—known as a cash- to-cash transfer—a sender enters a money transmitter agent location and provides cash to cover the transfer amount and fees (see fig. 1). For transfers at or above $3,000, senders must generally provide basic information about themselves (including name and address) at the time of the transfer request. The agent processes the transaction, and the money transmitter’s headquarters screens it to validate BSA/AML compliance. The money is then transferred to a recipient via a distributing agent or bank. In an international money transfer, the money may be distributed through an agent in the destination country, wired through the money transmitter’s bank to the distributor agent’s bank, or transferred by other means to a specified agent in the recipient’s country. The distributor agent pays out cash to the recipient in either U.S. dollars or local currency. Money-Laundering and Terrorist-Financing Risks Posed by Money Transmitters Money transfers can pose money-laundering and terrorist-financing risks, as funds related to illicit activity may go undetected due to the large volume of transactions or to money transmitters’ inadequate oversight of the various entities involved. We and others have identified money- laundering and terrorist-financing risks associated with money transmitters, including risks related to agents, customers, geographic location, and products. Agents. Money transmitters often work with multiple agents, and maintaining adequate oversight can be challenging, given the decentralized nature of the agent system. According to data collected by the Conference of State Bank Supervisors, as of December 31, 2018, 204 money transmitters reported that they had more than 440,000 agents—with nine of these money transmitters reporting that they had at least 10,000 agents. These agents present money- laundering risks if they knowingly or unknowingly fail to follow BSA/AML requirements or the policies and programs established by the money transmitter. For example, an agent may not follow the recordkeeping requirements for transfers above the regulatory funds transfer threshold or above lower thresholds that a money transmitter has self-imposed. MSB principals are required to conduct risk-based monitoring of their agents. Customers. Certain customers may pose heightened risk because of the nature of their business, occupation, or anticipated transaction activity. Additionally, in certain instances, they may be able to launder money while remaining anonymous. For example, customers may use false identities or straw men (individuals hired to conduct transfers on behalf of others) to keep from being identified as the original source of the funds. Examples of suspicious customer activity that may indicate money laundering include identification documents that cannot be easily verified; the use of different taxpayer identification numbers with variations of the same name; frequent or large transactions with no record of past or present employment; and reluctance to provide identification for transactions subject to identification requirements. Geographic location. Certain geographic locations may be more vulnerable to money laundering or terrorist financing via money transfers. High-risk geographic locations can be either international or domestic. According to FinCEN’s MSB examination manual, examples of international high-risk geographic locations include countries subject to sanctions by the Office of Foreign Assets Control or countries and territories identified as being noncooperative. Domestic high-risk geographic locations include High Intensity Drug Trafficking Areas (HIDTA) and High Intensity Financial Crime Areas (HIFCA). Products. According to the FFIEC and FinCEN MSB examination manuals, certain products and services, such as money transfers, may pose a higher risk of money laundering because of the degree of anonymity they can offer. For example, the Financial Action Task Force identified money-laundering and terrorist-financing risks associated with mobile payments because these services can sometimes allow for anonymous transactions, depending on the level of AML measures the mobile payments provider has in place. The task force also reported that virtual currency—digital representations of value such as Bitcoin that are not government-issued legal tender—could facilitate international remittances as virtual-currency- based products and services are developed. Federal agencies and international organizations have identified instances where money transfers have been used to launder proceeds from illicit activities such as human smuggling and trafficking, drug trafficking, and consumer fraud, including the following examples: In 2017, a large money transmitter entered into a $586 million settlement with the Department of Justice, the Federal Trade Commission, and the U.S. Attorney’s offices for several states after it was accused of, among other things, processing money transfers that were suspected of being used to pay human smugglers in China. In 2012, the Department of Justice found that a large money transmitter’s agents knowingly participated in a scheme in which victims wired funds to the transmitter’s agents and outlets in response to fraudulent claims such as promising victims they would receive large cash prizes or lottery winnings, falsely offering various high- ticket items for deeply discounted prices, falsely promising employment opportunities, or posing as a relative of the victim and claiming to be in trouble and in urgent need of money. In a 2011 case, seven people were sentenced for money laundering and drug trafficking involving the transfer of funds from the U.S. Virgin Islands to Alaska. Hundreds of thousands of dollars in payment for the drugs were sent using a large money transmitter in amounts averaging less than $2,000 per wire transfer, a money-laundering method known as structuring. See figure 2 for an illustrated example of structuring. Requirements to Assess and Manage Money-Transmitter Risk Present Challenges for Some Banks Banks Are Required to Assess Money-Transmitter Risks and Manage Risks through Due Diligence and Monitoring In April 2005, FinCEN and the federal banking regulators issued interpretative guidance to further clarify BSA/AML requirements to banks that provide banking services to MSBs (including money transmitters) operating in the United States. According to the interagency guidance, a bank’s level and extent of due diligence beyond the minimum expectations should be based on an assessment of the individual customer’s BSA/AML risks. If a particular MSB relationship indicates a low risk of money laundering or other illicit activity, the bank may not be routinely expected to perform further due diligence beyond minimum expectations. Minimum expectations include applying the bank’s customer identification program and confirming FinCEN registration (if required), agent status (if applicable), and state and local licensing requirements (if applicable). Banks are also to conduct a basic BSA/AML risk assessment to determine the level of risk associated with the account and whether further due diligence is necessary. In order to properly assess risks, the interpretive guidance clarifies that banks should consider the purpose of the account, the types of products and services offered by the MSB, the locations and markets it serves, and the anticipated account activity (see text box). Examples of Basic Information Banks Should Consider When Assessing a Money Transmitter’s Money-Laundering Risk, According to the Interagency Guidance Purpose of account: Whether the money transmitter needs the bank account to transfer funds to its principal U.S. account or to foreign-based agents in other countries. Products and services offered: Whether the money transmitter is a principal with a fleet of agents, or is it an agent itself, and whether money transmission the customer’s primary or ancillary business (such as a grocery store that derives a small fraction of its overall revenue from providing money transmission services). Locations served: Whether the money transmitter’s market domestic or international and whether it targets local residents or broad markets. Anticipated account activity: Relevant considerations include the expected transaction amounts and whether the money transmitter is operating out of one location and using one bank branch, or whether it has several agents making deposits at multiple branches throughout the bank’s network. If a bank concludes from its risk assessment that the MSB customer presents a higher level of money-laundering or terrorist-financing risk, it will be expected to conduct additional due diligence in a manner commensurate with the heightened risk. According to the interagency guidance, the appropriate amount of due diligence depends in part on the level of perceived risk and the size and sophistication of the particular MSB. Appropriate due diligence can include reviewing the MSB’s BSA/AML compliance program, the results of the MSB’s independent testing of its program, and written agent management and termination practices for the MSB, as well as conducting on-site visits to the MSB. The interagency guidance also provides examples of “risk indicators” to assist banks with their risk assessments. Examples of potentially lower- risk indicators include a money transmitter that primarily markets to customers that conduct routine transactions with moderate frequency in low dollar amounts; is an established business with an operating history; or only remits funds to domestic entities. Examples of potentially higher- risk indicators include a money transmitter that allows customers to conduct transactions in higher dollar amounts with moderate to high frequency; is a new business without an established operating history; offers only, or specializes in, cross-border transactions, particularly to countries posing heightened risk for money laundering or terrorism financing; or is located in an area designated as a HIFCA or HIDTA. The guidance notes that in determining the level of risk, a bank should not focus on any single indicator. Rather, an effective risk assessment should be a composite of multiple factors, and depending on the circumstances, certain factors may be weighed more heavily than others. Banks’ customer risk assessments also determine the level of ongoing monitoring for suspicious activity they must perform on each customer. The interagency guidance states that, based on the bank’s assessment of the risks of its MSB customers (including money transmitters), monitoring should include periodic confirmation that initial projections of account activity have remained reasonably consistent over time. Examples of potentially suspicious activity include a money transmitter transferring funds to a different jurisdiction than expected or depositing currency significantly in excess of expected amounts without any justifiable explanation, such as an expansion of business activity or new locations. Officials from several banks we spoke with described their additional due diligence procedures for implementing BSA/AML requirements when accepting new money transmitter customers or monitoring existing ones. These include obtaining and reviewing the money transmitter’s BSA/AML policies, using questionnaires and interviews to collect detailed information from the money transmitter on its business operations—such as services offered, transaction volume, and cash activity—and site visits to verify the information collected. Officials from one bank told us that additional due diligence includes a review of the money transmitter’s business location, longevity, principal owners, transaction volume, and cash activity. Bank staff collect this information via a questionnaire administered through an in-person interview at a branch. After reviewing the information, the bank’s BSA/AML compliance department may choose to speak one-on-one with the potential money transmitter customer or conduct a site visit. When monitoring a new money transmitter customer for suspicious activity, compliance staff compare answers from the due diligence questionnaire against the customer’s cash log and wire activity to determine if the activity is outside normal parameters. The compliance department investigates any suspicious leads and reports them to the bank’s SAR committee to decide whether to file a SAR. Federal Banking Examiners Determine Whether Banks Adequately Incorporate BSA/AML Risk into Their Compliance Programs Federal banking examiners determine whether a BSA/AML examination should include a review of a bank’s money transmitter accounts based on the overall risk profile of the bank. The FFIEC examination manual directs examiners to tailor the BSA/AML examination scope and procedures to the specific risk profile of the bank. Examiners begin a BSA/AML examination by reviewing and assessing the adequacy of the bank’s BSA/AML risk assessment. This review includes determining whether bank management has developed an accurate risk assessment that identifies significant risks to the bank (see text box). This determination is based on factors such as whether management has adequately considered all products, services, customers, transaction number and volume, and geographic locations, and whether management’s assessment methodology within these specific risk categories was adequate. Bank Secrecy Act/Anti-Money Laundering (BSA/AML) Examination Procedures for Banks In order to effectively apply resources and ensure compliance with BSA requirements, the Federal Financial Institutions Examination Council (FFIEC) examination manual is structured to allow examiners to tailor the BSA/AML examination scope and procedures to the specific risk profile of the bank. At a minimum, examiners are expected to follow core examination procedures to ensure that the bank has an adequate BSA/AML compliance program commensurate with its risk profile. The core procedures encompass four areas: Scoping and planning: Identifying the bank’s BSA/AML risks, developing the examination scope, and documenting the plan. BSA/AML risk assessment: Assessing the BSA/AML risk profile of the bank and evaluating the adequacy of the bank’s BSA/AML risk assessment process. BSA/AML compliance program: Determining whether the bank has developed, administered, and maintained an effective program for compliance with the BSA and all of its implementing regulations. Developing conclusions and finalizing the examination: Formulating conclusions, communicating findings to management, preparing report comments, developing an appropriate supervisory response, and closing the examination. In addition to the core examination procedures, the examination manual also contains sections of expanded examination procedures that address specific lines of business, products, customers, or entities that may present unique BSA/AML compliance challenges and exposures for which banks should institute appropriate policies, procedures, and processes. As examples, the examination manual contains expanded examination procedures with respect to nonbank financial institutions, electronic banking, and funds transfers. The examination manual indicates that not all of the core and expanded examination procedures are likely to be applicable to every bank. The specific examination procedures that need to be performed depend on the BSA/AML risk profile of the bank, the bank’s history of BSA/AML compliance, and other relevant factors. Examiners also review the bank’s written BSA/AML compliance program and determine whether the bank has adequately incorporated the risk it identified through its risk assessment into its BSA/AML compliance program. This review and determination include completing relevant core examination procedures for assessing key elements of the bank’s compliance program, such as the customer identification program and policies, procedures, and processes related to customer due diligence, suspicious activity reporting, and currency transaction reporting. As part of these core examination procedures, examiners conduct risk-based transaction testing, which OCC staff noted allows examiners to evaluate the adequacy of the bank’s compliance with regulatory requirements; determine the effectiveness of its policies, procedures, and processes; and evaluate suspicious activity monitoring systems. For example, examiners might determine to select and review a sample of customer accounts in testing the bank’s compliance with its policies, procedures, and processes or for possible suspicious activity. The FFIEC examination manual contains an expanded examination section for banks with significant relationships with nonbank financial institutions, which include MSBs. This expanded section references and incorporates the April 2005 interagency guidance for providing banking services to MSBs and includes related examination procedures. Consistent with this guidance, these procedures direct examiners to assess whether the bank has minimum due diligence policies, procedures, and processes in place for new or existing MSB accounts. Examiners are then to determine whether the bank’s policies, procedures, and processes to assess MSB risks effectively identify higher-risk accounts and the amount of further due diligence necessary. To assist in this effort, the manual directs examiners to perform risk- focused transaction testing on a sample of higher-risk MSB accounts. In discussion groups held with federal bank examiners, examiners from all discussion groups noted that their review of the transaction activity of money transmitter accounts is essential to determining whether the bank understands the money transmitter’s business and has appropriately assessed the risk. For example, one examiner said that customer due diligence procedures at account opening should include the appropriate qualitative and quantitative questions so that the bank can make a reasonable determination of the types and volumes of transactions that will be flowing in and out of the account. Examiners from all discussion groups said that when assessing the bank’s risk assessment of a money transmitter, they focus on whether the bank has considered the risk factors discussed in the examination manual, including geography, customer type, products, services, and transactional volume. In some discussion groups, examiners noted that they may review money transmitter accounts if these accounts are included in the sampling of bank customer accounts as part of the core examination procedures. One examiner said that because banks in her region do not tend to specialize in money transmitters or have a significant degree of risk from them, the only time she reviews money transmitter accounts is if they are included in her sample for transaction testing. Examiners from one discussion group said that they may review money transmitters as part of expanded examination review procedures for nonbank financial institutions if the bank has a large portfolio of money transmitter accounts. For example, one examiner said he generally does not set out to look for and review money transmitter accounts when conducting a BSA/AML examination, but in one case his examination team learned that during the course of a merger, a bank acquired a number of nonbank financial institutions, including MSBs. As this bank did not have prior experience with these kinds of customers, the examination team decided to include them in the scope of their review. Examiners in all discussion groups said that they neither instruct nor recommend that banks close accounts with money transmitters or other types of MSBs. Although IRS and state agencies also examine money transmitters and other MSBs, examiners from all discussion groups said that BSA/AML requirements and guidance do not allow banks to rely on IRS or state oversight. These examiners said these reports could provide banks with a useful additional source of information when conducting their due diligence on MSB customers. However, these examiners added that the reports would not substitute for or reduce the due diligence expected of banks in complying with BSA/AML compliance program requirements.. Examiners from most discussion groups observed that they know very little about the quality of state or IRS examinations of MSBs and their frequency. Examiners Identified BSA/AML Compliance Challenges for Some Banks with MSB Customers, Including Money Transmitters Examiners in our discussion groups said the challenges that some banks face in ensuring BSA/AML compliance for their MSB customers include those related to customer due diligence, risk assessments, customer identification, and BSA/AML compliance staff and resources. Customer due diligence. Examiners from most discussion groups said that some banks do not fully understand the customer due diligence requirements for banking MSBs. Examiners in some discussion groups said that banks do not always fully review or understand the documents and information obtained from their MSB customers in conducting due diligence. One examiner described an instance where bank staff could not understand documentation collected from MSB customers in a foreign language. Examiners in some discussion groups said banks do not understand the need to conduct ongoing monitoring of MSB accounts, including of the flow and volume of customers’ transactions. For example, one examiner in a different discussion group described an instance of a community bank that was unaware that an MSB account had $2 billion flowing through annually even though the bank had only $1 billion in assets. Examiners in some discussion groups said that banks also may not fully understand their automated software for monitoring suspicious activity or how to set the proper software parameters for capturing potentially suspicious transactions. One examiner in a different discussion group said that without proper monitoring, a bank would not know when sudden changes in MSB customers’ transaction types or volumes would be considered suspicious and should be reported. Risk assessment. Examiners in many discussion groups said some banks do not appropriately assess their MSB customers’ risk, either because they do not consider relevant risk factors or they rate all MSB customers at the same risk level. One examiner in a discussion group said he examined a bank with many money transmitter customers that transmitted funds to several countries and found that the bank did not assess the risk levels of the countries to which the money transmitters sent funds. An examiner in a different discussion group said that banks often assess all MSBs at the same level of risk because they do not understand the difference between the various risk levels. Another examiner in the same discussion group added that banks often do not understand the guidance clarifying that banks should assess each customer’s risk individually. This statement was corroborated by our review of several banks’ BSA policies that stipulated that all money transmitters and other MSBs should be considered high risk, contrary to the 2005 guidance. Customer identification. Examiners from many discussion groups said banks do not always identify their MSB customers—for example, when a bank acquires another bank without being aware that the acquired bank has MSB customers. Examiners in some discussion groups said that failure to properly identify MSB customers stems partly from inadequate due diligence or risk assessment. BSA/AML compliance staff and resources. Examiners in many discussion groups said that some banks do not have sufficient BSA/AML compliance staff or resources to manage their BSA/AML compliance programs. For example, an examiner in one discussion group described a bank with nearly 70 money transmitters and more than 200 check cashers but only four staff in its BSA/AML compliance department, which the examiner considered inadequate. Examiners in many discussion groups said that BSA/AML deficiencies generally stem from overall weakness in a bank’s BSA/AML compliance program or internal controls, and not from providing services to money transmitters or any particular customer type. An examiner from one discussion group noted that a bank with weak internal controls around money transmitters likely has weak internal controls across its BSA/AML compliance program. Examples of deficiencies provided by examiners across discussion groups include banks failing to follow written policies and procedures, rating entire categories of customers as high-risk rather than assessing individual customer risk, not conducting on-site customer reviews, failing to conduct other due diligence, and not properly monitoring and reporting suspicious activities. Moreover, our review of bank examination documents found that BSA/AML-related deficiencies mostly stemmed from weakness in banks’ BSA/AML compliance programs and internal controls overall—for example, in customer identification programs, customer due diligence procedures and practices, and risk assessments—and not from a bank providing services to MSBs or any other customer type. According to examiner discussion groups and examination documents we reviewed, not all banks with MSB customers experience BSA/AML compliance challenges. Examiners in some discussion groups noted that banks that successfully provide accounts to MSBs, including money transmitters, tend to have a strong BSA/AML compliance program. For example, examiners in some discussion groups said that such banks have internal controls commensurate with the BSA/AML risks of the MSB customers, including conducting appropriate monitoring and due diligence of customers, and understand the full scope of MSB customers’ activities. The examiners stated that these banks also have sufficient BSA/AML compliance staff who received training. Similarly, our review of bank examination documents included examples of banks with MSB customers that complied with BSA/AML compliance program requirements, such as a community bank with 80 money transmitters. In the examination documents we reviewed, examiners noted that although the bank engaged in higher-risk business, it was managing the risk appropriately. Some Examiners Identified Challenges in Assessing Banks’ Due Diligence for Money Transmitters While views among examiners in our discussion groups varied, examiners in some discussion groups identified challenges in assessing banks’ customer due diligence for money transmitters and other MSB customers. As discussed earlier, the FFIEC examination manual includes an expanded examination section for nonbank financial institutions that provides procedures and guidance for examiners when assessing banks’ compliance controls for MSB customers, including money transmitters. The procedures direct examiners to determine whether the banks’ policies, procedures, and processes to assess risks posed by MSB customers allow the banks to effectively identify higher-risk accounts and the amount of further due diligence that is necessary. The expanded examination guidance provides examples of actions banks can take to meet the additional due diligence requirement for customers they deem to be higher risk. Examiners from many discussion groups said they believe these procedures and guidance are sufficient. One examiner noted that assessing controls is the same for a bank’s MSB customers as for any other type of customer. However, examiners from some discussion groups said it was unclear how much due diligence is reasonable to expect banks to conduct for their money transmitters and other MSB customers. An examiner in one discussion group said it was not clear from the examination procedures and guidance how much banks were expected to question and request information from their MSB customers or monitor their MSB customers’ due diligence efforts without expecting banks to act as the de facto regulator for MSBs. Other examiners noted that although banks are responsible for understanding the kinds of transactions that flow through an MSB, to some extent banks do not have visibility into these individual transactions, as they are aggregated before flowing into the account at the bank. Similarly, another examiner said there was uncertainty about how critical an examiner should be of a bank’s due diligence efforts in cases where a bank’s documentation on an MSB customer’s BSA/AML compliance program is lacking. One examiner noted that while the examination guidance provides examples of due diligence actions banks can consider performing, those actions are not requirements. The examiner said it was therefore not clear to what extent examiners should apply these examples as criteria and expect banks to have implemented them. Further, examiners in some discussion groups said that it can be difficult to evaluate banks’ risk assessments, including processes for identifying higher-risk customers that require additional due diligence. One examiner said that it is unclear from the examination procedures how to determine whether banks’ risk assessment processes for identifying higher-risk customers are adequate. An examiner in a different discussion group said that in evaluating banks’ risk assessment of new money transmitter customers, he looks for whether banks ask why new customers switched banks. However, other examiners in the same discussion group noted that this is not a standard question. Our review of the expanded examination section found a lack of examples of specific steps or processes that examiners can take in assessing banks’ compliance for additional due diligence. For example, this section’s procedures contain only a general reference that examiners should determine whether the banks’ policies, procedures, and processes effectively allow the banks to identify and conduct risk-based due diligence for higher-risk customers and lack specific examples to assist examiners in evaluating additional due diligence activities. The section’s guidance states that examiners could take actions, including reviewing an MSB’s BSA/AML compliance program or conducting on-site visits to help evaluate a bank’s compliance. But neither the guidance nor the procedures clarify what these reviews or visits might entail. In comparison, the expanded section’s guidance and procedures include examples of specific steps that examiners can take when assessing banks’ compliance with minimum due diligence requirements for MSB accounts, such as applying the bank’s customer identification program and confirming FinCEN registration status and state licensing, if applicable. Officials from the Federal Reserve and OCC said that the examination manual is not intended to provide explicit criteria for examiners when they are assessing the adequacy of a bank’s program. They said that establishing explicit criteria would result in a “check the box” approach to BSA/AML compliance, such that banks are given a uniform set of requirements to follow, irrespective of the money-laundering or terrorism- financing risks associated with their banking activities. They said that if banks only needed to meet specific requirements, such an approach would encourage banks to do the minimum to establish a BSA/AML compliance program and would not effectively detect and deter money laundering and terrorism financing. As discussed earlier, the examination manual is instead structured to allow examiners to tailor the BSA/AML examination scope and procedures to the specific risk profile of the bank. Staff from the federal banking regulators said that as a result, examiners are expected to apply their judgment in evaluating banks’ BSA/AML compliance programs. However, while regulators want compliance programs to be tailored to the unique risks a bank’s operations present, examiners need sufficient guidance to determine whether a given bank’s BSA/AML-related policies, processes, and procedures are adequate. Regulators and FinCEN issued the 2005 interagency guidance to clarify BSA/AML requirements and supervisory expectations for banks when providing banking services to money transmitters and other MSBs. Since then, examiners have relied on this guidance when reviewing banks’ MSB customer accounts. However, the examination procedures and related guidance may not provide all of the information examiners need to conduct their assessments, as indicated by the examiners in some of our discussion groups who reported that it is not clear to them how to determine whether banks’ due diligence efforts are adequate. Providing clarifying information would not compromise examiners’ ability to exercise judgement during an examination. Rather, it would provide them with greater certainty that they are evaluating banks’ compliance with BSA/AML requirements appropriately. Federal internal control standards state that agencies should identify, analyze, and respond to risks related to achieving the defined objectives. Unless federal banking regulators take steps to improve examiners’ ability to evaluate banks’ compliance controls with respect to money transmitter accounts, examiners may not be fully achieving the BSA/AML examination objectives of identifying and assessing risks and banks’ ability to manage risks, as set out in the examination manual in assessing banks’ compliance with BSA/AML requirements. Internal control standards also state that agencies should internally communicate the necessary quality information to achieve their objectives. With respect to examiners, such communication could include providing updates to examination procedures, examiner training, or a combination of methods. Terminating or Limiting Bank Accounts with Money Transmitters May Raise Derisking Concerns and Can Affect Their Operations Survey Results Suggest That a Number of Banks Terminated or Limited Money Transmitters’ Accounts in 2014–2016 We estimate that 32 percent of banks nationwide provided accounts to money transmitters from 2014 through 2016, based on the results of a survey we conducted jointly with other GAO work on derisking. For calendar year 2016, of the 91 banks that reported having money transmitters as customers, 71 banks of varying asset sizes reported having 41,089 money transmitter accounts (see table 1). Overall, of the 91 banks that reported having money transmitters as customers, close to half of them (40 banks) terminated at least one of their money transmitter accounts and almost one-third of them (29 banks) limited the number of accounts with money transmitters, both for reasons related to BSA/AML risk, from 2014 through 2016 (see table 2). Because extra-large banks reported having a much greater number of accounts with money transmitters, these banks also reported a greater proportion of account terminations, compared with small and medium banks. Specifically, 18 banks of all sizes that responded to the survey reported that they terminated 1,098 accounts in 2016—with 89 percent of these account closures (976 out of 1,098) reported by six extra-large banks. In particular, one extra-large bank accounted for more than half (601 out of 1,098) of the account terminations in that year. See table 3 for more information on account terminations in 2016. See appendix II for more information on account terminations and limitations. Although Some Account Terminations and Limitations Are Associated with Managing BSA/AML Risk, Some Raise Derisking Concerns Some terminations and limitations of money transmitters’ bank accounts appear to be associated with managing BSA/AML risk. However, some terminations and limitations raise derisking concerns. Some Reasons for Terminating or Limiting Accounts Are Associated with Managing BSA/AML Risk Some reasons that banks reported for terminating accounts were associated with managing BSA/AML-related risk, including the filing of SARs associated with the account and customers failing to provide information necessary for the bank to conduct adequate BSA/AML due diligence. Some banks also reported terminating accounts to reduce the risk that a customer’s activity could harm a bank’s reputation, known as reputational risk (see table 4). These survey results are consistent with the results of our prior work on banks in the Southwest border region. The most commonly cited reason in our survey for terminating accounts was the filing of SARs. Officials we interviewed from one bank told us that they investigate customers that have triggered multiple SAR filings and considered setting up controls to limit account activities. Officials of another bank told us that a federal bank examiner suggested that the bank consider closing an account with a money transmitter customer because of SAR filings associated with it. The second most commonly cited reason for terminating accounts was that a customer failed to provide information requested by a bank for conducting BSA/AML due diligence. Officials we interviewed from two banks told us that customers may not be able to provide information and documentation or may not disclose that they are an MSB when opening new accounts. Officials of a bank that maintained accounts with money transmitters told us they terminated accounts in instances where a money transmitter did not submit required documentation. Another commonly cited reason for terminating accounts was reputational risk—the potential that negative publicity regarding an institution’s business practices, whether true or not, will cause a decline in the customer base, costly litigation, or revenue reductions. One bank’s officials said in an interview that when examiners inquired as to whether bank officials factor reputational risk into their decision-making about money transmitters, they viewed such inquiries as implicit suggestions that the bank had an issue with reputational risk that needed to be addressed. Examiners in our discussion groups also shared similar comments on suspicious activity monitoring and banks’ requests for information. Specific to suspicious activities, one examiner noted that banks generally have an internal policy stating that if a specific number of SARs are filed on the customer, the bank will automatically terminate the account. Regarding banks’ information requests, examiners in some discussion groups said they observed that banks may terminate an MSB’s account if the MSB does not comply with the bank’s request for due-diligence- related documentation. Three of the most common reasons banks reported for limiting accounts with money transmitters were that (1) the cost of BSA/AML compliance made the customer type unprofitable, (2) the banks were unable to manage the BSA/AML risk associated with the customer type, and (3) the customer type fell outside of a bank’s risk tolerance (see table 5). One of the most commonly cited reasons for limiting the number of accounts with money transmitters was compliance costs associated with managing BSA/AML risk. Officials of about two-thirds of the banks we interviewed said their BSA/AML compliance costs had increased over time, with eight institutions specifically citing past or planned upgrades to their monitoring software systems as one source of increasing costs. Moreover, officials of one bank said their compliance costs had increased in recent years as a result of regulatory scrutiny, which they said had increased as MSBs came to comprise a larger portion of their customer base. In response to this heightened scrutiny, officials said the bank had installed a new transaction-monitoring platform, which incurred a one-time migration cost and would incur higher monthly fees, and was considering expanding its compliance department. Officials of three banks told us in interviews that 50 percent of their compliance costs stem from BSA/AML compliance. As we have reported previously, money transmitters are generally low-profit customers for banks, in that the revenue from their accounts may not be sufficient for some banks to offset the associated costs of BSA/AML compliance. For example, officials of one bank said the bank spent about $250,000 annually to maintain its BSA-related monitoring software and training, which they believed was a significant portion of the bank’s $25 million annual income. These officials told us that unlike the bank’s other customers, which use the bank’s other products and refer business, money transmitters are not the bank’s core customers and do not use other products or services, so the bank would rather focus its time and resources on its core customers. Similarly, officials of another bank said they decided not to bank MSBs because any revenue generated would not cover the additional resource and compliance costs. Banks’ inability to manage BSA/AML risks associated with money transmitter customers was another commonly cited reason for limiting the number of accounts. For example, officials of one bank we interviewed said they did not accept any MSB customers, including money transmitters, because they were not willing or able to take on the required risk and level of BSA/AML monitoring. Another commonly cited reason for limiting accounts was that a customer type fell outside of a bank’s risk tolerance. In interviews, banks expressed concerns about their MSB customers’ ability to maintain an adequate BSA/AML compliance program. One bank’s officials told us that owners of gas stations may offer check cashing or money transmission services to generate additional revenue, but they may not be aware that offering such services would subject their business to BSA/AML compliance requirements. Another bank’s officials also said that many business owners do not know that they have to register with FinCEN to operate as an MSB. Officials from a third bank said that some MSBs may not understand the BSA/AML regulations and, at their customers’ request, may inadvertently commit a violation such as structuring that may generate a SAR (for example, by breaking up a money transfer in excess of $10,000 into multiple transfers to avoid generating a Currency Transaction Report). Similarly, examiners in many discussion groups said that the staffing and resource costs required for adequate monitoring and due diligence on MSB customers, including money transmitters, are reasons why some banks may choose not to bank MSBs. Moreover, examiners in many discussion groups also said some banks offer MSBs accounts and then find out that they do not have the necessary BSA/AML expertise or that the business is not profitable for them. For example, one examiner said that when a larger bank in his area terminated all of its money transmitter accounts, a number of smaller banks looking for profit offered accounts to these money transmitters. However, the examiner added that the smaller banks did not understand the level of customer due diligence and monitoring that was required for these accounts and the associated costs, and they terminated the accounts. In contrast, examiners in some discussion groups said that some community banks have accepted money transmitter customers as a way to generate potentially substantial fee income. Some Account Terminations and Limitations Raise Derisking Concerns According to survey responses from banks, the most commonly cited reason for limiting the number of money transmitter accounts was that the customer type drew heightened BSA/AML regulatory oversight—behavior that would indicate derisking. Banks also commonly cited this reason for terminating money transmitter accounts. For example, officials from one bank told us that the bank no longer offered services to MSBs because it wanted to be viewed favorably by regulators. Officials of another bank said that money transmitter account closures were generally the result of onerous regulatory requirements and increased regulatory scrutiny. Officials from two banks we spoke with said that they received greater regulatory scrutiny after increasing their number of MSB customers, which affected their willingness to open additional accounts with MSBs. According to officials of one of the two banks, when the bank increased its MSB customers from one to two, the institution was assessed as high risk by examiners. Related to heightened regulatory oversight, some banks’ officials we interviewed also expressed concerns that some examiners’ expectations go beyond what is described in the examination manual. For example, they said examiners expected banks to know their customers’ customers—although BSA/AML regulations do not require banks to obtain information on their customers’ customers. Bank officials said ascertaining such information was difficult because money transmitters’ customers are one step removed from the bank. Some banks’ officials also told us that they felt obligated to follow examiners’ verbal suggestions, even when the suggestions did not appear in the final examination report as recommendations. Other banks’ officials we interviewed stated that although examiners did not explicitly recommend that banks exit certain lines of business, officials felt pressure from the examiners to do so. For example, officials from one bank said examiners suggested that if the bank exited certain lines of business, the bank would not have deficiencies in its BSA/AML compliance program. We reported similar concerns in our March 2018 report. About half of the banks we interviewed for that report said that the fear of regulatory scrutiny served as a disincentive for banks to maintain accounts with money transmitters. Some banks’ officials expressed uncertainty about the amount of due diligence required for regulatory purposes because regulations included ambiguous language or because examiner practices exceeded regulations. These bank officials suggested that regulators could provide more specific guidance for banks on risk management, such as by including example scenarios and answers to frequently asked questions. Conversely, some banks we interviewed had a different experience. For example, officials of one bank told us that examiners’ interpretation of BSA/AML principles did not differ from the bank’s understanding of those principles. Officials added that when they initially began preparing risk assessments, they sought feedback and advice from their examiners and that examiners now use the bank’s risk assessment as an example for other banks. Moreover, these officials said that if they need clarification on BSA/AML compliance requirements, they contact FinCEN, which has been responsive to their questions. Officials of another bank told us they have a good relationship with their federal regulator and said that examiners follow BSA guidance and have been consistent in conducting their examinations. Officials of two other banks told us that their BSA/AML examinations have been consistent with guidance and requirements and that examiners have not told officials what types of customers to avoid. We also reported in February 2018 that recent BSA/AML law enforcement and regulatory enforcement actions have caused some banks to become more conservative in the types of businesses to which they offer accounts. In our interviews for the February 2018 report, officials of three banks and an industry group expressed concerns about potential enforcement actions, including civil penalties, if banks’ employees make mistakes in BSA/AML monitoring. In 2012, federal regulators assessed civil money penalties—including a $500 million penalty assessed by OCC and a $165 million penalty by the Federal Reserve—against HSBC Bank for, among other things, failing to maintain an effective BSA/AML compliance program and failing to conduct appropriate due diligence on foreign correspondent bank account holders. As another example, in March 2018, OCC issued consent orders for civil penalties against three senior executives of the Merchants Bank of California for violations of consent orders related to monitoring BSA/AML compliance. In our interviews, officials of an industry association told us that fines associated with BSA violations are especially difficult for community banks to absorb and could result in the bank going out of business. Similarly, examiners from a discussion group said some banks may decide not to offer accounts to MSBs to avoid heightened regulatory scrutiny. For example, examiners said some banks likely want to avoid BSA/AML risk entirely when they decide not to offer MSBs accounts. One examiner thought that some banks lack understanding regarding the business models of MSBs and that it is easier for them not to provide them accounts. In some cases, banks offer MSBs bank accounts but on a limited basis. For example, examiners from one discussion group said that in some cases, banks manage their BSA/AML risks by maintaining existing MSB accounts but not offering accounts to new MSB customers. In a 2015 speech, a senior Treasury official noted banks’ concerns about the cost of complying with BSA/AML requirements, uncertainty about supervisors’ expectations regarding appropriate due diligence, and the nature of the enforcement and supervisory response if they make a mistake. Moreover, the official stated that the banks held the perception that supervisory and enforcement expectations lack transparency, predictability, and consistency. The official also said that this perception feeds into higher anticipated compliance costs and may eclipse any potential economic gains of taking on new MSB customers. To address these concerns, the senior official stated that policymakers needed to continue to improve their understanding of the scope, nature, and drivers of the problem through better data collection and continue to explore ways to improve the effectiveness of their communication. Effects of Account Terminations and Limitations on Money Transmitters Include Ceasing of Operations and Higher Costs for Services According to money transmitters we spoke with, effects of account terminations due to derisking include ceasing of operations, loss of revenue, higher costs for services provided, and failure of the business. For example, officials from one large money transmitter that operates in the United States and internationally said that in recent years, about 100 of the money transmitter’s agents have lost accounts with their local and regional banks each month. The officials added that when banks terminate accounts with the money transmitter or its agents, the money transmitter cannot conduct the necessary transactions with its agents to facilitate the cash transfer. As a result, officials told us, account terminations can cause the money transmitter to cease operations in a particular country or cause the agents to go out of business. These officials also told us that some banks have terminated accounts with their institution while maintaining accounts with other money transmitters. These officials said they obtained legal injunctions for unfair competitor treatment in some of these cases. Officials of a smaller, regional money transmitter said that they have experienced 10 account terminations since 2006. Moreover, the officials said that they have to switch banks every 2 to 3 years because of account terminations and that it is getting more difficult to find a bank willing to take on money transmitters as customers. For example, the officials said that they called about 300 banks in a state and only two banks were willing to open accounts with them. The money transmitter’s officials said it has had to cease operations in three states due to account terminations. The officials said that the money transmitter now focuses on opening accounts with community banks and credit unions, but these institutions may be too small to handle the money transmitter’s volume of deposits. Another money transmitter told us that it takes about 3 months to open an account with a bank. Moreover, as a result of account terminations and limitations by banks, the money transmitter has had to reduce its number of employees from 220 to 180 and has not been able to open new locations. Another money transmitter said that account terminations have affected its ability to obtain accounts with other banks. In our March 2018 report, we found that some money transmitters—those that may be considered higher risk based on the 2005 interagency guidance—may utilize nonbank channels for transferring money as a response to account terminations. Specifically, we reported that as a result of banks’ account terminations and limitations, some money transmitters serving fragile nations have relied on nonbank channels, such as cash couriers and armored trucks, to transfer money domestically and abroad. We further reported that using cash couriers or armored trucks to move money increases costs and risks of theft and safety. Account terminations and limitations by banks also affect money transmitters that do not serve customers abroad—money transmitters that could be considered lower risk based on the 2005 interagency BSA guidance. For example, a company that acquired another business offering money transmission services to customers within the United States also experienced account terminations. When the company acquired the new business and thus the business’s money transmission license, its bank refused to service the company because of its newly acquired status as a money transmitter. In another example, officials of a money transmitter that serves only U.S. customers told us they have difficulty opening accounts and have experienced account terminations often. Officials said that their business has stopped at times because they did not have any bank accounts to facilitate money transmission. Additionally, account closures also may affect money transmitters’ customers. For example, some money transmitters we interviewed said they passed on increased costs resulting from account closures to their customers. Specifically, officials of one large money transmitter said that because of derisking, banks that still do business with them are charging higher fees. The officials added that they try to absorb the higher fees but have passed on the increased costs to their customers in some markets. In contrast, some money transmitters told us in interviews that although their costs have increased, they have not increased customer fees. Several money transmitters told us that banks did not always provide reasons for terminating their accounts. Some said they believe that banks terminate accounts due to regulatory pressure, compliance costs, or changes in a bank’s policy or risk appetite. One money transmitter stated that the problem of account terminations due to derisking stems from banks being too afraid to bank MSBs, including money transmitters. In response to banks’ account terminations and limitations, some money transmitters—including those with characteristics considered to be higher and lower risk according to the 2005 interagency guidance—now maintain accounts with multiple banks to help ensure they can continue operating should a bank close their account. For example, officials of the company that acquired another business offering domestic money transmission services told us they maintain accounts with more than one bank, but they said it is difficult and costly to do so. Officials of another money transmitter said that to help prevent disruptions to their ability to transfer funds when they experience an account closure, they try to have back-up accounts at other banks. Some money transmitters also engage with their banks’ management to better understand what banks expect from them in meeting compliance requirements. For example, an official from one money transmitter said the money transmitter tries to meet with its banks’ financial crimes teams to better understand how it can help minimize the risk of facilitating money transfers for terrorist-financing and money-laundering purposes. Officials of another money transmitter told us that as a result of meeting with bank management, the money transmitter added additional employees to its compliance department and bought new monitoring software to fulfill its bank’s requirement for monthly monitoring of transactions. FinCEN and the Federal Regulators Have Taken Some Steps to Address Derisking Concerns but Have Not Fully Addressed Our Prior Recommendation FinCEN and the Federal Regulators Have Issued Guidance to Banks Related to the Derisking of Money Transmitters FinCEN and the federal banking regulators have responded to concerns about the derisking of money transmitters and other MSBs on a national level by issuing guidance to banks to clarify expectations for providing banking services to these customer types. In March 2005, the federal banking regulators and FinCEN issued a joint statement noting that MSBs were losing access to banking services as a result of concerns about regulatory scrutiny, the risks presented by MSB accounts, and the costs and burdens associated with maintaining such accounts. According to the joint statement, these concerns might have stemmed, in part, from banks’ misperception of the requirements of the BSA and the erroneous view that MSBs present a uniform and unacceptably high risk of money laundering or other illicit activity. The joint statement recognized that the MSB industry provides valuable financial services, especially to individuals who may not have ready access to the formal banking sector. It further noted that it is important that MSBs comply with the requirements of the BSA and applicable state laws and remain within the formal financial sector and be subject to appropriate AML controls. The joint statement announced the intent of the regulators and FinCEN to issue the interagency guidance for banks on providing services to MSBs, which, as previously discussed, was intended to clarify BSA requirements and supervisory expectations as applied to accounts opened or maintained for MSBs. More recently, in November 2014, FinCEN issued a statement reiterating that banks can serve the MSB industry while meeting their BSA obligations and referring to the interagency guidance to banks on providing services to MSBs. The statement noted concerns that banks were indiscriminately terminating the accounts of all MSBs, or refusing to open accounts for any MSBs, thereby eliminating them as a category of customers. It noted, similar to the March 2005 joint statement, that regulatory scrutiny, the perceived risks presented by MSB accounts, and the costs and burdens associated with maintaining such accounts appeared to play a part in these decisions. In the 2014 statement, FinCEN cautioned that a wholesale approach to MSB customers runs counter to the expectation that financial institutions can and should assess the risks of customers on a case-by-case basis. Similarly, it noted that a blanket direction by U.S. banks to their foreign correspondents not to process fund transfers of any foreign MSBs, simply because they are MSBs, runs counter to the risk-based approach. FinCEN stated that refusing financial services to an entire segment of the industry can lead to an overall reduction in financial sector transparency, and that such transparency is critical to making the sector resistant to the efforts of illicit actors. Federal banking regulators also issued separate statements addressing BSA/AML risk posed by MSBs and foreign banks. See table 6 for a summary of key statements and guidance related to MSBs issued in recent years by FinCEN and the federal banking regulators. Regulators Have Taken Some Steps to Address Concerns That May Be Influencing Banks to Derisk but Have Not Reviewed the Full Range of Factors In 2018, we reported that regulators had taken only limited steps to understand how banks’ regulatory concerns and BSA/AML compliance efforts may be influencing banks to derisk. We reported that regulators had taken some actions in response to derisking, including issuing the guidance previously discussed, and that some agencies took steps aimed at trying to determine why banks may be terminating accounts. We also reported that regulators had conducted retrospective reviews on some BSA/AML requirements. We noted that actions regulators had taken to address concerns raised in BSA/AML retrospective reviews had focused primarily on the burden resulting from the filing of Currency Transaction Reports and SARs. However, we noted that these actions had not been aimed at addressing—and, if possible, ameliorating—the full range of factors that influence banks to engage in derisking, particularly how banks’ regulatory concerns and BSA/AML compliance efforts may be influencing their willingness to provide services. We concluded that without a broader assessment of the full range of BSA/AML factors that may be influencing banks to derisk, FinCEN, the federal banking regulators, and Congress do not have the information needed to determine if BSA/AML regulations and their implementation are achieving their regulatory objectives in the most effective and least burdensome way. Therefore, we recommended that FinCEN and the federal banking regulators conduct a retrospective review of BSA regulations and their implementation for banks, with a focus on how banks’ regulatory concerns may be influencing their willingness to provide services. According to the federal banking regulators and FinCEN, they and Treasury established an interagency working group in early 2018 that they believe will address our recommendation. The interagency working group is intended to identify ways to improve the efficiency and effectiveness of BSA/AML regulations, supervision, and examinations while continuing to meet the requirements of the BSA and its implementing regulations, supporting law enforcement, and reducing BSA/AML compliance burden. Staff from FinCEN and the federal banking regulators identified several interagency statements that the working group has completed. Interagency Statement on Sharing BSA Resources (issued on October 3, 2018): This statement clarified how banks may reduce the costs of meeting BSA requirements effectively by sharing employees or other resources in a collaborative arrangement with one or more banks. The statement highlighted potential benefits to sharing resources and provided examples of resources that may be appropriate to share, such as certain internal controls, independent testing, and BSA/AML training functions. The statement also highlighted potential risks of sharing resources and cautioned that any collaborative arrangements should be designed and implemented according to each bank’s risk profile. Joint Statement on Innovative Efforts to Combat Money Laundering and Terrorist Financing (issued on December 3, 2018): This statement clarified the working group’s position with respect to innovative approaches in BSA/AML compliance and encouraged banks to consider such approaches. For example, some banks are experimenting with artificial intelligence and digital identity technologies applicable to their BSA/AML compliance programs. The statement notes that these innovations and technologies can strengthen BSA/AML compliance approaches and that the regulators welcome these types of innovative approaches to further efforts to protect the financial system against illicit financial activity. According to the statement, pilot programs undertaken by banks to test and validate the effectiveness of innovative approaches should not subject banks to supervisory criticism even if the pilot programs ultimately prove unsuccessful. Joint Statement on Risk-Focused Bank Secrecy Act/Anti-Money Laundering Supervision (issued on July 22, 2019): This statement was intended to improve the transparency of the risk-focused approach used for planning and performing BSA/AML examinations. In this statement, FinCEN and the banking regulators emphasized that they scope their examinations in response to the unique risk profile for each bank because banks vary in focus and complexity. The regulators also clarified common practices for assessing a bank’s risk profile, including leveraging available information such as the bank’s own risk assessment, contacting the banks between examinations, and considering the bank’s ability to identify, measure, monitor, and control risks. Federal banking regulators and FinCEN staff said the working group’s focus on regulatory reform and on reducing the burden associated with BSA/AML compliance may indirectly address derisking concerns, including those related to money transmitters. In particular, they said these efforts may help agencies as they clarify their supervisory expectations for banks with respect to managing BSA/AML risk. For example, the staff said that the joint statement on the risk-focused approach to supervision clarifies that the role of the examiner is not to determine what level of risk a bank should assume. Instead, the examiners should review risk management practices to evaluate whether a bank has effective processes to identify, measure, monitor, and control risks and to assess the effectiveness of a bank’s processes. They said that reminding examiners and institutions of the risk-focused approach will help dispel the perception that banks will be criticized for taking certain higher-risk customers when the bank is properly managing that risk. Similarly, they said that the joint statement on innovation could help address derisking concerns because it allows banks to leverage new technologies and innovative approaches to help reduce costs of implementing the strong risk management practices that may be necessary to provide banking services to some higher-risk customers. The actions taken to date by the interagency working group are important steps toward improving the efficiency and effectiveness of BSA/AML regulations and supervision. As previously discussed, one reason some banks reported terminating or limiting money transmitter accounts was because of the cost associated with BSA/AML compliance. The interagency statements on sharing BSA resources and innovative efforts to combat money laundering and terrorist financing could help reduce banks’ implementation costs associated with providing banking services to potentially higher-risk customers. However, consistent with our prior work, our evidence demonstrates that banks terminate or limit customer accounts not only as a way to address legitimate money-laundering and terrorist-financing threats, but also as a way to manage regulatory concerns, which may indicate derisking. Reminding examiners and banks of the risk-focused examination approach may help to dispel the perception that banks will be criticized for taking certain higher-risk customers when the bank is properly managing that risk and may indirectly address some factors that influence banks to derisk. Nevertheless, the working group has not yet considered whether there are other supervisory concerns that factor into banks’ decisions to derisk. As we stated in our prior work, it is important to evaluate and address the full range of factors that may be influencing banks to derisk. Therefore, we maintain that FinCEN and the banking regulators should continue to work toward implementing our prior recommendation to conduct a retrospective review of BSA/AML regulations focusing on how banks’ regulatory concerns may be influencing their willingness to provide services. Conclusions Regulators and FinCEN issued the 2005 interagency guidance to clarify BSA/AML requirements and supervisory expectations with regard to accounts banks open or maintain for money transmitters and other MSBs. However, some examiners in our discussion groups said they were unclear about how much due diligence is reasonable to expect banks to conduct for their money transmitters. Improving examiners’ ability to evaluate banks’ BSA/AML compliance controls with respect to money transmitter accounts would help ensure that such evaluations are done in accordance with BSA/AML examination objectives of identifying and assessing risks and banks’ ability to manage risks, as set out in the examination manual. Options for making such improvements could include providing examiners with more detailed examination procedures, enhanced information, additional training, or a combination of methods. Recommendations We are making a total of four recommendations to the Federal Reserve, OCC, FDIC, and NCUA: The Board of Governors of the Federal Reserve System should, in coordination with the other federal banking regulators, and with input from BSA/AML examiners and other relevant stakeholders, take steps to improve examiners’ ability to evaluate the effectiveness of banks’ BSA/AML compliance controls with respect to money transmitter accounts. Steps may include providing updates to examination procedures, examiner training, or a combination of methods. (Recommendation 1) The Comptroller of the Currency should, in coordination with the other federal banking regulators, and with input from BSA/AML examiners and other relevant stakeholders, take steps to improve examiners’ ability to evaluate the effectiveness of banks’ BSA/AML compliance controls with respect to money transmitter accounts. Steps may include providing updates to examination procedures, examiner training, or a combination of methods. (Recommendation 2) The Chairman of the Federal Deposit Insurance Corporation should, in coordination with the other federal banking regulators, and with input from BSA/AML examiners and other relevant stakeholders, take steps to improve examiners’ ability to evaluate the effectiveness of banks’ BSA/AML compliance controls with respect to money transmitter accounts. Steps may include providing updates to examination procedures, examiner training, or a combination of methods. (Recommendation 3) The Chairman of the National Credit Union Administration should, in coordination with the other federal banking regulators, and with input from BSA/AML examiners and other relevant stakeholders, take steps to improve examiners’ ability to evaluate the effectiveness of banks’ BSA/AML compliance controls with respect to money transmitter accounts. Steps may include providing updates to examination procedures, examiner training, or a combination of methods. (Recommendation 4) Agency Comments We provided a draft of this report to the Federal Reserve, FDIC, NCUA, OCC, and Treasury’s FinCEN for review and comment. The federal regulators provided technical comments on the draft report, which we have incorporated as appropriate. The Federal Reserve, FDIC, NCUA, and OCC also provided written comments (reproduced in appendixes III through VI). They agreed with GAO’s recommendations and expressed a commitment to implement them. We are sending copies of this report to the appropriate congressional committees, the Director of the Financial Crimes Enforcement Network, the Chairman of the Board of Governors of the Federal Reserve System, the Chairman of the Federal Deposit Insurance Corporation, the Comptroller of the Currency, and the Chairman of the National Credit Union Administration. The report will also be available at no charge on our website at http://www.gao.gov. If you or your staffs have any questions about this report, please contact me at (202) 512-8678 or clementsm@gao.gov. Contact points for our Offices of Congressional Relations and Public Affairs are listed on the last page of this report. GAO staff who made major contributions to this report are listed in appendix VII. Appendix I: Objectives, Scope, and Methodology This report (1) describes regulators’ Bank Secrecy Act (BSA)/anti-money laundering (AML) supervisory expectations for banks that provide services to money transmitters and other money services businesses (MSB) and examiner views on bank challenges in complying with these requirements; (2) examines challenges reported by examiners in conducting BSA/AML assessments; (3) examines the extent to which banks are terminating or limiting money transmitters’ access to banking services and the effects on money transmitters; and (4) evaluates how the Department of the Treasury’s Financial Crimes Enforcement Network (FinCEN) and the federal banking regulators have assessed and responded to concerns about the derisking of money transmitters. The federal banking regulators included in our review are the Board of Governors of the Federal Reserve System (Federal Reserve), the Federal Deposit Insurance Corporation (FDIC), the Office of the Comptroller of the Currency (OCC), and the National Credit Union Administration (NCUA). We define “derisking” as the practice of banks limiting certain services or ending their relationships with customers to, among other things, avoid perceived regulatory concerns about facilitating money laundering. We developed this definition in our prior work addressing account terminations and branch closures in the U.S. Southwest border region. To describe regulators’ BSA/AML supervisory expectations for banks that provide services to money transmitters and other MSBs and federal bank examiners’ views on banks’ challenges in complying with these requirements, we reviewed joint guidance issued by FinCEN and the federal banking regulators in April 2005 on banking MSBs and the Federal Financial Institutions Examination Council’s (FFIEC) BSA/AML examination manual, which federal banking regulators use to examine banks for BSA/AML compliance. We also interviewed the federal regulators named above. Further, we interviewed representatives of 16 banks, six credit unions, and relevant industry groups and trade associations. Because of our judgmental sampling, the views expressed by these groups may not be representative. To identify the universe of banks for interviews, we used data from FDIC’s Statistics on Depository Institutions database as of December 31, 2016. Next, we excluded banks that did not offer the product types relevant to our study, including credit card banks and banks that offer nontraditional accounts; multiple subsidiaries of large holding companies; and federal branches of foreign banks. We also excluded banks with insufficient information to determine the types of accounts offered. In addition, we excluded banks selected to participate in a web- based survey (we describe our survey methodology below). After these exclusions, our initial list consisted of 5,922 banks. Because the primary regulators (Federal Reserve, OCC, and FDIC) do not track which banks have money transmitter customers, we used a judgmental sample to randomly select banks to interview from each of the primary regulators based on asset size (small, medium, and large). For small and medium banks, we interviewed one bank of each size from each of the three regulators. For large banks, all were regulated by OCC, and we interviewed two of these banks. We defined banks’ asset-size categories as follows: (1) “small” consisted of banks with assets of less than $1 billion, (2) “medium” consisted of banks with assets of $1 billion to less than $10 billion, and (3) “large” consisted of banks with assets of $10 billion to less than $50 billion. Once we selected our sample, we contacted each bank to confirm that it had money transmitter or other types of MSB customers. If a bank did not have money transmitter or other MSB customers or declined to speak with us, we selected another bank in the same asset-size category. We initially selected nine banks to interview—three in each asset-size category—but one large bank declined to speak with us. Because there were no other large banks in our sample, we interviewed two large banks, for a total of eight small, medium, or large banks. We also jointly interviewed eight extra-large banks (with assets of $50 billion or more) in coordination with our other work on derisking. Because NCUA tracks which credit unions have money transmitter customers, we obtained data from NCUA on credit unions that served money transmitters as of April 2017 and stratified them according to small, medium, and large asset-size categories. We defined credit unions’ asset-size categories as follows: (1) “small” consisted of credit unions with assets of less than $100 million, (2) “medium” consisted of credit unions with assets of $100 million to $500 million, and (3) “large” consisted of credit unions with assets of more than $500 million. We chose three credit unions with the largest numbers of money transmitter customers and randomly selected one credit union from each asset-size category, for a total of six credit unions. From our initial selection, we emailed or called each of the six credit unions to ascertain if it had a money transmitter customer. If a credit union did not have a money transmitter customer or declined to speak with us, we selected another credit union in the same asset-size category. We then conducted two discussion groups per regulator with bank examiners from the Federal Reserve, OCC, FDIC, and NCUA to understand how they applied the FFIEC manual in assessing BSA/AML compliance controls of banks with money transmitter customers. To determine the composition of the discussion groups, we identified BSA/AML specialists or subject-matter experts from the district and regional offices of each federal banking regulator located in geographic areas with relatively large numbers of money transmitters. To do this, we first identified the states with the largest numbers of registered money transmitters by analyzing FinCEN money transmitter registration data from January 2015 through May 2017. We then requested rosters of staff designated as BSA/AML subject-matter experts and specialists from each regulator for each district or regional office in those states. We administered a questionnaire to the individuals on each roster asking about their experience with examining banks with money transmitter customers and other questions, such as years of experience in conducting bank examinations. We excluded from consideration BSA/AML subject-matter experts and specialists who either self-identified as supervisors or who had not examined a bank with a money transmitter customer in the past 3 years. We then randomized and selected BSA/AML subject-matter experts and specialists for participation in our discussion groups. Depending on scheduling and availability, the number of participants for each discussion group ranged from six to 14. Each session was digitally recorded and transcribed by an outside vendor, and we used the transcripts to summarize participants’ responses. An initial coder assigned a code that best summarized the statements from discussion group participants and provided an explanation of the types of statements that should be assigned to a particular code. A separate individual reviewed and verified the accuracy of the initial coding. The initial coder and reviewer discussed orally and in writing any disagreements about code assignments and documented consensus on the final analysis results. Discussion groups were intended to generate in-depth information about the reasons for the participants’ views on specific topics. The opinions expressed by the participants represent their points of view and may not represent the views of all BSA/AML subject-matter experts and specialists at the federal banking regulators. For purposes of this report, we used the following terms to describe the number of discussion groups in which an issue is mentioned: “some” to describe two to three groups out of the eight discussion groups, “many” to describe four to five discussion groups, and “most” to describe six to seven discussion groups. To examine challenges reported by federal bank examiners in assessing banks’ BSA/AML compliance controls around money transmitters, we asked examiners in our discussion groups to identify any challenges they encountered when assessing these compliance controls. We also reviewed examination guidance and procedures for assessing BSA/AML compliance controls around money transmitters. We assessed this information against federal internal control standards related to identifying risks and communicating information. We also reviewed bank examination and related documentation from the federal BSA/AML examinations of 56 selected banks and credit unions to gain additional context about BSA/AML examinations, including BSA/AML compliance violations—10 from FDIC, 12 from the Federal Reserve, 22 from OCC, and 12 from NCUA. For the documentation review, we selected a nongeneralizable sample of banks and credit unions based on asset-size categories and geographic location (based on each regulator’s field, district, or regional offices) from each federal banking regulator. For banks, we used the same asset-size categories described earlier for our interview selection process. We also included six banks that were issued final BSA/AML enforcement actions—two each from OCC, FDIC, and the Federal Reserve—for calendar years 2014 through 2016. For credit unions, we selected randomly from the same asset-size categories we used for selecting credit unions for interviews—along with geographic locations—and randomly selected four credit unions from each asset-size category, for a total of 12 credit unions. To obtain geographic representation, we ensured that each bank and credit union selected within each asset-size category also represented multiple geographic locations. For each of the 56 banks and credit unions, we requested and reviewed bank examination reports and related workpaper documentation for 2014, 2015, and 2016, including scoping and planning memorandums, bank- or examiner-prepared BSA/AML risk assessments, and conclusion memorandums or documents that summarized BSA examiner findings. For some banks, we also received banks’ BSA policies as part of the examination report and supplemental documentation package. To examine the extent to which banks are terminating or limiting money transmitters’ access to banking services and their reasons why, we administered a web-based survey to a nationally representative sample of banks in the United States for a total survey sample of 406 banks. We did not include credit unions in our sample. In the survey, we asked banks about terminations of money transmitter accounts and limitations on account offerings related to BSA/AML risk and the reasons for these decisions for the 3-year period from January 1, 2014, to December 31, 2016. We obtained a weighted survey response rate of 46.5 percent. While we designed the survey to be nationally representative of all banks in the United States, some results are statistically nongeneralizable because of the relatively low number of banks that reported having money transmitters as customers. For survey questions that are statistically nongeneralizable, we present only the number of responses to each survey question, and these results are not generalizable to the population of banks. Moreover, not all banks responded to every survey question or provided information for every year covered by our survey; therefore, we are not able to provide trend information from 2014 through 2016. We administered the survey from July 2017 to September 2017. To obtain information on the effects of bank account terminations on and limitations in the number of accounts with money transmitters, we interviewed a nongeneralizable sample of representatives from 11 money transmitters. To select the money transmitters, we obtained money transmitter licensure data from the Conference of State Banking Supervisors’ Nationwide Multistate Licensing System. Using the number of state licenses as a proxy for the size of the money transmitter, we developed five size categories and selected the top four money transmitters in the first stratum (40 or more licenses) along with one money transmitter in the second, third, and fourth strata (20–39, 10–19, and 2–9 licenses, respectively) and four money transmitters in the fifth stratum (one license). To evaluate how FinCEN and the federal banking regulators have assessed and responded to concerns about derisking of money transmitters, we reviewed agency documentation and guidance the agencies issued to banks related to derisking and MSBs, and we interviewed agency management. We also reviewed a prior GAO report that evaluated regulators’ response to derisking along the Southwest border and assessed actions regulators have taken to respond to a recommendation we made in that report. We utilized multiple data sources throughout our review. We assessed the reliability of FDIC’s Statistics on Depository Institutions database by reviewing related documentation and conducting electronic testing for missing data, outliers, or any obvious errors. Furthermore, we used NCUA data that track which credit unions bank money transmitters, the Nationwide Multistate Licensing System, and FinCEN’s MSB registration database to help select our nongeneralizable samples of credit unions and money transmitters to interview. We did not assess the data reliability of these sources because we used these data purely to inform our sampling population, and once we selected our samples, we took additional steps to confirm that the institutions we selected had MSB or money transmitter customers and were willing to speak to us. For FinCEN’s MSB registration database, as previously discussed, we used the data to help identify which states had the most money transmitters registered. In analyzing the data, we found a clear difference in the number of MSB registrations between the top five states (California, Texas, Michigan, Florida, and Illinois) with the most MSBs (ranging from close to 800 to almost 4,000 MSBs) and the remaining states (all with fewer than 500 MSBs). Because we used these data to help facilitate the identification of BSA/AML subject-matter experts and specialists who had experience examining banks with money transmitter customers, we did not need to confirm the exact number of MSBs registered. As a result, we did not assess the reliability of FinCEN’s registration database. We concluded that all applicable data were sufficiently reliable for the purposes of describing BSA/AML risks and compliance challenges and identifying banks to survey on account terminations and limitations. We conducted this performance audit from August 2016 to December 2019 in accordance with generally accepted government auditing standards. Those standards require that we plan and perform the audit to obtain sufficient, appropriate evidence to provide a reasonable basis for our findings and conclusions based on our audit objectives. We believe that the evidence obtained provides a reasonable basis for our findings and conclusions based on our audit objectives. Appendix II: Responses to Selected Questions from GAO’s Survey of Banks on Account Terminations and Limitations From July 2017 through September 2017, we administered a web-based survey to a nationally representative sample of banks. In the survey, we asked banks about account terminations and restrictions (also referred to as limitations) for reasons associated with managing Bank Secrecy Act/anti-money laundering (BSA/AML) risk; whether banks are terminating or limiting accounts with money transmitters; and the reasons for these decisions. We collected information for the 3-year period from January 1, 2014, to December 31, 2016. Responses to selected questions from our survey that are directly applicable to the research objectives in this report are shown in tables 7–19 below. While we designed the survey to be nationally representative of all banks in the United States, results specific to money transmitters are statistically nongeneralizable because of the relatively low number of banks that reported having money transmitters as customers. Because these survey questions are statistically nongeneralizable, we present only the number of responses to each survey question, and the results are not generalizable to the population of banks. Moreover, not all banks responded to every survey question or provided information for every year covered by our survey; therefore, we are not able to provide trend information from 2014 through 2016. Our survey included multiple-choice and open-ended questions. For a more detailed discussion of our survey methodology, see appendix I. Appendix VII: GAO Contact and Staff Acknowledgments GAO Contact Staff Acknowledgments In addition to the contact named above, Stefanie Jonkman (Assistant Director), Kun-Fang Lee (Analyst-in-Charge), Carl Barden, Lilia Chaidez, Giselle Cubillos-Moraga, Joshua Garties, Toni Gillich, Shamiah Kerney, Jill Lacey, Patricia Moye, Aku Shika Pappoe, Jennifer Schwartz, Jena Y. Sinkfield, Tyler Spunaugle, Verginie Tarpinian, and Deme Yoo made key contributions to this report.