    [Senate Hearing 115-158]
    [From the U.S. Government Publishing Office]

                                                            S. Hrg. 115-158

        COMBATING MONEY LAUNDERING AND OTHER FORMS OF ILLICIT FINANCE:
      OPPORTUNITIES TO REFORM AND STRENGTHEN BANK SECRECY ACT ENFORCEMENT

    =======================================================================

                                    HEARING

                                   before the

                                  COMMITTEE ON
                       BANKING,HOUSING,AND URBAN AFFAIRS
                              UNITED STATES SENATE

                         ONE HUNDRED FIFTEENTH CONGRESS

                                 SECOND SESSION

                                       ON

     EXAMINING THE ISSUES UNDERLYING THE MODERNIZATION OF SYSTEMS DESIGNED
     TO COMBAT MONEY LAUNDERING, TERRORIST FINANCING, CORRUPTION, WEAPONS
              PROLIFERATION, SANCTIONS EVASION, AND OTHER THREATS

                                   __________

                                JANUARY 9, 2018

                                   __________

      Printed for the use of the Committee on Banking, Housing, and Urban
                                    Affairs

    [GRAPHIC(S) NOT AVAILABLE IN TIFF FORMAT]

                    Available at: http://www.govinfo.gov/

                                       ______

                             U.S. GOVERNMENT PUBLISHING OFFICE

    28-675 PDF                     WASHINGTON : 2018

                COMMITTEE ON BANKING, HOUSING, AND URBAN AFFAIRS

                          MIKE CRAPO, Idaho, Chairman

    RICHARD C. SHELBY, Alabama           SHERROD BROWN, Ohio
    BOB CORKER, Tennessee                JACK REED, Rhode Island
    PATRICK J. TOOMEY, Pennsylvania      ROBERT MENENDEZ, New Jersey
    DEAN HELLER, Nevada                  JON TESTER, Montana
    TIM SCOTT, South Carolina            MARK R. WARNER, Virginia
    BEN SASSE, Nebraska                  ELIZABETH WARREN, Massachusetts
    TOM COTTON, Arkansas                 HEIDI HEITKAMP, North Dakota
    MIKE ROUNDS, South Dakota            JOE DONNELLY, Indiana
    DAVID PERDUE, Georgia                BRIAN SCHATZ, Hawaii
    THOM TILLIS, North Carolina          CHRIS VAN HOLLEN, Maryland
    JOHN KENNEDY, Louisiana              CATHERINE CORTEZ MASTO, Nevada
    JERRY MORAN, Kansas                  DOUG JONES, Alabama

                         Gregg Richard, Staff Director
                     Mark Powden, Democratic Staff Director
                          Elad Roisman, Chief Counsel
            John O'Hara, Chief Counsel for National Security Policy
                   Sierra Robinson, Professional Staff Member
                     Elisha Tuku, Democratic Chief Counsel
                   Colin McGinnis, Democratic Policy Director
                           Dawn Ratliff, Chief Clerk
                          Cameron Ricker, Deputy Clerk
                         James Guiliano, Hearing Clerk
                          Shelvin Simmons, IT Director
                              Jim Crowell, Editor

                                      (ii)

                                C O N T E N T S

                                  ----------

                            TUESDAY, JANUARY 9, 2018

                                                                       Page

    Opening statement of Chairman Crapo..............................     1

    Opening statements, comments, or prepared statements of:
        Senator Brown................................................     2

                                   WITNESSES

    Greg Baer, President, The Clearing House Association.............     4
        Prepared statement...........................................    29
        Responses to written questions of:
            Senator Brown............................................    58
            Senator Sasse............................................    62
            Senator Tillis...........................................    70
            Senator Warner...........................................    75
            Senator Cortez Masto.....................................    79
    Dennis M. Lormel, President and Chief Executive Officer, DML
      Associates, LLC, and Former Chief, FBI Financial Crimes Program     5
        Prepared statement...........................................    35
        Responses to written questions of:
            Senator Brown............................................    86
            Senator Sasse............................................    87
            Senator Tillis...........................................    96
            Senator Warner...........................................   100
            Senator Cortez Masto.....................................   105
    Heather A. Lowe, Legal Counsel and Director of Government
      Affairs, Global Financial Integrity............................     7
        Prepared statement...........................................    46
        Responses to written questions of:
            Senator Brown............................................   111
            Senator Sasse............................................   117
            Senator Tillis...........................................   124
            Senator Warner...........................................   130
            Senator Cortez Masto.....................................   134

                  Additional Material Supplied for the Record

    Countering International Money Laundering........................   145
    Letter submitted by the FACT Coalition...........................   174
    Statement submitted by the Independent Community Bankers of
      America........................................................   176
    Letter submitted by the Credit Union National Association........   178

                                     (iii)

        COMBATING MONEY LAUNDERING AND OTHER FORMS OF ILLICIT FINANCE:
      OPPORTUNITIES TO REFORM AND STRENGTHEN BANK SECRECY ACT ENFORCEMENT

                                  ----------

                            TUESDAY, JANUARY 9, 2018

                                           U.S. Senate,
              Committee on Banking, Housing, and Urban Affairs,
                                                        Washington, DC.
        The Committee met at 10:04 a.m., in room SD-538, Dirksen
    Senate Office Building, Hon. Mike Crapo, Chairman of the
    Committee, presiding.

                OPENING STATEMENT OF CHAIRMAN MIKE CRAPO

        Chairman Crapo. This hearing will come to order.
        Today's hearing is the first of two currently planned
    hearings to explore the difficult issues underlying modernizing
    a decades-old system designed to combat money laundering,
    terrorist financing, corruption, weapons proliferation,
    sanctions evasion, and a host of other threats.
        Our Nation's financial industry has long worked on the
    front lines of preserving the integrity of the United States
    and international financial systems and in partnership with our
    Government since at least when the Bank Secrecy Act was first
    enacted, in 1970, and the phrase ``anti-money laundering''--or
    AML--was coined a few years later.
        From its tax and narcotics beginnings, the BSA, its
    regulations, and other supporting laws have evolved into a mass
    of counter-threat-finance regulatory requirements designed to
    focus the industry's attention on an ever-expanding set of
    domestic and foreign threats to the Nation.
        These threats were brought to the forefront of Americans'
    hearts and minds and have only increased after the terrorist
    attacks of September 11, 2001, and, in response, the enactment
    of the PATRIOT Act.
        The threats against our Nation, our people, and our
    financial system are real. Everyone sees these threats. One
    only needs to turn on a TV or read an article about corruption,
    drugs, or a terrorist attack and wonder about the money that
    had to be involved to make it happen or the profits that came
    as a result.
        Illicit money enables bad people to do the worst of things
    in this world. Where does it come from? Where does it go? And
    who has it now? These questions will always need to be asked
    and answered.
        In fact, these questions are being answered, whether they
    always know it or not, by an entire industry of technical and
    financial professionals dedicated to managing the day-to-day
    BSA and other threat finance compliance requirements of our
    financial institutions.
        They do the hard work of monitoring hundreds of millions of
    financial transactions and producing millions of reports so
    that law enforcement and security professionals can do their
    jobs of managing an increasingly complex domestic and
    international threat picture.
        But a lot has changed in this nearly 50 years that have
    passed since the BSA was enacted. Certainly the sophistication,
    types, and numbers of threats have increased. The regulations
    that focus the financial industry's attention on suspicious
    activities have also increased. So, too, have the resources
    that are expended and paid by industry and Government alike to
    maintain a constant vigilance over threats to the financial
    system.
        It is incumbent on this Committee to then ensure that all
    of this work and the resources involved result in a ``high
    degree of usefulness'' in protecting this Nation, as intended
    by the BSA itself.
        I welcome each of our witnesses today whose individual
    expertise in financial regulation, law enforcement, and
    financial transparency together will help inform the Committee
    of potential ways to sharpen the focus, sustainability, and
    enforcement of a modernized, more efficient U.S. counter-
    threat-finance architecture.
        Getting this right saves lives. Period.
        This is a bipartisan issue.
        This is both an American and a global issue.
        I look forward to working with Senator Brown and all
    Members of the Committee to see that the needs of the
    stakeholders in this important work are critically examined and
    addressed in order to modernize a system that benefits so many,
    at home and abroad.
        Senator Brown.

               OPENING STATEMENT OF SENATOR SHERROD BROWN

        Senator Brown. Thank you, Mr. Chairman, for this important
    hearing, the first of two this month in which the Committee
    will look at ideas for strengthening and reforming our laws to
    combat money laundering and illicit financial transactions.
        Some of the world's largest banks and their foreign
    partners have run afoul of these laws. In some cases they had
    inadequate anti-money laundering oversight and compliance
    regimes. Other banks willfully and persistently violated U.S.
    bank secrecy, sanctions, and anti-corruption laws.
        In fact, the GAO concluded last year that from 2009 to 2015
    about $12 billion was collected in fines and penalties and
    forfeitures from financial institutions for violations of the
    Bank Secrecy Act, the Foreign Corrupt Practices Act, and U.S.
    sanctions requirements.
        These laws are all tools that aid the Federal Government in
    detecting and disrupting and inhibiting financial crimes,
    terrorist financing, bribery, and corruption.
        During that same period, Federal agencies assessed more
    than $5 billion specifically for Bank Secrecy Act violations.
    When one widens the lens and reaches back to 2005, that number
    grows larger, much larger.
        Many of these banks violated U.S. anti-money laundering and
    sanctions laws by knowingly facilitating financial transactions
    for rogue jurisdictions like Burma and Iran and Sudan and Libya
    and Syria.
        Some conducted transactions with individuals or entities
    affiliated with terrorist organizations and drug cartels in
    violation of U.S. law. Many violated the law for several years.
    And in some cases, foreign affiliates of banks operating in the
    U.S. were working actively to circumvent the compliance systems
    of their own banks.
        These are not victimless crimes. For example, money
    laundering on behalf of drug cartels has a direct line to the
    opioid epidemic in my State, where more die of opioid overdoses
    than any State in the country. These drug cartels have a direct
    line to the opioid epidemic in Ohio, where Sinaloa cartel
    actors have been active in robbing so many families of sisters
    and husbands and parents and children.
        These types of violations should concern those who argue we
    should loosen laws or regulations or oversight in this area.
    These laws have been critical in protecting the integrity of
    our financial system.
        That said, we should assess whether there are ways to
    responsibly update and strengthen the anti-money laundering
    framework, including through new measures to require beneficial
    ownership information when companies are formed in the U.S.
    Right now the U.S. has the dubious distinction of being a haven
    for anonymous shell companies. That needs to end so that law
    enforcement can stanch the flow of money into illegal activity.
        Broadening information sharing may make sense, but
    important questions about privacy protections, of course, must
    be answered. We should focus on sharpening suspicious activity
    reporting and bolstering efforts by law enforcement to give
    banks guidance on what to look for, instead of substantially
    raising currency reporting thresholds.
        There are many tough questions for the Committee to
    consider on these issues. I welcome our distinguished
    witnesses, and I look forward to the comments of the panel.
        Thanks, Mr. Chairman.
        Chairman Crapo. Thank you very much, Senator Brown.
        We appreciate our witnesses' being with us today, and I
    want to remind the witnesses that we have asked that you each
    keep your initial presentation to 5 minutes so that we can have
    time for our questions and answers; also, to remind the
    Senators that they should keep their questions to a 5-minute
    period.
        Our witnesses today are Mr. Greg Baer, president of The
    Clearing House Association; Mr. Dennis Lormel, president and
    CEO of DML Associates and a former Chief of the FBI Financial
    Crimes Program; and Ms. Heather Lowe, the legal counsel and
    director of Government affairs of Global Financial Integrity.
        Again, we appreciate all of you being with us today, and,
    Mr. Baer, you may proceed.

         STATEMENT OF GREG BAER, PRESIDENT, THE CLEARING HOUSE
                              ASSOCIATION

        Mr. Baer. Thank you. Chairman Crapo, Ranking Member Brown,
    and Members of the Committee, I appreciate the chance to
    testify before you today.
        Over the past year, the Clearing House has convened off-
    the-record symposia on the AML/CFT system and produced a
    comprehensive report. We included a wide range of stakeholders
    from banking, data science, diplomacy, and global development.
    We emphasized law enforcement input, which included former
    senior officials at Treasury's Office of Terrorism and
    Financial Intelligence, former FinCEN Directors, the former
    Chief of the AML Unit at the SDNY, and numerous former
    officials from Justice, DEA, IRS, Customs, and Scotland Yard.
    The consensus, reflected in our report, is that our current
    AML/CFT system is extraordinarily inefficient, outdated, and
    driven by perverse incentives.
        Collectively, U.S. financial firms act as an intelligence-
    gathering agency for law enforcement and national security,
    employing thousands of people and spending billions of dollars.
    That collective agency currently yields much extremely valuable
    intelligence, but a fraction of what a modernized, properly
    targeted regime could achieve.
        An effective approach to AML/CFT should be risk-based,
    devoting the greatest majority of resources to the most
    dangerous activity. Unfortunately, banks have been pushed away
    from risk-based approaches because their performance is graded
    not by law enforcement or national security officials but,
    rather, by bank examiners, who do not track how the
    intelligence is actually used. Instead, those auditors focus on
    what they know: policies, procedures, and quantifiable
    metrics--for example, the number of computer alerts generated.
        So, for example, if a bank were to start a financial
    intelligence unit focused on the opioid crisis, it would likely
    receive no examination credit for that activity. It would
    receive blame if a diversion of resources caused it to fail to
    file a SAR in another area.
        What gets measured gets done, and providing valuable
    intelligence to law enforcement or national security does not
    get measured. According to bank analysis, there is little to no
    governmental analysis. For the average SAR filing, there is a
    less than 10 percent chance that any law enforcement follow-up
    will occur. For certain categories of SARs--structuring,
    insider abuse, and here insider abuse includes teller crimes--
    the yield is close to 0 percent, and those SARs--insider abuse
    and structuring--now represent a majority of the SARs filed.
        Furthermore, banks know that the fastest way to get in
    regulatory trouble is failure to file a SAR that an examiner
    subsequently determined should have been filed. Therefore, they
    reportedly spend more time documenting decisions not to file
    SARs, papering the file, than they do following up on the SARs
    they do file. In other words, they focus on the noise, not on
    the signal.
        To file SARs, in practice, almost all banks hire one of a
    handful of vendors who construct rules for generating alerts--
    for example, three cash deposits between $5,000 and $10,000 in
    a 3-week period, or a wire transfer over $1,000 to a high-risk
    country, say Mexico. These crude rules generate numerous
    alerts, and bank investigators must then decide whether to
    clear the alert or file a SAR. And examiners will criticize
    thresholds that do not generate a large number of alerts. Of
    course, it is widely understood that sophisticated criminals
    know these rules, as the software is for sale and widely
    distributed, and its rules do not change much over time.
        Consider then the potential for revolutionary change that
    artificial intelligence and other concepts therefore present.
    AI does not search for previously identified typologies but,
    rather, mines data to detect anomalies. It gets progressively
    smarter, it would not be easily evaded, and it changes as
    criminal behavior changes.
        The current system is not modernizing, however, because
    there has been no indication from the regulatory agencies or
    others that dollars can be shifted from the existing, rules-
    based system to a better one--in other words, that firms will
    be rewarded, not punished, for innovation.
        Perverse incentives also explain a push for banks to
    eliminate clients in countries or industries that could end up
    creating political risk, so-called derisking. A recent report
    in The Economist notes, ``Derisking chokes off financial flows
    that parts of the global economy depend on. It undermines
    development goals such as boosting financial inclusion and
    strengthening fragile States. And it drives some transactions
    into informal channels, meaning that regulators become less
    able to spot suspicious deals. The blame for the damage that
    derisking causes lies mainly with policymakers and regulators,
    who overreacted to past money-laundering scandals.''
        The cause of derisking is clear: Regulators require banks
    to deem certain accounts ``high risk'' based on factors such as
    line of business or country of origin. The cost of maintaining
    that account thereby rises exponentially as the bank must
    conduct an independent investigation of each such client, and
    that does not even include the risk of fines in the event the
    client actually does something wrong. The safest alternative is
    always to derisk, that is, fire the client.
        Last, one important change to the current system that
    requires new legislation is ending the use of shell companies
    with anonymous ownership. The Clearing House strongly urges
    Congress to adopt such legislation promptly and is pleased to
    see bipartisan support for it.
        I hope this testimony has been helpful, and I look forward
    to your questions.
        Chairman Crapo. Thank you, Mr. Baer.
        Mr. Lormel.

     STATEMENT OF DENNIS M. LORMEL, PRESIDENT AND CHIEF EXECUTIVE
     OFFICER, DML ASSOCIATES, LLC, AND FORMER CHIEF, FBI FINANCIAL
                             CRIMES PROGRAM

        Mr. Lormel. Thank you, Chairman, and thank you guys for
    holding this hearing. I think this is really an important
    topic. And to your point in your opening statement, when you
    talked about saving lives, when I was in the FBI, we actually
    were able to help save lives based on Bank Secrecy Act
    information and investigations that we conducted.
        I have given you a statement for the record, and I am just
    going to highlight some points on that, and I will look forward
    to questions afterward and for the discussion. I certainly
    appreciated Greg's testimony. And as I said, I was in law
    enforcement, and I have been doing this for 45 years, and in
    law enforcement I was the direct beneficiary of suspicious
    activity reports in particular. And I agree that we have a lot
    of inefficiencies in the system, and they need to be improved,
    and this is a great starting point. And I believe that the
    Clearing House report is a good starting point for discussion.
        I also think that we need to have a more robust discussion
    on this, and I would encourage you to include law enforcement
    more actively in that dialogue, and particularly when we get
    into SARs, and I will close out my testimony on SARs when we
    get to that.
        I really applaud what you guys did in having the
    symposiums, and I was not involved in that at all. And one of
    the things that concerned me was the level of actual
    participation law enforcement was involved, and I know you
    mentioned some people that you had spoken to, and certainly
    that is very helpful. But I spoke, after you issued the report,
    to current executives in law enforcement, people that sat in
    the chairs I sat in, and in other chairs in other agencies, and
    they were not involved in the dialogue. And I think it is
    really important that going forward that those voices are
    heard, particularly if you get into the situation where you
    look at suspicious activity reports and you determine--or
    currency transaction reports, and you consider changing the
    reporting thresholds. I think particularly in today's world and
    environment, where we talk about, you know, the threat of
    homegrown violent extremists in particular, currency
    transaction reports will factor into those types of
    investigations. And I am sure the FBI can provide statistics on
    that type of thing.
        One of the things that I like to do is visualize the flow
    of funds, and as Mr. Baer pointed out, there are a lot of
    inefficiencies in the current system, and we really need to
    look at it and bring those up to date. But from the vantage
    point where I came from, the information that flows--so law
    enforcement is the back-end beneficiary of suspicious activity
    reports and other BSA reports. Financial institutions are
    really the front-end monitors when it comes to that type of
    information, and so they provide that information and it flows
    to law enforcement. And the basic flow, the basic system, and
    the information that comes to law enforcement on a regular
    basis is good information. The problem is that as you add
    filters on top of that--and the regulatory filters is what I am
    talking about--the more regulatory filters and the more
    convoluted the flow of information from banks to law
    enforcement, that is where we run into the inefficiencies and
    the system being flawed. And that, in my view, is where we need
    to focus our attention going forward in terms of improving the
    system.
        And then on the subject of SARs, as I said, I was the
    direct beneficiary of SARs in law enforcement, and one of the
    things that I would encourage you to look at, if you get into
    the SARs, is the law enforcement constituents. For instance, I
    datamined quite a bit at the program level at FBI headquarters.
    We had the ability to do datamining and a lot of broad
    analytical work that was very helpful. If you talk to people
    who work with SARs at the street agent level, at the levels of
    the SAR Review Teams--every U.S. Attorney's Office has a SAR
    Review Team. They still manually review SARs. So you are going
    to get two different perspectives on the use of SARs. From
    where I sat, more was better because we were able to use a lot
    more information and use it against other data sets. To the SAR
    Review Teams out in the streets, they have to physically look
    at every SAR, they are going to say less is better. So I think
    there is a balance there as to the quality of the SAR
    information.
        And then to the point, again, I was firsthand involved in
    and a firsthand beneficiary of some very good, innovative
    projects, and I cite one in my written testimony that JPMorgan
    Chase did back in 2009, and it came out in 2011, where they
    worked with Homeland Security, and they had targeted
    monitoring. It was to the same points that you were making
    about transaction monitoring, and this was targeted monitoring
    where they specifically set up certain rule sets. And,
    consequently, the hit rate in that type of proactive
    investigations, they have tremendous results. They are
    tremendously effective, they are very efficient, and we need to
    encourage more of that type of work. And I agree that there is
    not the incentive there for banks to conduct those types of
    investigations. And I also believe--and I do a lot of training
    with financial institutions, and I am a firm believer, and I
    look at things, and I try to assess the flows, information
    flows, and that is how I broke down the flow of SARs or BSA
    data to law enforcement from financial institutions. And I
    think that in that regard--and I will stop, sir, on this. I am
    very passionate about this topic. And I believe that the more
    we can do to encourage law enforcement and banks to work
    together as partners and to work together in terms of being
    proactive, and particularly when we were in a reactive type of
    environment, the better the outcome.
        Chairman Crapo. Thank you, Mr. Lormel.
        Ms. Lowe.

      STATEMENT OF HEATHER A. LOWE, LEGAL COUNSEL AND DIRECTOR OF
             GOVERNMENT AFFAIRS, GLOBAL FINANCIAL INTEGRITY

        Ms. Lowe. Thank you, Chairman Crapo, Ranking Member Brown,
    and Members of the Committee, for the opportunity to testify
    before you today on this very important topic. I hope that my
    contributions to today's hearing will help you take measured
    and informed decisions that are in the public's interest with
    respect to the U.S.'s anti-money laundering regime.
        So my written testimony, of course, is much more lengthy
    and more detailed, and I hope that you have a chance to read
    through that. There are additional points in that testimony
    that I will not be making verbally today.
        So some of the key points that I did make in my testimony
    are, first, that money laundering and the technology that can
    help us combat it are both evolving. And in light of this, it
    is appropriate to consider whether changes to our regulatory
    structure should be made.
        Equally, however, it is critical that Congress balance and
    carefully weigh the potential benefits against the potential
    negative ramifications before making decisions in this area.
        Number two, as you have seen, money-laundering enforcement
    tends to be through identification of regulatory infractions as
    opposed to criminal money-laundering cases. The burden of proof
    is lower. It is far less costly for the Government to pursue
    regulatory infractions than pursuing criminal money-laundering
    charges, and yet it still has a very dissuasive effect. Despite
    this, the hallmarks of serious criminal money laundering are
    really there in those cases, in those regulatory cases. As a
    result, decreasing the ability to enforce using the regulatory
    approach may have serious, negative repercussions on compliance
    and, ultimately, allow a lot of criminal access to the U.S.
    banking system.
        Number three, it is critical that information about the
    natural person(s) who own and control companies--otherwise
    known as ``the beneficial owners''--is finally collected either
    by the States or by the Federal Government and that it be made
    available to law enforcement and to banks at the very least.
    Companies with hidden ownership are the number one problem in
    the anti-money laundering world, and the U.S. cannot continue
    to allow our failure to act to put the U.S. financial system
    and the global financial system at risk.
        Number four, I strongly oppose one of the Clearing House's
    proposals, and that is transferring responsibility for setting
    AML priorities for individual banks from those banks to FinCEN.
    Banks are best placed to understand their own business, their
    own systems, the risks that their own client base presents, and
    what is inherent therein, and to create the systems that work
    best in their own business models to combat that money-
    laundering risk. FinCEN and other regulators should review
    those assessments, but they cannot be responsible for carrying
    them out. They do not have the information they need to do so.
        The Clearing House recommends greater information sharing
    among banks and with Governments in a number of ways, and we do
    really support that. It is a really significant impediment to
    AML enforcement around the world that this information sharing
    is not happening. However, it really does need to be done with
    some appropriate safeguards, especially where it may result in
    somebody being denied banking services. Say a bank in Hong Kong
    denies services for whatever reason, sends that information to
    the U.S., and U.S. banks deny services, that person may not be
    able to get a bank account anywhere, and there may be a good
    reason for that, which is fine; but they also need an
    opportunity to disprove whatever information has been collected
    on them and give them access if they do have legitimate
    business.
        Number six, transferring raw banking data from banks to
    FinCEN to analyze, with the appropriate privacy safeguards, is
    not actually a bad idea either. However, it really is essential
    that we do not absolve banks of the responsibility to carry out
    their own analysis as well, which they have the ability to
    review within the context of the additional client information
    that they are holding and because they are the gatekeepers to
    the financial system. The Federal Government cannot do that
    alone.
        Number seven, some types of entities and persons should be
    required to have AML programs in place that currently do not,
    such as those involved in real estate, lawyers, and others. The
    banking sector cannot and should not carry the responsibility
    alone, especially where these persons act as a proxy to open
    the door to the financial system for criminals and their money.
        And, finally, I just wanted to end with an overall concept,
    that money-laundering and sanctions violation cases over the
    past few years really relate to willful, knowing, and very
    egregious violations of U.S. laws and regulations that have
    resulted in U.S. and foreign banks granting access to the
    financial system for hundreds of millions of dollars in funds
    supporting genocide and funds supporting major, violent South
    American drug cartels, and many other violations. These fines
    that have resulted from these cases have been seen by the
    banking industry as heavy, so banks have begun to take AML
    regulations that have been in place for many years much more
    seriously. I would, therefore, remind Members of Congress that
    the regulatory burden here has not actually really been
    increasing. The threat of being found out is what has actually
    been increasing.
        Thank you very much.
        Chairman Crapo. Thank you very much, Ms. Lowe.
        Before I go to my questions, I would like to ask unanimous
    consent to enter into the record two letters--or a letter and a
    statement from industry: one from the Credit Union National
    Association and another from the Independent Community Bankers
    of America. Without objection, so ordered.
        My first question, Mr. Baer, is for you. There has been
    considerable discussion of the need for improved information
    sharing between financial institutions and regulators and among
    the financial institutions themselves. How is information
    sharing accomplished under the current regime?
        Mr. Baer. Sure. Thank you, Mr. Chairman. Right now, under
    Section 314(b) of the USA PATRIOT Act, information sharing is
    allowed among firms with regard to two types of offenses: one
    is terrorist activity, and the other is anti-money laundering.
    The definition of anti-money laundering can be a little complex
    because that can include some of the predicate offenses. But
    there does seem to be room, and not a lot of room, to draw a
    principal distinction between anti-money laundering and a lot
    of other Federal crimes to expand the categories of offense for
    which, you know, information sharing is permitted.
        It has multiple benefits. It certainly allows banks to
    better identify who the true criminals are. It also, in an
    underrated way, allows banks to identify people who are not
    criminals. So one bank may be looking at only one piece of the
    puzzle and see something that looks suspicious and speak to
    another bank and realize, no, in the broader context, that is
    actually OK.
        So it makes the whole system more efficient both in terms
    of finding bad guys and not finding good guys.
        Chairman Crapo. So I was going to ask how we could improve
    that, but I think you just described it, right? Yes, Ms. Lowe,
    would you like to comment on that?
        Ms. Lowe. Sure. I would like just to add some little more
    of a context to this.
        Chairman Crapo. Turn your mic on.
        Ms. Lowe. Oh, sorry. It has a green light.
        Just to add a little international context and a little
    historical context to this particular area, back in 2012, the
    Financial Action Task Force, which is the international anti-
    money laundering standard-setting body, was going to update its
    recommendations, and one of the proposals that they made was
    that banks be required to share information across borders in
    this way. And, basically, everyone agreed that that was a
    really good idea and really important back in 2012, but
    realized it could not actually be included in the
    recommendations because, in particular, the EU's privacy laws
    would actually prevent that information sharing from happening.
    Since 2012, those privacy rules in the EU have actually only
    strengthened.
        So in looking in this area, if you are looking to make
    revisions here, something you also need to be looking at are
    the EU privacy laws as well as the U.S. privacy laws to see,
    you know, does anything need to change in there, and we may
    need to be doing international--work across the ocean to really
    move that forward, because we cannot really do it alone. We can
    allow it within the U.S., but abroad is going to be much more
    difficult.
        Chairman Crapo. Well, thank you, Ms. Lowe. That perspective
    is helpful.
        Mr. Lormel, you mentioned yourself the Clearing House
    report that was put out and indicated that you feel we need
    some more law enforcement engagement on that. With regard to
    the report itself, it characterizes the current AML/CFT regime
    as outdated and in need of redesign to increase the efficiency
    and effectiveness of it. Are there parts of that report that
    you agree with? And if so, which are the most critical parts of
    it that you see?
        Mr. Lormel. Well, I do agree with parts of the report for
    sure, and I believe that the comments about the system being
    antiquated is--they are good comments, and I think that we
    really need to look at the regulatory framework, and I think
    where they pointed out in the report that the regulators--they
    have a different perspective, and that is why when I wrote my
    statement, I talked on the importance of perspectives and
    understanding perspective. And, quite frankly, if you look at
    law enforcement and financial institutions and you put them in
    a triangle, where you have got the financial institutions here,
    law enforcement and regulators, you will have hard lines
    between the regulators and law enforcement, and there is a
    broken line between law enforcement and the regulators. And so
    I think a lot of the dialogue belongs--should belong there and
    bringing it--but what we need to do is we need to encourage--
    and that is the other thing I agreed with in the statement. I
    am a firm believer in innovation. I think our system is very--
    it is inherently reactive, and the more we can do to use
    financial intelligence information from a proactive
    perspective, the better. So where they encourage innovative and
    incentivizing innovation, I think that is important.
        In my statement I wrote about a bank--and I am not really
    at liberty to talk about it other than the fact that it is
    similar to what I described with the JPMorgan Chase thing. And
    if you talk to those bankers and they were going to be
    forthright about it, what they would tell you is that there is
    no incentive and that the regulators really do not encourage
    them to do that. And I think that is where I agree and where I
    think the building block going forward is how do we promote
    innovation.
        Chairman Crapo. Thank you very much. My time has expired.
    Senator Brown.
        Senator Brown. Thanks, Mr. Chairman. Before I start, I
    would like to ask unanimous consent to include a letter and
    other documents from the FACT Coalition into the record and
    that the record remain open for 5 days for any other documents
    that Senators might have.
        Chairman Crapo. Without objection.
        Senator Brown. Mr. Lormel, thank you for your service at
    the FBI, and thank you for serving as Chief of the Financial
    Crimes Program. Let me start with you. Give us a sense of how
    you think law enforcement can better respond to the traditional
    criticism from banks that it too seldom shares targeted
    information that is useful to banks in assessing customer
    risks.
        Mr. Lormel. Yes, sir. I think that law enforcement, really
    we need to put a feedback mechanism or we need to do more to
    encourage feedback in working with financial institutions, and
    I believe that in a lot of instances--and I certainly, when I
    was in law enforcement, was guilty of this to a degree. Again,
    it goes to a matter of perspective and almost wearing blinders
    that I am trying to develop my law enforcement case and in
    doing that I did not look or I did not consider enough the
    position of the banks and trying to determine how I could
    better share information with banks.
        One of the things I put in my statement, for instance, on
    the subject of terrorist finance is the fact that--and I am
    sorry, sir, I may be drifting from your question. But I think
    it is important that we put mechanisms in place to provide
    security clearances to people in banks where we could share
    classified information and other intelligence information back
    that they can run into their systems and use for transaction
    monitoring. If you think about it, the financial institutions
    are the repository. They have got the financial intelligence,
    and how do we provide them with more information, and maybe it
    is the----
        Senator Brown. Is there any evidence--sorry to interrupt.
    Is there any evidence that that is happening or that there is a
    mechanism, an effort to make that happen other than your saying
    you would like that to happen?
        Mr. Lormel. Which, the security clearances?
        Senator Brown. Yeah. Well, the security clearances and then
    the sharing back of information.
        Mr. Lormel. Yes, there are initiatives. There are one-off
    initiatives at different agencies. For instance, I started the
    Terrorist Financing Operations Section at the FBI. TFOS
    continues to have working groups with a number of the financial
    institutions. They have major financial institutions they deal
    with. And to the extent they can permissible, they share
    information. We were involved with the SWIFT project, for
    instance, and the sharing of information among agencies and
    sanitizing some of that information and being able to share
    that back to the extent you can with the banks. I do not think
    we do it as consistently as we can.
        Senator Brown. Thank you.
        Ms. Lowe, you have done a lot of work for the Global
    Financial Integrity on transparency internationally and in the
    U.S. with FATF and otherwise including beneficial ownership
    legislation. Describe for the Committee how you think we should
    be thinking about new beneficial ownership requirements. For
    example, what are the key elements in the definition that you
    think are critical?
        Ms. Lowe. Sure. So key elements of the definition--and the
    definition is critical to any legislation. I think we have a
    problem actually with the current customer due diligence rule
    that was adopted for banks where the definition is actually not
    sufficient. It does not meet international requirements. The
    FATF and the IMF have both said the same, so important to note
    that that is something we should probably look at. But for
    beneficial ownership, you want to know the direct or indirect
    persons who own or control a company or who have control by
    other means. And there is a recent Kazakh case which involved
    control by other means. It is a very difficult thing to
    determine, but you need to be asking the questions to figure
    out where it exists. So those are really important elements.
        I think that the U.S. Treasury has been pushing the idea
    that one should be able to simply list a senior manager of a
    company as the beneficial owner. That is not a beneficial owner
    by any international definition or anybody's idea of who is a
    beneficial owner of a company. It is the person at the top of
    the chain or people at the top of the chain who own or control
    the company.
        The other thing that I think the U.S. Treasury has been
    pushing is the concept that if a company does not have anybody
    who owns more than 25 percent of that company directly or
    indirectly at the top, then there is nobody with enough
    beneficial ownership to actually be listed. So, therefore, if
    you have or create five people to own 20 percent of a business,
    you would get away with not listing anybody as your beneficial
    owner, which is really not acceptable. It is incredibly easy to
    get around.
        I would note that the SEC accepts a 5-percent threshold
    because they do require beneficial ownership of information for
    SEC-regulated entities. And, actually, in the FATCA
    legislation, Congress put that threshold at 10 percent.
    Treasury, when it actually implemented, implemented at 25
    percent. So I would note that difference as well.
        Senator Brown. Why would that be? Why would Treasury
    implement it that way?
        Ms. Lowe. You would have to ask Treasury. I think they
    think it is easier to comply with. I think it----
        Senator Brown. Which is kind of not the point.
        Ms. Lowe. Right, which is kind of not the point to my mind.
    But I would suggest you ask Treasury that question.
        Senator Brown. Thank you.
        Chairman Crapo. Senator Rounds.
        Senator Rounds. Thank you, Mr. Chairman.
        I am just curious. The United Kingdom recently established
    a body known as the ``Joint Money Laundering and Intelligence
    Task Force'' that brings together financial institutions, law
    enforcement, and trade associations to discuss AML risks and
    how Government and private industry can work better together.
    Can you discuss the efficacy of the U.K.'s task force and
    whether or not there is anything that we can learn from the
    British system? It kind of comes back down to either a
    coordinated effort where you eliminate some of the dotted lines
    and so forth. But I am just curious if any of you have had any
    contact with or if you are familiar with that system and how
    that compares with ours. Yes, sir?
        Mr. Baer. Yes, Senator, actually we have met with them a
    couple of times, and, actually, they attended our symposia. We
    think it is a very good model. It is not an entire anti-money
    laundering system, but it is the sort of thing you would take
    for granted that, of course, you would have, you know, law
    enforcement, intelligence, senior bank folks sit down on a
    regular basis and basically work cases together. It is the type
    of informal, now through JMLIT formalized information sharing
    that we very much support, and it is done in a very thoughtful
    way there.
        Now, that is not a replacement for the broader AML/CFT
    regime or OFAC or any of the other things. So I would not
    describe it as a substitute for the current regime, but it is
    certainly a very useful component potentially of a U.S. regime,
    and we would very much support a similar endeavor here.
        Mr. Lormel. I certainly agree with that, and some of the
    training I conduct, I have trained with the former head of
    terrorist financing for Scotland Yard, and he was an original
    member of JMLIT, and he really emphasizes the importance of
    that sharing, and to bring the banks and the intelligence
    community and law enforcement together under that Government
    umbrella is a phenomenal thing. And I would really hope we can
    build on that model and try to replicate it to the extent we
    can.
        Ms. Lowe. And just to add on there, the original country
    that actually did this was Australia under what they called
    ``Project Wickenby''. So that is also something to take a look
    at.
        Something that the U.K. is doing very well is this concept
    of the FinTech Sandbox, so within this area. They are creating
    a system--they have created a system where a financial
    institution can come to them and say, ``We would like to try
    this new technology. We know it is not something that is OK
    under the regulations at present. Can you take a look at it?
    Let us know what you think, let us know if we can try it out.
    And then we will give you feedback on how it is going and you
    can review.'' And then over time, the Government can then
    approve that technology for the larger industry.
        So that I think is a really good process that they have put
    in place that we should be looking at as a model at this point.
        Senator Rounds. Thank you.
        I am just curious, with regard to SARs and the reporting
    requirements right now, there is one process in which the
    regulatory processes are set up so that you define, and clearly
    everybody knows what they are with regard to the reporting
    requirements for the different monetary transactions that
    occur. Bad guys know what they are as well, and so you have,
    first of all, a system set in place today that everybody knows
    what the rules are, and the real challenge for those that wish
    to move resources around is how do we appropriately get around
    those SARs or the reporting requirements.
        Can you talk to me a little bit about our focus on the
    compliance side of making sure that the financial institutions
    are appropriately reporting the transactions that are occurring
    that are suspicious in nature versus our ability using existing
    resources or the need for new resources to go after the unique
    ways in which the bad guys can get around those reporting
    requirements?
        Mr. Baer. Sure. It is a great question, Senator. It really
    gets to sort of the heart of the matter here.
        Right now banks are, as I noted, using sort of a rules-
    based system developed by a set of vendors who are common to
    all, and those rules are rather crude. They overgenerate
    alerts. They require huge investigative resources to basically
    clear away the chaff and whichever is left, the wheat. And that
    is a fantastically sort of complex and time-consuming and not
    terribly productive endeavor.
        It is also an endeavor that they have to undertake with
    regard to offenses that no Federal prosecutor would ever
    prosecute. So our estimate is that approximately 40 percent of
    SARs filed are structuring, that is, multiple cash deposits
    that add up to 10 percent--$10,000, but could just as easily in
    most cases are just simply a small business that does a lot of
    cash. But that--and the yield on those SARs is close to 0
    percent, and yet they are 40 percent of the SARs filed, maybe
    more.
        The same thing with insider abuse where you fire a call
    center employee for misstating his or her time sheets or fire a
    teller because the till is short. Those are not crimes that are
    going to be prosecuted, but that is where the SAR resources are
    going. Right now the largest focus of the AML system is filing
    sales practices SARs on low-level employees, unfortunately.
        So it gets to what I think Dennis was talking about, which
    is, yeah, we can--and I think what the Ranking Member was
    talking about, we could say, law enforcement could say let us
    prioritize opioids, let us prioritize human trafficking, let us
    prioritize other things. That is what any rational intelligence
    community would do, any rational law enforcement or national
    security organization would do. And you can tell the banks
    that. But the banks are in no way absolved by the bank
    examiners of having to file those SARs on teller abuse. So they
    cannot shift the resources out of that to the more serious
    crimes to more innovative and thoughtful artificial
    intelligence and other means of catching bad guys. They are
    sort of stuck in the mud in an old rules-based system that does
    not work very well.
        Senator Rounds. Thank you.
        Chairman Crapo. Senator Reed.
        Mr. Lormel. If I can just add one comment, sir, just on
    that.
        Chairman Crapo. Briefly.
        Mr. Lormel. I believe, though, that--I mean, and I agree
    with that statement. But at the same token, we still see a good
    number of SARs that come through that are very meaningful and
    they continue to come through. So there is a fine balance here
    that we really have to try to achieve.
        Senator Rounds. Thank you, Mr. Chairman.
        Chairman Crapo. Senator Reed.
        Senator Reed. Well, thank you very much, Mr. Chairman. Let
    me thank all the witnesses for their excellent testimony. I
    have reviewed it, and I particularly thank you, Mr. Lormel, for
    your service in the FBI. Thank you, sir.
        One of the issues that has been raised in your testimony
    and in your written statements is beneficial ownership and
    shell companies, and one of the disturbing things, we are
    getting the reputation around the world as a place to go if you
    want to hide money, and we used to think, at least when I was
    younger, that that was un-American, that, you know, it was
    these little exotic lands overseas, et cetera.
        So beginning with Mr. Baer, given the context that most of
    this is a function of State law because unless you are publicly
    traded company, the SEC does not have a lot to do--few
    exceptions, but not a lot to do. So how do we get our arms
    around this when there is a new industry for attracting
    questionable money because of beneficial ownership rules and
    limited or shell companies?
        Mr. Baer. Right. It just really gets down to what is the
    need to form a company with anonymous ownership in the United
    States, and the United States, as I think some have noted, is a
    magnet for this because we and I think Kenya are the two worst
    in the world on this.
        There is certainly a legitimate desire, I believe, that you
    may not want the whole world to know who owns your company.
    Everybody uses the example of, you know, when the Disney
    Corporation was buying up half of Orlando, they did not want to
    have to pay exorbitant rates for the last piece of land. And
    there may be valid privacy reasons where you do not want people
    to know who owns your company. But we cannot think of any valid
    reason you would not want law enforcement to know who owns your
    company, or if there is a bank that, pursuant to Federal law,
    is required to know who owns your company, well, they should
    get to peek behind and see who that is as well.
        So, you know, I think as Heather noted, there are difficult
    issues around how to define beneficial ownership. We actually
    support the FinCEN final customer due diligence rule on that.
    But there are certainly other ways to look at that. But I think
    the general notion that you should not be able to have a
    company with anonymous ownership from law enforcement and banks
    who are required to know who owns you is a pretty simple
    concept, and I think that is why it has gotten good bipartisan
    support.
        Senator Reed. Just a follow-up, and then I will go to Mr.
    Lormel. One, you could either do it through changes of State
    law requiring the acknowledgment of real ownership, or you
    could do it through the banking laws in terms of banking
    relationships, even deposits that the entity would have to
    disclose who was, so we have a Federal avenue if we have to
    deal with this.
        Mr. Baer. Yes, Senator, I think a couple of alternatives
    have been proposed. One is just to have the States do it when
    you file your articles of incorporation, you file your
    ownership.
        Senator Reed. Right.
        Mr. Baer. Some have suggested that--and I do not know if
    that is right or not--that might be a burden on the States or
    they may choose not to do that, so the alternative has been----
        Senator Reed. Well, I think there are about 45 States at
    least that require that.
        Mr. Baer. Yes. So for those, I think at least one of the
    bills I have seen has the sort of fail-safe that if the State
    does not want to do it, FinCEN can gather that information and
    hold it the way it holds a lot of confidential information
    currently. I think others have suggested the IRS. I think
    FinCEN is probably the right place if the State does not want
    to do it.
        Senator Reed. I only have about 2 minutes, but, Mr. Lormel,
    your comments? You are a law enforcement officer.
        Mr. Lormel. Well, certainly having been in law enforcement,
    I dealt with the challenge of trying to identify beneficial
    ownership. That was always a challenge, and it was always
    problematic. And in today's world, when we need to get things
    more urgently, that is problematic. I look at this and I look
    at the good-case scenario in a sense, and I agree with Greg
    that FinCEN may be the better alternative. I am a believer
    going back that the information should be collected at the
    States at the point of incorporation. To me, that makes the
    most sense. And trying to make that uniform I am sure would be
    a bit of a challenge.
        Alternatively, FinCEN would be, I think, a good
    alternative. The IRS is not a good alternative in the sense
    that that information for me as an FBI agent, when I was an FBI
    agent, I would have to get a court order, or I would not have
    access to that information. So it is not relevant then for my
    investigative purposes. So the FinCEN alternative would be a
    decent alternative.
        Senator Reed. Thank you.
        Ma'am, your final comments?
        Ms. Lowe. Sure. You know, I am happy with States collecting
    it. I am happy with FinCEN collecting it. I would note, you
    know, one of the things people raise is the privacy issue.
    First of all, on the Disney example, I would point out that you
    have two parties in that; you have Disney and you have a
    farmer. And that money--I am sorry, that land is worth whatever
    they can get for it, right? You have two parties in a
    transaction. One party should not have more information than
    the other party has. That is not good economics. So there is
    that.
        I would say that we are talking about making information on
    beneficial ownership available to law enforcement and to the
    banks, which is fine, and I think it is where we need to go
    next. But I would note that the entire European Union, 28
    countries have now decided to make beneficial ownership
    information on companies public information, and that is
    despite their very, very strong, you know, individual privacy
    laws that are in place. Other countries around the world are
    doing the same. Afghanistan is working to make public
    registration of beneficial ownership information. Ghana is
    doing that. Nigeria is doing that. And we are just grappling
    with can we give it to FinCEN. So a little context there.
        Senator Reed. Thank you very much.
        Thank you, Mr. Chairman.
        Chairman Crapo. Thank you.
        Senator Tillis.
        Senator Tillis. Thank you, Mr. Chairman. Thank you all for
    being here.
        Mr. Baer, in your written testimony there was a footnote
    that I found very striking in terms of the regulatory burden
    and whether or not we are putting our resources to their best
    use. It is on page 6. It says, ``The over 800 employees in
    Global Financial Crimes Compliance at Bank of America is
    greater than the combined authorized full-time employees in
    Treasury's Office of Terrorism and Financial Intelligence and
    the Financial Crimes Enforcement Network.'' And that does not
    include other bank employees in anti-money laundering, economic
    sanctions compliance, business operations, and technology.
        It seems like if you see that with a large bank of the
    scale of Bank of America, which happens to be down in my neck
    of the woods, I wonder what the small banks and medium banks
    are doing in terms of the regulatory burden on them. Are we
    spending that money for its best purposes? Are we spending that
    money on innovative concepts that could be worked back into the
    financial--to a broader benefit for the financial services
    industry? So I know that a part of what I think we have to do
    is go back and look at the practices that seem like they add
    cost and not value, either as they are currently implemented
    or--can you give me some sense, if you were to go through and
    just do it quick, when we come into committees like this, we
    tend to have a ``Solve World Hunger'' sort of scope to our
    discussion. And if we were just going to cook a good meal and
    make some progress, what sorts of quick hits, immediate obvious
    things that there seems to be consensus on but no action in
    terms of congressional action? And I would open that up to
    anybody, starting with Mr. Baer.
        Mr. Baer. Sure. Thank you, Senator. And I would just say we
    highlight those numbers--I mean, not to complain about the cost
    but just to emphasize how important it is that those resources
    are being misallocated.
        Senator Tillis. Well, I think it is very important for that
    purpose.
        Mr. Baer. Right, because, again, you are talking about a
    very large intelligence community that has been created under
    the PATRIOT Act and the BSA, and so it actually really matters
    whether they are well led and they are incentivized to do the
    right things, and the stakes are very high. So it is not, ``Oh,
    we do not want to spend the money anymore.'' It is, ``We are
    spending it on the wrong things.''
        And I should note, you know, I testified last year with a
    community banker who had, I think it was, a $100 million bank
    with three branches. He had seven AML compliance officers and
    four lending officers. AML was 15 percent of the budget of his
    bank. So this is not just a problem for large banks. It is a
    very large problem for small banks. He also described how he
    was pressured to dramatically increase the number of high-risk
    customers they designated and on which they had to do more and
    more investigations. I actually wrote down the number. His
    system, they generate 7,100 alerts a year and file 15 SARs. And
    they do not even know if any of those SARs are of any use.
        So I think I am sort of dodging your question, which is
    what is the easy----
        Senator Tillis. But how do we use some of those metrics,
    some of those outcomes to be instructive to what we should
    first start looking at to improve the system? Look, I am not
    against money laundering--I think it is a bad thing. What I
    want to do is make sure as much lead can be put on the target
    as possible, and right now it does not--it seems like we are
    shooting a lot, but not necessarily hitting the target near as
    much as we could, and it is costing us a lot of money.
        So, again, I want to move--we are going to submit several
    questions for the record. This is an area that is very
    important to me and of personal interest, but if we are going
    to do the best that we can, let us say harden our domestic
    banking system, we obviously have a lot of international
    depositors, and we do a good job here, and we do not have
    strong global cooperation, we do not work through some of the
    privacy differences between the EU, what have we done except
    move the snakes somewhere--I mean, what we are trying to do
    here is not limit our portfolio of banking clients. We are
    trying to identify bad actors and take their money away. And so
    what sort of global initiatives are really leading us down that
    path to say, OK, everything is great here, but the money is
    still flowing through other international banking entities? Ms.
    Lowe, I would be happy to have you answer that one and give me
    the secret sauce.
        Ms. Lowe. Well, organizations like mine are working
    internationally on these issues, so, you know----
        Senator Tillis. Yeah, but what progress are we making?
        Ms. Lowe. You know, I think actually we are making quite a
    lot of progress. In a lot of the world, the FATF
    recommendations, the sort of framework, if you will, of what we
    consider to be an anti-money laundering regime, has only
    recently in the past 2 or 3 years been put in place in many,
    many different countries. And so, you know, as it goes, you put
    laws in place, and then you give some time for the industry to
    get used to them, to understand how to implement them, et
    cetera, and then you start enforcing, et cetera. So in many
    parts of the world, this is still very nascent, but the regime
    and the framework is in place.
        The U.S. FinCEN is our financial intelligence unit, or FIU,
    and we are part of what is called the ``Egmont Group'', which
    is the network of financial intelligence units around the world
    that have methods and ways of sharing information among
    financial intelligence units or between financial intelligence
    units. And right now there are over 135 Egmont FIUs, which
    tells you that we are making progress.
        I spent a lot of time in Africa last year actually meeting
    with heads of FIUs, and, you know, it is actually inspiring to
    have those meetings because these are people that really want
    to make a difference and they are trying.
        Senator Tillis. I am going to submit several questions for
    the record.
        Ms. Lowe. Sure.
        Senator Tillis. But I would also like you to come back and
    just think about as I would do when I go in any organization,
    what are the things that we should clearly be making consensus
    on--or making progress on? Because there is consensus, you just
    need action.
        Ms. Lowe. There is no question on the beneficial ownership.
    Absolutely no question there.
        Senator Tillis. So we will look forward to your feedback so
    that we can work with the Chair and the Committee.
        Ms. Lowe. Sure. No problem.
        Senator Tillis. Thank you.
        Chairman Crapo. Senator Cortez Masto.
        Senator Cortez Masto. Thank you. Thank you all for this
    discussion. Mr. Chairman and Ranking Member, I appreciate the
    conversation. And let me follow up with what my colleague
    Senator Tillis has just been talking about. I agree. I think
    there has to be some balance absolutely on this. I hear from
    Nevada, from the gaming industry, the same thing that I am
    hearing from the banking industry, some of the concerns. They
    are absolutely open to looking at how we address the security
    necessary to attack money laundering, but at the same time
    streamlining some of the forms, making sure they want to be
    cooperative with Government, and so I am really curious about
    how we find this balance now.
        The first question I have is you have been talking about--
    and let me just focus on the law enforcement piece of this--
    this risk-based approach. And I am curious, Ms. Lowe, is this
    something that you would support and how would you identify
    what this looks like?
        Ms. Lowe. The risk-based approach is actually fundamental
    to the entire international anti-money laundering regime. It is
    not a question for me of how does this look. It actually
    exists. It is a framework, and it has a look, right? A casino,
    for example, or a bank looks at what are its financial products
    or what is its business line. Who are its clientele, and what
    risks do they pose? What countries am I bringing money to and
    from? And what risks does that pose based on whether or not
    those are high or low risk for money laundering, et cetera? And
    they create a profile. A casino will do this, a bank will do
    this. And then they will craft their anti-money laundering
    regime to reflect what they consider to be their highest risks,
    OK? So that is the basics and the basis of the risk-based
    analysis.
        I think a lot of the concern that you are hearing is that
    when examiners are going in, they are not really open to that
    risk base that the financial institution has put in place. They
    are looking at checking their boxes that are on their forms.
        Senator Cortez Masto. When you say the examiners, that is
    the Federal Government, the regulatory oversight.
        Ms. Lowe. Yes.
        Senator Cortez Masto. They are coming, and they are not
    recognizing----
        Ms. Lowe. Right. I understand that that is the concern, and
    I think Greg can probably tell you a little bit more about
    that. But as far as the risk-based approach goes, I absolutely
    100 percent support that. I think it is incredibly important,
    actually, in order to actually address the problem.
        Senator Cortez Masto. And that is something the industry is
    actually doing now, Mr. Baer.
        Ms. Lowe. Yes.
        Senator Cortez Masto. Is that right?
        Mr. Lormel. If I can add a comment to that.
        Senator Cortez Masto. Please.
        Mr. Lormel. Yes, it is one of the fundamentals in an AML
    program to have a risk-based approach, and fundamentally and
    the way conceptually it is supposed to work then is you
    identify that risk and to what Greg has been complaining about
    or pointing out is the inefficiency. And what has happened is
    that the regulators now have put the banks in a position where
    they are not necessarily going after that risk or putting
    metrics in place or procedures in place to deal with that high
    risk, but they are more into the check-box mentality. And I
    have done a lot of training, and I was on the quarter point and
    monitor team for Western Union, and one of the problems they
    had--and they used that as an example--was their investigative
    process was such that it was really a check-the-box mentality,
    and we had to break them from that and say, you know, you need
    to go out and you have got to have an investigative mind-set.
    And it is a similar thing when you come over to the banks, and
    I think that is where I talked earlier about law enforcement
    being that beneficiary and the banks being the monitor, is the
    process from getting information from the bank to law
    enforcement has become so convoluted, and it gets detoured
    because of the regulatory concern or the perceived concerns.
        Senator Cortez Masto. And so can you address your targeted
    monitoring? How do you--is that the same thing or is it
    something different?
        Mr. Lormel. OK. Well, it is similar in the sense that all
    financial institutions conduct transaction monitoring, and they
    will have vendors or whatever are involved in that. And they
    have a baseline monitoring system, and they identify and they
    alert to certain rules, because you establish the rules and you
    alert them, and that is where one of the problems we have is
    there are too many false positives in the system. So if you are
    going to do targeted monitoring--and I will use the human
    smuggling or the human trafficking. We understand these are the
    scenarios that we know that smugglers are going to follow, and
    this is where, to the question earlier from Mr. Reed about how
    we can help, is to provide the financial institutions, the
    compliance people, with those scenarios, and for them then to
    build into their systems targeted monitoring where you are
    specifically on top of your regular transaction monitoring, you
    have a targeted monitoring for a specific crime problem, you
    know, and I would like to see us carry that over to terrorist
    financing if we can--I think the area of human smuggling, you
    have got more defined and identifiable patterns of activity so
    that it is more workable there.
        Senator Cortez Masto. Right. And I know my time is up, and
    thank you, Mr. Chair, but this is something, I agree, the
    technology gives us the ability now to be targeted to also
    focus on the risk-based, and we do need law enforcement at the
    table when we are having this conversation. So I appreciate the
    dialogue today. Thank you all.
        Chairman Crapo. Thank you.
        Senator Warren.
        Senator Warren. Thank you, Mr. Chairman, and thank you all
    for being here today.
        Money laundering is a massive problem. The United Nations
    estimates that between 2 and 5 percent of global GDP--that is
    about $800 billion to $2 trillion--is laundered through the
    international banking system every single year. That money
    funds terrorists. It funds human traffickers. It funds crime
    syndicates. So everything we can do to try to crack down on
    that is good, and that is what we should be doing.
        But it seems to me we need to rethink a lot of our money-
    laundering laws, some of which, as you noted, were written back
    in the 1970s and are badly out of date, because that makes it
    hard for law enforcement that is trying to stop money
    laundering and bad for financial institutions that are trying
    to comply with these laws.
        So my colleagues have probed some areas, but I want to ask
    about some other areas where we might be able to update our
    rules and help both law enforcement and financial institutions.
    So let me start with reporting requirements.
        Mr. Baer, I have heard from a lot of community banks and
    credit unions that anti-money laundering reporting requirements
    are a big part of their overall compliance costs, so let us
    probe that a bit. They have pointed out that the threshold that
    triggers a currency transaction report to the Treasury
    Department has been at $10,000 since 1972. So let me ask, do
    you support raising that number?
        Mr. Baer. Thank you, Senator. I think here--I mean,
    obviously, our organization is slightly larger, somewhat larger
    banks. I think for them that number is not as big a burden in
    the sense that they have the capability to file whatever the
    number is. Those systems are built, and it is at least a clear
    rule. You know the number, right?
        Senator Warren. Right.
        Mr. Baer. The larger problem for them has been questions
    like: How do you decide whether it is $10,000? If you own with
    someone else a company and you make a cash deposit, the company
    makes a cash deposit, and the other owner makes a cash deposit,
    do you add all those up? So those are the tougher issues. But
    certainly for community banks, I agree with you it is a large
    burden.
        Senator Warren. OK, that it is large burden. All right. And
    we should at least talk about where the number should
    appropriately be set. But community banks also, when they come
    in and talk, and other small financial institutions, often
    mention the costs associated with filing the suspicious
    activity reports with the Treasury Department. You know, the
    banks are filing more and more of these reports every year. I
    note that there was a 50-percent increase in filings just from
    2012 to 2017 over this 5-year period. At the same time, the
    banks are submitting this information through a reporting
    process that, as I understand it, makes it actually harder for
    law enforcement to use.
        So, Mr. Baer, let me ask, the Clearing House has proposed
    letting banks directly share data with the Treasury Department
    with proper guardrails to protect customers' privacy. This
    sounds like it would make it easier for the banks, but can you
    say a word about how it would impact Treasury's ability to
    catch criminals that are laundering money?
        Mr. Baer. Yes, Senator. I think it would have both those
    effects. A lot of times what law enforcement really wants is
    just the underlying data. They do not need a carefully
    calibrated paragraph written by a bank compliance officer about
    that information. So with regard to certain types of
    activities, it would certainly be much more efficient to
    avoid--you know, you have the alert, and then you have to
    conduct an investigation to decide whether to file a SAR, and
    you have to document why you did not file a SAR if you decide
    not to file a SAR, and that is a massive resource drain. And it
    would be much simpler just to file the data with law
    enforcement and let them datamine it to the heart's content.
        Senator Warren. OK.
        Mr. Baer. And that would be a very efficient----
        Senator Warren. So I hope we keep digging into this because
    we might be able to reduce costs for the banks and at the same
    time help law enforcement do this more efficiently.
        I have got two more questions I want to hit, if I can very
    quickly. Another one is anonymous shell corporations that make
    money laundering easier. You know, there are a variety of
    proposals out there to deal with the so-called beneficial
    ownership legislation at the Federal level that would require
    companies to disclose their owners. Just setting aside the
    details, which we could go into for a long time, can I just
    ask, do all of you support the idea in principle? Can I just
    have an on-the-record yes?
        Ms. Lowe. Yes.
        Mr. Lormel. Yes.
        Mr. Baer. Yes.
        Senator Warren. Good. OK. So we have got three yeses on
    that, Mr. Chairman. I support this as well.
        Let me ask one more question. Ms. Lowe, in your estimation,
    if we did that, if we revealed the beneficial ownership, would
    that increase or decrease the costs of anti-money laundering
    compliance for small financial institutions?
        Ms. Lowe. It should certainly decrease it. If they have
    access to that information as a place to start their customer
    due diligence, you know, a lot of people equate customer due
    diligence and just beneficial ownership, and that is not
    correct. You also need to know the source and use of the funds
    coming in for that account and many other things. But that is
    the start. And if a bank has someplace to start, I think it
    really reduces their costs significantly.
        Senator Warren. Good. And I take it that both of you would
    agree with that.
        I just want to say I introduced a bill with Senator Rubio
    to increase oversight of money laundering used by human-
    trafficking networks, and I was very glad when we were able to
    adopt that at the Committee and get it into the language on the
    North Korea sanctions bill. But we need to do a lot more with
    our money-laundering laws, and I think we can make some changes
    to reporting requirements and beneficial ownership disclosure
    that would make life easier both for law enforcement and for
    our smaller banks. And I look forward to working with the
    Committee to be able to do exactly that.
        Thank you, Mr. Chairman.
        Chairman Crapo. Thank you.
        Senator Schatz.
        Senator Schatz. Thank you, Mr. Chairman.
        I want to ask a question about AI. I think, you know, in
    challenging spaces, especially challenging spaces that include
    data, there is a tendency to think of this as sort of a magical
    solution where you just sort of throw big data, throw AI at the
    problem, and I want to get your sense--in the intelligence
    community, there is a conversation about the sort of
    overabundance of data and the overreliance on data points and
    an underutilization of human intelligence and instincts. And I
    am wondering what you think about the balance between utilizing
    new data analytics, big data AI in terms of fighting money
    laundering, but also how do we balance that with the fact that
    we probably still need human beings who have instincts, who
    have experience? I think we should move in this direction. I
    just think we should not overcorrect and abandon the sort of
    institutional knowledge of people. I will start with Mr. Baer.
        Mr. Baer. Senator, I think that was very well put. I think
    those, like us, who believe there is great potential here do
    not believe that you would eliminate the human element. Really
    what you would use the AI for is--we have talked a lot about
    alert SAR filing. So you would use AI in order to generate
    fewer alerts but much smarter alerts, and you would then still
    need to have an investigator come in and decide whether or not
    that was truly a suspicious activity that needed to be reported
    to law enforcement.
        The true great advantage of the AI approach, though, is you
    get rid of what we have discussed earlier, which is a rules-
    based approach. If X, then alert. If Y, then alert. But there
    is a whole other alphabet that you are not even looking at. And
    what AI is able to do is look for anomalies. So instead of
    typologies, it is anomalies. And it gets smarter and smarter
    and it learns.
        So particularly in the world we would hope to get to is
    where, you know, banks could share that information. A friend
    of mine uses the example of a food truck, which is a great way
    to launder money, but it is also a great way to feed people in
    D.C. So one bank may only have three food truck clients, so
    they do not know what is anomalous. But if that bank could
    share information with a bank that has 300 food truck clients
    say in San Francisco, that bank would get smarter.
        Senator Schatz. And isn't that the Square model, on the
    private sector side, isn't that what Square does? They just
    sort of presumptively give you the device, and then if you look
    different than the thousands of other florists or food trucks,
    then you get scrutiny as opposed to sort of preapproval?
        Mr. Baer. I think it is a very similar approach.
        Senator Schatz. Mr. Lormel.
        Mr. Lormel. I agree. I think we definitely need to keep
    human intelligence in the mix. It is very important. And
    certainly you hit the word of ``instincts,'' and, again, I do a
    lot of training, and I always talk about trusting your
    instincts, because even with the best technology, you need to
    rely on human experience. And I think that is important. But I
    also think we need to leverage newer technologies to improve
    our efficiencies and certainly our capabilities. And I will
    look at it from the law enforcement perspective. The more that
    we could use analytical tools, certainly the better and the
    more sharply we can focus our attention, and I think the more
    timely we can act.
        Senator Schatz. Ms. Lowe.
        Ms. Lowe. I do not think I have anything to add as far as
    the AI element of it, but just to go back to some of the things
    that were being discussed a little earlier. So a bank is
    concerned that they are spending too much time filing SARs
    about structuring transactions under a $10,000 threshold. I
    understand that. But if they do not do that, then law
    enforcement does not see that that same client is doing that at
    six different banks, right? And all of a sudden, what would
    have been, well, a problem but probably something that would
    not be investigated if it was only at that one bank will be
    investigated if it is at six different banks, right? So I think
    we need to also bear that in mind when we are talking about
    what do we file SARs on and what don't we.
        Senator Schatz. One final question. I will start with you,
    Ms. Lowe. It appears to me that I do not think we are going to
    settle the sort of technical aspect of these questions and
    these system improvements, process improvements, and rule
    changes and all the rest of it. And so I know Senator Tillis
    mentioned the U.K. model, the working group. There has been
    some discussion about a sort of FinTech, FinCEN Sandbox. I am
    wondering what you think about establishing a public-private
    either task force or working group to kind of work the
    technical details, because as much wisdom as is possessed on
    this dais, I am not sure we can settle this in statutory law or
    that that is where this belongs. So I am just wondering, very
    quickly, if you like the idea of some sort of working group in
    statute.
        Ms. Lowe. Sure, I think that that is an important thing, I
    think at least for a limited time period. I do not think it
    would have to go on forever. I would note, though, that the
    people that are really innovating in the FinTech area are
    actually mainly Nordic. So a lot of the companies are based in
    Sweden and Denmark and Norway, and not actually in the U.S. So
    I would be concerned about limiting it just to sort of U.S.
    involvement. I think you actually need to be looking further.
        Senator Schatz. Fair enough. But, listen, in the Defense
    Department, you have the Defense Policy Advisory Board. You can
    have sort of standing committees without authority to actually
    establish policy, but who are highly influential and can help
    agencies to iterate. Do either of you have anything to add on
    this as my time runs out?
        Mr. Lormel. Well, just if I may, in terms of a working
    group, the Association of Certified Anti-Money Laundering
    Specialists has a FinTech working group that is exploring some
    of these issues now.
        Mr. Baer. I guess maybe I will end with a discouraging
    note.
        Senator Schatz. Thanks.
        [Laughter.]
        Mr. Baer. To what I was saying earlier, I mean, I think
    before this can really be realized, there are a lot of great
    vendors out there with great AI approaches and other types of
    approaches, but there really is a break on the system in the
    sense that there is no sense from the bank regulatory agencies
    that banks are going to be allowed to shift from the old rules-
    based system where they file thousands and thousands of SARs to
    a new smarter system. And so what you are effectively telling
    them is you have to double your budget. You are not going to
    get any----
        Senator Schatz. You have got to do both.
        Mr. Baer. Yeah. And so somebody in charge--and that is
    really our core recommendation for all this. Somebody has got
    to step up and say, ``I am in charge, and we want you to stop
    filing SARs where the yield is effectively 0 percent for law
    enforcement and start filing higher''----
        Senator Schatz. Got it. Thank you.
        Chairman Crapo. Senator Warner.
        Senator Warner. Thank you, Mr. Chairman, and I appreciate
    you having this. This is something I need to learn more about,
    and we have got a lot of intersection with it on the
    Intelligence Committee side. And I was really disappointed when
    Senator Schatz came in and jumped the line again, but he
    actually asked really good questions.
        [Laughter.]
        Senator Schatz. You seem so surprised.
        Senator Warner. I know.
        One, I am glad to see the consensus around beneficial
    ownership and the need for new rules. I thought I was also
    hearing, similar to what Mr. Baer has said, that, you know, we
    need to move from this rules-based approach to a more
    collaborative approach, and actually perhaps with some of the
    smaller institutions shift some of the--shift more of the data
    to some central point and allow that to be analyzed.
        Ms. Lowe, I think earlier on didn't you push back on that
    and felt that--I thought you made some comments that you
    thought this responsibility ought to stay with the bank
    examiners. Could you explain, if I heard it right?
        Ms. Lowe. Sure. I actually think it is important to shift
    that information, you know, to, for example, FinCEN because I
    think they need to be looking at that intelligence across
    different banks. What are they seeing as far as trends? Where
    do you have certain--again, you will have clients that have
    accounts at many different banks in order to not raise
    suspicion, for example. So I think that that is a really
    important shift, and I think it is important that FinCEN do
    that.
        But what is also important is the banks not be absolved of
    their responsibility of doing their own analysis as well
    because they have so much more information about the client
    and, you know, the risks that that client may pose and what
    they should expect----
        Senator Warner. But how would you get at the problem of the
    $100 million bank that has got seven AML individuals and only
    four lenders? There has got to be some way we can move this
    from the rules-based, check-the-box approach.
        Ms. Lowe. Right, and I think that that has a lot to do with
    the examinations. I go back to the examinations. And, you know,
    it is more work for the regulators to actually accept that they
    cannot do a one-size-fits-all, check-the-box approach when you
    have an entirely risk-based system. And so that shift needs to
    happen, and it will be a big one.
        Senator Warner. Let me move to two other areas, if I can. I
    may ask for an extra minute since I waited so long.
        One, we are seeing all the problems with the existing
    system and how we need to change and modernize machine learning
    and AI. I also see that back in August of 2015, FinCEN talked
    about extending this type of anti-money laundering activities
    toward registered investment advisers, and then back in 2017
    there was some motion, some need to look at bringing real
    estate into the fold as well.
        As these proposals around registered investment advisers,
    around real estate move forward, are they being moved forward
    with kind of more modern forward thinking? Or how can we avoid,
    if we were to take in these two industries, simply going back
    to a check-the-box type approach? If I could get each of you to
    quickly address that.
        Mr. Baer. Actually, I am glad you mentioned real estate
    because I think one of the major reasons to support beneficial
    ownership legislation is most of these companies do not
    establish bank accounts so it is not really that much about the
    banks. What they do is they put real estate in, or jewelry or
    art or whatever. So there is clearly a need to expand the scope
    of potential money laundering. You know, cryptocurrencies right
    now----
        Senator Warner. That is what I was going to come to next.
        Mr. Baer. ----is certainly going to be an area of great
    concern, and there are a lot of other financial institution
    types that are not necessarily subject to the customer due
    diligence rule, or if they are subject to it, are not examined
    for it. So there clearly is a sense that a lot of this is being
    pushed out of the largest banks and the banks that are best
    able to detect bad behavior to places where it is a little
    less----
        Senator Warner. And how do we get that right? Having seen a
    great deal of Russian activity in terms of using real estate,
    wearing my other hats, how do we get that right? What is the
    regime that we ought to be looking at? Since, clearly, I would
    think that the real estate industry and the financial
    investment advisory industry would say, oh, my gosh, look at
    the burden this has put on us on the banking side, we want
    nothing about that. Who is doing the best thinking, Ms. Lowe,
    on real estate and investment advisers?
        Ms. Lowe. So on the real estate end of things, FinCEN has
    had geographic targeting orders in place in Florida,
    California, Texas, and New York in specific counties to have
    title insurers--which are part of that industry, right?--
    determine the beneficial owners of any entity that is
    purchasing high-value real estate and then provide that
    information to FinCEN.
        FinCEN found that they had crossover where 30 percent of
    the beneficial owners identified by those title companies,
    title insurance companies, had SARs filed on them already by
    banks. So it tells you just the sort of saturation of what we
    are talking about here.
        Apart from investment advisers, there is a list of what are
    called ``designated nonfinancial businesses and professions,''
    or DNFBPs, that FinCEN has identified as sort of nonbanks that
    play a role in access to the financial system and should have
    money-laundering regimes in place that essentially require
    them----
        Senator Warner. But are those industries fighting back
    against--I would think they do not----
        Ms. Lowe. Many of them are, yes.
        Senator Warner. Let me also, since my time has expired,
    have you also address--and, Mr. Baer, you raised this. You
    know, we are seeing how we try to move from a rules-based
    system to a more collaborative system, but, you know, we are
    about to be overwhelmed with bitcoin and other kind of
    cryptocurrencies. How are we preparing--how is the system
    preparing for this whole new movement? And I would love to hear
    briefly from each of you? With that, I----
        Mr. Baer. I think we are all looking at each other on that
    one. I will admit to a certain amount of bank myopia. Actually,
    I do not know how this system is preparing for
    cryptocurrencies. I am not sure there is a way to prepare.
        Ms. Lowe. I can say----
        Mr. Baer. Go ahead.
        Ms. Lowe. So FinCEN--I am sorry, not FinCEN. FATF has
    actually been looking at this quite closely. The last two
    private sector meetings that I attended, there were breakout
    sessions specifically on this and how do we regulate in this
    area. You know, FinCEN has done some regulation, and we are the
    first country to actually have put some regulation with respect
    to cryptocurrencies in one part of the transaction. And I think
    that that is a good discussion to have with FinCEN about how
    effective that has been. I really could not tell you. I think,
    again, I would discuss that with FinCEN.
        There have been moves to make the cryptocurrencies or the
    technology, et cetera, actually more anonymous. The biggest
    problem with it is that you are talking about movement of funds
    in a very anonymous way.
        So the underlying technology of blockchain has a lot of
    different potential positive uses, and because it is a closed
    system, that does not allow you to go back and amend something.
    So you can only amend going forward, and you have to sort of
    explain why you are doing that, right?
        So a lot of financial institutions are adopting the
    underlying technology of blockchain for various applications,
    and I think that that would actually be a really good hearing
    to have to understand the difference between what is the
    cryptocurrencies and dangers posed versus the technology, the
    underlying technology itself, and, you know, how do we draw the
    line and how do we regulate in a way that allows that
    technology to be used in a really positive way--I think it can
    be really used in a positive way in anticorruption as well--
    versus the dangers of the anonymity of the actual currencies
    that are traded using that technology.
        Senator Warner. I would hope, Mr. Chairman, that we could
    take a look at this and maybe get ahead of it rather than
    chasing the issue after the fact.
        Chairman Crapo. Definitely, and we should.
        Well, that concludes our questioning. I want to thank our
    witnesses again for coming. Both your written and your oral
    testimony has been very helpful. As you can see, there is a lot
    of very serious interest in this issue on this Committee, and
    we will be working to try to find a way to improve and
    strengthen and make our approach to this more efficient, both
    in terms of the burden that is carried by those who engage in
    our anti-money laundering efforts and in terms of the results
    that we get in terms of achieving the objectives.
        I have a couple of quick announcements. For those Senators
    who want to ask questions following the hearing, those will be
    due by January 16th, Tuesday. And to the witnesses, you will
    probably get some follow-on questions. I ask you to respond to
    them very promptly.
        With that, the hearing is adjourned. Thank you.
        [Whereupon, at 11:25 a.m., the hearing was adjourned.]
        [Prepared statements, responses to written questions, and
    additional material supplied for the record follow:]
                        PREPARED STATEMENT OF GREG BAER
                   President, The Clearing House Association
                                January 9, 2018
        Chairman Crapo, Ranking Member Brown, and Members of the Committee,
    my name is Greg Baer and I am the President of the Clearing House
    Association and General Counsel of the Clearing House Payments Company.
    Established in 1853 and owned by 25 large commercial banks, we are the
    oldest banking payments company in the United States, and our
    Association is a nonpartisan advocacy organization dedicated to
    contributing quality research, analysis and data to the public policy
    debate.
        The Clearing House is grateful that the Senate Banking Committee is
    holding this hearing to review our Nation's anti-money laundering and
    countering the financing of terrorism (AML/CFT) regime.
    Introduction
        Our AML/CFT system is broken. It is extraordinarily inefficient,
    outdated, and driven by perverse incentives. A core problem is that
    today's regime is geared towards compliance expectations that bear
    little relationship to the actual goal of preventing or detecting
    financial crime, and fail to consider collateral consequences for
    national security, global development, and financial inclusion.
    Fundamental change is required to make this system an effective law
    enforcement and national security tool, and reduce its collateral
    damage.
        The U.S. AML/CFT regulatory regime, circa 2017, is a system in
    which banks have been deputized to act as quasi law-enforcement
    agencies and where the largest firms collectively spend billions of
    dollars each year, amounting to an annual budget somewhere between that
    of the ATF and the FBI. \1\ One large bank may employ more individuals
    dedicated to BSA/AML/OFAC compliance than the combined staffs of
    Treasury's Office of Terrorism and Financial Intelligence, OFAC, and
    FinCEN. However, in talking to senior executives at banks large and
    small, their primary concern is not how much they spend, but how much
    they waste. And that waste derives from a series of perverse incentives
    embedded in the current system.
    ---------------------------------------------------------------------------
         \1\ See PwC Global Anti-Money Laundering available at http://
    www.pwc.com/gx/en/services/advisory/consulting/forensics/economic-
    crime-survey/anti-money-laundering.html (``According to new figures
    from WealthInsight, global spending on AML compliance is set to grow to
    more than $8 billion by 2017''); FBI FY2017 Budget Request at a Glance
    available at https://www.justice.gov/jmd/file/822286/download; ATF
    FY2017 Budget Request at a Glance available at https://www.justice.gov/
    jmd/file/822101/download.
    ---------------------------------------------------------------------------
        As an analogy, think of the collective resources of the banks as a
    law enforcement agency where officers are evaluated solely based on the
    number of tickets they write and arrests they make, with no
    consideration of the seriousness of the underlying crimes or whether
    those arrests lead to convictions. Imagine further that suspension or
    firing is most likely in the event that a ticket is not written or an
    arrest not made, or if a resulting report is not filed in a timely
    manner.
        To appreciate how misdirected the system has become, it's helpful
    to first consider what kind of incentives should be at its heart. From
    a public policy perspective, any rational approach to AML/CFT would be
    risk-based, devoting the greatest majority of resources to the most
    dangerous financial crimes and illicit activity. For example, law
    enforcement and national security officials would prefer that banks
    allocate significant resources to so-called financial intelligence
    units (FIUs)--basically, in-house think tanks devoted to finding
    innovative ways to detect and prevent serious criminal misconduct or
    terrorist financing--or to following up on high-value suspicious
    activity reports; or SARs.
        Unfortunately, our AML/CFT regulatory system is focused elsewhere.
    Large banks have been pushed away from risk-based approaches, because
    their performance is not graded by law enforcement or national security
    officials, but rather by bank examiners, who do not know of or consider
    their successes. \2\ Instead, those examiners focus on what they know
    and control: policies, procedures, and quantifiable metrics--for
    example, the number of computer alerts generated, the number of SARs
    filed, and the number of compliance employees hired. This means that a
    firm can have a program that is technically compliant, but is not
    effective at identifying suspicious activity, or is producing adverse
    collateral consequences. The converse is also true (and frequently true
    in practice).
    ---------------------------------------------------------------------------
         \2\ See article by Bob Werner and Sabreen Dogar, ``Strengthening
    the Risk-Based Approach'', in TCH Q3 2016 Banking Perspectives issue;
    available at: https://www.theclearinghouse.org/research/banking-
    perspectives/2016/2016-q3-banking-perspectives/strengthening-the-rba.
    ---------------------------------------------------------------------------
        As a result, we have banks filing SARs that are in less than 10
    percent of cases followed up on in any way. For certain categories of
    SARs, the yield is close to 0 percent. Meanwhile, given the draconian
    consequences of missteps and prohibitively high cost of compliance,
    banks are exiting regions or businesses categorized by regulators as
    high risk.
    Specific Problems With the Status Quo
        Background. The BSA/AML regime is primarily codified in the Bank
    Secrecy Act (BSA), enacted in 1970 and amended periodically since then.
    The Act requires financial institutions to keep certain records and
    make certain reports to the Government, including reports on cash
    transactions greater than $10,000. In the 1990s, the law was amended to
    require financial institutions to detect and report their customers'
    ``suspicious'' transactions. Finally, in 2001, the USA PATRIOT Act
    amended the BSA and imposed additional requirements on financial
    institutions to, among other things, verify and record information
    relating to the identity of their customers; and conduct enhanced due
    diligence on correspondent banks, private banking clients and foreign
    senior political figures.
        Congress granted authority to implement the BSA to the Secretary of
    the Treasury, thereby designating an agency with both financial and law
    enforcement expertise as its administrator. \3\ The Secretary in turn
    delegated most of these functions to FinCEN. The Secretary was also
    given authority to examine financial institutions for BSA compliance,
    which Treasury then delegated to various regulators according to
    institution type. \4\ This has resulted in a regime where banking
    agency examiners, with their safety-and-soundness focus, evaluate the
    BSA/AML policies, procedures, and processes at the institutions they
    supervise, while Treasury and law enforcement officials use the
    information supplied by financial institutions to mitigate domestic and
    international illicit finance threats. \5\
    ---------------------------------------------------------------------------
         \3\ See 31 U.S.C. 5318(a)(2) and (h)(2). As recently as 2014, the
    Secretary delegated that authority to FinCEN. See Treasury Order 108-01
    (July 1, 2014).
         \4\ See 31 CFR 1010.810(b).
         \5\ As in other areas, regulators have imposed requirements
    through guidance or manuals that are not published for comment, and can
    conflict with valid FinCEN rules. See TCH letter to the Federal banking
    agencies, ``Appropriate Implementation of FinCEN's Customer Due
    Diligence Rule'', (December 14, 2017); available at https://
    www.theclearinghouse.org//media/TCH/Documents/TCH%20WEEKLY/2017/
    %2020171214_TCH_Letter_CDD_Rule_Implementation.pdf. See also The
    Clearing House Letter to FinCEN, Re: RIN 1506-AB15--Advance Notice of
    Proposed Rulemaking on Customer Due Diligence Requirements for
    Financial Institutions (June 11, 2012); available at https://
    www.theclearinghouse.org/-/media/files/association%20documents%202/
    20120611%20tch%20comments%20on%20customer%20due%20diligence.pdf.
    ---------------------------------------------------------------------------
        SAR Filings. A key obligation of banks under the current BSA
    reporting regime--and the key area of focus by bank examiners--is the
    filing of SARs. The current SAR reporting regime went into effect in
    April 1996 as a way for banks to provide leads to law enforcement. The
    process typically begins with an alert generated by a bank's monitoring
    system, with a SAR filed in the event that investigation determines
    that the activity is suspicious. For example, negative media reports on
    an existing bank customer could trigger an alert, prompt an
    investigation by a bank compliance department, and result in a SAR
    filing.
        In the current regulatory and enforcement climate, bank compliance
    officers have powerful incentives to trigger as many alerts and file as
    many SARs as possible, because those metrics demonstrate a quantifiable
    culture of compliance. (There appears to be no case of a bank being
    sanctioned for filing spurious SARs.) And even where no grounds for a
    SAR filing are found, financial institutions can also spend a
    significant amount of time documenting, for review by their examiners,
    why they closed an alert without filing a SAR.
        What gets measured gets done, and providing valuable intelligence
    to law enforcement or national security agencies does not get measured;
    writing policies and procedures and filing SARs does. So, almost two
    million SARs are filed per year. \6\ Worse yet, SAR filing rules and
    metrics fail to consider the relative severity of the offense. SAR
    dollar thresholds have not changed in 21 years, and there is no dollar
    threshold for so-called insider abuse (say, a teller stealing a small
    amount of money). \7\ No Federal law enforcement agency would ever
    prosecute the large and growing majority of offenses to which SAR
    filings relate, and this is one reason the ``yield'' on SARs is
    generally reported to be well under 10 percent, and close to 0 percent
    for many types of SARs.
    ---------------------------------------------------------------------------
         \6\ See ``SAR Stats'', available at https://www.fincen.gov/fcn/
    Reports/SARStats. The total number of SARs filed in 2017 was 1,867,269.
         \7\ See 12 CFR 208.62, 211.5(k), 211.24(f), and 225.4(f) (Board of
    Governors of the Federal Reserve System) (Federal Reserve) 12 CFR 353
    (Federal Deposit Insurance Corporation) (FDIC) 12 CFR 748 (National
    Credit Union Administration) (NCUA) 12 CFR 21.11 and 12 CFR 163.180
    (Office of the Comptroller of the Currency) (OCC) and 31 CFR 1020.320
    (FinCEN) for Federal SAR regulations. The SAR requirement became
    effective April 1, 1996, and dollar thresholds have not been raised
    since.
    ---------------------------------------------------------------------------
        In practice, almost all banks hire one of a handful of vendors who
    construct rules for generating alerts: for example, three cash deposits
    between $5,000 and $10,000 in a 3-week period, or a wire transfer over
    $1,000 to a high-risk country (Mexico, for example). These crude rules
    generate numerous alerts, and bank investigators must then clear the
    alert or file a SAR. And examiners will be critical if the thresholds
    for a given bank are set at a level that does not generate a large
    number of alerts; so, in the event that a $1,000 threshold is not
    generating many alerts, the bank may be told to lower the threshold to
    $250, or even $0. Of course, it is widely understood that sophisticated
    criminals know these rules, as the software is for sale and widely
    distributed, and its rules do not change much over time.
        Consider the potential for revolutionary change that artificial
    intelligence therefore presents. AI does not search for typologies but
    rather mines data to detect anomalies. It gets progressively smarter;
    it would not be easily evaded; and different banks with different
    profiles would end up producing different outcomes. The current system
    is not progressing from typology to anomaly, however, because there has
    been no signal whatsoever from the regulatory agencies that dollars can
    be shifted from the existing, rules-based system to a better one.
        To be clear, this is not a criticism of bank examiners, but rather
    of the role the current system forces them to play. From a political
    and personal risk perspective, they are in a no-win situation. On the
    one hand, they are excluded when the bank they examine is pursuing real
    cases with law enforcement, national security or intelligence community
    officials, and therefore receive no credit when those cases are
    successful. But if something goes wrong--if a corrupt official or
    organization turns out to be a client of the bank they examine--the
    examiner faces blame. Thus, from an examiner and banking agency
    perspective, the only possible safe harbor is to demand more policies
    and procedures, ensure that a lot of alerts are generated and SARs
    filed, and encourage the bank to investigate exhaustively any client
    deemed high risk. While all other aspects of banking--for example,
    credit risk management--have risk appetites and tolerances, for AML/
    CFT, there is none. And because banks know that the easiest way to get
    in trouble is to fail to file a SAR when examiners subsequently
    determine they should have, they probably spend more time documenting
    decisions not to file SARs--papering the file--than they do following
    up on SARs they do file. In other words, they are incentivized to
    follow the noise, not the signal.
        Enforcement trends have only served to exacerbate the impact of the
    perverse incentives underlying our system; AML/CFT-related fines on
    U.S. banks have increased exponentially over the past 5 years.
    Certainly, there have been some egregious cases where enforcement
    action was warranted, but many enforcement actions taken involve no
    actual money laundering. Rather, they are based on a banking agency
    finding that an insufficient number of alerts were being generated by
    bank systems or that not enough SARs were filed. But the primary
    problem with this enforcement history is not the size and number of
    fines that are imposed periodically, but rather how those fines and
    accompanying consent orders incentivize financial firms to allocate
    their AML/CFT resources. Such orders uniformly result in the hiring of
    more compliance personnel, the retention of consultants, the drafting
    of more policies and procedures, and the direct involvement of the
    board of directors, with resources reallocated to those functions, and
    away from more proactive ones.
        Derisking. Nowhere is this set of perverse incentives more clear
    than in the push for banks to eliminate clients in countries or
    industries that could end up creating political risk to examining
    agencies. A recent set of articles in The Economist details the
    unfortunate consequences that the misalignment in AML/CFT expectations
    and standards has created as financial institutions have worked to
    balance fear of enforcement and supervisory expectations with the AML
    compliance costs of maintaining a global business. As the writers note,
    ``[d]erisking chokes off financial flows that parts of the global
    economy depend on. It undermines development goals such as boosting
    financial inclusion and strengthening fragile States. And it drives
    some transactions into informal channels, meaning that regulators
    become less able to spot suspicious deals. The blame for the damage
    that derisking causes lies mainly with policymakers and regulators, who
    overreacted to past money-laundering scandals.'' \8\
    ---------------------------------------------------------------------------
         \8\ See ``The Great Unbanking: Swingeing Fines Have Made Banks Too
    Risk-Averse'', The Economist, July 6, 2017, available at https://
    www.economist.com/news/leaders/21724813-it-time-rethink-anti-money-
    laundering-rules-swingeing-fines-have-made-banks-too-risk-averse. See
    also ``A Crackdown on Financial Crime Means Global Banks Are
    Derisking'', The Economist, July 8, 2017, available at https://
    www.economist.com/news/international/21724803-charities-and-poor-
    migrants-are-among-hardest-hit-crackdown-financial-crime-means.
    ---------------------------------------------------------------------------
        The causes of derisking are clear: the systems, processes, and
    people required to manage examiner expectations for clients deemed to
    be of ``higher risk'', are extremely costly. For example, a bank may
    prepare a lengthy report on a customer only to be criticized for not
    further documenting the grounds on which it decided to retain the
    customer. Institutions are therefore required to make difficult
    decisions, because it is often times too expensive to build out this
    infrastructure to support higher risk accounts. And this does not even
    include the risk of massive fines and reputational damage in the event
    a customer designated high-risk actually commits a criminal act.
        Similarly, domestically, banks of all sizes report that customer
    due diligence (CDD) requirements have dramatically increased the cost
    of opening new accounts, and now represent a majority of those costs.
    Of course, disproportionate and heightened account opening requirements
    make low-dollar accounts for low- to moderate-income people much more
    difficult to offer and price. While the connection is not immediately
    apparent, AML/CFT expense now is clearly an obstacle to banking the
    unbanked, and a reason that check cashers and other forms of high-cost,
    unregulated finance continue to prosper. The problem, of course, is
    that bank examiners and Federal prosecutors seeking record fines do not
    internalize those costs. And those in the Government who do internalize
    those costs play no role in examining the performance of financial
    institutions.
        To put some numbers to the issue, one AML director recently
    testified that his firm employs 800 individuals worldwide fully
    dedicated to AML/CFT compliance, detection and investigation work, as
    well as economic sanctions compliance. \9\ Today, a little over half of
    these people are dedicated to finding customers or activity that is
    suspicious. The remainder--and the vast majority of employees dedicated
    to these efforts in the business and operations teams that support the
    firm's AML program--are devoted to perfecting policies and procedures;
    conducting quality assurance over data and processes; documenting,
    explaining and governing decisions taken relating to their compliance
    program; and managing the testing, auditing, and examinations of their
    program and systems.
    ---------------------------------------------------------------------------
         \9\ This number does not include other employees dedicated to
    anti-money laundering or economic sanctions compliance in Bank of
    America's lines of businesses, operations or technology teams. The over
    800 employees in Global Financial Crimes Compliance at Bank of America
    is greater than the combined authorized full-time employees in
    Treasury's Office of Terrorism and Financial Intelligence (TFI) and the
    Financial Crimes Enforcement Network (FinCEN).
    ---------------------------------------------------------------------------
    The Great Opportunity Being Lost
        This lack of focus on the goals of the system is especially
    disheartening in an age in which emerging technology has the potential
    to make the AML/CFT regime dramatically more effective and efficient.
    One of the most pressing needs in enhancing the U.S. regime is to
    enable financial institutions to innovate their anti-money laundering
    programs and coordinate that innovation with their peers. As noted
    above, artificial intelligence (AI) and machine learning could
    revolutionize this area, and banks continue to discuss various concepts
    for greater sharing of information. When the SAR requirement (and its
    predecessor the criminal referral form) was first implemented,
    relatively few reports were filed, and each SAR was read by someone in
    law enforcement. Now, with banks and other financial institutions
    employing tens of thousands of people and using computer monitoring to
    flag potentially suspicious activity, almost two million SARs are filed
    per year. \10\ Law enforcement generally reads SARs only if they are
    specifically flagged by the institution, or if a word search identifies
    it as relevant to an existing investigation.
    ---------------------------------------------------------------------------
         \10\ SAR Stats, supra n. 6.
    ---------------------------------------------------------------------------
        Thus, the role of a SAR in law enforcement has changed completely,
    which is not necessarily a bad development. Because so much more data
    is available, there is extraordinary potential for the use of AI and
    machine learning to improve the system, as previously described. But
    there are obstacles. AI strategies require feedback loops, which do not
    exist in the current system. In addition, there are barriers to cross-
    border information sharing of suspicious activity for global financial
    institutions. \11\ As noted above, resources are trapped elsewhere and
    several AML executives have reported that efforts to construct novel
    approaches to detecting illegal behavior have resulted in examiner
    criticism. Examiners have now also begun applying to bank AML models
    the same model risk governance rules they adopted for capital
    measurement, even though models are much more dynamic and have no
    financial reporting consequence; as a result, it now takes months, as
    opposed to weeks, to change an AML model to capture new behaviors,
    which serves as a major disincentive to innovation. \12\
    ---------------------------------------------------------------------------
         \11\ See TCH and FSR letter to the Treasury on its ``Review of
    Regulations'', (``2017 Joint Trades Letter to Treasury on Review of
    Regulations'') July 31, 2017, available at https://
    www.theclearinghouse.org/sitecore/content/tch/home/issues/articles/
    2017/07/
    20170731%20tch%20and%20fsr%20comment%20on%20fincen%20and%20ofac%20regula
    tions.
         \12\ Id.
    ---------------------------------------------------------------------------
        In sum, banks will be reluctant to invest in systems unless someone
    in the Government can tell them that such systems will meet the banking
    examiners' expectations, and can replace old, outdated methods--in
    other words, that they will be rewarded, not punished, for innovation.
    Until then, we have a database created for one purpose and being used
    for another.
        To get a sense of the potential for improvement, note that one bank
    has publicly reported that it receives follow-up requests from law
    enforcement on approximately 7 percent of the SARs it files, which is
    consistent with other reports we have received. More importantly, for
    some categories of SARs--structuring, insider abuse--that number is far
    lower, approaching 0 percent. But no one can afford to stop filing SARs
    in any category, because examination focuses on the SAR that was not
    filed, not the quality or importance of the SAR that was filed.
        Furthermore, in resolving this issue, we also must deal with the
    ``last piece of the puzzle'' problem. Law enforcement will report
    anecdotally that it sometimes finds a low-dollar SAR of use as part of
    a larger investigation--not as a lead but as the last piece in a large
    puzzle. However, it is important to consider the opportunity cost of
    that SAR--the resources necessary to produce it, and whether those
    resources, if allocated elsewhere, would produce the first piece in a
    more important puzzle. As an analogy, if law enforcement rigorously
    enforced jaywalking rules, it would occasionally capture a wanted
    fugitive, but no one would consider that a good use of finite law
    enforcement resources. Again, a core problem with the current regime is
    that there is an absence of leadership making choices like these.
    The Beginning of a Solution
        In early 2017, TCH issued a report offering recommendations on
    redesigning the U.S. AML/CFT regime to make it more effective and
    efficient. This report reflects input from a wide range of
    stakeholders, including foreign policy, development and technology
    experts. \13\
    ---------------------------------------------------------------------------
         \13\ See The Clearing House, ``A New Paradigm: Redesigning the
    U.S. AML/CFT Framework To Protect National Security and Aid Law
    Enforcement'', (TCH AML/CFT Report) (February 2017), available at
    https://www.theclearinghouse.org//media/TCH/Documents/TCH%20WEEKLY/
    2017/20170216_TCH_Report_AML_CFT_Framework_Redesign.pdf. See also TCH
    press release ``The Clearing House Publishes New Anti-Money Laundering
    Report'', (February 16, 2017), available at https://
    www.theclearinghouse.org/press-room/in-the-news/
    29170216%20tch%20aml%20cft%20report.
    ---------------------------------------------------------------------------
        The most important recommendation in the report is for the
    Department of the Treasury to accept--or, better yet, claim--
    responsibility for the system. That includes convening on a regular
    basis the end users of SAR data--law enforcement, national security and
    others affected by the AML/CFT regime including the State Department--
    and setting goals and priorities for the system. Treasury is uniquely
    positioned to balance the sometimes conflicting interests relating to
    national security, the transparency and efficacy of the global
    financial system, the provision of highly valuable information to
    regulatory, tax and law enforcement authorities, financial privacy,
    financial inclusion, and international development.
        Such a process has a clear precedent. The National Security
    Strategy (NSS) is a document prepared periodically by the National
    Security Council (NSC) for submission to Congress which outlines the
    major national security concerns of the United States and how the
    Administration plans to deal with them. The strategy is developed by
    the NSC through an iterative, interagency process to help resolve
    internal differences in foreign policy/national security agendas and
    effectively communicate priorities to a number of different audiences.
    There's also the National Intelligence Priorities Framework (NIPF),
    which is used to establish national priorities for the intelligence
    community. \14\ We believe that measurable outcomes or goals should be
    clearly and specifically defined for each component of our Nation's
    AML/CFT regime (including the anti-money laundering programs in
    financial institutions), and then agreed upon ways to measure the
    achievement of those outcomes or goals should be set and reported. From
    these outcomes or goals, priorities should be set regularly for the
    AML/CFT regime and promptly revisited when new risks emerge. We believe
    this is the best way to build a regime that is ultimately effective in
    achieving the desired outcome of a robust and dynamic national AML/CFT
    regime that can efficiently and quickly adapt to address new and
    emerging risks. For financial institutions, we believe that such an
    exercise would change the focus from technical compliance with
    regulations or guidance, to building anti-money laundering programs
    that achieve the clearly articulated desired and measurable outcomes or
    goals of the regime. And we believe that setting measurable outcomes or
    goals, and then tracking progress to the achievement of these goals, is
    the best way to build anti-money laundering programs and a national
    AML/CFT regime that are both effective and efficient.
    ---------------------------------------------------------------------------
         \14\ See Intelligence Community Directive Number 204--``Roles and
    Responsibility for the National Intelligence Priorities Framework'',
    (September 13, 2007); available at https://www.dni.gov/files/documents/
    ICD/ICD_204.pdf.
    ---------------------------------------------------------------------------
        Reform must also recognize that of the roughly one million SARs
    filed annually by depository institutions (banks and credit unions),
    approximately half are filed by only four banks. Whereas a small to
    mid-sized bank might file a handful of SARs per year, the largest banks
    file roughly one SAR per minute. These are the same banks that are
    internationally active, and therefore present almost all of the most
    difficult policy questions with respect to derisking. Certainly, reform
    is warranted for smaller firms, where the cost of filing that handful
    of SARs is wildly disproportionate to its benefit. But if the goal is
    to catch dangerous criminals, identify terrorist activity, and reduce
    collateral damage to U.S. interests abroad, FinCEN need focus its
    examination energy on only a very few firms. This creates an
    extraordinary opportunity.
        We estimate that an examination team of only 25-30 people at FinCEN
    could replicate the existing work of the Federal banking agencies and
    the IRS (for the largest MSBs) at the largest, most internationally
    active institutions. More importantly, a dedicated FinCEN exam team for
    this small subset of large institutions could receive appropriate
    security clearances, meet regularly with end users and other affected
    parties, receive training in big data and work with other experts in
    Government. They in turn would be supervised by Treasury officials with
    law enforcement, national security, and diplomatic perspectives on what
    is needed from an AML/CFT program--not bank examiners with no
    experience in any of those disciplines. And when FinCEN turned to
    writing rules in this area, it would do so informed by its experience
    in the field. It would see the whole battlefield, and promote
    innovative and imaginative conduct that advanced law enforcement and
    national security interests, rather than auditable processes and box
    checking.
        Remarkably, this arrangement is exactly what Congress intended and
    authorized. In the Bank Secrecy Act, Congress granted FinCEN, not the
    banking agencies, authority to examine for compliance. However, over 20
    years ago, FinCEN delegated its supervisory authority to the Federal
    banking agencies, while retaining enforcement authority. At the time
    the delegation was made, FinCEN's decision was logical, even
    inevitable. The agency had few resources, and insufficient knowledge of
    the banking system. Furthermore, the Nation had over 10,000 banks, and
    those banks were more alike than different. \15\ Restrictions on
    interstate banking meant that there were no truly national banks, and
    U.S. banks generally were not internationally active. As a result,
    there was no real basis by which FinCEN could have distinguished among
    banks. Given the choice between supervising 10,000 banks or none, it
    logically chose none, effectively sub-contracting its statutory duties
    in this area to the banking agencies. \16\
    ---------------------------------------------------------------------------
         \15\ See ``Commercial Banks in the U.S., Economic Research of the
    Federal Reserve Bank of St. Louis'' available at https://
    fred.stlouisfed.org/series/USNUM.
         \16\ In addition, in 1986, Congress granted the Federal banking
    agencies authority to prescribe regulations requiring banks to comply
    with the Bank Secrecy Act, and examine for such compliance. See 31 CFR
    1010.810. As the rule notes ``[o]verall authority for enforcement and
    compliance, including coordination and direction of procedures and
    activities of all other agencies exercising delegated authority under
    this chapter, is delegated to the Director, FinCEN.'' Id. 1010.810(a).
    See also 12 U.S.C. 1818(s).
    ---------------------------------------------------------------------------
        Importantly, the benefits of a FinCEN examination function would
    extend well beyond the handful of banks it examined. Priorities set and
    knowledge learned could be transferred to regulators for the remaining
    financial institutions. And innovation started at the largest firms,
    with encouragement from FinCEN, would inevitably benefit smaller firms.
    The result of FinCEN assuming some supervisory authority would be a
    massive cultural change, as the focus shifted to the real-world
    effectiveness of each institution's AML/CFT program, rather than the
    number of SARs filed or number of policies written. That change would
    start with those banks under sole FinCEN supervision, but would
    eventually spread to all institutions.
        (In that regard, I testified last year alongside a community banker
    who reported that his three-branch bank has four lending officers--and
    six AML compliance officers. \17\ While my testimony has focused on
    challenges faced by the largest banks, the AML/CFT regime is no more
    rational when imposed on the smallest.)
    ---------------------------------------------------------------------------
         \17\ See Testimony of Lloyd DeVaux before the House Financial
    Services Committee Subcommittee on Financial Institutions and Consumer
    Credit, June 28, 2017, available at https://
    financialservices.house.gov/uploadedfiles/hhrg-115-ba15-wstate-ldevaux-
    20170628.pdf.
    ---------------------------------------------------------------------------
        Relatedly, TCH recommends that Treasury undertake a review of the
    BSA/AML reporting regime to ensure information of a high degree of
    utility is reported to law enforcement as well as encourage the
    exchange of AML/CFT information between the Government and the private
    sector as well as between and among financial institutions. We applaud
    FinCEN's recently announced ``Exchange'' program which aims to
    strengthen public-private sector AML/CFT information sharing by
    convening regular briefings between FinCEN, law enforcement and
    institutions. Such sharing not only makes financial institutions'
    programs more effective and efficient, it assists in focusing their
    resources on important matters.
        Finally, one important change to the current system that requires
    new legislation is ending the use of shell companies with anonymous
    ownership. Here, the United States trails the rest of the world, and
    has been criticized by the Financial Action Task Force for being a
    shelter for criminals or kleptocrats seeking to launder money by
    adopting the corporate form and cloaking their ownership. \18\ There
    may be valid reasons why corporate owners would want to keep their
    ownership secret from the broader public; however, it is difficult to
    imagine a valid reason why corporate owners would want to keep their
    ownership secret from the State incorporating them, law enforcement,
    and a financial institution that is legally obligated to determine that
    ownership in the exercise of its BSA/AML obligations. The Clearing
    House strongly urges Congress to adopt such legislation promptly, and
    is pleased to see bicameral, bipartisan support for it.
    ---------------------------------------------------------------------------
         \18\ See FATF Anti-money laundering and counterterrorist financing
    measures, Mutual Evaluation of the United States (December 2016) at 18
    available at http://www.fatf-gafi.org/media/fatf/documents/reports/
    mer4/MER-United-States-2016.
    ---------------------------------------------------------------------------
        In conclusion, I thank you for inviting me today and focusing
    Congressional attention on such an important topic. I look forward to
    your questions.
                                     ______

                     PREPARED STATEMENT OF DENNIS M. LORMEL
    President and Chief Executive Officer, DML Associates, LLC, and Former
                      Chief, FBI Financial Crimes Program
                                January 9, 2018
        Good morning Chairman Crapo, Ranking Member Brown, and
    distinguished Members of the Committee. Thank you for the opportunity
    to testify before you today. My name is Dennis M. Lormel. I have been
    engaged in the fight against money laundering, financial crimes,
    terrorist financing and other forms of illicit finance for 45 years. I
    served in the U.S. Government for 31 years, 28 of which I served as a
    Special Agent in the Federal Bureau of Investigation (FBI). I amassed
    extensive investigative experience in complex and labor intensive
    financial investigations as a street agent, first line supervisor,
    middle manager, and senior executive. In 2000, I was promoted to Chief
    of the Financial Crimes Section, in the FBI's Criminal Division.
    Following the terrorist attacks of September 11, 2001, I formulated,
    established and led the Terrorist Financing Operations Section (TFOS)
    within the FBI's Counterterrorism Division. During my FBI career, I was
    the direct beneficiary of Bank Secrecy Act (BSA) data to include
    currency transaction reports (CTRs) and suspicious activity reports
    (SARs). I experienced firsthand the value BSA data brought to
    investigations. This was especially true after 9/11. One of our
    important initiatives was a datamining project which included SAR
    reporting. For the past 14 years, I have been a consultant, primarily
    working in the financial services industry, in the anti-money
    laundering (AML), terrorist financing and financial crimes prevention
    community. In this capacity, I have worked with private sector clients
    to improve the effectiveness and efficiency of BSA reporting.
        My Government investigative and private sector consulting
    experience has provided me a unique opportunity to understand and
    appreciate two very distinct perspectives regarding the BSA. Two of the
    principal stakeholders of the BSA are law enforcement and financial
    institutions. Putting this in the context of the flow and utilization
    of financial information, law enforcement is the back end user and
    beneficiary of BSA data. Financial institutions serve as the front end
    repository and custodian of financial intelligence. Financial
    institutions also serve the critical function of being the monitor for
    identifying and reporting suspicious activity and other BSA data to law
    enforcement. Simply put, law enforcement uses BSA data to predicate or
    enhance investigations from a tactical standpoint. Law enforcement also
    uses BSA data for strategic purposes. From a simplistic standpoint, the
    flow of BSA data that is continuously filtered to law enforcement is
    invaluable. When you layer the complexities of regulatory compliance
    requirements over the monitoring and filtering process financial
    institutions must follow, the effectiveness and efficiency of BSA
    reporting from the front end monitor to the back end beneficiary,
    becomes flawed.
        My point is that the BSA system is not broken. The system is
    fraught with many inefficiencies but it works. Law enforcement
    consistently receives valuable intelligence from BSA data. The
    challenge is that the BSA system can and should be much more effective
    and efficient. In this context, I applaud the Committee for dedicating
    the time to assess the effectiveness and efficiency of BSA enforcement
    and considering reform measures to strengthen BSA reporting
    requirements.
        I'd like to take the opportunity to commend the Clearing House for
    having issued their report in February 2017 ``A New Paradigm:
    Redesigning the U.S. AML/CTF Framework to Protect National Security and
    Aid Law Enforcement''. I believe the report is a good point of
    reference to initiate discussion for reform consideration. I laud the
    Clearing House for recognizing the importance of including all
    stakeholders in the discussion. I was not involved in the two
    symposiums held to formulate the report. One concern I have about the
    report is the actual extent to which law enforcement was included as a
    contributing stakeholder. In my view, law enforcement is the most
    important stakeholder because the BSA was intended to assist law
    enforcement. When the report was issued, I contacted then current law
    enforcement executives in positions like I held and none were included
    in the deliberations. I encourage the Committee to include a variety of
    active and former law enforcement executives in your ongoing dialogue
    and efforts to strengthen the BSA.
        The BSA was passed in 1970 with the legislative purpose of
    generating reports and records that would assist law enforcement in
    following the money and developing prosecutable criminal cases. Since
    passage of the BSA, additional legislation has periodically been
    enacted to enhance regulations. Most notably, passage of the USA
    PATRIOT Act established a host of new measures to prevent, detect, and
    prosecute those involved in money laundering and terrorist financing.
    Going forward, deliberations to enhance the BSA should focus on
    systemic vulnerabilities, evolving technology, emerging trends and
    opportunities to leverage public and private partnerships and
    information sharing with an eye on continuing to enhance law
    enforcements investigative ability.
        As noted in the introduction of the BSA, ``the implementing
    regulations under the BSA were originally intended to aid
    investigations into an array of criminal activities, from income tax
    evasion to money laundering. In recent years, the reports and records
    prescribed by the BSA have also been utilized as tools for
    investigating individuals suspected of engaging in illegal drug and
    terrorist financing activities. Law enforcement agencies have found
    CTRs to be extremely valuable in tracking the huge amounts of cash
    generated by individuals and entities for illicit purposes. SARs, used
    by financial institutions to report identified or suspected illicit or
    unusual activities are likewise extremely valuable to law enforcement
    agencies''. This statement is a true reflection of BSA reporting.
    However, there is a troubling back story about perceived regulatory
    expectations that have resulted in systemic inefficiencies.
        Regardless of the extent or effectiveness of BSA regulations,
    criminals and terrorists must use the financial system to raise, move,
    store and spend money in order to sustain their illicit operations and
    enterprises. The reality is that no matter how robust an anti-money
    laundering (AML) program is, it cannot detect all suspicious activity.
    The BSA standard is that financial institutions maintain AML programs
    that are reasonably designed to detect and report suspicious activity.
    One of the regulatory challenges confronting financial institutions
    today is the question: What constitutes a reasonably designed AML
    program? Regulatory expectations, either real or perceived, have caused
    financial institutions to lose sight of the purpose of BSA reporting
    and have consequently led to many of the systemic inefficiencies of BSA
    reporting.
        In using the financial system, criminals and terrorists are
    confronted with distinct contrasts. On one hand, the financial system
    serves as a facilitation tool enabling bad actors to have continuous
    access to funding. On the other hand, the financial system serves as a
    detection mechanism. Illicit funds can be identified and interdicted
    through monitoring and investigation. Financing is the lifeblood of
    criminal and terrorist organizations. At the same time, financing is
    one of their major vulnerabilities. At the basic core level of the
    front end and back end data process flow, BSA reporting works and is
    more apt to serve as the intended detection mechanism. The more
    convoluted and distracting the regulatory process becomes, the greater
    the likelihood that the financial system serves as a facilitation tool
    for criminals and terrorists.
        There are a number of vulnerabilities or high risk areas in the
    financial system that criminals and terrorists exploit. I categorize
    them as criminal activity and facilitation tools bad actors use to
    exploit their ill-gotten gains derived from their criminal activity.
    The biggest crime problems we encounter include fraud and money
    laundering. Most criminal activity, other than select violent crimes,
    includes elements of fraud and money laundering. Drug trafficking,
    human trafficking, corruption, and other crimes contain elements of
    fraud and require money laundering. Some of the more significant
    facilitation tools include wire transfers, correspondent banking, shell
    companies (beneficial ownership), illegal money remitters (informal
    value transfer systems), non-Government organizations, credit and debit
    cards, and electronic mechanisms. In my experience, one of the biggest
    areas of vulnerability in the financial system is identifying illegal
    money remitters.
        One facilitation tool that consistently garners Congressional
    attention is the issue of beneficial ownership. Year after year,
    potential bills are introduced regarding beneficial ownership. I
    strongly encourage the Committee to consider beneficial ownership
    legislation as an enhancement to the BSA. Throughout my law enforcement
    career, I dealt with the challenge of shell companies and identifying
    true beneficial owners. Based on my experience, I believe beneficial
    ownership should be required by Secretaries of States, at the point of
    incorporation. On May 11, 2016, the Financial Crimes Enforcement
    Network (FinCEN) issued Customer Due Diligence Requirements for
    Financial Institutions (the COD Rule). The rule strengthens existing
    customer due diligence (CDD) requirements and requires banks to
    identify and verify the beneficial owners of legal entity customers.
    Financial institutions are in the process of implementing COD
    requirements. If identification of beneficial ownership were required
    at point of incorporation, the burden on financial institutions would
    be lessened.
        Regarding the BSA, it is important that all stakeholders be engaged
    in the discussion and deliberation to improve the effectiveness and
    efficiency of BSA reporting and enforcement. More importantly, all
    stakeholders should be involved in breaking down real or perceived
    regulatory impediments. In each of our areas of responsibility, all BSA
    stakeholders should strive to exploit the financial vulnerability of
    criminals and terrorists by ensuring the financial system serves as a
    detection mechanism disrupting illicit funding flows. Although the BSA
    system works, it is flawed and lacks the effectiveness and efficiency
    it was intended to achieve.
        The starting point toward improving the effectiveness and
    efficiency of BSA reporting is to improve the current system through
    building meaningful and sustainable public and private sector
    partnerships beginning with BSA stakeholders, including the financial
    services industry, regulators, policy makers, sanctioning authorities,
    intelligence experts, law enforcement, legislatures and other
    stakeholders. We need to start by improving the efficiencies of our
    current system by breaking down impediments. We then need to determine
    what enhancements to regulations should be considered.
        Building meaningful and sustainable partnerships begins with
    understanding perspectives. Each stakeholder partner possesses a
    perspective based on their professional responsibilities and
    experience. Each of our perspectives will be somewhat unique.
    Understanding and blending the perspectives of our partners will enable
    us to establish a middle ground to improve or build efficiencies upon.
    As this process evolves, we can leverage the capabilities and capacity
    of our partners. This type of evolution sets the stage for developing
    innovative ideas and proactive measures.
        One of the inherent disadvantages we have in our financial system
    and AML environment is that we are reactive. Criminals and terrorists
    have the advantage of being proactive. Our ability to add innovative
    ideas and proactive measures to an otherwise reactive system can
    achieve impactful investigative results. In fact, there have been
    recurring innovative and proactive law enforcement investigations. I
    speak from firsthand experience when I talk about developing proactive
    techniques. I can point to specific proactive law enforcement
    initiatives following 9/11 that were the direct result of innovative
    public and private sector partnerships. My emphasis here is we can be
    innovative within the current framework. We can also improve the
    current landscape through enhancements to encourage and/or incentivize
    innovation. For example, financial institutions conduct baseline
    transaction monitoring to alert to anomalies that can lead to
    identification of suspicious activity. By developing rule sets and
    scenarios that are targeted to specific transactions or financial
    activity, we are more likely to identify specific or targeted
    suspicious activity regarding specific crime problems such as human
    trafficking. Financial institutions are reluctant to employ targeted
    monitoring initiatives because of concern for the potential regulatory
    expectations or other perceived impediments such innovative thinking
    could incur.
        Included as an attachment to my testimony is an article I wrote in
    2011 for publication by the Association of Certified Anti-Money
    Laundering Specialists (ACAMS) titled ``Perspectives. Partnerships and
    Innovation''. As an example of innovative and proactive targeted
    monitoring, the article details the public and private partnership of a
    special AML investigative team at JPMorgan Chase (JPMC) in 2009, with
    Homeland Security Investigations (HSI), Immigration and Customs
    Enforcement (ICE). I provide extensive training to the financial
    services industry regarding AML, terrorist financing, fraud,
    investigations, suspicious activity reporting and related topics. I
    frequently site the JPMC and ICE collaboration as one of the best
    models for partnerships and innovation. One of the accomplishments of
    this collaboration was the effective and efficient use of BSA data
    based on targeted monitoring against human trafficking. The attached
    article also provides a sense of leveraging perspective and, the
    regulatory and collateral challenges financial institutions face by
    endeavoring to be innovative.
        As an extension of public and private partnerships, we should
    consider how to improve information sharing. The PATRIOT Act provided
    us with information sharing vehicles such as Section 314(a) where
    financial institutions can share financial information with law
    enforcement and Section 314(b) where financial institutions can share
    information with each other. Efforts should be made to enhance Section
    314 information sharing in the current environment. In addition, any
    proposed enhancements to the BSA should consider additional information
    sharing mechanisms. The more we can do to enhance information sharing,
    the more meaningful information will be for law enforcement and the
    more detrimental to criminals and terrorists. During their plenary
    session in June 2017, the Financial Action Task Force (FATF) stressed
    the importance of information sharing to effectively address terrorist
    financing. I have always been a huge proponent of information sharing
    to the extent legally allowable.
        One of the most productive examples of public and private sector
    partnership, and information sharing, is the Joint Money Laundering
    Intelligence Task Force (JMLIT) in the United Kingdom (U.K.). JMLIT was
    formed by the Government National Crimes Agency (NCA) in partnership
    with the financial sector to combat high end money laundering. JMLIT
    was established as a business-as-usual function in May 2016. It has
    been developed with partners in Government, the British Bankers
    Association, law enforcement and more than 40 major U.K. and
    international banks. I'm hopeful that the U.S. can assess and work
    through information sharing and privacy concerns in order to replicate
    the U.K. JMLIT model.
        With respect to terrorist financing, any legislative enhancement to
    the BSA should consider facilitating obtaining security clearances for
    select financial institution personnel. In most instances, law
    enforcement is precluded from sharing classified information with
    financial institutions. If financial institutions had select personnel
    with a security clearance and they could gain access to select
    classified information, they would be able to either search for
    specific financial information or establish targeted monitoring
    initiatives to identify specific financial intelligence that would be
    meaningful to classified or otherwise sensitive counterterrorism
    investigations.
        Throughout my career, I have worked closely with financial
    institution AML and fraud compliance professionals. I have the utmost
    respect for their dedication and commitment to protecting the integrity
    of their financial institutions and for identifying the misuse of the
    financial system by bad actors. Next to my former law enforcement
    colleagues, I hold my friends in AML and fraud compliance in the
    highest regard. It is important to note that the BSA shortcomings we
    face are systemic problems caused by multiple factors and not by groups
    of individuals. One of the positive trends evolving within financial
    institutions, in part, founded on the dedication factor of AML
    professionals that I complimented, is the formation of financial
    intelligence units and/or special investigations teams established to
    deal with terrorist financing and emergency response situations such as
    the Panama Papers, the FIFA scandal and human trafficking. In addition
    to developing proactive mechanisms, like targeted monitoring, these
    teams have developed ``urgently'' reactive capabilities to respond to
    terrorist and emergency situations requiring immediate response. As I
    mentioned earlier, AML programs are inherently reactive. One of the
    best reactive mechanisms we possess is negative news reporting. For
    example, when terrorist incidents like the attacks in New York in
    October and December 2017 occurred, as soon as the names of the
    perpetrators are announced, these special investigations teams
    immediately run the perpetrator names through their systems and should
    they identify accounts or transactional activity involving those
    individuals, they immediately contact law enforcement.
        Like the JPMC and ICE human trafficking targeted monitoring program
    I mentioned, I'm aware of a major bank that has formed a special
    investigative team to similarly search for human trafficking that could
    be related to a forthcoming major sporting event. I' m not at liberty
    to further identify the financial institution or circumstances.
    However, it is important to note that financial institutions and law
    enforcement do participate in targeted monitoring projects and when
    they are able to do so, BSA data flows from the front end monitor (a
    financial institution) to the back end beneficiary (law enforcement) in
    a timely and, effective and efficient manner.
        I encourage all financial institutions to establish special
    investigations or critical incident response teams. I teach and view
    these teams analogous to law enforcement Special Weapons and Tactics
    (SWAT) teams. SWAT officers receive regular intensive training to deal
    with dangerous emergency response situations. Most SWAT officers have
    other primary law enforcement assignments, and SWAT is a collateral
    duty. Financial institution SWAT or critical incident response or
    special investigations teams should also receive special training for
    dealing with emergency response and targeted proactive investigative
    situations. Regardless of the size of a financial institution, all
    financial institutions should establish special investigative teams to
    identify and report targeted suspicious activity. Whether the team is a
    unit or one investigator, all financial institutions should develop
    emergency response capabilities.
        In my training programs regarding money laundering, fraud and
    terrorist financing, I stress the importance of situational awareness.
    Situational awareness is being aware of and responsible for your
    physical surroundings regarding your personal safety and security. If
    you see something, say something. The same principles apply to money
    laundering, fraud and terrorist financing. You need to be situationally
    aware of and understand the flow of funds for illicit purposes. Much
    the same, we all need to be situationally aware of the vulnerabilities
    to the financial system and ensure the BSA is as effective and
    efficient as it can be.
        The most important BSA report is a SAR. In most instances, the
    biggest regulatory compliance breakdown resulting in some sort of
    enforcement or regulatory action is the failure to file SARs or to
    adequately file SARs. I cannot underscore enough that law enforcement
    is the direct beneficiary of SARs. Regardless of systemic
    inefficiencies, law enforcement consistently benefits from SAR filings.
        SARs are used tactically to predicate and/or enhance criminal
    investigations. SARs are also used strategically for analytical
    purposes. When attempting to measure effectiveness and efficiency of
    SAR filing, we cannot solely rely on the percentage of SARs filed
    versus the number of SARs used to predicate or enhance an
    investigation. We must also factor in how SARs are used strategically
    for trend analysis and analytical purposes. Finding accurate metrics to
    determine the effectiveness and efficiency of SAR filing is extremely
    difficult.
        When I was in law enforcement, I used SARs for both strategic and
    tactical purposes. When I was Chief of TFOS at the FBI, we established
    a financial intelligence unit. I wanted to know on a recurring basis
    what were the emerging threat trends, as well as emerging crime
    problems. SARs were one of the data sets we used for such trend
    analysis. We also used SARs for tactical purposes in furtherance of
    investigations. We used financial intelligence, some of which was
    derived from BSA data, to include SARs and CTRs, for tactical proactive
    investigations and for tactical reactive or more traditional ``books
    and records'' ``follow the money'' investigations. We used datamining
    technology for both strategic and tactical initiatives. I believe that
    the FBI continues to use BSA data for strategic and tactical
    investigative purposes.
        I developed a flow chart I use for training purposes describing the
    ``lifecycle'' of a SAR. It tracks a SAR from the point of origin when
    it's filed with FinCEN through both regulatory and law enforcement
    review and investigative tracks. During their lifecycle, some SARs go
    directly to support investigations and some remain in the SAR database.
    A number of SARs that go into the SAR database will be used to support
    investigations at later times. Regardless of whether SARs are used to
    support investigations, they will be used in datamining initiatives to
    develop trend analysis or other strategic analyses.
        Following my retirement from the FBI and as I have gained more of a
    financial institution perspective, based on my experience as a
    consultant, I have become more sensitive to the perceived lack of
    feedback to financial institutions from FinCEN and law enforcement
    regarding the value of SARs and how SARs should be written to get law
    enforcements attention. FinCEN has done a good job of discussing the
    value of SARs in their SAR Activity Review publications. In recent
    years, FinCEN has recognized financial institution personnel as the
    front end provider and law enforcement agents as the back end consumer
    for outstanding investigations involving BSA data.
        When I was Chief of Financial Crimes, and subsequently TFOS, I had
    frequent meetings with Jim Sloan. During that time period, Mr. Sloan
    was Director of FinCEN. We often discussed developing a SAR feedback
    mechanism from law enforcement through FinCEN to financial
    institutions. There were many impediments that existed at the time,
    much as they continue to exist today, that precluded us from developing
    a consistent feedback mechanism. Some impediments include the ongoing
    nature and secrecy of Federal grand jury investigations, the time lapse
    from when a SAR was filed and an investigation completed, resource
    constraints and other factors. Feedback regarding SARs warrants further
    consideration. This is an area where the Committee should consider
    dialogue with FinCEN and senior law enforcement executives.
        The law enforcement utilization of SARs, as I have described how I
    used SARs as an FBI executive, was more at a program level than at the
    grass roots investigations level. At the program level there is a
    greater use of datamining and advanced analytics. At the grass roots
    field level, SARs are dealt with more in the form of individual manual
    reviews where each SAR is physically reviewed. For example, every U.S.
    Attorney's Office has a SAR review team. Even though the SAR review
    teams use excel spreadsheets and other analytics, they review SARs by
    hand. The reason this is important for the Committee is at the program
    level, I was more inclined to want to see more SARs filed. For our
    datamining purpose, more was better. At the grass roots level, SAR
    review teams would prefer to see less numbers of SARs filed. In this
    context, less is better. As a field agent and middle manager, I
    reviewed SARs manually, and I understand the grass roots perspective as
    well as the program perspective. Therefore, it is incumbent that as the
    Committee proceeds, you speak to a variety of law enforcement
    stakeholders to gain the best context available.
        One final issue where law enforcement should be the primary
    stakeholder to potential legislation is the issue of CTR and SAR
    reporting thresholds. Since SARs were first implemented, the reporting
    thresholds have been the same. Periodically, banking associations and
    financial institutions have recommended that reporting thresholds be
    adjusted to account for inflation. I strongly believe that CTR and SAR
    reporting thresholds should remain as they are. Law enforcement would
    lose valuable financial intelligence if thresholds are raised. This is
    especially true for terrorist financing, where our primary threat is
    from homegrown violent extremists. My sense is that when we identify
    homegrown violent extremists and financial institutions run their
    names, a high percentage of them will have transactional activity
    involving CTRs.
        As I've stated, at the core level, the flow of BSA data from the
    front end provider (financial institutions) to the back end consumer
    (law enforcement) is good. When financial institutions can be proactive
    and more targeted in their monitoring and reporting, the BSA data they
    provide is more effective and efficient. When the data flow becomes
    convoluted and more constrained, the system becomes more flawed and
    ineffective and inefficient.
        Thank you again for affording me the opportunity to testify today.
    I look forward to responding to any questions you have.

    [GRAPHIC(S) NOT AVAILABLE IN TIFF FORMAT]

                                     ______

                     PREPARED STATEMENT OF HEATHER A. LOWE
      Legal Counsel and Director of Government Affairs, Global Financial
                                   Integrity
                                January 9, 2018
        Thank you for the opportunity to testify before you today on the
    subject of Combating Money Laundering and Other Forms of Illicit
    Finance and the Opportunities to Reform and Strengthen BSA Enforcement.
    I hope that my contributions to today's hearing will help you take
    measured and informed decisions that are in the public's interest with
    respect to the U.S.'s anti-money laundering (AML) regime as set forth
    in the Bank Secrecy Act (BSA).
        Money laundering is a vast subject and there are many different
    facets that it would be worthwhile for this Committee to examine. I
    will discuss some of those areas in my testimony today but, as I am
    sure you will discover as we delve deeper into the topic, there may be
    a great deal more that you wish to explore moving forward. I am happy
    to assist to the extent that I can.
        In my testimony, I will provide information and opinions regarding
    the following: Trends in compliance, Suspicious Activity Reports
    (SARs), Know Your Customer (KYC)/Customer Due Diligence (CDD), and the
    balance of activity and obligations between the Financial Crimes
    Enforcement Network (FinCEN) and the private sector. Some of my remarks
    will directly address recent proposals by The Clearing House in their
    publication ``A New Paradigm: Redesigning the U.S. AML/CFT Framework to
    Protect National Security and Aid Law Enforcement'', as I am sure that
    you are giving consideration to those proposals. (CFT refers to
    countering the financing of terrorism.)
        Some of the key points that I will be making in my testimony are:

      1.  Money laundering and the technology that can help us combat it
            are both evolving and, in light of this, it is appropriate to
            consider whether changes to our regulatory structure should be
            made. Equally, however, it is critical that Congress consider
            and carefully weigh the potential benefits against potential
            negative ramifications before making decisions in this area.

      2.  Enforcement against money laundering is primarily through
            identification of regulatory infractions as opposed to through
            criminal charges of actual money laundering. This may be
            because it is much easier to find evidence of regulatory
            infractions, the burden of proof is lower, and it is far less
            costly for the Government than pursuing a criminal money
            laundering charge, and there is a clear dissuasive effect.
            Despite this, when we look at the cases where enforcement was
            merely through identification of deficiencies of AML systems
            and filing requirements, the hallmarks of serious criminal
            money laundering are there in the cases. As a result,
            decreasing the ability to enforce using the regulatory approach
            may have serious, negative repercussions on compliance and,
            ultimately, criminal access to the U.S. banking system.

      3.  It is critical that information about the natural person(s) who
            own or control companies (the beneficial owners) is finally
            collected by either the State or Federal Government and is made
            available to law enforcement and to financial institutions.
            Companies with unknown or hidden ownership are the number one
            problem in the AML world and the U.S. cannot continue to allow
            our failure to act to put the U.S. and global financial system
            at risk.

      4.  I would strongly caution against transferring responsibility for
            setting AML priorities for individual banks from those banks to
            FinCEN. Banks are best placed to understand their business and
            their systems and the money laundering risks inherent therein,
            and create the systems that work best in their business models
            to combat money laundering. FinCEN and/or other regulators
            should review those assessments but cannot be responsible for
            carrying them out.

      5.  The Clearing House recommends greater information sharing among
            banks and with the Government in a number of ways. While we
            generally support greater sharing of information in the AML
            area, it must be done with appropriate privacy safeguards.
            Where it may result in a person being denied banking services
            at all, there must be a system for redress for people to be
            able to restore that access if they can demonstrate that they
            are involved in legitimate activity.

      6.  Transferring raw banking data from banks to FinCEN to analyze
            (with appropriate privacy safeguards) is not a bad idea.
            However, it is essential that we do not absolve banks of the
            responsibility to carry out their own analysis as well, which
            they have the ability to review within the context of the
            additional client information that they have, because they are
            the gatekeepers to the financial system. The Federal Government
            cannot do this alone.

      7.  AML compliance and reporting is undertaken by a wide range of
            entities and persons, going far beyond the banking sector. Any
            proposed changes should consider the implications for all of
            these types of entities and persons.

      8.  Some types of entities and persons should be required to have AML
            programs in place that currently do not, such as those involved
            in real estate closings, lawyers, and others. The banking
            sector cannot and should not carry this responsibility alone,
            especially where these persons act as a proxy to open the door
            to the financial system for criminals and their money.

      9.  Suspicious Activity Reports are meant to be just that, reports of
            ``suspicious'' activity. Requiring bank employees to determine
            if activity is in fact illegal before filing a SAR would be
            counterproductive for a number of reasons, including increasing
            the burden on bankers who would consequently have to make a
            new, legal determination.

      10.  Congress should request from the various regulators data
            regarding formal and informal enforcement actions pertaining to
            AML/BSA violations and deficiencies so that they are able to
            independently asses the appropriateness of the enforcement
            regime currently in place.

      11.  Both small banks and large banks have been the subject of major
            money laundering cases.

      12.  Money laundering and sanctions violation cases over the past few
            years relate to willful, knowing, and egregious violations of
            U.S. laws and regulations that have resulted in U.S. and
            foreign banks granting access to hundreds of millions of
            dollars in funds supporting genocide and funds supporting
            major, violent South American drug cartels into our system, to
            name a few examples. The fines that have resulted from these
            cases have been seen by the banking industry as heavy and so
            banks have begun to take AML regulations that have been in
            place for many years more seriously as the possibility and
            repercussions of enforcement have increased. I would therefore
            remind Members of Congress that the regulatory ``burden'' has
            not actually been increasing, the threat of being found out is
            what has actually increased.
    Preface: Who Has AML Compliance Responsibilities?
        One thing to keep in mind for the purposes of AML is that the term
    ``financial institution'' (FI) is defined very broadly and encompasses
    a much wider range of types of entities than most people realize. Being
    classified as a financial institution means that an entity must
    generally have some sort of AML compliance in place, with the main
    types of FIs \1\ being required to have an AML compliance program,
    conduct customer due diligence and know your customer checks, monitor
    accounts, and file suspicious activity reports and currency transaction
    reports. I have included the definition of ``financial institutions''
    at the end of this testimony for information. Today you have before you
    representatives from three banking associations, but it is important to
    consider that any changes to the AML/CFT regime will affect a much
    wider range of entities and persons, such as currency exchanges,
    casinos, dealers in precious metals, stones or jewels, pawn brokers,
    and insurance companies, which you should also factor into your
    decision making.
    ---------------------------------------------------------------------------
         \1\ This includes insured banks, commercial banks, agencies or
    branches of a foreign bank in the U.S., credit unions, savings
    associations, corporations acting under section 25A of the Federal
    Reserve Act 12 U.S.C. 611, trust companies, securities broker-dealers,
    futures commission merchants (FCMs), introducing brokers in commodities
    (IBs), and mutual funds. FATF Mutual Evaluation Report of the United
    States, December 2016, available at http://www.fatf-gafi.org/media/
    fatf/documents/reports/mer4/MER-United-States-2016.pdf.
    ---------------------------------------------------------------------------
        There are also a few persons that ought to have U.S. AML
    obligations but currently do not. Although banks serve as an immediate
    gateway into the U.S. financial system and must therefore bear
    significant responsibility for preventing criminals and other
    wrongdoers from finding safe haven here, they shouldn't bear that
    responsibility alone. Other actors that handle large sums of money,
    such as persons involved in real estate transactions, escrow agents,
    investment advisors, lawyers, corporate service providers, and
    accountants must also take responsibility for knowing with whom they
    are doing business and guard against their services being used to
    launder dirty money. Excluding these nonbank sectors renders the U.S.
    financial system vulnerable to serious, ongoing money laundering
    threats as shown by multiple media reports about how, for example,
    anonymous ownership of high-value real estate facilitates money
    laundering, \2\ a 60 Minutes segment showing how lawyers facilitate
    money laundering by corrupt foreign Government officials, \3\ and of
    course the Panama Papers which disclosed how corporate formation agents
    and lawyers help wrongdoers hide and launder criminal proceeds.
    ---------------------------------------------------------------------------
         \2\ See, e.g., The New York Times series ``Towers of Secrecy''
    available at https://www.nytimes.com/news-event/shell-company-towers-
    of-secrecy-real-estate.
         \3\ Can be accessed at http://www.cbsnews.com/news/anonymous-inc-
    60-minutes-steve-kroft-investigation/.
    ---------------------------------------------------------------------------
        Technically, persons involved in real estate closings are already
    classified as FIs per the definition established by the USA PATRIOT Act
    in 2001, but they were given a ``temporary exemption'' (which had no
    sunset clause) from AML compliance requirements in 2002. Despite
    Treasury conducting a comment period with respect to AML compliance in
    the real estate sector in 2003, they have not removed that temporary
    exemption. Congress should consider doing so.
        Addressing the money laundering risks posed by these nonbank
    sectors and actors would finally bring us in line with international
    anti-money laundering standards--agreed to by the U.S., as a leading
    member of the Financial Action Task Force (FATF), the international
    anti-money laundering standard-setting body. In FATF parlance, most of
    these persons are referred to as ``Designated Non-Financial Businesses
    and Professions''. Members of FATF, including the U.S., are supposed to
    require most of these persons to have AML compliance programs, and many
    of its member countries have already done so.
    I. Trends in Compliance
    A. Understanding Regulatory Enforcement Data
        As you know, the money laundering realm is governed by statutes
    which both criminalize the act of laundering money \4\ and impose civil
    and criminal penalties for the failure of a financial institution to
    have an effective AML program. \5\ Under Federal law, the type, nature,
    and scope of a financial institution's AML systems and controls depend
    upon the institution's risk profile, which differs significantly for
    banks that, for example, serve a local, rural community versus a global
    institution that operates in high-risk foreign environments. A
    financial institution's risk profile depends upon its assessment of the
    types of risks it faces, which are a function of where it operates,
    what products and services it offers, and what clients it takes on,
    among other variables.
    ---------------------------------------------------------------------------
         \4\ 18 U.S.C. 1956-1957.
         \5\ The Currency and Foreign Transactions Reporting Act of 1970,
    31 U.S.C. 5311 et seq. (regulations at 31 CFR Ch. X).
    ---------------------------------------------------------------------------
        Developing accurate risk assessments and AML compliance regimes is
    therefore an art and not a science, and requires a great deal of
    judgment. It is the job of the regulators to determine if a financial
    institution has gotten it right--whether the FI's risk assessment is
    comprehensive and reasonable, whether its AML systems and controls are
    appropriately responsive to those risks, and whether those systems and
    controls are effective. The examination reports that result from
    regulators' reviews are highly confidential and exempt from public
    records requests, \6\ although this Committee has the authority to
    review those examination reports should it want to review their content
    and reasonableness. \7\
    ---------------------------------------------------------------------------
         \6\ Exemption of examination reports from public availability. See
    12 CFR 261.14 (Federal Reserve Board); 12 CFR 309.5(g)(8) (FDIC); 12
    CFR 4.12(b)(8) (OCC).
         \7\ Prohibition on banks disclosing information from their
    examination reports. See 12 CFR 261.20(g), 12 CFR 261.2(c)(1)
    (Federal Reserve Board); 12 CFR 350.9 (FDIC); 12 CFR 18.9 (OCC).
    ---------------------------------------------------------------------------
        My organization was hired by a third party in 2015 to undertake a
    confidential study of AML enforcement in the U.S. and the U.K. between
    2001 and 2015. That study was carried out by myself and our Policy
    Counsel Elizabeth Confalone. I have permission to share some of our
    observations from that report with you today, but unfortunately I am
    unable to share the entire report.
        One of our primary observations was that, apart from the rather
    small number of publicly available deferred prosecution agreements
    (DPAs) and nonprosecution agreements (NPAs) that financial institutions
    have entered into with respect to AML-related activity, it is extremely
    difficult to determine the number and nature of the formal and informal
    enforcement actions taken by regulators in response to BSA/AML
    deficiencies because (i) very little information about informal actions
    is available to Congress or the public, (ii) information about formal
    actions is not in a machine-readable format--meaning that one must open
    and read every file to know what the infraction(s) was, and (iii)
    ``actions'' taken by regulators do not always indicate misconduct--an
    ``action'' for the FDIC terminating deposit insurance for a banking
    unit whose deposits were transferred to another bank within the group
    is lumped together with an ``action'' for the systemic violation of
    U.S. sanctions laws.
        A second observation was that, based upon a review of the
    enforcement actions that could be identified as related to AML
    deficiencies, the Federal Government rarely charged a financial
    institution with the criminal offense of money laundering, favoring
    instead a finding that the institution had violated Federal
    requirements to have an effective AML program and report suspicious
    activity to law enforcement. This was the approach even when the
    hallmarks of criminal money laundering seemed clearly present in the
    cases. This may be because it is easier to prove deficiencies in AML
    compliance than it is to meet the criminal standard of proof for money
    laundering. In light of this, it is important to carefully consider
    how, for example, shifting responsibility for AML risk analysis for FIs
    and aggregate data analysis from the private sector to FinCEN (as has
    been proposed in different ways by The Clearing House) could hamper the
    Government's use of civil enforcement actions to combat money
    laundering, which uses far less time and fewer Government resources
    than criminal prosecution would entail, with important dissuasive
    results.
    B. What Does an Overview of Selected Enforcement Tell Us?
        The best source of data on AML/BSA-specific enforcement actions
    providing sufficient detail for adequate analysis are (i)
    nonprosecution agreements (NPAs) and deferred-prosecution agreements
    (DPAs), and (ii) FinCEN data. My organization, Global Financial
    Integrity, reviewed those data sets in order to conduct a more detailed
    analysis of AML/BSA-specific violations and trends in enforcement. I
    will discuss each of these in turn.
        FinCEN Enforcement Actions
        Unlike bank regulatory agencies that tend to be more concerned with
    ensuring the general health and stability of our financial system,
    FinCEN's specific mission is to ``safeguard the financial system from
    illicit use and combat money laundering and promote national
    security.'' \8\ As a result, FinCEN's enforcement actions relate solely
    to issues involving money laundering and illicit finance.
    ---------------------------------------------------------------------------
         \8\ Financial Crimes Enforcement Network, Mission Statement,
    available at http://www.fincen.gov/about_fincen/wwd/mission.html.
    ---------------------------------------------------------------------------
        Given the available data, we analyzed 61 separate actions \9\
    against 52 different banks. \10\ There were 26 American banks subject
    to FinCEN actions, and 26 foreign banks and U.S. branches and offices
    of foreign banks that were subject to FinCEN actions. Each case
    involved multiple failings over a period of years, making
    categorization of the violations challenging.
    ---------------------------------------------------------------------------
         \9\ Technically, the DPAs and NPAs are ``cases'' and the FinCEN
    notices are ``actions,'' however for ease of reference we will use the
    term ``actions'' here.
         \10\ In a few instances there was both a FinCEN action, as well as
    a DPA or NPA relating to the same bank activity, and we have counted
    those as one case each because they cover the same bank activity.
    ---------------------------------------------------------------------------
        Within the FinCEN actions, the most common thread was a failure to
    file suspicious activity reports, however the violations were usually
    accompanied by a large range of other AML system violations such as a
    failure to carry out customer due diligence, failure to verify the
    source and use of funds, failure to identify red flag activity, failure
    to have an adequate AML program, failure to have enough compliance
    staff, and failure to train staff, among other deficiencies.
        Among the full body of 61 cases, 13 of the actions included
    problems relating to money service businesses (MSBs) (mainly foreign)
    and the processing of the cash and monetary instruments by those MSBs,
    including issues with the identification and risk-rating of MSB
    clients. Ten of the actions involved problems with the management of
    foreign correspondent accounts and the processing of the cash and
    monetary instruments for correspondent accounts, including the
    identification and risk-rating of the clients. Several banks had
    violations relating to their failure to file required currency
    transaction reports, and there were a hodge-podge of other specific
    violations as well, such as fraud and problematic trade finance
    activity. Five of the actions involved banks that had foreign
    Politically Exposed Person (PEP) clients, some coupled with failures to
    carry out adequate customer due diligence on those PEPs, to verify the
    source and use of funds, or monitor the client accounts appropriately.
        The FinCEN actions contained damning details illustrating the
    banks' failures, but were always drafted to focus on the civil law
    violations as opposed to the activity that might, in fact, be criminal.
    For example, The Foster Bank, based in Chicago, was sanctioned by
    FinCEN for violations relating to having an ineffective money
    laundering program in place. Illustrating the types of activity that
    Foster's AML deficiencies permitted to occur, the FinCEN action states:

            For example, from April 1999 through August 2002, one customer
            who operated a sportswear business purchased approximately
            $674,390 in cashier's checks, all individually purchased below
            the $3,000 Bank Secrecy Act record-keeping threshold for
            monetary instrument transactions. Concurrently, from April 1999
            through August 2002, the same customer engaged in a pattern of
            structured transactions involving over $6,199,616 in cash
            deposits in amounts under $10,000 per deposit. Ultimately, in
            December 2002, the Bank discovered that this customer had
            conducted nearly $10 million in cash transactions between April
            1999 and November 2002.

            Another Foster customer routinely made cash deposits in the
            amounts of $9,900 up to four times daily. The Bank retained no
            documentation in its file to support a legitimate business
            reason for these deposits.

            Other customers engaged in large aggregate cash transactions,
            totaling an average of $300,000 to $600,000 per month, at least
            some of which appeared to be designed to avoid currency
            transaction reporting. Foster did not have documentation
            supporting the legitimacy of the customers' banking activities
            and failed to file timely suspicious activity reports for these
            customers. \11\
    ---------------------------------------------------------------------------
         \11\ FinCEN, ``Assessment of Civil Money Penalty Against the
    Foster Bank'', Case No. 2006-8, at 5, http://www.fincen.gov/news_room/
    ea/files/foster.pdf.

        This description indicates that that these customers were engaging
    in activities that were likely illegal, given the lengths that they
    went to in order to the avoid money laundering reporting requirement
    that deposits of $10,000 or more be reported to FinCEN on a Currency
    Transaction Report (CTR). The FinCEN action is concerned with Foster's
    failure to identify these avoidance techniques, but we can find no
    corresponding case in Illinois where the bank is actually charged with
    the criminal act of laundering money for its clients. At the time we
    conducted this research, we did not find any records relating to
    prosecution of persons in Illinois who used the accounts at Foster
    Bank, although a case against an individual might not mention the
    bank's name. Therefore, while this case has multiple hallmarks of money
    laundering activity, there was no prosecution for the laundering that
    we could find. Further, we were unable to find evidence that these
    clients' activities were even investigated by Illinois State or Federal
    authorities.
        Having reviewed the FinCEN actions, we are under the impression
    that the vast majority of the sanctioned banks knew or should have
    known (as is the standard) that their services were being used to
    launder proceeds of some sort of illegal activity (although they may
    not have known precisely what kind of illegal activity), and that some
    of the banks may have either been established for that specific
    purpose, or the banks' business was somehow taken over by those
    clients. This misconduct is most evident in the cases relating to small
    banks, where in several cases the clients that were engaging in
    activity that should have raised red flags and caused the banks to file
    SARs were a large percentage of the small bank's business.
        For example, North Dade Community Development Federal Credit Union
    was a nonprofit community development bank based in North Dade County,
    Florida, with $4.1 million in assets. As a community development bank,
    its clients were supposed to be limited to people who live, work or
    worship in the North Dade County area. North Dade had only one branch
    and only five employees. Despite its small, local focus, North Dade was
    servicing multiple money service businesses that were located outside
    of its geographic field of membership and that were engaging in high-
    risk activities. For example, records showed ``(1) deposits in excess
    of $14 million in U.S. cash that was physically imported into the
    United States on behalf of nearly 40 Mexican currency exchangers, and
    (2) hundreds of millions of dollars in wire transfers to foreign bank
    accounts of MSBs located in Mexico and Israel.'' \12\ It is difficult
    to believe that the bank's five staff members were unaware of the
    likelihood that the bank was being used to launder money via their MSB
    clients, and it is wholly possible that the bank was either established
    to carry out illegal activity or was overtaken by criminal clientele.
    ---------------------------------------------------------------------------
         \12\ FinCEN, ``In the Matter of North Dade Community Development
    Federal Credit Union'', Number 2014-07, at 7, 8, 9, Nov. 25, 2014
    (hereinafter, ``FinCEN North Dade Enforcement Action''), http://
    www.fincen.gov/news_room/ea/files/NorthDade_Assessment.pdf.
    ---------------------------------------------------------------------------
        DPAs and NPAs
        We also reviewed deferred prosecution agreement and nonprosecution
    agreements (DPAs and NPAs) related to BSA/AML violations, which we drew
    from the University of Virginia School of Law's Federal Organizational
    Prosecution Agreements collection. \13\ As you know, NPAs and DPAs
    represent a step beyond agency enforcement actions. They represent
    settlements of criminal and civil cases brought by the Government
    against corporations where the corporation generally admits to certain
    facts, agrees to take certain remedial measures, and often pays a fine
    in exchange for the Government deferring or discharging the
    prosecution. In the case of NPAs, the matter is settled once the
    Government has signed the agreement. In the case of DPAs, the
    Government has the option of renewing the prosecution if the company
    does not implement the required remedial measures or continues to
    otherwise act unlawfully.
    ---------------------------------------------------------------------------
         \13\ Brandon L. Garrett and Jon Ashley, ``Federal Organizational
    Prosecution Agreements'', University of Virginia School of Law, at
    http://lib.law.virginia.edu/Garrett/prosecution_agreements/.
    ---------------------------------------------------------------------------
        The DPAs and NPAs we reviewed settled actual cases against banks
    brought by the U.S. Department of Justice. We reviewed 36 DPAs and NPAs
    involving banks. Eleven of those did not involve AML/BSA-related
    infractions. Eight of the agreements related to sanctions-busting
    violations, where the banks were stripping wires of key information,
    re-routing the wires, or taking other actions to evade U.S. sanctions
    laws. Fourteen cases involved money laundering violations, ten of which
    were also the subject of FinCEN actions, and therefore included in the
    analysis above. Only four banks were the subject of money laundering-
    related DPAs/NPAs that did not have a corresponding FinCEN action. Five
    of the cases were against large, international banks for aiding and
    abetting large-scale tax evasion by Americans. Several cases were
    included in the count of both the sanction violations and money-
    laundering categories because their conduct and the terms of their
    agreements included both types of violations.
        Several of the money laundering cases involved funds being moved
    from developing or middle income countries into the U.S. via money
    service businesses or correspondent banking activities. The majority of
    the countries involved were South or Central American (mainly focusing
    on the Black Market Peso Exchange) or Middle Eastern. One case involved
    a bank in Nigeria and one case involved Russian banks. The countries
    that arise in these cases are not surprising in light of the American
    political priorities of fighting drug crime and terrorist financing.
        Some Useful Perspective
        Lastly in this section, I'd like to remind Members of the Committee
    that although the headline-grabbing figures relating to BSA/AML
    enforcement for FIs' may seem large, they pale in comparison to some of
    the egregious, willful violations taking place. Two examples:
        HSBC USA was fined a mere $1.9 billion in 2012 for:

        Failing to have required money laundering controls applied
            to over $200 trillion in wire transfers it received over a 3-
            year period (that's about 3x global GDP),

         Of which $670 billion came from Mexico, which it had
            classified as a low risk country for money laundering although
            the U.S. Department of State and many, many others classify it
            as high risk, and

         Of which $881 million was determined to be proceeds of
            drug trafficking by the Mexican Sinaloa Cartel and the
            Columbian Norte de Valle Cartel.

         Bear in mind that we have no idea what other percentage of
            that $200 trillion was dirty money flowing through HSBC USA
            because the AML controls were turned off.

        Failing to have the required money laundering controls in
            place with respect to the purchase of $9.4 billion in cash from
            its Mexican subsidiary.

        Processing wire transfers with inadequate information that
            were the result of other HSBC subsidiaries' efforts to ensure
            that U.S. dollar transactions from sanctioned countries like
            Iran and Libya were cleared in the U.S.

        BNP Paribas, France's largest bank, was fined $8.9 billion in 2014
    for:

        Processing over $190 billion in transactions through its
            New York office for clients in the sanctioned countries of
            Sudan, Iran, and Cuba,

         at one point providing over half of the banking services
            in use by the Sudanese Government, enabling this Government,
            sanctioned by the U.S. for perpetrating genocide, to process
            its oil money (denominated in dollars) and continue to purchase
            the weapons it needed and pay its soldiers to continue to
            engage in mass-murder, and

         knowingly providing banking services in U.S. dollars for
            people subject to individual and specific sanctions.
    C. Conclusion of Analysis and Recommendation
        Our analysis of the AML enforcement data showed that small banks,
    even local banks, can be and are used to move illicit funds in the same
    way that large, international banks are used. In addition, our analysis
    of the DPAs, NPAs, and FinCEN actions establishes that banks of all
    sizes knowingly and intentionally facilitate the movement of illicit
    funds. In none of the cases reviewed does it appear that the bank was
    unwittingly involved in the movement of illicit money, many of which
    appeared to have been the subject of previous regulatory warnings. SAR
    filing violations were a factor in almost every single one of these
    cases, but they were far from the most serious violations.
        Due to the limitations on access to data, our analysis is
    incomplete. Additional analysis should be undertaken prior to making
    major alterations to the existing U.S. AML regime. We therefore
    recommend that the Members of the Committee undertake a more in-depth
    review of the AML enforcement data prior to making any policy changes.
    This review could include requesting each regulator to identify which
    of their formal and informal enforcement actions over the last 10 years
    relate to AML/BSA or sanctions violations and to include information in
    the searchable/sortable data fields indicating the type of infraction
    involved and the laws or regulations that were violated. In addition,
    we recommend that the Committee obtain the documents related to a
    sample of the formal and informal enforcement actions taken by each
    agency to get a better sense of the misconduct involved and the quality
    of enforcement actions taken. Finally, it would be ideal if all the
    regulators adopted the same fields and display format on their website.
    This will allow for more effective and efficient Congressional
    oversight moving forward, and make it easier for FIs to search the data
    to identify evolving criminal methods and trends.
    II. Suspicious Activity Reports (SARs)
        The Nature of SARs. Suspicious Activity Reports (SARs) are an
    important part of the BSA/AML framework, but the nature of SAR filing
    has changed over time and could be reviewed. It is important for the
    Committee to understand that SARs were intended to be just that,
    reports of suspicion of criminal activity. They are not called illegal
    activity reports, because FI employees are not required to determine if
    the activity they are seeing is actually illegal. Instead, FI employees
    are supposed to file reports where they see something out of the
    ordinary and simply have a suspicion that there is a problem. Requiring
    bank employees to go further and make a determination that an activity
    is actually illegal would be an unrealistic and unwarranted
    expectation. There is no ``bright line'' test for when a SAR should be
    filed because that is contrary to the intended nature of a SAR.
        The Clearing House has nevertheless proposed that further guidance
    be provided by FinCEN to ``relieve financial institutions of the need
    to file SARs on activity that is merely suspicious without an
    indication that such activity is illicit.'' That recommendation would
    fundamentally change the nature of SAR reports and would actually make
    bank employees' tasks much more difficult and risky. After all, it
    clearly requires a greater amount of effort and legal analysis to
    determine whether an activity is, in fact, illicit rather than merely
    suspicious.
        One source of tension in this area appears to be that law
    enforcement wants SARs to include as much information as possible, in
    as standard a format as possible, and that their demands for greater
    detail and specificity have grown over time. FI employees may not have
    the desired level of detail that law enforcement would like, but that
    is simply a reality of money laundering cases which often involve
    hidden conduct and individuals. The SAR instructions properly allow FI
    employees to indicate on the form that the information is ``unknown'';
    that option should be honored by law enforcement rather than trying to
    require FI employees to become detectives uncovering illegal conduct.
        The Sharing of SARs. The Clearing House has proposed that new
    regulations allow FIs to share SAR information among foreign affiliates
    and branches. GFI supports this recommendation; its importance was made
    clear in the HSBC case. A related issue, however, is what actions FI's
    affiliates and branches are required or permitted to take in response
    to receiving this information. I understand that there have been cases
    where a person's accounts have been closed by a bank because it
    received information that another bank identified the person as
    suspicious, making it difficult for that person to establish banking
    relationships elsewhere. If FIs are permitted to close accounts based
    upon suspicions communicated to them by other banks, Congress should
    ensure that there is some mechanism for appeal or redress for
    individuals wishing to establish their bona fides. Such closure of
    accounts may also serve to ``tip off'' the account holder that they are
    the subject of a SAR, contrary to the SAR confidentiality requirements.
        Integrating New Technology. I am in favor of exploring the ways in
    which today's (and tomorrow's) technology can be used to innovate in
    the AML compliance sphere and believe that the Government should be
    supporting such innovation (usually referred to as ``FinTech'').
    Northern Europe seems to be leading in this space, and it would be
    helpful to create a better environment for such innovation in the U.S.
    I therefore support the creation of a technological ``sandbox'', as has
    been proposed by The Clearing House and has been implemented in the
    U.K. The U.K. structure appears to have some specific safeguards to
    protect consumers, however, which they consider to be an integral part
    of their system. I have not had an in-depth look at the U.K. program,
    however regulators presented it at a recent FATF industry consultation
    meeting I attended. They stressed the importance of ensuring that
    consumers were protected at all times as innovative approaches were
    being tested, and the U.S. should do the same. It is important to note
    that, in the House of Representatives, Members are discussing
    legislative language that does not require any of the safeguards
    present in the U.K. system, potentially giving FIs an unlimited safe
    harbor for the use of any new technology with no Government oversight.
    This is a significant danger because if an FI spends the money to
    integrate new technology that, it turns out, isn't as effective as
    alternative methods, they would have no incentive to change their
    approach. They would incur some unwelcome cost for doing so and they'd
    have the security of an unlimited safe harbor, so there would be no
    incentive to act.
    III. Know Your Customer (KYC)/Customer Due Diligence (CDD)
        As part of their customer due diligence, or CDD, procedures, FIs
    are supposed to know their customers by engaging in Know Your Customer,
    or KYC, procedures. In banking terms, knowing your customer is more
    than just knowing who the owners or controllers of the company are
    (known as ``beneficial ownership'' information), it is also
    understanding how that legal or natural person will be using the
    account so that the account can be appropriately monitored for possible
    money laundering activity. Establishing the expected normal use of the
    account is imperative if the FI is to effectively monitor for
    suspicious activity going forward. Moreover, characteristics of the
    beneficial owner of the account (such as nationality/residence, whether
    a politically exposed person (PEP), etc.), the type of business using
    the account, whether that business is cash intensive, and many other
    factors all contribute to an account's risk profile, and that risk
    profile determines what type and level of monitoring the account will
    be subject to.
        Beneficial Ownership Information. Knowledge of the beneficial
    owner(s) of a company holding an account is a critical question in KYC,
    however. Therefore, one Clearing House proposal that GFI wholeheartedly
    supports is its proposal that information about the beneficial owners
    of U.S. companies--the actual individuals who own or control those
    companies--should be collected at the time that companies are
    incorporated in the U.S. and that this information should be made
    available to law enforcement and financial institutions. This is an
    issue that has been gaining visibility and urgency on a global level.
    This is because anonymous companies, or companies with hidden owners,
    are the most frequently used vehicle for money laundering. That's why
    identifying who owns or controls a company is a fundamental step
    necessary to combat the problem.
        In response to the global movement towards greater corporate
    ownership transparency, in May 2016, the U.S. Treasury Department
    adopted a regulation which more explicitly requires banks to obtain
    beneficial ownership information beginning in May 2018. Unfortunately,
    that regulation includes some significant loopholes and so has not been
    deemed compliant with international AML standards in the most recent
    evaluation of the U.S. AML system by the IMF. Hopefully, Treasury will
    be making improving that regulation a priority in order to bring the
    U.S. into compliance with international AML standards and ensure that
    true beneficial ownership information is being collected.
        But whether or not the U.S. improves its regulation, U.S. banks
    that operate in other countries are already subject to strong corporate
    transparency standards that are only getting stronger. As a result, the
    multinational banks that belong to The Clearing House want beneficial
    ownership information for U.S.-formed entities to be collected by
    either those who incorporate the companies or by an appropriate
    Government entity so that they can use the information as a key data
    point in their customer due diligence process. While we do not support
    banks being allowed to rely exclusively on this information in their
    customer due diligence procedures, the information could and should be
    an extremely helpful starting point in the ``know your customer''
    process and as a tool to verify information supplied by the client.
    Accordingly, we strongly support The Clearing House beneficial
    ownership proposal, which is soon to be the subject of bipartisan
    legislation in the House and Senate.
        I wanted to note that in discussions of relevant legislative text
    in the House of Representatives, some Members have been pushing the
    idea that law enforcement should only have access to information about
    the beneficial owners of companies if they can produce a summons or
    subpoena, while at the same time not discussing any limitations on
    availability of the information to the banks. As a fundamental
    principle, U.S. law enforcement should have free access to beneficial
    ownership information because it is critical information they have been
    requesting for years, as evidenced by their many letters of support for
    beneficial ownership bills introduced over the past 10 years. We should
    not, under any circumstances, have a situation in which the banks have
    easy access to this information and our law enforcement does not. I
    would also note that last month, the European Union adopted legislation
    which requires all 28 EU Member States to create registers of
    beneficial ownership information and for that information to be made
    available to the public, including law enforcement and financial
    institutions. The U.K. already has such a public registry in place, and
    countries such at Ghana, the Ukraine, Afghanistan, Kenya, and Nigeria
    are all actively working on putting the same in place. At this point,
    free access by law enforcement and banks must be seen as a minimum
    standard.
    IV. The Balance of Activity and Obligations Between FinCEN and the
            Private Sector
        The Clearing House has proposed that (i) for the large
    multinational FIs, all enforcement power should be consolidated within
    FinCEN, (ii) data collection and analysis should be shifted from the
    private sector to FinCEN, and (iii) for the large multinational FIs,
    FinCEN/Treasury should establish priorities for each FI on an annual
    basis, review progress with each FI every 3 months, and oversee any
    examination of an FI. I'll address each in turn.
        Consolidation of AML Enforcement Power. While the proposal to
    consolidate AML enforcement power in FinCEN has surface appeal, it
    would also be at odds with a major principle in Federal law regulating
    FIs. Federal law now authorizes different functional regulators to
    regulate different FI activities in order to make use of their
    specialized expertise. For example, the SEC is given primacy over
    securities activities at FIs because it understands the securities
    markets and their inherent risks. Similarly, the Commodity Futures
    Exchange Commission oversees AML issues affecting commodity trading,
    and State insurance regulators examine AML issues affecting FI
    insurance activities, again because each regulator is expert in their
    own field. If AML enforcement power were instead consolidated in
    FinCEN, the sector-specific AML experts now working at the individual
    regulators would have to be transferred to FinCEN, swelling its ranks
    and reach. There are strengths and weaknesses to continuing the current
    disaggregated AML oversight system versus concentrating AML oversight
    at FinCEN, and the issues and tradeoffs would need to be carefully
    thought through.
        Data Collection and Analysis Transferral to FinCEN. The suggestion
    that FinCEN be given access to bulk data transfers from FIs to enable
    it to analyze AML trends and patterns across institutions is another
    potentially useful idea. But questions about the effectiveness and cost
    of this proposal include whether FinCEN currently has the technological
    capability and personnel needed to perform that type of data analysis
    or whether it would need to be built, which could be a significant
    expense. In addition, charging FinCEN with industrywide data collection
    and analysis should not be seen as a way for banks to absolve
    themselves of their AML obligations. The banks would retain their
    position as the primary gateway into the U.S. financial system, so the
    first level of responsibility to safeguard the system against money
    laundering abuses must remain with the individual banks who open their
    accounts to individuals and entities around the world.
        Requiring FinCEN To Establish AML Priorities. The third proposal,
    to essentially charge FinCEN with establishing annual AML priorities
    for every large multinational bank and monitoring every bank's progress
    every 3 months, is extremely ill-advised. The FI understands its own
    business and products better than anyone else. It is therefore best-
    placed to determine what its AML risks are and how best to address
    those risks within the systems that it has created. We support the idea
    of an FI working with FinCEN/Treasury to discuss those risks in the
    context of national and global trends observed by FinCEN, and whether
    adjustments might be made as a result, however. In addition, reviewing
    each FI's progress in AML every 3 months seems like far too short a
    time frame to observe how an FI is progressing in this respect,
    however, and entirely impractical from a Government resource allocation
    perspective.
        Creates Bigger Government. Overall, it is critical that the
    Committee understand that changes of the magnitude suggested by The
    Clearing House would require a significant appropriation from the
    Federal budget to pay for, among other things, a very large staff
    increase and procedural and technological improvements at FinCEN. In
    addition, many new regulations would have to be drafted to give effect
    to these changes. The result would be a much bigger Government agency
    and a bigger FinCEN impact on AML activities. Careful analysis is
    needed to determine whether the benefits of each of these changes would
    outweigh the costs.
    V. Conclusion
        In conclusion, positive changes can be made to the AML regulatory
    structure, but they must be made carefully, with good data, and only
    after thinking through as many of the potential ramifications as
    possible.
        Unfortunately for the banking community, many of the high profile,
    incredibly egregious cases that involve the biggest banks in the world
    have eroded public trust that banks will indeed act in a manner that is
    law-abiding and actively try to turn away proceeds of crime. Even many
    bankers lack faith in their institutions. The Members of this Committee
    may find a 2015 study by the University of Notre Dame and the law firm
    of Labaton Sucharow, entitled ``The Street, the Bull, and the Crisis'',
    to be of interest. The researchers surveyed more than 1,200 U.S. and
    U.K.-based financial services professionals to examine views on
    workplace ethics, the nexus between principles and profits, the state
    of industry leadership and confidence in financial regulators. As the
    report states, ``The answers are not pretty. Despite the headline-
    making consequences of corporate misconduct, our survey reveals that
    attitudes toward corruption within the industry have not changed for
    the better.'' \14\
    ---------------------------------------------------------------------------
         \14\ ``The Street, the Bull, and the Crisis'' is available at
    https://www.secwhistlebloweradvocate.com/pdf/Labaton-2015-Survey-
    report_12.pdf.
    ---------------------------------------------------------------------------
        Some of the banks that have been the subject of these high-profile,
    egregious cases are members of The Clearing House, whose proposals for
    regulatory change are before this Committee. That does not necessarily
    mean that the proposed changes are unwarranted, but it is the
    responsibility of Congress to make informed decisions about the extent
    to which each of these proposals is also in the public interest.
    Deregulation for the sake of deregulation in the AML area is most
    certainly not in the public's interest. Making it easier for banks,
    knowingly or unknowingly, to take in greater inflows of drug money, the
    proceeds of human trafficking, the ill-gotten gains of foreign
    dictators, and terror financiers is not in the best interest of anyone.
        Thank you for the opportunity to share my views on such an
    important topic.

    [GRAPHIC(S) NOT AVAILABLE IN TIFF FORMAT]

            RESPONSES TO WRITTEN QUESTIONS OF SENATOR BROWN
                             FROM GREG BAER

    Q.1. Shifting BSA Oversight Back to FinCEN--One Clearing House
    recommendation is to have FinCEN's BSA oversight authority over
    large banks--originally delegated to Federal banking agencies
    over 20 years ago--returned to FinCEN. But it seems clear
    FinCEN does not have the bandwidth to make such a radical
    change.
        Can you describe your organization's effort to assess what
    this change would require, in terms of additional Federal
    funding and personnel, or new assessments on big banks? Why
    should we redo wholesale a system that has been working
    reasonably well, and put in place the kind of centralized
    examination teams you suggest, when examiners have expertise
    and experience with these large entities, and have been doing
    this job successfully for many years?

    A.1. While it would be a significant undertaking for FinCEN to
    examine all financial institutions subject to the BSA, we
    instead recommend that FinCEN retake exam authority for large
    international financial institutions that present complex
    cross-border issues and file a majority of SARs. We estimate
    that an examination team of only 25-30 people at FinCEN could
    replicate the existing work of the Federal banking agencies and
    the IRS (for the largest MSBs) at these institutions. More
    importantly, a dedicated FinCEN exam team for this small subset
    of large institutions could receive appropriate security
    clearances, meet regularly with law enforcement and other end
    users, receive training in big data analytics and work with
    other experts in Government. They, in turn, would be supervised
    by Treasury officials with law enforcement, national security,
    and diplomatic perspectives on what is needed from an AML/CFT
    program--not bank examiners who frequently bring no experience
    in any of those disciplines. Furthermore, when FinCEN turned to
    writing rules in this area, it would do so informed by its
    experience in the field. It would see the whole field, and
    promote innovative and imaginative conduct that advanced law
    enforcement and national security interests, rather than
    auditable processes and box checking. Funding such an exam team
    could be accomplished many ways, including: (i) assessing
    financial institutions for examinations costs; \1\ or (ii)
    establishing a centralized team funded pro rata by each of the
    affected agencies but reporting directly and solely to the
    FinCEN Director.
    ---------------------------------------------------------------------------
         \1\ Existing statutory authority appears to allow for such an
    assessment and affected institutions should see a corresponding
    reduction in the assessment they currently pay to prudential regulators
    for supervision of this function. The Independent Offices Appropriation
    Act provides general authority for a Government agency to assess user
    fees or charges by administrative regulation, based on the value of the
    service to the recipient. See 31 U.S.C. 9701. OMB Circular No A-25
    provides further guidance regarding ``user fees'' (``A user charge . .
    . will be assessed against each identifiable recipient for special
    benefits derived from Federal activities beyond those received by the
    general public.''). See OMB Circular No. A-25 Revised.
    ---------------------------------------------------------------------------
        This recommendation aims to address one of the fundamental
    drivers of the inefficiency in the U.S. AML/CFT regime--the
    fact that the end users of the information generated by banks
    (e.g., law enforcement and national security officials) have no
    say in how banks allocate their resources and provide financial
    intelligence to them. Therefore, examiners do not have insight
    into the utility of the material provided by banks, law
    enforcement AML/CFT priorities, or the degree to which banks
    can innovate their compliance programs in order to provide
    better leads to law enforcement. Instead they focus on
    auditable policies, procedures, and metrics.
        From a political and personal risk perspective, examiners
    are in a no-win situation. On the one hand, they are excluded
    when the bank they examine is pursuing real cases with law
    enforcement, national security or intelligence community
    officials, and therefore receive no credit when those cases are
    successful. But if something goes wrong--if a corrupt official
    or organization turns out to be a client of the bank they
    examine--the examiner faces blame. Thus, from an examiner and
    banking agency perspective, the only possible safe harbor is to
    demand more policies and procedures, ensure that a lot of
    alerts are generated and SARs filed, and encourage the bank to
    investigate exhaustively any client deemed high risk. Given
    that banks have been complying with AML/CFT requirements for
    decades, examiners are also fairly comfortable with the current
    technological and programmatic aspects of the regime, so rather
    than encourage institutions to make innovative programmatic
    changes to detect high-risk financial crimes, the examiner
    focuses on auditing processes like the number of computer
    alerts generated, SARs filed and compliance employees hired. As
    a result, banks of all sizes generate a lot of SARs that are of
    little to no use to law enforcement.
        Importantly, the benefits of a FinCEN examination function
    would extend well beyond the handful of banks it examined.
    Priorities set and knowledge learned could be transferred to
    regulators for the remaining financial institutions. And
    innovation started at the largest firms, with encouragement
    from FinCEN, would inevitably benefit smaller firms. The result
    of FinCEN assuming some supervisory authority would be a
    massive cultural change, as the focus of exams shifted to the
    real-world effectiveness of each institution's AML/CFT program,
    rather than the number of SARs filed or number of policies
    written. That change would start with those banks under sole
    FinCEN supervision, but would eventually spread to all
    institutions.

    Q.2. Protecting Information Shared Among Banks--With any
    increase in information sharing between financial institutions
    beyond that allowed under current law would come an increased
    responsibility for those institutions to protect consumer and
    commercial data.
        What additional steps are needed to ensure that expanding
    information sharing among banks doesn't put customers at
    greater risk of data theft, or of unjustified exclusion from
    the financial system because of inaccurate information being
    shared? Should we consider a more formal redress mechanism for
    persons debanked as a result of increased information sharing?
    Has the Clearing House surveyed its members to assess, over the
    last 5 years or so, how many 314b inquiries were made, and how
    many responded to, by member banks? If not, could you do such
    an informal survey and provide to the Committee that data?

    A.2. Financial institutions work very hard to ensure that their
    customers can conduct their financial transactions in a safe
    and secure manner, while protecting their privacy. U.S. banks
    are subject to a host of regulatory and other requirements and
    devote substantial time and investment to safeguarding customer
    data--and have every incentive to do so. We believe that
    greater information sharing is fully consistent with the
    important privacy risks of bank customers. If a customer has an
    account at multiple banks, each of those banks is already
    monitoring those accounts for suspicious activity. Allowing a
    bank that believes that it has detected suspicious activity to
    consult the other relevant banks would allow it to develop a
    more complete picture of the customer's financial activity, and
    in many cases would result in a SAR not being filed. (For
    example, one bank might see suspicious wire transfers to
    another country, while a second bank might explain that it
    banks a company owned by that customer in that country, so the
    transfers are entirely appropriate.) Of course, in some cases,
    a more complete picture might confirm initial suspicions, and
    lead to a higher quality SAR filing.
        We do not believe there should be concerns about
    information sharing on SARs leading to customers becoming
    unbanked. Sharing would only occur if there was already cause
    for suspicion, and would occur only among those banks that
    currently share the customer. Even in the event that all those
    banks, as a result of the sharing, decide to close the
    customer's accounts, this fact will not be disclosed to other
    banks or to the public. Thus, this case is not akin to credit
    reporting, where a customer's experience with one bank affects
    his or her credit score, and thereby the ability to obtain
    credit from any bank.
        In order to be covered by the 314(b) safe harbor, financial
    institutions or an association of financial institutions must
    comply with a number of requirements, including: (i) annually
    registering with FinCEN and providing a point of contact for
    requests; (ii) taking reasonable steps to verify that the
    recipient institution is also registered with FinCEN; and (iii)
    ensuring that the information shared is adequately protected,
    secure and confidential. \2\ In particular, FinCEN's 314(b)
    regulation states that institutions who share under this
    program are to ``maintain adequate procedures to protect the
    security and confidentiality of such information . . . [which]
    shall be deemed satisfied to the extent that a financial
    institution applies to such information procedures that the
    institution has established to satisfy the requirements of
    section 501 of the Gramm-Leach-Bliley Act (15 U.S.C. 6801), and
    applicable regulations issued thereunder, with regard to the
    protection of its customers' nonpublic personal information.''
    \3\ As a general matter, FinCEN notes that sharing under 314(b)
    must only be done to ``[i]dentify[] and, where appropriate,
    report[] on activities that may involve terrorist financing or
    money laundering; [d]etermine[] whether to establish or
    maintain an account, or to engage in a transaction; or
    [a]ssist[] in compliance with anti-money laundering
    requirements.'' \4\
    ---------------------------------------------------------------------------
         \2\ See FinCEN ``Section 314(b) Fact Sheet'', (314(b) Fact Sheet)
    November 2016, available at www.fincen.gov/sites/default/files/shared/
    314bfactsheet.pdf.
         \3\ See 31 CFR 1010.540(b)(4)(ii).
         \4\ See 314(b) Fact Sheet, supra n. 2.
    ---------------------------------------------------------------------------
        While it would be difficult to provide you with data on the
    frequency of requests and responses as requests carry varying
    degrees of urgency and significance--some are critical and
    merit an institution's immediate attention while others are
    more routine and can function as alerts--we note that FinCEN
    guidance suggests that financial institutions reference 314(b)
    in SAR narratives when it has assisted institutions in
    determining whether information is suspicious, so the agency
    may be able to provide you with a comprehensive assessment of
    the relative effectiveness of the program. Relatedly, our
    members have been told anecdotally by law enforcement that
    their investigative work, using 314(b) and other tools, has
    resulted in the production of highly useful information. \5\
    ---------------------------------------------------------------------------
         \5\ See Testimony of William J. Fox before the U.S. House
    Financial Services Subcommittees on Financial Institutions and Consumer
    Credit and Terrorism and Illicit Finance, November 29, 2017, available
    at financialservices.house.gov/uploadedfiles/hhrg-115-ba15-wstate-wfox-
    20171129.pdf.
    ---------------------------------------------------------------------------
        Finally, when dealing with financial inclusion concerns, we
    note that the present regulatory framework lends itself to
    overly conservative evaluations of risk. This is why TCH
    recommends that Treasury lead the regime as it is uniquely
    positioned to balance the sometimes conflicting interests
    relating to national security, the transparency and efficacy of
    the global financial system, the provision of highly valuable
    information to regulatory, tax and law enforcement authorities,
    financial privacy, financial inclusion, and international
    development.

    Q.3. SAR Filings--You noted in your testimony that currently
    the largest number of SARs being filed against banks are for
    insider threats and abuses such as deceptive and fraudulent
    sales practices, and seemed to suggest that was inappropriately
    high. But I note that in cases like Wells Fargo, which has
    recently been forced to pay out hundreds of millions in fines,
    penalties, and a class action settlement, the filing of SARs is
    often a useful tool to identify such patterns of misconduct
    among employees, and throughout a bank and its branches.
        Are there specific types of insider threats, deceptive or
    fraudulent practices, or other types of illicit conduct that
    you think should NOT be subject to SAR filings?

    A.3. We are aware of no case, including Wells Fargo, where SAR
    filings served as a ``useful tool to identify . . . patterns of
    misconduct among employees, and throughout a bank and its
    branches.'' Rather, our strong presumption is that SAR filings
    with respect to minor offenses in small dollar amounts are
    rarely if ever investigated by law enforcement. We do not know
    but strongly suspect that any post hoc SAR filings made by
    Wells Fargo have not resulted in any prosecution of employees
    subject to those filings, and that law enforcement, if it were
    interested in prosecuting or interviewing those employees, did
    not require a SAR filing to identify them. Again, this is only
    speculation, so we would strongly urge the Committee to ask
    FinCEN for data on the yield on SARs filed on insider abuse,
    and for examples of where such filings initiated or advanced a
    prosecution.
        None of this is to minimize the importance of enforcing the
    law against banks and their employees. We do question strongly
    whether resources deployed to filing SARs on insider abuse
    could be better deployed to innovative approaches to detecting
    more serious crimes. As a general matter, the current BSA/AML
    reporting regime should be reviewed and the investigation and
    reporting of activity of limited law enforcement or national
    security consequence should be deprioritized, while increasing
    law enforcement feedback, to allow financial institutions to
    re-allocate resources to higher value AML/CFT efforts. This
    effort corresponds with the statutory purpose of the BSA, which
    is to provide the Government with AML/CFT information that is
    of a ``high degree of usefulness.'' \6\
    ---------------------------------------------------------------------------
         \6\ See 31 U.S.C. 5311, which states that ``[i]t is the purpose
    of this subchapter [the BSA] to require certain reports or records
    where they have a high degree of usefulness in criminal, tax, or
    regulatory investigations or proceedings, or in the conduct of
    intelligence or counterintelligence activities, including analysis, to
    protect against international terrorism.'' Note that the last clause
    was added by the USA PATRIOT Act in 2001.
    ---------------------------------------------------------------------------
        TCH believes that the SAR regime should be modernized
    through the tailoring of various requirements and facilitation
    of the submission of raw data from financial institutions to
    law enforcement. This could be done in part by (i) providing
    guidance further clarifying that a SAR is not required simply
    because a transaction appears to have no economic, business, or
    lawful purpose; (ii) eliminating requirements to file SARs when
    there are single instances of structuring activity and under
    the 90-day continuing activity review requirements; (iii)
    reducing the number of fields deemed ``critical'' and
    ``optional'' to SAR and CTR filings, as each one imposes
    associated regulatory expectations and burdens with varying
    benefits; and (iv) reviewing, revising or retracting as
    necessary all existing SAR guidance to ensure it aligns with
    the priorities of law enforcement and the regime more broadly
    and clearly communicates expectations to institutions. CTR
    expectations should also be streamlined as, when coupled with
    the SAR regime, many may be of low law enforcement or national
    security value. \7\
    ---------------------------------------------------------------------------
         \7\ See The Clearing House, ``Re: Request for Comments Regarding
    Suspicious Activity Report and Currency Transaction Report
    Requirements'', (April 10, 2018), available at
    www.theclearinghouse.org/-/media/tch/documents/tch-weekly/2018/
    20180410_tch_comment_letter_to_fincen_on_sar_and_ctr_requirements.pdf.
    ---------------------------------------------------------------------------
        To get a sense of the potential for improvement, note that
    one bank has publicly reported that it receives follow-up
    requests from law enforcement on approximately 7 percent of the
    SARs it files, which is consistent with other reports we have
    received. More importantly, for some categories of SARs--
    structuring, insider abuse--that number is far lower,
    approaching 0 percent. However, no one can afford to stop
    filing SARs in any category because examiners focus on the SAR
    that was not filed, not the quality or importance of the SAR
    that was filed. A core problem with the current regime is that
    there is an absence of leadership making choices like these--
    therefore we also recommend that Treasury set priorities for
    the AML/CFT regime and allow financial institutions to deploy
    their resources in support of those priorities.
                                    ------

            RESPONSES TO WRITTEN QUESTIONS OF SENATOR SASSE
                             FROM GREG BAER

    Q.1. Our current money laundering regulatory regime evaluates
    financial institutions based on how they meet process-based
    metrics such as the filing of suspicious activity reports. As
    this hearing discussed, the drawback to this is that financial
    institutions end up focusing on meeting these metrics instead
    of developing innovations that will better catch the bad guys.
    One proposed way to encourage innovation that focuses on
    results is to find ways to allow financial institutions to
    experiment with new anti-money laundering technologies without
    facing regulatory liability. For example, some have proposed a
    no-action letter system which would allow financial
    institutions to gain guidance from FinCEN and other regulators
    about the legality of proposed actions. How would such a system
    function and how could it encourage innovation? Would FinCEN
    need legislative authorization to implement a no-action letter
    process, either to issue no-action letters themselves or to
    have the authority to exempt financial institutions from any
    particular reporting requirements?

    A.1. TCH supports efforts to institute a no-action letter like
    process that resembles the Securities and Exchange
    Commission's. \1\ While rulemaking and the issuance of guidance
    are cumbersome processes that do not always promote innovation
    or dialogue with the industry, a no-action letter system could
    be more effective. It would allow individual financial
    institutions to ask particular questions about actions they
    plan to take, thereby spurring innovation; provide quick
    answers, thereby nurturing innovation; and increase the flow of
    information from industry to FinCEN. As with other areas of
    reform, Congressional efforts to encourage the establishment of
    a no-action letter process for Bank Secrecy Act-related issues
    would be helpful. \2\ We note that the Bank Secrecy Act grants
    Treasury broad interpretive authority including to ``prescribe
    an appropriate exemption from a requirement under this
    subchapter and regulations prescribed under this subchapter.''
    \3\
    ---------------------------------------------------------------------------
         \1\ See The Clearing House, ``A New Paradigm: Redesigning the U.S.
    AML/CFT Framework To Protect National Security and Aid Law
    Enforcement'', (TCH AML/CFT Report), February 2017, available at
    www.theclearinghouse.org//media/TCH/Documents/TCH%20WEEKLY/2017/
    20170216_TCH_Report_ AML_CFT_Framework_Redesign.pdf.
         \2\ While legislative authorization would be helpful, we note that
    the Securities and Exchange Commission's no-action letter regime
    appears to be established under broad authorities. See Nagy, Donna M.,
    ``Judicial Reliance on Regulatory Interpretations in SEC No-Action
    Letters: Current Problems and a Proposed Framework'', Cornell Law
    Review, Vol. 83: 921, p. 931 which says ``[i]n addition to rulemaking
    and adjudicatory powers of statutory origin, the SEC possesses inherent
    power to issue interpretations of the Federal securities laws and the
    SEC rules it has promulgated thereunder. This authority to make
    interpretive statements derives from Congress's charge to the SEC to
    administer and enforce the Federal securities laws.'' Available at
    www.lawschool.cornell.edu/research/cornell-law-review/upload/Nagy.pdf.
         \3\ See 31 U.S.C. 5318(a)(7).
    ---------------------------------------------------------------------------
        More broadly, a cultural change is necessary in how banks
    are examined for compliance, and assessed for potential
    enforcement action. The current focus of examination is
    reviewing a sample of alerts and attempting to demonstrate that
    a SAR should have been filed in some of those cases. There is
    little to no focus on the value of the SARs the bank filed.
    There is little to no contact between examiners and the law
    enforcement and national security officials who use those SARs.
    We believe that any assessment of a firm's AML/CFT program
    should include all that information, and that any examination
    criticisms (in the form of Matters Requiring Attention) or
    formal enforcement action should come only after a holistic
    review of the program, and not perceived compliance lapses in a
    particular area, particularly where there was no attempt to
    actually assist (as opposed to failure to detect) money
    laundering. We have proposed achieving that result for the
    largest, internationally active banks--which file the majority
    of SARs and present global derisking issues--by having FinCEN
    reclaim the examination authority that Congress assigned it,
    rather than continuing to delegate it. For other banks, we
    believe FinCEN needs to set priorities and assist in reviewing
    the value of a firm's program.

    Q.2. What should our risk tolerance be for the fact that the
    U.S. financial system facilitates crimes like human
    trafficking? Should we strive to have zero incidence of money
    laundering in our financial system?

    A.2. Financial institutions around the globe are proactively
    working among themselves and with the public sector to disrupt
    human trafficking networks. In a 2016 Financial Times op-ed,
    Standard Chartered's Group General Counsel discussed the need
    for enhanced public-private sector sharing, noting that
    presentations from NGOs and Government agencies ``have improved
    banks' ability to detect potentially [human trafficking]
    related financial transactions. In turn, they have helped law
    enforcement disrupt trafficking networks.'' \4\ Such movements
    are also underway in the United States. \5\
    ---------------------------------------------------------------------------
         \4\ See Financial Times op-ed by David Fein, ``How To Beat the
    Money Launderers: Banks Must Work With Governments To Combat This
    Scourge'', November 22, 2016, available at www.ft.com/content/569c2e26-
    adb9-11e6-ba7d-76378e4fef24.
         \5\ See TCH Banking Perspectives article by Juan C. Zarate and
    Chip Poncy, ``Designing a New AML System'', Q3 2016, available at
    www.theclearinghouse.org/research/banking-perspectives/2016/2016-q3-
    banking-perspectives/a-new-aml-system.
    ---------------------------------------------------------------------------
        However, a core problem with the current regime is that it
    does not prioritize the allocation of financial institution
    resources to generate leads that are of a ``high degree of
    usefulness'' as required by the BSA. \6\ Therefore, TCH
    recommends that Treasury set AML/CFT priorities for the regime
    to assist financial institutions as they work to fulfill their
    statutorily mandated reporting obligations--including for
    potential human trafficking. \7\ Furthermore, we encourage the
    development and improvement of public-private sector AML/CFT
    information sharing partnerships. The authorized and
    appropriate sharing of information between the Government and
    the private sector as well as the sharing of information
    between and among financial institutions is critical to efforts
    to address illicit finance. We note that the USA Patriot Act's
    Section 314(b) private sector information sharing provisions
    have reportedly been useful in addressing human trafficking and
    other crimes. \8\
    ---------------------------------------------------------------------------
         \6\ See 31 U.S.C. 5311, which states that ``[i]t is the purpose
    of this subchapter [the BSA] to require certain reports or records
    where they have a high degree of usefulness in criminal, tax, or
    regulatory investigations or proceedings, or in the conduct of
    intelligence or counterintelligence activities, including analysis, to
    protect against international terrorism.'' Note that the last clause
    was added by the USA PATRIOT Act in 2001.
         \7\ We note that the U.K.'s Joint Money Laundering Intelligence
    Taskforce (JMLIT) has established the following operational priorities
    for its public-private sector information sharing partnership: (i)
    understanding and disrupting the funding flows linked to bribery and
    corruption; (ii) understanding and disrupting trade based money
    laundering; (iii) understanding and disrupting the funding flows linked
    to organized immigration crime, human trafficking and modern slavery;
    (iv) understanding and disrupting money laundering through capital
    markets; and (v) understanding key terrorist financing methodologies.
    See JMLIT website at www.nationalcrimeagency.gov.uk/about-us/what-we-
    do/economic-crime/joint-money-laundering-intelligence-taskforce-jmlit.
         \8\ See Testimony of William J. Fox before the U.S. House
    Financial Services Subcommittees on Financial Institutions and Consumer
    Credit and Terrorism and Illicit Finance, November 29, 2017, available
    at financialservices.house.gov/uploadedfiles/hhrg-115-ba15-wstate-wfox-
    20171129.pdf.

    Q.3. I'd like to understand better how technological innovation
    is transforming the fight against money laundering and how
    Government policy can help or hurt these efforts.
        In the health care context, I hear about how researchers
    have used machine learning and artificial intelligence to
    identify diseases and predict when they will occur, using data
    points that humans would have never put together. How have
    financial institutions or law enforcement officials been able
    to use of similar techniques to identify money laundering and
    how much more progress can be made in this front?
        Outside of AI and machine learning, how can recent FinTech
    innovations such as blockchain fight money laundering?
        What regulatory requirement or requirements--if any--most
    hinders the adoption of technological innovations?

    A.3. Financial institutions are in the early stages of
    exploring various ways to apply technological innovations to
    AML/CFT efforts. In particular, artificial intelligence has the
    potential to improve the way that banks identify suspicious
    activity. AI does not search for typologies but rather mines
    data to detect anomalies. It gets progressively smarter; it
    won't be easily evaded; and different banks with different
    profiles would end up producing different outcomes.
        Our banks report that they are working to pilot AI
    solutions in this area, yet the experts that they need to work
    on these initiatives are instead required to validate their
    current programmatic processes to examiners. \9\ Financial
    institutions need to be able to innovate their AML programs and
    coordinate that innovation with their peers. Yet, the most
    consequential impediment to innovation is the current
    regulatory structure as examiners focus on auditing banks'
    policies, processes, and metrics versus encouraging financial
    institutions to shift their resources to developing innovative
    methods of detecting financial crime.
    ---------------------------------------------------------------------------
         \9\ Id.
    ---------------------------------------------------------------------------
        Furthermore, some firms have expressed concerns that if
    they adopt new and more effective methods, and actually
    identify more illicit activity, they will be sanctioned by the
    banking agencies for failing to detect that conduct earlier. It
    is a reflection of the current dysfunction that this is an
    actual concern.
        This is why TCH believes that Treasury should take a more
    prominent role in coordinating AML/CFT policy and examinations
    across the Government and conduct a robust and inclusive annual
    or biennial process to establish AML/CFT priorities and provide
    an overarching purpose for the regime. Furthermore, we believe
    that FinCEN should retake exam authority for multinational,
    complex financial institutions. A dedicated FinCEN exam team
    for this small subset of large institutions could receive
    appropriate security clearances, meet regularly with law
    enforcement and other end users, receive training in big data
    analytics and work with other experts in Government. They, in
    turn, would be supervised by Treasury officials with law
    enforcement, national security, and diplomatic perspectives on
    what is needed from an AML/CFT program. This change would
    promote innovative and imaginative conduct that advanced law
    enforcement and national security interests, rather than
    auditable processes and box checking. Importantly, the benefits
    of a FinCEN examination function would extend well beyond the
    handful of banks it examined. Priorities set and knowledge
    learned could be transferred to regulators for the remaining
    financial institutions. And innovation started at the largest
    firms, with encouragement from FinCEN, would inevitably benefit
    smaller firms. The result of FinCEN assuming some supervisory
    authority would be a massive cultural change, as the focus of
    exams shifted to the real-world effectiveness of each
    institution's AML/CFT program, rather than the number of SARs
    filed or number of policies written. That change would start
    with those banks under sole FinCEN supervision, but would
    eventually spread to all institutions.

    Q.4. How much does bitcoin, blockchain, and other
    cryptocurrencies facilitate money laundering? How--if at all--
    should this impact our approach to combating money laundering
    in traditional banks? How can law enforcement officials best
    stop this newer form of money laundering?

    A.4. As a general matter, customers are using various tools to
    conduct transactions around the globe with bank and nonbank
    financial institutions. In 2013, FinCEN issued guidance
    indicating that a cryptocurrency ``administrator or exchanger
    is an MSB under FinCEN's regulations, specifically, a money
    transmitter, unless a limitation to or exemption from the
    definition applies to the person.'' \10\ We also note that in
    the past few years, FinCEN has levied enforcement actions
    against cryptocurrency exchangers. While TCH is not privy to
    data on the extent of money laundering within virtual
    currencies, we note that others are beginning to look into this
    issue. \11\
    ---------------------------------------------------------------------------
         \10\ See FIN-2013-G001 ``Application of FinCEN's Regulations to
    Persons Administering, Exchanging, or Using Virtual Currencies'', March
    18, 2013, available at www.fincen.gov/sites/default/files/shared/FIN-
    2013-G001.pdf.
         \11\ For example, in January 2018, Yaya J. Fanusie and Tom
    Robinson published a memorandum on ``Bitcoin Laundering: An Analysis of
    Illicit Flows Into Digital Currency Services''. Available at:
    www.defend democracy.org/content/uploads/documents/
    MEMO_Bitcoin_Laundering.pdf.
    ---------------------------------------------------------------------------
        Any review of the BSA/AML regime and its effectiveness
    should investigate the changing ways in which customers
    interact with financial institutions and ensure that statutory
    authorities are adequately tailored to address the evolving
    nature of illicit finance threats.

    Q.5. I'd like to discuss Suspicious Activity Reports (SARs).
    Today, around 2 million SARs are filed each year. While every
    SAR used to be read by law enforcement officials, that is no
    longer the case today. Financial institutions often complain
    that they rarely, if ever, receive feedback from law
    enforcement officials on the utility of any particular
    suspicious activity report that they file. This lack of
    feedback loops increases the burdens on financial institutions,
    who continue to file SARs that are of little utility to law
    enforcement officials. It also prevents financial institutions
    from developing better analytical tools to more precisely
    discern between the signal and the noise.
        What percentage of SARs are actually read by someone in law
    enforcement?
        How often do financial institutions receive feedback from
    law enforcement officials as to the utility of their SAR
    filing?
        While some have proposed reducing the number of SARs and
    CRT filings because they are often superfluous and are never
    read, others argue that this poses risks, because investigating
    minor infractions may still lead to significant law enforcement
    successes. How should policymakers resolve this conflict?

    A.5. TCH members report that they receive follow-up requests
    for additional information from law enforcement on their SAR
    filings in less than 10 percent of cases. For certain
    categories of SARs, the number of requests is close to 0
    percent. It should be noted that a follow-up request does not
    mean that the SAR led to an arrest or conviction; it means only
    that someone in law enforcement wanted to learn more about the
    case. Our understanding is that FinCEN does not routinely
    research how SARs are used and what their yield is. Obviously,
    a more modern system would be more data-driven.
        While law enforcement is best placed to provide data on how
    many reports are read, we note that they are generally used by
    FinCEN and law enforcement for data searches and mining. While
    one BSA report may be the ``last piece of the puzzle,'' it's
    important to consider the resources deployed for the production
    of that report and whether they would be better spent if
    redirected to produce the first piece in a more important
    puzzle. As an analogy, if law enforcement rigorously enforced
    jaywalking rules, it would occasionally capture a wanted
    fugitive, but no one would consider that a good use of finite
    law enforcement resources. Again, a core problem with the
    current regime is that there is an absence of leadership making
    choices like these.
        This is why TCH recommends that Treasury lead the regime by
    coordinating AML/CFT policy and examinations across the
    Government and conduct a robust and inclusive annual or
    biennial process to establish AML/CFT priorities that would
    form the basis for the deployment of financial institution
    resources. Relatedly, Treasury should undertake a review of
    BSA/AML reporting requirements to ensure information of a high
    degree of utility is reported to law enforcement, which
    conforms with financial institutions' obligations under the
    BSA. \12\
    ---------------------------------------------------------------------------
         \12\ See 31 U.S.C. 5311, which states that ``[i]t is the purpose
    of this subchapter [the BSA] to require certain reports or records
    where they have a high degree of usefulness in criminal, tax, or
    regulatory investigations or proceedings, or in the conduct of
    intelligence or counterintelligence activities, including analysis, to
    protect against international terrorism.'' Note that the last clause
    was added by the USA PATRIOT Act in 2001.

    Q.6. How could regulators (1) set up better feedback loops
    between financial institutions and law enforcement officials
    that could help financial institutions better identify money
    laundering; and (2) empower financial institutions to act upon
    their improved ability to distinguish between useful and
    superfluous reports, including by filing fewer unnecessary
    SARs, without fearing regulatory consequences for doing so?
        Would a better feedback loop system exist if financial
    institutions employed more people with security clearances? If
    so, what, if anything, can the Federal Government do to
    facilitate this?

    A.6. There are substantial benefits to developing additional
    pathways, both formally and informally, for AML/CFT information
    sharing between various stakeholders in the public and private
    sector. Granting law enforcement and national security
    authorities opportunities to provide general feedback on the
    reports filed, and incorporating this feedback into supervisory
    evaluations of firms' compliance, could assist financial
    institutions in targeting their resources to efforts that
    provide information that is of the greatest use in preventing
    illicit financing. We note that under the current regime, many
    large financial institutions operate financial intelligence
    units (FIUs) that employ former law enforcement or national
    security officials, yet still receive little to no useful
    feedback.
        It would also be helpful if a pathway for sharing
    information was established to allow financial institutions to
    efficiently share raw data with law enforcement, under a safe
    harbor, and with reforms made to current reporting
    requirements. The current regime is built on individual,
    bilateral reporting mechanisms grounded in the analog
    technology of the 1980s, rather than the more interconnected
    and technologically advanced world of the 21st century. \13\
    Therefore, providing such data in bulk would modernize the
    current regime and allow institutions to provide law
    enforcement with information in a timelier manner. Furthermore,
    it would allow law enforcement, using big data analytics, to
    effectively have access to and sift through large quantities of
    data more efficiently.
    ---------------------------------------------------------------------------
         \13\ See The Clearing House, ``A New Paradigm: Redesigning the
    U.S. AML/CFT Framework To Protect National Security and Aid Law
    Enforcement'', (TCH AML/CFT Report), February 2017, available at
    www.theclearinghouse.org//media/TCH/Documents/TCH%20WEEKLY/2017/
    20170216_TCH_Report_ AML_CFT_Framework_Redesign.pdf.
    ---------------------------------------------------------------------------
        Further coordination and information sharing between and
    among public sector authorities is critical to establishing
    AML/CFT priorities and providing an overarching purpose for the
    regime. In order to empower institutions to deploy resources to
    high-value activities, TCH recommends that Treasury take a more
    prominent role in coordinating AML/CFT policy and examinations
    across the Government and conduct a robust and inclusive annual
    or biennial process to establish AML/CFT priorities, which
    could form the basis of financial institution examinations.
    This is particularly important in the U.S. where law
    enforcement, national security, and financial institution
    oversight responsibilities are dispersed among multiple
    agencies. This stands in contrast to other approaches (e.g.,
    the U.K.'s Joint Money Laundering and Intelligence Task Force
    (JMLIT)) that better address barriers to information sharing by
    bringing together relevant actors to share information as well
    as allowing financial institutions to follow-up on SAR
    activity, thereby potentially improving the effectiveness of
    financial institution reporting mechanisms. However, as alluded
    to above, with any public-private sector dialogue, and more
    generally, we believe that national authorities should speak
    with one voice when providing feedback as well as disseminating
    red flags, threats, and typologies to the private sector as
    disparate voices create confusion.

    Q.7. Often, financial institutions will derisk by refusing to
    serve customers that could be involved in illegal activity. As
    financial institutions start to share more information with
    each other, this practice could become more prominent and
    potential criminals could more frequently lose access to the
    United States' financial system altogether.
        Are there instances in which derisking is actually
    unhelpful for law enforcement purposes, because it drives these
    criminals underground and makes it more difficult to track
    them?
        At the moment, do the regulators that evaluate and enforce
    financial institutions compliance with our Federal money
    laundering take this into account?
        Are there promising ways to increase cooperation between
    financial institutions, regulators, and law enforcement
    officials, so that financial institutions can make a more
    informed decision about when and how to derisk?
        Would financial institutions need to hire more employees
    with a top security clearance and/or a law enforcement
    background for this coordination to be effective?

    A.7. The current derisking trend is in part a reaction to
    Government and supervisory characterizations of correspondent
    banking as a high risk business and the evolving standards
    within the domestic and international community. \14\ The
    causes are clear--the systems, processes, and people required
    to manage examiner expectations for clients deemed to be of
    ``higher risk'', are extremely costly. For example, a bank may
    prepare a lengthy report on a customer only to be criticized
    for not further documenting the grounds on which it decided to
    retain the customer. For certain regions or businesses it is
    often times too expensive to build out this infrastructure to
    support higher risk accounts. And this does not even include
    the risk of massive fines and reputational damage in the event
    a customer designated high-risk actually commits a criminal
    act.
    ---------------------------------------------------------------------------
         \14\ See ``The Great Unbanking: Swingeing Fines Have Made Banks
    Too Risk-Averse'', The Economist, July 6, 2017, available at
    www.economist.com/news/leaders/21724813-it-time-rethink-anti-money-
    laundering-rules-swingeing-fines-have-made-banks-too-risk-averse. See
    also ``A Crackdown on Financial Crime Means Global Banks Are
    Derisking'', The Economist, July 8, 2017, available at
    www.economist.com/news/international/21724803-charities-and-poor-
    migrants-are-among-hardest-hit-crackdown-financial-crime-means.
    ---------------------------------------------------------------------------
        As discussed previously, TCH believes that Treasury should
    take a more prominent role in coordinating AML/CFT policy and
    examinations for the regime. That includes convening on a
    regular basis the end users of BSA data--law enforcement,
    national security, and others affected by the AML/CFT regime
    including the State Department--and setting goals and
    priorities for the system. Treasury is uniquely positioned to
    balance the sometimes conflicting interests relating to
    national security, the transparency and efficacy of the global
    financial system, the provision of highly valuable information
    to regulatory, tax and law enforcement authorities, financial
    privacy, financial inclusion, and international development.
        In addition, and as discussed above, TCH believes that
    greater information sharing will assist in further clarifying
    whether a customers' activity is, in fact, suspicious.
    Presently the USA PATRIOT Act grants various statutory
    authorities, under Sections 314(a) and 314(b) to allow for
    public-private and private-private sector sharing. While
    security clearances and additional staff may be helpful, we
    note that large financial institutions employ hundreds of staff
    members, some of whom are former law enforcement officials, to
    assist with compliance efforts yet it's the ``check-the-box''
    nature of the compliance regime that prevents them from
    utilizing these resources for more proactive AML/CFT efforts.
    \15\
    ---------------------------------------------------------------------------
         \15\ See Testimony of William J. Fox before the U.S. House
    Financial Services Subcommittees on Financial Institutions and Consumer
    Credit and Terrorism and Illicit Finance, November 29, 2017, available
    at financialservices.house.gov/uploadedfiles/hhrg-115-ba15-wstate-wfox-
    20171129.pdf.
    ---------------------------------------------------------------------------
                                    ------

            RESPONSES TO WRITTEN QUESTIONS OF SENATOR TILLIS
                             FROM GREG BAER

    Q.1. How can we leverage technology to make the process
    simultaneously less onerous on banks while enhancing the
    outcomes of catching illegal behavior? Are there regulatory and
    legislative barriers to getting that down?

    A.1. Allowing financial institutions to innovate their AML
    programs is key to enhancing their ability to identify
    suspicious activity. The biggest barrier to innovation is the
    current exam paradigm. As one bank recently testified, from
    2010-11 they were able to innovate the way in which they used
    technology to identify potentially suspicious activity.
    However, since then, they have found innovation difficult as
    regulatory guidance has been inappropriately applied to their
    programs and examiners have in turn rigorously enforced this
    guidance, thereby delaying the implementation of programmatic
    changes that used to take weeks to 9 months or a year. \1\
    Under the current AML/CFT regime, examiners focus on auditing
    banks' policies, processes, and metrics versus encouraging
    financial institutions to shift their resources to developing
    innovative and effective methods of detecting financial crime.
    ---------------------------------------------------------------------------
         \1\ See Testimony of William J. Fox before the U.S. House
    Financial Services Subcommittees on Financial Institutions and Consumer
    Credit and Terrorism and Illicit Finance, November 29, 2017, available
    at financialservices.house.gov/uploadedfiles/hhrg-115-ba15-wstate-wfox-
    20171129.pdf.
    ---------------------------------------------------------------------------
        This is why TCH believes that Treasury should take a more
    prominent role in coordinating AML/CFT policy and examinations
    across the Government and conduct a robust and inclusive annual
    or biennial process to establish AML/CFT priorities and provide
    an overarching purpose for the regime. Furthermore, we believe
    that FinCEN should retake exam authority for multinational,
    complex financial institutions. A dedicated FinCEN exam team
    for this small subset of large institutions could receive
    appropriate security clearances, meet regularly with law
    enforcement and other end users, receive training in big data
    analytics and work with other experts in Government. They, in
    turn, would be supervised by Treasury officials with law
    enforcement, national security, and diplomatic perspectives on
    what is needed from an AML/CFT program. This change would
    promote innovative and imaginative conduct that advanced law
    enforcement and national security interests, rather than
    auditable processes and box checking. Importantly, the benefits
    of a FinCEN examination function would extend well beyond the
    handful of banks it examined. Priorities set and knowledge
    learned could be transferred to regulators for the remaining
    financial institutions. And innovation started at the largest
    firms, with encouragement from FinCEN, would inevitably benefit
    smaller firms. The result of FinCEN assuming some supervisory
    authority would be a massive cultural change, as the focus of
    exams shifted to the real-world effectiveness of each
    institution's AML/CFT program, rather than the number of SARs
    filed or number of policies written. That change would start
    with those banks under sole FinCEN supervision, but would
    eventually spread to all institutions.

    Q.2. Financial institutions often complain that FinCEN, law
    enforcement officials, and prudential regulators do not tell
    them whether their BSA filings serve a useful purpose, or how
    the reports they submit are being used--and that the filings go
    into a black hole. Can you shed some light on the filings that
    you make or have used and what could be done to improve this
    process?

    A.2. TCH members report that they receive follow-up requests
    for additional information from law enforcement on their SAR
    filings in less than 10 percent of cases. For certain
    categories of SARs, the number of requests is close to 0
    percent. It should be noted that a follow-up request does not
    mean that the SAR led to an arrest or conviction; it means only
    that someone in law enforcement wanted to learn more about the
    case. Our understanding is that FinCEN does not routinely
    research how SARs are used and what their yield is. Obviously,
    a more modern system would be more data-driven.
        TCH believes that the SAR regime and BSA filing
    requirements generally, should be modernized through the
    tailoring of various requirements and facilitation of the
    submission of raw data from financial institutions to law
    enforcement. The current regime is built on individual,
    bilateral reporting mechanisms grounded in the analog
    technology of the 1980s, rather than the more interconnected
    and technologically advanced world of the 21st century. \2\
    Therefore, providing such data in bulk would modernize the
    current regime and allow institutions to provide law
    enforcement with information in a timelier manner. Furthermore,
    it would allow law enforcement, using big data analytics, to
    effectively have access to and sift through large quantities of
    data more efficiently.
    ---------------------------------------------------------------------------
         \2\ See The Clearing House, ``A New Paradigm: Redesigning the U.S.
    AML/CFT Framework To Protect National Security and Aid Law
    Enforcement'', (TCH AML/CFT Report), February 2017, available at
    www.theclearinghouse.org//media/TCH/Documents/TCH%20WEEKLY/2017/
    20170216_TCH_Report_ AML_CFT_Framework_Redesign.pdf.
    ---------------------------------------------------------------------------
        Furthermore, additional pathways for AML/CFT information
    sharing between various stakeholders in the public and private
    sector should be developed. Granting law enforcement and
    national security authorities opportunities to provide general
    feedback on the reports filed, and incorporating this feedback
    into supervisory evaluations of firms' compliance, could assist
    financial institutions in targeting their resources to efforts
    that provide information that is of the greatest use in
    preventing illicit financing.
        Further coordination and information sharing between and
    among public sector authorities is critical to establishing
    AML/CFT priorities and providing an overarching purpose for the
    regime. In order to empower institutions to deploy resources to
    high-value activities, TCH recommends that Treasury take a more
    prominent role in coordinating AML/CFT policy and examinations
    across the Government and conduct a robust and inclusive annual
    or biennial process to establish AML/CFT priorities, which
    could form the basis of financial institution examinations.
    This is particularly important in the U.S. where law
    enforcement, national security, and financial institution
    oversight responsibilities are dispersed among multiple
    agencies. This stands in contrast to other approaches (e.g.,
    the U.K.'s Joint Money Laundering and Intelligence Task Force
    (JMLIT)) that better address barriers to information sharing by
    bringing together relevant actors to share information as well
    as allowing financial institutions to follow-up on SAR
    activity, thereby potentially improving the effectiveness of
    financial institution reporting mechanisms. However, with any
    public-private sector dialogue, and more generally, we believe
    that national authorities should speak with one voice when
    providing feedback as well as disseminating red flags, threats,
    and typologies to the private sector as disparate voices create
    confusion.

    Q.3. Another compliance challenge often cited by banks is that
    they feel pressured by bank examiners and law enforcement
    authorities to exit certain business lines or cease offering
    certain services to customers viewed as presenting particular
    money-laundering vulnerabilities, i.e., severing corresponding
    banking relationships with foreign institutions in certain
    geographic areas, and also ending money services businesses
    (MSBs, i.e., check cashing, money transmitters, currency
    exchange outlets, etc.)
        As banks reevaluate their business relationships with MSBs
    in light of what they may view as a hostile regulatory
    landscape, what can we do to change this type of behavior/is
    this a prevalent problem in the industry?
        It is my understanding that there are times when law
    enforcement and the bank regulators work at cross purposes.
    That is, law enforcement might want a bank to continue banking
    an individual or company that they are following and building a
    case against but the bank regulators, whose incentives are to
    not be embarrassed by their regulated entities, force the banks
    to ``derisk'' or close those accounts. Is that actually the
    case?

    A.3. We do not have hard data on this question. With respect to
    specific customers, we have heard of cases where law
    enforcement asked a bank to keep an account open, and the bank
    agreed; we have also heard of cases where banks felt that the
    regulatory risk was too high, and declined. At a broader level,
    with respect to certain lines of business or regions, we do not
    believe there are cases where banks have agreed to remain
    engaged at law enforcement or other governmental request. For
    example, it has been reported that the State Department
    expressed considerable concern at the decision by banks to
    derisk foreign embassies in the United States, but the banks
    involved could not get sufficient assurance that the banking
    agencies would not sanction them if something went wrong, so
    closed or refused to open those accounts.

    Q.4. In terms of AML, we know that the success of AML is
    centric around whether or not the predicate crime of money
    laundering has been reduced, but we only really know how
    pervasive money laundering is on a reactive basis, i.e., when
    someone/some entity is caught. To that end, do you believe the
    advent/popularity of cryptocurrencies could affect the capture
    of money laundering/could it affect AML? Do enforcement
    authorities have the technological capabilities to work with
    private industry to capture mal-actors?

    A.4. As a general matter, customers are using various tools to
    conduct transactions around the globe with bank and nonbank
    financial institutions. In 2013, FinCEN issued guidance
    indicating that a cryptocurrency ``administrator or exchanger
    is an MSB under FinCEN's regulations, specifically, a money
    transmitter, unless a limitation to or exemption from the
    definition applies to the person.'' \3\ We also note that in
    the past few years, FinCEN has levied enforcement actions
    against cryptocurrency exchangers. While TCH is not privy to
    data on the extent of money laundering within virtual
    currencies, others are beginning to look into this issue. \4\
    In addition, in a recent speech, Treasury Under Secretary for
    Terrorism and Financial Intelligence Sigal Mandelker provided
    an example of cryptocurrencies being used for money laundering
    and terrorist financing stating that ``law enforcement
    authorities recently arrested a woman in New York who used
    Bitcoin to launder fraud proceeds before wiring the money to
    ISIS.'' \5\
    ---------------------------------------------------------------------------
         \3\ See FIN-2013-G001 ``Application of FinCEN's Regulations to
    Persons Administering, Exchanging, or Using Virtual Currencies'', March
    18, 2013, available at www.fincen.gov/sites/default/files/shared/FIN-
    2013-G001.pdf.
         \4\ For example, in January 2018, Yaya J. Fanusie and Tom Robinson
    published a memorandum on ``Bitcoin Laundering: An Analysis of Illicit
    Flows Into Digital Currency Services''. Available at: www.defend
    democracy.org/content/uploads/documents/MEMO_Bitcoin_Laundering.pdf.
         \5\ See U.S. Department of the Treasury Under Secretary Sigal
    Mandelker Speech before the Securities Industry and Financial Markets
    Association Anti-Money Laundering and Financial Crimes Conference,
    (Treasury Under Secretary Mandelker's 2018 SIFMA Speech), February 13,
    2018, available at home.treasury.gov/news/press-release/sm0286.
    ---------------------------------------------------------------------------
        Any review of the BSA/AML regime and its effectiveness
    should investigate the changing ways in which customers
    interact with financial institutions and ensure that statutory
    authorities are adequately tailored to address the evolving
    nature of illicit finance threats.

    Q.5. In your opinion, do you think that the overall AML regime
    has been effective? Additionally, what do you see as the best
    way to ensure future effectiveness?
        Is it to have Treasury be the lead to:
        1. Define with other stakeholders specific and clear
    national priorities of the regime; and
        2. Determine, working with other stakeholders, clear and
    measurable objectives of the regime in light of those
    priorities. Should Treasury or someone else have to report
    those measurements against the objectives back to Congress?

    A.5. The U.S. AML/CFT regime is broken. It is extraordinarily
    inefficient, outdated, and driven by perverse incentives. A
    core problem is that today's regime is geared towards
    compliance expectations that bear little relationship to the
    actual goal of preventing or detecting financial crime, and
    fail to consider collateral consequences for national security,
    global development, and financial inclusion. Fundamental change
    is required to make this system an effective law enforcement
    and national security tool, and reduce its collateral damage.
        The Department of the Treasury should reclaim
    responsibility for the system. That includes convening on a
    regular basis the end users of SAR data--law enforcement,
    national security, and others affected by the AML/CFT regime
    including the State Department--and publicly setting goals and
    priorities for the system. Treasury is uniquely positioned to
    balance the sometimes conflicting interests relating to
    national security, the transparency and efficacy of the global
    financial system, the provision of highly valuable information
    to regulatory, tax, and law enforcement authorities, financial
    privacy, financial inclusion, and international development.
        In addition, FinCEN should retake exam authority for
    multinational, complex financial institutions. Relatedly,
    Treasury should review the BSA/AML reporting regime to ensure
    information of a high degree of utility is reported to law
    enforcement as well as encourage the exchange of AML/CFT
    information between the Government and the private sector as
    well as between and among financial institutions. Finally, one
    important change to the current system is the passage of
    legislation ending the use of shell companies with anonymous
    ownership.

    Q.6. Mr. Baer, does the current process of having FinCEN
    delegate authority to the bank regulators work? What are the
    challenges and deficiencies of the current system and how best
    do we improve outcomes?
        Does the current system take full advantage of
    technological advancements?
        How does BSA affect financial institutions of different
    size, with different staff and tech resources?

    A.6. Congress in the Bank Secrecy Act explicitly vested sole
    regulatory, examination, and enforcement authority in the
    Treasury Department, an agency with considerable financial but
    also law enforcement and national security knowledge--not the
    banking agencies. Congress rightly saw that this was an
    altogether different mission, requiring different expertise.
    However, decades ago, an understaffed and underfunded FinCEN
    delegated all examination authority to the banking agencies,
    and then abdicated any oversight role in how they conducted it.
        The result is a system where the end users of suspicious
    activity reports, or SARs--law enforcement and national
    security--have little or nothing to say when a bank's
    compliance is evaluated. Examiners are generally not permitted
    to know which SARs are valued by the end users, and so focus on
    what they do know: policies and procedures.
        For example, banks know that examiners test compliance by
    reviewing alerts and trying to identify cases where a SAR was
    not filed but arguably should have been. Therefore, they
    reportedly spend more time documenting decisions not to file
    SARs than they do following up on SARs they do file. In other
    words, they focus on the noise, not the signal. And they
    continue to use antiquated, consultant-devised, rules-based
    systems--rules known to the bad guys, by the way--rather than
    innovative artificial intelligence approaches, largely because
    the former are conducted under policies and procedures that
    have passed muster with regulators.
        Furthermore, under this regime no one sets priorities--
    unlike any law enforcement or national security agency in the
    world. According to bank analysis--there is little to no
    governmental analysis--the great majority of SAR filings
    receive no uptake from law enforcement. For certain categories
    of SARs--structuring, insider abuse--the yield is close to 0
    percent. And those categories now represent a majority of the
    SARs filed.
        BSA/AML reform would benefit institutions of all sizes. In
    2017, TCH testified before the House with a community banker
    who reported that his three-branch bank has four lending
    officers and six AML compliance officers. While TCH represents
    25 large commercial banks, the regime is no more rational for
    smaller banks. \6\
    ---------------------------------------------------------------------------
         \6\ See Testimony of Lloyd DeVaux before the House Financial
    Services Committee Subcommittee on Financial Institutions and Consumer
    Credit, June 28, 2017, available at financialservices.house.gov/
    uploadedfiles/hhrg-115-ba15-wstate-ldevaux-20170628.pdf.
    ---------------------------------------------------------------------------
                                    ------

            RESPONSES TO WRITTEN QUESTIONS OF SENATOR WARNER
                             FROM GREG BAER

    Q.1. What are the costs and benefits of having bank examiners
    assess bank compliance with the Bank Secrecy Act's (BSA)
    requirements instead of having anti-money laundering (AML) and
    combating the financing of terrorism (CFT) experts at the
    Financial Crimes Enforcement Network (FinCEN) examine bank
    compliance programs?

    A.1. As you know, Congress assigned examination authority to
    the Treasury Department given its considerable financial, law
    enforcement, and national security knowledge. The benefit of
    delegation is clear: there are thousands of banks in the
    country, and bank regulators already have examiners assigned to
    them. Thus, they can efficiently add AML/CFT compliance to the
    list of items for which they examine. It would be inefficient
    for FinCEN to examine the vast majority of these banks, who
    present few issues.
        On the other hand, for the largest, multinational banks, we
    believe that the equation is quite different. We estimate that
    an examination team of only 25-30 people at FinCEN could
    replicate the existing work of the Federal banking agencies and
    the IRS (for the largest MSBs) at these institutions. More
    importantly, a dedicated FinCEN exam team for this small subset
    of large institutions could receive appropriate security
    clearances, meet regularly with law enforcement and other end
    users, receive training in big data analytics, and work with
    other experts in Government. They, in turn, would be supervised
    by Treasury officials with law enforcement, national security,
    and diplomatic perspectives on what is needed from an AML/CFT
    program--not bank examiners with no experience in any of those
    disciplines. And when FinCEN turned to writing rules in this
    area, it would do so informed by its experience in the field.
    It would see the whole battlefield, and promote innovative and
    imaginative conduct that advanced law enforcement and national
    security interests, rather than auditable processes and box
    checking.
        Importantly, the benefits of a FinCEN examination function
    would extend well beyond the handful of institutions it
    examined. Priorities set and knowledge learned could be
    transferred to regulators for the remaining financial
    institutions. And innovation started at the largest firms, with
    encouragement from FinCEN, would inevitably benefit smaller
    firms. The result of FinCEN assuming some supervisory authority
    would be a massive cultural change, as the focus of exams
    shifted to the real-world effectiveness of each institution's
    AML/CFT program, rather than the number of SARs filed or number
    of policies written. That change would start with those banks
    under sole FinCEN supervision, but would eventually spread to
    all institutions.
        Funding such an exam team could be accomplished many ways,
    including (i) assessing financial institutions for examinations
    costs; \1\ or (ii) establishing a centralized team funded pro
    rata by each of the affected agencies but reporting directly
    and solely to the FinCEN Director.
    ---------------------------------------------------------------------------
         \1\ Existing statutory authority appears to allow for such an
    assessment and affected institutions should see a corresponding
    reduction in the assessment they currently pay to prudential regulators
    for supervision of this function. The Independent Offices Appropriation
    Act provides general authority for a Government agency to assess user
    fees or charges by administrative regulation, based on the value of the
    service to the recipient. See 31 U.S.C. 9701. OMB Circular No. A-25
    provides further guidance regarding ``user fees'' (``A user charge . .
    . will be assessed against each identifiable recipient for special
    benefits derived from Federal activities beyond those received by the
    general public.''). See OMB Circular No. A-25 Revised.

    Q.2. Is there a way to maintain a top-shelf effective AML/CFT
    policy while maintaining a commitment to increase access to
    financial products for the underbanked and immigrants who rely
    ---------------------------------------------------------------------------
    on remittance services?

    A.2. With respect to remittances, the current derisking trend
    is in part a reaction to Government and supervisory
    characterizations of correspondent banking as a high risk
    business and the evolving standards within the domestic and
    international community. \2\ The causes are clear--the systems,
    processes, and people required to manage examiner expectations
    for clients deemed to be of ``higher risk'', are extremely
    costly. While those who care about poverty or international
    development might conclude that the benefits of allowing
    remittances exceed the costs, in the form of potential money
    laundering, banking agencies in our experience have not
    undertaken such a cost-benefit analysis. Thus, they impose
    documentation requirements and expectations that make certain
    lines of business uneconomical.
    ---------------------------------------------------------------------------
         \2\ See ``The Great Unbanking: Swingeing Fines Have Made Banks Too
    Risk-Averse'', The Economist, July 6, 2017, available at
    www.economist.com/news/leaders/21724813-it-time-rethink-anti-money-
    laundering-rules-swingeing-fines-have-made-banks-too-risk-averse. See
    also ``A Crackdown on Financial Crime Means Global Banks Are
    Derisking'', The Economist, July 8, 2017, available at
    www.economist.com/news/international/21724803-charities-and-poor-
    migrants-are-among-hardest-hit-crackdown-financial-crime-means.
    ---------------------------------------------------------------------------
        We believe more research is warranted on how AML/CFT
    requirements affect the unbanked. Our understanding is that AML
    customer due diligence requirements are a substantial, perhaps
    majority, cost of opening an account. For low-dollar deposit
    accounts for lower income people, that can make the account
    difficult to offer and price.

    Q.3. I'm interested in the ways in which technology can aid AML
    compliance efforts. What are some of the innovative
    technologies that you've seen that hold some promise for either
    the Government or the private sector?
        What are the barriers to either the Government or the
    private sector adopting these technologies?
        What can we be doing as legislators to ensure that we
    promote technological innovation in this sector?

    A.3. Financial institutions are in the early stages of
    exploring various ways to apply technological innovations to
    AML/CFT efforts. In particular, artificial intelligence has the
    potential to improve the way that banks identify suspicious
    activity. AI does not search for typologies but rather mines
    data to detect anomalies. It gets progressively smarter; it
    won't be easily evaded; and different banks with different
    profiles would end up producing different outcomes.
        Our banks report that they are working to pilot AI
    solutions in this area, yet the experts that they need to work
    on these initiatives are instead required to validate their
    current programmatic processes to examiners. \3\ Furthermore,
    they lack feedback from the public sector on the BSA reports
    that they file--such feedback would assist institutions in
    tuning their systems to provide more targeted leads to law
    enforcement. Financial institutions need to be able to innovate
    their AML programs and coordinate that innovation with their
    peers. Yet, the most consequential impediment to innovation is
    the current regulatory structure as examiners focus on auditing
    banks' policies, processes, and metrics versus encouraging
    financial institutions to shift their resources to developing
    innovative methods of detecting financial crime. Banks will be
    reluctant to invest in systems unless someone in the Government
    can tell them that such systems will meet the banking
    examiners' expectations, and can replace old, outdated
    methods--in other words, that they will be rewarded, not
    punished, for innovation.
    ---------------------------------------------------------------------------
         \3\ Id.
    ---------------------------------------------------------------------------
        While there are instances where legislation is needed, in
    many cases agencies already have existing authority to address
    some of the concerns outlined during the hearing. For example,
    TCH believes that Treasury should take a more prominent role in
    coordinating AML/CFT policy and examinations across the
    Government, a step currently within their existing authority,
    to conduct a robust and inclusive annual or biennial process to
    establish AML/CFT priorities, which would form the basis for
    financial institution exams. Furthermore, we believe that
    FinCEN should retake exam authority for multinational, complex
    financial institutions, which is also within their current
    authorities. A dedicated FinCEN exam team for this small subset
    of large institutions could receive appropriate security
    clearances, meet regularly with law enforcement and other end
    users, receive training in big data analytics and work with
    other experts in Government. They, in turn, would be supervised
    by Treasury officials with law enforcement, national security,
    and diplomatic perspectives on what is needed from an AML/CFT
    program. This change would promote innovative and imaginative
    conduct that advanced law enforcement and national security
    interests, rather than auditable processes and box checking.
    Importantly, the benefits of a FinCEN examination function
    would extend well beyond the handful of institutions it
    examined. Innovation started at the largest firms, with
    encouragement from FinCEN, would inevitably benefit smaller
    firms. The result of FinCEN assuming some supervisory authority
    would be a massive cultural change, as the focus of exams
    shifted to the real-world effectiveness of each institution's
    AML/CFT program, rather than the number of SARs filed or number
    of policies written. That change would start with those banks
    under sole FinCEN supervision, but would eventually spread to
    all institutions.

    Q.4. The regulatory definition of ``financial institution'' has
    been expanded several times over the years, both by FinCEN
    rulemaking and by legislation by Congress.
        Should the definition of financial institutions be expanded
    to include other sectors? If so, which sectors?
        Could these changes be made via FinCEN rulemaking or should
    legislation be passed?

    A.4. As a general matter, the BSA/AML regime should be reviewed
    and its effectiveness investigated to account for the changing
    ways in which customers interact with bank and nonbanks and
    ensure that statutory authorities are adequately tailored to
    address the evolving nature of illicit finance threats.
        Such a review could be undertaken by Treasury without
    Congressional action, with recommendations on further
    administrative, legislative, or regulatory changes that need to
    be made to improve the efficiency and effectiveness of the AML/
    CFT regime.

    Q.5. In August 2017, FinCEN issued an advisory encouraging real
    estate brokers to share information with them that could be
    helpful in AML efforts, while noting they are not required to
    do so under current law.
        How do we increase information sharing between real estate
    brokers and FinCEN?
        Geographic Targeting Orders (GTOs), which impose additional
    record keeping and reporting requirements on domestic financial
    institutions or nonfinancial trades or businesses in a specific
    geographic area for transactions involving certain amounts of
    United States currency or monetary instruments, have been
    deployed since 2016 to target high-end real estate sectors in
    major metropolitan areas by requiring U.S. title insurance
    companies to identify the natural persons behind shell
    companies used to pay ``all cash'' for high-end residential
    real estate.
        Are GTOs an effective tool or would regulation be a
    preferable way to cover the real estate sector?

    A.5. As previously mentioned the AML/CFT regime should be
    reviewed and adequately tailored to address the evolving nature
    of illicit finance threats, including those in the real estate
    sector. There are substantial benefits to developing additional
    pathways, both formally and informally, for AML/CFT information
    sharing between various stakeholders in the public and private
    sector.
        While we are not privy to any data on the effectiveness of
    FinCEN's GTO program, when discussing money laundering in the
    real estate sector we would urge Congress to pass legislation
    that prohibits the forming of companies with anonymous
    ownership. Such companies can be used by criminals to ``mask
    their identities, involvement in transactions, and origins of
    their wealth, hindering law enforcement efforts to identify
    individuals behind illicit activity.'' \4\
    ---------------------------------------------------------------------------
         \4\ See FIN-2017-A003, ``Advisory to Financial Institutions and
    Real Estate Firms and Professionals'', August 22, 2017, available at
    www.fincen.gov/sites/default/files/advisory/2017-08-22/
    Risk%20in%20Real%20
    Estate%20Advisory_FINAL%20508%20Tuesday%20%28002%29.pdf.

    Q.6. Cryptocurrency exchanges are money services businesses
    supervised by State regulators and subject to Federal AML and
    CFT laws.
        Should FinCEN play an enhanced role in assessing the
    compliance of cryptocurrency exchanges, or are State regulators
    sufficiently equipped to handle compliance monitoring?
        What additional tools could we give regulators and law
    enforcement?
        How prevalent is money laundering in cryptocurrency
    markets?

    A.6. As a general matter, we believe that Treasury should take
    the lead in coordinating AML/CFT priorities and exams for all
    financial institutions, including cryptocurrency exchanges.
    Customers are using various tools to conduct transactions
    around the globe with bank and nonbank financial institutions
    and having one agency leading the regime would help coordinate
    disparate regulatory and law enforcement perspectives.
        In 2013, FinCEN issued guidance indicating that a
    cryptocurrency ``administrator or exchanger is an MSB under
    FinCEN's regulations, specifically, a money transmitter, unless
    a limitation to or exemption from the definition applies to the
    person.'' \5\ We also note that in the past few years, FinCEN
    has levied enforcement actions against cryptocurrency
    exchangers. While TCH is not privy to data on the extent of
    money laundering within virtual currencies, we note that others
    are beginning to look into this issue. \6\ Finally, in a recent
    speech, Treasury Under Secretary for Terrorism and Financial
    Intelligence Sigal Mandelker provided an example of
    cryptocurrencies being used for money laundering and terrorist
    financing stating that ``law enforcement authorities recently
    arrested a woman in New York who used Bitcoin to launder fraud
    proceeds before wiring the money to ISIS.'' \7\ As
    circumstances change AML/CFT authorities and requirements
    should be flexible and tailored enough to adapt to evolving
    threats.
    ---------------------------------------------------------------------------
         \5\ See FIN-2013-G001 ``Application of FinCEN's Regulations to
    Persons Administering, Exchanging, or Using Virtual Currencies'', March
    18, 2013, available at www.fincen.gov/sites/default/files/shared/FIN-
    2013-G001.pdf.
         \6\ For example, in January 2018, Yaya J. Fanusie and Tom Robinson
    published a memorandum on ``Bitcoin Laundering: An Analysis of Illicit
    Flows Into Digital Currency Services''. Available at:
    www.defenddemocracy.org/content/uploads/documents/
    MEMO_Bitcoin_Laundering.pdf.
         \7\ See U.S. Department of the Treasury Under Secretary Sigal
    Mandelker Speech before the Securities Industry and Financial Markets
    Association Anti-Money Laundering and Financial Crimes Conference,
    (Treasury Under Secretary Mandelker's 2018 SIFMA Speech), February 13,
    2018, available at home.treasury.gov/news/press-release/sm0286.
    ---------------------------------------------------------------------------
                                    ------

                   RESPONSES TO WRITTEN QUESTIONS OF
                  SENATOR CORTEZ MASTO FROM GREG BAER

    Q.1. Gaming and tourism are some of Nevada's top industries. In
    the State of Nevada, our gaming operators employ thousands of
    hard working Nevadans, and the industry as a whole domestically
    supports 1.7 million jobs across 40 States. Qualified casinos,
    like financial institutions, are also subject to Banking
    Secrecy Act requirements. Organizations within Nevada have
    suggested that gaming operators would welcome a review of BSA
    requirements, which they find to be burdensome. They look
    forward to this Committee's thoughtful, bipartisan, review of
    BSA requirements that takes into account the security
    imperative for robust anti-money laundering efforts, as well as
    the impact those requirements have on all industries. For
    example, the Suspicious Activity Report (SAR) ($5,000) and the
    Currency Transaction Report (CTR) ($10,000) levels were set
    years ago. Some have recommended increasing these to correspond
    with inflation. Others believe that would be too high but do
    support a higher amount than currently.
        One of the top priorities of the gaming industry is to
    remove the requirement for a detailed factual narrative for
    structuring in the suspicious activity forms. What do you think
    of this recommendation?

    A.1. We strongly support that recommendation. We note that when
    the SAR regime was implemented in the mid-1990s it was based on
    the concept of providing law enforcement a narrative analytical
    lead, but SARs are instead used today as a source for word
    searches and datamining by FinCEN and law enforcement. This is
    particularly true with respect to structuring. Our
    understanding is that the yield on structuring SARs is close to
    zero, as most cash transactions are entirely legitimate. Thus,
    resources invested in constructing a narrative is wasted. To
    the extent that datamining identifies a structuring transaction
    as truly suspicious, then law enforcement can contact the bank
    and obtain whatever detail is necessary.

    Q.2. Do you have specific recommendations regarding how the
    gaming industry can benefit from greater communication with
    Government agencies and law enforcement? Is there something the
    Federal Government can do to share information with casinos and
    others filing SARs about broad benefits that may occur because
    of some of the 58,000 SAR forms filed by gaming firms.
        Would the creation of a Qualitative Feedback Mechanism help
    reduce money laundering and terrorist financing? Should the
    Secretary of the Treasury establish a mechanism to communicate
    anti-money laundering (AML) and countering terrorism financing
    (CTF) priorities to financial institutions, gaming
    establishments and Federal financial regulators? Could such a
    mechanism provide qualitative feedback on information shared by
    financial institutions with the Department of Treasury,
    including CTRs and SARs? Please describe the pros and cons of
    such a system.

    A.2. There are substantial benefits to developing additional
    pathways, whether through a qualitative feedback mechanism or
    some other structure, for improved AML/CFT information sharing
    between various stakeholders in the public and private sector.
    As the Financial Action Task Force recently noted ``[l]ack of
    guidance and feedback by public sector authorities on
    information shared by the private sector may hinder private
    sector's ability to effectively monitor transactions and
    provide well-developed reports to FIUs . . . [and] may also
    impede or discourage information sharing between different
    private sector entities, or between private and public sectors,
    and vice versa, e.g., because regulatory expectations are
    unclear or because there is insufficient information available
    about risks.'' \1\
    ---------------------------------------------------------------------------
         \1\ See ``FATF Guidance: Private Sector Information Sharing'',
    November 2017, p.26, available at www.fatf-gafi.org/media/fatf/
    documents/recommendations/Private-Sector-Information-Sharing.pdf.
    ---------------------------------------------------------------------------
        For example, the absence of public sector feedback on SARs
    in the current regime is hindering financial institutions'
    ability to tune their systems to provide more targeted leads to
    law enforcement. Granting law enforcement and national security
    authorities opportunities to provide general feedback on the
    reports filed, and incorporating this feedback into supervisory
    evaluations of firms' compliance, could assist financial
    institutions in targeting their resources to efforts that
    provide information that is of the greatest use in preventing
    illicit financing.
        It would also be helpful if a pathway for sharing
    information were established to allow financial institutions to
    efficiently share raw data with law enforcement along with
    reforms to SAR and other BSA reporting requirements. As
    discussed in the TCH AML/CFT report, the current regime is
    built on individual, bilateral reporting mechanisms grounded in
    the analog technology of the 1980s, rather than the more
    interconnected and technologically advanced world of the 21st
    century. \2\ Therefore, providing such data in bulk would
    modernize the current regime and allow institutions to provide
    law enforcement with information in a timelier manner.
    Furthermore, it would allow law enforcement, using big data
    analytics, to effectively have access to and sift through large
    quantities of data more efficiently.
    ---------------------------------------------------------------------------
         \2\ See The Clearing House, ``A New Paradigm: Redesigning the U.S.
    AML/CFT Framework To Protect National Security and Aid Law
    Enforcement'', (TCH AML/CFT Report), February 2017, available at
    www.theclearinghouse.org//media/TCH/Documents/TCH%20WEEKLY/2017/
    20170216_TCH_Report_ AML_CFT_Framework_Redesign.pdf.
    ---------------------------------------------------------------------------
        Further coordination and information sharing between and
    among public sector authorities is also critical to
    establishing AML/CFT priorities and providing an overarching
    purpose for the regime. Therefore, TCH recommends that Treasury
    take a more prominent role in coordinating AML/CFT policy and
    examinations across the Government and conduct a robust and
    inclusive annual or biennial process to establish AML/CFT
    priorities and provide an overarching purpose for the regime.
    This is particularly important in the U.S. where law
    enforcement, national security, and financial institution
    oversight responsibilities are dispersed among multiple
    agencies. This stands in contrast to other approaches (e.g.,
    the U.K.'s Joint Money Laundering and Intelligence Task Force
    (JMLIT)) that better address barriers to information sharing by
    bringing together relevant actors to share information as well
    as allowing financial institutions to follow-up on SAR
    activity, thereby potentially improving the effectiveness of
    financial institution reporting mechanisms.

    Q.3. The Office of the Comptroller of the Currency mentioned in
    its 2018 Banking Operating Plan that financial institutions
    should not inadvertently impair financial inclusion. But, as of
    September 2017, the OCC has not identified any specific issues
    they plan to address. We know that derisking has become an
    epidemic across many communities and industries, such as
    communities along the Southwest border, humanitarian
    organizations aiding Nations wracked with violence, and
    remittances providers that serve fragile Nations like Somalia.
        What type of guidance could the OCC, FinCEN, FDIC, and the
    Federal Reserve provide to help banks meet the banking needs of
    legitimate consumers and businesses that are at risk of losing
    access--or have already lost access?

    A.3. The current derisking trend is in part a reaction to
    Government and supervisory characterizations of correspondent
    banking as a high risk business and the evolving standards
    within the domestic and international community. \3\ The causes
    are clear--the systems, processes, and people required to
    manage examiner expectations for clients deemed to be ``higher
    risk'' are extremely costly. For example, a bank may prepare a
    lengthy report on a customer only to be criticized for not
    further documenting the grounds on which it decided to retain
    the customer. Institutions are therefore required to make
    difficult decisions, because it is often times too expensive to
    build out this infrastructure to support higher risk accounts.
    And this does not even include the risk of massive fines and
    reputational damage in the event a customer designated high-
    risk actually commits a criminal act.
    ---------------------------------------------------------------------------
         \3\ See ``The Great Unbanking: Swingeing Fines Have Made Banks Too
    Risk-Averse'', The Economist, July 6, 2017, available at
    www.economist.com/news/leaders/21724813-it-time-rethink-anti-money-
    laundering-rules-swingeing-fines-have-made-banks-too-risk-averse. See
    also ``A Crackdown on Financial Crime Means Global Banks Are
    Derisking'', The Economist, July 8, 2017, available at
    www.economist.com/news/international/21724803-charities-and-poor-
    migrants-are-among-hardest-hit-crackdown-financial-crime-means.
    ---------------------------------------------------------------------------
        Similarly, domestically, banks of all sizes report that
    customer due diligence (CDD) requirements have dramatically
    increased the cost of opening new accounts, and now represent a
    majority of those costs. Of course, disproportionate and
    heightened account opening requirements make low-dollar
    accounts for low- to moderate-income people much more difficult
    to offer and price. While the connection is not immediately
    apparent, AML/CFT expense now is clearly an obstacle to banking
    the unbanked, and a reason that check cashers and other forms
    of high-cost, unregulated finance continue to prosper. The
    problem, of course, is that bank examiners do not internalize
    those costs. And those in the Government who do internalize
    those costs play no role in examining the performance of
    financial institutions.
        As noted in my testimony, TCH believes that Treasury should
    take a more prominent role in coordinating AML/CFT policy and
    examinations for the regime. That includes convening on a
    regular basis the end users of BSA data--law enforcement,
    national security, and others affected by the AML/CFT regime
    including the State Department--and setting goals and
    priorities for the system. Treasury is uniquely positioned to
    balance the sometimes conflicting interests relating to
    national security, the transparency and efficacy of the global
    financial system, the provision of highly valuable information
    to regulatory, tax and law enforcement authorities, financial
    privacy, financial inclusion, and international development.
        In addition, while the AML/CFT regime is supposed to be
    risk-based, particularly in the context of correspondent
    banking relationships, it is instead perceived as being ``zero
    miss or tolerance.'' Supervisors must reaffirm the risk-based
    nature of the regime and make clear that isolated failures to
    identify potentially suspicious activity should not call into
    question a bank's entire BSA/AML/OFAC compliance framework.
    Furthermore regulators should continue to clarify correspondent
    banking and other regulatory expectations and should provide
    banks with greater certainty that the banks' good-faith
    application of clear regulatory guidance and expectations will
    ensure that banks are found by their regulators and auditors to
    be in compliance with those requirements.

    Q.4. Last year, the Countering Iran's Destabilizing Activities
    Act of 2017 (P.L. 115-44) was enacted. In Section 271, it
    required the Treasury Department to publish a study by May 1,
    2018, on two issues:
        Somali Remittances: The law required the U.S. Department of
    Treasury to study if banking regulators should establish a
    pilot program to provide technical assistance to depository
    institutions and credit unions that wish to provide account
    services to money services businesses serving individuals in
    Somalia. Such a pilot program could be a model for improving
    the ability of U.S. residents to make legitimate funds
    transfers through easily monitored channels while preserving
    strict compliance with BSA.
        Sharing State Banking Exams: The law also required Treasury
    to report on the efficacy of money services businesses being
    allowed to share certain State exam information with depository
    institutions and credit unions to increase their access to the
    banking system.
        Have you or your organization been involved with these
    Treasury studies?

    A.4. TCH has not received a request to participate in this
    study.

    Q.5. What advice did you give--or would you give--on the pilot
    studies?

    A.5. We encourage the Treasury Department to solicit input from
    the industry on each of these studies to ensure that any
    recommendations incorporate private sector perspectives.

    Q.6. In 2016, William and Margaret Frederick were moving from
    Ohio to Las Vegas. Unfortunately, it is alleged that the title
    company they used in Columbus, Ohio, fell for an email scam and
    wired the $216,000 profit from their home sale to a hacker, not
    to the Fredericks. William is 83 and Margaret is 75 and as of
    October, they were still trying to get their money back. While
    the Fredericks' tale is now a court case to determine who was
    responsible for the fraudulent information, we know that the
    Fredericks' experience is ``very typical'' of scams that divert
    an estimated $400 million a year from title companies into
    bogus accounts.
        Please describe the responsibilities of financial firms to
    avoid these frauds?
        What penalties should be assessed and by which agencies
    when financial firms enable theft?
        What is the role for the Consumer Financial Protection
    Bureau to ensure financial firms protect their customers' money
    and information?

    A.6. Wire transfers are a ``push'' payment in which a bank
    customer instructs its bank to pay another party. Under the law
    that applies to wire transfers, Uniform Commercial Code Article
    4A, a bank is liable for losses resulting from unauthorized
    wire transfer instructions unless the bank and its customer
    have entered into a commercially reasonable security procedure
    agreement and the bank follows those procedures when it
    receives instructions. Generally banks enter into these
    agreements with their customers and have security procedures in
    place to verify that instructions are in fact the instructions
    of their customer.
        In the unfortunate case described above, the instruction
    from the title company was authorized. However, the title
    company had been deceived, through means outside of the bank's
    control, into paying the wrong party. Legally it is not the
    bank's responsibility to determine if its customer has been
    deceived into paying a fraudulent actor. However, banks do not
    want their customers to be victims of fraud. In response to the
    increase in fraud attacks on their corporate and institutional
    customers banks have conducted extensive educational campaigns
    using in-person sessions, webinars, and conference calls to
    alert customers to fraud schemes and the steps customers can
    take to avoid fraud losses. These measures that customers are
    encouraged to take include verifying the authenticity of email,
    telephone, or other communications before relying on those
    communications to instruct wire transfers. Failure to take
    these precautions can result in a customer's authorized wire
    transfer instruction to its bank that is based upon information
    received from a criminal.

    Q.7. In 2014, FinCEN issued an advisory with human trafficking
    red flags, to aid financial institutions in detecting and
    reporting suspicious activity that may be facilitating human
    trafficking or human smuggling.
        To what extent do you assess that financial institutions
    are currently utilizing these red flags, in order to better
    assess whether their banks are being used for to finance human
    trafficking? If institutions are not widely utilizing the red
    flags, what actions is FinCEN taking to encourage them to do
    so?

    A.7. As previously discussed, TCH recommends that Treasury set
    AML/CFT priorities for the regime to assist financial
    institutions as they work to provide leads to law enforcement--
    including on human trafficking. \4\
    ---------------------------------------------------------------------------
         \4\ We note that the U.K.'s Joint Money Laundering Intelligence
    Taskforce (JMLIT) has established operational priorities for its
    public-private sector information sharing partnership
    www.nationalcrimeagency.gov.uk/about-us/what-we-do/economic-crime/
    joint-money-laundering-intelligence-taskforce-jmlit.
    ---------------------------------------------------------------------------
        Financial institutions around the globe are proactively
    working among themselves and with the public sector to disrupt
    human trafficking networks. In a 2016 Financial Times op-ed,
    Standard Chartered's Group General Counsel discussed the need
    for enhanced public-private sector sharing, noting that
    presentations from NGOs and Government agencies ``have improved
    banks' ability to detect potentially [human trafficking]
    related financial transactions. In turn, they have helped law
    enforcement disrupt trafficking networks.'' \5\ Such movements
    are also underway in the United States. \6\
    ---------------------------------------------------------------------------
         \5\ See Financial Times op-ed by David Fein, ``How To Beat the
    Money Launderers: Banks Must Work With Governments To Combat This
    Scourge'', November 22, 2016, available at www.ft.com/content/569c2e26-
    adb9-11e6-ba7d-76378e4fef24.
         \6\ See TCH Banking Perspectives article by Juan C. Zarate and
    Chip Poncy, ``Designing a New AML System'', Q3 2016, available at
    www.theclearinghouse.org/research/banking-perspectives/2016/2016-q3-
    banking-perspectives/a-new-aml-system.
    ---------------------------------------------------------------------------
        Furthermore, the U.K.'s Royal United Services Institute
    published a report in 2017 on the role financial institutions
    play in disrupting human trafficking. It studied efforts in
    both the U.K. and U.S. and notes the following: (i) the 2016
    Dow Jones and ACAMS Global Anti-Money Laundering Survey found
    that ``nearly 70 percent of respondents report their
    organizations have modified AML training and/or transaction
    monitoring to incorporate human trafficking and smuggling red
    flags and typologies,'' with heavy U.S. participation in that
    survey; (ii) financial institution approaches to disrupting
    human trafficking networks are mixed as some adapt alerts and
    guidance; others create bespoke algorithms; and others utilize
    other sources of information such as law enforcement inquiries
    or negative media alerts; and (iii) many financial institutions
    are proactively investigating historic transaction records
    rather than relying on real-time monitoring as it may not be as
    effective in detecting potential trafficking. \7\
    ---------------------------------------------------------------------------
         \7\ See Tom Keating and Anne-Marie Barry, ``Disrupting Human
    Trafficking: The Role of Financial Institutions'', Whitehall Report 1-
    17, Royal United Services Institute for Defence and Security Studies,
    March 2017, available at rusi.org/sites/default/files/
    201703_rusi_disrupting_human_trafficking.pdf.
    ---------------------------------------------------------------------------
        The report also notes that barriers to financial
    institutions' efforts to combat human trafficking include: (i)
    difficulties with automating triggers as most human
    trafficking-specific signals are similar to normal commercial
    activity; \8\ (ii) concerns from financial institutions that
    they receive no regulatory credit for their efforts and instead
    will be penalized or censured; (iii) the diverse number of
    financial institutions and payment methods, in multiple
    jurisdictions, over which such high volume and small
    denomination activity can occur which makes it difficult to
    detect without law enforcement leads and greater information
    sharing; and (iv) the lack of formal law enforcement feedback
    as well as coordinated law enforcement-endorsed efforts to
    address human trafficking.
    ---------------------------------------------------------------------------
         \8\ FinCEN implicitly acknowledges this in their 2014 human
    trafficking advisory when it says ``financial institutions may consider
    incorporating [FinCEN's red flags] into their monitoring programs. In
    applying these red flags, financial institutions are advised that no
    single transactional red flag is a clear indicator of human smuggling
    or trafficking-related activity.'' See www.fincen.gov/resources/
    advisories/fincen-advisory-fin-2014-a008.
    ---------------------------------------------------------------------------
        As a general matter, the USA PATRIOT Act's Section 314(b)
    private sector information sharing provisions have reportedly
    been useful in addressing human trafficking and other crimes.
    \9\
    ---------------------------------------------------------------------------
         \9\ See Testimony of William J. Fox before the U.S. House
    Financial Services Subcommittees on Financial Institutions and Consumer
    Credit and Terrorism and Illicit Finance, November 29, 2017, available
    at financialservices.house.gov/uploadedfiles/hhrg-115-ba15-wstate-wfox-
    20171129.pdf.

    Q.8. What are the pros and cons of reducing or eliminating the
    standards requiring SARs filing for insider abuse (i.e.,
    employee misconduct)?
        The common expectation is that any financial institution
    subjected to a cyberattack would be in touch with law
    enforcement about whether or not it's required to file an SAR.
    What are the pros and cons of eliminating SAR filing
    requirement for cyberattacks against financial institutions?

    A.8. While we do not support eliminating SAR filings in all
    insider abuse cases, we do believe that those filing
    requirements should be further tailored, perhaps by making them
    subject to the same dollar thresholds as other submissions. We
    believe that this would allow firms to shift resources away
    from investigating activity that, even if it proved criminal,
    would almost certainly never be prosecuted, and towards
    innovative efforts to detect more serious offenses. We cannot
    think of a ``con'' for this change.
        Similarly, with respect to cyber, we presume that cyber SAR
    filings are of little to no utility, for the reasons you state.
    However, we would strongly urge the Committee to confirm this
    impression with law enforcement or FinCEN--that is, by asking
    them whether there are investigations where a SAR filing, as
    opposed to direct engagement with the firm, helped make a case.

    Q.9. Most of the cost of regulatory compliance for financial
    institutions has been in the BSA/AML area. Yet, when we talk of
    simplifying regulations for community banks, we have not
    addressed this issue even though our banks and credit unions
    tell us this is the most costly and complex.
        Can you give a percent of staff resources invested in AML/
    BSA compliance for financial institutions of less than $50
    billion in assets?

    A.9. BSA/AML reform would benefit institutions of all sizes. In
    2017, TCH testified before the House with a community banker
    who reported that his three-branch bank has four lending
    officers and six AML compliance officers. While TCH represents
    25 large commercial banks, the regime is no more rational for
    smaller banks. \10\
    ---------------------------------------------------------------------------
         \10\ See Testimony of Lloyd DeVaux before the House Financial
    Services Committee Subcommittee on Financial Institutions and Consumer
    Credit, June 28, 2017, available at financialservices.house.gov/
    uploadedfiles/hhrg-115-ba15-wstate-ldevaux-20170628.pdf.
    ---------------------------------------------------------------------------
                                    ------

            RESPONSES TO WRITTEN QUESTIONS OF SENATOR BROWN
                         FROM DENNIS M. LORMEL

    Q.1. Strengthening Financial Intelligence Tools--You have
    studied the financial underpinnings of recent terrorist
    attacks, like the 2017 attack in Manchester, England, where a
    suicide bomber killed 22 people and injured more than 100.
    Investigations in the aftermath of that event led to the arrest
    of a network of at least 15 more suspects. At the time, you
    wrote it was unlikely our current AML and terror finance
    regimes could have alerted U.K. or U.S. authorities to this
    type of attack.
        What specific financial intelligence tools should we
    strengthen to detect and disrupt the planning and finance of
    such attacks? Is our current response capability sufficiently
    joined up, both within the United States and with key allies,
    so that key financial evidence is swiftly identified and shared
    with relevant law enforcement authorities?

    A.1. In attacks like Manchester, it is extremely unlikely that
    financial institutions would generate alerts through
    transaction monitoring because the banking activity of most of
    the individuals involved would usually not raise any suspicion
    to cause an alert. The funding flowing through the account,
    particularly for homegrown violent extremists would be
    generated by their employment compensation, entitlement funds,
    or other sources that would usually not raise suspicion. If
    they were engaged in criminal activity, there would be more
    likelihood this type of funding might generate an alert as
    being potentially suspicious but that would be contingent on
    the funding flow. These types of individuals, for the most
    part, want to avoid detection. It's usually not until after the
    event occurs, when names are reported in the media that
    financial institutions would identify transactional activity or
    account relationships through name identification of the
    negative news.
        I've written a number of articles with different ideas
    about identifying terrorist financing. It's extremely
    difficult. I'm happy to forward a sampling of the articles to
    provide more context. The problem is most people, including
    individuals working in financial institutions do not adequately
    understand the funding flows nor are they familiar with
    terrorist financing typologies. We tend to look at terrorist
    financing more generically and do not visualize sources of
    funds, methods of moving funds or how terrorists access funds.
    I believe there are three funding streams with numerous
    variations of the three primary funding streams.
        I believe U.S. law enforcement and their international law
    enforcement do a good job of sharing and exchanging
    information. Law enforcement does not do as good a job sharing
    information with financial institutions. Part of the problem is
    a lack of capacity. Part of the problem is a good deal of
    information cannot be shared do to considerations to include
    grand jury secrecy and classified information. I have been a
    proponent for providing security clearances to select personnel
    in financial institutions dating back to when I formed and ran
    the Terrorist Financing Operations Section (TFOS) at the FBI.
    In fact, I recommended that the 9/11 Commission recommend that
    security clearances should be granted to bankers. They did not
    concur with this. I am still a firm believer that security
    clearances would lead to better information sharing.
        Financial institution AML personnel are very dedicated to
    identifying money laundering and terrorist financing.
                                    ------

            RESPONSES TO WRITTEN QUESTIONS OF SENATOR SASSE
                         FROM DENNIS M. LORMEL

    Q.1. I'd like to understand better the law enforcement context
    for the U.S.'s efforts to fight money laundering.
        Does the U.S. financial system substantially--even if
    inadvertently--facilitate human trafficking?

    A.1. The U.S. financial system does facilitate human
    trafficking. The financial system also serves as a detection
    mechanism. I conduct a lot of AML training, speak frequently at
    AML and terrorist financing conferences and write articles
    published mostly by the Association of Certified Anti-Money
    Laundering Specialists (ACAMS). I make the point that financial
    institutions are either facilitation tools or detection
    mechanisms. I stress that we need to do more to enhance
    detection and limit facilitation.
        I believe that AML compliance professionals are dedicated
    to identifying money laundering and especially for heinous
    crimes such as human trafficking. In my response to Senator
    Cortez Masto's questions, I spoke about proactive initiatives
    certain financial institutions have taken in partnership with
    law enforcement. Below is the answer I provided which puts
    context around my comment above about public-private
    partnerships.
        The Association of Certified Anti-Money Laundering
    Specialists (ACAMS) has made human smuggling a long time
    priority. They started a working group in 2010 with a group of
    major banks and Homeland Security Investigations. Bank analysts
    and Homeland Security Investigations analysts developed
    patterns of activity or typologies consistent with human
    smuggling. JPMorgan Chase had a team of special investigators
    who conducted targeted transaction monitoring and identified
    potential suspicious activity. ACAMS gave JPMorgan Chase and
    Homeland Security a special award in recognition of their
    outstanding collaboration. Another outstanding example of
    public-private sector partnerships occurred in January 2018, in
    the run up to the Super Bowl. The ACAMS Minneapolis Chapter
    held a half-day long learning event focused entirely on human
    slavery/trafficking. I was proud to be the first speaker. U.S.
    Bank, Homeland Security Investigations, and the U.S. Attorney's
    Office in Minneapolis collaborated to develop typologies to
    identify human sex trafficking specifically related to travel
    for the Super Bowl. These types of initiatives have a great
    impact on crime problems like human trafficking. I must give a
    cautionary comment, that this type of initiative is not as easy
    as it sounds. It can be costly; there are regulatory concerns
    and other impediments that must be overcome. The September
    issue of ACAMS Today magazine had a detailed article about the
    Minneapolis learning event. I would be happy to provide a copy
    of ACAMS Today if you'd like one.

    Q.2. What about terrorism?

    A.2. Like money laundering for human trafficking, financial
    institutions serve as either facilitation tools or detection
    mechanisms for terrorist financing. It is easier to develop
    typologies and red flags for human trafficking and other crimes
    than it is for terrorist financing. That is one reason I spend
    a considerable amount of my time teaching and writing about
    terrorist financing. Terrorist financing is very complex and
    multifaceted. I believe there are three basic funding streams
    and many variations of the three funding streams. What also
    needs to be considered is who you are dealing with,
    organizations or individuals. I have a great deal of content in
    terms of power point presentations and articles providing
    greater detail that I'm happy to share.
        AML professionals are vigilant and would like to identify
    potential terrorist financing but generally, they do not
    understand terrorism or the funding flows to be concerned about
    and how it impacts their institutions. This is not for a lack
    of trying. It's an extremely complex issue. I encourage
    financial institutions to form specialized investigations
    teams, analogous to law enforcement SWAT teams to address
    issues like terrorist financing, human trafficking and
    transnational criminal organizations, as you inquire about
    below. One of the problems we have in AML compliance is that we
    are inherently reactive. The more we can be ``urgently''
    reactive and to the extent we can be proactive, the more
    detective and disruptive we can be.

    Q.3. What about drug cartels and violent gangs such as MS-13?

    A.3. I would characterize drug cartels, violent gangs, and
    organized crime organizations as either transnational criminal
    organizations or domestic criminal organizations. Either way,
    they would operate locally, regionally, and/or globally. Again,
    financial institutions serve as facilitation tools or detection
    mechanisms. Here, one of my principal concerns is the nexus
    between transnational criminal organizations and terrorist
    groups. I refer to this as the problem of convergence and
    diversification. Criminal and terrorist groups converge to act
    together in criminal activity or to share the same supply
    chains and channels for shipping illicit goods and for human
    smuggling and trafficking. As these hybrid operations mature,
    they diversify into more seemingly legitimate activity. This is
    where public-private partnerships become more important and
    meaningful.

    Q.4. Can you walk me through a typical case, either as an agent
    or as a field manager, where you used financial intelligence,
    such as suspicious activity reports, to catch these sort of
    criminals?

    A.4. Senator, thank you for this question because it goes to
    the heart of my January 9th written and oral testimony. Every
    day, law enforcement uses BSA data, either in the form of SARs,
    CTRs, 8300s, or other BSA data, to predicate or enhance
    criminal investigations. I just attended the West Coast AML
    Forum annual conference in San Francisco (May 2-4, 2018). Three
    separate law enforcement case studies were presented that were
    built on SARs, CTRs, 8300s, and other BSA data. One case
    revolved around Ponzi schemes, one around Asian Organized
    Crime, and one around dark web internet sites selling illicit
    goods, including synthetic opioids. They were very compelling
    presentations demonstrating the importance of building evidence
    around BSA data. In addition to those presentations, I gave a
    presentation on terrorist financing and stated that the FBI
    relies extensively on SARs and CTRs for terrorist financing
    investigations.
        To more directly answer your question, as a hypothetical,
    as a law enforcement agent I receive a SAR about an investment
    fraud. I would run the subject name(s) and collateral
    identifying data through the SAR database and through my
    agency's investigative indices. I may or may not get additional
    hits. However, if it's an investment fraud, it most likely will
    have multiple victims, perhaps through multiple financial
    institutions. I would contact the financial institution(s)
    filing the SAR(s) and request the SAR decision documentation. I
    would attempt to establish predicating information to open a
    case to present to a prosecutor. I would get grand jury
    subpoenas for bank account records and begin my investigation
    to ``follow the money.'' As I proceed, it is likely I'll
    identify CTRs and additional SARs. Through bank account
    analysis, I'll likely identify other bank and credit card
    accounts and continue to build my links to co-conspirators. I'd
    continue to build financial evidence along with other evidence
    to include audio and video recordings, surveillance, interviews
    and other investigative steps to build my case. Often times an
    investigation as I'm describing could lead to an opportunity to
    establish an undercover operation where the undercovers provide
    money laundering services to the bad guys. I would continue to
    build my case to obtain an indictment and sustain a
    prosecution. At every step in the process, financial record and
    BSA data will be essential elements of the case.
        I used SAR and CTR information in terrorist financing
    following 9/11 for purposes of developing strategic
    intelligence about current and emerging trends. We established
    a datamining initiative where we used SAR and CTR information
    with other buckets of information to develop said strategic
    intelligence. I believe that capability is more robust today
    than in the 2001-2003 timeframe.
        In training presentations I give regarding SARs, I have a
    flow chart about the lifecycle of a SAR. I would be happy to
    provide it to you and to provide a demonstration or
    explanation.

    Q.5. At the FBI, what percentage of the time would you estimate
    that unique leads are generated from AML tools, such as
    suspicious activity reports and currency transaction reports?

    A.5. I cannot give you a definitive answer of the current
    status of how SAR and CTR data is used at the FBI today. When I
    was Chief of the Terrorist Financing Operations Section (TFOS),
    following its formation and through 2003, we checked for and/or
    used SAR and CTR data extensively. One of the processes we
    established was that all terrorism cases had a financial sub-
    file and that SAR and CTR checks were made. Between December
    2000 and 9/11, while I was Chief of the Financial Crimes
    Section, we had an analyst checking the SAR database on a daily
    basis to find SARs we could take actionable steps with. We also
    had a pilot program regarding money laundering and running
    through the SAR database for SARs we could predicate
    investigations with and refer out to field offices. I
    participate in bank working group outreach meeting that TFOS
    has with financial institutions a few times a year. TFOS
    leaders discuss how SARs are used for their investigative
    targeting in terrorism cases. Although I cannot provide
    information about how other divisions within the FBI use SARs
    and CTRs, my sense is they are widely used. The FBI has a cadre
    of forensic accountants that work throughout the criminal and
    counterterrorism programs. My expectation is they regularly
    rely on BSA data in their financial investigations.

    Q.6. What should our risk tolerance be for the fact that the
    U.S. financial system facilitates crimes like human
    trafficking? Should we strive to have zero incidence of money
    laundering in our financial system?

    A.6. The Bank Secrecy Act specifically states that financial
    institutions have AML programs that are ``reasonably designed''
    to identify and report suspicious activity. With the volume of
    transactions that take place on a daily basis it is impossible
    to identify all suspicious activity. Having a reasonably
    designed program is the appropriate standard. In a perfect
    world, we could consider a zero tolerance for money laundering
    standard. However, in the real world, that is an impossible
    standard. We should always strive to improve transaction
    monitoring and rely more on innovation to improve the detection
    versus facilitation capabilities. In my view, ensuring that
    financial institutions develop and maintain ``reasonably
    designed'' AML standards is appropriate.

    Q.7. I'd like to understand better how technological innovation
    is transforming the fight against money laundering and how
    Government policy can help or hurt these efforts.
        In the health care context, I hear about how researchers
    have used machine learning and artificial intelligence to
    identify diseases and predict when they will occur, using data
    points that humans would have never put together. How have
    financial institutions or law enforcement officials been able
    to use of similar techniques to identify money laundering and
    how much more progress can be made in this front?

    A.7. I believe we need to embrace technology and use
    technological advances to better monitor for suspicious
    activity and to support criminal investigations. In the last
    few years, technology has been greatly enhances. We should be
    exploiting technology as much as we can to enhance monitoring
    and investigative capabilities. We need to ensure the legal and
    regulatory framework is in place to support technology. We must
    also ensure that individual privacy rights are not abused. I'm
    not a technology expert. I would encourage the Committee to
    hold hearings and briefings with technology experts and privacy
    rights advocates to determine what technologies can be
    exploited in a legal framework.
        I would also note, that no matter how advanced machine
    learning and artificial intelligence become, we will always
    need humans to conduct investigations and to make the decisions
    on filing SARs and other BSA decisions.

    Q.8. Outside of AI and machine learning, how can recent FinTech
    innovations such as blockchain fight money laundering?

    A.8. As I noted above, I am not an IT expert. However, FinTech
    needs to be included in the discussion about improving the
    effectiveness and efficiency of AML reporting requirements. I
    believe blockchain is only going to gain momentum and become
    more mainstream. We need to take a step back and better
    understand blockchain and accountability regarding blockchain
    and other emerging technology. I honestly believe, in listening
    to experts familiar with blockchain, that blockchain can be a
    tool to fight money laundering.

    Q.9. What regulatory requirement or requirements--if any--most
    hinders the adoption of technological innovations?

    A.9. As I noted above, I am not an IT expert. I'm not sure if
    it's a regulatory problem as much as a cost consideration.
    Regardless of cost considerations, the problem is not
    regulations. Rather it is the regulators and the lack of
    clarity and leadership by regulators concerning regulatory
    expectations. My sense is financial institutions are concerned
    about potential regulatory consequences they may face for
    enhancing technology. There is concern that if new innovations
    will result in criticism that the older technology will be
    criticized for not having picked up the same level of alerts
    causing them to have to look back for potential suspicious
    activity perceived to be missed. At the ACAMS AML Conference
    held in Hollywood, Florida, from April 9-11, 2018, during a
    regulator panel, one regulator advised that if financial
    institutions upgraded their transaction monitoring system, they
    should run the two systems in parallel for a period of time to
    ensure that if one system generates more alerts, the other is
    assessed to see if it missed alerts. That's a cause for concern
    for two reasons, cost and perceived regulatory action against
    the financial institution. This is a deterrent and not an
    incentive to enhance technology.

    Q.10. How much does bitcoin, blockchain, and other
    cryptocurrencies facilitate money laundering? How--if at all--
    should this impact our approach to combating money laundering
    in traditional banks? How can law enforcement officials best
    stop this newer form of money laundering?

    A.10. As bitcoin, blockchain, and other cryptocurrency continue
    to emerge and gain popularity and usage, it will grow as a
    money laundering challenge. The initial reaction to bitcoin,
    blockchain, and other cryptocurrency, and its attractiveness to
    money launderers and criminals was its perceived anonymity.
    Experts have demonstrated that is not true and that they can
    identify people engaging in bitcoin and other cryptocurrency
    transactions. This is a money laundering deterrent. However,
    the more bitcoin and other cryptocurrencies are used, and the
    more they can be used in cash like manners, the more prevalent
    the money laundering challenge will become. Part of the problem
    is the extent to which the dark net can be used and the level
    of anonymity that bad guys can develop and exploit.

    Q.11. I'd like to discuss Suspicious Activity Reports (SARs).
    Today, around 2 million SARs are filed each year. While every
    SAR used to be read by law enforcement officials, that is no
    longer the case today. Financial institutions often complain
    that they rarely, if ever, receive feedback from law
    enforcement officials on the utility of any particular
    suspicious activity report that they file. This lack of
    feedback loops increases the burdens on financial institutions,
    who continue to file SARs that are of little utility to law
    enforcement officials. It also prevents financial institutions
    from developing better analytical tools to more precisely
    discern between the signal and the noise.
        What percentage of SARs are actually read by someone in law
    enforcement?

    A.11. First, to the statement above, the number of SARs read by
    law enforcement and feedback regarding SARs are two separate
    issues and should not be compared with each other or considered
    a metric for whether law enforcement reviews SARs.
        I cannot give a precise percentage for how many SARs are
    reviewed by law enforcement but based on my experience I
    confidently believe a very high percentage of SARs, if not all
    SARs, are reviewed in some fashion. At a macro level, a program
    level or for strategic purposes the FBI, IRS, and FinCEN
    possess analytics and/or datamining initiatives that scrub all
    SAR data. At the grassroots or field office level SARs that
    fall into the grassroots or field office jurisdictions
    throughout the U.S. are reviewed. I believe that most, if not
    all, SARs receive at least a cursory manual review. I think
    there are 94 U.S. Attorney's Offices (USAOs) in the U.S. Each
    USAO has at least one SAR review team. SAR review teams are
    composed of agents from Federal law enforcement agencies in
    each jurisdiction, most prominently IRS and FBI agents and/or
    analysts. In addition, field office personnel or State and
    local law enforcement review certain SARs independent of the
    SAR review teams. As an example, the Manhattan District
    Attorney's Office has a SAR review team. I'm confident that
    most, if not all, SARs are reviewed by law enforcement.

    Q.12. How often do financial institutions receive feedback from
    law enforcement officials as to the utility of their SAR
    filing?

    A.12. Feedback from law enforcement to financial institutions
    regarding the value of SARs is problematic. I have frequently
    heard the same complaint from financial institutions. As noted
    above, the lack of feedback does not mean SARs were not
    reviewed or that SARs did not predicate and/or enhance law
    enforcement investigations. In response to the frustration on
    the part of financial institutions about the lack of SAR
    feedback, I always make it a point when I provide training to
    AML professionals to discuss how important SARs are to law
    enforcement. I also include in my presentations a flow chart I
    developed regarding the lifecycle of a SAR. As I mentioned in
    an earlier response to one of your questions, I'd be happy to
    provide the flow chart to you.
        When I was the Chief of TFOS in the FBI, I frequently met
    with then FinCEN Director James Sloan. We often spoke about
    developing a consistent feedback mechanism for financial
    institutions but were unable to develop an adequate mechanism
    to do so. There are a number of inherent impediments to
    establishing a feedback mechanism. Such include the nature of
    criminal investigations. From the point a SAR is filed to the
    point a case is concluded, it could be a period of one or more
    years. If a case is a Grand Jury investigation, information
    cannot be disclosed by law enforcement. Law enforcement lacks
    the resources to consistently provide feedback. There are
    always new cases to move forward with and investigators don't
    have time to provide feedback. Impediments aside, they are no
    excuse for not providing feedback. I believe a feedback
    mechanism should be developed and implemented through FinCEN
    initiated by law enforcement. I concur with your comment that a
    SAR feedback mechanism would improve the quality of SAR
    submissions. I also believe that a SAR feedback would improve
    the morale of AML professionals who are involved in the SAR
    process. They would have a greater sense of accomplishment and
    satisfaction that their work contributes to law enforcement
    successes. Make no mistake; SARs play a significant role in
    investigations.

    Q.13. While some have proposed reducing the number of SARs and
    CRT filings because they are often superfluous and are never
    read, others argue that this poses risks, because investigating
    minor infractions may still lead to significant law enforcement
    successes. How should policymakers resolve this conflict?

    A.13. Having been the direct beneficiary of SARs and having
    used SARs at the program or macro level for strategic analysis,
    I'm a strong proponent that more SARs and CTRs are better.
    Agents who manually review SARs at the grassroots level would
    probably opine that less is better. In any event, a disparate
    SAR that may not have a high financial loss from a consumer
    fraud or elderly fraud may likely be identifiable with similar
    SARs. When those SARs are aggregated, what was an insignificant
    fraud could escalate into a massive fraud case. I think policy
    makers should take a serious look at this issue. There are
    merits to both arguments. My opinion is there is more merit to
    not reducing the number of SARs filed, especially by increasing
    SAR thresholds. I am definitely staunchly against that
    alternative.

    Q.14. How could regulators (1) set up better feedback loops
    between financial institutions and law enforcement officials
    that could help financial institutions better identify money
    laundering; and (2) empower financial institutions to act upon
    their improved ability to distinguish between useful and
    superfluous reports, including by filing fewer unnecessary
    SARs, without fearing regulatory consequences for doing so?

    A.14. I do not believe regulators should have a role in SAR
    feedback or to have a voice in what a useful SAR is. Regulators
    have no authority over law enforcement, are not law enforcement
    and represent an impediment to law enforcement in the SAR
    process in certain regards. SARs are intended to assist law
    enforcement not the regulators. One criticism I have about
    regulators regarding SARs is that in a number of instances,
    financial institutions write SARs geared to what the regulators
    want versus what law enforcement wants. This is
    counterproductive. Where regulators can assist in the SAR
    process during their examinations is to identify situations
    where financial institutions do not file SARs or do not file
    adequate SARs. In my experience, the failure to file SARs or to
    adequately file SARs is the biggest breakdown in an AML
    program. This is where the regulators should be focused
    regarding SARs.

    Q.15. Would a better feedback loop system exist if financial
    institutions employed more people with security clearances? If
    so, what, if anything, can the Federal Government do to
    facilitate this?

    A.15. I have long been an advocate that select financial
    institution AML professionals be granted security clearances.
    In fact, I was interviewed many times by the 9/11 Commission. I
    strongly recommended to them they recommend that security
    clearances be granted to select financial institution
    personnel. Unfortunately, the 9/11 Commission did not concur.
    Despite that, I firmly believe security clearances would be
    beneficial and are warranted.
        Security clearances have been given to select AML personnel
    on a limited basis through TFOS at the FBI for terrorist
    financing collaboration.
        I do not believe that security clearances would improve the
    feedback issue. However, it would improve the ability of the
    Government to provide financial institutions with classified
    information.

    Q.16. Often, financial institutions will derisk by refusing to
    serve customers that could be involved in illegal activity. As
    financial institutions start to share more information with
    each other, this practice could become more prominent and
    potential criminals could more frequently lose access to the
    United States' financial system altogether.
        Are there instances in which derisking is actually
    unhelpful for law enforcement purposes, because it drives these
    criminals underground and makes it more difficult to track
    them?

    A.16. Law enforcement would prefer that financial institutions
    do not derisk. Exiting relationships is a hindrance to law
    enforcement. It makes it more challenging for law enforcement
    to follow the money and to develop prosecutable cases reliant
    on financial evidence. There are times when law enforcement
    learns that financial institutions are going to exit an account
    relationship and law enforcement requests the financial
    institution maintain the banking relationship. In such
    instances, law enforcement will provide the financial
    institution with a keep open letter. Financial institutions
    often derisk and/or exit high risk relationships due to concern
    of adverse regulatory actions by their regulators.

    Q.17. At the moment, do the regulators that evaluate and
    enforce financial institutions compliance with our Federal
    money laundering take this into account?

    A.17. Regulators do not take this into account, which is a
    problem. Either real or perceived, financial institutions
    derisk because they are concerned that the regulators will take
    an enforcement action against the financial institution for the
    level of high risk they accept. This is where the regulators
    lack leadership and clarity with financial institutions. I've
    heard regulators asked to provide guidance respond that it is
    up to the financial institution to identify the appropriate
    level of risk they can manage. In many such high risk
    situations financial institutions believe it's better to exit
    the customer relationship and not face real or perceived
    regulatory action.

    Q.18. Are there promising ways to increase cooperation between
    financial institutions, regulators, and law enforcement
    officials, so that financial institutions can make a more
    informed decision about when and how to derisk?

    A.18. If financial institutions, regulators, and law
    enforcement could establish sustainable communications and take
    the time to understand each other's perspectives, a better
    sense of collaboration could be established and a middle ground
    acceptable to each other could be established. If you placed
    financial institutions, the regulators and law enforcement in a
    triangle and places financial institutions at the top and
    regulators and law enforcement at the bottom side points, there
    would be hard lines from the financial institutions to the
    regulators and law enforcement. Unfortunately, the line between
    the regulators and law enforcement would be a broken line. The
    hard lines are lines of communication. The broken line is a
    lack of communication. The point is the level of communications
    between the regulators and law enforcing is not good. This
    leaves financial institutions in direct communications with the
    regulators and law enforcement, which have conflicting
    interests.

    Q.19. Would financial institutions need to hire more employees
    with a top security clearance and/or a law enforcement
    background for this coordination to be effective?

    A.19. The issue of security clearances is not related to the
    issue of derisking. They are separate issues. I think it would
    be extremely beneficial if financial institutions hire more
    employees from law enforcement or the intelligence community
    who have security clearances. This would enable law enforcement
    to share classified information with financial institutions
    they would not have otherwise been able to share. Financial
    institutions derisk in order to avoid real or perceived
    regulatory actions like enforcement actions.
                                    ------

            RESPONSES TO WRITTEN QUESTIONS OF SENATOR TILLIS
                         FROM DENNIS M. LORMEL

    Q.1. How can we leverage technology to make the process
    simultaneously less onerous on banks while enhancing the
    outcomes of catching illegal behavior? Are there regulatory and
    legislative barriers to getting that down?

    A.1. We should definitely seek to leverage and embrace
    technology to enhance transaction monitoring and to be more
    innovative. I believe the barriers to this are two pronged.
    First is cost considerations for financial institutions. The
    second is real or perceived regulatory expectations. Financial
    institutions are concerned about adverse regulatory action if
    they enhance technology. In questions from Senator Sasse I
    received a similar question. The answer I provided Senator
    Sasse is set forth below:
        As I noted above, I am not an IT expert. I'm not sure if
    it's a regulatory problem as much as a cost consideration.
    Regardless of cost considerations, the problem is not
    regulations. Rather it is the regulators and the lack of
    clarity and leadership by regulators concerning regulatory
    expectations. My sense is financial institutions are concerned
    about potential regulatory consequences they may face for
    enhancing technology. There is concern that if new innovations
    will result in criticism that the older technology will be
    criticized for not having picked up the same level of alerts
    causing them to have to look back for potential suspicious
    activity perceived to be missed. At the ACAMS AML Conference
    held in Hollywood, Florida, from April 9-11, 2018, during a
    regulator panel, one regulator advised that if financial
    institutions upgraded their transaction monitoring system, they
    should run the two systems in parallel for a period of time to
    ensure one if one system generates more alerts, the other is
    assessed to see if it missed alerts. That's a cause for concern
    for two reasons, cost and perceived regulatory action against
    the financial institution. This is a deterrent and not an
    incentive to enhance technology.

    Q.2. Financial institutions often complain that FinCEN, law
    enforcement officials, and prudential regulators do not tell
    them whether their BSA filings serve a useful purpose, or how
    the reports they submit are being used--and that the filings go
    into a black hole. Can you shed some light on the filings that
    you make or have used and what could be done to improve this
    process?

    A.2. SARs are extremely important and make significant
    contributions to law enforcement investigations. Lack of
    feedback is a problem. The perception by financial institutions
    that SARs fall into a black hole is a misperception. SARs do
    not fall into a black hole. Financial institutions have a right
    to be frustrated about the lack of SAR feedback. In terms of
    developing a consistent feedback mechanisms, this is not an
    issue for the regulators. It is an issue for FinCEN and law
    enforcement, mostly law enforcement. Law enforcement is the end
    user of SARs and the beneficiary of SAR information. Senator
    Sasse asked a similar question. Below is the answer I furnished
    him, which is relevant to your question.
        Feedback from law enforcement to financial institutions
    regarding the value of SARs is problematic. I have frequently
    heard the same complaint from financial institutions. As noted
    above, the lack of feedback does not mean SARs were not
    reviewed or that SARs did not predicate and/or enhance law
    enforcement investigations. In response to the frustration on
    the part of financial institutions about the lack of SAR
    feedback, I always make it a point when I provide training to
    AML professionals about how important SARs are. I also include
    in my presentations a flow chart I developed regarding the
    lifecycle of a SAR. As I mentioned in an earlier response to
    one of your questions, I'd be happy to provide the flow chart
    to you.
        When I was the Chief of TFOS in the FBI, I frequently met
    with then FinCEN Director James Sloan. We often spoke about
    developing a consistent feedback mechanism for financial
    institutions but were unable to develop an adequate mechanism
    to do so. There are a number of inherent impediments to
    establishing a feedback mechanism. Such include the nature of
    criminal investigations. From the point a SAR is filed to the
    point a case is concluded, it could be a period of one or more
    years. If a case is a Grand Jury investigation, information
    cannot be disclosed by law enforcement. Law enforcement lacks
    the resources to consistently provide feedback. There are
    always new cases to move forward with and investigators don't
    have time to provide feedback. Impediments aside, they are no
    excuse for not providing feedback. I believe a feedback
    mechanism should be developed and implemented through FinCEN
    initiated by law enforcement. I concur with your comment that a
    SAR feedback mechanism would improve the quality of SAR
    submissions. I also believe that a SAR feedback would improve
    the morale of AML professionals who are involved in the SAR
    process. They would have a greater sense of accomplishment and
    satisfaction that their work contributes to law enforcement
    successes. Make no mistake; SARs play a significant role in
    investigations.

    Q.3. Another compliance challenge often cited by banks is that
    they feel pressured by bank examiners and law enforcement
    authorities to exit certain business lines or cease offering
    certain services to customers viewed as presenting particular
    money-laundering vulnerabilities, i.e., severing corresponding
    banking relationships with foreign institutions in certain
    geographic areas, and also ending money services businesses
    (MSBs, i.e., check cashing, money transmitters, currency
    exchange outlets, etc.)
        As banks reevaluate their business relationships with MSBs
    in light of what they may view as a hostile regulatory
    landscape, what can we do to change this type of behavior/is
    this a prevalent problem in the industry?

    A.3. Senator, let me answer the second part of your question
    first. The issue is a significant prevalent issue in the
    industry. The term referred to for exiting high risk
    relationships by financial institutions is ``derisking''. The
    problem here is with the regulators. Either real or perceived,
    financial institutions believe they will face regulatory
    enforcement actions if they continue to bank high risk
    customers. This is where I believe regulators lack leadership
    and clarity. They do not provide guidance to financial
    institutions about banking high risk customers. I have heard
    regulators at conference state it is not their responsibility
    to provide such guidance but it's the responsibility of the
    financial institution to determine the level of risk they can
    manage. This lack of guidance leads to financial institutions
    exiting high risk customer relationships.

    Q.4. It is my understanding that there are times when law
    enforcement and the bank regulators work at cross purposes.
    That is, law enforcement might want a bank to continue banking
    an individual or company that they are following and building a
    case against but the bank regulators, whose incentives are to
    not be embarrassed by their regulated entities, force the banks
    to ``derisk'' or close those accounts. Is that actually the
    case?

    A.4. Unfortunately, this is the case. As noted in my response
    to your previous question, either real or perceived, financial
    institutions derisk out of fear of regulatory enforcement
    actions. The regulators do not provide financial institutions
    with leadership or clarity about maintaining high risk
    relationships. Consequently, financial institutions exit these
    relationships. Regulators state that they do not want derisking
    but they want inclusion. The problem is they do not provide the
    guidance about banking high risk customers.
        Law enforcement would prefer the account relations not be
    exited, especially in cases of ongoing investigations. Below is
    the response to a similar question that I provided to Senator
    Sasse.
        Law enforcement would prefer that financial institutions do
    not derisk. Exiting relationships is a hindrance to law
    enforcement. It makes it more challenging for law enforcement
    to follow the money and to develop prosecutable cases reliant
    on financial evidence. There are times when law enforcement
    learns that financial institutions are going to exit an account
    relationship and law enforcement requests the financial
    institution maintain the banking relationship. In such
    instances, law enforcement will provide the financial
    institution with a keep open letter. Financial institutions
    often derisk and/or exit high risk relationships due to concern
    of adverse regulatory actions by their regulators.

    Q.5. In terms of AML, we know that the success of AML is
    centric around whether or not the predicate crime of money
    laundering has been reduced, but we only really know how
    pervasive money laundering is on a reactive basis, i.e., when
    someone/some entity is caught. To that end, do you believe the
    advent/popularity of cryptocurrencies could affect the capture
    of money laundering/could it affect AML? Do enforcement
    authorities have the technological capabilities to work with
    private industry to capture mal-actors?

    A.5. The challenge of identifying money laundering is that it
    is an inherently reactive process. The evolution of
    cryptocurrency presents new challenges for financial
    institutions. This is certainly one area where public-private
    sector partnerships could better address the emerging
    challenges of cryptocurrency. I responded to a similar question
    from Senator Sasse. Below is the response I provided him with.
        As bitcoin, blockchain, and other cryptocurrency continue
    to emerge and gain popularity and useage, it will grow as a
    money laundering challenge. The initial reaction to bitcoin,
    blockchain, and other cryptocurrency, and its attractiveness to
    money launderers and criminals was its perceived anonymity.
    Experts have demonstrated that is not true and that they can
    identify people engaging in bitcoin and other cryptocurrency
    transactions. This is a money laundering deterrent. However,
    the more bitcoin and other cryptocurrencies are used, and the
    more they can be used in cash like manners, the more prevalent
    the money laundering challenge will become. Part of the problem
    is the extent to which the dark net can be used and the level
    of anonymity that bad guys can develop and exploit.

    Q.6. In your opinion, do you think that the overall AML regime
    has been effective? Additionally, what do you see as the best
    way to ensure future effectiveness?

    A.6. As I stated in my written and oral testimony at the
    Committee hearing on January 9th, the flow of BSA information
    from financial institutions to law enforcement is invaluable.
    In this regard the AML regime is effective. The system is
    flawed when you overlay regulatory requirements. The system
    could be more effective and efficient. I encourage the
    Committee to assess the perspectives of all stakeholders in the
    process, especially law enforcement and financial institutions
    who I consider the two primary stakeholders. BSA information is
    intended to assist law enforcement. Financial institutions are
    the repository for financial intelligence and serve as the
    filter for identifying and reporting suspicious activity. I
    believe there are three primary factors that Congress should
    consider:

      1.  How to incentivize financial institutions to enhance
            technology and be innovative. In addition to cost
            factors, this will require dealing with the real or
            perceived regulatory expectations financial
            institutions are concerned about regarding upgrading
            technology. Financial institutions are concerned about
            potential adversarial regulatory consequences.

      2.  How to make transaction monitoring and the SAR process
            more effective and efficient. The key is to improve the
            percentage of SARs that are meaningful and are used to
            predicate and/or enhance law enforcement
            investigations.

      3.  How to establish a consistent and meaningful feedback
            mechanism from law enforcement to financial
            institutions regarding the value of SARs. This would be
            one factor that would contribute to improving the
            effectiveness and efficiency of the SAR process.

    Q.7. Is it to have Treasury be the lead to:

      1.  Define with other stakeholders specific and clear
            national priorities of the regime; and

      2.  Determine, working with other stakeholders, clear and
            measurable objectives of the regime in light of those
            priorities. Should Treasury or someone else have to
            report those measurements against the objectives back
            to Congress?

    A.7. This is a difficult question that requires considerable
    assessment by numerous stakeholders with varying perspectives.
    On one hand, I concur that from a practical point of view, one
    department or stakeholder should be the lead to establish
    specific and clear national priorities and set clear and
    measurable objectives that are reported back to Congress. My
    problem is that Federal departments and agencies within those
    departments have vastly different responsibilities and
    mandates. Therefore, could one department objectively determine
    the overall priorities for the intergovernmental community? For
    example, the Treasury Department is primarily responsible for
    sanctions and enforcement. Whereas, the Department of Justice
    (DOJ) and Homeland Security are responsible for law
    enforcement. From a practical standpoint, it would be prudent
    to designate Treasury to be responsible. However, without equal
    input, my concern would be that DOJ and Homeland Security law
    enforcement perspective and priorities might not be accurately
    stated and/or prioritized. In addition, are their other
    stakeholders who should be included in the reporting process
    such as the CIA and Department of Defense (DOD)? The CIA and
    DOD are both engaged in threat and/or terrorist financing.
    Having co-responsibility might be an acceptable alternative.
    However, that would be a challenge for efficiency. Perhaps
    Treasury, DOJ, Homeland Security, and other Government
    stakeholders should be responsible to submit similar reports to
    more specifically define their priorities, objectives and
    measurable.
        Regardless of who is designated with reporting
    responsibility, I believe it would be prudent to have a
    reporting mechanism to Congress.
        This idea may have come from the Clearinghouse report,
    dated February 2017, titled ``A New Paradigm: Redesigning the
    U.S. AML/CTF Framework to Protect National Security and Aid Law
    Enforcement''. I was not involved in the Clearing House
    assessment process. However, my concern is the principal
    participants possessed more of a Treasury perspective
    (sanctions and enforcement) verses a law enforcement
    perspective. I understand the working group included former law
    enforcement officials. However, in reading the Clearing House
    report, my concern is law enforcement interests were not
    adequately considered. As noted in my written and oral
    testimony on January 9th, I contacted then current law
    enforcement executive in positions like I held in the FBI, and
    none were included in the discussions. I believe the Clearing
    House report sets a good framework for improving BSA reporting.
    However, law enforcement should have greater engagement in the
    assessment process.
                                    ------

            RESPONSES TO WRITTEN QUESTIONS OF SENATOR WARNER
                         FROM DENNIS M. LORMEL

    Q.1. What are the costs and benefits of having bank examiners
    assess bank compliance with the Bank Secrecy Act's (BSA)
    requirements instead of having anti-money laundering (AML) and
    combating the financing of terrorism (CFT) experts at the
    Financial Crimes Enforcement Network (FinCEN) examine bank
    compliance programs?

    A.1. I do not believe it is practical to have FinCEN perform
    the bank examinations/program reviews as currently done by the
    regulatory agencies. First and foremost, FinCEN does not have
    the capacity to handle such demands. They lack the required
    resources. FinCEN resources do not have the same level of
    examination training or experience that regulatory agencies
    possess. I believe it is imperative that FinCENs primary
    responsibility continue to be to collect BSA reporting
    information and to serve as the conduit between financial
    institutions and law enforcement. FinCEN should continue to be
    involved in regulatory actions on a case specific basis and in
    conjunction with the regulators. FinCEN should continue to
    provide regulatory guidance to financial institutions. FinCEN
    should also continue to conduct the analytical work they
    perform in support of law enforcement.

    Q.2. Is there a way to maintain a top-shelf effective AML/CFT
    policy while maintaining a commitment to increase access to
    financial products for the underbanked and immigrants who rely
    on remittance services?

    A.2. I'm a proponent for inclusion of the underbanked and
    immigrants who rely on remittance services. I conduct AML,
    terrorist financing, and fraud training on a regular basis. I
    also write articles published in industry publications, such as
    ACAMS Today magazine. In these forums, I frequently state that
    illegal money remitters represent one of the most significant
    vulnerabilities to the U.S. financial system. Part of the
    problem is that some illegal money remitters and underbanked
    customers have been derisked. Derisking is a significant
    problem. Much of the problem regarding illegal money remittance
    is that different ethnic communities, especially with the
    underbanked and immigrants prefer to use illegal money
    remitters to transmit funds back to family members in their
    countries of origin.
        One of the solutions to the issue of derisking is for
    regulators to provide leadership and clarity to financial
    institutions about regulatory expectations. Another solution
    for the issue if illegal money remittance is for FinCEN, law
    enforcement, and financial institutions to establish a
    partnership and working group to address the issue of illegal
    money remittance operations.

    Q.3. I'm interested in the ways in which technology can aid AML
    compliance efforts. What are some of the innovative
    technologies that you've seen that hold some promise for either
    the Government or the private sector?

    A.3. I'm not an IT expert. However, I believe that financial
    institutions should embrace technology. In doing so, they
    should also demand transparency with new technology driven
    product offerings. Regarding transaction monitoring, financial
    institutions should be considering technology enhancements
    through artificial intelligence and FinTech capabilities.

    Q.4. What are the barriers to either the Government or the
    private sector adopting these technologies?

    A.4. In my opinion, the barriers to Government are primarily
    cost related. The barriers also include Government bureaucracy.
    The barriers to the private sector, specifically to financial
    institutions, are cost and real or perceived regulatory
    expectations. I was asked similar questions by your colleagues
    Senators Sasse and Tillis. Below are my responses to their
    questions.

      1.  We should definitely seek to leverage and embrace
            technology to enhance transaction monitoring and to be
            more innovative. I believe the barrios to this are two
            pronged. First is cost considerations for financial
            institutions. The second is real or perceived
            regulatory expectations. Financial institutions are
            concerned about adverse regulatory action if they
            enhance technology. In questions from Senator Sasse I
            received a similar question. The answer I provided
            Senator Sasse is set forth below:

      2.  As I noted above, I am not an IT expert. I'm not sure if
            it's a regulatory problem as much as a cost
            consideration. Regardless of cost considerations, the
            problem is not regulations. Rather it is the regulators
            and the lack of clarity and leadership by regulators
            concerning regulatory expectations. My sense is
            financial institutions are concerned about potential
            regulatory consequences they may face for enhancing
            technology. There is concern that if new innovations
            will result in criticism that the older technology will
            be criticized for not having picked up the same level
            of alerts causing them to have to look back for
            potential suspicious activity perceived to be missed.
            At the ACAMS AML Conference held in Hollywood, Florida,
            from April 9-11, 2018, during a regulator panel, one
            regulator advised that if financial institutions
            upgraded their transaction monitoring system, they
            should run the two systems in parallel for a period of
            time to ensure one if one system generates more alerts,
            the other is assessed to see if it missed alerts.

        That's a cause for concern for two reasons, cost and
    perceived regulatory action against the financial institution.
    This is a deterrent and not an incentive to enhance technology.

    Q.5. What can we be doing as legislators to ensure that we
    promote technological innovation in this sector?

    A.5. Technology innovation is important. If I was a legislator,
    I would consider what I could do to incentivize financial
    institutions to embrace technology. One thing I would assess is
    how to encourage regulators to take a leadership role and to
    provide financial institutions with guidance and clarity to
    change the real or perceived concern by financial institutions
    that there could be adverse regulatory enforcement actions for
    enhancing technology as addressed in the response to the prior
    question.

    Q.6. The regulatory definition of ``financial institution'' has
    been expanded several times over the years, both by FinCEN
    rulemaking and by legislation by Congress.
        Should the definition of financial institutions be expanded
    to include other sectors? If so, which sectors?

    A.6. The one sector that comes to mind where the definition of
    ``financial institution'' might be included is the real estate
    sector. As addressed in Geographic Targeting Orders (GTOs),
    issued by FinCEN to require U.S. title insurance companies to
    identify the natural persons behind shell companies used to pay
    ``all cash'' for high-end residential real estate in six major
    metropolitan areas, money laundering through real estate is a
    significant problem. Certainly, where focus was placed on this
    specific money laundering problem, the GTOs were warranted. But
    the problem of money laundering through real estate is much
    broader. There are a number of real estate schemes to include
    criminal property flipping that have had a detrimental economic
    impact on many U.S. cities.
        I believe that to answer how broadly the real estate sector
    should be regulated as a financial institution requires
    considerable assessment. Stakeholders should include FinCEN,
    real estate professionals and experts, financial institutions,
    law enforcement, and academics who have researched money
    laundering in the real estate sector. As an example, the
    Terrorism, Transnational Crime and Corruption Center (TraCCC)
    at George Mason University (GMU), held a daylong conference at
    GMU's Schar School of Policy and Government to learn about
    money laundering through the real estate sector. The forum was
    held on March 23, 2018. Speakers included experts from the real
    estate sector, law enforcement banks, Government, associations,
    nongovernment organizations, and academia. I served as a
    moderator for a panel addressing new approaches to countering
    money laundering in real estate in the U.S. A draft report has
    been circulated to conference speakers and organizers. The
    report is in the process of being finalized. If you are
    interested, I'd be happy to provide a copy of the report after
    it's published.

    Q.7. Could these changes be made via FinCEN rulemaking or
    should legislation be passed?

    A.7. I believe both FinCEN rulemaking and legislation are
    warranted. I believe that the GTO's issued by FinCEN are an
    outstanding example of FinCEN rulemaking. However, the long-
    term solution is legislation. Congress should consider
    establishing a working group to assess how best to craft
    legislation to address the broader risks of money laundering
    through real estate.

    Q.8. In August 2017, FinCEN issued an advisory encouraging real
    estate brokers to share information with them that could be
    helpful in AML efforts, while noting they are not required to
    do so under current law.
        How do we increase information sharing between real estate
    brokers and FinCEN?

    A.8. Meaningful information sharing between real estate brokers
    and FinCEN is more likely to be accomplished through rulemaking
    and legislative requirements. An alternative that could result
    in voluntary information is to promote awareness through
    outreach, particularly in the real estate sector, about the
    risk and consequences of money laundering through real estate.

    Q.9. Geographic Targeting Orders (GTOs), which impose
    additional record keeping and reporting requirements on
    domestic financial institutions or nonfinancial trades or
    businesses in a specific geographic area for transactions
    involving certain amounts of United States currency or monetary
    instruments, have been deployed since 2016 to target high-end
    real estate sectors in major metropolitan areas by requiring
    U.S. title insurance companies to identify the natural persons
    behind shell companies used to pay ``all cash'' for high-end
    residential real estate.
        Are GTOs an effective tool or would regulation be a
    preferable way to cover the real estate sector?

    A.9. I applaud the GTOs. They are a good step forward in
    addressing the money laundering issues in real estate. The
    GTO's focus on one significant money laundering problem. I
    believe this has had the intended impact and that is why the
    GTOs were extended in 2017. As noted in the response to the
    prior question, I believe the long-term solution is regulations
    that are broader than the one issue addressed in the GTOs.
    Regulations need to address a broader range of money laundering
    risks in the real estate sector.

    Q.10. Cryptocurrency exchanges are money services businesses
    supervised by State regulators and subject to Federal AML and
    CFT laws.
        Should FinCEN play an enhanced role in assessing the
    compliance of cryptocurrency exchanges, or are State regulators
    sufficiently equipped to handle compliance monitoring?

    A.10. I will address this question first at the State level and
    then at the Federal level. Overall, State regulators do a good
    job at enforcing State regulatory compliance requirements.
    However, there is no uniformity among States about regulatory
    requirements. Regulatory requirements vary from State to State.
    My sense is New York probably has the most stringent State
    requirements. At the Federal Government level, we need to
    assess the roles and perspectives Government agency
    stakeholders have with respect to cryptocurrency exchanges. For
    instance, FinCEN issued guidance to cryptocurrency exchanges in
    2013. Since cryptocurrency exchanges are MSBs, they would be
    subject to Federal review by the IRS, who examines MSBs from a
    Federal regulatory perspective. In addition, the Securities and
    Exchange Commission (SEC) and the Commodities Futures Trading
    Commission (CFTC) each have interests. In some situations, the
    SEC could consider the trade of cryptocurrency securities
    transactions. In some situations, the CFTC could consider
    virtual currency as a commodity.
        The question of should FinCEN play an enhanced role in
    assessing the compliance of cryptocurrency exchanges should be
    assessed along with the roles of the IRS, SEC, and CFTC. One
    question is, does FinCEN have the capacity, in terms of
    resources, to take on enhanced responsibilities. FinCEN should
    certainly provide continued guidance and rulemaking. In terms
    of supervision, IRS should continue to have examination
    responsibility. The problem here is the same question as I
    posed for FinCEN. Does the IRS possess adequate resources to
    address regulatory examination requirements?

    Q.11. What additional tools could we give regulators and law
    enforcement?

    A.11. The tools that regulators and law enforcement need to
    address the AML challenges posed by cryptocurrency begin with
    budget enhancements. From the regulators side, enhanced
    resources are needed in terms of personnel and equipment to
    perform an adequate level of regulatory examinations. Whether
    it's the IRS or FinCEN, resource enhancements are needed. Law
    enforcement is less pressed for resource enhancements, although
    the need for resource enhancements should be assessed.
    Regulators and law enforcement could use budget enhancements to
    address the training requirements necessary to gain and
    maintain the skill sets required to address the evolving
    challenges posed by cryptocurrencies.

    Q.12. How prevalent is money laundering in cryptocurrency
    markets?

    A.12. I cannot speak definitively about how prevalent money
    laundering is in cryptocurrency markets. However, like with all
    types of financial institutions, there is a risk for money
    laundering. Like financial institutions, cryptocurrency markets
    serve as a facilitation tool or a detection mechanism. Our
    challenge is to make cryptocurrency markets more of a detection
    mechanism.
        The common belief that cryptocurrencies can be anonymous
    makes cryptocurrency more attractive to money laundering. Law
    enforcement has begun to state that cryptocurrencies are not as
    anonymous as thought and that they can trace transactions and
    those transacting in cryptocurrency. The more law enforcement
    proves this fact by making arrests, getting convictions, and
    seizing illicit assets, the greater the deterrent there will be
    for money laundering through cryptocurrency. That said, the
    more cryptocurrency transactions become cash like transactions,
    the greater the likelihood for money laundering. AML
    transaction monitoring is inherently reactive, which poses a
    significant challenge for those fighting money laundering.
    Cryptocurrency is an evolving space. AML technology must evolve
    along with cryptocurrency technology.
                                    ------

                   RESPONSES TO WRITTEN QUESTIONS OF
               SENATOR CORTEZ MASTO FROM DENNIS M. LORMEL

    Q.1. Gaming and tourism are some of Nevada's top industries. In
    the State of Nevada, our gaming operators employ thousands of
    hard working Nevadans, and the industry as a whole domestically
    supports 1.7 million jobs across 40 States. Qualified casinos,
    like financial institutions, are also subject to Banking
    Secrecy Act requirements. Organizations within Nevada have
    suggested that gaming operators would welcome a review of BSA
    requirements, which they find to be burdensome. They look
    forward to this Committee's thoughtful, bipartisan, review of
    BSA requirements that takes into account the security
    imperative for robust anti-money laundering efforts, as well as
    the impact those requirements have on all industries. For
    example, the Suspicious Activity Report (SAR) ($5,000) and the
    Currency Transaction Report (CTR) ($10,000) levels were set
    years ago. Some have recommended increasing these to correspond
    with inflation. Others believe that would be too high but do
    support a higher amount than currently,

    A.1. I would like to comment here that I am not in favor of
    raising the SAR or CTR reporting thresholds. In today's world,
    where it takes small amounts of funds to commit a terrorist
    act, we need the thresholds where they are. Most financial
    institutions will tell you the reporting thresholds do not
    cause extra burden to them.

    Q.2. One of the top priorities of the gaming industry is to
    remove the requirement for a detailed factual narrative for
    structuring in the suspicious activity forms. What do you think
    of this recommendation?

    A.2. I was the direct beneficiary of SARs when I was an FBI
    agent, especially following the terrorist attacks of 9/11. I
    formed and ran the Terrorist Financing Operations Section
    (TFOS). Following 9/11, we began a datamining project and
    included SAR narratives and SAR identifying information like
    addresses, phone numbers, and other collateral information.
    From a macro or program level, I liked the narrative
    information for all SARs to include structuring. That said,
    SARs are a subjective topic. If you speak to law enforcement
    agents at the field or grass roots level, especially those who
    physically review SARs, they would likely agree that
    structuring narratives are cumbersome and not necessary. There
    is no easy solution to the SAR narrative question.

    Q.3. Do you have specific recommendations regarding how the
    gaming industry can benefit from greater communication with
    Government agencies and law enforcement? Is there something the
    Federal Government can do to share information with casinos and
    others filing SARs about broad benefits that may occur because
    of some of the 58,000 SAR forms filed by gaming firms.

    A.3. I am a huge proponent for public and private partnerships
    and collaboration. When I ran the Financial Crimes Section at
    the FBI prior to 9/11, I had frequent conversation with the
    then Director of FinCEN, James Sloan about developing a
    feedback mechanism for financial institutions regarding SARs.
    There were numerous inherent impediments to establishing a
    feedback mechanism. That should not be an excuse. FinCEN and
    law enforcement should revisit this issue and determine how to
    more consistently provide feedback to financial institutions,
    including Casinos.

    Q.4. Would the creation of a Qualitative Feedback Mechanism
    help reduce money laundering and terrorist financing? Should
    the Secretary of the Treasury establish a mechanism to
    communicate anti-money laundering (AML) and countering
    terrorism financing (CTF) priorities to financial institutions,
    gaming establishments, and Federal financial regulators? Could
    such a mechanism provide qualitative feedback on information
    shared by financial institutions with the Department of
    Treasury, including CTRs and SARs? Please describe the pros and
    cons of such a system.

    A.4. As mentioned in the answer above, I am a firm believer in
    the benefits of a feedback mechanism regarding SARs. I would
    welcome a feedback mechanism. I do believe that would improve
    the identification of money laundering and terrorist financing.
    From an intangible standpoint, a consistent feedback mechanism
    would greatly improve the morale and motivation of the AML
    professionals involved in the SAR process. There is a constant
    sense that SARs go into a black hole. That is not true. SARs
    are extremely valuable. If AML professionals received
    consistent feedback, there would be more interest in filing
    better quality SARs that would improve the investigative
    process and lead to more prosecutions and disruptions.
        I do not like the idea of Treasury providing money
    laundering and terrorist financing priorities to financial
    institutions because their issues are with sanctioning and
    enforcement actions and not law enforcement. Non-Treasury law
    enforcement agencies, such as the FBI have primary criminal and
    intelligence for terrorism and many criminal violations. I'm
    not comfortable with Treasury setting priorities for matters
    they have limited or no jurisdiction over. If Treasury acted as
    a bridge with law enforcement then perhaps it would be
    workable.

    Q.5. The Office of the Comptroller of the Currency mentioned in
    its 2018 Banking Operating Plan that financial institutions
    should not inadvertently impair financial inclusion. But, as of
    September 2017, the OCC has not identified any specific issues
    they plan to address. We know that derisking has become an
    epidemic across many communities and industries, such as
    communities along the Southwest border, humanitarian
    organizations aiding Nations wracked with violence, and
    remittances providers that serve fragile Nations like Somalia.
        What type of guidance could the OCC, FinCEN, FDIC, and the
    Federal Reserve provide to help banks meet the banking needs of
    legitimate consumers and businesses that are at risk of losing
    access--or have already lost access?

    A.5. Inclusion or derisking is a sensitive issue. Although the
    regulators preach inclusion and the harm of derisking, they do
    not adequately provide the needed guidance to financial
    institutions. In my view and what I have observed in working
    groups that discuss this issue and in other forums, the
    regulators do not demonstrate any leadership or clarity in
    providing direction. Regulators will state that it is up to
    banks to determine the level of risk they can manage and offer
    no guidance about regulatory expectations. Consequently, that
    lack of guidance causes financial institutions to be more risk
    averse and exit relationships for fear that the regulators
    would take a negative view and some action against the
    institution for banking high risk customers. Regulators should
    take a leadership role and provide clear guidance about
    regulatory expectations beyond stating that financial
    institutions need to identify and manage their risk.

    Q.6. Last year, the Countering Iran's Destabilizing Activities
    Act of 2017 (P.L. 115-44) was enacted. In Section 271, it
    required the Treasury Department to publish a study by May 1,
    2018, on two issues:
        Somali Remittances: The law required the U.S. Department of
    Treasury to study if banking regulators should establish a
    pilot program to provide technical assistance to depository
    institutions and credit unions that wish to provide account
    services to money services businesses serving individuals in
    Somalia. Such a pilot program could be a model for improving
    the ability of U.S. residents to make legitimate funds
    transfers through easily monitored channels while preserving
    strict compliance with BSA.
        Sharing State Banking Exams: The law also required Treasury
    to report on the efficacy of money services businesses being
    allowed to share certain State exam information with depository
    institutions and credit unions to increase their access to the
    banking system.
        Have you or your organization been involved with these
    Treasury studies?

    A.6. I have not been engaged in the Treasury studies. I am in
    favor of such pilot programs

    Q.7. What advice did you give--or would you give--on the pilot
    studies?

    A.7. Somalia is a high risk country for terrorism. That said,
    the stories of bulk cash being carried to Somalia from the U.S.
    because MSBs are not banked and NGOs are forced to currier
    money is extremely problematic. To expand on my answer above
    about regulatory agencies not taking or demonstrating a
    leadership role, this would be a great opportunity for that to
    change. I would recommend Treasury and the regulators take a
    leadership role in working with financial institutions to bank
    MSBs in the Somali region and to what extent the depository
    institutions should have a risk tolerance for. Part of the lack
    of leadership on the part of the regulators results in a lack
    of clarity with banks in terms of the level of risk they should
    take on and the perceived regulatory response to financial
    institutions considering taking on such risk. This is where
    leadership and clarity would be helpful in formulating more
    realistic risk tolerance thresholds and would lead to less
    derisking.
        I like the idea of MSBs being able to share certain State
    exam information with depository institutions and credit
    unions. In most instances, it would provide information that
    should lead to establishing or maintaining a banking
    relationship.

    Q.8. In 2016, William and Margaret Frederick were moving from
    Ohio to Las Vegas. Unfortunately, it is alleged that the title
    company they used in Columbus, Ohio, fell for an email scam and
    wired the $216,000 profit from their home sale to a hacker, not
    to the Fredericks. William is 83 and Margaret is 75 and as of
    October, they were still trying to get their money back. While
    the Fredericks' tale is now a court case to determine who was
    responsible for the fraudulent information, we know that the
    Fredericks' experience is ``very typical'' of scams that divert
    an estimated $400 million a year from title companies into
    bogus accounts.
        Please describe the responsibilities of financial firms to
    avoid these frauds?

    A.8. These situations are devastating to the victims,
    especially elderly victims like the Fredericks. I wish there
    was a simple recourse for the Frederick's but there is not. The
    financial institutions involved in the transaction do not owe
    the Fredericks or the title company a fiduciary duty. The
    financial institution has a responsibility to have a reasonably
    designed AML program. What that means is the program is
    reasonably designed to identify and report suspicious activity
    to FinCEN. Your question does not give much context about the
    banking relationships involved in this case. The Frederick's
    recourse should be with the title company who fell for the
    phishing/email scam. It's likely the escrow company did not
    have adequate controls. There are, unfortunately, to many cases
    like this. They usually wind up in civil law suits.
        Depending on the case specifics, it is not likely the bank
    would be found negligent or responsible. Again, the culpability
    is likely to lie with the escrow company. The bank would not be
    responsible for the escrow company's falling victim to the
    scammers.

    Q.9. What penalties should be assessed and by which agencies
    when financial firms enable theft?

    A.9. In the event that the financial institution did not have a
    reasonably designed AML program to identify suspicious
    activity, the bank failed to file SARs or to adequately file
    SARs than the bank should face an enforcement action by their
    regulators and/or FinCEN. If it was a one off fraud, and the
    bank had a reasonably designed program it is unlikely they
    would be held culpable. Invariably, many of these cases wind up
    with civil law suits filed against the bank. In at least some
    such cases, the bank will opt to settle the law suit and avoid
    trial to avert adverse publicity and reputational damage.

    Q.10. What is the role for the Consumer Financial Protection
    Bureau to ensure financial firms protect their customers' money
    and information?

    A.10. The CFPB is intended to help consumers protect their
    assets from fraud. I'm not sure of the role the CFPB would play
    in a scenario involving the Fredericks. If the escrow company
    was negligent and lacked adequate internal controls, they
    should be held culpable for the loss. I'm not a lawyer so I
    cannot speak to the legal ramifications. Again, I'm not sure of
    what the CFPB could or should do.

    Q.11. In 2014, FinCEN issued an advisory with human trafficking
    red flags, to aid financial institutions in detecting and
    reporting suspicious activity that may be facilitating human
    trafficking or human smuggling.
        To what extent do you assess that financial institutions
    are currently utilizing these red flags, in order to better
    assess whether their banks are being used for to finance human
    trafficking? If institutions are not widely utilizing the red
    flags, what actions is FinCEN taking to encourage them to do
    so?

    A.11. Human trafficking is a heinous crime problem. I believe
    that AML professionals are dedicated professionals and are very
    concerned about human trafficking. I cannot speak definitively
    as to how widely financial institutions use the FinCEN red
    flags regarding human trafficking or to the extent FinCEN
    provides guidance regarding human trafficking. However, I do
    believe many financial institutions use human trafficking and
    smuggling red flags from multiple sources. There is other red
    flag guidance that financial institutions use that comes from
    FATF, Homeland Security Investigations, the FBI and other
    viable sources. It should be noted that the Polaris Project has
    written a great reference guide about human slavery
    (trafficking), titled ``Typologies of Modern Slavery''. In
    addition, human trafficking is widely discussed at industry
    training conferences. Training is one of the core pillars of an
    AML program. Human smuggling typologies and warning signs are
    frequent topics.
        The Association of Certified Anti-Money Laundering
    Specialists (ACAMS) has made human smuggling a long time
    priority. They started a working group in 2010 with a group of
    major banks and Homeland Security Investigations. Bank analysts
    and Homeland Security Investigations analysts developed
    patterns of activity or typologies consistent with human
    smuggling. JPMorgan Chase had a team of special investigators
    who conducted targeted transaction monitoring and identified
    potential suspicious activity. ACAMS gave JPMorgan Chase and
    Homeland Security a special award in recognition of their
    outstanding collaboration. Another outstanding example of
    public-private sector partnerships occurred in January 2018, in
    the run up to the Super Bowl. The ACAMS Minneapolis Chapter
    held a half-day long learning event focused entirely on human
    slavery/trafficking. I was proud to be the first speaker. U.S.
    Bank, Homeland Security Investigations, and the U.S. Attorney's
    Office in Minneapolis collaborated to develop typologies to
    identify human sex trafficking specifically related to travel
    for the Super Bowl. These types of initiatives have a great
    impact on crime problems like human trafficking. I must give a
    cautionary comment that this type of initiative is not as easy
    as it sounds. It can be costly; there are regulatory concerns
    and other impediments that must be overcome. The September
    issue of ACAMS Today magazine had a detailed article about the
    Minneapolis learning event. I would be happy to provide a copy
    of ACAMS Today if you'd like one.

    Q.12. What are the pros and cons of reducing or eliminating the
    standards requiring SARs filing for insider abuse (i.e.,
    employee misconduct)?

    A.12. I do not believe there are any pros to reducing or
    eliminating SAR filing for insider abuse. If the insider abuse
    would be considered suspicious activity, SARs should be filed.
    Insider abuse can be devastating to financial institutions and
    should be dealt with harshly. It's one thing if insiders
    embezzle or defraud their employer. It's another issue when
    insiders facilitate external fraud schemes. That can be more
    devastating to the financial institution, as well as to
    outsiders exposed to the fraud or other crime problem.

    Q.13. The common expectation is that any financial institution
    subjected to a cyberattack would be in touch with law
    enforcement about whether or not it's required to file an SAR.
    What are the pros and cons of eliminating SAR filing
    requirement for cyberattacks against financial institutions?

    A.13. As I mentioned responding to an earlier question, I do
    not see any pros for eliminating SAR filing requirements
    regarding cyberattacks. There are only cons. That is unless the
    cyberattack has no financial lead value. I believe that most if
    not all cyberattacks have a financial component to them.
    Therefore, it is incumbent that SARs be filed to ensure the
    financial considerations receive adequate attention from
    financial experienced investigators. More importantly, FinCEN
    has a cyberteam that assesses and addresses cyber SARs. I
    believe that not all cyberthreats, where SARs are generated,
    are reported to law enforcement other than through the SAR
    filing. Also, when cyberthreats are reported to cyber
    investigators, I'm not sure that the follow up cyber
    investigation has a financial component as it would if SARs
    were filed.

    Q.14. Gaming and tourism are some of Nevada's top industries.
    In the State of Nevada, our gaming operators employ thousands
    of hard working Nevadans, and the industry as a whole
    domestically supports 1.7 million jobs across 40 States.
    Qualified casinos, like financial institutions, are also
    subject to Banking Secrecy Act requirements. Organizations
    within Nevada have suggested that gaming operators would
    welcome a review of BSA requirements, which they find to be
    burdensome. They look forward to this Committee's thoughtful,
    bipartisan review of BSA requirements that takes into account
    the security imperative for robust anti-money laundering
    efforts, as well as the impact those requirements have on all
    industries. The Suspicious Activity Report (SAR) ($5,000) and
    the Currency Transaction Report (CTR) ($10,000) levels were set
    years ago. Some have recommended increasing these to correspond
    with inflation. Others believe that would be too high but do
    support a higher amount than currently,
        From a law enforcement perspective, are there risks to
    raising the amounts? Is it possible that having CTRs at higher
    levels could result in more fraud and terrorist financing? If
    the amounts were raised, to what amount do you recommend?

    A.14. I am a firm believer that the SAR and CTR thresholds
    should not be raised. This would be detrimental to law
    enforcement, especially considering the threat of homegrown
    violent extremists. Homegrown violent extremists would be more
    likely to transact in amounts below the $5,000 and $10,000
    threshold levels. As the Chief of the Financial Crimes Section
    and founder of the Terrorist Financing Operations Section
    (TFOS) at the FBI, I was the direct beneficiary of SAR and CTR
    data. I saw firsthand how information below the threshold
    levels was used in investigations. I believe in 2004 or 2005,
    my successor as Chief of TFOS, Michael Morehart, testified
    about not raising the thresholds before a Congressional
    Committee. Subsequent to that, GAO conducted a review of the
    threshold issue and concured that law enforcement benefited
    from SAR and CTR information at the current thresholds. My
    apology for not being more specific about the hearing or report
    date. At this point in time, I do not recall the specifics and
    in deference to time in completing my response to questions, I
    was unable to conduct the necessary research.
        I also believe that most financial institutions would state
    that the current thresholds do not cause them any greater work
    than they would if the thresholds were raised. This topic comes
    up at industry conferences and financial institution
    representatives have stated this regularly.
                                    ------

            RESPONSES TO WRITTEN QUESTIONS OF SENATOR BROWN
                          FROM HEATHER A. LOWE

    Q.1. Information Sharing Among Banks--While you have generally
    supported increased information sharing between banks and the
    U.S. Government, and among banks, you also have sounded an
    alarm about the importance of appropriate privacy safeguards
    around bank-bank information sharing, particularly where an
    individual's access to financial services may be at risk if
    negative but inaccurate information on them gets into the
    system, as with inaccurate credit reporting.
        Can you describe the types of safeguards you think would be
    important if we were to consider clarifying or expanding this
    authority? In particular, should we consider implementing a
    system of redress or information correction for such
    individuals, and if so how would you configure such new
    protections, and how would you envision that process actually
    working?

    A.1. The general rule around information sharing among banks
    should be that data is anonymized before being shared. This is
    consistent with the Clearing House's recommendations. Instances
    where an individual's personal and/or account information can
    be shared among banks should be very clearly circumscribed. A
    system of redress should be established for individuals to
    review and rectify incorrect information that may be forming
    the basis of banks' decisions to deny an individual banking
    services, as is the case with credit information.
        When the banks ask for permission to share information,
    they are asking for that permission not just among banks in the
    U.S., but globally. As such, rules circumscribing the sharing
    of individuals' personal and account information and processes
    for redress should be crafted in conjunction with other major
    financial centers. FinCEN (the U.S.'s financial intelligence
    center) could initiate and lead this process through its
    membership in the Egmont Group, the umbrella organization for
    more than 135 financial intelligence centers around the world.

    Q.2. Bank Derisking/Remittances--Your testimony emphasized the
    importance of Know Your Customer procedures for banks. But in
    recent years many financial institutions have opted to shed
    accounts of customers with personal or commercial links to
    parts of the world where it can be difficult to ascertain the
    final recipient of a financial transaction--an especially
    important concern to Somali communities in Ohio, for example.
    Whether we are talking about family remittances, or funds
    transfers for humanitarian purposes, this derisking has
    presented hurdles to effort to get resources to some of the
    most at-risk populations on Earth. And customers who lose
    accounts or are unable to move money through the regulated
    financial system are often forced to use less transparent, safe
    and regulated channels, undermining AML/CFT goals. The
    Financial Action Task Force (FATF) has recently suggested
    making inappropriate derisking a priority.
        From your perspective, what steps can be taken as part of
    BSA modernization to address the derisking problem and provide
    relief to both banks and their customers? How specifically can
    we better balance KYC obligations with the need to facilitate
    the flow of remittances, and the legitimate work of charities
    and humanitarian organizations, abroad?

    A.2. My organization focuses on the movement of illicit money
    out of developing countries the effect of that financial flow
    for development, and not financial flows into developing
    countries, so we have not focused a great deal on the
    remittances and nonprofit issues. Nonprofit organizations like
    the Charity and Security Network, Oxfam, and the Center for
    Global Development, and intergovernmental organizations such as
    the World Bank, the IMF, the OECD and others have been doing a
    great deal more research in this area and I would recommend
    speaking with them for more developed and far-reaching
    recommendations.
        Having said that, there are three somewhat different
    problems in the derisking area with root causes that are not
    all AML-related, and I think that is a really important point
    here. One is that banks that are no longer willing to provide
    banking services to money service businesses (MSBs) that are
    the primary movers of remittances. Second is banks choosing not
    to do business with correspondent banks in certain very high-
    risk countries. (The Somali remittance problems are a
    combination of both these first and second categories.) Third,
    is the problem of banks choosing not to provide banking
    services for charities/nonprofits. These are related issues,
    but not the same issues. Something to bear in mind as well is
    that the World Bank has found that the cost of transmitting
    remittances has actually decreased over the past several years,
    suggesting that some of the problems in the sector may really
    be location specific, such as with Somalia, as opposed to being
    as widespread as discussion on this topic might suggest.
        In 2012 and the following 2 years, FATF Recommendations and
    related guidance were published relating to risks posed by
    nonprofits and risks posed by MSBs. That guidance suggested
    that those entire sectors were particularly vulnerable to money
    laundering with no nuance, which resulted in banks categorizing
    them all as high risk, regardless of the nature of those
    businesses, the strength of their compliance programs, their
    clientele, or other risk assessment factors. The general
    refrain from banks was that it was too costly to do proper AML
    vetting on all these ``high risk'' entities. Banks also said
    they were pulling out of high risk areas because of an increase
    in fines and penalties, but very few fines/penalties have been
    levied related to servicing MSB or nonprofit clients, which
    begs the question of whether this reaction was simply
    disproportionate or driven by other motives, such as an excuse
    to get out of these relatively low-margin lines of business.
        For example, Barclays in the U.K. caused a bit of a crisis
    when it closed the accounts of the vast majority of the money
    service businesses it serviced. But it held on to MSBs with
    assets of $10m or more. However, the significant MSB money
    laundering case on record actually relates to Western Union,
    one of the world's largest and well-capitalized MSBs. Barclays'
    decision to jettison smaller MSB accounts was made not in
    relation to actual enforcement trends, how good their MSB
    clients' compliance programs were, or other risks relating to
    the individual MSB's business or other relevant factors, it was
    made on whether the bank wanted to keep that capitalization or
    not and bother to continue servicing smaller accounts where its
    margin was smaller and getting smaller because of compliance
    costs. It would be interesting to find out pre-2012 margins on
    these business lines versus post-2012 margins so that Congress
    has a frame of reference for what a bank consider an
    unacceptable margin in these business lines.
        And that raises an important point in all of this that is
    very often missed. There has been huge bank consolidation
    leading to behemoth banks that do not consider providing
    services to smaller account holders to be worth the cost. (In
    our experience, smaller, local banks rarely provide adequate
    international transfer services and did not do so prior to AML
    regulation.) We see that every day as banking fees for people
    who have little savings climb while those who have sizable
    accounts have no fees at all. Banks are doing everything they
    can to increase their profit margins with little regard to the
    effect on the average account holder. That's today's business
    model, and bank decisions regarding MSB and nonprofit account
    holders are driven in large part by this model. Furthermore,
    the Center for Global Development put out a report on derisking
    in 2015. In that report, they noted that some banks have
    ``derisked'' and then beefed up their own money transmitter
    services, suggesting a possible move to undermine competition
    and seize the market themselves.
        So there are problems, some of which are not actually AML
    related, but the following are some measures that can be taken
    in the AML sphere to help in this area:

        Better nuanced Recommendations and guidance from
            FATF and regulators is needed.

          In October 2014, FATF spoke out against blanket
            derisking and said that FIs should derisk only on a
            case by case basis. FinCEN, the FDIC, and the OCC
            followed that up asking banks to come to the regulators
            if they felt pressure to terminate an MSB relationship.
            Other regulators have followed.

          Unfortunately it seems that there is no hard data
            to be able to measure what has happened in the market
            since.

          After an outcry from the global nonprofit
            community, FATF revised its guidance with respect to
            the problematic Recommendation 8, but I think it still
            needs further revision and U.S. Treasury could use its
            influence to make that happen. Please contact Kay
            Guinane at the Charity and Security Network for further
            information (kguinane@charityandsecurity.org).

        Banks should have access to information from FinCEN
            about whether an MSB has been the subject of formal
            warnings/cease and desists which are not public
            information, so that they can better judge the strength
            of an MSB's compliance program and its weaknesses.

        Create a low-cost certification scheme for smaller
            MSBs. Such a scheme would create benchmarks for MSB
            compliance programs, similar to what has been done in
            the development of an ISO standard for anticorruption
            compliance. This could perhaps be subsidized by a fund
            the big banks pay into for the smaller MSBs.

        One element of compliance cost is identifying the
            true owners and controllers of MSBs and charities, as
            well as the remitters themselves. Transparency about
            who owns and controls companies would be a real help
            with that.

        National ID schemes for individuals around the
            world are also important. India leading the way in
            effectively doing this in rural populations living in
            poverty--the hardest to reach and often recipients of
            remittances. While it may seem to be outside of
            Congress' remit, USAID has financially supported these
            initiatives in the past and Congress could prioritize
            funding to USAID to continue and/or increase this work.

    Q.3. Scope of AML Reporting--In recent House testimony, you
    noted that AML compliance and reporting is undertaken by a wide
    range of entities and persons beyond the banking sector. You
    also made clear that there are entities and persons not
    currently regulated or required to have AML programs in place,
    that really ought to if the system is to be comprehensive.
        Can you give us a sense of the scope of entities and
    persons you think we ought to have in mind, beyond the banking
    sector, when contemplating an update to our current anti-money
    laundering framework and its underlying authorities?

    A.3. FATF has identified several of what it calls Designated
    Non-Financial Businesses and Professions, or DNFPB's, as
    businesses and professions that are susceptible for, or can be
    used to play a part in, money laundering. The idea is that
    these businesses and professions should identify who they are
    doing business with, in some cases carry out some customer due
    diligence, and file suspicious activity reports if they think a
    transaction is suspicious.
        The U.S. already requires some DNFBPs to have those AML
    programs, such as casinos and dealers in precious metals and
    stones. Treasury regulations originally also included others,
    including travel agents, those involved in real estate
    closings, and car, plane, and boat dealers, among others, but
    then Treasury gave them a ``temporary'' exemption from the
    requirements with no sunset for that exemption which has now
    been in place for many years. Still others never made it on any
    list, and those four are lawyers, accountants, corporate
    service providers, and escrow agents. For these four, AML
    programs would really be about knowing with whom you are doing
    business and not permitting practitioners in these businesses
    and professions to be able to have plausible deniability that
    they didn't have reason to know or suspect that they were
    providing services that might be laundering dirty money.
        While there are clearly several businesses and professions
    missing from U.S. regulation, I would focus on five of them:
    lawyers, those involved in real estate closings, corporate
    service providers, escrow agents, and accountants.
        Lawyers: Of course criminals need and use legal services. A
    60 Minutes piece that aired last year featured undercover
    footage from an organization called Global Witness, showing
    just how easy it is to walk into a law firm in New York and get
    a lawyer to easily suggest ways in which structures could be
    created to spend money that is clearly the proceeds of
    corruption to buy real estate, planes, etc. One attorney even
    suggested running the dirty money through the lawyer's client
    account to clean it. It was a real eye-opener. In 2010, the
    American Bar Association published what I would characterize as
    sound Voluntary Good Practices Guidance for Lawyers to Detect
    and Combat Money Laundering and Terrorist Financing, but I
    encourage you to ask every lawyer you know if they have
    implemented it. It is unlikely that they have even heard of it.
    This voluntary guidance is simply not enough.
        Escrow Agents: Senate Permanent Subcommittee on
    Investigations' 2010 report Keeping Foreign Corruption Out of
    the United States: Four Case Histories tells the story of how
    one escrow agent, McAfee & Taft, refused to provide escrow
    services to Teodorin Obiang, the corrupt, playboy son of the
    long time dictator of the impoverished Nation of Equatorial
    Guinea, because the anti-money laundering policy they had
    voluntarily put in place prescribed that they do so. Another
    escrow agent without an AML program happily took that money.
        Corporate Service Providers: The Panama Papers showed just
    how entangled corporate service providers like Mossack Fonseca
    can be in facilitating money laundering, corruption, and tax
    evasion. The book Global Shell Games details research by a team
    of American and Australian academics into just how easy it is
    to create an anonymous company to engage in terror finance or
    corruption in different countries around the world through
    corporate service providers. They found that the easiest
    country in which to do so was the United States. One email
    response to the researchers' inquiry from a corporate service
    provider in Florida was, ``[Y]our started purpose could well be
    a front for funding terrorism, and who the f---- would get
    involved in that? Seriously, if you wanted a functioning and
    useful Florida corporation you'd need someone here to put their
    name on it, set up bank accounts, etc. I wouldn't even consider
    doing that for less that 5k a month, and I doubt you are going
    to find any suckers that will do it for less, if at all. If you
    are working with less than serious money, don't waste anybody's
    time here. Using a f------ google account also shows you are
    just a f------ poser and loser. If you have a serious proposal,
    write it up and we will consider it. Your previous message and
    this one are meaningless crap. Get a clue. Just how stupid do
    you think we are?''
        Those Involved in Real Estate: With respect to real estate,
    since July 2016, FinCEN has had geographic targeting orders in
    place in various counties in New York, Florida, Texas, and
    California, requiring title insurance companies to collect
    beneficial ownership information for those entities buying high
    value real estate with cash. They found that about 30 percent
    of the beneficial owners identified by the title companies
    already had SARs filed on them by other financial institutions.
    That's nearly one third. Exposes like The New York Times'
    ``Towers of Secrecy'' show just how easy it is for people to
    hide behind anonymous companies and buy real estate with
    proceeds of crime and corruption. It is central to the 2017
    indictment of Paul Manafort and Richard Gates as well.

    Q.4. Cryptocurrencies--As the use of cryptocurrencies continues
    to evolve and to spread, questions have been raised about the
    abuse of such virtual currency for money laundering and other
    illicit purposes.
        Can you please comment on the current exploitation of
    virtual currency for illicit finance purposes, as well as the
    potential for blockchain technology to short-circuit our
    current AML regulatory and enforcement frameworks? In your
    opinion, what tools should the U.S. Government be developing,
    now, to head off this threat?

    A.4. I am not sufficiently informed to provide a detailed
    response to this question, but recommend that you contact the
    following people to develop a greater understanding of the
    threats and opportunities posed by both cryptocurrencies
    (referred to as ``virtual currencies'' in international
    regulatory parlance) and the blockchain technology that
    underpins them, but also has much wider applications.
        Yaya Fanusie, Director of Analysis, Center on Sanctions and
    Illicit Finance (yaya@defenddemocracy.org); Tom Robinson, COO
    and Cofounder, Elliptic (tom@elliptic.co); Jamie Smith, Global
    Chief Communications Officer, The Bitfury Group
    (jamie.smith@bitfury.com).
                                    ------

            RESPONSES TO WRITTEN QUESTIONS OF SENATOR SASSE
                          FROM HEATHER A. LOWE

    Q.1. This hearing discussed the importance of increasing
    information sharing between financial institutions and with law
    enforcement officials.
        What--if any--are the privacy risks with facilitating the
    sharing of such information?
        What are the best ways to mitigate such privacy concerns?
        Increased information sharing between financial
    institutions could make it easier for individuals to be
    completely cut out of the United States' financial system. How
    should wrongly targeted individuals be able to challenge their
    designation?
        What should our risk tolerance be for the fact that the
    U.S. financial system facilitates crimes like human
    trafficking? Should we strive to have zero incidence of money
    laundering in our financial system?

    A.1. There are three types of privacy risks that I would
    identify here--the information security risk, the risk of
    personal information being sold or otherwise transmitted by
    financial institutions for reasons other than communicating
    risk of criminal activity, and the ``cut out'' risk. I do not
    have the right expertise to effectively address the information
    security risk, and recommend that you speak with cybersecurity
    experts focusing on the financial sector and to FinCEN/law
    enforcement regarding their cybersecurity protections (and
    protections on the BSA database), as those will be the two
    types of entities between which this information would be
    passed and collected.
        Regarding the risk of information being sold or otherwise
    transmitted for purposes other than detection of criminal
    activity, the laws and regulations around what type of
    information can be transmitted, to whom, and how and how long
    it should be retained should be very clearly defined in
    legislation/regulation.
        The risk that someone could be incorrectly identified as a
    bad actor and cut out of the global financial system is
    certainly a risk here. It is a common complaint associated with
    being added to the OFAC's Specially Designated Nationals and
    Blocked Persons (SDN) list. Another complaint about the SDN
    list is that sometimes people do not know why they have been
    placed on the SDN list and there is no procedure for
    challenging the designation. In that case, there is one body
    making those designations. In a world of financial institution
    information sharing, those decisions would be just as opaque,
    could have been made by any financial institution, and there is
    even less redress because a financial institution is never
    under an obligation to open an account for someone.
        Ultimately, we are also talking about information sharing
    that is global and repercussions that are global, so I don't
    think the U.S. will be able to create a redress system alone. I
    think a redress system would probably need to involve FinCEN,
    however, because of the confidential nature of the information
    involved. FinCEN is the U.S.'s Financial Intelligence Unit, or
    FIU. Most other countries with any sort of AML monitoring that
    might end up denying someone access also have an FIU. Those
    FIUs are, with some exceptions, members of a body called the
    Egmont group, which has rules and methods for information
    sharing among Egmont FIUs. There are over 135 FIU members of
    Egmont at present. The U.S. could spearhead the creation of a
    redress process in this area that involved the Egmont FIUs, or
    a review panel housed within that secretariat the was, perhaps,
    funded by bank contribution.
        In terms of expectations with respect to money laundering,
    at my organization, Global Financial Integrity, we always speak
    in terms of curtailing the problem. We understand that it can
    never be entirely prevented. However, I caution against using
    terms like ``tolerance.'' There is no acceptable level of known
    money laundering that should be tolerated. We need to have
    reasonable expectations with respect to how much money
    laundering can be detected by financial institutions that have
    well-crafted and executed AML compliance programs in place, and
    we need reasonable expectations as to what a well-crafted and
    executed AML program is. Congress is currently in the dark with
    respect to independently verifiable information about the
    nonpublic citations financial institutions are currently
    receiving for compliance program failures and whether they are
    reasonable. Congress has only the complaints of industry
    representatives themselves, many of whom resent AML compliance
    and reporting requirements writ large and have every incentive
    to overstate the problem. The massive fines levied on banks in
    recent years have been the result of knowing, willful, and
    egregious violations of laws and regulations in the AML area in
    order to turn a blind eye to money laundering their clearly
    knew about in order to increase profits. There should be zero
    tolerance for that.

    Q.2. I'd like to understand better how technological innovation
    is transforming the fight against money laundering and how
    Government policy can help or hurt these efforts.
        In the health care context, I hear about how researchers
    have used machine learning and artificial intelligence to
    identify diseases and predict when they will occur, using data
    points that humans would have never put together. How have
    financial institutions or law enforcement officials been able
    to use of similar techniques to identify money laundering and
    how much more progress can be made in this front?
        Outside of AI and machine learning, how can recent FinTech
    innovations such as blockchain fight money laundering?
        What regulatory requirement or requirements--if any--most
    hinders the adoption of technological innovations?
        How much does bitcoin, blockchain, and other
    cryptocurrencies facilitate money laundering? How--if at all--
    should this impact our approach to combating money laundering
    in traditional banks? How can law enforcement officials best
    stop this newer form of money laundering?

    A.2. With respect to the first bulleted question, there is a
    very wide world of financial analytics in use to identify money
    laundering and expertise to create the algorithms used in these
    processes. I am not an expert in analytics, unfortunately, but
    there is an entire industry of people who can provide a helpful
    response to this question, although they may not be able to
    answer this broad of a question in written form.
        With respect to the remaining bullet points, the most
    significant block to adopting new technologies is, I believe, a
    concern that regulators will not recognize the use of a new
    technology as a positive development in examinations. I
    therefore support the creation of a technological ``sandbox'',
    as has been proposed by The Clearing House and has been
    implemented in the U.K. It is important to note that the U.K.
    structure appears to have some specific safeguards to protect
    consumers which they consider to be an integral part of their
    system. U.K. regulators presented their approach at a recent
    FATF industry consultation meeting I attended. They stressed
    the importance of ensuring that consumers were protected at all
    times as innovative approaches were being tested, and the U.S.
    should do the same. In the House of Representatives, Members
    are discussing legislative language that does not require any
    of the safeguards present in the U.K. system, potentially
    giving financial institutions an unlimited safe harbor for the
    use of any new technology with no Government oversight. This is
    a significant danger because if a financial institution spends
    the money to integrate new technology that, it turns out, isn't
    as effective as alternative methods, they would have no
    incentive to change their approach. They would incur some
    unwelcome cost for doing so and they'd have the security of an
    unlimited safe harbor, so there would be no incentive to act.
        Connecting this in with blockchain technology, there is
    certainly work being done in this area. You may wish to reach
    out to Tom Robinson, COO and Cofounder, Elliptic
    (tom@elliptic.co). Elliptic is a company that finds ways to
    identify the ``anonymous'' digital currency traders to help
    with customer due diligence problems associated with digital
    currencies.
        Mr. Robinson recently coauthored a paper entitled ``Bitcoin
    Laundering: An Analysis of Illicit Flows Into Digital Currency
    Services'' with the Foundation for Defense of Democracy's Yaya
    Fanusie, a long-time expert on illicit and terror finance who
    has been researching the linkages between terror finance and
    digital currency. I would recommend reaching out to Mr. Fanusie
    to further explore this area. Yaya Fanusie, Director of
    Analysis, Center on Sanctions and Illicit Finance
    (yaya@defenddemocracy.org).

    Q.3. I'd like to discuss Suspicious Activity Reports (SARs).
    Today, around 2 million SARs are filed each year. While every
    SAR used to be read by law enforcement officials, that is no
    longer the case today. Financial institutions often complain
    that they rarely, if ever, receive feedback from law
    enforcement officials on the utility of any particular
    suspicious activity report that they file. This lack of
    feedback loops increases the burdens on financial institutions,
    who continue to file SARs that are of little utility to law
    enforcement officials. It also prevents financial institutions
    from developing better analytical tools to more precisely
    discern between the signal and the noise.
        What percentage of SARs are actually read by someone in law
    enforcement?

    A.3. I am not aware of credible estimates. This question will
    need to be answered by FinCEN.

    Q.4. How often do financial institutions receive feedback from
    law enforcement officials as to the utility of their SAR
    filing?

    A.4. Such feedback is rare. While law enforcement cannot and
    should not share information about an ongoing investigation, at
    the very least they could be collecting statistics about the
    number of SARs/CTRs from a given financial institution that
    they followed up on in some way. Where a SAR from a financial
    institution (or many SARs from several institutions, which is
    more likely) helped law enforcement bring a strong case, it
    could be worthwhile to positively identify the banks that
    helped the case in this way once the case is resolved. Positive
    reinforcement is important. I once highlighted a seminal case
    regarding tax evasion and money laundering at an international
    AML conference in Florida. A very excited compliance officer
    from the U.S. Virgin Islands approached me after presentation--
    she had been the person to file the SAR that resulted in the
    case and she had never known what had happened to it. She was
    thrilled that her actions had made a difference, and remembered
    the SAR because the activity seemed so odd to her at the time.
    I believe that we would have a much more robust AML defense
    system in the U.S. if more bankers and compliance officers were
    given such opportunities to feel like their actions really made
    a difference. Therefore, I am in favor of initiatives like
    FinCEN Exchange, announced in December, to enhance information
    sharing with Financial Institutions. However FinCEN needs to
    make this a meaningful program in its execution if it is to
    have any impact.

    Q.5. While some have proposed reducing the number of SARs and
    CRT filings because they are often superfluous and are never
    read, others argue that this poses risks, because investigating
    minor infractions may still lead to significant law enforcement
    successes. How should policymakers resolve this conflict?

    A.5. The driving force behind this complaint from industry is
    the amount of resources spent on drafting SARs, including
    preparatory investigation time. CTR filings are automatically
    generated when more than $10,000 is deposited, so should be
    discussed separately if there really are valid concerns there.
    One source of tension in this area appears to be that law
    enforcement wants SARs to include as much information as
    possible, in as standard a format as possible, and that their
    demands for greater detail and specificity have grown over
    time. This has obviously developed over time as law enforcement
    has identified what information is most useful to them and the
    presentation that is most useful--specificity that the
    financial institutions have actually asked for over time.
    However, financial institution employees may not have the
    desired level of detail that law enforcement would like--that
    is simply a reality of money laundering cases which often
    involve hidden conduct and individuals. The SAR instructions
    properly allow filers to indicate on the form that the
    information is ``unknown''; that option should be honored by
    law enforcement rather than trying to require bank employees to
    become detectives uncovering illegal conduct.

    Q.6. How could regulators (1) set up better feedback loops
    between financial institutions and law enforcement officials
    that could help financial institutions better identify money
    laundering; and (2) empower financial institutions to act upon
    their improved ability to distinguish between useful and
    superfluous reports, including by filing fewer unnecessary
    SARs, without fearing regulatory consequences for doing so?

    A.6. I believe my answer is subsumed in the responses above.

    Q.7. Would a better feedback loop system exist if financial
    institutions employed more people with security clearances? If
    so, what, if anything, can the Federal Government do to
    facilitate this?

    A.7. I do not have an opinion on this question.

    Q.8. Often, financial institutions will derisk by refusing to
    serve customers that could be involved in illegal activity. As
    financial institutions start to share more information with
    each other, this practice could become more prominent and
    potential criminals could more frequently lose access to the
    United States' financial system altogether.
        Are there instances in which derisking is actually
    unhelpful for law enforcement purposes, because it drives these
    criminals underground and makes it more difficult to track
    them?
        At the moment, do the regulators that evaluate and enforce
    financial institutions compliance with our Federal money
    laundering take this into account?
        Are there promising ways to increase cooperation between
    financial institutions, regulators, and law enforcement
    officials, so that financial institutions can make a more
    informed decision about when and how to derisk?
        Would financial institutions need to hire more employees
    with a top security clearance and/or a law enforcement
    background for this coordination to be effective?

    A.8. My organization focuses on the movement of illicit money
    out of developing countries the effect of that financial flow
    for development, and not financial flows into developing
    countries, so we have not focused a great deal on the
    remittances and nonprofit issues. Nonprofit organizations like
    the Charity and Security Network, Oxfam, and the Center for
    Global Development, and intergovernmental organizations such as
    the World Bank, the IMF, the OECD and others have been doing a
    great deal more research in this area and I would recommend
    speaking with them for more developed and far-reaching
    recommendations.
        Having said that, there are three somewhat different
    problems in the derisking area with root causes that are not
    all AML-related, and I think that is a really important point
    here. One is that banks that are no longer willing to provide
    banking services to money service businesses (MSBs) that are
    the primary movers of remittances. Second is banks choosing not
    to do business with correspondent banks in certain very high-
    risk countries. (The Somali remittance problems are a
    combination of both these first and second categories.) Third,
    is the problem of banks choosing not to provide banking
    services for charities/nonprofits. These are related issues,
    but not the same issues. Something to bear in mind as well is
    that the World Bank has found that the cost of transmitting
    remittances has actually decreased over the past several years,
    suggesting that some of the problems in the sector may really
    be location specific, such as with Somalia, as opposed to being
    as widespread as discussion on this topic might suggest.
        In 2012 and the following 2 years, FATF Recommendations and
    related guidance were published relating to risks posed by
    nonprofits and risks posed by MSBs. That guidance suggested
    that those entire sectors were particularly vulnerable to money
    laundering with no nuance, which resulted in banks categorizing
    them all as high risk, regardless of the nature of those
    businesses, the strength of their compliance programs, their
    clientele, or other risk assessment factors. The general
    refrain from banks was that it was too costly to do proper AML
    vetting on all these ``high risk'' entities. Banks also said
    they were pulling out of high risk areas because of an increase
    in fines and penalties, but very few fines/penalties have been
    levied related to servicing MSB or nonprofit clients, which
    begs the question of whether this reaction was simply
    disproportionate or driven by other motives, such as an excuse
    to get out of these relatively low-margin lines of business.
        For example, Barclays in the U.K. caused a bit of a crisis
    when it closed the accounts of the vast majority of the money
    service businesses it serviced. But it held on to MSBs with
    assets of $10m or more. However, the significant MSB money
    laundering case on record actually relates to Western Union,
    one of the world's largest and well-capitalized MSBs. Barclays'
    decision to jettison smaller MSB accounts was made not in
    relation to actual enforcement trends, how good their MSB
    clients' compliance programs were, or other risks relating to
    the individual MSB's business or other relevant factors, it was
    made on whether the bank wanted to keep that capitalization or
    not and bother to continue servicing smaller accounts where its
    margin was smaller and getting smaller because of compliance
    costs. It would be interesting to find out pre-2012 margins on
    these business lines versus post-2012 margins so that Congress
    has a frame of reference for what a bank consider an
    unacceptable margin in these business lines.
        And that raises an important point in all of this that is
    very often missed. There has been huge bank consolidation
    leading to behemoth banks that do not consider providing
    services to smaller account holders to be worth the cost. (In
    our experience, smaller, local banks rarely provide adequate
    international transfer services and did not do so prior to AML
    regulation.) We see that every day as banking fees for people
    who have little savings climb while those who have sizable
    accounts have no fees at all. Banks are doing everything they
    can to increase their profit margins with little regard to the
    effect on the average account holder. That's today's business
    model, and bank decisions regarding MSB and nonprofit account
    holders are driven in large part by this model. Furthermore,
    the Center for Global Development put out a report on derisking
    in 2015. In that report, they noted that some banks have
    ``derisked'' and then beefed up their own money transmitter
    services, suggesting a possible move to undermine competition
    and seize the market themselves.
        So there are problems, some of which are not actually AML
    related, but the following are some measures that can be taken
    in the AML sphere to help in this area:

        Better nuanced Recommendations and guidance from
            FATF and regulators is needed.

          In October 2014, FATF spoke out against blanket
            derisking and said that FIs should derisk only on a
            case by case basis. FinCEN, the FDIC, and the OCC
            followed that up asking banks to come to the regulators
            if they felt pressure to terminate an MSB relationship.
            Other regulators have followed.

          Unfortunately it seems that there is no hard data
            to be able to measure what has happened in the market
            since.

          After an outcry from the global nonprofit
            community, FATF revised its guidance with respect to
            the problematic Recommendation 8, but I think it still
            needs further revision and U.S. Treasury could use its
            influence to make that happen. Please contact Kay
            Guinane at the Charity and Security Network for further
            information (kguinane@charityandsecurity.org).

        Banks should have access to information from FinCEN
            about whether an MSB has been the subject of formal
            warnings/cease and desists which are not public
            information, so that they can better judge the strength
            of an MSB's compliance program and its weaknesses.

        Create a low-cost certification scheme for smaller
            MSBs. Such a scheme would create benchmarks for MSB
            compliance programs, similar to what has been done in
            the development of an ISO standard for anticorruption
            compliance. This could perhaps be subsidized by a fund
            the big banks pay into for the smaller MSBs.

        One element of compliance cost is identifying the
            true owners and controllers of MSBs and charities, as
            well as the remitters themselves. Transparency about
            who owns and controls companies would be a real help
            with that.

        National ID schemes for individuals around the
            world are also important. India leading the way in
            effectively doing this in rural populations living in
            poverty--the hardest to reach and often recipients of
            remittances. While it may seem to be outside of
            Congress' remit, USAID has financially supported these
            initiatives in the past and Congress could prioritize
            funding to USAID to continue and/or increase this work.
                                    ------

            RESPONSES TO WRITTEN QUESTIONS OF SENATOR TILLIS
                          FROM HEATHER A. LOWE

    Q.1. How can we leverage technology to make the process
    simultaneously less onerous on banks while enhancing the
    outcomes of catching illegal behavior? Are there regulatory and
    legislative barriers to getting that down?
        Financial institutions often complain that FinCEN, law
    enforcement officials, and prudential regulators do not tell
    them whether their BSA filings serve a useful purpose, or how
    the reports they submit are being used--and that the filings go
    into a black hole. Can you shed some light on the filings that
    you make or have used and what could be done to improve this
    process?

    A.1. While law enforcement cannot and should not share
    information about an ongoing investigation, at the very least
    they could be collecting statistics about the number of SARs/
    CTRs from a given financial institution that they followed up
    on in some way. Where a SAR from a financial institution (or
    many SARs from several institutions, which is more likely)
    helped law enforcement bring a strong case, it could be
    worthwhile to positively identify the banks that helped the
    case in this way once the case is resolved. Positive
    reinforcement is important. I once highlighted a seminal case
    regarding tax evasion and money laundering at an international
    AML conference in Florida. A very excited compliance officer
    from the U.S. Virgin Islands approached me after presentation--
    she had been the person to file the SAR that resulted in the
    case and she had never known what had happened to it. She was
    thrilled that her actions had made a difference, and remembered
    the SAR because the activity seemed so odd to her at the time.
    I believe that we would have a much more robust AML defense
    system in the U.S. if more bankers and compliance officers were
    given such opportunities to feel like their actions really made
    a difference. Therefore, I am in favor of initiatives like
    FinCEN Exchange, announced in December, to enhance information
    sharing with Financial Institutions. However FinCEN needs to
    make this a meaningful program in its execution if it is to
    have any impact.

    Q.2. Another compliance challenge often cited by banks is that
    they feel pressured by bank examiners and law enforcement
    authorities to exit certain business lines or cease offering
    certain services to customers viewed as presenting particular
    money-laundering vulnerabilities, i.e., severing corresponding
    banking relationships with foreign institutions in certain
    geographic areas, and also ending money services businesses
    (MSBs, i.e., check cashing, money transmitters, currency
    exchange outlets, etc.)
        As banks reevaluate their business relationships with MSBs
    in light of what they may view as a hostile regulatory
    landscape, what can we do to change this type of behavior/is
    this a prevalent problem in the industry?

    A.2. My organization focuses on the movement of illicit money
    out of developing countries the effect of that financial flow
    for development, and not financial flows into developing
    countries, so we have not focused a great deal on the
    remittances and nonprofit issues. Nonprofit organizations like
    the Charity and Security Network, Oxfam, and the Center for
    Global Development, and intergovernmental organizations such as
    the World Bank, the IMF, the OECD and others have been doing a
    great deal more research in this area and I would recommend
    speaking with them for more developed and far-reaching
    recommendations.
        Having said that, there are three somewhat different
    problems in the derisking area with root causes that are not
    all AML-related, and I think that is a really important point
    here. One is that banks that are no longer willing to provide
    banking services to money service businesses (MSBs) that are
    the primary movers of remittances. Second is banks choosing not
    to do business with correspondent banks in certain very high-
    risk countries. (The Somali remittance problems are a
    combination of both these first and second categories.) Third,
    is the problem of banks choosing not to provide banking
    services for charities/nonprofits. These are related issues,
    but not the same issues. Something to bear in mind as well is
    that the World Bank has found that the cost of transmitting
    remittances has actually decreased over the past several years,
    suggesting that some of the problems in the sector may really
    be location specific, such as with Somalia, as opposed to being
    as widespread as discussion on this topic might suggest.
        In 2012 and the following 2 years, FATF Recommendations and
    related guidance were published relating to risks posed by
    nonprofits and risks posed by MSBs. That guidance suggested
    that those entire sectors were particularly vulnerable to money
    laundering with no nuance, which resulted in banks categorizing
    them all as high risk, regardless of the nature of those
    businesses, the strength of their compliance programs, their
    clientele, or other risk assessment factors. The general
    refrain from banks was that it was too costly to do proper AML
    vetting on all these ``high risk'' entities. Banks also said
    they were pulling out of high risk areas because of an increase
    in fines and penalties, but very few fines/penalties have been
    levied related to servicing MSB or nonprofit clients, which
    begs the question of whether this reaction was simply
    disproportionate or driven by other motives, such as an excuse
    to get out of these relatively low-margin lines of business.
        For example, Barclays in the U.K. caused a bit of a crisis
    when it closed the accounts of the vast majority of the money
    service businesses it serviced. But it held on to MSBs with
    assets of $10m or more. However, the significant MSB money
    laundering case on record actually relates to Western Union,
    one of the world's largest and well-capitalized MSBs. Barclays'
    decision to jettison smaller MSB accounts was made not in
    relation to actual enforcement trends, how good their MSB
    clients' compliance programs were, or other risks relating to
    the individual MSB's business or other relevant factors, it was
    made on whether the bank wanted to keep that capitalization or
    not and bother to continue servicing smaller accounts where its
    margin was smaller and getting smaller because of compliance
    costs. It would be interesting to find out pre-2012 margins on
    these business lines versus post-2012 margins so that Congress
    has a frame of reference for what a bank consider an
    unacceptable margin in these business lines.
        And that raises an important point in all of this that is
    very often missed. There has been huge bank consolidation
    leading to behemoth banks that do not consider providing
    services to smaller account holders to be worth the cost. (In
    our experience, smaller, local banks rarely provide adequate
    international transfer services and did not do so prior to AML
    regulation.) We see that every day as banking fees for people
    who have little savings climb while those who have sizable
    accounts have no fees at all. Banks are doing everything they
    can to increase their profit margins with little regard to the
    effect on the average account holder. That's today's business
    model, and bank decisions regarding MSB and nonprofit account
    holders are driven in large part by this model. Furthermore,
    the Center for Global Development put out a report on derisking
    in 2015. In that report, they noted that some banks have
    ``derisked'' and then beefed up their own money transmitter
    services, suggesting a possible move to undermine competition
    and seize the market themselves.
        So there are problems, some of which are not actually AML
    related, but the following are some measures that can be taken
    in the AML sphere to help in this area:

        Better nuanced Recommendations and guidance from
            FATF and regulators is needed.

          In October 2014, FATF spoke out against blanket
            derisking and said that FIs should derisk only on a
            case by case basis. FinCEN, the FDIC, and the OCC
            followed that up asking banks to come to the regulators
            if they felt pressure to terminate an MSB relationship.
            Other regulators have followed.

          Unfortunately it seems that there is no hard data
            to be able to measure what has happened in the market
            since.

          After an outcry from the global nonprofit
            community, FATF revised its guidance with respect to
            the problematic Recommendation 8, but I think it still
            needs further revision and U.S. Treasury could use its
            influence to make that happen. Please contact Kay
            Guinane at the Charity and Security Network for further
            information (kguinane@charityandsecurity.org).

        Banks should have access to information from FinCEN
            about whether an MSB has been the subject of formal
            warnings/cease and desists which are not public
            information, so that they can better judge the strength
            of an MSB's compliance program and its weaknesses.

        Create a low-cost certification scheme for smaller
            MSBs. Such a scheme would create benchmarks for MSB
            compliance programs, similar to what has been done in
            the development of an ISO standard for anticorruption
            compliance. This could perhaps be subsidized by a fund
            the big banks pay into for the smaller MSBs.

        One element of compliance cost is identifying the
            true owners and controllers of MSBs and charities, as
            well as the remitters themselves. Transparency about
            who owns and controls companies would be a real help
            with that.

        National ID schemes for individuals around the
            world are also important. India leading the way in
            effectively doing this in rural populations living in
            poverty--the hardest to reach and often recipients of
            remittances. While it may seem to be outside of
            Congress' remit, USAID has financially supported these
            initiatives in the past and Congress could prioritize
            funding to USAID to continue and/or increase this work.

    Q.3. It is my understanding that there are times when law
    enforcement and the bank regulators work at cross purposes.
    That is, law enforcement might want a bank to continue banking
    an individual or company that they are following and building a
    case against but the bank regulators, whose incentives are to
    not be embarrassed by their regulated entities, force the banks
    to ``derisk'' or close those accounts. Is that actually the
    case?

    A.3. There is no reputational risk associated with continuing
    to bank a customer when instructed to do so by law enforcement.
    A bank will not be sanctioned by examiners for doing so. The
    information will not be made public. This seems a spurious
    complaint if it is being made by industry.

    Q.4. In terms of AML, we know that the success of AML is
    centric around whether or not the predicate crime of money
    laundering has been reduced, but we only really know how
    pervasive money laundering is on a reactive basis, i.e., when
    someone/some entity is caught.
        To that end, do you believe the advent/popularity of
    cryptocurrencies could affect the capture of money laundering/
    could it affect AML? Do enforcement authorities have the
    technological capabilities to work with private industry to
    capture mal-actors?

    A.4. NOTE: Your introduction suggests some confusion with
    respect to money laundering (i.e., reference to ``whether or
    not the predicate crime of money laundering has been
    reduced''). It is critical to understand that money laundering
    is a crime in and of itself and is not a predicate offense. The
    crime is thought by many to be the crime of laundering/
    disguising/accepting the funds of some underlying crime that
    generated money, otherwise known as a predicate offense or, in
    U.S. statutory terms, a specified unlawful activity (SUA). That
    is correct, but it is not complete. A person can be convicted
    of money laundering if they believed they were accepting/
    disguising the proceeds of an SUA and took steps to do so. That
    means that even if nobody has been convicted of the underlying
    crime that is the SUA, a person can be convicted of laundering
    the related funds. However, in almost every ``money
    laundering'' case you have heard of, the banks were not charged
    with actual criminal money laundering. They were charged with
    violations of provisions of the Bank Secrecy Act requiring
    financial institutions to have in place measures to detect when
    someone is trying to use the institution to launder money and
    preventative measures that detect if anyone inside the
    institution is allowing money to be laundered by the
    institution.
        The advent and popularity of digital currencies are an
    emerging threat in the money laundering field because much of
    our AML policies depend on a financial institution carrying out
    ``due diligence'' and ``know your customer'' checks. That is
    why accounts opened by companies with hidden beneficial
    ownership are such a problem. One of the biggest challenges
    with digital currencies is also the fact that the transactions
    are essentially conducted anonymously. For more information, I
    recommend that you contact Tom Robinson, COO and Cofounder,
    Elliptic (tom@elliptic.co). Elliptic is a company that finds
    ways to identify the ``anonymous'' digital currency traders to
    help with customer due diligence problems associated with
    digital currencies.
        Mr. Robinson recently coauthored a paper entitled ``Bitcoin
    Laundering: An Analysis of Illicit Flows Into Digital Currency
    Services'' with the Foundation for Defense of Democracy's Yaya
    Fanusie, a long-time expert on illicit and terror finance who
    has been researching the linkages between terror finance and
    digital currency. I would recommend reaching out to Mr. Fanusie
    to further explore this area. Yaya Fanusie, Director of
    Analysis, Center on Sanctions and Illicit Finance
    (yaya@defenddemocracy.org).

    Q.5. In your opinion, do you think that the overall AML regime
    has been effective? Additionally, what do you see as the best
    way to ensure future effectiveness?
        Is it to have Treasury be the lead to:
        1. Define with other stakeholders specific and clear
    national priorities of the regime; and
        2. Determine, working with other stakeholders, clear and
    measurable objectives of the regime in light of those
    priorities. Should Treasury or someone else have to report
    those measurements against the objectives back to Congress?

    A.5. My organization has estimated that just 11 types of
    transnational crime generate a total proceeds of between $1.6
    and $2.2 trillion annually. There are many, many more types of
    crime that generate proceeds in this world. Most of that money
    must be laundered in some way. As noted above, there is very
    little prosecution for large-scale criminal money laundering,
    even when it seems from charging documents that criminal money
    laundering (which includes an intent standard) was taking
    place. In addition, individuals are not being prosecuted and
    jailed for their actions in the cases that we see, which would
    be a significant deterrent to money laundering. That may be
    changing, however, as I note in a recent piece that I wrote
    about the Rabobank case. So I would say that we are not
    prosecuting criminal money laundering and that is a problem.
        What you are asking, however, is really whether the
    regulatory regime that is in place to detect money laundering
    and prevent banks from engaging in it has been effective. There
    is no way to determine this through data because hard data (not
    extrapolated estimates) of the amount of money laundered in the
    world do not and cannot exist by their very nature. What I can
    say is that the AML compliance violation cases that we have
    seen over the past few years (HSBC, Wachovia, Citigroup, BNP
    Paribas, Rabobank, etc.) tell us that many large international
    bank were either paying lip service to complying with the legal
    requirements or were actively subverting the measures up until
    about 2010. I have no reason to believe that these cases are
    not indicative of an industrywide approach because banks had
    absolutely no incentive to comply with laws which would
    ultimately require them to turn away clients and money that
    they had previously banked very willingly. The question at this
    point is whether, now that there has been some significant
    enforcement of AML compliance laws, banks are actually
    complying with those laws and regulations and if they are
    turning away business/closing accounts where there is
    significant indication of money laundering.
        The crescendo of complaints by the industry about the
    ``rising cost'' of compliance indicates that this is the case.
    I have ``rising cost'' in quotations because we are talking
    about the cost of complying with laws that have been in place
    for many, many years now, so this is neither a new cost nor one
    that could not have been anticipated, and should be estimated
    in terms of costs that should have been incurred and spread
    over that lengthy time period. The other indication that the
    regime is now having an effect is the industry's
    disproportionate measures in what has come to be called
    ``derisking'' entire client categories and/or business with
    certain countries. Some of that activity may be due to a
    serious concern by the bank about managing the risks associated
    with a certain business, but research has indicated that some
    banks may be jettisoning some types of business in order to
    freeze out competition for those services and then offering
    those services themselves (such as in the money transmission
    area).
        In some cases, I think certain actions are being taken in
    order to try to force deregulation, such as when Bank of
    America, a major provider of banking services to foreign
    embassies in the U.S., sent a letter to its embassy clients
    that it was going close their accounts and cease to provide
    banking services to them only one week before closing their
    accounts. The action seemed clearly designed to create a
    diplomatic crisis for the U.S. Government, to be blamed on U.S.
    AML regulation. If Bank of America's concern was really AML
    related, they should have worked with FinCEN and law
    enforcement to identify accounts, individuals and activities of
    concern and, after doing so, closed the accounts in accordance
    with a process that was agreed with the Government. If the
    decision was that they simply did not want to service what they
    perceived as a high-risk client but they hadn't actually
    observed money laundering red flags associated with the
    accounts, they should have provided the embassies with adequate
    notice, giving them time to find an alternative service
    provider and to migrate their accounts. Instead, they chose to
    create an unnecessary and unwarranted diplomatic crisis which
    should have had the effect of undermining their credibility in
    speaking out with AML regulatory concerns. It certainly
    undermined their credibility with me.
        Giving FinCEN total responsibility for establishing annual
    AML priorities for banks and monitoring every bank's progress
    every 3 months, as was recommended by the Clearing House, is
    extremely ill-advised. A financial institution understands its
    own business and products better than anyone else. It is
    therefore best-placed to determine what its AML risks are and
    how best to address those risks within the systems that it has
    created. We support the idea of a financial institution working
    with FinCEN/Treasury to discuss those risks in the context of
    national and global trends observed by FinCEN, and whether
    adjustments might be made as a result, however. In addition,
    reviewing each financial institution's progress in AML every 3
    months seems like far too short a time frame to observe how an
    FI is progressing in this respect, however, and entirely
    impractical from a Government resource allocation perspective.
        On a related note the suggestion that FinCEN be given
    access to bulk data transfers from financial institutions to
    enable it to analyze AML trends and patterns across
    institutions is another potentially useful idea. But questions
    about the effectiveness and cost of this proposal include
    whether FinCEN currently has the technological capability and
    personnel needed to perform that type of data analysis or
    whether it would need to be built, which could be a significant
    expense. In addition, charging FinCEN with industrywide data
    collection and analysis should not be seen as a way for banks
    to absolve themselves of their AML obligations. The banks would
    retain their position as the primary gateway into the U.S.
    financial system, so the first level of responsibility to
    safeguard the system against money-laundering abuses must
    remain with the individual banks who open their accounts to
    individuals and entities around the world.
                                    ------

            RESPONSES TO WRITTEN QUESTIONS OF SENATOR WARNER
                          FROM HEATHER A. LOWE

    Q.1. What are the costs and benefits of having bank examiners
    assess bank compliance with the Bank Secrecy Act's (BSA)
    requirements instead of having anti-money laundering (AML) and
    combating the financing of terrorism (CFT) experts at the
    Financial Crimes Enforcement Network (FinCEN) examine bank
    compliance programs?

    A.1. I am not sure it will make much of a difference.
    Currently, you have examiners sitting at the Securities and
    Exchange Commission, the Commodities Futures Trading Commission
    and other specialized agencies who have specific AML/CFT
    training. When they have AML/CFT enforcement questions, they
    liaise with FinCEN as needed. If you had those people instead
    within FinCEN, they have easy access to FinCEN personnel but
    would have to reach out to the other agencies for sector-
    specific guidance. Would bringing all of the examiners into
    FinCEN result in a more coherent approach to examination?
    Unlikely, unless specific changes were made to the examination
    procedures and incentives for examiners. However, I can also
    imagine that should there be more coherence in examination
    procedure across industries, it would give rise to the problem
    that examinations are not nuanced enough and therefore not even
    addressing issues specific to a given industry where AML/CFT
    risks may be significant. I can imagine that industry
    complaints about that would surge. No company will ever be
    happy with the way they are examined, so it is most important
    to work with industry to identify real problems which result in
    ineffective or inadequate AML oversight and with law
    enforcement to identify areas where the resources being
    expended by industry seem disproportionate to the value of
    information gleaned from their efforts, and not just industry
    complaints.

    Q.2. Is there a way to maintain a top-shelf effective AML/CFT
    policy while maintaining a commitment to increase access to
    financial products for the underbanked and immigrants who rely
    on remittance services?
        I'm interested in the ways in which technology can aid AML
    compliance efforts. What are some of the innovative
    technologies that you've seen that hold some promise for either
    the Government or the private sector?
        What are the barriers to either the Government or the
    private sector adopting these technologies?
        What can we be doing as legislators to ensure that we
    promote technological innovation in this sector?

    A.2. The most significant block to adopting new technologies
    is, I believe, a concern that regulators will not recognize the
    use of a new technology as a positive development in
    examinations. I therefore support the creation of a
    technological ``sandbox'', as has been proposed by The Clearing
    House and has been implemented in the U.K. It is important to
    note that the U.K. structure appears to have some specific
    safeguards to protect consumers which they consider to be an
    integral part of their system. U.K. regulators presented their
    approach at a recent FATF industry consultation meeting I
    attended. They stressed the importance of ensuring that
    consumers were protected at all times as innovative approaches
    were being tested, and the U.S. should do the same. In the
    House of Representatives, members are discussing legislative
    language that does not require any of the safeguards present in
    the U.K. system, potentially giving financial institutions an
    unlimited safe harbor for the use of any new technology with no
    Government oversight. This is a significant danger because if a
    financial institution spends the money to integrate new
    technology that, it turns out, isn't as effective as
    alternative methods, they would have no incentive to change
    their approach. They would incur some unwelcome cost for doing
    so and they'd have the security of an unlimited safe harbor, so
    there would be no incentive to act.

    Q.3. The regulatory definition of ``financial institution'' has
    been expanded several times over the years, both by FinCEN
    rulemaking and by legislation by Congress.
        Should the definition of financial institutions be expanded
    to include other sectors? If so, which sectors?
        Could these changes be made via FinCEN rulemaking or should
    legislation be passed?

    A.3. FATF has identified several of what it calls Designated
    Non-Financial Businesses and Professions, or DNFPB's, as
    businesses and professions that are susceptible for, or can be
    used to play a part in, money laundering. The idea is that
    these businesses and professions should identify who they are
    doing business with, in some cases carry out some customer due
    diligence, and file suspicious activity reports if they think a
    transaction is suspicious.
        The U.S. already requires some DNFBPs to have those AML
    programs, such as casinos and dealers in precious metals and
    stones. Treasury regulations originally also included others,
    including travel agents, those involved in real estate
    closings, and car, plane, and boat dealers, among others, but
    then Treasury gave them a ``temporary'' exemption from the
    requirements with no sunset for that exemption which has now
    been in place for many years. Still others never made it on any
    list, and those four are lawyers, accountants, corporate
    service providers, and escrow agents. For these four, AML
    programs would really be about knowing with whom you are doing
    business and not permitting practitioners in these businesses
    and professions to be able to have plausible deniability that
    they didn't have reason to know or suspect that they were
    providing services that might be laundering dirty money.
        While there are clearly several businesses and professions
    missing from U.S. regulation, I would focus on five of them:
    lawyers, those involved in real estate closings, corporate
    service providers, escrow agents, and accountants.
        Lawyers: Of course criminals need and use legal services. A
    60 Minutes piece that aired last year featured undercover
    footage from an organization called Global Witness, showing
    just how easy it is to walk into a law firm in New York and get
    a lawyer to easily suggest ways in which structures could be
    created to spend money that is clearly the proceeds of
    corruption to buy real estate, planes, etc. One attorney even
    suggested running the dirty money through the lawyer's client
    account to clean it. It was a real eye-opener. In 2010, the
    American Bar Association published what I would characterize as
    sound Voluntary Good Practices Guidance for Lawyers to Detect
    and Combat Money Laundering and Terrorist Financing, but I
    encourage you to ask every lawyer you know if they have
    implemented it. It is unlikely that they have even heard of it.
    This voluntary guidance is simply not enough.
        Escrow Agents: Senate Permanent Subcommittee on
    Investigations' 2010 report Keeping Foreign Corruption Out of
    the United States: Four Case Histories tells the story of how
    one escrow agent, McAfee & Taft, refused to provide escrow
    services to Teodorin Obiang, the corrupt, playboy son of the
    long time dictator of the impoverished Nation of Equatorial
    Guinea, because the anti-money laundering policy they had
    voluntarily put in place prescribed that they do so. Another
    escrow agent without an AML program happily took that money.
        Corporate Service Providers: The Panama Papers showed just
    how entangled corporate service providers like Mossack Fonseca
    can be in facilitating money laundering, corruption, and tax
    evasion. The book Global Shell Games details research by a team
    of American and Australian academics into just how easy it is
    to create an anonymous company to engage in terror finance or
    corruption in different countries around the world through
    corporate service providers. They found that the easiest
    country in which to do so was the United States. One email
    response to the researchers' inquiry from a corporate service
    provider in Florida was, ``[Y]our started purpose could well be
    a front for funding terrorism, and who the f---- would get
    involved in that? Seriously, if you wanted a functioning and
    useful Florida corporation you'd need someone here to put their
    name on it, set up bank accounts, etc. I wouldn't even consider
    doing that for less that 5k a month, and I doubt you are going
    to find any suckers that will do it for less, if at all. If you
    are working with less than serious money, don't waste anybody's
    time here. Using a f------ google account also shows you are
    just a f------ poser and loser. If you have a serious proposal,
    write it up and we will consider it. Your previous message and
    this one are meaningless crap. Get a clue. Just how stupid do
    you think we are?''
        Those Involved in Real Estate: With respect to real estate,
    since July 2016, FinCEN has had geographic targeting orders in
    place in various counties in New York, Florida, Texas, and
    California, requiring title insurance companies to collect
    beneficial ownership information for those entities buying high
    value real estate with cash. They found that about 30 percent
    of the beneficial owners identified by the title companies
    already had SARs filed on them by other financial institutions.
    That's nearly one third. Exposes like The New York Times'
    ``Towers of Secrecy'' show just how easy it is for people to
    hide behind anonymous companies and buy real estate with
    proceeds of crime and corruption. It is central to the 2017
    indictment of Paul Manafort and Richard Gates as well.

    Q.4. In August 2017, FinCEN issued an advisory encouraging real
    estate brokers to share information with them that could be
    helpful in AML efforts, while noting they are not required to
    do so under current law.
        How do we increase information sharing between real estate
    brokers and FinCEN?

    A.4. Voluntary measures will not yield the necessary results
    because it is rare for a business to voluntarily want to lose
    out on a sale or for it to be discovered that if you work with
    a particular agent they may provide information to law
    enforcement about your transcation. Any measure must be
    industrywide and required to maintain a level playing field. It
    is necessary to bring them into the definition of Financial
    Institution. Please see response to previous question.

    Q.5. Geographic Targeting Orders (GTOs), which impose
    additional record keeping and reporting requirements on
    domestic financial institutions or nonfinancial trades or
    businesses in a specific geographic area for transactions
    involving certain amounts of United States currency or monetary
    instruments, have been deployed since 2016 to target high-end
    real estate sectors in major metropolitan areas by requiring
    U.S. title insurance companies to identify the natural persons
    behind shell companies used to pay ``all cash'' for high-end
    residential real estate.
        Are GTOs an effective tool or would regulation be a
    preferable way to cover the real estate sector?

    A.5. GTOs are an effective tool for the purposes they were
    created--to gather intelligence for specific cases or, as in
    this case, to gather intelligence about the extent of a problem
    to inform decisions about how to move forward. They should not
    be used as a long-term measure. With respect to the Title
    Insurer GTOs, FinCEN now has the information it needs to move
    forward with a rulemaking--there is clearly a problem in the
    real estate industry.
        However, I would note that I would not focus regulation in
    the real estate sector on title insurers, but rather on real
    estate agents, who have the longest and most personal
    relationship with the buyer and are in a much better position
    to identify red flags. Furthermore, it is very easy for a cash
    buyer of real estate to avoid title insurers entirely (which
    launderers have apparently not realized yet). If I'm trying to
    launder money through real estate and I'm making an all-cash
    purchase, I don't need a mortgage and so title insurance isn't
    actually required. If I'm going to flip the property to launder
    the funds, then I'm not too worried about a challenge to title
    down the line (my buyer will get their own title insurance and
    my lack of it doesn't affect that). If I am concerned that the
    title is not clean and it will therefore be difficult to sell
    the property, I can have an attorney carry out a title search
    or I can even do it myself--the search itself is not difficult
    (I would probably need legal assistance to fix any problems I
    found however, if I didn't simply abandon that particular
    purchase). So if I were a money launderer I would simply avoid
    the title insurers and avoid the disclosures entirely.

    Q.6. Cryptocurrency exchanges are money services businesses
    supervised by State regulators and subject to Federal AML and
    CFT laws.
        Should FinCEN play an enhanced role in assessing the
    compliance of cryptocurrency exchanges, or are State regulators
    sufficiently equipped to handle compliance monitoring?
        What additional tools could we give regulators and law
    enforcement?
        How prevalent is money laundering in cryptocurrency
    markets?

    A.6. There is certainly work do be done in the area of digital
    currency/blockchain technology. I am far from an expert in this
    area, so I will make some recommendations for people to
    contact. Before I do, however, I would note that I was
    concerned by the Treasury representative's statement that they
    felt they had adequately regulated in the digital currency
    space by regulating the exchangers. Technology has moved on,
    and the advent of ``mixers'', which are now used to make it
    incredibly difficult for the exchangers to identify where the
    currency they are exchanging is coming from, makes that
    regulation now insufficient.
        You may wish to reach out to Tom Robinson, COO and
    Cofounder, Elliptic (tom@elliptic.co). Elliptic is a company
    that finds ways to identify the ``anonymous'' digital currency
    traders to help with customer due diligence problems associated
    with digital currencies.
        Mr. Robinson recently coauthored a paper entitled ``Bitcoin
    Laundering: An Analysis of Illicit Flows Into Digital Currency
    Services'' with the Foundation for Defense of Democracy's Yaya
    Fanusie, a long-time expert on illicit and terror finance who
    has been researching the linkages between terror finance and
    digital currency. I would recommend reaching out to Mr. Fanusie
    to further explore this area. Yaya Fanusie, Director of
    Analysis, Center on Sanctions and Illicit Finance
    (yaya@defenddemocracy.org).
        Finally, Ms. Jamie Smith, Global Chief Communications
    Officer, The Bitfury Group (jamie.smith@bitfury.com), is an
    excellent resource as well.
        Both Ms. Smith and Mr. Fanusie have extensive prior
    experience working within U.S. Government agencies and
    understand political context well.
                                    ------

                   RESPONSES TO WRITTEN QUESTIONS OF
               SENATOR CORTEZ MASTO FROM HEATHER A. LOWE

    Q.1. What is the most effective action a consumer can take to
    protect against identity theft if the consumer's information
    has been compromised? Please include a detailed description of
    the differences between credit freezes, credit locks, and fraud
    alerts, including how long each takes to activate and
    deactivate and the relative benefits and drawbacks of each.

    A.1. Unfortunately, I am not an expert on U.S. consumer banking
    laws and cannot provide an informed response to your question.

    Q.2. Many States have laws requiring credit bureaus to provide
    credit freezes. Can you describe what these laws generally
    require and discuss whether it is appropriate for Congress to
    create a Federal standard?

    A.2. Unfortunately, I am not an expert on U.S. consumer banking
    laws and cannot provide an informed response to your question.

    Q.3. Gaming and tourism are some of Nevada's top industries. In
    the State of Nevada, our gaming operators employ thousands of
    hard working Nevadans, and the industry as a whole domestically
    supports 1.7 million jobs across 40 States. Qualified casinos,
    like financial institutions, are also subject to Banking
    Secrecy Act requirements. Organizations within Nevada have
    suggested that gaming operators would welcome a review of BSA
    requirements, which they find to be burdensome. They look
    forward to this Committee's thoughtful, bipartisan, review of
    BSA requirements that takes into account the security
    imperative for robust anti-money laundering efforts, as well as
    the impact those requirements have on all industries. For
    example, the Suspicious Activity Report (SAR) ($5,000) and the
    Currency Transaction Report (CTR) ($10,000) levels were set
    years ago. Some have recommended increasing these to correspond
    with inflation. Others believe that would be too high but do
    support a higher amount than currently.
        One of the top priorities of the gaming industry is to
    remove the requirement for a detailed factual narrative for
    structuring in the suspicious activity forms. What do you think
    of this recommendation?
        Do you have specific recommendations regarding how the
    gaming industry can benefit from greater communication with
    Government agencies and law enforcement? Is there something the
    Federal Government can do to share information with casinos and
    others filing SARs about broad benefits that may occur because
    of some of the 58,000 SAR forms filed by gaming firms.
        Would the creation of a Qualitative Feedback Mechanism help
    reduce money laundering and terrorist financing? Should the
    Secretary of the Treasury establish a mechanism to communicate
    anti-money laundering (AML) and countering terrorism financing
    (CTF) priorities to financial institutions, gaming
    establishments, and Federal financial regulators? Could such a
    mechanism provide qualitative feedback on information shared by
    financial institutions with the Department of Treasury,
    including CTRs and SARs? Please describe the pros and cons of
    such a system.

    A.3. Financial Institutions file SARs because they believe that
    activity is suspicious, and descriptions of what they saw that
    seemed suspicious is important information for law enforcement.
    SARs are subject to automated data analysis and human review,
    and the narratives provide information that may seem
    unimportant alone, but takes on greater significance when
    reviewed in light of other SARs. I would not remove the
    narrative requirement unless law enforcement takes the position
    that it is of limited value.
        Lack of feedback from the Government on what happens to
    SARs and CTRs has long been a complaint of Financial
    Institutions. I once highlighted a seminal case regarding tax
    evasion and money laundering at an international AML seminar in
    Florida. A very excited compliance officer from the U.S. Virgin
    Islands approached me after presentation--she had been the
    person to file the SAR that resulted in the case and she had
    never known what had happened to it. She was thrilled that her
    actions had made a difference. I believe that we would have a
    much more robust AML defense system in the U.S. if more bankers
    and compliance officers were given such opportunities to feel
    like their actions really made a difference. Therefore, I am in
    favor of initiatives like FinCEN Exchange, announced in
    December, to enhance information sharing with Financial
    Institutions. I would strongly recommend that the gaming
    industry engage with FinCEN quickly to ensure that this
    initiative is set up for the gaming industry in a way that
    results in practical and meaningful exchange of information
    with the Government as opposed to something less useful.
        I am wary when it comes to the Government setting AML
    priorities for the industry. It already happens to some extent,
    but I would strongly caution against actually transferring
    responsibility for setting AML priorities for individual
    Financial Institutions from those institutions to FinCEN.
    Financial Institutions are best placed to understand their
    business and their systems and the money laundering risks
    inherent therein, and create the systems that work best in
    their business models to combat money laundering. FinCEN and/or
    other regulators should review those assessments but cannot be
    responsible for carrying them out.

    Q.4. The Office of the Comptroller of the Currency mentioned in
    its 2018 Banking Operating Plan that financial institutions
    should not inadvertently impair financial inclusion. But, as of
    September 2017, the OCC has not identified any specific issues
    they plan to address. We know that derisking has become an
    epidemic across many communities and industries, such as
    communities along the Southwest border, humanitarian
    organizations aiding Nations wracked with violence, and
    remittances providers that serve fragile Nations like Somalia.
        What type of guidance could the OCC, FinCEN, FDIC, and the
    Federal Reserve provide to help banks meet the banking needs of
    legitimate consumers and businesses that are at risk of losing
    access--or have already lost access?

    A.4. My organization focuses on the movement of illicit money
    out of developing countries the effect of that financial flow
    for development, and not financial flows into developing
    countries, so we have not focused a great deal on the
    remittances and nonprofit issues. Nonprofit organizations like
    the Charity and Security Network, Oxfam, and the Center for
    Global Development, and intergovernmental organizations such as
    the World Bank, the IMF, the OECD and others have been doing a
    great deal more research in this area and I would recommend
    speaking with them for more developed and far-reaching
    recommendations.
        Having said that, there are three somewhat different
    problems in the derisking area with root causes that are not
    all AML-related, and I think that is a really important point
    here. One is that banks that are no longer willing to provide
    banking services to money service businesses (MSBs) that are
    the primary movers of remittances. Second is banks choosing not
    to do business with correspondent banks in certain very high-
    risk countries. (The Somali remittance problems are a
    combination of both these first and second categories.) Third,
    is the problem of banks choosing not to provide banking
    services for charities/nonprofits. These are related issues,
    but not the same issues. Something to bear in mind as well is
    that the World Bank has found that the cost of transmitting
    remittances has actually decreased over the past several years,
    suggesting that some of the problems in the sector may really
    be location specific, such as with Somalia, as opposed to being
    as widespread as discussion on this topic might suggest.
        In 2012 and the following 2 years, FATF Recommendations and
    related guidance were published relating to risks posed by
    nonprofits and risks posed by MSBs. That guidance suggested
    that those entire sectors were particularly vulnerable to money
    laundering with no nuance, which resulted in banks categorizing
    them all as high risk, regardless of the nature of those
    businesses, the strength of their compliance programs, their
    clientele, or other risk assessment factors. The general
    refrain from banks was that it was too costly to do proper AML
    vetting on all these ``high risk'' entities. Banks also said
    they were pulling out of high risk areas because of an increase
    in fines and penalties, but very few fines/penalties have been
    levied related to servicing MSB or nonprofit clients, which
    begs the question of whether this reaction was simply
    disproportionate or driven by other motives, such as an excuse
    to get out of these relatively low-margin lines of business.
        For example, Barclays in the U.K. caused a bit of a crisis
    when it closed the accounts of the vast majority of the money
    service businesses it serviced. But it held on to MSBs with
    assets of $10m or more. However, the significant MSB money
    laundering case on record actually relates to Western Union,
    one of the world's largest and well-capitalized MSBs. Barclays'
    decision to jettison smaller MSB accounts was made not in
    relation to actual enforcement trends, how good their MSB
    clients' compliance programs were, or other risks relating to
    the individual MSB's business or other relevant factors, it was
    made on whether the bank wanted to keep that capitalization or
    not and bother to continue servicing smaller accounts where its
    margin was smaller and getting smaller because of compliance
    costs. It would be interesting to find out pre-2012 margins on
    these business lines versus post-2012 margins so that Congress
    has a frame of reference for what a bank consider an
    unacceptable margin in these business lines.
        And that raises an important point in all of this that is
    very often missed. There has been huge bank consolidation
    leading to behemoth banks that do not consider providing
    services to smaller account holders to be worth the cost. (In
    our experience, smaller, local banks rarely provide adequate
    international transfer services and did not do so prior to AML
    regulation.) We see that every day as banking fees for people
    who have little savings climb while those who have sizable
    accounts have no fees at all. Banks are doing everything they
    can to increase their profit margins with little regard to the
    effect on the average account holder. That's today's business
    model, and bank decisions regarding MSB and nonprofit account
    holders are driven in large part by this model. Furthermore,
    the Center for Global Development put out a report on derisking
    in 2015. In that report, they noted that some banks have
    ``derisked'' and then beefed up their own money transmitter
    services, suggesting a possible move to undermine competition
    and seize the market themselves.
        So there are problems, some of which are not actually AML
    related, but the following are some measures that can be taken
    in the AML sphere to help in this area:

        Better nuanced Recommendations and guidance from
            FATF and regulators is needed.

          In October 2014, FATF spoke out against blanket
            derisking and said that FIs should derisk only on a
            case by case basis. FinCEN, the FDIC, and the OCC
            followed that up asking banks to come to the regulators
            if they felt pressure to terminate an MSB relationship.
            Other regulators have followed.

          Unfortunately it seems that there is no hard data
            to be able to measure what has happened in the market
            since.

          After an outcry from the global nonprofit
            community, FATF revised its guidance with respect to
            the problematic Recommendation 8, but I think it still
            needs further revision and U.S. Treasury could use its
            influence to make that happen. Please contact Kay
            Guinane at the Charity and Security Network for further
            information (kguinane@charityandsecurity.org).

        Banks should have access to information from FinCEN
            about whether an MSB has been the subject of formal
            warnings/cease and desists which are not public
            information, so that they can better judge the strength
            of an MSB's compliance program and its weaknesses.

        Create a low-cost certification scheme for smaller
            MSBs. Such a scheme would create benchmarks for MSB
            compliance programs, similar to what has been done in
            the development of an ISO standard for anticorruption
            compliance. This could perhaps be subsidized by a fund
            the big banks pay into for the smaller MSBs.

        One element of compliance cost is identifying the
            true owners and controllers of MSBs and charities, as
            well as the remitters themselves. Transparency about
            who owns and controls companies would be a real help
            with that.

        National ID schemes for individuals around the
            world are also important. India leading the way in
            effectively doing this in rural populations living in
            poverty--the hardest to reach and often recipients of
            remittances. While it may seem to be outside of
            Congress' remit, USAID has financially supported these
            initiatives in the past and Congress could prioritize
            funding to USAID to continue and/or increase this work.

    Q.5. Last year, the Countering Iran's Destabilizing Activities
    Act of 2017 (P.L. 115-44) was enacted. In Section 271, it
    required the Treasury Department to publish a study by May 1,
    2018, on two issues:
        Somali Remittances: The law required the U.S. Department of
    Treasury to study if banking regulators should establish a
    pilot program to provide technical assistance to depository
    institutions and credit unions that wish to provide account
    services to money services businesses serving individuals in
    Somalia. Such a pilot program could be a model for improving
    the ability of U.S. residents to make legitimate funds
    transfers through easily monitored channels while preserving
    strict compliance with BSA.
        Sharing State Banking Exams: The law also required Treasury
    to report on the efficacy of money services businesses being
    allowed to share certain State exam information with depository
    institutions and credit unions to increase their access to the
    banking system.
        Have you or your organization been involved with these
    Treasury studies?
        What advice did you give--or would you give--on the pilot
    studies?

    A.5. I have not been involved with either of these Treasury
    studies because other organizations have been leading research
    and advocacy on remittance issues. They may have been involved
    in and/or consulted on these issues. Please contact: Kay
    Guinane, Director of the Charity and Security Network
    (kguinane@charityandsecurity.org); Vijaya Ramachandran, Senior
    Fellow at the Center for Global Development
    (vramachandran@cgdev.org).

    Q.6. In 2016, William and Margaret Frederick were moving from
    Ohio to Las Vegas. Unfortunately, it is alleged that the title
    company they used in Columbus, Ohio, fell for an email scam and
    wired the $216,000 profit from their home sale to a hacker, not
    to the Fredericks. William is 83 and Margaret is 75 and as of
    October, they were still trying to get their money back. While
    the Fredericks' tale is now a court case to determine who was
    responsible for the fraudulent information, we know that the
    Fredericks' experience is ``very typical'' of scams that divert
    an estimated $400 million a year from title companies into
    bogus accounts.
        Please describe the responsibilities of financial firms to
    avoid these frauds?
        What penalties should be assessed and by which agencies
    when financial firms enable theft?
        What is the role for the Consumer Financial Protection
    Bureau to ensure financial firms protect their customers' money
    and information?

    A.6. As noted above, I am not an expert on U.S. consumer
    banking laws and cannot provide an informed response to your
    question with respect to CFPB. Your question regarding the
    title insurance company's culpability is a fact-specific
    question of criminal or tortious liability that I am unable to
    answer in this format, and does not relate to money laundering.

    Q.7. In 2014, FinCEN issued an advisory with human trafficking
    red flags, to aid financial institutions in detecting and
    reporting suspicious activity that may be facilitating human
    trafficking or human smuggling.
        To what extent do you assess that financial institutions
    are currently utilizing these red flags, in order to better
    assess whether their banks are being used for to finance human
    trafficking? If institutions are not widely utilizing the red
    flags, what actions is FinCEN taking to encourage them to do
    so?

    A.7. I have not seen any data pertaining to the number of SARs
    filed in relation to human trafficking or smuggling in the
    United States, so I do not have enough information to provide
    an accurate assessment. FinCEN has an online tool that can be
    used to look at the number of SARs filed with respect to
    specific activities, but unfortunately human trafficking is not
    one of the categories. However, anecdotally I can say that
    human trafficking and human smuggling are issues where I have
    seen a relatively large number of training programs offered to
    compliance personnel in recent years. It is therefore on the
    radar of compliance personnel in the U.S. at least. I would
    recommend that you reach out to FinCEN for an answer to this
    question and, if they are not currently collecting statistics
    to be able to answer this question, ask or legislate for them
    to do so. You might also reach out to Polaris for further
    discussions on the intersection between money laundering and
    human trafficking.

    Q.8. What are the pros and cons of reducing or eliminating the
    standards requiring SARs filing for insider abuse (i.e.,
    employee misconduct)?

    A.8. I do not have a strong opinion about this issue.
    Logically, however, I think it is helpful for FinCEN to know
    the identifying information of people who have been found by
    financial institutions to be engaging in fraudulent activity or
    other malfeasance, and for the CFPB to be aware of the same if
    it involved harm to consumers, but I do not necessarily think a
    SAR is likely to be the most effective way to communicate that.

    Q.9. The common expectation is that any financial institution
    subjected to a cyberattack would be in touch with law
    enforcement about whether or not it's required to file an SAR.
    What are the pros and cons of eliminating SAR filing
    requirement for cyberattacks against financial institutions?

    A.9. Cyberattacks are an ever-growing threat to the financial
    services sector and, therefore, to the business and individual
    consumers with accounts at financial institutions. A great deal
    of personal information is collected and held by financial
    institutions, so they are a particular target for that reason
    as well. I think FinCEN does a good job of explaining why they
    want cyberattacks to be reported in SAR form, how they have
    used such information in the past, and what information is most
    useful for them in a SAR relating to cyberattacks in an October
    2016 Advisory. In December 2017, news broke in the U.K. that
    the U.K.'s Financial Conduct Authority had found that U.K.
    banks were significantly under-reporting the full extent of
    cyberattacks. As history has shown in a number of AML-related
    areas, it is unlikely that U.S. banks are reporting more
    rigorously. This puts not only account holders at risk, but the
    entire fabric of our financial system.

    Q.10. As you know, under current regulations, FinCEN currently
    exempts a range of institutions from the requirement to
    maintain an anti-money laundering program. The list of exempted
    institutions includes ``pawnbrokers,'' ``private bankers,''
    ``seller of vehicles, including automobiles, airplanes and
    boats,'' as well persons ``involved in real estate closings and
    settlements'' among others.
        In your view, what are some of the most glaring exemptions
    on this list?
        Are there any additional categories of institution, such as
    persons involved in the art market or lawyers that should be
    required to establish minimum anti-money laundering program
    requirements?

    A.10. FATF has identified several of what it calls Designated
    Non-Financial Businesses and Professions, or DNFPB's, as
    businesses and professions that are susceptible for, or can be
    used to play a part in, money laundering. The idea is that
    these businesses and professions should identify who they are
    doing business with, in some cases carry out some customer due
    diligence, and file suspicious activity reports if they think a
    transaction is suspicious.
        The U.S. already requires some DNFBPs to have those AML
    programs, such as casinos and dealers in precious metals and
    stones. Treasury regulations originally also included others,
    including travel agents, those involved in real estate
    closings, and car, plane, and boat dealers, among others, but
    then Treasury gave them a ``temporary'' exemption from the
    requirements with no sunset for that exemption which has now
    been in place for many years. Still others never made it on any
    list, and those four are lawyers, accountants, corporate
    service providers, and escrow agents. For these four, AML
    programs would really be about knowing with whom you are doing
    business and not permitting practitioners in these businesses
    and professions to be able to have plausible deniability that
    they didn't have reason to know or suspect that they were
    providing services that might be laundering dirty money.
        While there are clearly several businesses and professions
    missing from U.S. regulation, I would focus on five of them:
    lawyers, those involved in real estate closings, corporate
    service providers, escrow agents, and accountants.
        Lawyers: Of course criminals need and use legal services. A
    60 Minutes piece that aired last year featured undercover
    footage from an organization called Global Witness, showing
    just how easy it is to walk into a law firm in New York and get
    a lawyer to easily suggest ways in which structures could be
    created to spend money that is clearly the proceeds of
    corruption to buy real estate, planes, etc. One attorney even
    suggested running the dirty money through the lawyer's client
    account to clean it. It was a real eye-opener. In 2010, the
    American Bar Association published what I would characterize as
    sound Voluntary Good Practices Guidance for Lawyers to Detect
    and Combat Money Laundering and Terrorist Financing, but I
    encourage you to ask every lawyer you know if they have
    implemented it. It is unlikely that they have even heard of it.
    This voluntary guidance is simply not enough.
        Escrow Agents: Senate Permanent Subcommittee on
    Investigations' 2010 report Keeping Foreign Corruption Out of
    the United States: Four Case Histories tells the story of how
    one escrow agent, McAfee & Taft, refused to provide escrow
    services to Teodorin Obiang, the corrupt, playboy son of the
    long time dictator of the impoverished Nation of Equatorial
    Guinea, because the anti-money laundering policy they had
    voluntarily put in place prescribed that they do so. Another
    escrow agent without an AML program happily took that money.
        Corporate Service Providers: The Panama Papers showed just
    how entangled corporate service providers like Mossack Fonseca
    can be in facilitating money laundering, corruption, and tax
    evasion. The book Global Shell Games details research by a team
    of American and Australian academics into just how easy it is
    to create an anonymous company to engage in terror finance or
    corruption in different countries around the world through
    corporate service providers. They found that the easiest
    country in which to do so was the United States. One email
    response to the researchers' inquiry from a corporate service
    provider in Florida was, ``[Y]our started purpose could well be
    a front for funding terrorism, and who the f---- would get
    involved in that? Seriously, if you wanted a functioning and
    useful Florida corporation you'd need someone here to put their
    name on it, set up bank accounts, etc. I wouldn't even consider
    doing that for less that 5k a month, and I doubt you are going
    to find any suckers that will do it for less, if at all. If you
    are working with less than serious money, don't waste anybody's
    time here. Using a f------ google account also shows you are
    just a f------ poser and loser. If you have a serious proposal,
    write it up and we will consider it. Your previous message and
    this one are meaningless crap. Get a clue. Just how stupid do
    you think we are?''
        Those Involved in Real Estate: With respect to real estate,
    since July 2016, FinCEN has had geographic targeting orders in
    place in various counties in New York, Florida, Texas, and
    California, requiring title insurance companies to collect
    beneficial ownership information for those entities buying high
    value real estate with cash. They found that about 30 percent
    of the beneficial owners identified by the title companies
    already had SARs filed on them by other financial institutions.
    That's nearly one third. Exposes like The New York Times'
    ``Towers of Secrecy'' show just how easy it is for people to
    hide behind anonymous companies and buy real estate with
    proceeds of crime and corruption. It is central to the 2017
    indictment of Paul Manafort and Richard Gates as well.

    Q.11. In recent years we've witnessed a seemingly endless
    string of money laundering violations by some of the largest
    global banks, with Deutsche Bank being the most recent megabank
    to disregard the anti-money laundering requirements contained
    in the Bank Secrecy Act.
        Given that large megabanks continued to disregard their
    obligations under the law, what in your view should this
    Committee do to ensure compliance, particularly by the largest
    global banks?

    A.11. Unfortunately for the banking community, many of the high
    profile, incredibly egregious cases that involve the biggest
    banks in the world have eroded public trust that banks will
    indeed act in a manner that is law-abiding and actively try to
    turn away proceeds of crime. Even many bankers lack faith in
    their institutions. You may find a 2015 study by the University
    of Notre Dame and the law firm of Labaton Sucharow, entitled
    ``The Street, the Bull, and the Crisis'', to be of interest.
    The researchers surveyed more than 1,200 U.S. and U.K.-based
    financial services professionals to examine views on workplace
    ethics, the nexus between principles and profits, the state of
    industry leadership and confidence in financial regulators. As
    the report states, ``The answers are not pretty. Despite the
    headline-making consequences of corporate misconduct, our
    survey reveals that attitudes toward corruption within the
    industry have not changed for the better.''
        There are forms of enforcement that we have not been
    pursuing that I believe would be highly dissuasive. The first
    is prosecuting the individuals that are behind the decisions
    that are resulting in these money laundering violations. When a
    banker sees his or her colleague being prosecuted for decisions
    that bring the proceeds of crime into the bank, he or she will
    be careful not to do the same. Second, prosecution of financial
    institutions has historically been for regulatory violations of
    the BSA as opposed to the criminal act of money laundering,
    even when the hallmarks of a clear money laundering case are
    present. We need to begin to criminally prosecute these
    entities as well. Finally, when a financial institution is
    convicted of or pleads guilty to felonious behavior, it must
    trigger any cross-debarments that we have built into our legal
    system. For example, Credit Suisse should have lost its status
    as a Qualified Professional Asset Manager (QPAM) in 2014 by
    virtue of its conviction for facilitating large-scale tax
    evasion by Americans. However, as with several similar cases
    which preceded it, the Department of Labor waived Credit
    Suisse's disqualification and allowed the bank to continue to
    enjoy this ``privileged'' status under U.S. law that meant that
    the bank had to meet fewer regulatory requirements in its
    handling of U.S. pension funds--something we tend to try to
    keep felons away from for public policy reasons.

    Q.12. Despite record fines, rarely have the individuals who run
    the largest global banks been held accountable for their firms'
    willful disregard of anti-money laundering and counterterrorism
    financing rules included in the Bank Secrecy Act.
        Can you discuss why we've seen such low levels of
    individual accountability for such violations? To what degree
    does the lack of clear chains of responsibility within large
    firms contribute to the lack of accountability among senior
    leaders?

    A.12. The Department of Justice is the most appropriate body to
    answer this question because it is the body that has taken
    these decisions based on the evidence before it, prosecution
    guidelines, and cost/benefit analysis. However, there have
    certainly been a few cases where information made publicly
    available the Statement of Facts attached to relevant Deferred
    Prosecution Agreements, such as excerpts from emails between
    executives, strongly suggested that there was sufficient
    evidence to bring individuals to trial in certain cases, and
    yet we did not see that happen. When I have asked the DOJ about
    this, they have responded that they did not feel that they had
    sufficient evidence to move forward with prosecution.
        After receiving a fair amount of criticism about this, in
    September 2015 the DOJ released a memo outlining its intention
    to more frequently prosecute individuals. It would be
    worthwhile to ask for the DOJ for statistics around
    prosecutions of individuals before and after the publication of
    the memo. It is possible that we are seeing the first
    significant example of this approach being applied to a large
    bank money laundering case in the case of Rabobank, as I
    explain more fully in a recent blog post that was heavily
    quoted in the press. It will be important to keep an eye on
    whether individual executives are prosecuted in that case for
    the reasons outlined in the blog.

    Q.13. Just as the success of the BSA is reliant on good
    behavior by individual employees of financial institutions, the
    efficacy of the BSA also depends on regulatory and supervisory
    accountability. U.S. anti-money laundering efforts in recent
    years at times failed to recognize the cumulative effect of the
    violations they cited, leading them to permit massive problems
    to occur before any serious enforcement actions were taken.
        What in your view should be done to address this problem
    and ensure that regulators are holding repeat violators of the
    Bank Secrecy Act accountable?
        To your knowledge, to what extent are Bank Secrecy Act
    deficiencies currently factored into the management aspect of
    firms' CAMELS rating?

    A.13. It seems clear that any policies in place regarding
    number and nature of infractions leading to escalation in
    enforcement actions are either insufficient or not adhered to.
    Either way, this is an area that could certainly benefit from
    Congressional review. Policies on elevation/escalation need to
    be clear, proportionate, and enforced in a way that results in
    meaningful adjustments/reforms being carried out by banks when
    they have been the subject of violation notices.
        While I think the revolving door issue is a tricky one (we
    want experienced people in Government and in financial
    institutions and they should have the ability to progress their
    careers), I am concerned that there may not be sufficient
    safeguards preventing regulators from moving directly to work
    for the banks that they have been regulating. In the recent
    Rabobank case, Rabobank's OCC examiner put Rabobank under a
    Formal Agreement (requiring reform of their AML compliance
    program), and then while that Formal Agreement was still in
    place, she was hired by Rabobank as a senior executive
    overseeing compliance at the bank. According to Rabobank's Plea
    Agreement and accompanying Information, the OCC released
    Rabobank form that Formal Agreement within the year, although
    bank employees reported that nothing substantial having changed
    within the bank's compliance program in that time. Whether or
    not the executive used her close ties to the OCC to get the
    Formal Agreement dismissed, measures should be put in place to
    ensure that the revolving door does not allow this type of
    situation to arise.

                  Additional Material Supplied for the Record
                   COUNTERING INTERNATIONAL MONEY LAUNDERING

    [GRAPHIC(S) NOT AVAILABLE IN TIFF FORMAT]

                      LETTER SUBMITTED BY THE FACT COALITION

    [GRAPHIC(S) NOT AVAILABLE IN TIFF FORMAT]

      STATEMENT SUBMITTED BY THE INDEPENDENT COMMUNITY BANKERS OF AMERICA

    [GRAPHIC(S) NOT AVAILABLE IN TIFF FORMAT]

           LETTER SUBMITTED BY THE CREDIT UNION NATIONAL ASSOCIATION

    [GRAPHIC(S) NOT AVAILABLE IN TIFF FORMAT]