Introduction
Five years ago, Congress enacted the Uniting And Strengthening America By Providing Tools Required To Intercept And Obstruct Terrorism Act of 2001 ("Patriot Act"). Title III of the Patriot Act amended the Bank Secrecy Act ("BSA") in a variety of ways. This article describes the regulatory and civil enforcement activities undertaken in the last five years pursuant to these statutory amendments by the Financial Crimes Enforcement Network ("FinCEN"), the agency within the Treasury Department authorized to administer the BSA as amended by the Patriot Act.
FinCEN's Regulatory Activity Under The Patriot Act
Section 311 of the Patriot Act authorizes the Treasury Department to require domestic financial institutions to take certain "special measures" if Treasury has reasonable grounds to believe that a jurisdiction, financial institution, or transaction outside the United States is a primary money laundering concern. 31 U.S.C. 5318A.
Such special measures include additional recordkeeping and reporting; information gathering on beneficial owners, correspondent accounts, or payable-through accounts; and prohibitions on opening certain correspondent accounts or payable through accounts (the "fifth special measure"). Id . Section 312 of the Patriot Act requires financial institutions to conduct enhanced due diligence of correspondent accounts and private banking accounts that is reasonably designed to detect and report money laundering. 31 U.S.C. 5318(i). Section 313 of the Patriot Act prohibits defined financial institutions from opening or maintaining correspondent accounts for foreign shell banks. 31 U.S.C. 5318(j).
To date, Treasury has issued 15 proposed regulations or findings either designating certain jurisdictions, institutions, or transactions as primary money laundering concerns and/or invoking special measures. Two of these have been revoked, and five have gone to final rulemaking. As a result, Treasury has issued final rules invoking the fifth special measure against Burma, Asia Wealth Bank, the Commercial Bank of Syria, including the Syrian Lebanese Commercial Bank, the Myanmar Mayflower Bank, and VEF Banka. 31 C.F.R. 103.186-103.188; FinCEN; Amendments to the BSA Regulations - Imposition of Special Measure Against VEF Banka, as a Financial Institution of Primary Money Laundering Concern , 71 Fed. Reg. 39554 (Jul. 13, 2006). Treasury also has issued regulations under sections 312 and 313 of the Patriot Act on enhanced due diligence for correspondent accounts and private banking accounts and the prohibition on establishing or maintaining correspondent accounts for foreign shell banks. 31 C.F.R. 103.175-103.178. These regulations contain important definitions, including an identification of the types of financial institutions covered by the regulation, and other applicable standards.
Section 352 of the Patriot Act states that defined financial institutions must implement anti-money laundering ("AML") programs. All AML policies must (i) implement internal policies, procedures, and controls; (ii) designate a compliance officer; (iii) provide for ongoing employee training programs; and (iv) provide for independent audits to test the programs. 31 U.S.C. 5318(h). FinCEN has promulgated AML regulations for many industries, including financial institutions regulated by a Federal functional regulator or a self-regulatory organization ( e.g. , the Board of Governors of the Federal Reserve System, the Office of the Comptroller of the Currency, the FDIC, the Office of Thrift Supervision, the National Credit Union Association, the Securities and Exchange Commission, and the Commodity Futures Trading Commission), casinos, money services businesses; mutual funds; operators of credit card systems; insurance companies; and dealers in precious metals, precious stones, or jewels. See 31 C.F.R. 103.120-103.140. Certain other defined financial institutions are subject to a temporary exemption from the AML program requirement of the Patriot Act until such time as final regulations are issued by FinCEN . 31 C.F.R. 170. These institutions include pawnbrokers; loan and finance companies; travel agencies; telegraph companies; sellers of vehicles, including automobiles, airplanes, and boats; persons involved in real estate closings and settlements; private bankers; commodity pool operators; commodity trading advisors; investment companies; and banks that are not subject to Federal functional regulators. Id .
Section 326 of the Patriot Act authorizes Treasury to issue regulations requiring financial institutions to implement a customer identification program ("CIP"). CIPs require financial institutions to (i) verify customer identities, (ii) maintain records, and (iii) screen customers against lists of known or suspected terrorists. 31 U.S.C. 5318(l). Unlike section 352 of the Patriot Act, which affirmatively requires financial institutions to establish AML programs, section 326 only directs Treasury to promulgate regulations "setting forth the minimum standards for financial institutions and their customers regarding the identity of the customer that shall apply in connection with opening an account at a financial institution." Id . FinCEN has issued regulations requiring certain financial institutions to implement customer identification programs, including banks, savings associations, credit unions, and certain non-Federally regulated banks; broker-dealers, futures commission merchants and introducing brokers; and mutual funds. 31 C.F.R. 103.121-123 and 103.131.
Section 5318(g) of Title 31, United States Code, as amended by section 351 of the Patriot Act, provides that "[t]he Secretary [of Treasury] may require any financial institution . . . to report any suspicious transaction relevant to a possible violation of law or regulation." Although the requirements vary from regulation to regulation, suspicious activity reports ("SARs") generally must be filed for transactions that involve more than $5000 or other assets and the financial institution knows, suspects, or has reason to suspect that (i) the transaction "involves funds derived from illegal activities or is intended or conducted in order to hide or disguise funds or assets derived from illegal activities . . . as part of a plan to violate or evade any federal law or regulation or to avoid any transaction reporting requirement under federal law or regulation;" (ii) the transaction is designed to evade any requirements of the BSA or the regulations; or (iii) the transaction "has no business or apparent lawful purpose or is not the sort in which the particular customer would normally be expected to engage, and the [financial institution] knows of no reasonable explanation for the transaction after examining the available facts . . . ." 31 C.F.R. 103.18(a)(2). Section 351(a) of the Patriot Act, 31 U.S.C. 5318(g)(3), provides a "safe harbor" from liability for financial institutions that make such SARs. Section 351(b) of the Patriot Act, 31 U.S.C. 5318(g)(2), prohibits financial institutions from disclosing their SARs to the suspicious party involved in the transaction. Similar to section 326 of the Patriot Act, the basic statutory SAR requirement imposes no affirmative obligation on particular financial institutions to make SARs. Rather, it authorizes the Secretary of Treasury to impose such requirements by regulation. To date, FinCEN has issued regulations obligating the following financial institutions to make SARs: mutual funds, insurance companies, futures commission merchants and introducing brokers in commodities, banks, broker dealers in securities, money services businesses, and casinos. 31 C.F.R. 103.15-.21.
Section 5313 of Title 31, United States Code, requires defined financial institutions to report to FinCEN currency transactions in excess of $10,000. 19 U.S.C. 5313(a); 31 C.F.R. 103.22 Section 365 of the Patriot Act amended the BSA to impose a similar currency transaction reporting requirement on "any person who is engaged in a trade or business; and who, in the course of such trade or business, receives more than $10,000 in coins or currency in 1 transaction (or 2 or more related transactions) . . . ." 31 U.S.C. 5331. FinCEN implemented regulations prescribing the manner in which currency transaction reports are to be made. 31 C.F.R. 103.30.
Section 363 of the Patriot Act imposed new civil and criminal penalties for violations of sections 312 or 313 of the Patriot Act, (31 U.S.C. 5318(i), (j)) or any special measure imposed under section 311. As described above, section 312 imposes enhanced due diligence obligations on financial institutions with respect to correspondent accounts and private banking accounts, and section 313 prohibits the establishment or maintenance of correspondent accounts for foreign shell banks. These changes are reflected in FinCEN's regulations. 31 C.F.R. 103.57, 103.59.
FinCEN's Civil Enforcement Activity Under The Patriot Act
Since the enactment of Title III of the Patriot Act, FinCEN has published 20 civil penalty assessments against defined financial institutions under the civil penalty provision, 31 U.S.C. 5321. These assessments were issued at the rate of two in 2002, five in 2003, two in 2004, five in 2005, and six in 2006. The amounts of the civil penalty assessments ranged from $30,000,000, which was assessed against a Netherlands bank, to a $10,000 penalty assessed against Frosty Food Mart, a money services business. Four of these assessments involved penalties of $20 million or more, all of which were against banks; two involved penalties of between $10 million and $20 million, both of which were against banks; five involved penalties of between $1 million and $5 million, which were against a mix of banks, broker dealers, money services business, and casinos; and the remainder involved penalties of less than $1 million. Many of the cases also involved "undertakings," which are agreements by the financial institutions found to have violated the law to take affirmative steps to come into compliance.
In all but one case, the violations were considered by FinCEN to be willful. FinCEN either made this finding explicitly, or the finding is reflected in the amount of penalties. According to FinCEN, a willful violation means that the financial institution acted with a reckless disregard for its obligations under law or regulation. In The Matter Of Gulf Corporation; Assessment Of Civil Penalty , FinCEN No. 2005-1, citing Appalachian Resources Dev. Corp. v. Bureau of Alcohol, Tobacco, & Firearms , 387 F.3d 461 (2004). In the one case that did not involve an explicitly willful violation, the financial institution failed to take reasonable measures to prevent foreign shell banks from using the institution's correspondent accounts or ensure that its correspondent accounts were not being used by the foreign bank to provide banking services indirectly to a foreign shell bank. These violations are subject to penalties without a finding of "willfulness." 31 U.S.C. 5318(i), (j), 5318A, 5321(a)(7).
The types of financial institutions assessed with civil penalties were banks, both domestic and the U.S. branches of foreign banks; securities broker-dealers; money services businesses; and casinos. The most frequent violations were the failure to file suspicious activity reports and currency transaction reports, the failure to implement anti-money laundering programs and customer identification programs, the failure to keep records. The suspicious activities that the penalized financial institutions failed to detect included large cash deposits, including those made through the night deposit box or carried into the bank in paper bags; immediate withdrawals of the cash deposits by wire transfer; transactions structured to avoid recordkeeping or currency transaction reporting requirements; large deposits of sequentially numbered money orders and travelers checks; inconsistencies between the nature of the customer's deposits and the customer's business; substantial account activity by foreign government officials and politically exposed persons; indications of illegal activity on the part of the institution's customers; account activity by persons designated by the Office of Foreign Assets Control as blocked persons under one or more sanctions regime; and transactions involving "shell" companies. The violations frequently were detected through the routine examination of these financial institutions by their Federal functional regulators, such as the Federal Reserve or the Office of the Comptroller of the Currency.
Conclusion
Since the enactment of the Patriot Act five years ago, FinCEN has promulgated regulations with respect to financial institutions it believes pose the most significant risk for money laundering and terrorist financing. These institutions are now in an enforcement climate and would do well to learn from FinCEN's civil penalty assessments to ensure that their compliance programs prevent violations of the law. Other defined financial institutions are currently exempt from FinCEN regulation or are unregulated altogether. Enforcement against these institutions is not now a serious concern. Nevertheless, these institutions should expect FinCEN to repeat its "regulate-then-enforce" approach to its administration of the law and would be well advised to monitor FinCEN's regulatory activities, comment on FinCEN's notices of proposed rulemaking and advanced notices of proposed rulemakings, and be prepared to implement the appropriate compliance programs once the final rules become effective.
Published October 1, 2006.
