ICIJ Leaked SAR Investigation Highlights Opportunity for BSA/AML Reform

• The International Consortium of Investigative Journalists (ICIJ) investigation is largely based on 2,100 leaked SARs.² Media reports based on the investigation suggest that the current U.S. AML/CFT system—which is designed to support investigations and prosecutions by producing certain reports and records that enable law enforcement to track illicit funds that have already passed through the system—fails to prevent criminal abuse of the financial system. Additionally, these media reports suggest that the high number of SARs filed each year—many of which reflect “false positives” or defensive filings intended to forestall criticism from authorities—risk overwhelming government investigators looking for actionable intelligence.
• Although the investigation centered on SARs filed with FinCEN, regulators in most jurisdictions have implemented similar SARs-based frameworks that share many of the same flaws highlighted by the investigations—for example, prioritizing providing particular reports to law enforcement over more proactive and holistic approaches to protecting national and global financial systems.
• On 16 September, FinCEN released an ANPRM soliciting comments on changes to regulations implementing the Bank Secrecy Act (BSA).³ FinCEN is considering regulatory amendments that would define an “effective and reasonably designed” BSA/AML program based on three criteria, as well as require FinCEN to produce a biannual list of national AML priorities. Both proposed changes are likely intended to allow financial institutions (FIs) to more efficiently allocate their AML resources in line with institutional and national risks and priorities and also enhance their risk-based implementation of preventive measures related to high-risk areas.

Stakeholders in both the public and private sector acknowledge that the current U.S. and global approach has imposed growing costs on the private sector, particularly FIs. At the same time, stakeholders are concerned that those costs have not necessarily produced a commensurate gain in preventing criminals, sanctioned parties, and other illicit actors from moving money and laundering funds through the global financial system. Although efforts to quantify the size and scope of illicit financing are inevitably imperfect, the United Nations Office on Drugs and Crime has estimated that criminals annually launder funds equivalent to two to five percent of global GDP. ⁴ Most observers agree that only a tiny fraction of those funds are discovered or ultimately seized by law enforcement. As one limited and partial measure, in Fiscal Year 2019 the U.S. Department of Justice Asset Forfeiture Fund received $2.07 billion in forfeited assets, or less than .01 percent of U.S. GDP.⁵

• U.S. FIs face mounting compliance costs in part because recent reforms, such as requirements for FIs to identify and verify beneficial ownership information for customers,⁶ have forced FIs to police other gatekeepers to the financial system—such as trust and company service providers, investment advisors, and company registrars. At the same time, these changes fall short of directly addressing the risks emanating from these sectors. Previous ICIJ investigations have identified these gatekeepers as playing a critical role in the abuse of the global financial system.^7,8
• FIs around the world are increasing their compliance spending, often in response to enforcement actions, yet still face challenges as their transaction monitoring systems generate large volumes of “false positive” alerts while missing important instances of illicit activity. One study estimated that total global compliance spending will surpass $180 billion in 2020, which would reflect an increase of 7 percent over two years.⁹
• U.S. FIs are also filing an increasing number of SARs, and public sector agencies’ human resources have struggled to keep pace. SAR filings by depository institutions alone passed 1.1 million in 2019, an increase in 27 percent over figures for 2015,¹⁰ and during this time, the number of FinCEN employees decreased by 21 percent, from 345 to 271.¹¹ The number of IRS criminal investigators has fallen to levels last seen in the 1970s.¹²

FIs should seize the opportunity to help shape the potential reforms identified in the ANPRM and to provide thoughtful input regarding the impact of proposed changes on both AML/CFT effectiveness and their daily operations, as well as to suggest alternative measures. Although most observers agree that the United States and other jurisdictions need to employ a more proactive and innovative approach, they disagree on the extent of changes necessary, with some supporting incremental reforms and others arguing that U.S. and global standards require top-down revision. Broader changes to the purpose of the BSA or to corporate formation procedures could require congressional action. Regulated entities—whether individually or through their industry associations—should consider the nature and extent of the regulatory and supervisory changes that would be necessary to implement a more efficient and effective system.

• The ANPRM suggests regulatory changes that are designed to hone the current system, making it more explicitly risk-based while providing potentially additional clarity for FIs, but does not contemplate sweeping changes to the U.S. approach.¹³
• The current U.S. and global approach to AML/CFT is reactive by design, due to the emphasis on “following the money” that has already transited the system. FIs may wish to consider, and seek guidance on, a preventive approach to protecting the financial system, one that endeavors to bar access to illicit actors while promoting financial inclusion to the unbanked or under-serviced. A preventive approach would facilitate greater integration of sanctions-related preventive measures with the risk-based approach that underpins U.S. and global AML standards. It would also emphasize stronger customer due diligence and risk profiling to develop a deeper understanding of expected and actual customer behavior in order to enhance and focus existing approaches to transaction monitoring and SAR reporting.
• SAR filings are only a one-way transfer of information from an FI to the government, and supervisory and regulatory stovepipes hinder the flow of information and make it difficult for FIs and authorities to take a holistic, sector-wide view of risk. Although information sharing mechanisms such as Section 314 of the USA PATRIOT Act allow FIs to share information with supervisors and one another in limited circumstances, the public and private sectors have not fully embraced these mechanisms, which may be too rigid and narrowly scoped to support systemically meaningful cooperation. Stronger public-private partnerships could help protect the integrity of the financial system by enabling more effective information sharing among FIs and between FIs and authorities.¹⁴
• Growing global concerns over privacy and data sovereignty are only increasing information sharing challenges—among FIs, between FIs and authorities, and even across an FI’s global operations—by creating barriers to sharing customers’ personal information. Innovative approaches could use machine learning, data encryption, and advanced data analytics to analyze data across borders or institutions, while preserving privacy, facilitating the more efficient and effective identification of illicit finance typologies and red flags, and allowing FIs to employ more effective preventive measures.