    [Senate Hearing 108-886]
    [From the U.S. Government Publishing Office]

                                                            S. Hrg. 108-886

                          BANK SECRECY ACT ENFORCEMENT

    =======================================================================

                                    HEARING

                                   before the

                                  COMMITTEE ON
                       BANKING,HOUSING,AND URBAN AFFAIRS
                              UNITED STATES SENATE

                          ONE HUNDRED EIGHTH CONGRESS

                                 SECOND SESSION

                                       ON

     EFFORTS TO ENSURE COMPLIANCE AND ENFORCEMENT OF THE BANK SECRECY ACT,
      ENACTED IN 1970, WHICH AUTHORIZES THE SECRETARY OF THE TREASURY TO
     ISSUE REGULATIONS REQUIRING THAT FINANCIAL INSTITUTIONS KEEP RECORDS
     AND FILE REPORTS ON CERTAIN FINANCIAL TRANSACTIONS, FOCUSING ON ANTI-
         MONEY LAUNDERING AND ISSUES CONCERNING DEPOSITORY INSTITUTION
                              REGULATORY OVERSIGHT

                                   __________

                                  JUNE 3, 2004

                                   __________

      Printed for the use of the Committee on Banking, Housing, and Urban
                                    Affairs

          Available at: http: //www.access.gpo.gov /congress /senate/
                                senate05sh.html

                                     ______

                        U.S. GOVERNMENT PRINTING OFFICE
    25-956                      WASHINGTON : 2006
    _____________________________________________________________________________
    For Sale by the Superintendent of Documents, U.S. Government Printing Office
    Internet: bookstore.gpo.gov  Phone: toll free (866) 512-1800; (202) 512�091800
    Fax: (202) 512�092250 Mail: Stop SSOP, Washington, DC 20402�090001

                COMMITTEE ON BANKING, HOUSING, AND URBAN AFFAIRS

                      RICHARD C. SHELBY, Alabama, Chairman

    ROBERT F. BENNETT, Utah              PAUL S. SARBANES, Maryland
    WAYNE ALLARD, Colorado               CHRISTOPHER J. DODD, Connecticut
    MICHAEL B. ENZI, Wyoming             TIM JOHNSON, South Dakota
    CHUCK HAGEL, Nebraska                JACK REED, Rhode Island
    RICK SANTORUM, Pennsylvania          CHARLES E. SCHUMER, New York
    JIM BUNNING, Kentucky                EVAN BAYH, Indiana
    MIKE CRAPO, Idaho                    ZELL MILLER, Georgia
    JOHN E. SUNUNU, New Hampshire        THOMAS R. CARPER, Delaware
    ELIZABETH DOLE, North Carolina       DEBBIE STABENOW, Michigan
    LINCOLN D. CHAFEE, Rhode Island      JON S. CORZINE, New Jersey

                 Kathleen L. Casey, Staff Director and Counsel

         Steven B. Harris, Democratic Staff Director and Chief Counsel

                    Skip Fischer, Senior Staff Professional

                  Stephen R. Kroll, Democratic Special Counsel

       Joseph R. Kolinski, Chief Clerk and Computer Systems Administrator

                           George E. Whittle, Editor

                                      (ii)
    ?

                                C O N T E N T S

                                  ----------

                             THURSDAY, JUNE 3, 2004

                                                                       Page

    Opening statement of Chairman Shelby.............................     1

    Opening statements, comments, or prepared statements of:
        Senator Sarbanes.............................................     2
        Senator Reed.................................................     5
        Senator Allard...............................................     5
            Prepared statement.......................................    41
        Senator Bunning..............................................    41

                                   WITNESSES

    Susan S. Bies, Member, Board of Governors of the Federal Reserve
      System.........................................................     5
        Prepared statement...........................................    42
    John D. Hawke, Jr., Comptroller of the Currency, U.S. Department
      of the Treasury................................................     8
        Prepared statement...........................................    47
        Response to a question of Senator Shelby.....................   111
    Donald E. Powell, Chairman, Federal Deposit Insurance Corporation    10
        Prepared statement...........................................    60
    James E. Gilleran, Director, Office of Thrift Supervision, U.S.
      Department of the Treasury.....................................    12
        Prepared statement...........................................    67
    JoAnn M. Johnson, Chairman, National Credit Union Administration.    13
        Prepared statement...........................................    76
    William J. Fox, Director, Financial Crimes Enforcement Network,
      U.S. Department of the Treasury................................    15
        Prepared statement...........................................    79
    Gaston L. Gianni, Jr., Inspector General, Federal Deposit
      Insurance Corporation..........................................    32
        Prepared statement...........................................    84
    Davi M. D'Agostino, Director, Financial Markets and Community
      Investment, U.S. General Accounting Office.....................    34
        Prepared statement...........................................    93

                  Additional Material Supplied for the Record

    Letter to Senator Paul S. Sarbanes from John D. Hawke, Jr.,
      Comptroller of the Currency, U.S. Department of the Treasury,
      dated June 18, 2004............................................   112
    Letter to Senator Jack Reed from James E. Gilleran, Director,
      Office of Thrift Supervision, U.S. Department of the Treasury,
      dated June 9, 2004.............................................   116

                                     (iii)

                          BANK SECRECY ACT ENFORCEMENT

                                  ----------

                             THURSDAY, JUNE 3, 2004

                                           U.S. Senate,
              Committee on Banking, Housing, and Urban Affairs,
                                                        Washington, DC.

        The Committee met at 9:45 a.m., in room SD-538, Dirksen
    Senate Office Building, Senator Richard C. Shelby (Chairman of
    the Committee) presiding.

            OPENING STATEMENT OF CHAIRMAN RICHARD C. SHELBY

        Chairman Shelby. The hearing will come to order.
        The purpose of today's hearing is to examine the record of
    the Federal Government in enforcing this Nation's laws against
    money laundering and terrorist financing. The high-profile case
    of Riggs Bank, which was recently fined $25 million for
    repeated--I emphasize ``repeated''--failures to comply with the
    Bank Secrecy Act, the basic anti-money laundering statutes
    requiring the reporting of large cash transactions and
    suspicious financial activities, has highlighted possible
    deficiencies in the governmental structure for enforcing these
    laws.
        The Riggs case could be seen as unique. It involved that
    bank's near monopoly on foreign embassy banking. It involved an
    oil-rich country for which the movement of large amounts of
    cash was as
    routine as writing a check to pay bills is for many Americans.
    Whatever cultural, political, or economic factors resulted in
    Riggs' failure to comply with the law, despite repeated
    assurances to its Federal overseers that it would improve in
    that regard, this case cannot be seen as unique. As the General
    Accounting Office will testify later today before this
    Committee, the problem runs deeper than we may care to admit.
    There does appear, on the basis of a number of recent money
    laundering cases, as well as the case of UBS Investment Bank of
    Switzerland, about which this Committee held a hearing on May
    20, to be serious deficiencies on the part of the Federal
    regulatory agencies vested with the authority and
    responsibility to enforce this Nation's laws against money
    laundering.
        I mention the UBS case for a reason. In that case, the
    Federal Reserve Bank of New York, responsible for ensuring that
    U.S. currency was not being transferred to countries sanctioned
    for their support of terrorist activities or their poor human
    rights records, failed to provide adequate oversight of the
    banks with which it had contracted to serve as depositories of
    billions of U.S. dollars in cash. The Federal Reserve Bank
    trusted that the self-generating reports provided it by UBS
    were an accurate reflection of the latter's conduct. The Fed
    was wrong, to the tune of $5 billion.
        Similarly, the Riggs case showed a deference toward the
    client financial institution that undermined the integrity of
    the oversight process. Trust that Riggs would comply not just
    with the terms of the law, but with the agreements intended to
    bring it into compliance with the law, proved the undoing of a
    process that is essential to the war against terrorism. The war
    against terrorism cannot be won without serious efforts at
    impeding the very types of criminal activity that seem to be
    going on or went on at the Riggs Bank, as well as the UBS case.
    And Riggs, as we all know, is not just about their bank's
    relationship to the Embassy of Saudi Arabia. As disturbing are
    the business transactions with the Government of Equatorial
    Guinea, a country known for its corruption, human rights
    abuses, and desperately poor population, despite vast oil
    wealth.
        The Riggs case, as well as that of Banco Popular, Delta
    National Bank and Trust of New York, and others clearly point
    to underlying problems in the approach of Federal regulatory
    agencies to properly carry out their mandate to enforce the
    Bank Secrecy Act.
        How long banks are given to comply with the law before the
    Government acts with sufficient force so as to compel
    compliance is one of the issues to be addressed here today.
    Others include the ability and the willingness of the agencies
    represented here today to execute their enforcement function
    with regard to money laundering with the same competence with
    which they execute their apparently more ingrained ``safety and
    soundness'' function. Their relationship to each other, to the
    Financial Crimes Enforcement
    Network, also represented here today, and to law enforcement
    and the degree to which information essential for enforcing
    anti-money laundering laws is shared among themselves in a
    timely manner. For example, was the FBI informed about cease-
    and-desist orders, or did it have to read about them in the
    papers? What about FinCEN? Does the examination process need
    repair? These are the questions that demand attention here.
        Testifying here today and hopefully addressing these
    questions, are Susan Schmidt Bies, Board of Governors of the
    Federal Reserve System; John D. Hawke, Comptroller of the
    Currency and frequent guest here; Donald Powell, the Chairman
    of the Federal Deposit Insurance Corporation; James Gilleran,
    Director of the Office of Thrift Supervision; JoAnn Johnson,
    Chairman of the National Credit Union Administration; and
    William Fox, Director, Financial Crimes Enforcement Network.
    After we hear testimony from these officials, we have a second
    panel comprised of Gaston Gianni, Inspector General of the
    Federal Deposit Insurance Corporation; and Davi D'Agostino,
    Director of the Financial Markets and Community Investment
    Division of the General Accounting Office.
        Senator Sarbanes.

                 STATEMENT OF SENATOR PAUL S. SARBANES

        Senator Sarbanes. Thank you very much, Mr. Chairman. First
    of all, I want to say that I strongly share your commitment to
    very strong oversight by this Committee of the agencies under
    our jurisdiction and, in particular, this focus on the
    administration and enforcement of the Bank Secrecy Act.
        The President speaks often of the war against terrorism,
    and again and again people say that an essential part of the
    war against terrorism is to dry up the financial resources that
    the terrorist networks gain access to which enable them to
    carry out their activities. The Bank Secrecy Act is part of
    that effort, but the effectiveness of the BSA and the priority
    which bank regulators and the Treasury Department give to its
    enforcement is regrettably a very open question, underscored by
    the failures of compliance and regulatory oversight at Riggs
    Bank and other institutions. Riggs is the most recent one and
    in the focus.
        OCC examiners outlined problems in Riggs' BSA compliance
    and anti-money laundering procedures as early as 1997. But
    despite Riggs' well-known special circumstances, in terms of
    its clients, the examiners failed to discover widespread
    noncompliance with the Bank Secrecy Act. It was not until late
    2002 that OCC examiners began seriously to test transactions to
    see if the Riggs' program was actually producing results. We
    now know that it was not.
        Throughout much of the same period, Federal
    counterterrorism and law enforcement officials were involved in
    investigations involving accounts of some of Riggs' largest
    customers. And the Federal Reserve Board was conducting
    parallel oversight because of its jurisdiction over the Riggs
    holding company and Edge Act subsidiary. It is not clear when
    the Financial Crimes Enforcement Network, FinCEN, which is said
    to administer the Bank Secrecy Act and which ultimately issued
    a concurrent $25 million penalty assessment with the OCC
    against Riggs, first learned of Riggs' compliance problem. It
    seems clear that there was no coordinated Federal regulatory
    effort relating to the audit and investigation of Riggs.
        The Riggs situation in and of itself is serious, obviously.
    But it may reflect a broader structural problem. No one seems
    to be directly accountable for enforcement of the Bank Secrecy
    Act. Congress vested authority for the Bank Secrecy Act's
    administration and enforcement in the Secretary of the
    Treasury, who has delegated that authority, since 1994, to the
    Director of FinCEN. The Federal banking agencies examine the
    compliance of depository institutions with the Bank Secrecy
    Act, under authority delegated by Treasury. But they also have
    a separate statutory obligation to examine for BSA compliance
    procedures, employing a different set of sanctions than the
    statutory penalties in the Bank Secrecy Act.
        The list of agencies involved in potential BSA compliance
    problems does not end there. Federal enforcement and, now,
    intelligence agencies--for example, the FBI, the Bureau of
    Immigration and Customs Enforcement, the Drug Enforcement
    Administration, the Criminal Investigation Division of the
    Internal Revenue Service--investigate potential BSA violations
    in the course of their activities. State bank regulators have
    their own oversight authority that extends to the Bank Secrecy
    Act in the case of State-chartered institutions. Different
    regulators may--in fact, likely will--regulate different parts
    of increasingly integrated bank holding companies. Treasury,
    through FinCEN, will become involved in compliance penalties
    only in a limited number of situations in which cases are
    referred to it under procedures that, according to testimony we
    will be receiving today, are more than a decade old.
        I am also concerned about the nature of the bank
    examination procedures themselves in this area. Today's
    testimony will indicate that the bank examiners review
    procedures and systems in their money laundering compliance
    examinations. They rarely test transactions to see if the
    procedures or systems are working. It is a little bit like
    going into a room and seeing that the furniture is all in place
    but not placing any weight on the furniture to see whether it
    will sustain the stress. It could all be hollow.
        I am also concerned about reports that compliance
    examiners, generally at the OCC, FDIC, and OTS, have been made
    subordinate to safety and soundness examiners. This would
    affect not only the Bank Secrecy Act, but also other critical
    compliance areas, including, of course, consumer protection.
        The unfortunate lesson of the Riggs case seems to be that,
    despite the attention paid to improving the statutory tools
    given to the Treasury and to law enforcement in the legislation
    enacted after September 11--this Committee brought forth a
    title on money laundering which was included in that
    legislation, and, of course, prior legislation--the Bank
    Secrecy Act is not really ``administered'' at all in any
    coordinated way. Again, no one seems to be responsible for
    putting the statute into effect.
        I hope that today's hearing can force accelerated
    discussion of these issues and place them at the top of the
    anti-money laundering and counterterrorism financing agenda.
        I also want to get a better sense from our witnesses of how
    uniformly they are enforcing the BSA and the anti-money
    laundering laws. It is my understanding that last week,
    Comptroller Hawke sent a memorandum to the OCC's bank examiners
    reminding them of their responsibilities in this area, and I
    look forward to hearing what our other financial regulators are
    doing in this regard and how seriously they take this issue.
        A number of far-reaching proposals are now being made, and
    the Committee may well have to address them. And, of course,
    these would involve how authorities are allocated. One proposal
    is to create a separate Bank Secrecy Act audit and enforcement
    force at the Treasury. Another would be to create a joint BSA
    audit authority under the supervision of the banking regulators
    staffed by experienced examiners whose career ladders call for
    rotation into the unit for several years and who audit
    institutions other than those supervised by their home
    agencies. Another possibility is retaining the present system,
    but requiring FinCEN, so long as it is administrator of the
    BSA, to receive the portion of each examination report dealing
    with Bank Secrecy Act matters, and to participate in the
    determination of action to take in response to deficiencies.
        Another possibility, moving across the range of things,
    would be to delegate full BSA penalty and administrative
    authority to the bank regulators together with mandated
    reporting to Treasury. Another would be to mandate transaction
    testing and other upgraded examination procedures for BSA
    examination.
        I think it is very clear that the current system is not
    working the way it should be working. The Fed imposed a $100
    million on UBS AG for conducting illegal currency transactions
    with four countries. Our colleague, Representative Sue Kelly,
    on the House side, the Chairman of the House Financial Services
    Oversight Committee, called this sanction ``a mere slap on the
    wrist.'' There is very deep concern, obviously, here in the
    Congress about the effectiveness of our fight against terrorist
    financing. Our concern also involves organized crime, drug
    cartels, and so forth. And there is not a sense that the
    agencies are fully reporting for duty with respect to this
    important issue.
        Mr. Chairman, I look forward to hearing the testimony.
        Chairman Shelby. Thank you, Senator Sarbanes.
        Senator Reed.

                     STATEMENT OF SENATOR JACK REED

        Senator Reed. Mr. Chairman, I simply want to associate
    myself with Senator Sarbanes' comments and remarks, and I look
    forward to hearing the testimony of the witnesses.
        Thank you, Mr. Chairman.
        Chairman Shelby. Senator Allard, do you have an opening
    statement?

                   STATEMENT OF SENATOR WAYNE ALLARD

        Senator Allard. I do, Mr. Chairman, have an opening
    statement. I will just submit it for the record.
        Chairman Shelby. Without objection, it is so ordered.
        Senator Allard. I would like to thank the panel for taking
    the time to testify before the Committee and you for holding
    the hearing.
        Chairman Shelby. Thank you.
        All of your written testimony will be made part of the
    hearing record. We will start with you, Governor Bies.

                  STATEMENT OF SUSAN S. BIES, MEMBER,

            BOARD OF GOVERNORS OF THE FEDERAL RESERVE SYSTEM

        Ms. Bies. Thank you, Mr. Chairman and Senator Sarbanes. I
    want to thank you for the opportunity to appear before this
    Committee to discuss the Federal Reserve's participation in
    efforts to combat money laundering and terrorist financing.
        In my remarks today, I will describe for you some of the
    important steps we are taking to fulfill our supervisory
    mission, to guide the institutions we supervise, and, in
    cooperation with the other banking and financial services
    regulators and the Treasury Department, to make every effort to
    use our supervisory tools to enhance the banking industry's
    role in preventing and detecting money laundering and terrorist
    financing activity. The Federal Reserve's anti-money laundering
    program is multifaceted. It involves work in the bank
    supervision area, the applications area, enforcement,
    investigations, training, and coordination with law enforcement
    and intelligence communities, as well as rule writing. This
    morning, I will touch on some of these aspects of the Federal
    Reserve's anti-money laundering program, but will concentrate
    on bank supervision efforts and enforcement matters.
        The Federal Reserve has long shared Congress' view that
    financial institutions and their employees are on the front
    lines of the efforts to combat illicit financial activity. The
    Federal Reserve believes that the banking organizations it
    supervises must take every reasonable step to identify,
    minimize, and manage any risks that illicit financial activity
    may pose to individual financial institutions and the banking
    industry.
        It has been our longstanding policy that Federal Reserve
    supervisors incorporate a Bank Secrecy Act compliance and anti-
    money laundering program component into every safety and
    soundness examination conducted by a Federal Reserve Bank. This
    means that on a regular examination cycle, examiners evaluate
    whether a banking organization's Bank Secrecy Act and anti-
    money laundering compliance program is satisfactory and are
    commensurate with the organization's business activities and
    risk profiles. Bank Secrecy Act and anti-money laundering
    compliance has, for years, been an integral part of the bank
    supervision process at the Federal Reserve. Furthermore, the
    Federal Reserve's enforcement
    program has a strong history of addressing both anti-money
    laundering and safety and soundness problems in formal actions
    when it becomes necessary.
        There is an important correlation between the areas covered
    by a BSA/AML examination and an institution's overall risk
    management and internal controls. Bank examiners take into
    account an organization's enterprise-wide corporate governance
    mechanisms and how they are applied. The Federal Reserve's bank
    examiners are able to apply a broad perspective and depth of
    organizational knowledge to the area of Bank Secrecy Act and
    anti-money laundering compliance and to coordinate with the
    examination and analytical staff to ensure that safety and
    soundness and Bank Secrecy Act and anti-money laundering are
    integrated and comprehensive. The Federal Reserve has found
    that there is an important synergy gained by integrating safety
    and soundness and Bank Secrecy Act/anti-money laundering
    supervisory processes.
        The Federal Reserve focuses significant resources on the
    prevention and early resolution of deficiencies within the
    supervisory framework. In cases where examiners have identified
    a violation of the compliance program requirement, the Federal
    Reserve is bound by law to take formal enforcement action. The
    same law requiring us to promulgate rules requiring a
    compliance program provides that if an institution fails to
    establish and maintain required procedures, we must issue a
    formal action requiring the institution to correct the problem.
        The Federal Reserve takes this responsibility very
    seriously and has issued a number of public actions against
    banking organizations in fulfillment of this statutory mandate.
    Over the last 3 years, for example, the Federal Reserve has
    taken approximately 25 formal, public enforcement actions
    addressing Bank Secrecy Act and anti-money laundering-related
    matters.
        In addition to taking action itself, the Federal Reserve
    may refer a Bank Secrecy Act-related matter to Treasury's
    FinCEN for consideration of an enforcement action based on
    violations of that law.
        The Federal Reserve staff coordinates enforcement actions
    with other regulators or agencies, including in the area of
    anti-money laundering. If a banking organization's problems
    involve entities supervised by different regulators, resolution
    of enterprise-wide problems may involve multiple enforcement
    actions. For example, the OCC, FinCEN, and the Federal Reserve
    coordinated their recent enforcement actions against Riggs
    Bank, National Association; Riggs National Corporation; and
    Riggs International Banking
    Corporation, the national bank's Edge Act subsidiary. The
    Federal Reserve coordinates its enforcement actions with State
    banking supervisors on a regular basis, and enforcement actions
    involving
    operations of foreign banking organizations may be resolved in
    cooperation with supervisors abroad. In several recent matters,
    there was close coordination also with the U.S. Department of
    Justice.
        The Federal Reserve's Bank Secrecy Act and anti-money
    laundering functions range from supervising and regularly
    examining banking organizations subject to Federal Reserve
    supervision for compliance with the Bank Secrecy Act and
    relevant regulations, to requiring corrective actions for
    detected weaknesses in their Bank Secrecy Act/anti-money
    laundering program, to enhancing money laundering
    investigations by providing expertise to the U.S. law
    enforcement community, to providing training to U.S. law
    enforcement authorities and various foreign central banks and
    government agencies. Over the last 3 years, for example,
    Federal Reserve experts in anti-money laundering-related
    matters have participated in special reviews of funds transfers
    for Federal law enforcement and intelligence authorities,
    taught classes at FBI and Department of Homeland Security
    training academies, held seminars for central bank and foreign
    supervisor authorities in 10 countries, and engaged in
    discussions on anti-money laundering-related matters at
    international fora such as the Basel Cross-border Group and the
    Financial Action Task Force.
        Board and Reserve Bank supervisors seek to provide guidance
    to banking organizations to assist them to fully understand
    applicable regulatory requirements and what is expected by the
    regulators. The Federal Reserve views its supervisory role as
    including initiatives to enhance awareness and understanding by
    banking organizations under Federal Reserve supervision and by
    the industry at large.
        The Federal Reserve makes its Bank Secrecy Act examination
    procedures available to the banking industry and updates those
    procedures by publicly issuing supervision and regulation
    letters. These letters advise Reserve Bank supervisory staff
    and the industry about new examination policies and protocols,
    such as those associated with the USA PATRIOT Act. Federal
    Reserve staff also speaks regularly before the financial
    industry and issues sound practice guidance in conjunction with
    other regulators and Treasury. These initiatives are meant to
    respond to or anticipate questions that arise regarding anti-
    money laundering requirements and to help banking
    organizations' compliance efforts.
        The Federal Reserve believes that banking organizations
    should take reasonable and prudent steps to combat illicit
    financial activities, such as money laundering and terrorist
    financing, and to minimize their vulnerability to risks
    associated with such activity. For this reason, the Federal
    Reserve's commitment to ensuring compliance with the Bank
    Secrecy Act continues to be a high supervisory priority. The
    Federal Reserve has an important role in ensuring that criminal
    activity does not pose a systemic threat and, as important, in
    improving the ability of individual banking organizations in
    the United States and abroad to protect themselves from illicit
    activities.
        Thank you.
        Chairman Shelby. Thank you, Governor Bies.
        Mr. Hawke.

                    STATEMENT OF JOHN D. HAWKE, JR.

                      COMPTROLLER OF THE CURRENCY

                    U.S. DEPARTMENT OF THE CURRENCY

        Comptroller Hawke. Chairman Shelby, Ranking Member
    Sarbanes, and Members of the Committee, I appreciate the
    opportunity to discuss the work of the OCC in combating money
    laundering and enforcing compliance with U.S. laws designed to
    prevent our financial institutions from falling victim to
    criminals and terrorists.
        For the past 30 years, the OCC has placed great importance
    on developing policies and procedures designed to ensure that
    financial institutions have the necessary controls in place and
    provide the requisite notices to law enforcement to make
    certain that they do not become vehicles for money laundering.
    Our examiners are dedicated. Our BSA/anti-money laundering
    examination techniques are highly regarded. We have strived to
    keep our exam techniques current and responsive to new
    developments, and we work cooperatively and successfully with
    law enforcement. For all these reasons, the situation that we
    have confronted with Riggs Bank is deeply troubling, and this
    Committee's keen interest in Riggs is entirely appropriate.
        For this reason, I will rely today on my written testimony
    for a detailed discussion of the components of the OCC's
    extensive BSA and anti-money laundering program and devote my
    oral testimony to the Riggs situation.
        As I reviewed the record of our oversight of Riggs' Bank
    Secrecy Act/anti-money laundering compliance during this
    period, it become clear to me that there was a failure of
    supervision. We should have been more aggressive in our
    insistence on remedial steps at a much earlier time. The types
    of strong formal enforcement action that we ultimately took
    should have been taken earlier. We should have done more
    extensive probing and transaction testing of accounts. Indeed,
    our own BSA exam procedures called for transactional reviews in
    the case of high-risk accounts, yet until recently that was not
    done. We failed to appreciate the risks inherent in Riggs'
    embassy banking business and in certain of the accounts handled
    by the bank, as well as the significance of the deficiencies in
    the bank's systems and controls in relation to those risks.
        This is not a case where the deficiencies in these systems
    and controls at Riggs were not recognized, nor was there an
    absence of OCC supervisory attention to those deficiencies. But
    in failing to promptly recognize the high-risk nature of the
    bank's business in this regard, we did not probe as soon or as
    deeply as we should have. We gave the bank too much time, based
    on its apparent efforts to fix the problems we had repeatedly
    noted, before we
    demanded specific solutions, by specific dates, pursuant to
    formal enforcement actions.
        With this context, allow me to provide a brief review of
    our recent supervision of Riggs. The specific shortcomings in
    Riggs' BSA/AML compliance program were known to us as early as
    1997. In our regular and frequent examinations, we repeatedly
    identified the need for improvement in Riggs' BSA internal
    audit coverage, its information systems, its internal
    monitoring processes, its staff training, and its customer due
    diligence requirements, and we brought those deficiencies to
    the attention of Riggs management. Each time, we found
    management to be apparently cooperative and responsive. And
    because of this attitude, we concluded that Riggs' compliance
    program was either ``satisfactory'' or ``generally adequate,''
    which led us to continue to rely on various informal
    supervisory remedies in dealing with the Riggs management.
        In the aftermath of the September 11, 2001 tragedies, the
    OCC conducted a series of antiterrorist financing reviews at
    our large and high-risk banks. Riggs was included in those
    targeted exams. The subsequent examination of Riggs ran from
    January to May 2003 and involved extensive cooperation with law
    enforcement agencies. It focused on certain suspicious
    transactions involving the Saudi Embassy relationship and
    culminated in a July 2003 cease-and-desist order, directing
    Riggs to undertake a long list of corrective actions.
        Yet when we returned to the bank in October 2003, the same
    pattern surfaced. While progress had been made toward complying
    with the July C&D order, a new set of problems had become
    evident, this time relating to the bank's relationship with
    Equatorial Guinea. Our reaction this time was fundamentally
    different than before and ultimately led to the assessment of a
    record $25 million civil money penalty against the bank. We
    also continue to evaluate whether additional actions are
    warranted.
        Against this background, there are at least three important
    questions that this Committee might appropriately ask. And I am
    sure there are more. First, why was there a failure of
    supervision in the Riggs case? Second, is our record with
    regard to Riggs symptomatic of shortcomings in our BSA/AML
    supervision of other national banks? And, third, what is the
    OCC doing to assure that there will be no recurrence of
    situations like Riggs?
        To address the first two questions, I have directed our
    Quality Management Division, which reports directly to me and
    is analogous to an internal IG operation, to conduct a
    complete, no-holds-barred, top-to-bottom review of our handling
    of the Riggs situation and to report their findings and
    recommendations back to me in 90 days. I have also directed QMD
    to make a more general assessment of the quality of our BSA/AML
    supervision and to determine whether there are other banks as
    to which our compliance oversight reflects similar
    shortcomings. I will be happy to share the QMD report with this
    Committee when it is completed.
        In order to assure that there is no recurrence of the
    shortcomings evidenced in the Riggs case, I have directed a
    number of other actions, which are described in my written
    testimony, to improve our practices and policies and to develop
    new risk-screening systems and techniques.
        I have also instructed our Committee on Bank Supervision,
    which is comprised of the OCC's senior supervision officials,
    to communicate with all OCC examination staff to raise their
    level of alert for suspicious or high-risk accounts and to
    reemphasize the need for deeper investigation and transaction
    testing where such circumstances exist. This communication re-
    emphasizes the critical importance of our BSA/AML compliance
    program and the role that program plays in helping to assure
    that national banks will not be used to facilitate improper
    transactions.
        The Riggs episode reminds us that the Bank Secrecy Act and
    money laundering issues are not only of extreme importance to
    national security but they also have huge reputation
    implications for the banking industry. This heightened
    awareness, coupled with the many technical and other
    improvements in the approach to BSA/AML supervision already
    adopted or contemplated by the OCC and its sister financial
    regulatory agencies, should strengthen the ability of our
    financial system to resist those who would use it for improper
    purposes.
        Notwithstanding the Riggs situation, Mr. Chairman, the OCC
    is committed to doing its part to assure that national banks
    scrupulously perform their responsibilities under the laws
    relating to money laundering. We stand ready to work with
    Congress, with law enforcement, with the other financial
    regulatory agencies, and with the banking industry to continue
    to develop and implement a coordinated and comprehensive
    response to the threat posed to the Nation's financial system
    by money launderers and terrorists.
        Thank you, Mr. Chairman.
        Chairman Shelby. Mr. Powell.

                     STATEMENT OF DONALD E. POWELL

            CHAIRMAN, FEDERAL DEPOSIT INSURANCE CORPORATION

        Chairman Powell. Mr. Chairman, Senator Sarbanes, and
    Members of the Committee, thank you for this opportunity to
    discuss how the FDIC, along with the other bank regulatory
    agencies, addresses our responsibilities under the Bank Secrecy
    Act and related anti-money laundering and antiterrorism laws.
        While my written testimony provides greater detail about
    the FDIC's effort to prevent money laundering and terrorist
    financing, I would like to focus my statement today on how the
    FDIC is seeking to ensure that the American financial system is
    not misused in a way that supports criminal and terrorist
    activities and how bank regulators, law enforcement, and the
    banking industry can work together to address money laundering
    and terrorist financing.
        One of the strongest ways to attack criminal and terrorist
    activities is to focus on their funding sources and their
    attempts to use the financial system to further their goals.
    While legislative and regulatory efforts originally focused on
    criminals laundering large sums of cash, the events of
    September 11 expanded our reach to terrorists who seek to use
    the U.S. banking system to fund their activities.
        The FDIC is responsible for examining State-chartered,
    nonmember banks for compliance with the Bank Secrecy Act and to
    determine the effectiveness of the financial institutions'
    anti-money laundering program. While the vast majority of FDIC-
    supervised institutions are diligent in their efforts to
    establish, execute, and administer effective Bank Secrecy Act
    compliance programs, there have been instances where the
    controls and efforts were lacking. In those cases, we have
    implemented a range of corrective measures to ensure banks
    comply with the law.
        In cases where an institution's anti-money laundering
    compliance program has been criticized or in cases where
    previously identified deficiencies have not been corrected,
    including significant violations of law, the FDIC will take
    formal or informal enforcement action. The type of enforcement
    action pursued by the FDIC against an institution is directly
    related to the severity of the offense, management's
    willingness and ability to effectively implement corrective
    action, as well as the extent to which the program has failed
    to identify or deter potential money laundering. In addition,
    the nature of the criticism, the response to prior weaknesses
    or violation notifications, and the overall risk profile of the
    institution are factored into the type of supervisory action,
    as well as any determination to assess civil money penalties.
        The FDIC understands that all institutions are at risk. In
    today's global banking environment, where funds are transferred
    in an instant and communication systems make services available
    nationally, even a lapse at a small financial institution
    outside of a major metropolitan area can have major
    implications on another location across the Nation. The more
    difficult it is for criminals and terrorists to gain entry into
    the American financial system, the more likely it is that they
    will need to rely on less secure and less efficient means of
    financing their activities.
        Since the passage of the USA PATRIOT Act of 2001, the FDIC
    has been involved in a number of activities aimed at supporting
    our efforts to reduce the risk of terrorist financing
    activities. We participated in the rulemaking process of
    relevant parts of the USA PATRIOT Act, and we participated in a
    number of working groups focused on counter-financing of
    terrorism and the USA PATRIOT Act. In conjunction with this,
    and in part to address some recommendations identified in a
    recent inspector general report, the FDIC has undertaken or
    established a number of initiatives to enhance our enforcement
    of the Bank Secrecy Act.
        First, consistent with the increased importance of the BSA,
    the additional workload associated with the USA PATRIOT Act and
    greater emphasis on international efforts to combat terrorism
    financing, we are dedicating more staff to oversight of our
    anti-money laundering and PATRIOT Act efforts. Currently, the
    FDIC has more than 150 Bank Secrecy Act subject matter experts
    nationwide. The FDIC expects to double this number over the
    next 18 months.
        Second, the FDIC is requiring that all examiners complete
    additional formal training on anti-money laundering and PATRIOT
    Act issues by the end of this year. This computer-based
    training also will be offered to all State banking authorities
    and other regulators who wish to provide additional training
    for their staff.
        Third, the FDIC is reviewing all written guidance for
    examiner and industry use to assure that it is current and
    provides clear direction.
        Fourth, beginning this month, in those instances where the
    State banking authority does not conduct Bank Secrecy Act
    exams, the FDIC will send an examiner to conduct an examination
    for BSA and anti-money laundering compliance concurrent with
    the State authority's safety and soundness examination. While
    the FDIC reviews BSA compliance each time it examines a State-
    chartered nonmember bank, not all States conduct similar
    examinations. This initiative will ensure that all FDIC-
    supervised banks are reviewed for money laundering and
    terrorist financing activity during every examination cycle.
        Fifth, the FDIC has centralized the monitoring process for
    FDIC-supervised banks with serious anti-money laundering
    program deficiencies. This ensures a consistent supervisory
    approach is applied on a national basis. In addition, the FDIC
    recently centralized the process for referring violations to
    FinCEN, which provides consistency in reporting. These
    centralization efforts will enable us to analyze historical
    data internally to identify emerging trends and issues among
    FDIC-supervised banks.
        Sixth, the FDIC will continue its participation in the Bank
    Secrecy Act Advisory Group, which is a public-private
    partnership engaged in the evaluation of strategies to detect
    and prevent money laundering and terrorist financing schemes.
    These initiatives are underway and ongoing.
        There is more we can do. Here are some ideas we are
    exploring within the FDIC and the broader Government to further
    buttress our efforts: Work toward a smarter BSA that
    accomplishes the mission more efficiently through more useful
    and timely filing by banks; Encourage the use of Section 314
    safe harbor language in the law to foster meaningful dialogue
    between institutions about suspicious transactions; Tear down
    the wall between industry and Government and foster better
    dialogues about the broader threats, current criminal and
    terrorist practices, and about the way institutions' BSA
    filings are put to use; Enhance and solidify the perception of
    invulnerability. Any criminal or terrorist should know that if
    he uses the U.S. banking system to transfer value, he will be
    caught.
        In conclusion, the FDIC is fully committed to preventing
    the use of the financial system to support criminal or
    terrorist activities. Only through a strong and comprehensive
    supervisory response and the continued full commitment of the
    industry can we create an environment where terrorists know
    that any attempt to use the American financial system to fund
    their operations poses an unacceptable risk of discovery.
        This concludes my testimony. Thank you.
        Chairman Shelby. Mr. Gilleran.

                     STATEMENT OF JAMES E. GILLERAN

                 DIRECTOR, OFFICE OF THRIFT SUPERVISION

                    U.S. DEPARTMENT OF THE TREASURY

        Director Gilleran. Chairman Shelby, Senator Sarbanes,
    Members of the Committee, the OTS fully supports the Bank
    Secrecy Act and the U.S. PATRIOT Act, and we are dedicated to
    make sure that our agencies and our licensees completely carry
    out their responsibilities under them.
        In the last 10 months, of our 916 institutions we have
    completed 476 BSA examinations. Of those 476 examinations, we
    found 167 associations with BSA violations. The number of
    violations in those associations in total were 342. All of
    those violations were addressed prior to the completion of our
    examinations and did not lead to any more formal action since
    the institutions completely accepted our findings and made
    changes immediately. We have 7 actions that have come out of
    that effort that have been more formal in nature, have resulted
    in cease-and-desist orders and in civil money penalties. And we
    have 4 or 5 more that are in process.
        To put the number of violations, though, into perspective,
    342, in adding up the number of potential violations that are
    embedded in the OTS and Treasury regulations, they number over
    200 for each institution. So the possibility of the number of
    violations in those approximately 500 examinations was over
    100,000 potential violations. So the regulations are extremely
    detailed and, of course, our examination procedures are
    appropriately detailed but risk-focused.
        We have also participated in trying to conduct educational
    programs for the industry. We have provided additional training
    for our staff. We have greatly expanded the number of examiners
    who are BSA trained. We have halved the interval between BSA
    examinations from 24 to 36 months to 12-month to 18-month
    intervals. We have developed and implemented enhanced scoping
    and examination procedures. We have implemented a new BSA
    tracking and monitoring information system. We have improved
    internal controls governing internal data collection. We have
    bolstered our off-site BSA monitoring programs. We have adopted
    more robust and stringent enforcement policies. We have
    implemented the new BSA quality assurance and audit program.
    And we have improved our internal communications and external
    communications and coordinated closely with other financial
    regulatory agencies, Department of the Treasury, and law
    enforcement.
        I await your questions.
        Chairman Shelby. Thank you.
        Ms. Johnson.

                     STATEMENT OF JOANN M. JOHNSON

             CHAIRMAN, NATIONAL CREDIT UNION ADMINISTRATION

        Ms. Johnson. Chairman Shelby, Senator Sarbanes, and Members
    of the Committee, thank you for the invitation to testify
    before you today on behalf of the National Credit Union
    Administration on the enforcement of the Bank Secrecy Act.
        Congress enacted the BSA to prevent credit unions and other
    financial institutions from being used as intermediaries for
    the transfer or deposit of money derived from criminal
    activity. NCUA is the regulatory authority that monitors
    federally insured credit unions for compliance with the BSA.
        I am pleased to report to the Committee that federally
    insured credit unions have a good record of compliance with the
    requirements of the BSA. Credit unions are also substantially
    in compliance with Sections 314, Information Sharing, and
    Section 326, Customer Identification Program, of the USA
    PATRIOT Act.
        At the end of 2003, NCUA insured 9,399 credit unions.
    Almost 50 percent of federally insured credit unions have
    assets less than $10 million. These credit unions are less
    likely to have transactions that trigger the recordkeeping and
    recording requirements of the BSA. Additionally, approximately
    one-third of Federal credit unions have a single common bond
    sponsor. Officials in smaller credit unions often have a more
    intimate understanding of their members' transactions, which
    facilitates their compliance with the requirements of the BSA.
    Consequently, money laundering has not been a major problem for
    credit unions.
        Nevertheless, much has changed since the terrorist attacks
    of September 11. NCUA recognizes that some federally insured
    credit unions may be targeted by individuals or groups seeking
    to launder money.
        The Federal Credit Union Act requires NCUA to assure BSA
    compliance in federally insured credit unions. Federally
    insured credit unions are required to have BSA compliance
    programs that effectively monitor their daily operations to
    assure compliance with all applicable rules and regulations.
        In fact, the risk-focused examination program used by NCUA
    examiners and State credit union examiners directs that a
    review of compliance with the BSA be completed at every
    examination. All examinations of federally insured credit
    unions completed by a State regulator are reviewed by NCUA
    staff. It should be noted, however, that NCUA does not review
    examinations of privately insured credit unions and does not
    have enforcement authority for BSA compliance in those credit
    unions.
        During the examination of the 7,500 federally insured
    credit unions in 2003, NCUA determined that there were 334
    violations of the BSA. The violations were in 261 credit
    unions, representing 3.5 percent of all credit unions examined.
    The most common violations fell into three categories:
    Inadequate written policy, 63 percent; inadequate customer
    identification program, 8 percent; or
    inadequate currency transaction reporting procedures, 7
    percent.
        Of the 334 violations, credit union officials working with
    an examiner, corrected or agreed to correct 99 percent of the
    violations during the on-site examination.
        In instances when violations at a federally insured credit
    union persist and/or are more severe, NCUA has several options
    to initiate corrective action. They range from a letter from
    the NCUA
    Regional Director to formal administrative action, including
    conservatorship.
        NCUA will use a formal administrative action when necessary
    to correct BSA violations. This has occurred twice in the
    recent past. NCUA placed one institution into conservatorship
    and issued a cease-and-desist order against another.
        NCUA has taken numerous initiatives to address BSA
    compliance in credit unions. These initiatives fall into the
    following
    general categories: Examination program, examiner training,
    compliance examiners, and credit union education.
        In addition to on-site reviews of BSA compliance during
    examinations, NCUA has issued several publications to educate
    federally insured credit unions on BSA and USA PATRIOT Act
    compliance.
        Looking forward, NCUA is committed to maintaining a dynamic
    examination program that will assure federally insured credit
    unions have effective programs in place to minimize the risk of
    money laundering. NCUA will continue to provide guidance to
    federally insured credit unions regarding compliance with the
    BSA.
        Again, thank you, Mr. Chairman, for the opportunity to
    appear before you today on behalf of NCUA to discuss BSA
    compliance in the credit union industry. I am pleased to
    respond to any questions the Committee may have or be a source
    of any additional information you may require.
        Thank you.
        Chairman Shelby. Thank you.
        Mr. Fox.

                      STATEMENT OF WILLIAM J. FOX

             DIRECTOR, FINANCIAL CRIMES ENFORCEMENT NETWORK

                    U.S. DEPARTMENT OF THE TREASURY

        Mr. Fox. Thank you, Mr. Chairman, Senator Sarbanes, and
    distinguished Members of the Committee. I appreciate the
    opportunity to appear before you here today to discuss the role
    that the Financial Crimes Enforcement Network can and should
    play in Bank Secrecy Act compliance and enforcement matters. It
    is truly an honor for me to appear with this distinguished
    panel. As I stated the last time I appeared before this
    Committee, we very much appreciate the leadership and
    commitment and oversight of this Committee and its staff on
    these important issues that are the focus of today's hearing. I
    have prepared a statement and have submitted it for the record,
    and I will keep these remarks very brief.
        FinCEN is the delegated administrator of the Bank Secrecy
    Act. Through that delegation, FinCEN is answerable to the
    Secretary of the Treasury for ensuring that the ultimate goals
    of the Act are achieved. While we eagerly accept this
    responsibility, this responsibility is not ours alone. The
    distinguished ladies and gentlemen on this panel with me today
    and the agencies they represent, as well as other agencies such
    as the Securities and Exchange Commission and the Internal
    Revenue Service, have been delegated responsibility to examine
    financial institutions for BSA compliance.
        Indeed, presently implementation of the Bank Secrecy Act's
    regulatory regime involves eight different Federal agencies and
    three SRO's. This unusual structure is both a strength and a
    weakness. The weaknesses are obvious and sometimes clearly
    manifested. To diffuse responsibility across so many
    bureaucracies can cause, and indeed on occasion has caused,
    inconsistency in application, lack of clarity on purpose, and,
    more importantly, a lack of accountability. However, let me
    submit to you that, if managed properly, this structure can
    also be a strength because it builds upon the existing
    expertise and examination functions of the regulators who know
    their industries best. This structure leverages resources where
    resources would otherwise be completely insufficient and
    possibly duplicative, and the current structure exploits the
    knowledge base, experience, and resources of these disparate
    regulators who, again, know their industries best.
        I view it as FinCEN's responsibility to work with my
    colleagues at this table to help manage this structure, to
    build on the strengths our diverse partners bring to the table.
    In other words, administration of the Bank Secrecy Act means
    oversight, it means coordination, and it means ensuring
    consistency of application.
        When I appeared before this Committee in April, I outlined
    a number of challenges I perceived as I came to learn more
    about FinCEN. In my view, of all of those challenges, there are
    no challenges as important to FinCEN as the proper and
    appropriate implementation of the Bank Secrecy Act's regulatory
    regime. Much of our work has been and is devoted to the goal of
    maximizing industry compliance with that regime. We have new
    leadership of our regulatory team at FinCEN. We have also
    developed some short-term priorities for FinCEN in this area
    and on these issues to better understand the industries we
    regulate, assist our regulator partners in the examination
    process, and to further enhance our own capabilities to enforce
    the regulatory regime we have been asked to administer.
        We also have several ideas on how to better manage and
    coordinate the implementation of this regulatory regime on
    which we will engage our regulatory partners. The specifics of
    those priorities and the ideas that we have are set forth in my
    written testimony so I will not recite them here. What I want
    you to know, Mr. Chairman, is that I clearly understand how
    important this set of issues is to the success of our country's
    anti-money laundering and counter-
    terrorism finance efforts, dare I say it, to our country's
    security. The implementation of this risk-based system is a
    delicate matter that demands balance, consistency, and clarity.
        For example, the cornerstone of the Bank Secrecy Act,
    suspicious activity reporting, requires financial institutions
    to make judgment calls. If we fail in properly implementing
    this regime, if we get it wrong, the entire system fails. In
    other words, if as regulators we do not keep our focus on the
    implementation of appropriate anti-money laundering programs
    that generate proper reporting, there could be two equally
    unacceptable outcomes. Compliance, for example, is not about
    second-guessing individual judgment calls made by financial
    institutions whether a particular transaction is suspicious. If
    we go down that path, financial institutions as small ``c''
    conservative institutions will merely file on everything to
    protect themselves from regulatory risk. If, on the other hand,
    we are too lax when it comes to ensuring institutions or
    implementing these programs, proper reporting simply will not
    be generated. Either scenario represents a failure of
    implementation, in my view.
        Mr. Chairman and distinguished Members of this Committee,
    you should know that you have my commitment and the commitment
    of the women and men of FinCEN to do all in our power to ensure
    the appropriate and robust implementation of this critical
    regulatory regime. We appreciate this Committee's continued
    support and focus on these critical issues. Again, I appreciate
    very much the opportunity to be here today, and hopefully our
    presence here will add to this important conversation.
        I will be happy to answer any questions the Committee may
    have.
        Chairman Shelby. Thank you. I thank all of you.
        We have all heard former President Reagan's statement:
    ``Trust, but verify.'' What I fear here is that there has been
    a lot of trust and no verification for many years.
        Mr. Hawke, for the record's sake here, would you indicate,
    the first BSA compliance issue at Riggs, when it was noted by
    an OCC examiner? And when was final action taken with respect
    to the particular BSA compliance problems, in other words, the
    gap there, beginning to the end?
        Comptroller Hawke. I have reviewed the record back to 1997,
    Mr. Chairman, and in 1997, we noted certain shortcomings in
    their compliance program.
        Chairman Shelby. What did you do about it?
        Comptroller Hawke. First of all, we graded their program
    ``satisfactory,'' which in retrospect was clearly not warranted
    in view of----
        Chairman Shelby. In other words, you did not do anything.
        Comptroller Hawke. No. We told them that they had to make
    certain improvements in their Bank Secrecy Act compliance. They
    went through the motions of making those changes, and as we
    came back----
        Chairman Shelby. Did you go through the motions of checking
    them, too?
        Comptroller Hawke. We did. In subsequent examinations, we
    found that they had not fully complied, and we continued to
    push them to do it.
        Chairman Shelby. What did you do about it when you knew
    they had not complied? Nothing?
        Comptroller Hawke. As I said in my oral statement, Mr.
    Chairman, we did not take swift enough and strong enough
    action.
        Chairman Shelby. Could you just for a minute discuss the
    procedures for routine Bank Secrecy Act examinations? Just give
    us a scenario.
        Comptroller Hawke. We have about 40 full-time Bank Secrecy
    Act compliance examiners and a team of about three specialists
    in the Washington headquarters who set policies. In our large
    banks, Bank Secrecy Act compliance is a regular part of the
    ongoing responsibilities of the resident teams at those large
    banks. In those banks where we do not have full-time resident
    teams, Bank Secrecy Act compliance is part of their regular on-
    site examination.
        Chairman Shelby. How many, if you could quantify--and if
    you cannot do it here, do it for the record--violations did you
    pick up at Riggs? There had to be a lot of them.
        Comptroller Hawke. There were plenty of violations at
    Riggs.
        Chairman Shelby. Over many, many years, right?
        Comptroller Hawke. At the beginning of the process, the
    violations were inadequate control systems, inadequate
    training, and the like. As we developed further familiarity
    with that program, it was clear that the violations included
    failure to file suspicious activity reports in situations where
    they were called for.
        Chairman Shelby. Would it be fair to say that the scrutiny
    of the BSA was in name only? In other words, there is not a lot
    of verification, there is not a lot of compliance? Seven years'
    worth of violations and nothing really happened.
        Comptroller Hawke. I am not sure I would characterize it
    quite that way.
        Chairman Shelby. Close to it?
        Comptroller Hawke. I think the problem, Mr. Chairman, was
    not that we were not identifying shortcomings in their
    compliance program. We were. We were insufficiently robust in
    assuring that they were correcting those----
        Chairman Shelby. In other words, you did not do anything
    about it, just plain English.
        Is that right?
        Comptroller Hawke. We did not take swift enough action or
    strong enough action.
        Chairman Shelby. Okay. If we know this has gone on at Riggs
    under your supervision, as you are the Comptroller of the
    Currency, how many other hundreds of thousands, perhaps, of
    exam reports in your files which document serious and
    unaddressed BSA compliance issues at national banks throughout
    the country? Does that concern you?
        Comptroller Hawke. It certainly is an appropriate question.
    I do not have any reason to think that Riggs represents a
    systemic problem. But I have directed----
        Chairman Shelby. But you do not know that.
        Comptroller Hawke. I have directed our Quality Management
    Division to make exactly that kind of inquiry and to report
    back to me on it.
        Chairman Shelby. Mr. Hawke, in addition to the Saudi and
    Equatorial Guinea accounts, Riggs held numerous other foreign
    accounts, including what many characterize as what we would
    call high-risk by FinCEN and OFAC. They include, among others,
    Burma, Cuba, the Sudan, Iraq, Iran, Syria, and Nigeria. If
    Riggs' BSA/AML internal controls were so deficient, which is a
    given, should we be concerned, in other words, should you be
    concerned that many of these other embassy and special interest
    accounts could suffer similar inadequacies and violations?
        Comptroller Hawke. That is certainly a concern, and we have
    been addressing that concern in a number of ways over the last
    year and a half.
        Chairman Shelby. Will you give us a report to the Committee
    on what you have done, especially in these particular ones we
    have raised here?
        Comptroller Hawke. I would be happy to, Mr. Chairman.
        Chairman Shelby. Senator Sarbanes.
        Senator Sarbanes. Thank you very much, Mr. Chairman.
        Mr. Fox, you are the Administrator of the Bank Secrecy Act.
    Is that correct?
        Mr. Fox. Yes, sir.
        Senator Sarbanes. When did FinCEN learn of the problems at
    Riggs Bank?
        Mr. Fox. I believe the first we learned of the problems at
    Riggs Bank from the Comptroller's office was in June 2003.
        Senator Sarbanes. June 2003?
        Mr. Fox. I believe, yes.
        Senator Sarbanes. Well, now, we just heard in response to
    the questions from Chairman Shelby that the Comptroller's
    office, as I understand Mr. Hawke's answer--and he can correct
    me--had identified shortcomings at Riggs as early as 1997. Is
    that correct?
        And the first you knew as the Administrator of the Bank
    Secrecy Act, that there were such shortcomings, was when in
    2003?
        Mr. Fox. June 2003, Senator. That is what I am told. I was
    not there at FinCEN at the time, but that is what I am told.
        Senator Sarbanes. You are the Administrator of this Act. Do
    you not think there is something amiss when these shortcomings
    are being identified and you are not told about it?
        Mr. Fox. I actually think, sir, that we have a
    responsibility to engage our regulator partners to make sure
    that this communication is occurring on a regular and
    consistent basis.
        Senator Sarbanes. Am I to take it from that answer that to
    your perception the same possibility would exist with respect
    to the other agencies? There is no established reporting
    procedure which lets you, as the Administrator of the Bank
    Secrecy Act, know at a fairly early point that these regulators
    have discovered deficiencies in the workings of their financial
    institutions with respect to the Bank Secrecy Act?
        Mr. Fox. What I have found, Senator, since I have been
    there, is that communication occurs on an ad hoc basis, and I
    believe that that is not a wise course to follow. I believe
    that it should be routinized and we should have better, more
    established, consistent channels of communication if we are
    going to administer the Act effectively and efficiently.
        Senator Sarbanes. Let me ask the panel: When was the last
    time those on the panel, the regulators, including the
    Administrator of the Bank Secrecy Act, from the Treasury, Mr.
    Fox, met together to discuss and review programs and policies
    for coordination of the application of the Bank Secrecy Act?
        Mr. Fox. Sir, we had a meeting. I believe it was as
    recently as last month. It might be the month before. I can get
    you the exact date if you like. We have a group that we call
    affectionately, the SAR owners group, which includes all of the
    bank regulators, the functional regulators, and we met for an
    afternoon at FinCEN, and discussed just a number of issues that
    relate to this.
        Senator Sarbanes. And this included the people at this
    table?
        Mr. Fox. No, sir. It was their staff that handled these
    types of issues for them.
        Senator Sarbanes. Let us take it a level above you and go
    to the Secretary of the Treasury. Are you the administrator by
    delegation from the Secretary of the Treasury?
        Mr. Fox. Yes, sir.
        Senator Sarbanes. When was the last time, Ms. Bies, that
    you and these other top regulators here, and the Secretary of
    the Treasury--although if he sent Mr. Fox, I will accept that
    for the moment--met in order to discuss Bank Secrecy Act
    matters?
        Ms. Bies. Senator, I have not had such a meeting. I am not
    aware whether any of the other governors have. I can follow up
    on that and let you know.
        Senator Sarbanes. Are you the governor that is the point
    person----
        Ms. Bies. I chair the Committee on Supervision Regulation,
    so it would be--I would probably be the one, and I have not had
    such a meeting at that level.
        Senator Sarbanes. Mr. Hawke.
        Comptroller Hawke. I am not aware of any meeting during my
    tenure, Senator Sarbanes, of principals to discuss Bank Secrecy
    Act matters.
        Senator Sarbanes. Mr. Powell.
        Chairman Powell. Two meetings, Senator. First of all, Vice
    Chairman Reich met with Mr. Fox about, I am guessing, 3 to 4
    weeks ago to discuss this particular issue. Then I met with----
        Senator Sarbanes. Four weeks ago?
        Chairman Powell. Three to 4 weeks ago. I met with the
    Secretary of the Treasury within the last 10 days. Among other
    things, we talked about BSA.
        Senator Sarbanes. Now, that was just between you and them
    though. It was not a general meeting of the regulators?
        Chairman Powell. It was not a general meeting.
        Senator Sarbanes. It seems to me that you all might
    presumably learn something from one another in this arena.
        Mr. Gilleran.
        Director Gilleran. FinCEN is involved in all 7 of our
    cease-and-desist orders that have culminated from our
    examinations in the last year, and our people have met with
    FinCEN on several occasions in a formal way. I myself have not
    participated personally.
        Senator Sarbanes. Ms. Johnson.
        Ms. Johnson. I am not aware of a formally organized meeting
    that may have been attended by Former Chairman Dollar and then
    by myself.
        Senator Sarbanes. Is it an outlandish idea to think that a
    coordinated meeting of the regulators and FinCEN with respect
    to the Bank Secrecy Act on some periodic basis would be a good
    idea?
        Chairman Powell. It is a good idea, Senator.
        Comptroller Hawke. I completely agree, Senator. I think
    sharing information and experiences at the principal level
    would be very useful.
        Senator Sarbanes. Mr. Chairman, I have other questions, but
    my time is up, and I will yield.
        Chairman Shelby. We have another round.
        Senator Reed, thank you for your indulgence.
        Senator Reed. Thank you, Mr. Chairman, and thank you for
    your testimony, ladies and gentlemen.
        Mr. Hawke, why were criminal charges not brought in this
    matter with respect to Riggs? Is there a provision to allow
    criminal charges?
        Comptroller Hawke. Senator Reed, Riggs is a matter of
    ongoing investigation, and I think I need to be rather
    circumspect in talking about what may be coming out of the
    ongoing discussions relating to Riggs.
        Senator Reed. Fine. There is a general question you might
    also want to be circumspect. That is, the motivation behind
    these violations, which are rampant over many years. It would
    be one thing if it was just inattention or, lax recordkeeping.
    It would be something else if it was just designed to avoid
    regulation to induce business, and a third category, obviously,
    if there was some malign motive of cooperating with people who
    are criminals or worse. I do not know if you want to comment on
    that?
        Comptroller Hawke. Yes, I would like to comment on that,
    Senator, because Riggs was not an unsophisticated country bank.
    They were a long-established, significant bank in the Nation's
    Capital. As I look back over the record and ponder the same
    kind of question that you have raised, it seems to me that
    there was an inherent tension involved in Riggs' business
    objective, which was essentially to monopolize the embassy
    banking business. They had 95 percent of the embassies in
    Washington, 50 percent of the embassies in London, and they put
    a very high degree of importance on that business. But that was
    a very high-risk business from a Bank Secrecy Act point of
    view. There was an inherent conflict, an inherent tension
    between that business objective and the responsibility for
    robust compliance with the Bank Secrecy Act.
        Senator Reed. Thank you.
        Governor Bies, there is another related case, and that is
    UBS Investment Bank of Switzerland with respect to the extended
    custodial inventory program. A $100 million fine, I presume a
    civil fine?
        Ms. Bies. Yes, it was a civil fine, yes, sir.
        Senator Reed. Is there any contemplation of criminal
    charges?
        Ms. Bies. I think I again need to be circumspect around
    that right now while we continue to get the full information.
        Senator Reed. Let me pose the same question I posed to Mr.
    Hawke. What is your sense of the motivation, given there are a
    range of motives and some of them are, none of them are
    acceptable, but some are more serious and sinister than others.
        Ms. Bies. Again, I do not want to comment on the motives.
    The only thing I will comment is that when you have collusion
    to manage the information that comes to the Federal Reserve,
    there is some kind of intent, and that also the collusion made
    it difficult for us to detect it, and as a result of this we
    are looking; we have already changed procedures, and we are
    going in to test those procedures in the future to try to see
    if there is a way we could have detected this despite the
    collusion.
        Senator Reed. Thank you, Governor Bies.
        Mr. Gilleran, the GAO report, at least my understanding of
    it, suggests that in a survey of 986 thrifts from January 2000
    to October 2002, they discovered BSA violations at 180, which
    seems to be almost 20 percent. That causes you concern?
        Director Gilleran. It certainly does, and we have responded
    to that report, and we are appreciative of their comments in
    this area, and we have adjusted our system accordingly. We have
    improved our information system and that period of time was
    prior to the USA PATRIOT Act, and the focus of course now is
    much greater, but I think that review was a good one for us,
    and we are now presently being reviewed by the GAO also in the
    same area. I think outside reviews are helpful.
        Senator Reed. Thank you. The obvious question that I will
    just pose to the panel, is there any legislative authority that
    you need in addition to the existing statutes to better
    coordinate, better implement, and better enforce? I say that
    because I spend time on the Armed Services Committee also and
    we spend a lot of hours on the war, on terror and threats to
    the Nation. And you might have a more decisive role in
    frustrating attacks against America than many of our uniformed
    officers, if you can control the monies.
        Ms. Johnson.
        Ms. Johnson. Senator, there is one area that NCUA would
    have interest in. The Exam Parity Act of 1998 gave NCUA
    authority to perform examinations of third-party vendors, and
    the Act contained a sunset provision, and that authority
    expired in December 31, 2001. The other regulators do have that
    indefinite examination authority over third-party vendors, and
    that may be helpful.
        Senator Reed. Thank you.
        Comptroller Hawke. Could I just add something, Senator
    Reed?
        Senator Reed. Yes, sir.
        Comptroller Hawke. The legal requirements that we as
    regulators enforce are very far-reaching and very demanding.
    They go essentially, though, to process, to the maintenance of
    control systems, to training, to the maintenance of compliance
    officers, to the filing of currency transaction report, and the
    filing of suspicious activity reports.
        I think those statutes provide a very strong framework for
    the regulators to assure, if they are carrying out their
    responsibilities properly, that the banks, which have the
    primary information about transactions, are doing their job in
    identifying who their customers are, knowing what kinds of
    transactions are going through their accounts, and filing all
    the appropriate reports. It is the job of law enforcement to
    take the output of that process and to determine whether there
    are actual money laundering transactions or terrorist financing
    transactions that are going through the system.
        I think that the statutory framework is strong and adequate
    if we fulfill our responsibilities and the banks fulfill theirs
    in meeting the requirements to have the right kind of controls,
    to have the right kind of systems, and to do the right kind of
    reporting.
        Senator Reed. Thank you.
        Thank you, Mr. Chairman.
        Chairman Shelby. Thank you, Senator Reed.
        Director Gilleran. Just to respond further to Senator Reed,
    in my written statement I have made some recommendations for
    increased communications and better flow of information from
    law enforcement back to the institutions we regulate, because I
    think one of the problems here is the institutions do not know
    to what end a lot of the information that they are providing
    results in, and I think that would help them to better focus on
    a problem if they had more feedback.
        At the same time I would like to see, and I think my fellow
    regulators agree, that we should have a working group set up at
    the Federal Financial Institution Council focusing on Bank
    Secrecy Act, and I would like to have FinCEN be part of that. I
    think that is the appropriate forum under which we can all
    communicate.
        But I think enhanced communication of information is very
    important in this process.
        Senator Reed. Thank you, Mr. Chairman.
        Chairman Shelby. Mr. Hawke, as I understand it from talking
    with you yesterday, if someone withdraws, we will just use $1
    million, at Riggs Bank, $1 million in cash. And the bank files
    a notice of that with you, with the transaction report. Is
    there a second step that has to be done dealing with the Bank
    Secrecy Act? In other words, is it a two-step process? Would
    that be a little suspicious, $1 million?
        Comptroller Hawke. I think a $1 million cash transaction
    would inherently raise----
        Chairman Shelby. Should have set off an alarm somewhere at
    the Comptroller of the Currency if you had known.
        Comptroller Hawke. It should have set off alarms at the
    bank, which is the first place that the transaction would be
    noticed.
        Chairman Shelby. Unless the bank perhaps was maybe not
    filing that second report? Was it incumbent upon them to file
    two reports, one the transaction itself, the withdrawal?
        Comptroller Hawke. There are statutory and regulatory
    standards that define the circumstances for filing suspicious
    activity reports, and it is the bank's obligation in the first
    instance to make sure that they are filing suspicious activity
    reports where there is a suspicious transaction.
        Chairman Shelby. So it is a two-step process, was it not?
    That is what I am getting at.
        Comptroller Hawke. That is right.
        Chairman Shelby. The first one they file, and they did
    file, as I understand?
        Comptroller Hawke. That is right.
        Chairman Shelby. But they did not file the suspicious
    activity report, although in some cases there is $1 million in
    cash withdrawn; is that correct?
        Comptroller Hawke. That is correct.
        Chairman Shelby. Mr. Fox, I know there is an ongoing
    investigation, but it suggests to me maybe there is a
    conspiracy or something going on at Riggs. They file one report
    and do not file the others, you know, something is going on in
    the bank. Does that trigger anything with you?
        Mr. Fox. Senator, I agree that $1 million cash transaction
    generally should set off alarms, and I think it does at most
    institutions if such transactions occur. I really cannot
    comment on what----
        Chairman Shelby. I know, not on an ongoing investigation.
        Mr. Fox. Yes, sir.
        Chairman Shelby. Mr. Hawke, as you fully confident as we
    speak today, after looking back in the Comptroller of the
    Currency's Office, that your examiners fully understand the
    significance of BSA compliance? We know they understand the
    safety and soundness compliance, which is important.
        Comptroller Hawke. Senator, if they do not understand it
    today, we have a very serious problem. I think they do. We have
    emphasized it repeatedly. We are in the process of revising our
    examination handbook for Bank Secrecy Act. I directed our
    Committee on Bank Supervision to send out a very strong message
    to all of our examination personnel to reemphasize the
    importance of Bank Secrecy Act compliance and the need for
    transaction testing and the need to be extremely cautious and
    sensitive about identifying transactions that raise questions.
        Chairman Shelby. Governor Bies, how many cases, if any, has
    the Federal Reserve referred to FinCEN in the past year?
        Ms. Bies. Total number of cases I may have to get back to
    you, sir.
        Chairman Shelby. I heard it was zero, that it was no
    referrals.
        Ms. Bies. No, that is not true. That is not true. We have a
    good working relationship. We have the history of the 25 cases
    I cited. We actually referred cases to FinCEN, and in some
    cases they took formal action.
        Chairman Shelby. Will you furnish that to the Committee?
        Ms. Bies. We will get you a list, yes, sir.
        Chairman Shelby. What criteria is used in determining
    whether to refer a case to FinCEN from let us say the Board of
    Governors of the Fed?
        Ms. Bies. When we go in and do the testing as part of the
    examination procedure, we will look at the facts that we find
    and determine the violations. Sometimes also, I want to
    emphasize that the tests we perform, since they are samples, we
    may not detect the errors, but that is why it is so important
    we work with FinCEN and law enforcement because like in Banco
    Popular, they gave us a heads up on particular customers that
    we could then target for this testing, and were able to work
    with them to prove the case. So the information sharing is
    critical with law enforcement, both Department of Justice as
    well as FinCEN, to make sure we are effective jointly, because
    together we can find more than individually working.
        Chairman Shelby. Mr. Fox, do you recall any referrals from
    the Federal Reserve to FinCEN?
        Mr. Fox. Senator, I would like to get back to you with that
    number, particularly based on the Governor's comments. I just
    would like to get back and make sure we do not leave anything
    incorrect.
        Chairman Shelby. That what you told us before is right?
        Mr. Fox. Yes.
        [Laughter.]
        I want to be right, sir.
        Chairman Shelby. Mr. Fox, has FinCEN ever encountered
    resistance from bank regulators to the kind of communication
    you believe is essential to your mission of law enforcement?
        Mr. Fox. Sir, since I have been an FinCEN, absolutely not.
    In fact, one of the gratifying things that has occurred for me
    since I have been at FinCEN, since December 2003, is the
    willingness of the staff of the regulators to engage in this
    way.
        I think we are working on these issues and working on them
    hard, and I think this is getting better. That is my
    perception. I cannot speak about the past.
        Chairman Shelby. To all you as regulators, since September
    11, 2001, what has changed? Have you become more aware of the
    importance of terrorist financing and so forth? In other words,
    what have you done since September 11, 2001?
        Comptroller Hawke. Mr. Chairman, I think that the awareness
    of not only the regulators, but also everybody in Government
    has been significantly heightened since September 11. There are
    a number of supervisory actions that we have taken in this area
    including horizontal reviews of all of our large bank
    compliance programs, as well as many of the mid-size bank
    compliance programs. As I said before, we have revised our
    examination procedures, and our examination handbook. We are
    creating a database of SAR's. We are redoing a lot of things
    that have commended themselves to us because of the awareness
    that came from September 11.
        Chairman Shelby. Mr. Hawke, is there written guidance for
    examiners on when to refer violations to FinCEN? I would ask
    Mr. Powell and Mr. Gilleran the same question.
        Comptroller Hawke. I believe there are referral guidelines,
    Mr. Chairman, and those guidelines generally provide for
    referral of systematic serious violations to FinCEN.
        Chairman Shelby. Would this be true of the Board of
    Governors?
        Ms. Bies. Yes, sir.
        Chairman Shelby. Mr. Powell, the FDIC?
        Chairman Powell. Yes, sir. May I comment on your earlier
    question?
        Chairman Shelby. Absolutely.
        Chairman Powell. Obviously, I think there is a heightened
    awareness. We have dedicated more personnel. We have adopted
    new policies, and new procedures. Training is intensified. Let
    me make a couple of comments.
        I think policies, controls, oversight, testing, training
    are terribly important. I think it is important, in the line of
    questioning, that we fill in the box and that we make the
    appropriate reference to law enforcement. All those are
    critically important. But I do not think it is as important as
    the culture or the oversight of management. I think until
    management is committed, including the regulatory agencies----
        Chairman Shelby. At the top.
        Chairman Powell. It is a mindset, a proactive commitment.
    The procedures are important, but not like the attitude in our
    culture at the top.
        Chairman Shelby. Governor Bies.
        Ms. Bies. Mr. Chairman, I would like to echo what Mr.
    Powell just said, and to emphasize that at the Federal Reserve,
    one of the things we really focus on in terms of the quality
    assurance around our examination procedures is when we do find
    breaks in controls, that we take it very seriously and go back
    and say, what could we have done better, and improve it.
        For example, after Banco Popular, we went back and made
    significant changes in the way we were reviewing money
    laundering, the Bank Secrecy Act, and have put those changes in
    place.
        For the USA PATRIOT Act for those different parts of it
    where the required rules have been issued, we have already
    drafted new examination procedures. They are out in pilot,
    being actively tested by our examination force now to make sure
    they will be effective and have the intended results. We will
    adjust them if they do not get the results we are expecting. We
    just view this as a continuous process that every one of these
    events reminds us there are new ways that people are finding to
    use the banking system for illicit purposes, and whenever we
    find another way it is done, it is our job to respond promptly
    and make sure that is added to the arsenal of information that
    our examiners have out in the field to deal with this promptly.
        Chairman Shelby. Mr. Fox, how can you be sure that the
    banking regulators are referring violations to you under
    consistent criteria; how do you do that?
        Mr. Fox. Mr. Chairman, I think we have an agreement that
    was signed in 1990, or it may even have been signed before
    FinCEN became a bureau, certainly before it became the
    Administrator of the Act. Sir, that agreement needs to be
    revisited and along with our colleagues at the table here we
    need to come up with some pretty set criteria and guidelines so
    that we are all working from the same page.
        But I think again, sir, I would answer your question
    directly in saying that the best thing that we can do is engage
    these regulators. They are doing, from our perspective, very
    good work out there, and I think it is our responsibility to
    keep, if anything, maybe even be annoying at times, to keep
    reminding them that this is important and that we need to
    communicate and we need to do this in a right way. I think that
    is the best and most effective way to do it under this current
    system.
        Chairman Shelby. Senator Sarbanes.
        Senator Sarbanes. Thank you very much, Mr. Chairman.
        I have to say to the panel, I do not perceive a sense of
    urgency in dealing with this matter. I appreciate that the bank
    regulators have had a traditional focus on safety and
    soundness. And I understand that if something went wrong with
    safety and soundness, we would have you in here at the table
    and saying, ``Why did you not meet your mission? Here we have
    had a breakdown in safety and soundness and it is affecting the
    whole financial system.''
        But these compliance questions are important as well. Now,
    some of them involve a lot of consumer protection and I am not
    going to move over into that arena, although that is an arena
    that I think is quite important, and I think there has been a
    tendency on the part of the regulatory agencies not to give it
    appropriate focus and attention and importance. But Bank
    Secrecy Act compliance could well go to some basic question of
    our Nation's security.
        The Army announced today that they are going to keep
    thousands of active duty and reserve soldiers who are nearing
    the end of their volunteer service commitments, they are going
    to keep them in and have them serve an entire tour overseas. So
    it is really being transformed from a voluntary service into
    mandatory service. Now, the Army is under a lot of stress,
    which is resulting in this, but I mean, in a sense, emergency
    measures are being taken all over the place.
        And dealing with money laundering and terrorist financing
    is of critical importance. Now, we did not pay enough attention
    to it before. We had drug cartels, we had crime syndicates
    using money laundering and so forth. Great resistance. The
    Justice Department came to us, when we did the USA PATRIOT Act
    and wanted this title and a lot of the authorities which
    previously they had not been able to obtain. It is clear why.
        Some banking institutions come to us and say that clients
    are moving to off-shore jurisdictions because they have to go
    through these procedures here. Apparently they want to move hot
    money, and they go somewhere else in order to try to do it,
    which of course leads to the question of who is responsible for
    interacting in order to curb what is being done in other
    jurisdictions.
        But we have to devise a way for compliance to have a higher
    status, and I am trying to figure out how that can be done
    while at the same time, you can continue to ensure safety and
    soundness. Let me ask a couple of questions.
        First of all, I take it from the responses we have already
    received that the Treasury Secretary, interacting with the head
    regulators who are here today, could establish periodic
    meetings to consider the application of the Bank Secrecy Act
    and how to enhance its enforcement with respect to all of the
    financial institutions; is that correct? We do not have to pass
    legislation in order for that to happen; is that correct?
        [Witnesses nodded affirmatively.]
        I also gather most people think it is a good idea. I see
    everyone nodding.
        Mr. Fox, would you go back and tell Treasury Secretary Snow
    of this conversation we had here and see if we can get such a
    first meeting underway and then subsequent meetings to follow
    up? I mean, there is a lot of exchange that can take place here
    that I think will enhance the application of the Act. This is
    an important matter--I keep coming back to it--in the fight
    against terrorism.
        Mr. Fox. You have my word, sir, I will do that. I agree
    with you.
        Senator Sarbanes. Yes, okay.
        Now, I want to ask about the subordination of the
    compliance function at the various agencies to the safety and
    soundness examiners. The Fed maintains separate Safety and
    Soundness and Compliance Divisions, and that seems to me to
    give an extra impetus or focus to compliance and enables the
    development of enhanced expertise in that arena. I mean, the
    Safety and Soundness people have plenty to do in and of itself,
    and I think if you put the Compliance people under them, you
    may have a bit of a problem or maybe you will have quite a big
    problem.
        Now, as I understand it, the Compliance examiners at the
    other agencies have now been placed under the Safety and
    Soundness structure; is that correct?
        Director Gilleran. That is not true at the OTS.
        Senator Sarbanes. It is not true at the OTS?
        Director Gilleran. No.
        Senator Sarbanes. You have a separate Compliance Division?
        Director Gilleran. No, we have cross-trained, and therefore
    we see no distinction between Compliance and Safety and
    Soundness. We think that Compliance is part of Safety and
    Soundness. We have cross-trained our people so that they are
    completely able to do the compliance work, as well as safety
    and soundness work. We think that is the proper way to both
    train people and to carry out the examination process.
        Senator Sarbanes. Mr. Powell.
        Chairman Powell. Ours is separate, as you know, Senator.
    But one comment. I want to be sure I do not mislead you. BSA is
    part of the safety and soundness exam at the FDIC, and the
    reason for that is that we believe our BSA people should be
    trained more than in just the compliance effort, understand the
    bank operations, the assets and the liabilities. We found that
    terrorists sometimes get loans and just do not pay them back.
    So the BSA is part of the safety and soundness examination. The
    examiner are uniquely and specially trained. As I mentioned in
    my testimony, we have specialists. We have 150 of them at the
    FDIC that do nothing but the BSA work.
        Senator Sarbanes. Well, with respect to both of you, does
    this response also apply to the other laws in which you have a
    compliance responsibility?
        Chairman Powell. No, sir. We have specialists in compliance
    that are specialists in consumer laws and other related
    compliance laws.
        Senator Sarbanes. Are they under the safety and soundness
    people?
        Chairman Powell. They are under the Division of Supervision
    and Consumer Protection. We have a safety and soundness
    section, and we have a compliance section.
        Senator Sarbanes. And the OCC?
        Comptroller Hawke. I do not think it is accurate, Senator
    Sarbanes, to say that compliance supervision has been
    subordinated to safety and soundness supervision. We have, as
    the other agencies do, specialists in the compliance area, and
    each one of our banks has an examiner in charge. The examiner-
    in-charge of each of the 24 largest banks is responsible for
    all aspects of supervision of that bank. He will have Safety
    and Soundness people reporting to him, he will have Compliance
    people, he will have Asset Management people and IT people all
    reporting to him. So, at the top of the pyramid, with respect
    to any one of our large banks, there is a single point of
    accountability who will have responsibility both for safety and
    soundness and compliance.
        One other point, Senator Sarbanes, the nature of the
    responsibilities that we have in the Bank Secrecy Act
    compliance area is procedural and process-oriented, very much
    the same as the nature of the responsibilities we have in the
    safety and soundness area. Our examiners look at the adequacy
    of systems, the adequacy of controls, the adequacy of training.
    It is the same kind of methodology that is brought to bear on
    the safety and soundness side. So there is a great deal of
    similarity between the two disciplines.
        Senator Sarbanes. Well, now, as I understand it, the OCC
    recently realigned its compliance organizational structure; is
    that correct?
        Comptroller Hawke. We did not really realign it. We
    eliminated an intermediate level of management and replaced
    them with compliance experts in that chain of command.
        Senator Sarbanes. Well, now in the directive sent out by
    your Deputy Comptroller for Compliance, where they say you are
    going to ``closely align our Compliance Program with our Safety
    and Soundness Program,'' and then you move the Compliance field
    examiners to report to the ADC's in the field offices. That is
    a change.
        Comptroller Hawke. Right. That is with respect to the
    community banks. With respect to the large banks, as I
    described, it is the examiner-in-charge of the large bank who
    has the consolidated responsibility for all aspects of
    supervision: safety and soundness, compliance----
        Senator Sarbanes. And then let me go on. That same memo
    says, and I am concerned about this, ``Given the changes that
    are occurring in the banking industry, we anticipate that the
    number of field compliance specialists and ADC's at the Band 7
    level will in the future exceed the volume of traditional
    compliance work at that level. Therefore, we are offering
    buyouts to the Compliance examiners and Compliance ADC's who
    occupy Band 7 positions.''
        Now, at a time when the OCC seems to be taking on more
    compliance responsibilities, both Bank Secrecy and Consumer
    Protection, it is not quite clear to me how you can be buying
    out your Compliance examiners, in terms of meeting your
    responsibilities.
        Comptroller Hawke. We are not reducing the number of
    Compliance people that we have in the organization as a whole,
    Senator Sarbanes, and we are trying to promote, as Chairman
    Powell and Director Gilleran indicated, the broadening of the
    expertise of our examiners, generally.
        Senator Sarbanes. Let me ask, do you have----
        Comptroller Hawke. We do not intend to reduce the number of
    Compliance examiners.
        Senator Sarbanes. Then, that has not happened? You are not
    buying out Compliance examiners?
        Comptroller Hawke. No. I am not sure which memo you are
    reading from, Senator.
        Senator Sarbanes. It was a notice sent in March 2004 by Ann
    Jaedicke, Deputy Comptroller for Compliance.
        Comptroller Hawke. We put out a memo in May 2004,
    describing what was going on with respect to compliance, and we
    made very clear in that memo that we do not intend to reduce
    the number of Compliance examiners.
        Senator Sarbanes. Could you furnish us a copy of that memo.
        Comptroller Hawke. Yes, sir. I would be happy to.
        Ms. Bies. Senator Sarbanes, can I respond to the comment? I
    did not have a chance.
        The one thing I would like to point out, in the Federal
    Reserve System, we created, in 1993, at the Board level, a
    group, an officer who was really responsible for all of the BSA
    and anti-money laundering supervision, and we have expanded
    that group as need has occurred over the last few years.
        The reason we have specialists within Supervision and
    Regulation at the Board is to help design the policies and help
    us identify when there are weaknesses that need to be addressed
    out in the field exams. Within the Reserve Banks, which is
    where our examiners reside, is each of the 12 Reserve Banks,
    the examiners are part of the supervisory group within that
    Reserve Bank.
        But these, as we have gone from just money laundering with
    criminal activity to now bank secrecy, where you are involving
    maybe activities that go through legitimate funding sources
    that end up in terrorist hands, it gets more and more difficult
    to identify the sources of funding. And so one of the things we
    are trying to do is to work aggressively with law enforcement
    to help identify back to the banks where there are particular
    cases, whether they need to do follow-up.
        So it is really a team effort. It is identifying policy and
    procedures at the Board level, using that to strengthen the
    activities in the Reserve Banks, and then work in the field by
    the examiners also giving us indications back up to the top
    where the supervisory process needs to change. But it is
    integrated within the overall supervision for the Bank Secrecy
    Act anti-money laundering. It is all within our supervisory
    responsibility of the Division of Banking Supervision and
    Regulation.
        Senator Sarbanes. That is very helpful. Thank you.
        Chairman Shelby. Is there a set number of warnings that a
    financial institution receives, Mr. Hawke? In other words, is
    there a number of years that generally pass between an initial
    warning regarding a BSA compliance and imposition of a penalty?
        Comptroller Hawke. No, not at all, Senator. I think that is
    an issue that has to be decided in each case. Clearly, in the
    Riggs case, we gave them too much latitude over too long a
    period of time.
        Chairman Shelby. Trusted them too much?
        Comptroller Hawke. Well, it is not so much that we trusted
    them too much. We were insufficiently----
        Chairman Shelby. Wait a minute now. Are you saying you did
    not trust them? I thought you told me before, and others have
    said, that a lot of the relationship with a bank is trust.
        Comptroller Hawke. In the Riggs case, it was not a question
    of our trusting the management. We saw things that needed to be
    fixed. We told them that they had to be fixed. Where we were
    guilty of a shortfall in not coming in robustly and soon
    enough.
        Chairman Shelby. There was no follow-through, in other
    words, by the Comptroller of the Currency's Office, basically;
    is that correct?
        Comptroller Hawke. The follow-through was not strong enough
    early enough.
        Chairman Shelby. Well, did it exist at all?
        Comptroller Hawke. We eventually----
        Chairman Shelby. No, I mean from 1997 until recently, did
    it exist?
        Comptroller Hawke. Eventually, it did. In 2003, we issued a
    cease-and-desist order. We waited too long to do that.
        Chairman Shelby. Six years.
        Comptroller Hawke. We should have taken stronger action
    earlier. There is no question about that.
        Chairman Shelby. Chairman Powell, briefly, the Hudson
    United Bank Corporation, one of the most recent BSA-related
    cease-and-desist order involves the Hudson United Bank of New
    Jersey. Would you briefly walk us through the history of this
    case. What was the FDIC's role in determining what measures
    would be taken in responding to information pointing to
    Hudson's failure to comply with the Bank Secrecy Act? What was
    your agency's assessment of Hudson's risk prior to detection of
    its failure to comply with the Bank Secrecy Act?
        Chairman Powell. I am not sure I can answer those,
    specifically, Mr. Chairman, but I can tell you that I have been
    briefed on that particular issue within the last 30 days. I
    think our people were very aggressive in assessing the
    enforcement action against that particular institution, after
    findings that had occurred over the last 12 to 24 months.
        Chairman Shelby. Mr. Fox, in the past here, in the
    Committee, and Senator Sarbanes has been here longer than I
    have, and this is my 18th year, but I can tell you in the past
    we have addressed the issue of regulatory forbearance as it
    related to the solvency of bank safety and soundness.
        We learned the hard way right here, and the regulators
    learned, too, that when regulators let banks that were in
    trouble get by, when those banks later failed, it cost the U.S.
    taxpayers billions and billions of dollars.
        What is your view with respect to the dangers of regulatory
    forbearance in BSA compliance cases?
        Mr. Fox. Oh, it cannot even enter the conversation, Mr.
    Chairman. I believe that the information collected under the
    Bank Secrecy Act is absolutely critical to the security of our
    country.
        Chairman Shelby. That is right.
        Mr. Fox. And I will tell you something that I hope is
    heartening. It has been my perception, since I have been at
    FinCEN, I have not seen any such regulatory forbearance among
    these regulators, but I do not think we could ever be in a
    situation where we would allow something like that to happen.
        Chairman Powell. Senator, I think the bank regulators----
        Chairman Shelby. Chairman Powell.
        Chairman Powell. I am concerned, to some extent. I think
    that bank regulators and the industry we supervise recognize
    this is national security. Safety and soundness is one issue,
    but this is equal or superior to safety and soundness--the
    national security of this country. And I think there is
    heightened oversight on the BSA.
        Chairman Shelby. A high priority.
        Chairman Powell. Absolutely. I think bankers, I would not
    underestimate the seriousness of the BSA enforcement. It is a
    national security issue. It is lives and deaths. The other is
    dollars. And I think, clearly, our resolve is very strong that
    we enforce the Bank Secrecy Act.
        Chairman Shelby. But when there is a 6-year lapse there,
    that is more than troubling.
        Senator Sarbanes, do you have any other comments?
        Senator Sarbanes. I do not think so.
        Chairman Shelby. I want to thank the panel, all of you, for
    your time and your participation. We have a number of questions
    for the record, and we have some Members that are tied up in
    other hearings, and we will keep the record open for that.
        Mr. Fox, all of you, thank you very much.
        Senator Sarbanes. Mr. Chairman, I think, as they depart, we
    should leave them with a message that this is a matter which, I
    presume, the Committee intends to follow very closely, given
    its importance.
        Chairman Shelby. Absolutely. We have no choice in our
    oversight, as we know. This is important, and we are expecting
    Mr. Fox, and we believe that he is going to be working with you
    very, very closely regarding this.
        Mr. Fox. We welcome that oversight, Mr. Chairman, Senator
    Sarbanes. Thank you.
        Chairman Shelby. Thank you very much, all of you.
        Our second panel will be Gaston Gianni, Jr., Inspector
    General, the Federal Deposit Insurance Corporation, and Ms.
    Davi D'Agostino, Director, Financial Markets and Community
    Investments, General Accounting Office.
        I want to welcome the second panel. We appreciate your
    forbearance here today. We had some very important witnesses
    here, as you people know well.
        Mr. Gianni, we will start with you. Your written testimony
    has been made part of the record. And without objection, you
    proceed as you wish.

                   STATEMENT OF GASTON L. GIANNI, JR.

                           INSPECTOR GENERAL

                 FEDERAL DEPOSIT INSURANCE CORPORATION

        Mr. Gianni. Thank you, Mr. Chairman.
        Mr. Chairman, Senator Sarbanes, and Members of the
    Committee, I am pleased to testify before you today. We
    appreciate and thank the Committee for its interest in gaining
    a greater understanding of how Government is combatting
    terrorist financing and money laundering.
        What I would like to do is just briefly summarize my
    testimony, having it included for the record.
        By way of perspective, the FDIC Chairman's testimony
    indicated that FDIC has conducted almost 11,000 Bank Secrecy
    examinations since 2000. Over the past several years, in line
    with our
    responsibilities under the Inspector General Act, my office has
    conducted three audits that address the FDIC's efforts to
    design and implement a supervisory program to examine
    institutions' compliance with provisions of the Bank Secrecy
    and then more recently the USA PATRIOT Act.
        Overall, these audits identified that the Corporation has
    taken steps to implement a risk-focused approach to
    examinations. However, improvements were needed. I am pleased
    to report to you this morning that the Corporation has
    corrective actions completed or in process to address all of
    our recommendations.
        We issued our first report, the ``Examination Assessment of
    Bank Secrecy Compliance Act,'' in March 2001 and concluded
    that, first, examiners did not adequately document their Bank
    Secrecy examination planning and procedures; second, examiners
    did not consistently document the work they performed in risk-
    scoping as
    required by the Corporation; and, last, the examiners were not
    taking full advantage of the information that was available at
    FinCEN.
        We made recommendations to enforce the documentation
    requirements and to make fuller use of the information at
    FinCEN.
        We issued our second report in September 2003, related to
    our review of whether FDIC had developed and implemented
    adequate procedures to examine financial institutions'
    compliance with the USA PATRIOT Act. We focused on Title III of
    the Act, which addressed anti-money laundering measures and
    currency crimes and protection.
        The Division of Supervision and Consumer Protection had
    advised the FDIC-regulated institutions of the new Title III
    requirements in cases where the Department of the Treasury had
    issued final rules implementing Title III provisions, but had
    not established guidance for their examiners. The Corporation
    was either coordinating the issuance of uniform procedures with
    an interagency steering committee or waiting for Treasury to
    issue additional final rules. This delay was of particular
    concern for Title III provisions addressing money laundering
    deterrents and verification of customer identification.
        Again, we recommended that FDIC issue interim guidance and
    procedures and then work closely with their interagency
    counterparts to ensure timely issuance of final guidance.
        Our most recent audit related to Bank Secrecy focused on
    actions taken by FDIC in its supervisory capacity to ensure
    that FDIC-supervised institutions implemented effective
    corrective actions to BSA violations.
        Of the over 5,600 institutions that the FDIC supervised
    during the time period of our audit, which would cover the time
    period of 1997 through the year 2003, approximately 47 percent
    of the institutions had been cited at least one time for a BSA
    violation. Those violations included citations for not
    complying with Treasury requirements, as well as the FDIC's
    policies and procedures as to how a program is supposed to be
    developed.
        In those institutions where violations were cited, 458--
    approximately 17 percent--had been cited for repeat Bank
    Secrecy violations. Our audit results raised concerns related
    to four general areas: The extent of regulatory action on
    significant and repeat violations; the consistency of reporting
    of deficiencies and violations; the timing of follow-up and
    corrective actions taken by the institutions; and then handling
    of those referrals to the Department of the Treasury.
        Our audit showed a high rate of significant and repeat
    violations, many of which were not subject to regulatory
    actions. Our sample included 27 institutions with repeat
    violations. Of those 27 institutions, 17--63 percent--were not
    subject to regulatory action for their repeat violations,
    although other supervisory efforts such as follow-up
    correspondence to bank management and visitations may have been
    in progress. Of the 10 institutions that were subject to
    regulatory actions, only one was subject to a cease-and-desist
    order and the other 9 were subject to informal actions.
        Not all Bank Secrecy deficiencies that the Corporation's
    examiners described in their reports were cited as violations
    in the reports and tracked in the FDIC information systems.
    Such deficiencies may receive less attention from bank
    management or in FDIC's follow-up system.
        In many instances, the Corporation followed up or pursued
    regulatory action for certain violations before the next
    examination or received evidence from bank management, FinCEN,
    or others that the violation had been corrected.
        However, for nearly one-third of the 82 reports that we
    reviewed, examiners waited until the next examination to follow
    up on some or all of the Bank Secrecy violations.
        In some cases, more than 1 year, and up to 5 years, passed
    before bank management took corrective action that was
    effective or before the FDIC applied regulatory actions. About
    two-thirds of the violations sampled took longer than 1 year to
    correct.
        FDIC's policy of alternating examinations with State
    regulatory agencies also contributed to this time lag.
    Specifically, 45 of the 72 exam reports that we reviewed from
    State regulatory agencies did not address Bank Secrecy
    compliance. These were the institutions that had violations. We
    reviewed the State reports. They did not cite any specific
    information regarding the Bank Secrecy violations. Therefore,
    the FDIC could not rely on those exams. Consequently, follow-up
    by the FDIC did not occur until the next examination;
    generally, 2 to 3 years after the violations were initially
    filed.
        While many institutions had been cited for BSA violations,
    there were only 34 referrals to the Treasury Department during
    this period. Most of these referrals were made by one FDIC
    regional office. We determined that when a referral to the
    Treasury Department had been made, Treasury had taken action.
        Based on our work and in light of the increased
    Congressional interest in BSA compliance and emphasis on
    national security concerns, we have made recommendations that
    the Corporation reevaluate and update its examination guidance
    to help ensure adequate examiner follow-up and timely
    corrective action by bank management; discuss and update the
    referral policy with the Treasury Department; encourage State
    coverage of Bank Secrecy Act compliance; and develop
    alternative procedures to compensate for the lack of State
    coverage.
        Looking ahead, Mr. Chairman, there are key questions that
    FDIC should consider in conjunction with the Treasury
    Department and the other financial regulators as it looks to
    improve the Bank Secrecy program.
        First, is risk-scoping Bank Secrecy examinations and
    follow-up still the most effective approach to uncovering money
    laundering and terrorism financing?
        Second, are the policies and procedures for reporting
    certain cash transactions and Bank Secrecy violations to the
    Treasury Department, some of which date to the early 1990's,
    currently effective?
        And, last, is the information reported to FinCEN by
    financial institutions and regulators effectively evaluated and
    does it ultimately result in timely preventive actions?
        Mr. Chairman, we appreciate the opportunity to participate
    in these hearings. We are prepared to assist in addressing
    these issues and have additional audits planned in this area.
        I would be pleased to answer any questions that you may
    have.
        Chairman Shelby. Thank you.
        Ms. D'Agostino.

               STATEMENT OF DAVI M. D'AGOSTINO, DIRECTOR

               FINANCIAL MARKETS AND COMMUNITY INVESTMENT

                     U.S. GENERAL ACCOUNTING OFFICE

        Ms. D'Agostino. Thank you, Mr. Chairman, Ranking Member
    Sarbanes, and Members of the Committee.
        I am very pleased to be here today before you and along
    with the FDIC IG on this panel to discuss a number of issues
    concerning Federal regulators' oversight of banks, thrifts and
    credit unions for Bank Secrecy Act or BSA compliance, and our
    ongoing work for this Committee on this matter.
        Several recent cases imposing large civil money penalties
    on depository institutions have increased attention on industry
    compliance with, and Government enforcement of, the BSA. My
    oral
    summary will focus on, one, selected recent enforcement actions
    taken against depository institutions for BSA violations, and
    two, the scope and approach of our ongoing work that we are
    doing for this Committee on BSA examinations, violations
    identified and the various levels of enforcement and penalties
    imposed for them.
        First, in the last few years and as recently as last month,
    the financial regulators, FinCEN and the Courts have taken
    actions against a number of depository institutions for
    significant BSA violations. Recent enforcement actions show
    that various types of depository institutions have had BSA
    violations. These actions also raise the issue of the
    timeliness of the identification of the BSA violations and the
    enforcement actions taken by the regulators. For example, an
    individual who was later convicted of money laundering offenses
    had apparently deposited $21 million in cash at Banco Popular
    de Puerto Rico, between 1995 and 1998. The bank had not
    investigated or reported this activity to FinCEN or to law
    enforcement until 1998, years after the suspicious activity had
    taken place.
        In 1999, the bank's regulator expanded its examination
    scope for BSA compliance based on information it received from
    law enforcement. Its findings then led to Justice, FinCEN, and
    the bank regulator, imposing penalties and entering into a
    deferred prosecution agreement with the bank. These actions
    were all taken for violating the BSA's suspicious activity
    reporting requirement.
        More recently Riggs Bank was assessed a $25 million civil
    money penalty for BSA violations including the failure to
    maintain an effective BSA compliance program and failure to
    monitor and report large transactions involving foreign
    embassies. Although OCC, Riggs' regulator, testified yesterday
    and again today that they had identified the problems early on,
    apparently as early as 1997, and used supervisory measures in
    efforts to get improvement at the bank, these efforts in this
    case proved to have limited effect.
        In 2003, OCC deemed the bank to be systemically deficient
    and the bank entered into a consent order. In 2004, when the
    bank still was not in full compliance, they were assessed the
    penalty.
        In recent years, we have issued a number of reports dealing
    with regulatory oversight of AML activities, anti-money
    laundering activities, of financial institutions, and my
    written statement that has been submitted for the record goes
    into more detail on those. Our statement also highlights some
    of the work done by the IG's, the Inspectors General, on which
    we are relying quite heavily to help us get up the curve to do
    the massive amounts of work that we are doing for you in your
    most recent December request.
        Our current work is actually the most comprehensive review
    we think that we have done at GAO on BSA issues. In that work
    our primary objectives are to determine first, how the five
    regulators' risk-focused examinations assess BSA compliance;
    second, the extent to which the regulators identified BSA and
    AML violations and take supervisory actions; and third, the
    consistency of BSA compliance examination procedures and the
    interpretation of violations across the regulators.
        To answer these questions we plan to review the reliability
    of the data systems that the regulators use to track the
    violations themselves. As FDIC's IG's work has pointed out,
    there are some problems with the systems and what data is
    included and not included by the examiners in the database that
    is used.
        Second, from the samples we plan to pull from all of the
    regulators of BSA compliance examinations over a 4-year period,
    we plan to analyze the work papers, and this will allow us to
    determine the following things: The areas the exams did and did
    not cover, the nature of BSA violations identified, whether or
    not the regulators somehow curtailed their BSA compliance
    exams, and the basis for the decisions to do so. We are also
    going to be tracking the supervisory actions taken to correct
    violations that have been identified, and we will examine the
    ramifications, if any, of Treasury not delegating authority to
    the bank regulators to assess BSA compliance penalties as
    mandated by statute in 1994.
        We are also in the process of putting together a picture of
    the statutory authorities, the players and the layers of types
    of violations and enforcement actions, and the penalties,
    including when they are civil and when they are criminal. I
    hear a lot of confusion at each of these hearings that we are
    monitoring over the spring over what is a deficiency versus
    what is a violation? What is a recordkeeping violation versus a
    program violation? We hope to sort through all of that and
    review when certain kinds of penalties make sense. We are
    working with Justice, the bank regulators and Treasury to try
    to tease that out and make some sense of it as well as wade
    through all of the various legislation and authorities that are
    in place.
        With that said, Mr. Chairman, Ranking Member Sarbanes, I
    will conclude my statement and will answer any questions you
    have of us.
        Chairman Shelby. The General Accounting Office has prepared
    a number of reports on money laundering and terrorist financing
    over the years. Do you believe that there are systemic problems
    that resulted in Riggs case being unaddressed for so many
    years? You heard the testimony earlier. You know the case. A
    lot of years.
        Ms. D'Agostino. Yes. It did seem to go on for quite some
    time. From the pieces that we are putting together from the
    testimonies of the OCC representatives, it appears that OCC was
    trying to ``push on a string'' at Riggs with the bank's
    management, and when you push on a string, you don't get
    resistance and you don't make progress. It seems as if it did
    last a long time.
        Whether or not it is systemic, I do not think that we can
    say today. We hope that our work for the Committee will provide
    some insight into that question.
        Chairman Shelby. Would you say it is lack of due diligence
    then?
        Ms. D'Agostino. OCC was aware and trying to work with the
    bank's management.
        Chairman Shelby. Well, they were trying, but were they----
        Ms. D'Agostino. They were pushing on the string.
        Chairman Shelby. I love your phrase.
        Ms. D'Agostino. Yes. And it is very frustrating.
        Chairman Shelby. You have tried to push one, have you not?
        Ms. D'Agostino. Yes, sir.
        Chairman Shelby. Senator Sarbanes.
        Senator Sarbanes. I want to follow up the Chairman's
    question right there on whether there was a problem with the
    system. In the Banco Popular case which you cited, there
    eventually was a settlement in that case, correct?
        Ms. D'Agostino. There was a deferred prosecution. It was
    one of the early uses by Justice, I think, of this interesting
    tool.
        Senator Sarbanes. But the settlement agreement indicated,
    and I am now quoting from it, ``During the period of 1995
    through 1998, the Federal Reserve, through the Federal Reserve
    Bank of New York, conducted four examinations of Banco Popular.
    These examinations did not contain any criticism of Banco
    Popular's BSA compliance policies or procedures.'' And
    apparently they only noticed it when the Fed got a tip from a
    Federal law enforcement official, and ordered a special
    targeted examination of the bank.
        I ask the Chairman if I could ask that question right now.
        Chairman Shelby. You can.
        Senator Sarbanes. Because it follows up exactly on his
    point. I mean there is something wrong. The system is not
    working right, is it?
        Ms. D'Agostino. It is not working swiftly from the
    appearance of these two cases, and I think the FDIC IG's work
    indicates it can take a long time to go through the supervisory
    process of trying to take informal and formal supervisory
    action, sometimes without much effect.
        Yet at the same time--again--there is much we do not know,
    because we are still doing our work. For example, we do not
    know to what extent informal supervisory actions have been
    effective and timely. So, I think by starting with these cases
    which are very enlightening, we still may be missing the whole
    picture. Some of the things that we can learn by looking at
    more closed cases for the Committee, is how this layering of
    authorities, layering of players, and interaction between bank
    regulators and law enforcement, fits together and works--not
    only where it breaks down but also where it may work well. That
    is what we hope to get at in our systematic review of the
    regulators' data and through sampling exams for the Committee.
        Chairman Shelby. Mr. Gianni, how could the FDIC better use
    its supervisory and enforcement authority, which they have a
    lot there, to address BSA violations? Is BSA violations deemed
    an important mission at the FDIC, and if not, why not?
        Mr. Gianni. I think after today's hearing, I believe it is
    a priority within the Corporation. I think that clearly the
    work of my office would lead me to say that the examiners, the
    evidence would show that the examiners were in fact identifying
    problems. The issue became what happened after the
    identification? How hard did we push to get the problems
    resolved? What was the management support? This morning,
    Chairman Powell said that if you do not have the culture and
    you do not have the tone at the top, if I might use a phrase,
    to say that this is important, you tend to try to go after the
    approach that will have the least impact in disrupting the
    relationship with the institution. So you take the least
    aggressive action first. And if they do not follow through on
    that, then you go up a step. That takes time. Then if they do
    not take action on the second time, you go up to the last or
    cease and desist.
        So it takes time to go through this process of increased
    regulatory action. I think we need to, the Corporation needs to
    reexamine at that.
        Chairman Shelby. Is it troubling to both of you that in the
    Riggs situation, the second report that I talked about later
    was almost always ignored, the BSA, bank suspicious activity
    report? They filed the transaction report, but they did not do
    the other one.
        Ms. D'Agostino. The SAR.
        Chairman Shelby. Is that troubling?
        Ms. D'Agostino. Yes, it is. Although we do know from our
    previous work, that banks spend a lot of time doing their own
    investigation before they put together one of these reports.
    And again, I am not familiar with all of the facts and
    circumstances surrounding, for example, the Saudi account case,
    and whether or not this activity was unusual or suspicious for
    the Saudi account. It could have been routine that they pulled
    and moved millions of dollars in and out every day from their
    accounts. We just do not know enough about it.
        Chairman Shelby. But you are studying it closely.
        Ms. D'Agostino. We are. We are watching it every day. We
    are not going to be able to get all the details until cases are
    closed, and so that makes our job a little more difficult.
        Chairman Shelby. How often are banks, ma'am, examined? In
    other words, have the regulators adhered to their examination
    cycle with respect to the Bank Secrecy Act enforcement?
        Ms. D'Agostino. We have not gotten that far yet in our
    work, but we will include this question in our scope.
        Chairman Shelby. Is that not an important question?
        Ms. D'Agostino. Sure. How often do they go in and look at
    BSA compliance?
        Chairman Shelby. Will you be addressing this in your
    ongoing study at the General Accounting Office?
        Ms. D'Agostino. Sure. That will be one of many factors.
        Chairman Shelby. Mr. Gianni.
        Mr. Gianni. Mr. Chairman, I can report that the
    Corporation, is complying with the statute of ensuring that
    banks are examined at least every 18 months, and in some cases
    every year.
        Chairman Shelby. What about information sharing with regard
    to the Federal Deposit Insurance Corporation? If you just
    briefly tell the Committee the normal process which by FDIC
    information, the way they work the Bank Secrecy Act compliance,
    is shared with the other agencies like Treasury and anybody
    else.
        Mr. Gianni. There are a number of committees and groups
    that address bank secrecy type issues. I do not think there is
    a comprehensive process in place currently to share the
    information as it relates to bank secrecy and to pull all of
    this information together to see whether there are trends,
    anomalies, or issues that need to be addressed.
        I think first of all, all of the information that we
    accumulate within the Corporation is not passed on to FinCEN,
    and so with FinCEN's greater responsibility and the will to
    bring the regulators together, I think it is a good first step
    that the Committee has achieved. The parties can begin to
    better share information to see whether information that is
    housed within the FDIC is similar to information that is housed
    in one of the other regulatory agencies. Again, it is not
    unlike what is going on between the CIA and the FBI now as it
    relates to our intelligence sharing.
        Chairman Shelby. But it is very important in both instances
    to share information.
        Mr. Gianni. I would agree with you, sir, and I think what
    happened, sir, is that when September 11 tragically occurred,
    we had a sea change of priorities within our country, and we
    had the passage of the USA PATRIOT Act, but I believe that the
    risks associated to that, or potential risks associated to that
    were underestimated by the bank regulators. It is now being
    recognized that it is a part of our national defense, and I
    believe that the regulators will have the will and commitment
    to step up and to address these issues in a unified manner.
        Chairman Shelby. Both of you, you at the FDIC as Inspector
    General, and you at the General Accounting Office are
    continuing to work in this area. What are some of the steps you
    are into?
        Ms. D'Agostino. One of our major efforts relates to
    assessing the systems that each regulator has and the separate
    sets of data that are housed in their own IT units. We are
    going to have to go through all of them--luckily FDIC has done
    some work ahead of us on that--and try to get a good fix on
    what kind of data are and are not included. We will design our
    work around the systems and the data available within them, and
    check the reliability of them.
        That is what we are involved in right now. It is basically
    an audit within an audit, to see how reliable the information
    is before we use it to report to you information and analysis.
    That is a big piece of our undertaking for the Committee.
        Again, we are looking at the authorities and the penalties
    and how it all works in practice.
        Chairman Shelby. Thank you.
        Mr. Gianni. Mr. Chairman, I think we are going to work
    closely with the GAO. We do not want to duplicate. We want to
    try to identify how we can complement the GAO in its efforts to
    try to address the request from the Committee.
        There are several areas where I think that we could make a
    contribution. Clearly, I think that this practice of risk
    focusing might be appropriate for the initial go-round, but
    risk focusing for follow-up action may not be the appropriate
    way. So, we need to think a bit more about risk scoping and how
    that applies to bank secrecy.
        Second, I think clearly the agencies are concerned about
    regulatory burden. Having said that, we have to think through
    how we have gone about implementing the various laws and
    regulations, and to see whether there may be a streamlined way
    of still accomplishing the legislative objectives that were set
    out by the Congress, yet, doing it in a much more efficient
    way. The Corporation has a process working with the other
    regulators to look at that.
        The last thing I would like to talk about is--it was raised
    this morning--I think I would like to look at the Hudson case
    to see the similarities that might exist, and just pursue that
    from an intellectual standpoint to see if there are some
    lessons learned that we might be able to help the Corporation
    on.
        Chairman Shelby. You are in a position to do that.
        Mr. Gianni. Yes, I am, sir.
        Chairman Shelby. And I hope you will. To both of you, will
    you hopefully finish your work in this area before the year is
    out? This is just June 1. I know it is a big undertaking, but
    it is an important and timely undertaking. You cannot put a
    calendar day on it.
        Ms. D'Agostino. We have not yet committed to a date to the
    Committee for issuing our final report. We are considering
    whether there might be ways where we could report on an interim
    basis on different pieces of this fairly large request you have
    made of us, so that you do not have to wait so long to receive
    our results.
        Chairman Shelby. Sure. We appreciate that.
        Could you both briefly expand on comments regarding the
    vulnerability of the risk-based approach to the oversight
    process? For example, when you determine what constitutes
    suspicious activity, is that pretty subjective? You have
    criteria to go by, you have to have something that triggers
    something at the regulatory agencies?
        Mr. Gianni. There are certainly guidelines out that have
    been written to help the examiners, but it is judgment. It
    comes down to judgment. When you have judgment being made----
        Chairman Shelby. Critical evaluation of something.
        Mr. Gianni. It is a critical judgment. When you have those
    types of critical judgments being made within a framework, it
    is important to make sure those judgments get reviewed not only
    on an individual basis, but also on a collective basis to see
    if there are areas where we can help refine the guidance,
    further improve the guidance, so stronger and better judgments
    are made in the future.
        Chairman Shelby. Do you believe that the regulatory
    structure we have today, if used diligently, would be
    sufficient in the future, or do we need to look somewhere else?
        Mr. Gianni. I personally think that the bank regulators,
    working together, can accomplish what needs to get
    accomplished.
        Chairman Shelby. Is the Riggs case a wake-up call and some
    of the others, hopefully?
        Mr. Gianni. I believe Riggs is a wake-up call, as well as
    the fact that the Committee has seen fit to have oversight. I
    personally do not underestimate the power of Ccongressional
    oversight.
        Chairman Shelby. Do you have a comment?
        Ms. D'Agostino. I agree with the FDIC IG. I think training
    and keeping up to date on the most current approaches by the
    money launderers and terrorist financiers, and anything that
    law enforcement could help put together to better inform the
    examiners would be useful too. But I am not sure that structure
    is the only issue. I do think that the leadership, the
    oversight, and that tone at the top, as Mr. Gianni pointed out,
    are very important in keeping attention properly focused on
    AML.
        Chairman Shelby. You both have your hands full, but we
    appreciate the job you are doing and the attitude that you
    have, and we will have you back before the Committee.
        Thank you very much for the work and your commitment.
        Ms. D'Agostino. Thank you.
        Mr. Gianni. Thank you, Mr. Chairman.
        Chairman Shelby. The hearing is adjourned.
        [Whereupon, at 12:10 p.m., the hearing was adjourned.]
        [Prepared statements, response to written questions, and
    additional material supplied follows:]

                   PREARED STATEMENT OF SENATOR WAYNE ALLARD

        I would like to thank Chairman Shelby for holding this hearing to
    examine the enforcement of the Bank Secrecy Act. Since 1970, the Bank
    Secrecy Act has been an important tool the Government uses to combat
    money laundering and the financing of terrorism. This statute has taken
    on even more significance through the USA PATRIOT Act as the
    international monetary system has been manipulated by terrorists. The
    Act requires all financial institutions to maintain records and file
    reports that are used in criminal, tax, or regulatory investigations
    and proceedings. Seeing that these requirements are met is a daunting
    task, yet critical to the ultimate safety of people around the world.
        The Committee has held three oversight hearings on terror financing
    this year, which I believe have helped initiate significant
    improvements to the existing counterterror finance programs within the
    Treasury Department. I look forward to today's discussion on the
    specific procedures on how suspicious activities and transactions are
    detected, and more particularly, how they are dealt with when they are
    found. That is where there have been problems in recent months and it
    is vital that we determine how to catch money launderers in a timely
    fashion. An effective way to track down terrorists is by tracing their
    financial transactions, and so I look forward to progress made in this
    area.
        I would like to thank our witnesses for coming to testify and look
    forward to hearing how your offices enforce the Bank Secrecy Act.

                                   ----------

                   PREPARED STATEMENT OF SENATOR JIM BUNNING

        Thank you Mr. Chairman for holding this very important oversight
    hearing and I would like to thank all of our witnesses here today.
         Like many Americans, I was very surprised to hear the reports out
    of Iraq of our soldiers finding large sums of U.S. currency in a
    country that our Nation has imposed sanctions upon. I was even more
    surprised to find out that the cash was traced directly to the New York
    Federal Reserve. I was somewhat relieved to find out the New York Fed
    did nothing wrong in this particular instance, though I am concerned
    some of our allies were skirting our sanctions. However, when the Fed
    investigated the cash in Iraq, they uncovered many serious problems in
    the Extended Custodial Inventory Program. The program, which was set up
    to ensure a supply of currency and recover and replace worn out
    currency, showed some very disturbing abuses. UBS, who ran the program
    in Switzerland, falsified documents and sent currency to countries on
    our sanctions list.
         Equally disturbing were the reports of the Riggs bank scandal.
    Riggs was skirting Bank Secrecy Act procedures, and moving large sums
    of cash without making Suspicious Activity Reports or SAR's. SAR's are
    not something that are that obscure. They were even mentioned on an
    episode of the Sopranos. Surely a banker would know to file them. The
    only conclusion could be that the SAR's were knowingly not filed. The
    OCC has recently fined Riggs $25 million. But I am very concerned why
    the Riggs scandal lasted as long as it did. And I want to make sure
    this type of problem does not happen again.
         There seemed to be a lapse in oversight by the regulators in both
    of these cases. I am glad all of the regulating agencies are
    represented today so we can find out their take on the Bank Secrecy Act
    and the USA PATRIOT Act and if they believe any of their regulated
    institutions are involved in similar practices. I would like to know,
    if the Fed and OCC, without jeopardizing any possible investigations,
    can you tell us if there are any other similar problems out there on
    the horizon in the other institutions you regulate.
         I would also like to know from all of you, what you think of the
    Bank Secrecy Act and the USA PATRIOT Act. Should they be expanded or
    contracted. Where and how can they be improved? Do they need to be
    tweaked or overhauled? We must make sure we are making the best use of
    our resources to ensure we are doing whatever we can to choke off the
    financial lifeblood to terrorists. We can and must do better. Too much
    is at stake.
         Once again, thank you Mr. Chairman for holding this hearing and I
    thank our witnesses for testifying today. Hopefully we can get to the
    bottom of this.

                      PREPARED STATEMENT OF SUSAN S. BIES

            Member, Board of Governors of the Federal Reserve System
                                  June 3, 2004

        Mr. Chairman, thank you for the opportunity to appear before the
    Senate Committee on Banking, Housing, and Urban Affairs to discuss the
    Federal Reserve's participation in efforts to combat money laundering
    and terrorist financing. The Federal Reserve and the other Federal
    financial institutions supervisory agencies play a critical role in
    these efforts, and the Federal Reserve is actively engaged in a number
    of initiatives to refine and strengthen examination protocols in this
    area and to effectively deploy resources to prevent, identify, and
    address problems at the banking organizations supervised by the Federal
    Reserve.
        In my remarks today, I will describe for you some of the important
    steps we are taking to fulfill our supervisory mission, to guide the
    institutions we supervise, and, in cooperation with the other banking
    and financial services regulators and the Treasury Department, to make
    every effort to use our supervisory tools to enhance the banking
    industry's role in preventing and detecting money laundering and
    terrorist financing. The Federal Reserve's anti-money laundering
    program is multifaceted. It involves work in bank supervision,
    applications, enforcement, investigations, training, coordination with
    the law enforcement and intelligence communities, and rule writing.
    This morning, I will touch on some of these aspects of the Federal
    Reserve's anti-money laundering program, but will concentrate on bank
    supervision efforts and enforcement matters.
        I would like to begin with a few words about the Federal Reserve's
    supervisory philosophy in this area. The Federal Reserve has long
    shared Congress's view that financial institutions and their employees
    are on the frontline of the effort to combat illicit financial
    activity. The Federal Reserve believes that the banking organizations
    it supervises must take every reasonable step to identify, minimize,
    and manage any risks that illicit financial activity may pose to
    individual financial institutions and the banking industry.
    Accordingly, the Federal Reserve has required the financial
    institutions it supervises to put in place appropriate controls and
    risk management mechanisms, and has also devoted extensive resources to
    issuing guidance on legislative and regulatory requirements and sound
    banking practices, as well as to coordinating supervisory efforts with
    other agencies. In addition, the Federal Reserve uses its enforcement
    authority, where necessary, in the event that serious problems or risks
    cannot be satisfactorily addressed in the supervisory process.
    Supervisory Strategy and Procedures for Anti-Money Laundering
    and Counter Terrorist Financing
        It has been our longstanding policy that Federal Reserve
    supervisors incorporate a Bank Secrecy Act compliance and anti-money
    laundering program component into every safety and soundness
    examination conducted by a Reserve Bank. This means that on a regular
    examination cycle, examiners seek to determine if a banking
    organization's Bank Secrecy Act (BSA) and anti-money laundering (AML)
    compliance
    programs are satisfactory and are commensurate with the organization's
    business activities and risk profiles. Examinations are conducted at
    the State member banks, bank holding companies, Edge Act corporations,
    and U.S. branches and agencies of foreign banks supervised by the
    Federal Reserve. Every Reserve Bank has BSA/AML specialists and
    coordinators on its staff, and, since the late 1980's, the Board has
    had an anti-money laundering program in its supervision division
    overseen by a senior official. Simply put, Bank Secrecy Act and anti-
    money laundering compliance has for years been an integral part of the
    bank supervision process at the Federal Reserve. Furthermore, the
    Federal Reserve's enforcement program has a strong history of
    addressing both anti-money laundering and safety and soundness problems
    in formal actions, where necessary. While the number of actions may
    fluctuate somewhat from year to year, the Federal Reserve's exercise of
    its enforcement authority has been consistently strong and timely.
        The Federal Reserve supervision process includes both on-site
    examinations and off-site surveillance and monitoring. The Federal
    Reserve generally conducts an on-site examination of each bank it
    supervises once every 12 to 18 months, and at each examination staff
    reviews the institution's anti-money laundering procedures and its
    compliance with the Bank Secrecy Act, as amended by the USA PATRIOT Act
    and new Treasury regulations. For large, complex banking organizations,
    the safety and soundness examination process is continuous, and anti-
    money laundering and BSA compliance is incorporated into examinations
    conducted throughout the year. The Federal Reserve always includes BSA/
    AML examinations in the supervisory strategy for every banking
    organization we supervise.
        A key component of anti-money laundering examinations is the
    institution's compliance with the BSA compliance program requirement.
    The Federal Reserve and the other Federal banking agencies have
    compliance program requirements for institutions they supervise. In
    general, the rules require a bank to establish, maintain, and document
    a program that includes:

     a system of internal controls to ensure ongoing compliance
        with the BSA,
     independent testing of the bank's compliance with the BSA,
     training of appropriate bank personnel, and
     the designation of an individual responsible for coordinating
        and monitoring day-to-day compliance with the BSA.

        The Federal Reserve works to ensure that the banking organizations
    we supervise understand the importance of having in place an effective
    anti-money laundering program. When a Reserve Bank conducts a BSA/AML
    examination of a banking organization under its supervision, the four
    components of the program establish the framework for the examination.
    To properly evaluate the effectiveness of a banking organization's
    anti-money laundering program, the Federal Reserve has developed
    comprehensive examination procedures and manuals, and regularly
    provides training for its examiners. The BSA/AML examination procedures
    are currently under revision to reflect newly issued regulations under
    the USA PATRIOT Act.
        The Federal Reserve's BSA examinations are risk-focused. While a
    ``core'' BSA examination is required of all banking organizations,
    risk-focused procedures allow examiners to apply the appropriate level
    of scrutiny to higher-risk business lines, where necessary, and
    alleviate burden where high-risk products or customers are not present.
    In other words, a small State member bank with a low-risk customer base
    receives a considerably different and less burdensome BSA/AML
    examination than a large, complex banking organization with
    international operations.

    The Examination Process
        During every safety and soundness examination of banking
    organizations under Federal Reserve supervision, bank examiners
    specially trained in BSA requirements review the institution's previous
    and current compliance with the BSA. Examiners first determine whether
    the institution has included BSA/AML procedures in all of its
    operational areas, including retail operations, credit, private
    banking, and trust, and has adequate internal control procedures to
    detect, deter and report money laundering activities, as well as other
    potential financial crimes. As part of such an examination, bank
    examiners also review an institution's fraud detection and prevention
    capabilities, and its policies and procedures for cooperating with law
    enforcement (whether through responding to subpoenas, acting on
    information requests under Section 314 of the USA PATRIOT Act, or
    otherwise).
        Our supervision policy guidance in this area requires that
    examiners also conduct a review of the databases of Suspicious Activity
    Reports (SAR's) and Currency Transaction Reports (CTR's) to determine
    if the banking organization that is about to be examined has filed such
    reports and that they appear complete and timely. Examiners are not
    doing this to count the number of SAR's and CTR's, to compare their
    findings against other institutions, or to base any criticisms solely
    on a numerical count, but rather to make sure, for example, that the
    bank or U.S. branch of a foreign bank understands its obligations in
    this critical area and has taken steps to fulfill its responsibilities
    by filing timely and accurate reports with law enforcement and bank
    regulators.
        The on-site examination begins as a review of the institution's
    written compliance program and documentation of self-testing and
    training, as well as a review of the institution's system for capturing
    and reporting certain transactions pursuant to the Bank Secrecy Act,
    including any suspicious or unusual transactions possibly associated
    with money laundering or other financial crimes. Transaction testing is
    generally conducted to verify these systems.
        In those instances where there are deficiencies in the BSA/AML
    program, including failures to adequately document self-testing or
    training, obvious breakdowns in operating systems, or failures to
    implement adequate internal controls, the Federal Reserve's examination
    procedures require examiners to conduct a more intensified second-stage
    examination that would include the review of source documents and
    expanded transaction testing, among other steps.
        There is an important correlation between the areas covered by a
    BSA/AML examination and an institution's overall risk management and
    internal controls. Thus, bank examiners take into account an
    organization's enterprise-wide corporate governance mechanisms and how
    they are applied. The Federal Reserve's bank examiners are able to
    apply a broad perspective and depth of organizational knowledge to the
    area of BSA/AML and to coordinate with examination and analytic staff
    to ensure that the safety and soundness and BSA/AML examinations are
    integrated and comprehensive. The Federal Reserve has found that there
    is an important synergy gained by integrating the safety and soundness
    and BSA/AML supervisory processes.

    Enforcement Actions
        The Federal Reserve focuses significant resources on the prevention
    and early resolution of deficiencies within the supervisory framework.
    When problems are identified at a banking organization, they are
    typically communicated to the management and directors in a written
    report. The management and directors are requested to address
    identified problems voluntarily and to take measures to ensure that the
    problems are corrected and will not recur. Most problems are resolved
    promptly after they are brought to the attention of a banking
    organization's management and directors.
        In some instances, however, examiners identify problems relating to
    anti-money laundering measures that are pervasive, repeated, unresolved
    by management, or otherwise of such serious concern that use of the
    Federal Reserve's enforcement authority is warranted. If the problem
    does not require a formal action, the Reserve Banks have the authority
    to take informal, nonpublic supervisory action, such as requiring the
    adoption of an appropriate resolution by an institution's board of
    directors or the execution of a memorandum of understanding between an
    institution and the Reserve Bank.
        When informal action will not suffice, the Federal Reserve has
    authority to take formal, public enforcement action to compel the
    management and directors of a banking organization to address anti-
    money laundering and BSA compliance problems. These actions include
    written agreements, cease-and-desist orders, and civil money penalties,
    and are legally enforceable in court. These actions are not delegated
    to the Reserve Banks, and are undertaken only with the concurrence of
    the Board's General Counsel and the Board's Director of the Division of
    Banking Supervision and Regulation. Because these actions are public,
    they can have a significant impact on a banking organization,
    particularly one that is a public company. In determining whether
    formal action is appropriate, Federal Reserve staff considers all
    relevant factors, including the nature, severity, and duration of the
    problem, the anticipated resources and actions necessary to resolve the
    problem, and the responsiveness of the directors and management.
        In cases where examiners have identified a violation of the
    compliance program requirement, the Federal banking agencies are bound
    by law to take formal enforcement action. The same law requiring the
    banking agencies to promulgate rules requiring the four-part compliance
    program that I discussed earlier provides that if an institution fails
    to establish and maintain the required procedures, or if it has failed
    to correct any previously identified problem with the procedures, then
    the agency must issue a formal action requiring the institution to
    correct the problem. The Federal Reserve takes this responsibility very
    seriously and has issued a number of public actions against banking
    organizations in fulfillment of this statutory mandate. Federal Reserve
    staff exerts every effort to ensure that this statute is implemented
    consistently, and Board staff acts as a central coordinator for the
    examination and enforcement staff at the different Reserve Banks. Over
    the past 3 years, for example, the Federal Reserve has taken
    approximately 25 formal, public enforcement actions addressing BSA/AML-
    related matters. Actions have been taken against large banking
    organizations as well as smaller ones--the one constant is that the
    examination process identified regulatory violations in the
    organizations' compliance programs that, under the law, mandated the
    supervisory actions.
        In addition to taking action itself, the Federal Reserve may refer
    a BSA-related matter to Treasury's Financial Crimes Enforcement Network
    (FinCEN) for consideration of an enforcement action based solely on BSA
    violations, rather than a program failure or issues relating to safety
    and soundness. Treasury has delegated to the Federal financial banking
    agencies the authority to examine for BSA compliance those institutions
    they normally examine for safety and soundness; however, Treasury has
    not delegated the authority to take an enforcement action, such as the
    assessment of a fine, for violations of the Bank Secrecy Act.
        Federal Reserve staff coordinates enforcement actions with other
    regulators or agencies, including in the area of anti-money laundering.
    If a banking organization's problems involve entities supervised by
    different regulators, resolution of enterprise-wide problems may
    involve multiple enforcement actions. For example, the Office of the
    Comptroller of the Currency (OCC), FinCEN, and the Federal Reserve
    coordinated their recent enforcement actions against Riggs National
    Corporation; Riggs Bank, N.A.; and Riggs International Banking
    Corporation, the bank's Edge Act subsidiary, to ensure consistency and
    concurrent resolution of open issues. The Federal Reserve coordinates
    enforcement actions with State banking supervisors on a regular basis,
    and enforcement actions involving operations of foreign banking
    organizations may be resolved in cooperation with supervisors abroad.
    In several recent matters, there was close coordination with the U.S.
    Department of Justice as well.

    The Applications Process
        Before I describe some more aspects of the Federal Reserve's
    supervisory process, let me touch on a very important component of the
    Federal Reserve's anti-money laundering process--the processing of
    applications and notices filed with the Board. The Federal Reserve has
    had a longstanding practice of considering an applicant's compliance
    with anti-money laundering laws in evaluating various applications,
    including bank mergers and acquisitions of insured depositories by bank
    holding companies as well as applications filed by foreign banks to
    establish U.S. banking offices under the Foreign Bank Supervisory
    Enhancement Act. The USA PATRIOT Act included a provision memorializing
    our practice in the application area and required the Board to take
    into account the effectiveness of an applicant's BSA compliance program
    when it considers applications under various laws.
        Under our longstanding protocols as well as the new law, every
    application matter considered by the Federal Reserve includes a BSA/AML
    compliance-related component whereby staff has to make specific
    judgments regarding an applicant's compliance with the law in this
    important area. While I cannot, of course, comment on specific cases, I
    can report to you that Board staff has on some recent occasions advised
    banking organizations considering expansion or other activities
    requiring the filing of applications with the Federal Reserve to
    concentrate instead on their BSA/AML programs. While not the full
    equivalent of an enforcement action, I am sure that you can appreciate
    the fact that every banking organization that is seeking or planning on
    seeking Federal Reserve approval of an application makes every effort
    possible to ensure that its anti-money laundering program is considered
    to be fully satisfactory by examiners and that any deficiencies that
    may be identified are addressed as expeditiously as possible. The
    applications process gives the Board a strong tool in the BSA/AML area.

    Guidance to Banking Organizations
        Turning back to the Federal Reserve's normal supervision process,
    Board and Reserve Bank supervisors seek to provide guidance to banking
    organizations to assist them to fully understand applicable regulatory
    requirements and what is expected by the regulators. While financial
    institutions are, of course, fully responsible for their own
    compliance, the supervisors play an important role in ensuring that
    regulatory requirements are correctly understood and uniformly applied.
    This is particularly true in areas such as compliance with new
    regulations promulgated since the USA PATRIOT Act.
        The Federal Reserve views its supervisory role as including
    initiatives to enhance awareness and understanding by examiners
    throughout the Federal Reserve System, by banking organizations under
    Federal Reserve supervision, and by the financial industry at large. To
    promote a full understanding of anti-money laundering
    requirements, the Federal Reserve issues Supervision and Regulation
    letters, which are used to advise Reserve Bank supervisory staff,
    supervised institutions, and the banking industry about policy matters;
    provides on-going training to examiners; speaks regularly before the
    financial industry; and issues guidance in conjunction with other
    regulators and Treasury. These initiatives are meant to respond to or
    anticipate questions that arise regarding anti-money laundering
    requirements. The Federal Reserve is keenly aware of the resources that
    anti-money laundering and counter-terrorist financing requirements
    demand of financial institutions and believes that it is our duty to
    assist them in meeting their obligations.

    Federal Reserve Resource Commitment
        The Federal Reserve's BSA/AML function ranges from supervising and
    regularly examining banking organizations subject to Federal Reserve
    supervision for compliance with the BSA and relevant regulations, to
    requiring corrective action for
    detected weaknesses in BSA/AML programs, to enhancing money laundering
    investigations by providing expertise to the U.S. law enforcement
    community, and to providing training to U.S. law enforcement
    authorities and various foreign central banks and government agencies.
    Over the past 3 years, for example, Federal Reserve experts in BSA/AML-
    related matters have participated in special reviews of funds transfers
    for Federal law enforcement and intelligence authorities, taught
    classes at FBI and Department of Homeland Security training academies,
    held seminars for central bank and foreign supervisory authorities in
    over 10 countries, including Botswana, Mexico, Russia, and the United
    Arab Emirates, and engaged in discussions on AML-related matters at
    international fora such as the Basel Cross-border Group and the
    Financial Action Task Force on Money Laundering (FATF).
        Over the course of the past 10 plus years, the Federal Reserve's
    anti-money laundering program has grown dramatically. From a senior
    official at the outset assigned to coordinate the Federal Reserve's BSA
    activities in the late 1980's, to the creation and staffing in early
    2004 of a new section within the Board's Division of Banking
    Supervision and Regulation dedicated solely to anti-money laundering
    efforts (the Anti-Money Laundering Policy and Compliance Section), the
    Federal Reserve continues to commit a growing number of its resources to
    BSA/AML compliance. In 1993, the Federal Reserve System began the practice
    of designating a senior examiner at each of the 12 Reserve Banks to
    serve as a Bank Secrecy Act coordinator for the BSA examiners at that
    Reserve Bank. The number of senior BSA examiners throughout the System
    has grown tremendously, particularly since the enactment of the USA
    PATRIOT Act and the increasing complexity of BSA examinations. The web
    of BSA examiners throughout the Federal Reserve System is brought
    together through a direct communication channel with the Board's AML
    Policy and Compliance Section. This communication is an important tool
    for gathering examination experiences and providing consistent guidance
    throughout the Federal Reserve System.
        By any standard, the Federal Reserve has taken a leadership role in
    the U.S. Government's and international banking and regulatory
    community's anti-money laundering efforts.

    Supervisory Coordination
        Due to the complexity of financial institutions today, it is
    imperative that the Federal Reserve coordinate with a long list of
    agencies on issues tied to the Bank Secrecy Act. First, the Federal
    Reserve views the Department of the Treasury and FinCEN as important
    partners due to their leadership role in administering the Bank Secrecy
    Act. In addition, for a number of complex financial institutions, the
    Federal Reserve shares supervisory and regulatory responsibilities with
    the OCC, Federal Deposit Insurance Corporation, and the Office of
    Thrift Supervision at the Federal level, with the banking agencies of
    the various States, and with foreign banking authorities for the
    international operations of U.S. banks and the operations of foreign
    banks in the United States.
        This network of partners requires a high degree of coordination.
    The regulatory authorities communicate constantly regarding BSA-related
    matters. For example, among bank regulators, there are a number of
    electronic systems in place that allow secure access to examination
    information. This allows regulators to monitor the status of
    organizations under their direct or indirect purview. It is also the
    Federal Reserve's practice to notify relevant functional regulators
    when a supervisory action may have impact on an institution subject to
    their supervision.
        In addition, bank regulators collaborate in the development of
    consistent examination procedures and examiner training. The USA
    PATRIOT Act required a surge of rulemaking activity, and the Federal
    Reserve and its regulatory colleagues continue to advise Treasury as it
    completes this important work.

    Law Enforcement Coordination
        The Federal Reserve routinely coordinates with Federal and state
    law enforcement agencies with regard to potential criminal matters,
    including anti-money laundering and financial crime activities. This
    coordination may occur when the Federal Reserve takes action to address
    matters that are also addressed in a criminal proceeding, when the
    financial condition of a bank is affected by a criminal matter, or when
    law enforcement draws on Federal Reserve staff expertise in its
    investigative work. The Federal Reserve maintains open channels of
    communication with law enforcement, whether through interagency working
    groups or through informal staff level contacts.

    Conclusion
        The Federal Reserve believes that banking organizations should take
    reasonable and prudent steps to combat illicit financial activities
    such as money laundering and terrorist financing, and to minimize their
    vulnerability to risks associated with such activity. For this reason,
    the Federal Reserve's commitment to ensuring compliance with the Bank
    Secrecy Act continues to be a high supervisory priority. The Federal
    Reserve has an important role in ensuring that criminal activity does
    not pose a systemic threat, and, as important, in improving the ability
    of individual banking organizations in the United States and abroad to
    protect themselves from illicit activities.
        Thank you again for inviting me today to explain the Federal
    Reserve's work in this important area.

                    PREPARED STATEMENT OF JOHN D. HAWKE, JR.

                          Comptroller of the Currency
                        U.S. Department of the Treasury
                                  June 3, 2004

    Introduction
        Chairman Shelby, Ranking Member Sarbanes, Members of the Committee,
    I appreciate the opportunity to appear before you today to discuss the
    challenges we at the Office of the Comptroller of the Currency (OCC)--
    and other financial institution regulators--face in combating money
    laundering in the U.S. financial system, and how we are meeting those
    challenges. I will also address the enforcement actions in this area we
    have recently taken against Riggs Bank N.A.
        As the regulator of national banks, the OCC has long been committed
    to the fight against money laundering. For more than 30 years, the OCC
    has been responsible for ensuring that the banks under its supervision
    have the necessary controls in place and provide requisite notices to
    law enforcement to assure that those banks are not used as vehicles to
    launder money for drug traffickers or other criminal organizations. The
    tragic events of September 11 have brought into sharper focus the
    related concern of terrorist financing. Together with the other Federal
    banking agencies, the banking industry, and the law enforcement
    community, the OCC shares the Committee's goal of preventing and
    detecting money laundering, terrorist financing, and other criminal
    acts and the misuse of our Nation's financial institutions.
        The cornerstone of the Federal Government's anti-money laundering
    (AML) efforts is the Bank Secrecy Act (BSA). Enacted in 1970, the BSA
    is primarily a recordkeeping and reporting statute that is designed to
    ensure that banks and other financial institutions provide relevant
    information to law enforcement in a timely fashion. The BSA has been
    amended several times, most recently through passage of the USA PATRIOT
    Act in the wake of the September 11 tragedy. Both the Secretary of the
    Treasury, through the Financial Crimes Enforcement Network (FinCEN),
    and the Federal banking agencies, have issued regulations implementing
    the BSA, including regulations requiring all banks to have a BSA
    compliance program, and to file reports such as suspicious activity
    reports (SAR's) and currency transaction reports (CTR's).
        Due to the sheer volume of financial transactions processed through
    the U.S. financial system, primary responsibility for compliance with
    the BSA and the AML statutes rests with the Nation's financial
    institutions themselves. The OCC and the other Federal banking agencies
    are charged with ensuring that the institutions we supervise have
    strong AML programs in place to identify and report suspicious
    transactions to law enforcement, and that such reports are, in fact,
    made. Thus, our supervisory processes seek to ensure that banks have
    systems and controls in place to prevent their involvement in money
    laundering, and that they provide the types of reports to law
    enforcement that the law enforcement agencies, in turn, need in order
    to investigate suspicious transactions that are reported.
        To accomplish our supervisory responsibilities, the OCC conducts
    regular examinations of national banks and Federal branches and
    agencies of foreign banks in the United States. These examinations
    cover all aspects of the institution's operations, including compliance
    with the BSA. Our resources are concentrated on those institutions, and
    areas within institutions, of highest risk. In cases of noncompliance,
    the OCC has broad investigative and enforcement authority to address
    the problem.
        Unlike other financial institutions, which have only recently
    become subject to compliance program and SAR filing requirements, banks
    have been under such
    requirements for years. For example, banks have been required to have a
    BSA compliance program since 1987, and have been required to file SAR's
    (or their predecessors) since the 1970's. Not surprisingly, most banks
    today have strong AML programs in place, and many of the largest
    institutions have programs that are among the best in the world. There are
    now approximately 1.3 million SAR's in the centralized database that is maintained by FinCEN. While the USA PATRIOT Act further augmented the due diligence and reporting requirements for banks in several key areas, one
    of its primary objectives was to impose requirements on nonbanking
    institutions that had long been applicable to banks.
        The OCC's efforts in this area do not exist in a vacuum. We have
    long been active participants in a variety of interagency working
    groups that include representatives of the Treasury Department, law
    enforcement, and the other Federal banking agencies. We also work
    closely with the FBI and other criminal investigative agencies,
    providing them with documents, information, and expertise on a case-
    specific basis. In addition, when we are provided with lead information
    from a law enforcement agency, we use that information to investigate
    further to ensure that BSA compliance systems are adequate.
        We continue to work to improve our supervision in this area and we
    are constantly revising and adjusting our procedures to keep pace with
    technological developments and the increasing sophistication of money
    launderers and terrorist financers. For example, along with the other
    Federal banking agencies, the OCC recently developed examination
    procedures to implement several key sections of the USA PATRIOT Act,
    and we expect to be issuing a revised version of our BSA Handbook by
    year end. We have also recently initiated two programs that will
    provide stronger and more complete analytical information to assist our
    examiners in identifying banks that may have high money laundering
    risk. Specifically, we are developing a database of national-bank filed
    SAR's with enhanced search and reporting capabilities, and we also are
    developing and will implement nationwide, a new risk assessment process
    to better identify high-risk banks. Additionally, we are exploring with
    FinCEN and the other banking agencies better ways to use BSA
    information in our examination process to better identify risks and
    vulnerabilities in the banking system.
        Recent events surrounding Riggs Bank N.A. have heightened interest
    in how the banking agencies, and the OCC in particular, conduct
    supervision for BSA/AML compliance. Together with FinCEN, the OCC
    recently assessed a record $25 million civil money penalty (CMP)
    against Riggs Bank N.A. The OCC also imposed a supplemental cease-and-
    desist (C&D) order on the bank, requiring the institution to strengthen
    its controls and improve its processes in the BSA/AML area. Along with
    the C&D order we issued against the bank in July 2003, these and other
    actions we have taken have greatly reduced the bank's current risk
    profile.
        However, with the benefit of hindsight, it is clear that the
    supervisory actions that we previously took against the bank were not
    sufficient to achieve satisfactory and timely compliance with the BSA,
    that more probing inquiry should have been made into the bank's high
    risk accounts, and that stronger, more forceful enforcement action
    should have been taken sooner. While we do not believe that Riggs is
    representative of the OCC's supervision in the BSA/AML area, we are
    nonetheless taking a number of steps to guard against a repeat of this
    type of situation. In this regard, I have directed that our Quality
    Management Division commence a review and evaluation of our BSA/AML
    supervision of Riggs and make recommendations to me on several issues
    concerning our approach to and the adequacy of our BSA/AML supervision
    programs generally, and particularly with respect to Riggs.

    Background and Legal Framework
        In 1970, Congress passed the ``Currency and Foreign Transactions
    Reporting Act'' otherwise known as the ``Bank Secrecy Act'' (BSA),
    which established requirements for recordkeeping and reporting by
    private individuals, banks, and other financial institutions. The BSA
    was designed to help identify the source, volume, and movement of
    currency and other monetary instruments into or out of the United
    States or being deposited in financial institutions. The statute sought
    to achieve that objective by requiring individuals, banks, and other
    financial institutions to create a paper trail by keeping records and
    filing reports of certain financial transactions and of unusual
    currency transfers. This information then enables law enforcement and
    regulatory agencies to pursue investigations of criminal, tax, and
    regulatory violations.
        The BSA regulations require all financial institutions to submit
    various reports to the Government. The most common of these reports
    are: (1) FinCEN Form 104 (formerly IRS Form 4789)--Currency Transaction
    Report (CTR) for each payment or transfer, by, through or to a
    financial institution, which involves a transaction in currency of more
    than $10,000; and (2) FinCEN Form 105 (formerly Customs Form 4790)--
    Report of International Transportation of Currency or Monetary
    Instruments (CMIR) for each person who physically transports monetary
    instruments in an aggregate amount exceeding $10,000 into or out of the
    United States. Bank supervisors are not responsible for investigating
    or prosecuting violations of criminal law that may be indicated by the
    information contained in these reports; they are, however, charged with
    assuring that the requisite reports are filed timely and accurately.
        The Money Laundering Control Act of 1986 precludes the
    circumvention of the BSA requirements by imposing criminal liability
    for a person or institution that knowingly assists in the laundering of
    money, or who structures transactions to avoid reporting. It also
    directed banks to establish and maintain procedures reasonably designed
    to assure and monitor compliance with the reporting and recordkeeping
    requirements of the BSA. As a result, on January 27, 1987, all Federal
    bank regulatory agencies issued essentially similar regulations
    requiring banks to develop procedures for BSA compliance. The OCC's
    regulation requiring that every national bank maintain an effective BSA
    compliance program is set forth at 12 CFR Sec. 21.21 and is described
    in more detail below.
        Together, the BSA and the Money Laundering Control Act charge the
    bank regulatory agencies with:

     overseeing banks' compliance with the regulations described,
        which direct banks to establish and maintain a BSA compliance
        program;
     requiring that each examination includes a review of this
        program and describes any problems detected in the agencies' report
        of examination; and
     taking C&D actions if the agency determines that the bank has
        either failed to establish the required procedures or has failed to
        correct any problem with the procedures which was previously cited
        by the agency.

        The Annunzio-Wylie Anti-Money Laundering Act, which was enacted in
    1992, strengthened the sanctions for BSA violations and the role of the
    Treasury Department. It contained the following provisions:

     a so-called ``death penalty'' sanction, which authorized the
        revocation of the charter of a bank convicted of money laundering
        or of a criminal violation of the BSA;
     an authorization for Treasury to require the filing of
        suspicious-transaction reports by financial institutions;
     the grant of a ``safe harbor'' against civil liability to
        persons who report suspicious activity; and
     an authorization for Treasury to issue regulations requiring
        all financial institutions, as defined in BSA regulations, to
        maintain ``minimum standards'' of an AML program.

        Two years later, Congress passed the Money Laundering Suppression
    Act, which primarily addressed Treasury's role in combating money
    laundering. This statute:

     directed Treasury to attempt to reduce the number of CTR
        filings by 30 percent and, to assist in this effort, it established
        a system of mandatory and discretionary exemptions for banks;
     required Treasury to designate a single agency to receive
        SAR's;
     required Treasury to delegate CMP powers for BSA violations to
        the Federal bank regulatory agencies subject to such terms and
        conditions as Treasury may require;
     required nonbank financial institutions to register with
        Treasury; and
     created a safe harbor from penalties for banks that use
        mandatory and discretionary exemptions in accordance with Treasury
        directives.

        Finally, in 2001, as a result of the September 11 terror attacks,
    Congress passed the USA PATRIOT Act. The USA PATRIOT Act is arguably
    the single most significant AML law that has been enacted since the BSA
    itself. Among other things, the USA PATRIOT Act augmented the existing
    BSA framework by prohibiting banks from engaging in business with
    foreign shell banks, requiring banks to enhance their due diligence
    procedures concerning foreign correspondent and private banking
    accounts, and strengthening their customer identification procedures.
    The USA PATRIOT Act also:

     provides the Secretary of the Treasury with the authority to
        impose special measures on jurisdictions, institutions, or
        transactions that are of ``primary money-laundering concern;''
     facilitates records access and requires banks to respond to
        regulatory requests for information within 120 hours;
     requires regulatory agencies to evaluate an institution's AML
        record when considering bank mergers, acquisitions, and other
        applications for business combinations;
     expands the AML program requirements to all financial
        institutions; and
     increases the civil and criminal penalties for money
        laundering.

        The OCC and the other Federal banking agencies have issued two
    virtually identical regulations designed to ensure compliance with the
    BSA. The OCC's BSA compliance regulation, 12 CFR Sec. 21.21, requires
    every national bank to have a written program, approved by the board of
    directors, and reflected in the minutes of the bank. The program must
    be reasonably designed to assure and monitor compliance with the BSA
    and must, at a minimum: (1) provide for a system of internal controls
    to assure ongoing compliance; (2) provide for independent testing for
    compliance; (3) designate an individual responsible for coordinating
    and monitoring day-to-day compliance; and (4) provide training for
    appropriate personnel. In addition, the implementing regulation for
    Section 326 of the USA PATRIOT Act requires every bank adopt a customer
    identification program as part of its BSA compliance program.
        The OCC's SAR regulation, 12 CFR Sec. 21.11, requires every
    national bank to file a SAR when they detect certain known or suspected
    violations of Federal law or suspicious transactions related to a money
    laundering activity or a violation of the BSA. This regulation mandates
    a SAR filing for any potential crimes: (1) involving insider abuse
    regardless of the dollar amount; (2) where there is an identifiable
    suspect and the transaction involves $5,000 or more; and (3) where
    there is no identifiable suspect and the transaction involves $25,000
    or more. Additionally, the regulation requires a SAR filing in the case
    of suspicious activity that is indicative of potential money laundering
    or BSA violations and the transaction involves $5,000 or more.

    OCC'S BSA/AML Supervision
        The OCC and the other Federal banking agencies are charged with
    ensuring that banks maintain effective AML programs. The OCC's AML
    responsibilities are coextensive with our regulatory mandate of
    ensuring the safety and soundness of the national banking system. Our
    supervisory processes seek to ensure that institutions have compliance
    programs in place that include systems and controls to satisfy
    applicable CTR and SAR filing requirements, as well as other reporting
    and recordkeeping requirements to which banks are subject under the
    BSA.
        The OCC devotes significant resources to BSA/AML supervision. The
    OCC has nearly 1,700 examiners in the field, many of whom are involved
    in both safety and soundness and compliance with applicable laws
    including the BSA. We have over 300 examiners onsite at our largest
    national banks, engaged in continuous supervision of all aspects of
    their operations. In 2003, the equivalent of approximately 40 full time
    employees were dedicated to BSA/AML supervision. The OCC also has three
    full-time BSA/AML compliance specialists in our Washington DC
    headquarters office dedicated to developing policy, training, and
    assisting on complex examinations. In addition, the OCC has a full-time
    fraud expert in Washington DC, who is responsible for tracking the
    activities of offshore shell banks and other vehicles for defrauding
    banks and the public. These resources are supplemented by dozens of
    attorneys in our district offices and Washington DC headquarters office
    who work on compliance matters. In 2003 alone, not including our
    continuous large bank supervision, the OCC conducted approximately
    1,340 BSA examinations of 1,100 institutions and, since 1998, we have
    completed nearly 5,700 BSA examinations of 5,300 institutions.
        The OCC monitors compliance with the BSA and money laundering laws
    through its BSA compliance and money laundering prevention examination
    procedures. The OCC's examination procedures were developed by the OCC,
    in conjunction with the other Federal banking agencies, based on our
    extensive experience in supervising and examining national banks in the
    area of BSA/AML compliance. The procedures are risk-based, focusing our
    examination resources on high-risk banks and high-risk areas within
    banks. During an examination, examiners use the procedures to review
    the bank's policies, systems, and controls. Examiners test the bank's
    systems by reviewing certain individual transactions when they note
    control weaknesses, have concerns about high-risk products or services
    in a bank, or receive information from a law enforcement or other
    external source.
        In 1997, the OCC formed the National Anti-Money Laundering Group
    (NAMLG), an internal task force that serves as the focal point for all
    BSA/AML matters. Through the NAMLG, the OCC has undertaken a number of
    projects designed to improve the agency's supervision of the BSA/AML
    activities of national banks. These projects include the development of
    a program to identify high-risk banks for expanded scope BSA
    examinations and the examination of those banks using agency experts
    and expanded procedures; examiner training; the development of revised
    examination procedures; and issuance of policy guidance on various BSA/
    AML topics.
        Over the years, the NAMLG has had many significant accomplishments
    including:

     publishing and updating numerous guidance documents, including
        the Comptroller's BSA Handbook, extensive examination procedures,
        numerous OCC advi-sories, bulletins and alerts, and a comprehensive
        reference guide for bankers and examiners;
     providing expertise to the Treasury Department and the
        Department of Justice in drafting the annual U.S. National Money
        Laundering Strategy;
     providing expertise to the Treasury Department, FinCEN and the
        other Federal banking agencies in drafting the regulations to
        implement the USA PATRIOT Act; and
     developing state-of-the-art training programs for OCC and
        other Federal and foreign regulatory authorities in training their
        examiners in BSA/AML supervision.

        To deploy its resources most effectively, the OCC uses criteria
    developed by NAMLG that targets banks for expanded scope AML
    examinations. Experienced examiners and other OCC experts who
    specialize in BSA compliance, AML, and fraud are assigned to the
    targeted examinations. The examinations focus on areas of identified
    risk and include comprehensive transactional testing procedures. The
    following factors are considered in selecting banks for targeted
    examinations:

     locations in high-intensity drug trafficking areas (HIDTA) or
        high-intensity money laundering and related financial crime areas
        (HIFCA);
     excessive currency flows;
     significant international, private banking, fiduciary or other
        high-risk activities;
     unusual suspicious activity reporting patterns;
     unusual large currency transaction reporting patterns; and
     fund transfers or account relationships with drug source
        countries or countries with stringent financial secrecy laws.

        The program may focus on a particular area of risk in a given year.
    For example, our 2005 targeting program will focus on banks that have
    significant business activity involving foreign money services
    businesses. In prior years, our targeting focus has been on banks that
    have significant business activity in private banking, offshore
    banking, and lines of business subject to a high risk of terrorist
    financing.
        Other responsibilities of the NAMLG include sharing information
    about money laundering issues with the OCC's District offices;
    analyzing money laundering trends and emerging issues; and promoting
    cooperation and information sharing with national and local AML groups,
    the law enforcement community, bank regulatory agencies, and the
    banking industry.
        NAMLG has also worked with law enforcement agencies and other
    regulatory agencies to develop an interagency examiner training
    curriculum that includes instruction on common money laundering
    schemes. In addition, the OCC has conducted AML training for foreign
    bank supervisors and examiners two to three times per year for the past
    4 years. Over 250 foreign bank supervisors have participated in this
    training program. Recently, the World Bank contracted with the OCC to
    tape our international BSA school for worldwide broadcast. The OCC has
    also partnered with the State Department to provide AML training to
    high-risk jurisdictions, including selected Middle Eastern countries.
    And we consistently provide instructors for the Federal Financial
    Institutions Examination Council schools, which are now patterned after
    the OCC's school. In total, the OCC's AML schools have trained
    approximately 550 OCC examiners over the past 5 years.

    OCC's Enforcement Authority
        Effective bank supervision requires clear communications between
    the OCC and the bank's senior management and board of directors. In
    most cases, problems in the BSA/AML area, as well as in other areas,
    are corrected by bringing the problem to the attention of bank
    management and obtaining management's commitment to take corrective
    action. An OCC Report of Examination documents the OCC's findings and
    conclusions with respect to its supervisory review of a bank. Once
    problems or weaknesses are identified and communicated to the bank, the
    bank's senior management and board of directors are expected to
    promptly correct them. The actions that a bank takes, or agrees to
    take, to correct deficiencies documented in its Report are important
    factors in determining whether more forceful action is needed.
        OCC enforcement actions fall into two broad categories: Informal
    and formal. In general, informal actions are used when the identified
    problems are of limited scope and magnitude and bank management is
    regarded as committed and capable of correcting them. Informal actions
    include commitment letters, memoranda of understanding, and matters
    requiring board attention in examination reports. These
    generally are not public actions.
        The OCC also may use a variety of formal enforcement actions to
    support its supervisory objectives. Unlike most informal actions,
    formal enforcement actions are authorized by statute, are generally
    more severe, and are disclosed to the public. Formal actions against a
    bank include C&D orders, formal written agreements and CMPs. C&D orders
    and formal agreements are generally entered into consensually by the
    OCC and the bank and require the bank to take certain actions to
    correct identified deficiencies. The OCC may also take formal action
    against officers, directors and other individuals associated with an
    institution (institution-affiliated parties). Possible actions against
    institution-affiliated parties include removal and prohibition from
    participation in the banking industry, CMP's, and C&D orders.
        In the BSA area, the OCC's CMP authority is concurrent with that of
    FinCEN. In cases involving systemic noncompliance with the BSA, in
    addition to taking our own actions, the OCC refers the matter to
    FinCEN. In the case of Riggs Bank, the OCC and FinCEN worked together
    on the CMP against the bank.
        In recent years, the OCC has taken numerous formal actions against
    national banks to bring them into compliance with the BSA. These
    actions are typically C&D orders and formal agreements. The OCC has
    also taken formal actions against institution-affiliated parties who
    participated in BSA violations. From 1998 to 2003, the OCC has issued a
    total of 78 formal enforcement actions based in whole, or in part, on
    BSA/AML violations. During this same time period, the OCC has also
    taken countless informal enforcement actions to correct compliance
    program deficiencies that did not rise to the level of a violation of
    law.

    Significant BSA/AML Enforcement Actions
        The OCC has been involved in a number of cases involving serious
    BSA violations and, in some cases, actual money laundering. Some of the
    more significant cases involved the Bank of China (New York Federal
    Branch), Broadway National Bank, Banco do Estado de Parana (New York
    Federal Branch), and Jefferson National Bank. There are also dozens of
    other examples where the OCC identified significant money laundering or
    BSA non-compliance, took effective action to stop the activity, and
    ensured that accurate and timely referrals were made to law
    enforcement.

    Bank of China, New York Federal Branch
        In May 2000, OCC examiners conducting a safety and soundness
    examination discovered serious misconduct on the part of the branch and
    its former officials, including the facilitation of a fraudulent letter
    of credit scheme and other suspicious activity and potential fraud and
    money laundering. The misconduct, which resulted in significant losses
    to the branch, was subsequently referred to law enforcement. In January
    2002, the OCC and the Peoples' Bank of China entered into companion
    actions against the Bank of China and its United States-based Federal
    branches. The bank's New York branch agreed to pay a $10 million
    penalty assessed by the OCC and the parent bank, which is based in
    Beijing, agreed to pay an equivalent amount in local currency to the
    People's Bank of China, for a total of $20 million. The OCC also
    required that the branch execute a C&D order which, among other things,
    required it to establish account opening and monitoring procedures, a
    system for identifying high risk customers, and procedures for regular,
    ongoing review of account activity of high risk customers to monitor
    and report suspicious activity. The OCC also took actions against six
    institution-affiliated parties.

    Broadway National Bank, New York, New York
        In March 1998, the OCC received a tip from two separate law
    enforcement agencies that this bank may be involved in money
    laundering. The OCC immediately opened an examination which identified
    a number of accounts at the bank that were either being used to
    structure transactions, or were receiving large amounts of cash with
    wire transfers to countries known as money laundering and drug havens.
    Shortly thereafter, the OCC issued a C&D order which shut down the
    money laundering and required the bank to adopt more stringent
    controls. The OCC also initiated prohibition and CMP cases against bank
    insiders. In referring the matter to law enforcement, we provided
    relevant information including the timing of deposits that enabled law
    enforcement to seize approximately $4 million and arrest a dozen
    individuals involved in this scheme. The subsequent OCC investigation
    resulted in the filing of additional SAR's, the seizure of
    approximately $2.6 million in additional funds, more arrests by law
    enforcement, and a referral by the OCC to FinCEN. In November 2002, the
    bank pled guilty to a three count felony information that charged it
    with failing to maintain an AML program, failing to report
    approximately $123 million in suspicious bulk cash and structured cash
    deposits, and aiding and assisting customers to structure approximately
    $76 million in transactions to avoid the CTR requirements. The bank was
    required to pay a $4 million criminal fine.
    Banco do Estado de Parana, Federal Branch, New York, N.Y (Banestado)
        In the summer of 1997, the OCC received information from Brazilian
    Government officials concerning unusual deposits leaving Brazil via
    overnight courier. The OCC immediately dispatched examiners to the
    branch that was receiving the majority of the funds. OCC examiners
    discovered significant and unusually large numbers of monetary
    instruments being shipped via courier into the Federal branch from
    Brazil and other countries in South America, as well as suspicious wire
    transfer activity that suggested the layering of the shipped deposits
    through various accounts with no business justification for the
    transfers. The OCC entered into a C&D order with the Federal branch and
    its head office in Brazil in January 1998 that required controls over
    the courier and wire transfer activities and the filing of SAR's with
    law enforcement. The OCC also hosted several meetings with various law
    enforcement agencies discussing these activities and filed a referral
    with FinCEN. Shortly thereafter, the Brazilian bank liquidated the
    branch. In May 2000, the OCC assessed a CMP against the branch for
    $75,000.

    Jefferson National Bank, Watertown, New York
        During the 1993 examination of this bank, the OCC learned from the
    Federal Reserve Bank of New York that the bank was engaging in cash
    transactions that were not commensurate with its size. OCC examiners
    subsequently discovered that several bank customers were depositing
    large amounts of cash that did not appear to be supported by the
    purported underlying business, with the funds being wired offshore. The
    OCC filed four criminal referral forms (predecessor to the SAR) with
    law enforcement pertaining to this cash activity and several additional
    criminal referral forms pertaining to insider abuse and fraud at the
    bank. The OCC also briefed several domestic and Canadian law
    enforcement agencies alerting them to the significant sums of money
    flowing through these accounts at the bank. Based upon this
    information, law enforcement commenced an investigation of these large
    deposits. The investigation resulted in one of the most successful
    money laundering prosecutions in U.S. Government history. The
    significant sums of money flowing through the bank were derived from
    cigarette and liquor smuggling through the Akwesasne Indian Reservation
    in northern New York. The ring smuggled $687 million worth of tobacco
    and alcohol into Canada between 1991 and 1997. The case resulted in 21
    indictments that also sought the recovery of assets totaling $557
    million. It also resulted in the December 1999 guilty plea by a
    subsidiary of R.J. Reynolds tobacco company and the payment of a $15
    million criminal fine. The four criminal referral forms filed by the
    OCC in the early stages of this investigation were directly on point
    and pertained to the ultimate ringleaders in the overall scheme. These
    money laundering cases were in addition to the C&D order entered into
    with the bank, the prohibition and CMP cases that were brought by the
    OCC, and the insider abuse bank fraud cases that were brought by law
    enforcement against some of the bank's officers and directors. Seven
    bank officers and directors were ultimately convicted of crimes.

    OCC Cooperation with Law Enforcement and Other Agencies
        As the above cases illustrate, combating money laundering depends
    on the cooperation of law enforcement, the bank regulatory agencies,
    and the banks themselves. The OCC participates in a number of
    interagency working groups aimed at money laundering prevention and
    enforcement, and meets on a regular basis with law enforcement agencies
    to discuss money laundering issues and share information that is
    relevant to money laundering schemes. For example, the OCC is an
    original member of both the National Interagency Bank Fraud Working
    Group and the Bank Secrecy Act Advisory Group. Both of these groups
    include representatives of the Department of Justice, the FBI, the
    Treasury Department, and other law enforcement agencies, as well as the
    Federal banking agencies. Through our interagency contacts, we
    sometimes receive leads as to possible money laundering in banks that
    we supervise. Using these leads, we can target compliance efforts in
    areas where we are most likely to uncover problems. For example, if the
    OCC receives information that a particular account is being used to
    launder money, our examiners would then review transactions in that
    account for suspicious funds movements, and direct the bank to file a
    SAR if suspicious transactions are detected. The OCC also provides
    information, documents, and expertise to law enforcement for use in
    criminal investigations on a case-specific basis.
        The OCC has also played an important role in improving the AML and
    terrorist financing controls in banking throughout the world. For the
    past several years, the OCC has provided examiners to assist with
    numerous U.S. Government-sponsored international AML and terrorist
    financing assessments. We have a cadre of specially trained examiners
    that has provided assistance to the Treasury Department and the State
    Department on these assessments in various parts of the world,
    including South and Central America, the Caribbean, the Pacific-rim
    nations, the Middle East, Russia, and the former Eastern Bloc nations.
    In this regard, the cadre has participated in terrorist financing
    investigations, assessed local money laundering laws and regulatory
    infrastructure, and provided training to bank supervisors.
        The OCC is also providing direct assistance to the Coalition
    Provisional Authority (CPA) of Iraq. Four OCC examiners are currently
    working in Iraq as technical assistance advisers to the CPA's Ministry
    of Finance and helping their counterparts at the Central Bank of Iraq
    develop a risk-based supervisory system tailored to the Iraqi banking
    system. The OCC examiners are assisting in the development of a law
    addressing money laundering and terrorist financing that is close to
    enactment by the CPA, the drafting of new policy and examination
    manuals to implement this law, and they are providing extensive AML
    training to Iraqi bank regulators.
    Post-September 11 Activities and the Implementation of the

    USA PATRIOT Act
        In the immediate aftermath of the September 11 terror attacks, the
    OCC participated in a series of interagency meetings with bankers
    sponsored by the New York Clearinghouse to discuss the attacks and
    their impact on the U.S. economy and banking system, and provided
    guidance to the industry concerning the various requests from law
    enforcement for account and other information. The OCC was also
    instrumental in working with the other banking agencies to establish an
    electronic e-mail system for law enforcement to request information
    about suspected terrorists and money launderers from every financial
    institution in the country. This FBI Control List system was in place
    five weeks after September 11 and was the precursor to the current
    system established under Section 314(a) of the USA PATRIOT Act, which
    is now administered by FinCEN. At the same time, the OCC established a
    secure emergency communications e-mail system for all national banks
    through the OCC's BankNet technology.
        In October 2001, Congress passed the USA PATRIOT Act. The OCC has
    been heavily involved in the many interagency work groups tasked with
    writing regulations to implement the USA PATRIOT Act over the past few
    years. To date, these work groups have issued final rules implementing
    Sections 313 (foreign shell bank prohibition); 319(b) (foreign
    correspondent bank account records), 314 (information sharing), and 326
    (customer identification). The OCC was also involved in drafting the
    interim final rule implementing Section 312 (foreign private banking
    and correspondent banking).
        The OCC took the lead in developing the current 314(a) process for
    disseminating information between law enforcement and the banks. The
    OCC worked with the interested regulatory and law enforcement agencies,
    and drafted detailed instructions to banks concerning the 314(a)
    process and the extent to which banks are required to conduct record
    and transactions searches on behalf of law enforcement. The OCC also
    took the lead in drafting a frequently asked questions (FAQ's) document
    to provide further guidance as to the types of accounts and
    transactions required to be searched, when manual searches for this
    information would be required, and the timeframes for providing
    responses back to law enforcement. Under the new procedures, 314(a)
    requests from FinCEN are batched and issued every two weeks, unless
    otherwise indicated, and financial institutions have two weeks to
    complete their searches and respond with any matches.
        Throughout this process, the OCC continually assisted FinCEN in
    maintaining an accurate electronic database of 314(a) contacts for
    every national bank and Federal branch, provided effective
    communications to the industry through agency alerts concerning the
    314(a) system, and participated in quarterly interagency meetings with
    fellow regulators and law enforcement agencies to ensure that the
    process was working effectively and efficiently.
        The OCC also took the lead in drafting the interagency Customer
    Identification Program (CIP) regulation mandated by Section 326 of the
    USA PATRIOT Act, which mandates the promulgation of regulations that,
    at a minimum, require financial institutions to implement reasonable
    procedures for: (1) verifying the identity of any person seeking to
    open an account, to the extent reasonable and practicable; (2)
    maintaining records of the information used to verify the person's
    identity, including name, address, and other identifying information;
    and (3) determining whether the person appears on any lists of known or
    suspected terrorists or terrorist organizations provided to the
    financial institution by any government agency. The OCC is also the
    primary drafter of interagency FAQ's concerning the implementation of
    the CIP rules. A second set of interagency FAQ's will be issued
    shortly.
        In order to assess USA PATRIOT Act implementation by the industry,
    in the summer of 2002, the OCC conducted reviews of all of its large
    banks to assess their compliance with the regulations issued under the
    USA PATRIOT Act up to that time, and to evaluate the industry response
    to terrorist financing risk. Although, at that time, many of the USA
    PATRIOT Act regulations had not yet been finalized, we felt it was
    important to ascertain the level of bank compliance with and
    understanding of the new requirements. The purpose of these reviews was
    to discern the types of systems and controls banks had in place to
    deter terrorist financing, and follow up with full-scope AML exams in
    institutions that had weaknesses. As a result of these reviews, the OCC
    was able to obtain practical first hand knowledge concerning how banks
    were interpreting the new law, whether banks were having problems
    implementing the regulations or controlling terrorist financing risk,
    and which banks needed further supervision in this area.
        On October 20, 2003, the OCC issued interagency examination
    procedures to evaluate national bank compliance with the requirements
    of Section 313 and 319(b), and Section 314 of the USA PATRIOT Act. The
    procedures were designed to assess how well banks are complying with
    the new regulations and to facilitate a consistent supervisory approach
    among the banking agencies. OCC examiners are now using the procedures
    during BSA/AML examinations of the institutions under our supervision.
    The procedures allow examiners to tailor the examination scope
    according to the reliability of the bank's compliance management system
    and the level of risk assumed by the institution. An interagency
    working group is currently drafting examination procedures concerning
    Section 326 of the USA PATRIOT Act. The OCC is also the primary drafter
    of these procedures and we expect that they will be issued shortly.

    OCC Outreach and Industry Education
        As previously stated, the primary responsibility for ensuring that
    banks are in compliance with the BSA lies with the bank's management
    and its directors. To aid them in meeting this responsibility, the OCC
    devotes extensive time and resources to educating the banking industry
    about its obligations under the BSA. This has typically included active
    participation in conferences and training sessions across the country.
    For example, in 2002 the OCC sponsored a nationwide teleconference to
    inform the banking industry about the USA PATRIOT Act. This
    teleconference was broadcast to 774 sites with approximately 5,400
    listeners.
        The OCC also provides guidance to national banks through: (1)
    industry outreach efforts that include roundtable discussions with
    bankers and industry wide conference calls sponsored by the OCC; (2)
    periodic bulletins that inform and remind banks of their
    responsibilities under the law, applicable regulations, and
    administrative rulings dealing with BSA reporting requirements and
    money laundering; (3) publications, including the distribution of
    comprehensive guide in this area entitled Money Laundering: A Banker's
    Guide to Avoiding Problems; (4) publication and
    distribution of the Comptroller's BSA Handbook which contains the OCC's
    BSA examination procedures, and the Comptroller's Handbook for
    Community Bank Supervision which provides guidance on BSA/AML risk
    assessment; and (5) periodic alerts and advisories of potential frauds
    or questionable activities, such as alerts on unauthorized banks and
    FinCEN reporting processes. In addition, senior OCC officials are
    regular participants in industry seminars and forums on the BSA, the
    USA PATRIOT Act, and related topics.

    Current Supervisory Initiatives
        The OCC uses somewhat different examination approaches depending
    largely on the size of the institution and its risk profile. In large
    banks (generally total assets of $25 billion) and mid-size banks
    (generally total assets of $5 billion), OCC examiners focus first on
    the bank's BSA compliance program. These banks are subject to our
    general BSA/AML examination procedures that include, at a minimum, a
    review of the bank's internal controls, policies, procedures, customer
    due diligence, SAR/CTR information, training programs, and compliance
    audits. We also evaluate BSA officer competence, the BSA program
    structure, and the bank's audit program, including the independence and
    competence of the audit staff. While examining for overall BSA
    compliance, examiners typically focus on suspicious activity monitoring
    and reporting systems and the effectiveness of the bank's customer due
    diligence program.
        Additional and more detailed procedures are conducted if control
    weaknesses or concerns are encountered during the general procedures
    phase of the examination. These supplemental procedures include:

     transaction testing to ascertain the level of risk in the
        particular business area (for example, private banking, payable
        upon proper identification programs (PUPID), nonresident alien
        accounts, international brokered deposits, foreign correspondent
        banking, and pouch activity) and to determine whether the bank is
        complying with its policies and procedures, including SAR and CTR
        filing requirements;
     evaluation of the risks in a particular business line or in
        specific accounts and a determination as to whether the bank is
        adequately managing the risks;
     a selection of bank records to determine that its
        recordkeeping processes are in compliance with the BSA.

        For community banks (generally total assets under $5 billion),
    examiners determine the examination scope based on the risks facing the
    institution. For low-risk banks, examiners evaluate changes to the
    bank's operations and review the bank's BSA/AML compliance program. For
    banks with higher risk characteristics and weak controls, additional
    procedures are performed, including review of a sample of high-risk
    accounts and additional procedures set forth above. Examiners also
    perform periodic monitoring procedures between examinations and conduct
    follow-up activities when significant issues are identified.

    Use of CTR and SAR Data in the Examination Process
        All banks are required by regulation to report suspected crimes and
    suspicious transactions that involve potential money laundering or
    violate the BSA. In April 1996, the OCC, together with the other
    Federal banking agencies, and FinCEN, unveiled the SAR system, SAR
    form, and database. This system provides law enforcement and regulatory
    agencies online access to the entire SAR database. Based upon the
    information in the SAR's, law enforcement agencies may then, in turn,
    initiate investigations and, if appropriate, take action against
    violators. By using a universal SAR form, consolidating filings in a
    single location, and permitting electronic filing, the system greatly
    improves the reporting process and makes it more useful to law
    enforcement and to the regulatory agencies. As of December 2003, banks
    and regulatory agencies had filed over 1.3 million SAR's, with national
    banks by far the biggest filers. Nearly 50 percent of these SAR's were
    for suspected BSA/money laundering violations.
        The OCC also uses the SAR database as a means of identifying high-
    risk banks and high-risk areas within banks. Year-to-year trend
    information on the number of SAR's and CTR's filed is used to identify
    banks with unusually low or high filing activity. This is one factor
    used by the OCC to identify high-risk banks. Examiners also review
    SAR's and CTR's to identify accounts to include in the examination
    sample. Accounts where there have been repetitive SAR filings or
    accounts with significant cash activity in a high-risk business or
    inconsistent with the type of business might be accounts selected for
    the sample.

    Riggs Bank Enforcement Actions
        As previously mentioned, the OCC and FinCEN recently assessed a $25
    million CMP against Riggs Bank N.A. for violations of the BSA and its
    implementing regulations, and for failing to comply with the
    requirements of an OCC C&D order that was signed by the bank in July
    2003. Also, in a separate C&D action dated May 13, 2004 to supplement
    the C&D we had issued in July 2003, the OCC directed the bank to take a
    number of steps to correct deficiencies in its internal controls,
    particularly in the BSA/AML area. Among other requirements in this
    separate action, the OCC directed the bank to:

     Ensure competent management. Within 30 days, the board of
        directors must determine whether management or staff changes are
        needed and whether management skills require improvement.
     Develop a plan to evaluate the accuracy and completeness of
        the bank's books and records, and develop a methodology for
        determining that information required by the BSA is appropriately
        documented, filed, and maintained.
     Adopt and implement comprehensive written policies for
        internal controls applicable to the bank's account relationships
        and related staffing, including the Embassy and International
        Private Banking Group. Among other requirements, the policies must
        mandate background checks of all relationship managers at least
        every 3 years and must prohibit any employee from having signature
        authority, ownership, or custodial powers for any customer account.
     Develop and implement a policy that permits dividend payments
        only when the bank is in compliance with applicable law and upon
        written notice to the OCC.
     Adopt and implement an internal audit program sufficient to
        detect irregularities in the bank's operation, determine its level
        of compliance with applicable laws and regulations and provide for
        testing to support audit findings, among other requirements.

        These actions were based on a finding that the bank had failed to
    implement an effective AML program. As a result, the bank did not
    detect or investigate suspicious transactions and had not filed SAR's
    as required under the law. The bank also did not collect or maintain
    sufficient information about its foreign bank customers. In particular,
    the OCC found a number of problems with the bank's account relationship
    with foreign governments, including Saudi Arabia and Equatorial Guinea.
    Riggs failed to properly monitor, and report as suspicious,
    transactions involving tens of million of dollars in cash withdrawals,
    international drafts that were returned to the bank, and numerous
    sequentially numbered cashier's checks. The OCC will continue to
    closely monitor the corrective action that the bank takes in response
    to the order and we are prepared to take additional actions if
    necessary.
        These actions are the most recent of a series of escalating
    supervisory and enforcement reactions to ongoing deficiencies in Riggs
    BSA/AML compliance program. Since this matter involves an open bank and
    open investigations, there are limitations on what can be said without
    disclosing confidential supervisory information and potentially
    compromising future criminal, civil and administrative actions. With
    that caveat, we have tried to set out below a summary of our
    supervision of this institution in the BSA/AML area, dating back to
    1997.
        The OCC first identified deficiencies in Riggs' procedures several
    years ago. Beginning in the late 1990's, we recognized the need for
    improved processes at Riggs and for improvements in the training in,
    and awareness of, the BSA's requirements and in the controls over their
    BSA processes. Prior to September 11, the OCC visited the bank at least
    once a year and sometimes more often to either examine or review the
    Bank's BSA/AML compliance program.
        Over this timeframe OCC examiners consistently found that Riggs'
    BSA compliance program was either ``satisfactory'' or ``generally
    adequate,'' meaning that it met the minimum requirements of the BSA,
    but we nonetheless continued to identify weaknesses and areas of its
    program that needed improvement in light of the business conducted by
    the bank. We addressed these weaknesses using various informal,
    supervisory actions. Generally, this involved bringing the problems to
    the attention of bank management and the board and securing their
    commitment to take corrective action.
        During this period, it was clear that the bank's compliance program
    needed improvement but we determined that the program weaknesses did
    not rise to the level of a violation of our regulation or pervasive
    supervisory concern. The OCC identified problems with the bank's
    internal audit coverage in this area, its internal monitoring
    processes, and its staff training on the BSA and customer due diligence
    requirements. Repeatedly, management took actions to address specific
    OCC concerns but, as is now clear, the corrective actions being taken
    often were not sufficient to achieve the intended results. The bank was
    continually taking steps to respond to OCC criticisms, but failed to
    take action on its own to improve its overall compliance program,
    especially with regard to high-risk areas. Due to the lack of an
    effective and proactive management team, additional weaknesses and
    deficiencies were continually identified by the OCC over this time
    period, but bank follow-up on these weaknesses ultimately proved to be
    ineffective and the problems continued longer than they should have.
        As various changes occurred in the regulatory expectations for
    banks relative to BSA compliance and related issues over this period of
    time, our scrutiny of the bank was adjusted accordingly. For example,
    when the Financial Action Task Force and FinCEN identified
    ``uncooperative'' countries, we conducted an examination at Riggs that
    specifically focused on account relationships with those countries and
    determined that the bank did not have extensive transaction activity
    with any of the countries on the list. In addition, Treasury issued its
    guidance on ``politically exposed persons'' in January 2001, and, as a
    result, the OCC's focus on the risks associated with the Riggs' embassy banking business began to increase and our supervisory activities were heightened accordingly. However, at that time, the Kingdom of Saudi Arabia
    was not viewed as a country that posed heightened risk of money laundering
    or terrorist financing, and Equatorial Guinea had just begun to reap the financial benefits of the discovery of large oil reserves in the mid-1990's.
        After September 11, the OCC escalated its supervisory efforts to
    bring Riggs' compliance program to a level commensurate with the risks
    that were undertaken by the bank and we believed that we were beginning
    to see some progress in this regard. In fact, the bank was beginning
    the process of a major computer system conversion that would address
    many of the shortcomings in the existing information systems that the
    bank was relying on. Unfortunately, bank management had to adjust the
    timeline repeatedly. This caused significant delays in the
    implementation date, pushing it from the original target of year-end
    2002 to September 2003. Thus, the bank was not able to fulfill many of
    the commitments that it made to the OCC to correct our concerns
    pertaining to their BSA compliance program. Also, as previously
    mentioned, the OCC conducted a series of anti-terrorist financing
    reviews at our large or high-risk banks, including Riggs, in 2002. As a
    result of these reviews and other internal assessments, plus published
    accounts of suspicious money transfers involving Saudi Embassy
    accounts, our concerns regarding Riggs BSA/AML compliance were
    heightened. Thus, we commenced another examination of Riggs in January
    2003.
        The focus of the January 2003 examination was on Riggs' Embassy
    banking business, and, in particular, the accounts related to the
    Embassy of Saudi Arabia. Due to its Washington DC location, its
    extensive retail branch network, and its expertise in private banking,
    Riggs found embassy banking to be particularly attractive and had
    developed a market niche. In fact, at one time, 95 percent of all
    foreign embassies in the United States, and 50 percent of the embassies
    in London conducted their banking business with Riggs. The OCC's
    examination lasted for approximately 5 months and involved experts in
    the BSA/AML area. The findings from the January 2003 examination formed
    the basis for the July 2003 C&D order entered into with the bank. The
    OCC also identified violations of the BSA that were referred to FinCEN.
        During the course of the 2003 examination, the OCC cooperated
    extensively with investigations by law enforcement into certain
    suspicious transactions involving the Saudi Embassy relationship. These
    transactions involved tens of millions of dollars in cash withdrawals
    from accounts related to the Embassy of Saudi Arabia; dozens of
    sequentially numbered international drafts that totaled millions of
    dollars that were drawn from accounts related to officials of Saudi
    Arabia, and that were returned to the bank; and dozens of sequentially
    numbered cashier's checks that were drawn from accounts related to
    officials of Saudi Arabia made payable to the accountholder. There was
    regular contact with the FBI investigators throughout this examination.
    We provided the FBI with voluminous amounts of documents and
    information on the suspicious transactions, including information
    concerning transactions at the bank that the FBI previously was not
    aware of. The OCC also hosted a meeting with the FBI to discuss these
    documents and findings. Throughout this process we provided the FBI
    with important expertise on both general banking matters, and on some
    of the complex financial transactions and products that were
    identified.
        The July 2003 C&D order directed the bank to take a number of steps
    to correct deficiencies in its internal controls in the BSA/AML area
    and to strongly consider staffing changes. Among other requirements in
    this action, the OCC directed the bank to:

     Hire an independent, external management consultant to conduct
        a study of the Bank's compliance with the BSA, including, training,
        SAR monitoring, and correcting deficiencies and conduct a risk
        assessment for compliance with the BSA throughout the bank.
     Evaluate the responsibilities and competence of management. In
        particular, the consultant's report to the board of directors must
        address, among other things, the responsibilities and competence of
        the bank's BSA officer, and the capabilities and competence of the
        supporting staff in this area. Within 90 days, the board of
        directors must determine whether any changes are needed regarding
        the bank's BSA officer and staff;
     Adopt and implement detailed policies and procedures
        (including account opening and monitoring procedures) to provide
        for BSA compliance and for the appropriate identification and
        monitoring of high risk transactions;
     Ensure effective BSA audit procedures and expansion of these
        procedures. Within 90 days the board of directors must review and
        evaluate the level of service and ability of the audit function for
        BSA matters provided by any auditor; and
     Ensure bank adherence to a comprehensive training program for
        all appropriate operational and supervisory personnel to ensure
        their awareness and their responsibility for compliance with the
        BSA.

        The OCC began its next examination of the bank's BSA compliance in
    October 2003. The purpose of this examination was to assess compliance
    with the C&D order and the USA PATRIOT Act, and to review accounts
    related to the Embassy of Equatorial Guinea. It was clear from this
    examination that the bank had made progress in complying with the order
    and in improving its AML program. Another notable accomplishment was
    the successful implementation of the long planned system upgrade that
    significantly improved the information available to bank staff and
    management to monitor account activity and identify suspicious
    activity. Notwithstanding, there were significant areas of
    noncompliance noted by our examination. The examiners found that, as
    with the Saudi Embassy accounts, the bank lacked sufficient policies,
    procedures, and controls to identify suspicious transactions concerning
    the bank's relationship with Equatorial Guinea. These transactions
    involved millions of dollars deposited in a private investment company
    owned by an official of the country of Equatorial Guinea; hundreds of
    thousands of dollars transferred from an account of the country of
    Equatorial Guinea to the personal account of a government official of
    the country; and over a million dollars transferred from an account of
    the country of Equatorial Guinea to a private investment company owned
    by the bank's relationship manager. The findings from this examination,
    as well as previous examination findings, formed the basis for the
    OCC's recent CMP and C&D actions.
        In retrospect, as we review our BSA/AML compliance supervision of
    Riggs during this period, we should have been more aggressive in our
    insistence on remedial steps at an earlier time. We also should have
    done more extensive probing and transaction testing of accounts. Our
    own BSA examination procedures called for transactional reviews in the
    case of high-risk accounts, such as those at issue here, yet until
    recently, that was not done at Riggs in the Saudi Embassy and the
    Equatorial Guinea accounts. Clearly, the types of strong formal
    enforcement action that we ultimately took should have been taken
    sooner. This is not a case where the deficiencies in the bank's systems
    and controls were not recognized, nor was there an absence of OCC
    supervisory attention to those deficiencies. But we failed to
    sufficiently probe the transactions occurring in the bank's high-risk
    accounts and we gave the bank too much time, based on its apparent
    efforts to fix its own problems, before we demanded specific solutions,
    by specific dates, pursuant to formal enforcement actions. As described
    below, we have reevaluated our BSA/AML supervision processes in light
    of this experience and we will be implementing changes to improve how
    we conduct supervision in this area. I have also directed that our
    Quality Management Division undertake an internal review of our
    supervision of Riggs. These steps are outlined more fully below.

    Improvements Undertaken to Improve BSA/AML Supervision
        While we believe our overall supervisory approach to BSA/AML
    compliance has been rigorous and is working well, we are committed to
    ongoing evaluation of our approaches to BSA/AML compliance and to
    appropriate revisions to our approach in light of technological
    developments, and the increasing sophistication of money launderers and
    terrorist financers, as well as to address aspects of the process where
    shortcomings were evidenced in the Riggs situation. Recent and current
    initiatives include the following:

     As previously mentioned, together with the other Federal
        banking agencies, we recently developed revised examination
        procedures for several key sections of the USA PATRIOT Act and we
        expect to be issuing a revised version of our BSA Handbook by the
        end of the year.
     We plan to develop our own database of national bank-filed
        SAR's with enhanced search and reporting capabilities for use in
        spotting operational risk including in the BSA/AML area. This
        database will be compatible with the OCC's supervisory databases
        and enable us to: (1) generate specialized reports merging SAR data
        with our existing supervisory data, (2) sort SAR information by
        bank asset size and line of business, and (3) provide enhanced word
        and other search capabilities.
     We are developing and will implement nationwide, a new risk
        assessment process to better identify high-risk banks. This system
        uses standardized data on products, services, customers, and
        geographies to generate reports that we will use to identify
        potential outliers, assist in the allocation of examiner resources,
        and target our examination scopes (for example, particular products
        or business lines).
     We are exploring with FinCEN and the other agencies better
        ways to use BSA information in our examination process, so that we
        can better pinpoint risks and secure corrective action. Upon
        completion of FinCEN's BSA Direct initiative (currently under
        development), the OCC will have direct access, as opposed to dial-
        in access, to the SAR database. We expect that this direct access
        system will allow us to make better and more effective use of
        FinCEN's SAR database.
     We are also exploring how we can systematically capture BSA/
        AML criticisms in examination reports so that we can track
        situations where no follow-up formal action has been taken.
     Our Committee on Bank Supervision also has sent an alert to
        remind and reinforce for OCC examination staff the need to
        recognize accounts and transactions that appear to be anomalous or
        suspicious or that have other characteristics that should cause
        them to be considered high-risk in nature, and to conduct
        additional transaction testing and investigation in such
        situations.

        In addition, specifically with regard to Riggs, I have directed our
    Quality Management Division to immediately commence a review and
    evaluation of our BSA/AML supervision of Riggs. This review will
    include an assessment of whether we took appropriate and timely actions
    to address any shortcomings found in the bank's processes and in its
    responses to matters noted by the examiners, and the extent and
    effectiveness of our coordination and interaction with other regulators
    and with law enforcement. I have also asked for recommendations for
    improvements to our BSA/AML supervision and our enforcement policy with
    regard to BSA/AML violations.

    Conclusion
        The OCC is committed to preventing national banks from being used,
    wittingly or unwittingly, to engage in money laundering, terrorist
    financing, or other illicit activities. We stand ready to work with
    Congress, other financial institution regulatory agencies, law
    enforcement agencies, and the banking industry to continue to develop
    and implement a coordinated and comprehensive response to the threat
    posed to the Nation's financial system by money laundering and
    terrorist financing.

                     PREPARED STATEMENT OF DONALD E. POWELL

                Chairman, Federal Deposit Insurance Corporation
                                  June 3, 2004

        Mr. Chairman, Senator Sarbanes, and Members of the Committee, thank
    you for this opportunity to discuss how the Federal Deposit Insurance
    Corporation, along with the other bank regulatory agencies, addresses
    our responsibilities under the Bank Secrecy Act (BSA) and related anti-
    money laundering and antiterrorism laws.
        My testimony begins with a brief history of the BSA and an overview
    of the work the FDIC is doing under the law. I also will outline the
    current initiatives that the FDIC is undertaking to foster a culture
    more focused on the effective supervision of banks for compliance with
    BSA and related laws, and to provide assistance to law enforcement
    agencies. Finally, I will discuss some broader ideas related to the way
    bank regulators, law enforcement, and the banking industry can work
    together to address money laundering and terrorist financing.

    Background and Evolution of BSA
        The Bank Secrecy Act, which was enacted in 1970, authorizes the
    Secretary of the Treasury (Treasury) to issue regulations requiring
    that financial institutions keep records and file reports on certain
    financial transactions. Treasury's authority includes specifying filing
    and recordkeeping procedures and designating the businesses and types
    of transactions subject to these procedures. As part of its overall
    responsibility and authority to examine banks for safety and soundness,
    the FDIC is responsible for examining State-chartered, nonmember
    financial institutions for compliance with the BSA. This is consistent
    with Treasury's delegation of its authority under the BSA to the
    financial regulatory agencies for determining compliance with the
    Treasury's Financial Reporting and Recordkeeping regulations.
        The original purpose of the BSA was to prevent banks from being
    used to conceal money derived from criminal activity and tax evasion. A
    process of filing various reports, including currency transaction
    reports (CTR's), was established and proved highly useful in criminal,
    tax, and regulatory investigations and proceedings. Banks are required
    to report cash transactions over $10,000 using the CTR. The information
    collected in the CTR can provide a paper trail for investigations of
    financial crimes, including tax evasion and money laundering, and has
    led to convictions and asset forfeiture actions.
        Although the BSA has been in effect for over 30 years, numerous
    revisions and amendments have been made to enhance the notification and
    investigation of financial crimes. The Money Laundering Control Act,
    which was enacted in 1986 to respond to the increase in money
    laundering activity related to narcotics trafficking, was the first
    major expansion of the BSA. The Money Laundering Control Act
    criminalized money laundering and prohibited the structuring of
    transactions to avoid the filing of CTR's. Additionally, at that time,
    banks reported suspicious transactions by marking the ``Suspicious''
    box on the CTR and also filing a Report of an Apparent Crime form
    (criminal referral) with the bank's primary regulator and law
    enforcement agencies.
        Over the years, additional laws and amendments were passed to
    define how financial institutions share information relating to
    apparent money laundering activities with law enforcement. These laws
    included: the Annunzio-Wylie Money Laundering Suppression Act of 1992,
    which replaced the criminal referral form with the suspicious activity
    report (SAR) to be used for apparent money laundering activities; the
    Money Laundering Suppression Act of 1994, which liberalized the rules
    for using CTR exemptions; and the Money Laundering and Financial Crimes
    Strategy Act of 1998, which focused on improving cooperation and
    coordination among regulators, law enforcement, and the financial
    services industry.
        The focus of the BSA was escalated further in the wake of the
    September 11, 2001, terrorist attacks against the United States with
    passage of the Uniting and Strengthening America by Providing
    Appropriate Tools to Restrict, Intercept, and Obstruct Terrorism Act of
    2001, otherwise known as the USA PATRIOT Act. Title III of the USA
    PATRIOT Act expands the BSA beyond its original purpose of deterring
    and detecting money laundering to include terrorist financing in the
    United States. One of the new provisions requires financial
    institutions to conduct due diligence on customer accounts through a
    Customer Identification Program (CIP). The CIP requires institutions to
    maintain records, including customer information and methods used to
    verify customers' identities.
        In 1990, the Financial Crimes Enforcement Network (FinCEN) was
    established in Treasury to administer the BSA and provide a government-
    wide, multisource intelligence and analytical network. In October 2001,
    the USA PATRIOT Act elevated the status of FinCEN within Treasury and
    emphasized its role in fighting terrorist financing. In addition to
    administering the BSA, FinCEN is responsible for expanding the
    regulatory framework to other industries (such as insurance, gaming,
    securities brokers/dealers) vulnerable to money laundering, terrorist
    financing, and other crimes.

    Evolution of 314(a) Requests
        Shortly after the attacks on September 11, the Federal Bureau of
    Investigation provided a confidential listing (Control List) of
    suspected terrorists to the Federal banking agencies. The Federal
    banking agencies provided the list to financial institutions to check
    their records for any relationships or transactions with named
    suspects. Financial institutions reported positive matches to the
    Federal Reserve Bank of New York which, in turn, passed the information
    to the appropriate law enforcement agency. Based upon this information,
    law enforcement authorities would
    subpoena the reporting bank for relevant information needed to assist
    in their investigation. The initial Control List primarily consisted of
    suspects, supporters, and material witnesses of the ongoing
    investigation of the September 11 attacks.
        Section 314 of the USA PATRIOT Act requires FinCEN to establish a
    formal mechanism for law enforcement to communicate names of suspected
    terrorists and money launderers that are under investigation to
    financial institutions on a regular basis. The implementing regulations
    mandate that financial institutions receiving names of suspects search
    their account and transaction records for potential matches and report
    positive results to FinCEN in the manner and time frame specified in
    the request. This new information sharing system, referred to as
    ``314(a) Requests,'' replaced the Control List.
        Every FinCEN 314(a) request is certified and vetted as a valid and
    significant terrorist/money laundering investigation through the
    appropriate law enforcement agency prior to being sent to a financial
    institution. Law enforcement agencies maintain that this new system is
    an effective, successful tool in their investigations.
        Information provided to the FDIC from FinCEN, showing the initial
    results of the program, indicate some successes. From February 18,
    2003, through November 25, 2003, agencies have processed 188 law
    enforcement requests. Of these cases, 124 were related to money
    laundering and 64 cases were related to terrorism or terrorist
    financing. There were 1,256 subjects of interest in these
    investigations. Of these, financial institutions responded with 8,880
    matches, resulting in the discovery or issuance of the following:

     795 new accounts identified;
     35 new transactions;
     407 grand jury subpoenas;
     11 search warrants;
     29 administrative subpoenas/summons; and
     3 indictments.

        The FDIC plays a particularly active role in ensuring that the
    314(a) program runs effectively by maintaining point of contact
    information for FDIC-supervised and national banks. By properly
    maintaining this information, the FDIC ensures that banks are able to
    act on 314(a) requests in the timeliest fashion.
        The 314(a) requests should not be confused with the list published
    by the Department of the Treasury's Office of Foreign Assets Control
    (OFAC). The Section 314(a) request pertains to suspects and material
    witnesses to significant terrorist/money laundering investigations, and
    is confidential. Further, the names are subject to a one-time search of
    bank records, and banks are not required by law to terminate account
    relationships. The OFAC list is a public list which contains names of
    individuals, organizations and countries against whom the United States
    has instituted sanctions. Financial institutions must have a formal
    process for regular searches of records and transactions against
    updated OFAC lists.
        Although the Section 314(a) requests have improved our ability to
    identify possible money laundering or terrorist financing activity,
    other provisions of Section 314 may be underutilized or could be
    improved. For example, under Section 314(b), there is a safe harbor for
    bankers to discuss suspect transactions with other banks that are
    counterparties in a transaction. It appears that only 10 percent of
    insured financial institutions use this safe harbor even though it
    creates an opportunity to gain a better understanding of, and develop
    additional information about, questionable transactions before they are
    reported. In addition, under Section 314(a), financial institutions
    generally have a 14-day window to report a positive ``hit.'' This
    timeframe should be evaluated to determine whether this permissible
    reporting delay is realistic since the information may not be received
    until well after criminal activity occurs. As law enforcement, bank
    regulators and the industry gain experience with the USA PATRIOT Act,
    we must continually evaluate its implementation to ensure that it is as
    effective as possible.

    Responsibilities of the FDIC to Facilitate BSA Compliance
        All FDIC-supervised institutions are required to establish and
    maintain procedures designed to assure and monitor compliance with the
    requirements of the BSA. Section 326.8 of the FDIC's rules and
    regulations requires that all FDIC-supervised institutions maintain BSA
    compliance programs that include controls, training, and independent
    testing necessary to assure that effective programs are in place.
        In addition to examining State-chartered, nonmember banks for
    compliance with the BSA and underlying regulations, the FDIC is
    required to make periodic reports regarding violations of Treasury's
    financial recordkeeping rules to the Treasury. The purpose of the BSA
    examination is to determine the effectiveness of a financial
    institution's anti-money laundering program. Specifically, every BSA
    examination focuses on the oversight provided by a bank's senior
    management and its respective Board of Directors, as well as the system
    of controls put in place to identify reportable transactions, prepare
    CTR's, monitor the purchase and sales of monetary instruments and
    electronic funds transfer activities, comply with the OFAC laws and
    regulations, administer information sharing requirements under Section
    314(a) of the USA PATRIOT Act, administer the Customer Identification
    Program, and report suspicious activities. Although the BSA regulations
    do not prescribe the frequency with which BSA compliance should be
    reviewed, examination procedures for BSA compliance are included within
    the scope of FDIC safety and soundness examinations. Since 2000, the
    FDIC has conducted almost 11,000 BSA examinations.
        The FDIC is the primary Federal regulator of approximately 5,300
    insured financial institutions holding total assets of almost $1.7
    trillion. The majority of FDIC-supervised institutions are small and
    located outside a Metropolitan Statistical Area (MSA),\1\ in less-
    densely populated areas. To effectively supervise BSA compliance at
    State nonmember banks, the FDIC has adopted a risk-focused approach. An
    institution's level of risk for potential money laundering determines
    the necessary scope of the BSA examination. For example, an examiner
    might consider an institution with the following characteristics to
    have a low money-laundering risk: located in a rural area; not located
    in a high-risk money laundering and related financial crimes area
    (HIFCA); \2\ small asset size; small deposit base; known and stable
    customer base; stable management and employee base; and relatively few
    CTR's.
    ---------------------------------------------------------------------------
        \1\ The Office of Management and Budget defines an MSA as an area
    with either a minimum population of 50,000 or a Census Bureau-defined
    urbanized area with a total population of at least 100,000. MSA's
    comprise one or more counties and may include one or more outlying
    counties that have close economic and social relationships with the
    central county. An outlying county must have a specified level of
    commuting to the central counties and also must meet certain standards
    regarding metropolitan character. For example, the Washington, DC MSA
    extends from Frederick, Maryland, to Fredericksburg, Virginia, and
    includes two counties in West Virginia.
        \2\ HIFCA is a term used in the Money Laundering and Financial
    Crimes Strategy Act of 1998 as a means of concentrating law enforcement
    efforts at the Federal, State, and local levels in high intensity money
    laundering zones.
    ---------------------------------------------------------------------------
        On the other hand, an institution located in a HIFCA or engaged in
    particularly risky business lines will receive significantly more
    scrutiny under the FDIC's risk-focused compliance examinations due to
    their elevated risk profiles. Current HIFCA designations for money
    laundering are assigned to the MSA's of New York City, Los Angeles,
    Chicago, San Francisco, and Miami. HIFCA's also include the Mexican
    borders with Texas and Arizona as well as San Juan, Puerto Rico.
    Financial institutions located in a HIFCA, or that have certain
    characteristics that may indicate a greater risk of money laundering or
    related vulnerabilities, undergo an expanded-scope BSA examination.
    These examinations include extensive transaction testing designed to
    validate management's compliance with BSA and anti-money laundering
    regulations.
        Regardless of the risk profile of a particular institution, the
    FDIC understands that all institutions are at risk of being utilized to
    facilitate money laundering and terrorist financing. In today's global
    banking environment where funds are transferred instantly and
    communication systems make services available nationally, even a lapse
    at a small financial institution outside of a major metropolitan area
    can have significant implications in another location across the
    Nation. The more difficult it is for criminals and terrorists to gain
    entry into the American financial system, the more likely it is that
    they will need to rely on less secure and less efficient means of
    financing their activities.
        While it has been our experience that the vast majority of FDIC-
    supervised institutions are diligent in their efforts to establish,
    execute, and administer effective BSA compliance programs, there have
    been instances where controls and efforts were lacking. In those cases,
    the FDIC implements a range of corrective measures to ensure that banks
    comply with the law. Generally, weaknesses noted in BSA compliance have
    been technical in nature and have not resulted in the facilitation of
    money laundering or terrorist financing activities. Usually, bank
    management is responsive to correcting the deficiencies within the
    normal course of business. In cases where significant deficiencies are
    cited during a BSA examination, bank management is required to address
    such deficiencies in a written response to the FDIC that outlines the
    corrective action proposed and establishes a timeframe for
    implementation.
        In cases where an institution has been lax in administering its BSA
    compliance program and failed to correct previously identified
    deficiencies, including significant violations of law, the FDIC has
    procedures to obtain commitments from bank management to correct the
    deficiencies. The procedures generally require some type of formal or
    informal enforcement action. The FDIC can also utilize its authority to
    assess civil money penalties against an institution for noncompliance
    with BSA. In addition, significant violations are referred to FinCEN,
    in accordance with the BSA, which also has the authority to assess
    civil money penalties for noncompliance with the BSA.
        The FDIC believes in a flexible supervisory approach using
    technical guidance, moral suasion, and a gradual escalation of
    enforcement action as appropriate. However, a more aggressive
    supervisory approach may be necessary to effect correction when a
    greater risk for money laundering exists within an institution due to
    willful noncompliance with the BSA and/or the absence of an effective
    BSA program. The type of enforcement action pursued by the FDIC against
    an institution is directly related to the severity of the offense,
    management's willingness and ability to effectively implement
    corrective action, as well as the extent to which the program has
    failed to identify and/or deter potential money laundering.
    Additionally, the nature of the criticism, the response to prior
    weaknesses or violation notifications, and the overall risk profile of
    the institution are factored into the type of supervisory action. When
    weaknesses are identified at institutions that have a high BSA risk
    profile, such as those located within a HIFCA, the FDIC has been
    aggressive in taking formal supervisory action. In addition, the FDIC
    has the authority to remove and/or prohibit an individual from the
    banking industry for deliberate or negligent actions related to money
    laundering.

    FDIC Efforts to Thwart Money Laundering and Terrorist Financing
    Activities
        In order to identify money laundering and terrorist financing
    activity, it is important to know the differences between the two
    activities. Money laundering generally involves the following factors:

     Profit is the motivation;
     ``Dirty money'' is laundered;
     Funds are derived from the crime;
     Large sums of money are involved (generally);
     Shell companies and offshore centers are frequently used;
     Complicated structures are created often requiring attorney or
        trustee involvement;
     Assets are purchased with illicit funds, then sold, thereby
        converting to ``clean'' cash; and
     Use of official or counterfeit bank checks or wire transfers.

        Terrorist financing differs as it generally involves the following
    factors:

     Ideology is the motivation;
     Both ``clean money'' and ``dirty money'' are laundered;
     Funds are often derived from donations and crime;
     Both large and small sums of money are involved;
     Banks and money exchanges (including alternate value transfer
        systems) are used;
     Charities and front operations are used; and
     Funding sometimes derives from government ``state
        sponsorship.'' \3\
    ---------------------------------------------------------------------------
        \3\ State sponsorship can be described as implicit or explicit
    action or funding by a government to endorse terrorist activity.

        These distinctions between money laundering and terrorist financing
    are important when evaluating suspicious bank transactions.
        The FDIC examines CTR's and SAR's to determine, in part, a bank's
    compliance with the BSA. Examiners analyze an institution's volume and
    trend in CTR and SAR filings to assist in risk scoping the examination.
    For example, increases in the volume of CTR's filed may be the result
    of deposit growth, the elimination of exempted businesses, or increases
    in retail or other high-risk customers. Decreases may be caused by the
    failure of the bank to file CTR's, an increase in the number of
    exempted businesses, the elimination of retail and/or other high-risk
    customers, or structuring transactions to avoid reporting requirements.
        Increases in the number of SAR's filed may be due to an increase in
    high-risk customers, entry into a high-risk market or product, or an
    improvement in the bank's method for identifying suspicious activity.
    Decreases may be the result of deficiencies in the bank's process for
    identifying suspicious activity, the closure of high-risk or suspicious
    accounts, personnel changes, or the failure of the bank to file SAR's.
        When appropriate, examiners conduct transaction testing during a
    BSA examination to determine if reportable transactions have been
    captured on the bank's system and if a CTR was filed. In the case of a
    structured transaction, an examiner will determine if a SAR was filed.
    As part of the CTR and SAR validation process, an examiner may also
    note if the SAR reports fraud and/or insider abuse which is closely
    linked to money laundering and other illicit acts. Also, examination
    staff may use SAR's as a basis for further evaluation of the conduct of
    insiders who may eventually be removed and/or banned from the banking
    industry under Section 8(e) of the Federal Deposit Insurance Act.
        Since 2001, the FDIC has issued 30 formal enforcement actions
    against 25 financial institutions and three individuals to address
    severely deficient BSA compliance efforts and/or ineffective anti-money
    laundering controls. These actions include 25 Orders to Cease and
    Desist, three Orders of Prohibition which ban individuals from
    participating in the banking industry and two Civil Money Penalty
    Assessments against related entities in the amount of $7,500,000.
    Fourteen of the 25 Cease and Desist Orders were issued in response to
    severe and/or chronic BSA-related deficiencies that exposed those
    institutions to a high vulnerability of possible money laundering
    activity.
        The FDIC also has effectively utilized informal actions such as
    bank board resolutions and memoranda of understanding to strengthen the
    BSA compliance efforts of its supervised institutions under appropriate
    circumstances. The informal actions also put the bank's board of
    directors on notice of their responsibility to ensure BSA compliance.
    Since 2001, FDIC-supervised institutions have entered into 53 informal
    actions with BSA-related provisions.

    FDIC Participation in Interagency Working Groups
        The FDIC participates in numerous interagency working groups formed
    for the purpose of drafting risk-based revisions to the BSA, required
    by the USA PATRIOT Act, and developing interpretive guidance for the
    financial services community. The FDIC has worked actively with
    Treasury and the financial regulators in developing regulations and
    guidance to implement the USA PATRIOT Act. For many years, the FDIC has
    worked with the Treasury, FinCEN and the other banking agencies in
    setting international standards, developing policies, and implementing
    best practices to combat money laundering and, more recently, terrorist
    funding as part of the nation's anti-money laundering regime.
        The FDIC also participates in the Bank Secrecy Act Advisory Group,
    which is a public-private partnership devoted to the discussion of
    money laundering schemes, enforcement of anti-money laundering laws,
    and remedies for making all reporting processes more efficient. The BSA
    Advisory Group has 43 members with representatives from all bank
    regulatory agencies; law enforcement; the securities, insurance, and
    gaming industries; and the banking industry. The BSA Advisory Group and
    its subcommittees are currently evaluating all aspects of the BSA
    (implementing rules and reporting requirements) and developing
    recommendations to make these areas more efficient.

    International Outreach Programs
        The FDIC believes that strong governance of foreign banking
    programs reduces opportunities for money laundering and increases the
    ability to identify sources of terrorist financing. The FDIC actively
    participates in working groups and technical assistance missions
    sponsored by the Departments of State and Treasury to assess
    vulnerabilities to terrorist financing activity worldwide and to
    develop and implement plans to assist foreign governments in
    enforcement efforts directed toward
    financial crimes. To facilitate its commitment to these assignments,
    the FDIC identified a group of 22 examiners and attorneys who have
    received specialized training in identifying money laundering and
    terrorist financing. Over the past 2 years, several of these
    individuals and others have worked with over 62 countries to provide
    technical assistance and training, meeting with supervisory and law
    enforcement representatives, senior prosecutors, and financial
    intelligence unit directors, and assisting in the development of
    foreign-directed BSA training programs. In all cases, the foreign
    officials from these countries ranging from Caribbean to European to
    Middle Eastern war-torn countries expressed interest in the FDIC's
    anti-money laundering examination programs and our progress in
    implementing PATRIOT Act provisions. Some of these countries have a
    myriad of issues and concerns with regulatory compliance and secrecy
    laws. Further, through participation on the Basel Committee, the FDIC
    has assisted in the evaluation and issuance of international guidelines
    on money laundering.
        In addition, the FDIC provided substantial assistance to the
    Department of the Treasury in drafting the anti-money laundering/
    antiterrorist financing rules for the Iraqi Coalition Provisional
    Authority in Baghdad. The comprehensive framework was drafted for the
    new Iraqi government to implement and conform to international
    standards.

    Current Initiatives
        Since the passage of the USA PATRIOT Act in 2001 (which augments
    the BSA to address the risk of terrorist financing activities), the
    FDIC has been involved in a number of activities, including:
    implementing rules and interpretive guidance, incorporating changes
    into examination procedures, training examiners, and participating in
    industry outreach sessions. The agency participated in the rulemaking
    process of relevant parts of the USA PATRIOT Act and has participated
    in a number of working groups focused on counter-financing of terrorism
    and the USA PATRIOT Act. In conjunction with these activities, and, in
    part, to address some recommendations identified in a recent FDIC
    Office of Inspector General report, we have undertaken a number of
    initiatives to enhance the FDIC's enforcement of the BSA.

    Upgrading Staff
        Consistent with the increased importance of the BSA, the additional
    workload associated with the USA PATRIOT Act, and greater emphasis on
    international efforts to combat terrorism, the FDIC has taken
    additional steps to ensure that these areas receive increased
    attention. The FDIC is dedicating more staff to its Special Activities
    Section, which oversees the nationwide implementation and coordination
    of the FDIC's BSA, anti-money laundering, and PATRIOT Act efforts.
    Additionally, the FDIC is designating and training additional BSA
    subject matter experts. The FDIC expects to double its number of BSA
    experts over the next 18 months. Currently, the FDIC has more than 150
    BSA experts nationwide. Multiple experts are assigned to offices that
    examine several institutions having characteristics that may indicate
    greater money laundering or related vulnerabilities.

    Additional Training
        In an effort to increase the level of BSA expertise in the field,
    the FDIC is requiring all examiners to complete additional formal
    training on BSA anti-money laundering and PATRIOT Act issues by year-
    end 2004. This computer-based training also will be offered to all
    State banking authorities and other regulators who wish to provide
    additional training for their staff. As a supplement to the required
    additional training, the FDIC is participating in the planning and
    development of anti-money laundering training for examiners that is
    sponsored by the Federal Financial Institutions Examination Council.

    Updating Examiner Guidance
        The FDIC continues to reevaluate and modify as necessary all BSA
    anti-money laundering and antiterrorism examination and industry
    guidance to ensure the incorporation of changes resulting from passage
    of the USA PATRIOT Act. This effort involves reviewing all written
    guidance for examiner and industry use, working with other bank
    regulators and Federal law enforcement in assessing the guidance and
    using conferences and other public forums to communicate any changes
    required by banks for compliance with the law.

    Improving State Examinations
        The FDIC has an alternating examination program with most State
    banking departments. In this program, the FDIC and State authorities
    alternate, or conduct every other examination, accepting or using the
    other agency's examination findings to meet mandatory examination cycle
    requirements. While the FDIC reviews BSA compliance each time it
    examines a State-chartered, nonmember bank, not all States conduct
    similar examinations.
        Beginning this month, in those instances where a State banking
    authority does not conduct Bank Secrecy Act exams, the FDIC will send
    an examiner to conduct an examination for BSA and anti-money laundering
    compliance concurrent with the State authority's safety and soundness
    examination. This initiative will ensure that all FDIC-supervised banks
    are reviewed for money laundering and terrorist financing activity
    during every examination cycle. Conducting a BSA examination concurrent
    with the State's safety and soundness examination is expected to reduce
    the regulatory burden upon the financial institution by scheduling both
    events simultaneously rather than multiple examinations conducted
    during a given year.
        In addition, 10 sTates have committed to beginning BSA-examinations
    in 2004. The FDIC will assist those States as necessary with training
    to facilitate thorough state evaluations of BSA compliance.

    Improving Reporting
        The FDIC has centralized the monitoring process for FDIC-supervised
    banks with serious BSA, anti-money laundering and antiterrorist
    financing program deficiencies. This allows senior Washington Office
    personnel to confer with regional staff to ensure that a consistent
    supervisory approach is applied on a national basis. In addition, the
    FDIC recently centralized the process for referring BSA violations to
    FinCEN which provides consistency in reporting. These centralization
    efforts also will enable the FDIC to analyze historical data internally
    to identify emerging trends and issues among FDIC-supervised banks.
        In order to provide more information to financial institutions and
    the general public, a section of the FDIC's external website is devoted
    to the Bank Secrecy Act, anti-money laundering and counter-financing of
    terrorism issues.

    Improving Government and Industry Coordination
        While there has been marked improvement in information sharing
    among Government agencies in recent years, communication between
    Government entities and the banking industry could be improved. Current
    communication tends to be limited to requests for information and
    responses to those requests. We should also create a better dialogue
    between the industry, the regulators, and law enforcement about how our
    banking system can be used for nefarious purposes. We should continue
    to work to eliminate any barriers that exist between Government and the
    industry to foster more seamless communication about both the broader
    context and potential threats. In my view, these efforts would help us
    detect and deter the use of the financial system by criminals and
    terrorists.

    Conclusion
        The FDIC believes that a vigilant BSA, anti-money laundering and
    antiterrorist financing supervisory program requires that appropriate
    supervisory actions be taken to support compliance with Treasury and
    FDIC regulations and guidance. Proper supervision of banks to ensure
    that they maintain effective programs creates an environment where
    terrorists know that any attempt to use the American financial system
    to fund their operations pose an unacceptable risk of discovery.
        The FDIC diligently enforces the BSA by establishing a
    comprehensive supervisory approach that includes conducting thorough
    BSA compliance examinations and ensuring an appropriate supervisory
    approach when BSA concerns exist in FDIC-supervised institutions. In
    addition, the FDIC is proactive in addressing recent changes to the BSA
    by incorporating those rules into examiner and industry guidance,
    providing various forms of examiner and industry training and outreach
    sessions, and assisting in global anti-money laundering and
    antiterrorist financing efforts.
        The FDIC is fully committed to preventing the use of the financial
    system to support criminal or terrorist activities. Highly trained bank
    examiners are a major resource in this fight that cannot be easily
    duplicated. They are in every bank in the country, they are able to
    identify suspicious relationships and transactions and they have the
    power to dig deeply into the facts when warning flags are raised. While
    the current system is not perfect, we should approach reforms carefully
    to ensure that they do not duplicate resources and expertise that
    already exist and do not inadvertently interfere with the achievement
    of the goals that we all share.
        This concludes my testimony. I would be happy to answer any
    questions and would like to thank the Committee for providing this
    opportunity to discuss the FDIC's role in enforcing the Bank Secrecy
    Act and assisting the overall effort to fight money laundering and
    terrorist financing activity.

                    PREPARED STATEMENT OF JAMES E. GILLERAN

                     Director, Office of Thrift Supervision
                        U.S. Department of the Treasury
                                  June 3, 2004

    Introduction
        Good morning, Chairman Shelby, Senator Sarbanes, and Members of the
    Committee. Thank you for the opportunity to testify at today's hearing
    on the Bank Secrecy Act (BSA), as amended by the USA PATRIOT Act. My
    testimony provides an overview of the BSA and OTS's compliance
    responsibilities under the BSA and Home Owners' Loan Act (HOLA),
    describes our work to implement the USA PATRIOT Act and strengthen
    oversight of the BSA, and reports on the state of thrift compliance
    with the BSA and on how OTS responds to failures and deficiencies to
    comply with the Act. My statement also explains requirements for
    thrifts to file suspicious activity reports (SAR's), and summarizes an
    ongoing GAO audit of the agency on BSA implementation by OTS.
        OTS fully supports the goals and objectives of the BSA and the USA
    PATRIOT Act through policies, programs, and regulatory, supervisory,
    and enforcement initiatives. We have examiners who are well trained and
    experienced in reviewing thrifts for compliance with the BSA and the
    USA PATRIOT Act. Our examiners know the institutions we regulate well
    and are well-positioned to identify and correct BSA problems. The
    average OTS examiner has over 16 years of experience.
        Our examiners have been using updated BSA examination procedures
    since October of last year. We have strengthened our oversight by
    issuing internal guidance to our examiners and external guidance to the
    depository institutions. We have also developed and provided
    substantial new training programs for our staff over the last 2 years,
    and increased the number of examiners who have been trained in BSA
    requirements and have developed proficiency in this area.
        The number of OTS examiners capable of conducting BSA reviews has
    increased by over 80 examiners, or by approximately 75 percent from
    2001 to the present. We now have more than 190 examiners trained in BSA
    compliance issues, and we will continue to train staff and add
    expertise to our examination corps in this area in the coming year. We
    also shortened the examination cycle for BSA reviews since 2001, from a
    2 to 3 year cycle to a 12 to 18 month examination cycle, or more
    frequently if circumstances require.
        In addition, our field personnel communicate on a regular, on-going
    basis with OTS senior managers. Through frequent industry contact and
    ongoing supervision, OTS continually monitors industry BSA compliance
    efforts. We frequently consult with individual thrifts on their BSA
    compliance programs, such as reviewing changes in key personnel,
    unusual activity, or anomalous transactions that might warrant a field
    visit.
        In our experience, the most effective way to uncover BSA and USA
    PATRIOT Act deficiencies is through the ongoing examination process.
    Violations are usually discovered in fissures within an institution's
    programs, controls or operations. Uncovering weaknesses in an
    institution's BSA compliance program requires experienced examiners who
    are familiar with the ongoing operations of the particular institutions
    they oversee as well as how various banking transactions are typically
    structured, industry best practices, and depository institution
    operations, generally.
        BSA compliance review is necessarily risk-focused--the review is
    tailored to consider the potential risk of money laundering or
    terrorist financing in different business lines. Our examiners have
    broad exposure to an institution's entire business operation: Its
    organizational structure, business activities, normal range of
    transactions, risk management practices, the quality of its management,
    and its internal control environment. Our examinations and follow-up
    reviews enable us to monitor corrections and improvements in, and
    ongoing compliance with BSA/AML requirements. Knowledge of, and
    familiarity with each institution's risk profile puts OTS in the best
    position to effectively monitor the BSA compliance programs and
    activities of the institutions we regulate.

    Background of the Bank Secrecy Act and Compliance Overview
        The Bank Secrecy Act (BSA), enacted in 1970, requires financial
    institutions to file certain currency and monetary instrument reports
    and maintain certain records for possible use in criminal, tax, and
    regulatory proceedings. The BSA's purpose is to prevent financial
    institutions from being used as intermediaries for the transfer or
    deposit of money derived from criminal activity. Accordingly, the BSA
    requirements result in a paper trail of the activities of money
    launderers serving the interests of terrorists, drug traffickers, and
    other elements of white collar and organized crime.
        Congress has amended the BSA several times over the years to
    strengthen its anti-money laundering (AML) and counter-terrorism
    financing purposes. The most recent, and perhaps most significant, set
    of amendments is found in Title III of the USA PATRIOT Act. The USA
    PATRIOT Act adopted strong and far-reaching requirements intended to
    prevent, detect, and prosecute terrorism, terrorist financing, and
    international money laundering. It has resulted in several new
    regulations that have a direct impact on a thrift's BSA/AML compliance
    program.
        Since its enactment, OTS has worked vigorously and diligently to
    implement the USA PATRIOT Act. As detailed below, OTS has been actively
    involved in crafting regulations implementing various provisions of the
    USA PATRIOT Act,\1\ and in issuing related guidance and examination
    procedures. OTS has been examining and working with the institutions we
    regulate to ensure compliance not only with the letter of the law, but
    also the spirit of its intended purpose.
    ---------------------------------------------------------------------------
        \1\ This statement references three sets of regulations. These are
    OTS's BSA rule at 12 CFR Sec. 563.177; Treasury's BSA regulation at 31
    CFR Part 103, which applies to savings associations; and the
    interagency USA PATRIOT Act regulations, which are a part of Treasury's
    BSA rule in Part 103, which apply to a wide range of financial
    institutions, including thrifts.
    ---------------------------------------------------------------------------
    OTS's BSA Oversight Responsibilities
        The Home Owners' Loan Act (HOLA) authorizes OTS to require thrifts
    to comply with the BSA and provides very broad enforcement authority to
    compel this objective.\2\ The HOLA mandates that OTS issue regulations
    requiring thrifts to adopt BSA compliance procedures. At each
    examination we conduct, OTS reviews the required procedures, documents
    its findings and describes any significant problems in the examination
    report. When a thrift fails to establish and maintain the required
    procedures, or fails to correct previously identified problems, our
    examiners and field supervisors are instructed to take enforcement
    action against the institution. In addition to the HOLA, we have
    enforcement authority under the Federal Deposit Insurance Act (FDIA),
    which also imposes AML recordkeeping requirements on thrifts and other
    insured depository institutions.\3\
    ---------------------------------------------------------------------------
        \2\ HOLA Sec. 5(d)(6).
        \3\ FDIA Sec. 21.
    ---------------------------------------------------------------------------
        To discharge our responsibilities under the HOLA and FDIA, OTS
    issued a BSA regulation that requires compliance with specific
    components of the BSA.\4\ Our regulation also requires thrifts to
    comply with the Department of the Treasury's BSA regulations,\5\
    including requirements for Customer Identification Programs (CIP's),
    internal controls, testing for BSA compliance, and employee training on
    BSA/AML and related issues.
    ---------------------------------------------------------------------------
        \4\ 12 CFR Sec. 563.177.
        \5\ 12 CFR Part 103.
    ---------------------------------------------------------------------------
        OTS has also adopted a suspicious activity report (SAR) regulation
    that requires thrifts to file a SAR with FinCEN and the appropriate
    Federal law enforcement agencies when it detects a ``known or suspected
    violation of Federal law or a suspicious transaction related to a money
    laundering activity or a violation of the [BSA].'' \6\ These
    requirements are described in more detail later in this testimony.
    ---------------------------------------------------------------------------
        \6\ 12 CFR Sec. 563.180.
    ---------------------------------------------------------------------------
        While OTS has broad enforcement authority to correct a deficiency
    or BSA violation, choosing the appropriate supervisory response
    involves the careful balancing of a wide range of factors and the
    informed exercise of professional judgment and discretion.
        In our experience, the most effective way to resolve most BSA/AML
    compliance program deficiencies is as part of the overall examination
    process. We routinely require thrifts to undertake corrective action in
    the course of an examination. Addressing issues within the examination
    framework often results in a thrift promptly implementing necessary
    corrective action, and makes for fast and effective changes that we can
    immediately review. We believe that our examiners are in the best
    position to uncover problems with a thrift's BSA/AML compliance program
    and to resolve them quickly with management. The relationship between
    the institutions we regulate and our examiners is extremely
    constructive.
        It is our experience that most institutions appreciate the
    importance of BSA and the USA PATRIOT Act, and are committed to the
    concepts, goals, and objectives of these laws. We continue to work with
    thrift institutions to ensure that they have a strong, independent
    testing and verification process in place. Numbers bear out this
    contention. Since July of last year, we addressed BSA/AML compliance
    program deficiencies at 167 thrifts. Some of these deficiencies were
    self-reported by the institutions, but the vast majority were
    identified during OTS examinations. The combination of self-reporting
    and issues identified in examinations uncovered 342 BSA violations at
    these institutions, mostly of Treasury's BSA regulations at 31 CFR Part
    103. In all cases, management either agreed with the examiner's
    recommendation and moved promptly to implement changes to fix the
    problem, or completed the recommended corrective action before the
    examination was completed.
        When the examination approach fails to resolve a BSA problem or
    issue, OTS can take enforcement action under FDIA Section 8 against a
    thrift and its related entities for engaging in an unsafe or unsound
    practice or violating a law, regulation, condition imposed in writing,
    or written agreement. Under this authority, OTS may (i) issue cease-
    and-desist orders, (ii) issue removal, suspension, and prohibition
    orders, and/or (iii) impose civil money penalties.

    OTS Implementation of the USA PATRIOT Act
    Key Provisions of the USA PATRIOT Act
        OTS often, in coordination with FinCEN and the other Federal
    banking agencies (FBA's), has participated in numerous initiatives to
    issue regulations, policy guidance, and examination procedures to
    implement the USA PATRIOT Act. For example, OTS issued an extensive
    staff summary of the USA PATRIOT Act in March 2002.\7\ This document
    informs institutions of the requirements of the Act and provides
    information on its implementation. In particular, it discusses the USA
    PATRIOT Act in three sections, as follows:
    ---------------------------------------------------------------------------
        \7\ OTS Notice: OTS Staff Summary of USA PATRIOT Act (March 20,
    2002) (copy attached).

     The first section describes USA PATRIOT Act requirements that
        are applicable to all thrift institutions and that were effective
        immediately or in the near term, such as the information sharing
        requirements and the requirement that a financial institution
        produce records relating to its BSA/AML compliance program or its
        customers within 120 hours of a request from the appropriate FBA.
     The second section describes the new enhanced due diligence
        procedures for thrifts that engage in private banking or maintain
        foreign correspondent accounts.
     The third section discusses USA PATRIOT Act provisions of
        general interest, such as the authorization for Treasury to impose
        special measures with respect to particular institutions,
        jurisdictions, accounts, or transactions and the requirement that
        each thrift have a Customer Identification Program (CIP).

        OTS also issued a USA PATRIOT Act Update in August 2002.\8\ The
    update included important guidance on the new CIP requirements,
    information sharing with law enforcement, and new due diligence
    requirements for foreign correspondent accounts and private banking
    accounts. The update noted that OTS would begin
    reviewing for compliance with the provisions when the new regulations
    became effective, and urged institutions to carefully review the new
    regulations and their preambles, and implement the new procedures as
    required.
    ---------------------------------------------------------------------------
        \8\ Chief Executive Officer (CEO) Letter 166 (August 5, 2002) (copy
    attached).
    ---------------------------------------------------------------------------
    Customer Identification Programs
        The new CIP requirements, issued on May 9, 2003, by the Treasury
    Department, the FBA's, the SEC, and the CFTC, set forth procedures for
    verifying the identity of anyone who opens an account, and requires
    institutions to maintain records to verify a customer's identity, and
    to determine whether the customer appears on any list of known or
    suspected terrorists or terrorist organizations. An institution's CIP
    must include risk-based procedures designed to enable the institution
    to form a reasonable belief that it knows the identity of its
    customers. OTS has been examining institutions for CIP compliance since
    the requirements went into effect on October 1, 2003.
        Simultaneous with the issuance of the new CIP rules, OTS issued two
    additional pieces of guidance.\9\ Customer Identification Programs: A
    Staff Summary and Answers to Questions (the CIP Summary) (copy
    attached); and USA PATRIOT Act Preparedness Checkup: A Framework for
    Achieving Compliance with the New USA PATRIOT Act Regulations (the
    Checkup) (copy attached).
    ---------------------------------------------------------------------------
        \9\ CEO Letter 175 (May 9, 2003) (copy attached).
    ---------------------------------------------------------------------------
        The CIP Summary, the first guidance issued by a regulatory agency
    about the new CIP rules, alerted thrifts to the specific requirements
    of the new rules. The CIP Summary also specifies exactly what OTS is
    looking for when reviewing a thrift's CIP, and addresses important
    questions about the CIP rules.
        The CIP Summary describes the types of accounts covered by the
    rule, who is a ``customer'' for purposes of the rules, and the specific
    requirements that a thrift's CIP must meet. The CIP Summary also:

     Notes the four pieces of identifying information that a thrift
        must obtain from a customer who opens a new account;
     Indicates the methods (both documentary and nondocumentary) by
        which a thrift can verify the identifying information;
     Discusses the recordkeeping requirements of the new rules;
     Highlights the requirements about checking Government lists of
        suspected terrorists or money launderers;
     Notes that thrifts must be in compliance with the new rules
        beginning October 1, 2003; and
     Emphasizes that OTS would begin examining for compliance
        during all examinations beginning on or after October 1, 2003.

        The Checkup was issued the same day as the new rules and the CIP
    Summary. It remains the only checklist form of guidance about preparing
    for USA PATRIOT Act implementation issued by a regulatory agency. In
    the Checkup, OTS encouraged institutions to ``ADApT'' their current
    BSA/AML program to the new USA PATRIOT Act requirements:

     Analyze their current program;
     Develop a comprehensive BSA/AML program, which includes a CIP
        that address all of the thrift's business lines;
     Apply the revised program throughout the thrift's day-to-day
        operations; and
     Test the new program through internal audits and testing to
        ensure that the program is functioning as intended.

        The Checkup lists several questions a thrift should ask as it
    ADApTs to the new USA PATRIOT Act requirements. For instance, when
    Analyzing its current program, a thrift should consider, among other
    things, how its business operations expose it to money laundering or
    terrorism financing risks. When Developing its new, enhanced BSA/AML
    program, a thrift should take a number of steps, including ensuring
    that the program addresses each of the new regulatory requirements and
    identify business operations that might require enhanced scrutiny.
        When Applying its new program, a thrift should ask itself whether
    staff is informed of the new requirements, whether appropriate customer
    identification information collection and verification practices are
    taking place, and whether private banking accounts and foreign
    correspondent accounts are being handled correctly. Finally, when a
    thrift Tests the new program, the Checkup provides a number of factors
    for the thrift to review, including ensuring that internal audits or
    compliance reviews identify shortcomings in the BSA/AML compliance
    program and seek prompt corrective action, and determining whether
    staff and service provider implementation of the new regulatory
    requirements is keeping pace with the thrift's operational needs. Our
    examiners are instructed to explore all of these issues when
    examining an institution's USA PATRIOT Act compliance.
        In January 2004, OTS, along with the other FBA's, the SEC, and the
    CFTC, issued another importance piece of guidance, ``frequently asked
    questions'' (FAQ's) to help explain the final CIP rule.\10\ That
    document begins with a general description of the CIP requirements and
    emphasizes that a bank's CIP must include risk-based procedures for
    verifying the identity of each customer to the extent reasonable and
    practicable. The FAQ's note that it is critical that each bank develop
    procedures to account for all relevant risks, including those presented
    by the types of accounts maintained by the bank, the various methods
    provided to open accounts, the type of identifying information
    available, and the bank's size, location, and type of business or
    customer base.
    ---------------------------------------------------------------------------
        \10\ CEO Letter 188 (January 8, 2004) (copy attached).
    ---------------------------------------------------------------------------
        The FAQ's also make clear that specific minimum requirements in the
    rule, such as the four basic types of information to be obtained from
    each customer, should be supplemented by risk-based verification
    procedures, where appropriate, to ensure that the bank has a reasonable
    belief that it knows each customer's identity.
        The document also answers a number of common questions about the
    CIP rules, such as whether loans purchased from a car dealer are
    ``accounts'' (No) and whether a person who becomes a co-owner of an
    existing deposit account is a ``customer'' (Yes). The FAQ's also
    consider whether a bank's foreign subsidiaries are subject to the rule
    (No) and whether a bank may keep copies of documents provided to verify
    a customer's identity even though not required to do so (Yes). The
    agencies are currently working on a second set of FAQ's on the CIP
    requirements, which are now circulating for approval at the agencies
    and will be issued soon.

    Information Sharing
        Section 314 of the USA PATRIOT Act encourages cooperation and
    information sharing among financial institutions, regulators, and law
    enforcement. OTS has actively participated in developing and
    implementing these requirements.
        On September 26, 2002, Treasury issued a final rule implementing
    the new information sharing requirements. In response to industry
    concerns about the regulatory burden of the requests for information,
    and after consulting with OTS and the other FBA's, on November 26,
    2002, Treasury placed a moratorium on information requests from law
    enforcement. Treasury subsequently streamlined the process and lifted
    the moratorium in February 2003. Since then, institutions have been
    responding to requests for information from law enforcement.
        Last October, OTS alerted thrifts to new examination procedures to
    review thrift compliance with the new requirements,\11\ and we
    incorporated the new procedures into our overall BSA examination
    procedures. Those procedures include a review of the institution's
    procedures for promptly responding to law enforcement requests for
    information, documentation of any positive match with the requests, and
    copies of any vendor confidentiality agreements regarding services
    rendered pursuant to the requests. Examiners are also instructed to
    review copies of any SAR's filed related to the information sharing
    process, as well as to review an institution's analysis or
    documentation where a SAR was considered, but not filed.
    ---------------------------------------------------------------------------
        \11\ CEO Letter 183 (October 20, 2003) (copy attached).
    ---------------------------------------------------------------------------
        OTS also participates in quarterly meetings with FinCEN, the
    regulators, and representatives of law enforcement to discuss and
    further refine the information sharing process. Those meetings allow
    law enforcement to provide feedback to the regulators about how the
    information sharing process is working and for regulators to convey to
    law enforcement the views of financial institutions on how to improve
    the process. Items of discussion have included a breakdown of positive
    responses by type of financial institution and regulator, proposed
    enhancements to the various forms used in the process, and development
    of a secure, encrypted network to facilitate the exchange of
    information between law enforcement and financial institutions.

    Foreign Shell Banks, Requests for Bank Records, and Summons Authority
        OTS has also issued specific guidance on the USA PATRIOT Act
    provisions banning correspondent accounts for foreign shell banks,
    requiring financial institutions to produce records related to anti-
    money laundering compliance within 120 hours of an examiner's request,
    and providing that Treasury or the Attorney General may issue a
    subpoena or summons to any foreign bank that maintains a correspondent
    account in the United States and may request the bank to produce
    records related to that account, including records maintained abroad.
        Treasury, through FinCEN and after consultation with OTS and the
    other FBA's, issued a final rule implementing these new requirements on
    September 26, 2002. Last October, OTS alerted thrifts to the new
    examination procedures to review thrift compliance with the new
    requirements.\12\ Under those procedures, examiners are to evaluate an
    institution's policies and procedures for foreign correspondent
    accounts to determine whether they address the minimum requirements
    specified in the regulation, such as the responsible party for
    gathering the necessary information and the process for identifying
    foreign correspondent accounts. The procedures also require an examiner
    to, based on a risk assessment, sample foreign correspondent accounts,
    review the collection of requisite information and obtain any customer
    due diligence or other relevant information related to those accounts.
    We have incorporated those new procedures into our overall BSA
    examination procedures.
    ---------------------------------------------------------------------------
        \12\ CEO Letter 183 (October 20, 2003) (copy attached).
    ---------------------------------------------------------------------------
    Other Significant USA PATRIOT Act Provisions
        OTS also participates in a number of other ongoing working groups
    and projects related to specific provisions of the USA PATRIOT Act. For
    instance, Treasury consults with OTS, among others, when considering
    whether to impose special measures on a jurisdiction, institution,
    class of transactions, or type of account that the Department finds is
    of ``primary money laundering concern.'' To date, Treasury has imposed
    special measures on Nahru, Burma, and two Burmese banks, and has just
    issued a proposal to do so with regard to a bank in Syria.
        OTS has been involved in developing new regulations implementing
    the USA PATRIOT Act requirements that financial institutions have
    specific due diligence procedures, including enhanced due diligence
    procedures, for correspondent accounts for foreign financial
    institutions or private banking accounts for non-U.S. persons. On July
    23, 2002, Treasury, after consulting with OTS and the other FBA's,
    issued an interim rule imposing the Section 312 requirements on banks
    and thrifts. Treasury is drafting a final regulation implementing
    Section 312, and routinely consults OTS.

    Examination Procedures and Guidance
        In preparation for the October 1, 2003, compliance deadline for the
    new CIP requirements, OTS updated its entire BSA examination program.
    This revision included updating existing procedures and adding new
    sections to address specific USA PATRIOT Act requirements. We trained
    our examiners on the new procedures in mid-September 2003, and our
    examiners have been using the new procedures for all BSA examinations
    that commenced since October 1, 2003. Examiner reaction has been
    positive, with the examiners' general perception that most institutions
    are taking the necessary steps to comply with the new USA PATRIOT Act
    requirements. After extensive field testing, we are in the final stages
    of formally incorporating the new procedures in our OTS Examination
    Handbook.
        Under our comprehensive examination approach, many more examiners
    are now trained on conducting BSA examinations, which has expanded our
    capabilities immensely. We continually discuss and cover BSA and USA
    PATRIOT Act examination issues at staff conferences, examiner team
    meetings, and examiner education initiatives. In addition to our
    September 2003 training on the new procedures, we have included BSA/USA
    PATRIOT Act discussions in our Compliance I, Compliance II, and
    Advanced Compliance examiner schools. We provided internal training on
    the new BSA/USA PATRIOT Act requirements at our National Applications
    Staff Conference in May 2003 and our National Compliance Training for
    Senior Management program in June 2003. We also provide online and CD-
    ROM study guides and training modules for our examiners.
        We actively participate in training programs and industry
    conferences throughout the country. Besides the guidance we have issued
    directly to institutions, we have participated in numerous interagency
    BSA/USA PATRIOT Act seminars and town meetings with industry
    representatives in all of our Regions. We also participated in BSA/USA
    PATRIOT Act discussions at various officer and director conferences,
    such as the FDIC's Regional Directors conference, and numerous trade
    association conferences. These include conferences sponsored by
    America's Community Bankers, the California Bankers Association, the
    Chicagoland Bankers Association, the Florida Bankers Association, the
    Georgia Community Bankers Association, the Heartland Community Bankers,
    the Iowa Bankers Association, Iowa Community Bankers and Iowa
    Independent Bankers Association, the Maryland Bankers Association, the
    Missouri Bankers, the North Carolina Bankers Association, the Suncoast
    Bankers Compliance Association, and the Wisconsin Community Bankers,
    among others.
        In implementing the new USA PATRIOT Act requirements and in
    examining thrifts for compliance under the new BSA procedures issued
    last October, OTS also has had the benefit of several recommendations
    made by the Treasury Department's Inspector General, who conducted an
    audit of OTS's enforcement actions taken for BSA violations. That audit
    report, issued September 23, 2003, and which covered the period January
    2000 through October 2002, made certain recommendations to further
    enhance OTS's supervisory process and data collection efforts.
        In response to these recommendations, OTS has issued both external
    and internal supplemental guidance on BSA/AML compliance programs and
    the enforcement of BSA obligations. This past March, OTS issued a
    regulatory bulletin that discusses OTS's authority under the BSA,
    details the specific regulatory and statutory requirements applicable
    to thrift operations in this area, and sets out general enforcement
    guidelines that OTS will follow for violations of the regulatory and
    statutory requirements.\13\
    ---------------------------------------------------------------------------
        \13\ Regulatory Bulletin 18-6 (March 31, 2004) (copy attached).
    ---------------------------------------------------------------------------
        The bulletin also lists the special factors that OTS will consider
    when determining the appropriate enforcement action for BSA/AML
    violations, including the following:

     Whether the thrift has adequately corrected BSA/AML violations
        noted in a prior Report of Examination (ROE);
     Whether the thrift's BSA/AML compliance has deteriorated since
        violations were noted in the prior ROE, or there has been
        inordinate delay in making meaningful progress in addressing the
        violations;
     Whether the violations in fact constitute, or reflect a
        material risk of, money laundering, terrorist financing, or
        structuring to avoid reporting requirements; and
     Whether the thrift identified the weaknesses itself through
        its BSA testing, audit, or self-evaluation efforts and the thrift
        has independently instituted timely and adequate corrective action.

        On April 5, 2004, we issued to our examiners new internal guidance
    elaborating on certain features of the regulatory bulletin. That
    guidance identifies specific BSA/AML violations that must be noted in
    examination reports, unless the thrift adequately corrects the
    violations during the examination period. The internal guidance
    provides further instruction on when a thrift will be considered to
    have ``adequately corrected'' a violation. The internal guidance also
    specifies that all institutions, regardless of asset size, must have
    BSA compliance programs that address all the regulatory requirements
    and are appropriate to the BSA/AML risks attributable to the thrift's
    risk factors, operational complexity, and market circumstances.
    Finally, the internal guidance provides more detailed instructions to
    examiners on documenting BSA/AML violations in the appropriate OTS
    database.
        The guidance on entering BSA violations data into OTS's new
    database is part of an ongoing, multiyear project to enhance and update
    our examination reporting database that was begun in January 2000. The
    update, now completed, encompasses all examination areas, including
    examination of a thrift's BSA compliance program. Not only does our
    enhanced database enable OTS to more closely monitor a thrift's
    compliance as well as industry trends and areas of interest, but also
    the data it is producing verifies our conviction that the most
    effective way to resolve deficiencies in a thrift's BSA/AML compliance
    program is during the examination process.
        Finally, also as suggested by the Inspector General, we have
    enhanced our supervisory review of the BSA examination process.
    Specifically, to assure BSA violation data accuracy, each examiner-in-
    charge is now responsible for ensuring that BSA violations are entered
    into the data system correctly. This is often supplemented with a
    second level review and each region will conduct periodic quality
    assurance reviews to further ensure accurate data entry. We have
    drafted procedures for including BSA examinations and the integrity of
    system data entry in our ongoing
    Examination Quality Assurance reviews. Those reviews are designed to
    test compliance with OTS's national standards for BSA examinations,
    including those discussed in the new guidance. The initial review of
    examinations completed in the first quarter of calendar year 2004 will
    commence in the third quarter.

    Assessment of Thrift Compliance with the BSA; OTS Enforcement
        The effective date for the updated procedures to conduct BSA
    examinations, October 1 of last year, coincides with the effective date
    for the most recent USA PATRIOT Act regulation, the CIP rules. Although
    we have been using these new procedures only a short time, we have
    received preliminary feedback from examiners and supervisors in the
    field.
        That feedback is generally positive. We believe that the thrift
    industry, in general, is complying with the BSA and USA PATRIOT Act
    requirements. As in most areas of bank supervision, however, we
    continue to identify areas of weakness in some thrift institutions. We
    also periodically uncover significant problems at a small number of
    institutions. In these situations, we move quickly and forcefully to
    correct violations. We believe that our record of risk-based
    supervisory response to identified institutional weaknesses places OTS
    in an excellent position for ensuring that the thrift industry
    continues to meets its BSA/AML obligations.
        We have identified some recurring problems related to basic BSA/AML
    requirements at some smaller institutions that have fewer resources to
    devote to compliance issues. The problems we see in these smaller
    thrifts are normally the same types we saw even prior to the USA
    PATRIOT Act. They generally involve the more administratively intensive
    requirements of the BSA program elements. For example, some smaller
    thrifts have inadequate training programs or fail to conduct an annual
    audit of the BSA compliance program that is fully independent.
        Generally speaking, smaller thrifts engaged in typical mortgage
    lending and FDIC-insured deposit taking in a local community tend to be
    exposed to a lower risk of money laundering as a result of the
    traditional nature of their operations. They tend to know their
    customers, have geographically limited operations, offer few or no
    international banking or private banking products and services, and
    conduct more streamlined, traditional banking operations focused on
    narrow, longstanding markets (normally mortgage lending). Even small
    institutions, however, are not free from the risk of money laundering
    activities and our reviews take that fact into consideration.
        The BSA compliance program at a small thrift--which still should be
    risk-based--need not be as elaborate as a program at a large,
    international financial institution. While a BSA compliance program
    must include all regulatory components, how each component is satisfied
    can vary depending on the operational risk presented by a particular
    institution's business. We have made clear to the industry and our
    examiners that all thrifts, regardless of size, must have BSA
    compliance programs that address all regulatory requirements and are
    appropriate to the BSA risks attributable to their operational
    complexity and market circumstances.
        OTS has backed up that message by issuing a number of formal
    enforcement orders to ensure that savings associations comply fully
    with the requirements of the BSA. For example, in October 2003, OTS
    issued a comprehensive cease-and-desist order to a savings association
    requiring that it develop and implement effective BSA and AML programs,
    including procedures to ensure that SAR's and CTR's are filed as
    required by law. OTS also fined the institution $175,000 for its past
    violations. OTS is closely monitoring the institution's compliance with
    the order.
        In another example, OTS recently issued a cease-and-desist order
    against an institution that had several problems with its BSA/AML
    compliance program. Those problems included failing to monitor large
    cash transaction activity in several commercial accounts, failing to
    file SAR's, and failing to file CTR's. Examinations also revealed
    weaknesses in the required BSA training programs. The cease-and-desist
    order required the thrift to strengthen its BSA compliance program,
    with particular attention to its CTR filing obligation and ensuring
    that its designated BSA officer had sufficient resources to perform BSA
    responsibilities on a day-to-day basis.
        In all, since we started using our new examination procedures last
    October, we have issued seven formal enforcement orders for BSA
    violations, including cease-and-desist orders, civil money penalties,
    and supervisory agreements. We also use the examination process to
    informally resolve a host of BSA/AML compliance issues. As I noted,
    since last July, we identified 167 thrifts with deficiencies in their
    BSA/AML compliance programs--all of the institutions either agreed to
    implement changes and moved promptly to do so, or completed the
    recommended corrective action before the completion of their
    examination. Finally, we are actively investigating several other
    possible violations of the BSA by thrifts, which may result in the
    issuance of other enforcement orders.

    Interagency Working Groups and Committees
        Cooperation with our fellow agencies is always important, and it is
    particularly crucial in the anti-money laundering context. Money
    laundering and the financing of terrorism are truly global issues,
    cutting across a wide range of business activities, financial
    institutions, and international boundaries. The continuing fight
    against money laundering and terrorism demands coordinated, consistent
    efforts on both the national and international level.
        OTS and our Federal banking agency counterparts largely work hand-
    in-hand in this effort. I have already mentioned the number of USA
    PATRIOT Act-related working groups and regulatory projects to which
    OTS, as well the other Federal banking agencies, have contributed. Many
    of those projects continue, as the agencies, always in a concerted way,
    provide guidance and examination standards to the industry. A good
    example of such a continuing effort is the ongoing work to issue a
    second set of frequently asked questions about the Customer
    Identification Program rules.
        OTS also participates in the Bank Secrecy Act Advisory Group
    (BSAAG). The BSAAG is a unique collection of representatives from law
    enforcement, regulators, and the private sector charged with
    responsibility for advising the Secretary of the Treasury on matters
    relating to the administration of the BSA. With the USA PATRIOT Act's
    expansion of the types of entities subject to anti-money laundering
    program requirements, the BSAAG's membership has also recently expanded
    to include representatives from a wide variety of new industries, such
    as automobile dealers, life insurance companies, and money service
    businesses.
        Along with the other Federal banking agencies and representatives
    from a number of law enforcement agencies, OTS is a member of the Bank
    Fraud Working Group. This forum enables participants to share
    information, and cooperate in identifying individuals engaged in fraud
    and trends involving fraudulent activities.
        Even outside the formal working group context, cooperation between
    the Federal banking agencies on BSA/AML matters is consistent and long-
    standing. For instance, OTS cooperates with FinCEN and law enforcement
    agencies when matters of mutual interest are uncovered in OTS
    examinations or reviews. OTS and FinCEN have worked together to
    investigate and remedy BSA violations through the issuance of parallel
    enforcement actions. OTS also has frequently assisted law enforcement
    agencies investigating possible criminal misconduct and has, on
    occasion, made its examiners available as testifying experts before
    grand juries.

    OTS's BSA Resources Webpage and Hotline
        To make information about the Bank Secrecy Act and USA PATRIOT Act
    easily accessible by thrifts and other interested parties, OTS
    maintains a page on its internet site with links to all the documents
    referred to in this testimony, including those related to CIP and other
    USA PATRIOT Act requirements, SAR's, and recent announcements. The
    webpage also includes links to FinCEN and to the Office of Foreign
    Asset Control (OFAC). The OTS's BSA webpage can be accessed through
    OTS's Internet site at www.ots.treas.gov. OTS also maintains a USA
    PATRIOT Act hotline for thrifts to call with questions about their BSA
    responsibilities.

    Suspicious Activity Reports (SAR's)
        For many years, the BSA has authorized the Department of the
    Treasury to require any financial institution to report suspicious
    transactions relevant to possible statutory or regulatory violations.
    Even before the FBA's issued SAR regulations in 1996, thrifts and other
    depository institutions were required to file criminal referral and
    suspicious transactions reports. The USA PATRIOT Act did not change the
    basic SAR requirement.
        OTS's SAR regulations require a thrift to file a SAR when it
    detects a ``known or suspected violation of Federal law or a suspicious
    transaction related to a money laundering activity or a violation of
    the Bank Secrecy Act.'' \14\ To reduce regulatory burden on filers,
    depository institutions, and other filers submit SAR's only to an IRS
    data center that maintains a unified SAR database on behalf of FinCEN
    and the FBA's. FinCEN presently is testing a system to permit direct,
    secure on-line filing of SAR's. Currently, some filers still submit
    paper reports. Others deliver information electronically on tape or
    disk, which delays its inclusion in the database by approximately 1
    month. When fully implemented, electronic filing will greatly improve
    the usefulness of the SAR database for regulators and law enforcement
    agencies.
    ---------------------------------------------------------------------------
        \14\ 12 CFR Sec. 563.180.
    ---------------------------------------------------------------------------
        Because the SAR database contains highly confidential information
    of known or suspected criminal activities, on-line access is restricted
    to the FBA's, certain other state and Federal agencies, and to law
    enforcement agencies, such as the FBI and the Secret Service. Banks and
    thrifts may not disclose a SAR or its contents, and the banking
    agencies do not share SAR information with non-SAR users.
        From 1996 through 2003, financial institutions filed nearly 1.3
    million SAR's. SAR's related to thrifts account for less than 10
    percent of all SAR's. The total number of SAR's filed each year has
    grown significantly. For the 9 months of 1996 after the SAR
    requirements took effect, there were 52,069 SAR's filed. For 2003, this
    had grown to 288,343. Nearly half of all SAR's filed since 1996 have
    related to BSA and money laundering violations. Check fraud is a
    distant second, with nearly 12 percent.
        OTS staff members review SAR's each month for possible enforcement
    action and to coordinate with law enforcement investigations. In
    addition, in preparing to conduct a periodic examination of a thrift,
    examiners review the SAR's that relate to the thrift, and during the
    examination determine whether there is an ongoing problem that must be
    addressed.
        SAR's are valuable tools. For instance, information in SAR's allows
    FinCEN to identify emerging trends and patterns associated with
    financial crimes, which is vital to law enforcement agencies and
    provides valuable feedback to regulators and financial institutions.
    Here at OTS, information in thrift-filed SAR's has resulted in a number
    of enforcement orders, including cease and order orders and prohibition
    orders.

    General Accounting Office Review
        The General Accounting Office (GAO) has recently initiated two new
    reviews in this area. One involves a review of the implementation of
    the anti-money laundering provisions of the USA PATRIOT Act by the
    banking agencies and others. GAO specifically plans to review (i) the
    status of implementing the customer identification program and
    information sharing provisions, (ii) agency procedures for assessing
    compliance and enforcement, (iii) efforts to educate the industry about
    the new regulations, and (iv) the extent to which the agencies have
    revised and applied examination guidance.
        The other review relates to BSA examinations and enforcement for
    depository institutions. GAO intends to study (i) how the banking
    agencies audit for BSA compliance, (ii) the number and nature of BSA
    violations since the late 1990's, (iii) how BSA violations are
    identified and addressed, (iv) consistency of BSA examinations,
    interpretation, and enforcement across the agencies, (v) the adequacy
    of the agencies' resources for BSA examinations and the new USA PATRIOT
    Act requirements, and (vi) the role of the Treasury Department in the
    agencies' examination programs and enforcement efforts.
        Much of this testimony addresses what OTS has accomplished in the
    areas to be covered by the GAO reviews. We are working to provide GAO
    with the preliminary information they have requested and look forward
    to assisting them in their efforts in any way we can.

    OTS Recommendations to Enhance Existing BSA/USA PATRIOT Act Efforts
        We have identified several areas for consideration that we believe
    would enhance the existing BSA and USA PATRIOT Act efforts and
    initiatives. These are:

     Establishing better communications among the FBA's, FinCEN,
        the banking industry and law enforcement, particularly with respect
        to systemic BSA violations and developing trends. We encourage such
        exchanges of information through several means, including
        advisories, guidance, meetings and personal communications.
     Enhancing the flow of information between law enforcement and
        depository institutions. The information sharing process should be
        a two-way street. In order to review account records that might
        relate to terrorist financing, financial institutions need as much
        identifying information as law enforcement can provide.
        Additonally, law enforcement needs responses to its inquiries as
        quickly as possible from depository institutions. The FBA's can
        substantially assist in facilitating the collection and exchange of
        this vital information.
     Improving FBA coordination and BSA/AML awareness and training
        via a more formalized procedure within the Federal Financial
        Institutions Examination Council (FFIEC). This includes improving
        communications among the FBA's and FinCEN regarding known schemes
        to evade BSA/AML laws, as well as having FinCEN supplement BSA
        training programs within the FFIEC so that all the FBA's and FinCEN
        are consistent in the application of BSA/AML standards.

    Conclusion
        We have always taken our responsibility to oversee compliance with
    the BSA seriously. The original focus of the BSA was to prevent
    criminal money laundering activities. Since the events of September 11,
    2001, and the enactment of the USA PATRIOT Act, the focus of the BSA
    has expanded to include the war against terrorism.
        OTS has redoubled its efforts under the BSA and the new USA PATRIOT
    Act requirements. We have:

     Helped educate the thrift industry through a variety of
        mechanisms;
     Provided additional training for staff;
     Greatly expanded the number of examiners who are reviewing BSA
        and USA PATRIOT Act compliance on an on-going basis;
     Halved the interval between BSA examinations;
     Developed and implemented enhanced scoping and examination
        procedures;
     Implemented a new BSA tracking and monitoring information
        system;
     Improved internal controls governing data collection,
        examination, and enforcement activities;
     Bolstered off-site BSA monitoring programs;
     Adopted more robust and stringent enforcement policies;
     Implemented a new BSA Quality Assurance audit program; and
     Improved internal communications and external communications
        and coordination with other regulatory agencies, Treasury, and law
        enforcement.

        These actions collectively demonstrate our vigorous and diligent
    efforts to ensure maximum compliance with the intent and purpose of
    both the BSA and the USA PATRIOT Act. There is still more to be done.
    We pledge our continued efforts, look forward to your observations on
    these issues and await your questions.

                                   ----------

                     PREPARED STATEMENT OF JOANN M. JOHNSON
                 Chairman, National Credit Union Administration
                                  June 3, 2004

        Chairman Shelby, Ranking Member Sarbanes, and Members of the
    Committee, thank you for the invitation to testify before you on behalf
    of the National Credit Union Administration (NCUA) on the enforcement
    of the Bank Secrecy Act (BSA).
        Congress enacted the BSA to prevent credit unions and other
    financial institutions from being used as intermediaries for the
    transfer or deposit of money derived from criminal activity. NCUA is
    the regulatory authority that monitors federally insured credit unions
    for compliance with the BSA.

    Supervision of BSA Compliance in the Credit Union Industry
        I am pleased to report to the Committee that historically federally
    insured credit unions have a good record of compliance with the
    requirements of the BSA. Credit unions are also substantially in
    compliance with Sections 314 (Information Sharing) and 326 (Customer
    Identification Program) of the USA PATRIOT Act.
        At the end of 2003, NCUA insured 9,399 credit unions. Almost 50
    percent of federally insured credit unions are small with assets less
    than 10 million dollars. The smaller credit unions are less likely to
    have transactions that trigger the recordkeeping and recording
    requirements of the BSA. Additionally, approximately one-third of
    Federal credit unions have a single common bond sponsor. Officials in
    smaller credit unions and single common bond credit unions often have a
    more intimate understanding of their members' transactions, which
    facilitates their compliance with the requirements of the BSA.
    Consequently, money laundering has not been a major problem for credit
    unions.
        Nevertheless, much has changed since the terrorist attacks of
    September 11. There is increased recognition that denying terrorists
    the ability to launder funds through the Nation's financial system is
    an essential part of winning the war on terrorism. NCUA recognizes that
    as some federally insured credit unions increase in asset size, offer
    more complex financial services, and expand their fields of membership,
    the possibility increases that they may be targeted by individuals or
    groups seeking to launder money. NCUA is mindful of our responsibility
    in this area.
        The Federal Credit Union Act requires NCUA to assure BSA compliance
    in federally insured credit unions. Our responsibility is to ensure
    that all federally insured credit unions comply with applicable
    regulatory requirements and have effective programs in place to
    minimize the risk that they will be used to launder money. Federally
    insured credit unions are required to have BSA compliance programs that
    effectively monitor their daily operations to assure compliance with
    all applicable rules and regulations.
        To assure compliance, during each examination of a federally
    insured credit union, examiners review BSA compliance programs. In
    fact, the risk-focused examination program used by NCUA examiners and
    State credit union examiners directs that a review of compliance with
    the BSA be completed at every examination. (In the one State that does
    not use NCUA's risk-focused examination program, their examination
    program directs a comparable review of BSA compliance.) While this
    review is mandated by the Federal Credit Union Act, the design of the
    review and our extensive examiner education in this area result from
    NCUA's recognition of the important role of credit unions in preventing
    both money laundering and the financing of terrorism.
        In addition to NCUA's risk-focused examination program, NCUA has
    jointly participated with our fellow regulators and the Financial
    Crimes Enforcement Network (FinCEN) on a number of regulations designed
    to implement provisions of the USA PATRIOT Act. Also, NCUA is
    represented on the Bank Secrecy Act Advisory Group and the National
    Bank Fraud Working Group. And, as a member of the Federal Financial
    Institutions Examination Council (FFIEC), we work with other regulators
    to develop effective examiner education in this area and provide
    guidance on best practices to financial institutions.
        Among the 9,369 natural person credit unions, 3,593 are State-
    chartered, federally insured institutions and have a State supervisory
    authority as their primary regulator. In accordance with its
    responsibility under the Federal Credit Union Act, NCUA reviews BSA
    compliance each time it conducts a credit union examination. In State-
    chartered, federally insured credit unions where the State regulator
    conducts the examination, the State examiner reviews for BSA
    compliance. All examinations of federally insured credit unions
    completed by a state regulator are reviewed by NCUA staff. It should be
    noted, however, that NCUA does not review examinations of privately
    insured credit unions and does not have enforcement authority for BSA
    compliance in those credit unions.
        During examinations, NCUA reviews the federally insured credit
    union's operations to assure that policies and procedures are in place
    for credit union staff to file Suspicious Activity Reports (SAR's)
    relating to money laundering. Consolidated reports received from FinCEN
    concerning SAR filings are provided to NCUA regional staff and
    examiners to assist in the examination process of the BSA.
        In 2003, NCUA examined over 4,400 Federal credit unions and jointly
    participated with the State regulators in over 600 examinations of
    state-chartered federally insured credit unions. In addition, State
    regulators examined approximately 2,500 federally insured credit
    unions. During those examinations, NCUA determined that there were 334
    violations of the BSA. The violations were in 261 credit unions,
    representing 3.5 percent of credit unions examined. The most common
    violations fell into three categories--inadequate written policy (63
    percent), inadequate customer identification program (8 percent), or
    inadequate currency transaction reporting procedures (7 percent).
        When an examiner identifies a violation of the BSA, immediate
    resolution of the violation is sought. Of the 334 violations, credit
    union officials, working with an examiner, corrected or agreed to
    correct 99 percent of the violations during the on-site examination.
    Based on the severity of the violation, the examiner will establish
    supervision plans to ensure corrective action.
        In instances when violations at a federally insured credit union
    persist and/or are severe, NCUA has several options to initiate
    corrective action. They range from a letter from the NCUA Regional
    Director to formal administrative action including conservatorship.
    During 2003, NCUA Regional Directors issued one letter to a credit
    union that failed to have a BSA compliance program and entered into one
    Letter of Understanding and Agreement with credit union officials to
    ensure resolution of a multitude of problems from a failure to
    understand requirements of the BSA.
        NCUA will use a formal administrative action when necessary to
    correct BSA violations. This has occurred twice in the recent past.
    NCUA placed one institution into conservatorship and issued a cease-
    and-desist order against another. The first instance involved a credit
    union with multiple violations; NCUA placed the institution into
    conservatorship, removing the board of directors and senior operational
    management. NCUA then installed new management to correct deficiencies
    in internal controls and compliance programs. When systemic problems
    had been corrected, NCUA entered into a written agreement with the
    credit union committing the institution to a rigorous compliance
    program. Approximately 10 months after imposing the conservatorship,
    NCUA returned operations of the credit union to its members.
        In the other instance, NCUA issued a cease-and-desist order to
    correct deficiencies in a credit union's BSA program. NCUA required a
    review of past transactions using an acceptable independent auditor and
    a commitment to file appropriate documentation regarding discovered
    violations. The credit union also agreed to retain a BSA compliance
    expert to evaluate its BSA program and to provide weekly education to
    all its employees in this area.

    NCUA Initiatives
        The enforcement of the BSA and its related rules has been and
    remains a priority for NCUA. NCUA has taken numerous initiatives to
    address BSA compliance in credit unions. These initiatives fall into
    the following general categories:

     Examination Program
     Examiner Education
     Compliance Examiners
     Credit Union Education

        NCUA adopted a risk-focused examination program in 2002. Under this
    program, each credit union's examination is based on the examiner's
    analysis of risk for that particular institution. There are three
    mandatory procedures in the risk-focused
    examination program, one of which is the completion of the
    questionnaire on compliance with the BSA. The mandatory questionnaire
    was updated last year to incorporate recent provisions of the USA
    PATRIOT Act.
        NCUA educated all Federal examiners (approximately 600) for the
    implementation of the risk-focused examination and provided a specific
    session on BSA compliance. Additionally, BSA compliance is addressed in
    core training for all NCUA
    examiners. State examiners also attend NCUA compliance training
    sessions.
        NCUA participates with the other FFIEC agencies in developing and
    delivering training in this area. We have worked with our fellow
    regulators to develop guidance for the industry in implementing new USA
    PATRIOT Act regulations.
        The NCUA Examiner's Guide provides examiners with guidance in their
    review of a federally insured credit union's compliance with the BSA.
    To ensure a field focus on compliance with the USA PATRIOT Act, an
    updated version of the Examiner's Guide and the BSA questionnaire
    incorporating recent regulatory changes was issued to staff.
        In conjunction with the implementation of the risk-focused
    examination, NCUA has designated almost 30 compliance subject matter
    examiners. These examiners are called upon to assist in the examination
    of federally insured credit unions that exhibit a more complex
    operation or higher risk in compliance areas. Intensive training on the
    BSA (including the USA PATRIOT Act) was conducted at NCUA's November
    2003 Consumer Compliance Conference. Both Federal and state examiners
    attended the class. In 2002, we also provided a day-long session on the
    BSA for the compliance examiners.
        In addition to on-site reviews of BSA compliance during
    examinations, NCUA has issued several publications to educate federally
    insured credit unions on BSA and USA PATRIOT Act compliance:

     October 2001--Issued Letter to Credit Unions, 01-CU-18, NCUA
        Request Relating to Information Pertaining to the Terrorist Attacks
     April 2002--Issued Regulatory Alert 02-RA-02, USA PATRIOT Act
        Regulation to Improve Information Sharing
     September 2002--Issued Letter to Credit Unions 02-CU-14,
        Detection of Terrorist Financing
     March 2003--Issued Regulatory Alert 03-RA-03, USA PATRIOT Act
        Section 314(a) Information Requests
     May 2003--Issued Regulatory Alert 03-RA-07, Final USA PATRIOT
        Act Regulations on Customer (Member) Identification
     October 2003--Issued Letter to Credit Unions 03-CU-16, Bank
        Secrecy Act Compliance
     February 2004--Issued Regulatory Alert 04-RA-04, USA PATRIOT
        Act Section 326: FAQ's for Customer Identification Program (CIP)
        and Enclosure

        Currently, NCUA is finalizing an update to its Compliance Self-
    Assessment Guide designed to assist federally insured credit unions in
    complying with regulations. With our focus on the BSA and USA PATRIOT
    Act, in October 2003 we issued this draft section to credit unions
    (attached). The guide highlights key requirements of the BSA and can be
    used as a quick reference tool for federally insured credit unions.
        Working with federally insured credit unions to ensure accurate
    point of contact information for Section 314 requests of the USA
    PATRIOT Act, NCUA revised its quarterly Call Report to capture point of
    contact information in March 2003. All credit unions must provide point
    of contact information each quarter.
        NCUA's website (www.ncua.gov) is designed to provide easy access
    for federally insured credit unions to obtain a SAR form along with
    information on the proper filing of the form. This facilitates the
    ability of a credit union to file prompt reports.
        Looking forward, NCUA is committed to maintaining a dynamic
    examination program that will assure federally insured credit unions
    have effective programs in place to minimize the risk of money
    laundering. NCUA will continue to provide guidance to federally insured
    credit unions regarding compliance with the BSA.

    Conclusion
        Again, thank you, Mr. Chairman, for the opportunity to appear
    before you today on behalf of NCUA to discuss BSA compliance in the
    credit union industry. I am pleased to respond to any questions the
    Committee may have or to be a source of any additional information you
    may require.

                                   ----------

                      PREPARED STATEMENT OF WILLIAM J. FOX
                 Director, Financial Crimes Enforcement Network
                        U.S. Department of the Treasury
                                  June 3, 2004

        Chairman Shelby, Senator Sarbanes, and members of the Committee, I
    appreciate the opportunity to appear before you to discuss the role
    that the Financial Crimes Enforcement Network (FinCEN) can and should
    play in Bank Secrecy Act compliance and enforcement matters. As I noted
    the last time I appeared before this Committee, we are indebted to the
    Committee for its leadership and commitment to
    furthering the efforts of our Government generally, and FinCEN in
    particular, to understand, detect and prevent money laundering and
    terrorist financing through the administration of the Bank Secrecy Act
    regulatory regime.
        As the delegated administrator of the Bank Secrecy Act, FinCEN
    bears responsibility for ensuring that it is implemented to achieve the
    ultimate goals of the Act--the institution of measures across the
    financial industry to prevent money laundering, terrorist financing and
    other financial crime, and the creation of records and reports highly
    useful to criminal, tax, regulatory, and counter-terrorism intelligence
    activities. While we eagerly accept this responsibility, we discharge
    it in large measure through the Federal functional regulators and the
    Internal Revenue Service, who have been delegated responsibility to
    examine for Bank Secrecy Act compliance.
        The Bank Secrecy Act regulatory system is unique in that its
    implementation involves 8 different Federal agencies. This unusual
    structure is both the Bank Secrecy Act's strength and its weakness. It
    is a strength because it builds on the existing expertise and
    examination functions of the regulators who know their industries best.
    It is a weakness because of the risk inherent in such fragmentation and
    potential for lack of accountability.
        Within this structure, FinCEN's task is to build on these strengths
    while simultaneously addressing the weaknesses. FinCEN, as the fulcrum
    must ensure that all those responsible are guided by the same
    interpretive principles and apply them in a consistent manner through a
    continuing dialogue among the regulators, the regulated industry, and
    law enforcement.
        My statement today outlines our role in this process and highlights
    the ways in which I think we can improve this process.

    Background
        By virtue of a delegation order from the Secretary of the Treasury
    and a statute passed as part of the USA PATRIOT Act, FinCEN is charged
    with the responsibility of administering the regulatory regime of the
    Bank Secrecy Act. Among other things, we issue regulations and
    accompanying interpretive guidance; collect, analyze and maintain the
    reports and information filed by financial institutions under the Bank
    Secrecy Act; make those reports and information available to law
    enforcement and regulators; and ensure financial institution compliance
    with the regulations through enforcement actions aimed at applying the
    regulations in consistent manner across the financial services
    industry. FinCEN also plays an important role in analyzing the Bank
    Secrecy Act information collected to support law enforcement,
    identifying strategic money laundering and terrorist financing trends
    and patterns, and identifying Bank Secrecy Act compliance issues.
        FinCEN was created as an office within Treasury in 1990. Its
    original mission was focused on analysis--both tactical and strategic--
    of data collected under the Bank Secrecy Act along with other financial
    data. Treasury's Office of Financial Enforcement (OFE) was originally
    responsible for the administration of the Bank
    Secrecy Act regulatory regime. In 1994, Treasury merged OFE into FinCEN
    and delegated the responsibility to administer the regulatory regime to
    FinCEN. Treasury sought to link the analytical functions with the
    administration of the regulatory regime that dictated the information
    that financial institutions were required to record and report. Adding
    responsibilities for administering the regulatory regime strengthened
    and expanded FinCEN's analytical and intelligence abilities.

    Compliance Examination
        While FinCEN is responsible for ensuring compliance with the Bank
    Secrecy Act regulatory regime, FinCEN does not itself examine financial
    institutions for compliance. Instead, FinCEN taps the resources and
    expertise of other Federal agencies and self-regulatory organizations
    by relying on these agencies to conduct compliance exams, through
    delegations of authority that largely predated FinCEN. Examination
    responsibility has been delegated to other Federal regulators as
    follows:

     Depository Institutions--The Board of Governors of the Federal
        Reserve, the
        Office of the Comptroller of the Currency, the Federal Deposit
        Insurance Corporation, the Office of Thrift Supervision, and the
        National Credit Union Administration have been delegated authority
        to examine the depository institutions they regulate for Bank
        Secrecy Act compliance.
     Securities Broker-Dealers, Mutual Funds, and Futures
        Commission Merchants/Introducing Brokers--FinCEN has delegated
        examination authority to the Securities and Exchange Commission and
        the Commodity Futures Trading Commission, and relies on their self-
        regulatory agencies (such as the NASD, the NYSE, and the NFA) to
        examine these entities for compliance.
     Other Financial Institutions--The Internal Revenue Service
        (Small Business/Self-Employed Division) has been delegated
        responsibility for examining all other
        financial institutions subject to Bank Secrecy Act regulation for
        compliance, including, for example, depository institutions with no
        Federal regulator, casinos, and Money Services Businesses (MSBs).

        Even in the absence of examiners, FinCEN has an important role in
    supporting the examination regime created through our delegations.
    FinCEN's role involves providing prompt Bank Secrecy Act interpretive
    guidance to regulators, policy makers and the financial services
    industry, and ensuring the consistent application of the Bank Secrecy
    Act regulations across industry lines, most notably through the
    rulemaking process and subsequent guidance. We promote Bank Secrecy Act
    compliance by all financial institutions through training, education
    and outreach. We support the examination functions performed by the
    other agencies by providing them access to information filed by
    financial institutions in suspicious activity reports, currency
    transaction reports, and other Bank Secrecy Act reports. We also
    facilitate cooperation and the sharing of information among the various
    financial institution regulators to enhance the effectiveness of Bank
    Secrecy Act examination and, ultimately, industry compliance.
        FinCEN has played a more robust role with the Internal Revenue
    Service to develop an examination regime for the many categories of
    businesses that are newly subject to anti-money laundering regulation.
    For example, we have worked extensively with the Internal Revenue
    Service to improve their examination procedures and capabilities for
    money services businesses,\1\ including providing training, reviewing
    exam procedures and the setting of priorities and goals. Finally,
    although done only to a limited extent now, we do provide some
    assistance with examination targeting and prioritization.
    ---------------------------------------------------------------------------
        \1\ Under the Bank Secrecy Act and FinCEN's implementing
    regulations, any person or group of persons doing business in the
    United States in one of the following capacities is defined as a money
    services business (MSB): currency dealers or exchangers; check cashers;
    issuers, sellers, or redeemers of travelers' checks, money orders, or
    stored value; and money transmitters.
    ---------------------------------------------------------------------------
    Enforcement
        FinCEN has retained the authority to pursue civil enforcement
    actions against financial institutions for noncompliance with the Bank
    Secrecy Act and the implementing regulations. Under the Bank Secrecy
    Act, FinCEN is empowered to assess civil monetary penalties against, or
    require corrective action by, a financial institution committing
    negligent or willful violations.
        Generally, FinCEN identifies potential enforcement cases through
    (1) referrals from the agencies examining for Bank Secrecy Act
    compliance; (2) self-disclosures by financial institutions; and, (3)
    FinCEN's own inquiry to the extent it becomes aware of possible
    violations. Referrals from the examining agencies are regularly made to
    FinCEN. It should be noted that under Title 12, the banking regulators
    have authority to enforce certain regulations that fall under that
    statute as well as under the Bank Secrecy Act, such as the requirement
    that depository institutions have anti-money laundering programs. In
    addition, the Internal Revenue Service has authority to enforce certain
    Bank Secrecy Act requirements including the IRS/FinCEN Form 8300
    reporting for nonfinancial trades and businesses, and the Report of
    Foreign Bank and Financial Accounts by individual and entities.

    Efforts to Enhance Bank Secrecy Act Compliance
        Much of our work within FinCEN is devoted to the goal of maximizing
    industry compliance with the Bank Secrecy Act regulatory regime. But as
    the complexity of the regulatory regime, and the obligations imposed,
    continue to grow, our efforts must grow as well. Below, my statement
    outlines my priorities within FinCEN, in the short-term, to better
    enable us to assist the regulators in the examination process and
    further enhance our own capabilities to enforce the regulatory regime.
    I also have included a few ideas to consider as we look for ways to
    further enhance Bank Secrecy Act compliance and examination
    consistency.

    Short-Term Goals
        As I have explained previously, we are in the process of realigning
    FinCEN to position ourselves to better fulfill our mission. As part of
    this, we will be restructuring our regulatory section to focus
    resources and create efficiencies around the functions of Bank Secrecy
    Act examination and enforcement:

    Creation of an Examination Program Office
        Within FinCEN's regulatory office, we will create a new program
    office devoted solely to the Bank Secrecy Act examination function.
    Currently, the affected substantive program area handles examination
    related issues on an ad-hoc basis. For example, individuals responsible
    for the Money Services Business program have taken a primary role in
    working with the Internal Revenue Service to develop and enhance their
    examination regime. The new structure will consolidate all examination
    support functions and better enable FinCEN to provide the necessary
    support to regulatory agencies conducting Bank Secrecy Act compliance
    exams. As an initial priority, FinCEN plans to focus on assisting the
    Internal Revenue Service in its examination function, particularly in
    light of the new regulations that FinCEN has and will issue to bring
    thousands of additional businesses under the Bank Secrecy Act anti-
    money laundering program provision.

    Dedication of Analytical Resources to Compliance Support and
            Examination

    Targeting
        We will also be providing specific analytical support to our
    Examination Office. Our analysts will exploit the Bank Secrecy Act and
    other data to identify, review and, through the Examination Office,
    refer anomalies involving specific financial institutions to the
    appropriate regulator for review and examination. They will use the
    information to assist the regulators in examination targeting by
    identifying high-risk financial institutions or problem compliance
    areas to help the regulators prioritize and direct examination
    resources. The analysts will also work toward identifying new and
    emerging vulnerabilities that should be addressed through the
    examination process. We intend to work closely with the regulators in
    this process.

    Renewed Focus and Resources to Provide Interpretive Guidance
        As the complexity of the Bank Secrecy Act regulatory regime grows,
    so does the need for interpretive guidance. As part of our
    reorganization, we are placing a renewed focus and resource commitment
    on the provision of guidance, both in the form of more comprehensive
    guidance documents as well as more immediate responses to specific
    inquiries. With respect to the former, we intend to begin the process
    of issuing staff commentaries to the various provisions of the Bank
    Secrecy Act. This will involve close consultation with the regulators.
    Separately, we look to leverage existing and develop additional
    industry experts to provide prompt guidance to specific questions as
    they arise, especially during the course of an examination. This will
    also require our working with the regulators to ensure that they know
    what mechanisms are available through which such guidance can be
    obtained.

    Review Enforcement Referral Guidelines and Reporting Requirements
        To improve the Bank Secrecy Act civil enforcement process, FinCEN
    intends to review the utility of developing updated guidelines to
    assist the Federal banking agencies, Internal Revenue Service and other
    agencies, as appropriate, in determining how and when to refer matters
    involving significant, alleged violations of the Bank Secrecy Act to
    FinCEN for consideration of civil money penalties. Currently, upon
    discovery of significant Bank Secrecy Act deficiencies during
    examination cycles, the Federal banking agencies, Internal Revenue
    Service and the Securities and Exchange Commission rely on a memo
    predating the creation of FinCEN on such matters. If appropriate, we
    will work closely with the regulators to revise these guidelines.
        In addition, the regulations delegating Bank Secrecy Act
    examination authority to the banking regulators provide that periodic
    reports shall be made, in a form and timeframe prescribed by Treasury.
    By memorandum, dated June 6, 1979, Treasury prescribed the form and
    timing of the periodic reports to be received from the banking
    regulators, including the number of apparent Bank Secrecy Act
    violations discovered during the examination process. However, since
    its inception such reporting has been sporadic and it has not proved
    helpful. As a result, FinCEN plans on reviewing the utility of
    receiving periodic reports, in a mutually agreed to format, to better
    enable FinCEN to review Bank Secrecy Act compliance and examination
    findings on a national basis across agency lines; such as, for example,
    reporting of remedial actions undertaken by financial institutions as a
    result of consent orders, memorandum of understanding, board
    resolution, supervisory letter, or other enforcement mechanisms.

    MSB Compliance
        A top priority for FinCEN is the prevention of the financing of
    terrorism. One aspect of achieving this goal is finding better ways to
    provide information to the regulated community to better identify
    potential terrorist activity. One area of particular focus in this
    regard will be money services businesses. Money services businesses
    continue to require more attention and resources, and FinCEN will
    undertake an initiative to educate segments of this industry most
    vulnerable to terrorist abuse of their financial services. These
    segments include small businesses that typically offer money remittance
    services, check cashing, money orders sales, and informal value
    transfer systems. Working with our colleagues in law enforcement, we
    hope to enhance our outreach programs to include training on how
    terrorists have and may continue to use money services businesses; the
    reason for and importance of the registration requirement; and the
    importance of complying with the anti-money laundering compliance
    program, reporting and recordkeeping requirements of the Bank Secrecy
    Act, especially suspicious activity reporting. In fact, suspicious
    activity reporting for money services businesses should be streamlined
    by permitting the use of a simplified form to file, which we are
    currently developing.

    Ideas for Enhanced Coordination
        Coordination among the regulators, industry, and law enforcement is
    the lynchpin of effective Bank Secrecy Act compliance. Since the
    passage of the USA PATRIOT Act, cooperation has only improved. On our
    side, we have developed a much closer working and collaborative
    relationship with the regulators on all aspects of Bank Secrecy Act
    administration. This has been reflected in the process of developing
    the new regulations, conducting outreach and training for the industry,
    and focusing on specific compliance issues. Indeed, provisions of the
    Act such as the customer identification section required that FinCEN
    and the regulators issue regulations jointly.
        With respect to examinations, last month the Bank Secrecy Act
    Advisory Group formed a subcommittee devoted to identifying ways to
    better ensure examination consistency among the various regulatory
    agencies and industries. Representatives from industry, the regulatory
    agencies, and law enforcement will participate. This subcommittee is
    yet another vehicle through which FinCEN and the regulators can address
    the range of examination issues with the common goal of enhancing
    compliance on a national basis.
        In this context and elsewhere, we will all have to identify
    creative ways to facilitate continued cooperation. Some ideas that I
    hope to explore with my colleagues include:

    Identification of Common Compliance Deficiencies
        Better identification of compliance issues revealed through the
    examination process on an interagency scale is an essential aspect of
    enhancing the overall effectiveness of the Bank Secrecy Act regulatory
    regime. FinCEN could serve a key role in facilitating that process by
    encouraging the regular sharing of common compliance deficiencies
    uncovered by the regulators. Summaries of deficiencies identified in
    financial institutions will expose areas to be addressed, interpretive
    questions to be answered, or even inconsistencies with the regulations
    themselves. Based on this
    information, FinCEN and the regulators would be able to focus its
    outreach and guidance efforts on emerging, possibly systemic problem
    areas affecting one or more financial industries. Similarly, regulators
    would be able to better focus their examination resources on such
    areas. This data would also enhance the ability of FinCEN and the
    regulators to target their examinations and develop strategic
    examination goals across industry lines.

    Continued Collaboration on Examination Procedures
        To varying degrees, FinCEN has provided input into the development
    of examination procedures for the banking regulators and the Internal
    Revenue Service. In fact, FinCEN is working with Internal Revenue
    Service now to revise its Bank Secrecy Act Examination Manual, which
    guides the conduct of Bank Secrecy Act examinations and is used as a
    training template for Bank Secrecy Act examiners. This is an important
    way in which FinCEN can communicate our examination priorities to the
    regulators and better ensure a consistent examination process by the
    various agencies. We have also begun to participate on a limited scale,
    resources permitting, as observers in exams performed by our regulatory
    partners.

    Joint Examiner Training
        As a complement to the established mechanisms through which the
    regulators train their examiners, we will explore joint training
    opportunities that will afford FinCEN the opportunity to supplement the
    training provided with programs specifically targeted toward our Bank
    Secrecy Act compliance goals, including the possibility of our
    participating in multiagency anti-money laundering training at the
    Federal Financial Institution Examination Counsel.
        We have done such training already. For example, FinCEN has
    conducted joint training of Internal Revenue Service examiners on
    various Title 31 and USA PATRIOT Act requirements in recent IRS
    Examiner training classes. FinCEN also will be conducting training at
    an upcoming meeting of Internal Revenue Service supervisory level
    personnel who have Bank Secrecy Act examination responsibility. By
    training at the supervisory level (training-the-trainer), FinCEN can
    leverage its limited resources to help ensure that IRS Bank Secrecy Act
    supervisory personnel deliver the appropriate message concerning the
    content of Bank Secrecy Act exams to the Internal Revenue Service field
    exam staff.

    Conclusion
        Mr. Chairman, we appreciate your Committee's continued support in
    our efforts to ensure the effectiveness of Bank Secrecy Act examination
    and enforcement programs. This concludes my remarks. I will be happy to
    answer your questions.

                  PREPARED STATEMENT OF GASTON L. GIANNI, JR.
            Inspector General, Federal Deposit Insurance Corporation
                                  June 3, 2004

        Mr. Chairman, Ranking Member Sarbanes, and Members of the
    Committee, I am pleased to testify before you today as you conduct this
    hearing on the Federal financial regulatory agencies' enforcement of
    the Bank Secrecy Act (BSA). We appreciate and thank the Committee for
    its interest in gaining a greater understanding of how the Government
    is combating terrorist financing and money laundering. The Committee,
    the regulators, and our office clearly have a mutual interest in
    assuring the public that the best possible efforts are made to deter
    such dangerous and illegal activities.
        Today, I will present a historical perspective on the Bank Secrecy
    Act and discuss the BSA-related work my office has done over the past
    several years. I will also offer our views on the challenges that the
    Congress and the financial regulators face going forward in this
    critical area.

    The Bank Secrecy Act of 1970
        The Bank Secrecy Act of 1970 requires all financial institutions to
    maintain appropriate records and to file certain reports that are used
    in criminal, tax, or regulatory investigations and proceedings. The
    BSA's implementing regulation, 31 CFR Part 103, is also used to aid law
    enforcement agencies in the investigation of suspected criminal
    activity such as illegal drug activities, income tax evasion, and money
    laundering by organized crime. The BSA consists of two parts--Title I,
    Financial Recordkeeping, and Title II, Reports of Currency in Foreign
    Transactions.

     Title I authorizes the Secretary of the Treasury (Treasury
        Department) to issue regulations requiring institutions to maintain
        certain records related to financial transactions.
     Title II directs the Treasury Department to prescribe
        regulations governing the reporting of certain transactions by and
        through financial institutions in excess of $10,000. A financial
        institution must file a Currency Transaction Report (CTR) with the
        Treasury Department for each cash transaction over $10,000 or
        multiple cash transactions by an individual in 1 business day or
        over a period of days aggregating over $10,000. The BSA also
        requires financial institutions to file Suspicious Activity Reports
        (SAR) with the Treasury Department when suspected money laundering
        activity, terrorist financing, or other BSA violations occur, such
        as the use of shell entities, check kiting, or embezzlement.

    BSA Requirements for FDIC-Supervised Institutions
        The FDIC is currently the primary Federal regulator for
    approximately 5,300 financial institutions. In that role, the
    Corporation has implemented rules and regulations in addition to those
    issued by the Treasury Department that require each FDIC-supervised
    institution to develop and administer a BSA program to ensure
    compliance with the BSA and 31 CFR Part 103. Institutions' BSA programs
    should include:

     a written BSA program approved by the institution's board of
        directors,
     a system of internal controls to assure ongoing compliance,
     independent testing for compliance with the BSA and 31 CFR
        Part 103 to be conducted by bank personnel or an outside party,
     designation of individual(s) responsible for coordinating and
        monitoring compliance with the BSA, and
     training in BSA requirements for appropriate personnel.

    Examination Authority and Procedures
        Although the Treasury Department has overall authority for BSA
    enforcement and compliance, its regulations delegate authority to
    financial institution regulatory agencies, including the FDIC, to
    examine financial institutions for compliance. In this capacity, the
    FDIC has authority to (1) examine the institutions it supervises for
    compliance with the BSA, (2) refer BSA violations to the Treasury
    Department, and (3) impose regulatory actions for BSA violations. The
    FDIC is also required by the Federal Deposit Insurance Act (FDI Act)
    to:

     prescribe regulations requiring insured depository
        institutions to establish and maintain procedures reasonably
        designed to ensure and monitor compliance with the BSA,
     review such procedures during their examinations of these
        institutions, and
     enforce compliance with the BSA monetary transaction
        recordkeeping and report requirements.

        The Division of Supervision and Consumer Protection (DSC) at the
    FDIC is responsible for promoting the safety and soundness of FDIC-
    supervised institutions, and examining financial institutions'
    compliance with applicable laws and regulations such as the BSA.
        According to the Chairman's testimony for today's hearing, the FDIC
    has conducted almost 11,000 BSA examinations since 2000.

    Communication and Training
        The FDIC has taken steps to ensure that its supervised financial
    institutions and examiners are aware of BSA requirements and that its
    examinations of financial institutions include a review of BSA
    requirements. The FDIC also issues regulations, Financial Institution
    Letters, and other guidance to the financial institutions that it
    supervises; updates Corporation examination and training materials; and
    ensures that DSC examiners are adequately trained to monitor BSA
    compliance.

    Risk-focused Examination Procedures
        DSC requires examiners to use risk-focused examination procedures
    to assess BSA compliance. To accomplish this, examiners may use (1)
    core procedures that are considered during the basic review, (2)
    expanded procedures that are used to target concerns identified during
    the basic review, and (3) impact analyses to assess the seriousness of
    identified deficiencies. To assess the impact of deficiencies
    identified during the basic and expanded reviews, examiners determine
    whether BSA violations and weaknesses:

     are serious and indicate the need for civil money penalties,
     necessitate referrals to law enforcement agencies,
     necessitate a cease-and-desist order for cases in which a
        mandatory BSA compliance program was not established or maintained,
        or other supervisory action to correct prior noncompliance, and
     affect the safety and soundness of the institution.

    When Violations Should Be Referred to the Treasury Department
        According to referral guidelines issued by the Treasury
    Department's Office of Financial Enforcement in October 1990, the
    Treasury Department has a zero tolerance level for violations of the
    BSA but recognizes that BSA violations are of a varying nature. The
    guidelines state, ``Because the determination process often is
    subjective, sound examiner judgment and experience also are required.''
    To assist with the determination process for referrals to the Treasury
    Department, the guidelines
    instruct examiners to ``assess all of the facts and circumstances
    surrounding the violations,'' including whether:

     the violations represent an isolated incident caused by human
        error;
     the deficiencies are indicative of significant noncompliance
        with the BSA and/or systemic weaknesses in the institution's BSA
        compliance program;
     the types and nature of the violations are serious;
     the violations are the result of blatant, willful, or flagrant
        disregard for BSA requirements;
     there is a pattern of noncompliance with one or more sections
        of the regulations;
     the violations result from inadequate policies, procedures, or
        training programs; and
     the violations result from a nonexistent or seriously
        deficient compliance program.

        DSC procedures require examiners to use the Treasury Department's
    guidelines to determine when a referral is appropriate.

    The Treasury Department or the FDIC can take Regulatory Actions when
    BSA Violations are Identified
        Failure by a financial institution to comply with the BSA can
    result in regulatory sanctions by either the Treasury Department or the
    FDIC. The BSA and its underlying regulations give the Treasury
    Department the authority to assess civil money penalties for violations
    and to authorize criminal prosecution. The FDIC is required to report
    all identified BSA violations and to refer violations that warrant
    penalties to the Treasury Department's Financial Crimes Enforcement
    Network (FinCEN). The FinCEN was established to administer BSA and
    provide a government-wide, multisource intelligence and analytical
    network. Such referrals, however, do not preclude the FDIC from taking
    regulatory action when BSA violations are identified. For example, as
    cited in 12 U.S.C. 1818(s), the FDIC shall issue a cease-and-desist
    order to any FDIC-supervised institution that fails to establish and
    maintain appropriate BSA procedures or to correct any previously
    reported problem with the procedures.
        The Corporation has reported that, since 2001, it has issued 30
    formal enforcement actions against 25 financial institutions and 3
    individuals to address BSA
    violations--25 of these actions were cease-and-desist orders.
    Regulatory action, however, also includes informal actions such as bank
    board resolutions or memorandums of understanding to facilitate
    corrective action(s) from bank management. Since 2001, the Corporation
    reports that FDIC-supervised institutions have entered into 53 informal
    actions with BSA-related provisions. Finally, the FDIC often uses other
    supervisory actions such as correspondence and follow-up visitations or
    examinations to promote compliance with BSA and implementing guidance.

    BSA became a Higher Priority after the Events of September 11
        Prior to the tragic events of September 11, 2001, BSA had played a
    significant role in preventing banks and other financial service
    providers from being used as intermediaries for, or to hide the
    transfer or deposit of, money derived from criminal activity associated
    with organized crime and international drug traffickers. BSA became
    more of a national priority following September 11.

    The USA PATRIOT Act
        In October 2001, the Congress enacted the United and Strengthening
    America by Providing Appropriate Tools Required to Intercept and
    Obstruct Terrorism Act of 2001--the USA PATRIOT Act. This Act expanded
    the Treasury Department's authority initially established under the BSA
    to regulate the activities of U.S. financial institutions, particularly
    their relations with individuals and entities with foreign ties.
    Provisions of the USA PATRIOT Act augmented the BSA money laundering
    provisions, making it a useful tool in tracing terrorist financing
    activities. The Act also elevated the status of FinCEN within the
    Treasury Department and emphasized its role in fighting terrorist
    financing. In addition to administering the BSA, FinCEN is responsible
    for expanding the regulatory framework to other industries (such as
    insurance and securities brokers and dealers) vulnerable to money
    laundering, terrorist financing, and other crimes.

    FDIC's Post-September 11 Initiatives
        DSC has been proactive in the development and issuance of
    interagency examination guidance and has participated in working groups
    led by the Federal Financial Institutions Examination Council to
    develop and implement examiner training related to the enforcement of
    BSA and USA PATRIOT Act provisions. Additionally, DSC has organized and
    participated in numerous outreach programs intended to inform and
    educate the banking industry of USA PATRIOT Act compliance
    requirements. Further, DSC has indicated that it has been involved in
    various interagency and joint law enforcement initiatives, including:

     participation in the Financial Action Task Force's (FATF)
        Working Group on International Financial Institutions Issues, which
        establishes international anti-money laundering standards;
     participation in the Basel Committee decisionmaking process in
        reviewing the ``Know Your Customer'' risk management report;
     participation in working groups and technical assistance
        missions sponsored by the Departments of State and Treasury, which
        are designed to assess vulner-
        abilities to terrorist financing activity worldwide and to develop
        and implement plans to assist foreign governments concerning these
        issues; and
     serving as point-of-contact liaison between FinCEN and FDIC-
        supervised institutions in the USA PATRIOT Act Section 314(a)
        terrorist-subject biweekly searches.

    FDIC OIG Work that Addresses BSA-Related Issues
        My office has conducted three audits that address the FDIC's
    efforts to design and implement a supervisory program to examine
    institutions' compliance with provisions of the BSA and the more
    recently enacted USA PATRIOT Act. The first two audits addressed FDIC
    examiners' planning and conduct of BSA examinations and the
    Corporation's implementation of policies and procedures stemming from
    USA PATRIOT Act requirements. They were both conducted as part of our
    responsibility to provide coverage of the FDIC's supervision
    activities. The third and most recent audit primarily focused on
    supervisory actions taken by the FDIC to ensure institutions implement
    effective corrective action to address BSA violations. This audit was
    initiated in response to interest expressed by staff of the
    Subcommittee on Oversight and Investigations, House Committee on
    Financial Services.
        Overall, these audits identified that the Corporation had taken
    steps to implement a risk-focused examination program for BSA. However,
    improvements were needed to ensure that institutions were fully
    complying with, and the FDIC was effectively enforcing provisions of,
    the Act.
        I will now discuss more details of each audit, with the focus being
    on our findings and recommendations and the FDIC's corrective actions
    to address them.

    Examination Assessment of Bank Secrecy Act Compliance
        By way of background, in the wake of a much-publicized Bank of New
    York money laundering scandal in 1999, the question of whether the BSA
    and its implementation were effective gained renewed interest from the
    legislative and executive branches of the Federal Government. Of
    particular note, the Departments of Treasury and Justice jointly issued
    a revised National Money Laundering Strategy in March 2000 assigning
    responsibility for implementing parts of the strategy to bank
    regulatory agencies, including the FDIC, to enhance efforts to prevent
    money laundering. The regulatory agencies were specifically tasked with
    reviewing existing examination procedures, and where necessary,
    revising, developing, and implementing new examination procedures that
    would ensure anti-money laundering supervision is risk focused. In
    light of the interest and new requirements, we conducted an audit in
    2000 to determine the extent to which the FDIC's examiners reviewed
    FDIC-regulated institutions' compliance with the BSA during the course
    of safety and soundness examinations.
        In March 2001, we issued Audit Report No. 01-013, Examination
    Assessment of BSA Compliance. In the report, we concluded that
    examiners did not adequately document their BSA examination planning or
    procedures. In general, there was little justification for the
    examiners' decisions to omit or include procedures based on their
    evaluation of risk at the institutions being reviewed. Similarly, after
    completing the risk-scoping process, examiners did not consistently
    document the work they performed as required by the Corporation's
    Manual of Examination Policies. As a result, we could not always
    determine the extent to which examiners reviewed institutions'
    compliance with BSA provisions. We also found that examiners could have
    improved examination planning by taking full advantage of the FinCEN
    databases that contain information on CTR's and SAR's. At the time of
    our report, one region was compiling this information in a report and
    disseminating it to examiners. The report showed whether institutions
    had significant changes in the volume of SAR and CTR filings since the
    previous examination and could be used to determine whether the scope
    of the BSA examination should be expanded.
        We recommended that management (1) reinforce risk focusing guidance
    for BSA examinations and ensure that documentation requirements for
    examination planning and procedures were followed and (2) require that
    all FDIC regions provide
    examiners with CTR and SAR information for the purpose of planning BSA
    examinations. Management implemented these recommendations.

    FDIC's Implementation of the USA PATRIOT Act
        As discussed earlier, the USA PATRIOT Act broadened authority and
    required regulations to combat money laundering that were already
    established under the BSA to facilitate the prevention, detection, and
    prosecution of international money laundering and the financing of
    terrorism. Our review of the FDIC's implementation of the USA PATRIOT
    Act focused on Title III of the Act, which is entitled the
    International Money Laundering Abatement and Anti-terrorist Financing
    Act of 2001. Title III includes provisions related to (1) international
    counter-money laundering and related measures, (2) BSA amendments and
    related improvements that supplement the United States' authority to
    detect money laundering provided under the BSA, and (3) currency crimes
    and protection.
        The objective of our audit was to determine whether the FDIC had
    developed and implemented adequate procedures to examine financial
    institutions' compliance with the USA PATRIOT Act. We issued our final
    report on the audit entitled The FDIC's Implementation of the USA
    PATRIOT Act, Audit Report No. 03-037, on September 5, 2003. We
    concluded that DSC's existing BSA examination procedures covered
    certain USA PATRIOT Act, Title III requirements. In addition, DSC had
    advised FDIC-regulated institutions of the new requirements in cases in
    which the Treasury Department had issued final rules implementing the
    Title III provisions. However, DSC had not issued guidance to its
    examiners for those provisions requiring new or revised examination
    procedures because DSC was either coordinating the issuance of uniform
    procedures with an interagency steering committee or waiting for the
    Treasury Department to issue final rules. This delay in issuing
    examination guidance was of particular concern when the Treasury
    Department had issued final rules for Title III provisions addressing
    money laundering deterrents and verification of customer identification.
    We noted that timely issuance of examiner guidance would have helped
    ensure institutions' full compliance with USA PATRIOT Act provisions
    sooner.
        We recommended that the FDIC: (1) issue interim examination
    procedures for those sections for which the Treasury Department has
    already issued final rules and (2) work with its interagency
    counterparts to issue examination guidelines concurrently with the
    Treasury Department's issuance of final rules for institutions'
    implementation of Title III provisions. The FDIC concurred with both
    recommendations and took responsive corrective action. More
    specifically, the FDIC issued interim BSA examination procedures in
    August 2003, which included steps for reviewing institution compliance
    with applicable provisions of the USA PATRIOT Act and in October 2003,
    issued the final examination guidelines developed in consultation with
    the other financial institution regulators.
        While not the result of our audit, FDIC has also trained its bank
    examination staff on the USA PATRIOT Act and incorporated BSA and Anti-
    Money Laundering topics into one of its core examination schools. Also,
    the FDIC is working with the other Federal banking regulators and the
    Conference of State Bank Supervisors to revise examiner training
    programs to incorporate provisions of the USA PATRIOT Act. Furthermore,
    the FDIC has reported changing its application review program to
    consider prohibitions against certain types of relationships with
    financial institutions, particularly foreign shell banks. The
    Corporation has also amended its policies to consider the effectiveness
    of an insured depository institution's anti-money laundering
    activities--including those of overseas branches--when evaluating a
    proposed merger transaction.

    Supervisory Actions Taken for Bank Secrecy Act Violations
        Our most recent audit related to the BSA was done in response to
    interest expressed by the staff of the Subcommittee on Oversight and
    Investigations, House Committee on Financial Services. The audit
    focused on actions taken by the FDIC in its supervisory capacity to
    ensure that FDIC-supervised institutions implement effective corrective
    action to address BSA violations. Our audit results in this case raised
    concerns related to four general areas:

     Extent of Regulatory Action on Significant and Repeat
        Violations
     Consistency of Reporting of Deficiencies and Violations
     Timing of FDIC Follow-Up and Corrective Actions on BSA
        Violations
     Handling of Filings and Referrals to the IRS and Treasury
        Department
    Audit Took Approach Consistent with Prior Treasury OIG Report on BSA
        Our audit approach was modeled after a report issued by the
    Department of the Treasury OIG entitled OTS: Enforcement Actions Taken
    for Bank Secrecy Act Violations, Report No. OIG-03-095, dated September
    23, 2003. The objectives of the Treasury OIG audit were to determine:

     whether the Office of Thrift Supervision took timely and
        sufficient supervisory enforcement actions against thrifts with
        substantive BSA violations;
     enforcement actions, when taken, adequately addressed all
        substantive BSA violations identified by examiners;
     OTS's systems to track and monitor BSA examinations results
        were accurate and reliable.

        The Treasury OIG determined that greater use of forceful and timely
    enforcement sanctions were warranted for BSA violations; enforcement
    actions were not always taken timely or were not always thorough for
    substantive BSA violations; \1\ and BSA examination data errors existed
    in OTS' automated system used to monitor the results of all
    examinations, including BSA.
    ---------------------------------------------------------------------------
        \1\ The Treasury OIG defined substantive BSA violations as those
    that resulted from the failure to develop and implement a BSA program
    with the basic BSA minimum requirements and the nonfiling of CTR's and
    SAR's.
    ---------------------------------------------------------------------------
        The objective of our audit was to determine whether the FDIC
    adequately follows up on BSA violations reported in examinations of
    FDIC-supervised financial institutions to ensure that they take
    appropriate corrective action. The scope of our audit included
    examinations conducted by the FDIC or State regulatory agencies, and
    examinations in which the FDIC participated in a joint capacity with
    State regulatory agencies from January 1, 1997 through September 30,
    2003.

    The FDIC Had Cited a Significant Number of Institutions for BSA
            Violations
        Of the 5,662 financial institutions that the FDIC supervised (on
    average) during the time period covered by our audit, 2,672
    institutions (approximately 47 percent) had been cited for at least one
    BSA violation. Those violations included citations for not complying
    with the Treasury Department's Financial Recordkeeping and Reporting
    Requirements, that is, filing CTR's, and not adequately implementing
    BSA compliance programs as required by the FDIC's Rules and
    Regulations. Of those 2,672 institutions, 458 (approximately 17
    percent) had been cited for repeat BSA violations.

    Audit Shows High Rate of Significant and Repeat Violations, Many of
            Which
    Were Not Subject to Regulatory Action
        We selected a random sample of institutions with violations for
    detailed review. The random sample consisted of 22 institutions
    selected from the 8 DSC regional or area offices, and another 19
    institutions consisted of a judgmental sample of institutions with
    repeat violations for a total of 41 institutions reviewed. We
    determined that

     35 of the 41 institutions (86 percent) were cited for
        violations related to the Treasury Department's financial
        recordkeeping and reporting requirements as prescribed in 31 CFR
        Part 103, and
     29 of the 41 institutions (71 percent) were cited for
        deficient BSA compliance programs that did not meet the minimum
        requirements of the FDIC Rules and Regulations.

        Regarding violations of the Treasury Department's Regulations at 31
    CFR Part 103, these financial institutions were most frequently cited
    for failing to: File CTR's for nonexempted transactions over $10,000;
    maintain records on sales of monetary instruments of $3,000 through
    $10,000; furnish information required in CTR's, file CTR's timely, or
    retain CTR's for 5 years; and treat multiple transactions totaling over
    $10,000 as a single transaction.
        With respect to the FDIC's Rules and Regulations Section 326.8, the
    41 financial institutions in our sample were most frequently cited for
    lack of independent testing of BSA compliance; failure to develop or
    implement an adequate BSA compliance program; inadequate system of
    internal controls for BSA compliance; and failure to provide adequate
    BSA training.
        We also determined that 27 of the 41 institutions had repeat BSA
    violations. Of those 27 repeat institutions, 17 institutions (63
    percent) were not subject to regulatory action for their repeat
    violations, although other supervisory efforts such as follow-up
    correspondence to bank management and visitations may have been in
    progress. Of the 10 institutions that were subject to regulatory
    action, only 1 was subject to a cease-and-desist order.\2\ DSC policy
    states that repeat violations cannot be tolerated and that cease-and-
    desist orders should be initiated in such cases.
    ---------------------------------------------------------------------------
        \2\ The FDIC imposed a regulatory action for one institution that
    did not have repeat violations bringing the total number of regulatory
    actions taken for the sample we reviewed to 11.
    ---------------------------------------------------------------------------
        In addition, Section 8(s) of the FDI Act states that, ``If the
    appropriate Federal banking agency determines that an insured
    depository institution . . . has failed to correct any problem with the
    [BSA] procedures . . . which was previously reported . . . by such
    agency, the agency shall issue an order . . . requiring such depository
    institution to cease-and-desist from its violation . . ..'' In response
    to our audit, the FDIC concluded that it was not required to issue
    cease-and-desist orders in the case of every repeat BSA violation. The
    Corporation believes that enforcement authority always involves some
    element of discretion, including consideration of the nature of the
    violation and supervisory judgment as to how best to address the
    violation. As part of its response to our report, the Corporation
    provided a legal opinion by its General Counsel that addresses
    Congress's intent in Section 8(s). The opinion stated that:

            The absence of a mandate to bring a cease-and-desist action to
            address every violation of Section 8(s) or the regulations does
            not imply that the alternative is to take no action. To the
            contrary, the statutory intent must be to take an appropriate
            corrective action based upon the severity of the problem, the
            risk it poses, and the bank's willingness to comply
            expeditiously.

        We concur with the Counsel's guidance. However, as noted
    previously, our audit identified cases where DSC had not taken
    regulatory action to address repeat violations of BSA requirements.

    FDIC's Reporting and Follow-Up On BSA Violations
        For the 41 banks in our sample, we reviewed 82 reports of
    examination that cited apparent and often multiple BSA violations. We
    noted that not all BSA deficiencies described in DSC's examination
    reports were cited in the violations section of the reports and tracked
    in the FDIC's information system. For 25 (30 percent) of the 82
    reports, DSC waited until the next examination to follow up on some or
    all of the BSA violations, and corrective actions to address cited
    violations often took more than 1 year. Also, DSC's regional offices
    took various approaches to handling violations related to the filing of
    CTR's and to referring bank violations to the Treasury Department.
    Finally, we found that while many institutions had been cited for BSA
    violations, there were few referrals to the Treasury Department during
    the audit period, and most were made by one FDIC region.

    Inconsistencies in Describing Deficiencies and Citing Violations

        In reviewing DSC's reports of examination, we observed several
    instances of BSA deficiencies described in the reports but not cited in
    the Violations of Laws and Regulations section of the reports. On the
    other hand, we also noted instances of BSA deficiencies similar to
    those described that were cited as violations. Deficiencies that are
    described in the reports of examination but not cited as violations may
    receive less attention from bank management or in follow-up by DSC.
    According to DSC officials, the examiners exercise judgment in
    determining the significance of BSA concerns. That judgment includes
    determining whether the weaknesses constitute:

     apparent violation of laws or regulations, meriting inclusion
        in the violations section of the examination report, or
     noncompliance with DSC guidelines, meriting only mention in
        the report as matters for bank management's attention, which may be
        sufficient to eliminate concern.

    Follow-up and Correction of Violations Was Not Always Timely

        DSC's process for following up on violations cited in reports of
    examination includes:

     a request for the report to be considered in the bank's next
        board meeting, with a record of actions taken entered into the
        minutes;
     a request for bank management to provide a response indicating
        the actions taken to eliminate each cited violation or deficiency;
        and
     follow-up of the corrective actions at the next examination.

        For the institutions included in our sample, we checked how often
    and by what method DSC followed up on whether corrective actions had
    been taken. We considered evidence related to DSC's follow-up actions
    or the banks' corrective actions, as well as information from the
    Treasury Department. As a result of our analysis of the process and our
    review of the 82 reports that cited apparent BSA violations, we found
    that:

     For 20 reports, DSC followed up or pursued regulatory action
        for certain violations before the next examination, including
        additional correspondence, visitations, and regulatory actions such
        as bank board resolutions, memorandums of understanding, or cease-
        and-desist orders.
     For 42 reports, DSC received evidence from bank management,
        Treasury's FinCEN, or the Internal Revenue Service (IRS) that
        certain violations had been corrected before the next examination,
        and in many of these instances, corrective action took place before
        the examination was completed.
     For 25 reports, DSC waited until the next examination to
        assess the adequacy of bank corrective actions for certain
        violations.\3\
    ---------------------------------------------------------------------------
        \3\ Note that the numbers do not total 82 because DSC used
    different follow-up actions for some examination reports that cited
    multiple violations.

        We also observed that DSC regional and field offices exercised wide
    discretion in deciding whether and when to follow up on the violations
    or take regulatory action. In some cases, more than 1 to 5 years passed
    before (1) bank management took corrective action that was effective to
    prevent repeat violations or (2) DSC applied regulatory actions to
    address continuing violations. As shown below, about two-thirds of the
    violations took longer than 1 year to correct.

                      Time Taken to Address BSA Violations
    ------------------------------------------------------------------------
            LENGTH OF TIME FOR ACTION            NUMBER OF INSTITUTIONS *
    ------------------------------------------------------------------------
    12 months or less.......................                             27
    ------------------------------------------------------------------------
    13 months-24 months.....................                             13
    ------------------------------------------------------------------------
    25 months-36 months.....................                             16
    ------------------------------------------------------------------------
    37 months-48 months.....................                             10
    ------------------------------------------------------------------------
    49 months-60 months.....................                              1
    ------------------------------------------------------------------------
    More than 60 months.....................                              8
    ------------------------------------------------------------------------
    * The number of institutions will exceed the 41 sampled institutions
      because the length of time varied for institutions with multiple BSA
      violations.
    Source: OIG analysis of ViSION data and review of evaluation reports and
      supplemental information provided by DSC for the 41 sampled
      institutions.

        DSC officials stated that follow-up on BSA violations often occurs
    at the next FDIC examination rather than between examinations. Although
    the FDIC can conduct visitations between regularly scheduled
    examinations, we identified only a few visitations based on information
    provided by DSC that addressed BSA violations.
        Generally, the FDIC alternated examinations of the sampled
    institutions with State regulatory agency examinations for those
    institutions. However, 45 of the 72 examination reports we reviewed
    from state regulatory agencies did not specifically address BSA
    compliance. Therefore, the FDIC could not rely on those examinations to
    determine whether bank management took corrective actions to address
    previously cited violations or to identify any new BSA violations.
    Consequently, follow-up by the FDIC on some previously cited BSA
    violations did not occur until the next FDIC examination--generally 24
    to 36 months after the violations were initially identified. This delay
    in ensuring that BSA violations are corrected could result in
    additional or continued BSA violations and could hinder the detection
    of criminal activity.

    Handling of Violations Related to CTR's

        We also noted variations in the handling of violations related to
    CTR's. While conducting examinations, examiners identified instances in
    which financial institutions had improperly exempted customers from
    currency transaction reporting requirements or otherwise failed to file
    CTR's. According to DSC guidance, CTR's must be filed with the IRS
    within 15 days following the date of the transaction (25 days if the
    financial institution files electronically). For those institutions
    that did not file CTR's within the specified timeframe, FinCEN requests
    that examiners have bank officials request permission to backfile
    CTR's. DSC regional offices did not handle violations related to the
    backfiling of CTR's in a consistent manner. Some offices required the
    institutions to request permission to backfile, while other offices
    allowed the institutions, in cases that involved one or two CTR's, to
    file without requesting permission to backfile.

    Handling of Referrals to the Treasury Department

        DSC referrals of bank violations to the Treasury Department were
    infrequent. According to information provided by DSC, while 2,672
    institutions were cited for violations, there were only 34 referrals
    made from January 1, 1997 through December 31, 2003, and most of these
    referrals were made by one DSC regional office. DSC officials added
    that, since the Treasury Department has access to FDIC information on
    BSA violations through a shared information system, further reporting
    is not required. The Treasury Department sometimes requests copies of
    applicable examination reports based on its analysis of the violations.
    The following actions have
    resulted from the referrals made by the FDIC from January 1, 1997
    through December 31, 2003

     27 institutions received cautionary letters or letters of
        warning from the Treasury Department,
     1 institution received a civil money penalty,
     3 referrals were resolved by other means, and
     3 referrals were still open.

        In summary, the Treasury Department took action when referrals were
    made but, in our assessment, FDIC only did so infrequently.
    Report Recommends Strengthening Guidance Related to BSA Monitoring and
    Follow-Up Processes
        We concluded in our report that the FDIC had adequately followed up
    on some BSA violations to ensure bank management has taken appropriate
    corrective action. However, more could be done to better ensure that
    prompt and effective actions are taken by bank management to ensure
    compliance with BSA regulations.
        In light of the increased Congressional interest in BSA compliance
    and emphasis on national security concerns, we recommended that the
    Corporation:

     reevaluate and update its examination guidance to help ensure
        adequate examiner follow-up and timely corrective action by bank
        management;
     discuss and update the referral policy with the Treasury
        Department; and
     encourage State coverage of BSA compliance, and develop
        alternative processes to compensate for the lack of State coverage
        of BSA compliance.

    FDIC Management Agreed with Recommendations and Is Taking Steps to
            Improve
    Its BSA Program
        DSC management agreed with our recommendations. DSC had taken steps
    to initiate a reevaluation and update of its guidance, with interagency
    cooperation, to address formal supervisory actions, follow-up actions,
    citation of apparent violations, and recordkeeping and backfiling of
    CTR's. DSC also agreed to work with the FDIC Legal Division to clarify
    and update, as necessary, enforcement action guidance on BSA.
        Further, DSC management agreed to pursue clarification of referral
    procedures with the Treasury Department. Finally, DSC agreed to focus
    on strengthening processes to address variations in the State
    examination coverage of BSA and believed doing so would increase the
    consistency and reliability of the follow-up to its BSA examinations.

    Looking Ahead
        Mr. Chairman, the goal of identifying and cutting off terrorist
    funding is an essential one. The Government's success in accomplishing
    that goal is dependent upon
    collecting and analyzing necessary information, and disseminating and
    sharing that information among appropriate law enforcement and
    regulatory agencies. To that end, the Congress passed the BSA, and
    later, the USA PATRIOT Act, to establish requirements and coordination
    mechanisms for creating this free flow of information. While the FDIC
    has been a leader in many initiatives aimed at complying with these two
    Acts, we found and the Corporation has acknowledged it can do more. In
    light of the knowledge we have gained since September 11 and more
    recent terrorist threats, there are key questions that the FDIC should
    consider, in conjunction with the Treasury Department and the other
    financial regulators, as it looks to improve its BSA program.

     Is risk-scoping BSA examinations and follow-up still the most
        effective approach to deterring money laundering and terrorist
        financing?
     Are the policies and procedures for reporting certain cash
        transactions and BSA violations to the Treasury Department, some of
        which date to the early 1990's, currently effective?
     Is the information reported to FinCEN by financial
        institutions and regulators effectively evaluated and does it
        ultimately result in timely preventive actions?

        Mr. Chairman, we appreciate the opportunity to participate in this
    hearing. We are prepared to assist in addressing these issues and have
    additional audits planned in this area to help ensure that financial
    institutions, through efficient and effective supervision by the FDIC,
    will remain vigilant in implementing BSA programs that assist in
    preventing money laundering and terrorism. I would be pleased to answer
    any questions the Committee may have at this time.

               RESPONSE TO A QUESTION OF SENATOR SHELBY
                        FROM JOHN D. HAWKE, JR.

    A.1. Mr. Hawke, in addition to the Saudi and Equatorial Guinea
    accounts, Riggs held numerous other foreign accounts, including
    what many characterize as what we would call high-risk by
    FinCEN and OFAC. They include, among others, Burma, Cuba, the
    Sudan, Iraq, Iran, Syria, and Nigeria. If Riggs' BSA/AML
    internal controls were so deficient, which is a given, should
    we be concerned, in other words, should you be concerned that
    many of these other embassy and special interest accounts could
    suffer similar inadequacies and violations?

    A.1. OCC examiners reviewed Riggs Bank's OFAC controls during
    the January 2003 BSA examination and did not find any problems
    with the bank's handling of OFAC country accounts. The
    examiners reviewed the details of the Iraqi blocked accounts
    and did not identify any deficiencies or noncompliance with
    OFAC regulations. Subsequently, OCC examiners obtained and
    confirmed that appropriate licenses were acquired for Riggs or
    their banking customers to open accounts or transact business
    within OFAC sanctioned countries of Burma, Cuba, Iran, Iraq,
    the Sudan, Syria, and Yugoslavia (Balkans). The bank's OFAC
    compliance procedures used in the opening account process have
    also been assessed in subsequent exams and found to be
    satisfactory.
        Most of the above-mentioned OFAC sanctioned countries
    having either Embassy or Mission accounts within Riggs's
    Embassy Banking Division were closed in June 2004 as part of
    the bank's decision to exit high-risk Embassy accounts. There
    is one exception of an Iranian account that remains open and
    blocked as required by OFAC. Under the terms of the cease-and-
    desist orders, the bank is required to review the activity in
    all high-risk Embassy accounts going back to January 1, 2001,
    to ensure that Suspicious Activity Reports are filed where
    appropriate. The OCC will evaluate Riggs Bank's compliance with
    this and other requirements of the cease-and-desist orders in
    October of this year.