On June 20, Fannie Mae issued Servicing Guide Announcement SVC-2014-11, which reminds servicers that under a recent FinCEN rule, Fannie Mae is considered a financial institution subject to BSA requirements. The announcement advises servicers subject to the AML provisions of the BSA that they are obligated to be in compliance with the BSA, and to report to Fannie Mae: (i) all instances of noncompliance, compliance failures, or sanctions related to BSA/AML requirements; (ii) suspicious activity related to Fannie Mae loans or business activities; and (iii) changes in ownership interest. Servicers may implement these requirements immediately, but are required to do so no later than August 25, 2014.
On July 1,Fannie Mae issued Selling Guide Announcement SEL-2014-09 to remind lenders and originators—as it recently did for servicers—of their obligations to be in compliance with applicable provisions of the Bank Secrecy Act and its implementing regulations and to have internal policies, procedures, and controls in place to identify suspicious activities.
On June 25, the OCC published its semiannual risk report, which provides an overview of the agency’s supervisory concerns for national banks and federal savings associations, including operational and compliance risks. As in prior reports and as Comptroller Curry has done in speeches over the past year, the report highlights cyber-threats and BSA/AML risks. The OCC believes cyber-threats continue to evolve and require heightened awareness and appropriate resources to identify and mitigate the associated risks. Specifically, the OCC is concerned that cyber-criminals will transition from disruptive attacks to attacks that are intended to cause destruction and corruption. Extending another recent OCC theme, the report notes that the number, nature, and complexity of both foreign and domestic third-party relationships continue to expand, resulting in increased system and process interconnectedness and additional vulnerability to cyber-threats. The report also states that BSA/AML risks “remain prevalent given changing methods of money laundering and growth in the volume and sophistication of electronic banking fraud.” The OCC adds that “BSA programs at some banks have failed to evolve or incorporate appropriate controls into new products and services,” and again cautions that a lack of resources and expertise devoted to BSA/AML risk management can compound these concerns. Finally, the OCC expressed concern that competitive pressures in the indirect auto market are leading to an erosion of underwriting standards. The OCC’s supervisory staff plans to review retail credit underwriting practices at banks, especially for indirect auto.
On June 5, the FDIC and a Delaware bank entered a consent order that prohibits the bank from entering into any new relationships with third-party prepaid card processors or prepaid card program managers until the FDIC approves a written report from the bank that details the steps taken by the bank to (i) implement new BSA compliance policies and procedures; (ii) improve staff training; (iii) implement controls sufficient to mitigate BSA and safety and soundness risk associated with prepaid card, credit card merchant acquiring, and ACH activities; and (iv) perform a BSA risk assessment. The order similarly restricts the bank’s activities related to credit card merchant acquiring and ACH merchant payment processing. The order does not prohibit the bank from issuing prepaid cards through existing distribution channels under existing contracts with third-parties, but does restrict certain activities related to existing credit card and ACH processing activities. In addition, the bank must (i) retain and designate BSA and OFAC officers; (ii) conduct a suspicious activity reporting look-back review; and (iii) submit periodic progress reports. Finally, the order requires increased board supervision of the bank’s BSA compliance program and mandates the creation of a board-level BSA committee.
On April 29, FinCEN issued five rulings in response to companies who sought clarification regarding whether their company is a money service business under the BSA. In FIN-2014-R006, FinCEN determined that a company that operates an online real-time deposit, settlement, and payment services platform for banks, businesses, and consumers is considered a money transmitter, not a provider of prepaid access, and should be registered as a money services business under BSA regulations. In two other rulings—FIN-2014-R004 and FIN-2014-R005— FinCEN clarified the exemption from the money transmitter definition for persons that accept and transmit funds “only integral to the sale of goods or the provision of services, other than money transmission services.” FinCEN determined that the escrow services at issue in FIN-2014-R004 and the transaction management services at issue in FIN-2014-R005 fit within that exemption because the acceptance and transmission of funds in these cases is not a separate and discrete service in addition to the underlying service, but instead is a necessary and integral part of the service itself. Therefore, these companies are not considered to be money transmitters subject to registration. FinCEN determined in FIN-2014-R007 that a company that rents computer systems used to mine virtual currencies is not a money transmitter. Finally, in FIN-2014-R008, FinCEN determined that although the company, which uses armored cars to facilitate the exchange of coins and cash, does not qualify for the “armored car” exemption in the money transmitter definition, it is still not considered a money transmitter. FinCEN stated that the transportation of currency and/or coin of certain denominations from the company’s vault to the customer’s location and the return transportation of currency and/or coin in the exact amount of the change provided to the company’s own vault does not constitute the acceptance of value from one person and the transportation of such value to another person or location.
Comptroller Curry Addresses Senior Management’s AML Compliance Responsibilities, Criticizes “De-Risking”
On March 17, Comptroller of the Currency Thomas Curry reaffirmed his agency’s views with regard to BSA/AML compliance and the responsibilities of senior bank managers and boards of directors. Mr. Curry asserted that BSA infractions “can almost always be traced back to decisions and actions of the institution’s Board and senior management” and that the deficiencies underlying those infractions tend to involve failures in four areas: (i) the culture of compliance at the organization; (ii) the resources committed to BSA compliance; (iii) the strength of information technology and monitoring process; and (iv) the quality of risk management. Mr. Curry reported a recent positive trend, particularly at OCC-regulated large banks, which have increased spending and added BSA/AML compliance staff. He stated that such actions are one aspect of banks’ efforts to align “good compliance practices and the bank’s system of compensation and incentives.” The Comptroller criticized a separate trend of “de-risking”, in which banks avoid or end relationships with types of businesses deemed too risky. He warned that any business can be used for illicit purposes and “de-risking” is not a shortcut to circumvent a bank’s obligation to evaluate risk on an individual basis. He encouraged banks not to avoid high-risk businesses, but rather to apply stronger risk management and controls as necessary.
On February 20, in remarks to the Florida International Bankers Association Anti-Money Laundering Conference, FinCEN Director Jennifer Shasky Calvery reviewed FinCEN’s key initiatives over the past year and outlined priorities going forward. She discussed FinCEN’s efforts with regard to virtual currency risks and stated that it is important for financial institutions that deal in virtual currency to put effective AML/CFT controls in place. She noted that it is also important for all stakeholders to keep virtual currency concerns in perspective given the relatively small size of the market. FinCEN is growing increasingly concerned with third party money launderers who layer transactions, create or use shell or shelf corporations, use political influence to facilitate financial activity, or engage in other schemes to infiltrate financial institutions and circumvent AML controls. FinCEN intends to pursue such actors regardless of where they are located. Director Shasky Calvery also reiterated concerns about securities firms that offer services similar to banks, and promised continued focus on threats posed by trade-based money laundering. With regard to its policy initiatives, FinCEN intends to engage stakeholders in a discussion of “balancing the policy motivations behind data privacy and secrecy laws in different jurisdictions with the need for an appropriate level of transparency to combat money laundering and terrorist financing.” The Director noted that this issue is particularly critical in the area of correspondent banking.
On February 20, FinCEN finalized a rule that will require Fannie Mae, Freddie Mac, and the Federal Home Loan Banks (the GSEs) to develop AML programs and to file SARs directly with FinCEN. Under the current system, the GSEs file fraud reports with the FHFA, which then files SARs with FinCEN when warranted under FinCEN’s reporting standards. The new regulations are substantially similar to the version proposed in November 2011, and are intended to streamline the reporting process and provide more timely access to data about potential fraud. The AML provisions of the new regulations implement the BSA’s four minimum requirements: (i) the development of internal policies, procedures, and controls; (ii) the designation of a compliance officer; (iii) an ongoing employee training program; and (iv) an independent audit function to test programs. The SAR regulation requires reporting of suspicious activity in accordance with standards and procedures contained in all of FinCEN’s SAR regulations. In addition, under the streamlined system, the GSEs and their directors, officers, and employees will qualify for the BSA’s “safe harbor” provisions, which are intended to encourage covered institutions to report suspicious activities without fear of liability. The final rule does not require the GSEs to comply with any other BSA reporting or recordkeeping regulations, such as currency transaction reporting. The rule takes effect 60 days after publication in the Federal Register and the GSEs will have 180 days from publication to comply.
On February 14, FinCEN issued guidance to clarify BSA expectations for financial institutions seeking to provide services to marijuana-related businesses in states that have legalized certain marijuana-related activity. The guidance was issued in coordination with the DOJ, which provided updated guidance to all U.S. Attorneys. The FinCEN guidance reiterates the general principle that the decision to open, close, or refuse any particular account or relationship should be made by each financial institution based on its particular business objectives, an evaluation of the risks associated with offering a particular product or service, its ability to conduct thorough customer due diligence, and its capacity to manage those risks effectively. The guidance details the necessary elements of a customer due diligence program, including consideration of whether a marijuana-related business implicates one of the priorities in the DOJ memorandum or violates state law. FinCEN notes that the obligation to file a SAR is unaffected by any state law that legalizes marijuana-related activity and restates the SAR triggers. The guidance identifies the types of SARs applicable to marijuana-related businesses and describes the conditions under which each type should be filed.
On January 30, in remarks to SIFMA’s AML and Financial Crimes Conference, FinCEN Director Jennifer Shasky Calvery stressed the importance of establishing a “culture of compliance” at financial institutions to support effective AML safeguards. The Director’s comments reinforce similar remarks made in recent months by both the Deputy U.S. Attorney General and Comptroller Curry. And like Comptroller Curry, Ms. Shasky Calvery highlighted the need for better information sharing not only within institutions but between institutions. FinCEN agrees with industry feedback that the agency needs to improve its own ability to share information. Also part of a broader theme among enforcement authorities, the Director explained that financial institutions should take responsibility when their actions violate the BSA, not only by admitting to the facts alleged by FinCEN but also by acknowledging a violation of the law. She highlighted specific risks in the securities sector including those related to the use of cash, and explained that securities firms that provide bank-like services need to consider the vulnerabilities associated with engaging in such services and must ensure that their compliance programs are commensurate with those risks.
On January 27, during a speech to certified AML compliance specialists, the U.S. Attorney for the Southern District of New York, Preet Bharara, stressed BSA/AML enforcement as a top priority for his office. Mr. Bharara focused on three issues: (i) the importance of holding institutions accountable for misconduct; (ii) the need for law enforcement to stay ahead of rapidly changing markets and technologies; and (iii) organizational changes within his office to bring the needed resources to bear. With regard to enforcement against institutions, the U.S. Attorney rebutted arguments that prosecutors should focus on individuals and described the full spectrum of tools available to hold institutions accountable—ranging from pursuing criminal prosecutions to seeking monetary fines and restitution through civil actions. He stressed the need to employ the full range of tools against institutions, especially in the AML context where many of the anti-money laundering laws and BSA provisions are specifically directed at institutions. The U.S. Attorney also announced that his office’s Criminal Division’s Asset Forfeiture Unit will be renamed the Money Laundering and Asset Forfeiture Unit to reflect his office’s commitment to dedicate more physical and human resources to addressing money laundering crimes and BSA violations.
On January 27, the U.S. Attorney for the Southern District of New York announced the unsealing of criminal charges against an underground Bitcoin exchanger and the CEO of a Bitcoin exchange company registered as a money services business for allegedly engaging in a scheme to sell over $1 million in Bitcoins to users of “Silk Road,” the website that is said to have enabled its users to buy and sell illegal drugs anonymously and beyond the reach of law enforcement. Each defendant is charged with conspiring to commit money laundering and operating an unlicensed money transmitting business. The CEO of the exchange company is also charged with willfully failing to file any suspicious activity report regarding the exchanger’s illegal transactions, in violation of the Bank Secrecy Act. The U.S. Attorney stated that the charges demonstrate his office’s intention and ability to “aggressively pursue those who would coopt new forms of currency for illicit purposes.” The complaint alleges that over a nearly two-year period, the exchanger ran an underground Bitcoin exchange on the Silk Road website, selling Bitcoins to users seeking to buy illegal drugs on the site. Upon receiving orders for Bitcoins from Silk Road users, he allegedly filled the orders through a company based in New York, which was designed to charge customers for exchanging cash for Bitcoins anonymously. The exchanger allegedly obtained Bitcoins with the company’s assistance, and then sold the Bitcoins to Silk Road users at a markup. The exchange company CEO, who was also its Compliance Officer, allegedly was aware that Silk Road was a drug-trafficking website, and also knew that the exchanger was operating a Bitcoin exchange service for Silk Road users. The government alleges that the CEO knowingly facilitated the exchanger’s business, personally processed orders, gave discounts on high-volume transactions, and failed to file a single suspicious activity report.
On January 7, the U.S. Attorney for the Southern District of New York, the OCC, and FinCEN announced the resolution of criminal and civil BSA/AML violations by a major financial institution in connection with the bank’s relationship with Bernard L. Madoff Investment Securities and Madoff Securities’ Ponzi scheme. The bank entered into a deferred prosecution agreement (DPA) to resolve two felony violations of the Bank Secrecy Act: (i) that the bank failed to enact adequate policies, procedures, and controls to ensure that information about the bank’s clients obtained through other lines of business – or outside the United States – was shared with compliance and AML personnel; and (ii) that the bank violated the BSA by failing to file a Suspicious Activity Report on Madoff Securities in October 2008. According to the U.S. Attorney, pursuant to the DPA the bank (i) agreed to waive indictment and to the filing of a Criminal Information; (ii) acknowledged responsibility for its conduct by, among other things, stipulating to the accuracy of a detailed Statement of Facts; (iii) agreed to pay a $1.7 billion non-tax deductible penalty in the form of a civil forfeiture (the largest ever financial penalty imposed by the DOJ for BSA violations); and (iv) agreed to various cooperation obligations and to continue reforming its BSA/AML compliance programs and procedures. In a separate action, the OCC levied a $350 million civil money penalty to resolve parallel BSA/AML allegations included in a January 2013 cease and desist order. Finally, the bank consented to a FinCEN assessment pursuant to which it must pay an additional $461 million.
On December 3, FinCEN and the Federal Reserve Board issued a final rule to amend the definitions of “funds transfer” and “transmittal of funds” under regulations implementing the Bank Secrecy Act. The agencies finalized the rule as proposed. The changes are intended to maintain the scope of the definitions following recent related amendments to the Electronic Fund Transfer Act, so as to avoid certain currently covered transactions being excluded from BSA requirements. The changes take effect January 3, 2014.
On November 18, at an American Bar Association/American Bankers Association conference on the Bank Secrecy Act/Anti-Money Laundering (BSA/AML), Deputy Attorney General (Deputy AG) James Cole challenged financial institutions’ compliance efforts and outlined the DOJ’s financial crimes enforcement approach. Noting that compliance within financial institutions is of particular concern to the DOJ, based in part on recent cases of “serious criminal conduct by bank employees,” the nation’s second highest ranking law enforcement official detailed DOJ’s approach to investigating and deciding in what manner to pursue potential violations. The Deputy AG included among his examples of serious misconduct recent BSA/AML, RMBS, mortgage False Claims Act, and LIBOR cases. He explained that the DOJ is particularly concerned about incentives that encourage excessive risk taking, and stated that “too many bank employees and supervisors value coming as close to the line as possible, or even crossing the line, as being ‘competitive’ or ‘aggressive.’” Read more…