Summary

The legislative framework for combating money laundering began with the Bank Secrecy Act (BSA) in 1970 and most recently expanded in 2001with the USA PATRIOT Act. The Financial Crimes Enforcement Network (FinCEN) administers BSA and relies on multiple federal and state agencies to ensure financial institution compliance. GAO was asked to (1) describe how BSA compliance and enforcement responsibilities are distributed, (2) describe how agencies other than FinCEN are implementing those responsibilities and evaluate their coordination efforts, and (3) evaluate how FinCEN is implementing its BSA responsibilities. Among other things, GAO reviewed legislation, past GAO and Treasury reports, and agreements and guidance from all relevant agencies; and interviewed agency, association, and financial institution officials.

FinCEN is responsible for the administration of the BSA regulatory structure, and has delegated examination responsibility to the federal banking regulators (Board of Governors of the Federal Reserve System, Federal Deposit Insurance Corporation, Office of the Comptroller of the Currency, Office of Thrift Supervision, and National Credit Union Administration), the Securities and Exchange Commission (SEC), the Commodity Futures Trading Commission (CFTC), and the Internal Revenue Service (IRS). The federal banking regulators, SEC, CFTC, securities and futures self-regulatory organizations (SRO), and state agencies also have their own separate authorities to examine for compliance among institutions they supervise and take enforcement actions for noncompliance. FinCEN has retained enforcement authority for BSA and may take enforcement actions independently or concurrently with the regulators. While federal agencies have enhanced their BSA compliance programs, opportunities exist to improve interagency and state examination coordination. The federal banking regulators issued an interagency examination manual; SEC, CFTC, and their respective SROs developed BSA examination modules; and FinCEN and IRS, which examines nonbank financial institutions (NBFI), issued an examination manual for money services businesses (MSB). However, IRS has not fully coordinated MSB examination schedules with the states that also examine MSBs, potentially missing opportunities to reduce duplication and leverage resources. The federal financial regulators traditionally have different compliance approaches for their industries. With respect to BSA, multiple regulators are examining for compliance with the same legislation across industries and, for some larger holding companies, within the same institution. However, they do not have a mechanism through which all regulators discuss (without industry present) how to promote greater consistency, reduce unnecessary regulatory burden, and identify concerns across industries. Federal banking regulators reported improved transparency and coordination of enforcement actions. While FinCEN has increased regulatory resources, provided examination support, and made advances in outreach, it could improve its informationsharing efforts. FinCEN improved its system for tracking referrals but lack of a process for communication between IRS and FinCEN for IRS referrals, coupled with IRS's limited enforcement authority, may delay timely feedback to IRS-examined institutions. FinCEN completed more information-sharing memorandums of understanding (MOU) with federal and state agencies, but did not sign its MOU with CFTC until January 2009, which limited their information-sharing efforts. Some state regulators and securities and futures regulators continue to have no electronic access to BSA data. Lack of direct access to BSA data impedes their ability to identify potential risk areas on which to focus their examinations and effectively leverage resources. FinCEN officials said they finalized a data-access template in July 2008, and had begun providing more electronic access.

Recommendations

Our recommendations from this work are listed below with a Contact for more information. Status will change from "In process" to "Open," "Closed - implemented," or "Closed - not implemented" based on our follow up work.

Recommendations for Executive Action