GAO-05-412, USA Patriot Act: Additional Guidance Could Improve Implementation of Regulations Related to Customer Identification and Information Sharing Procedures


This is the accessible text file for GAO report number GAO-05-412 
entitled 'USA PATRIOT Act: Additional Guidance Could Improve 
Implementation of Regulations Related to Customer Identification and 
Information Sharing Procedures' which was released on June 6, 2005. 

This text file was formatted by the U.S. Government Accountability 
Office (GAO) to be accessible to users with visual impairments, as part 
of a longer term project to improve GAO products' accessibility. Every 
attempt has been made to maintain the structural and data integrity of 
the original printed product. Accessibility features, such as text 
descriptions of tables, consecutively numbered footnotes placed at the 
end of the file, and the text of agency comment letters, are provided 
but may not exactly duplicate the presentation or format of the printed 
version. The portable document format (PDF) file is an exact electronic 
replica of the printed version. We welcome your feedback. Please E-mail 
your comments regarding the contents or accessibility features of this 
document to Webmaster@gao.gov. 

This is a work of the U.S. government and is not subject to copyright 
protection in the United States. It may be reproduced and distributed 
in its entirety without further permission from GAO. Because this work 
may contain copyrighted images or other material, permission from the 
copyright holder may be necessary if you wish to reproduce this 
material separately. 

Report to Congressional Requesters: 

May 2005: 

USA PATRIOT Act: 

Additional Guidance Could Improve Implementation of Regulations Related 
to Customer Identification and Information Sharing Procedures: 

[Hyperlink, http://www.gao.gov/cgi-bin/getrpt?GAO-05-412]

GAO Highlights: 

Highlights of GAO-05-412, a report to congressional requesters: 

Why GAO Did This Study: 

Title III of the USA PATRIOT Act of 2001, passed after the September 11 
terrorist attacks, amended U.S. anti-money laundering laws and imposed 
new requirements on financial institutions. Section 326 of the act 
required the development of minimum standards for verifying the 
identity of financial institution customers. Section 314 required the 
development of regulations encouraging the further sharing of 
information between law enforcement agencies and the financial industry 
and between the institutions themselves. Because of concerns about the 
implementation of these new provisions, GAO determined how (1) the 
government developed the regulations, educated the financial industry 
on them, and challenges it encountered; (2) regulators have updated 
guidance, trained examiners, and examined firms for compliance; and (3) 
the new regulations have affected law enforcement investigations. 

What GAO Found: 

Treasury (including its Financial Crimes Enforcement Network (FinCEN)), 
the federal financial regulators, and self-regulatory organizations 
(SRO) overcame challenges to create regulations that apply consistently 
to a diverse financial sector and have used several outreach mechanisms 
to help the financial industry understand and comply with Customer 
Identification Program (CIP) requirements under section 326 and 
information sharing requirements under section 314. However, several 
implementation challenges remain. Industry officials told us some of 
their concerns have been addressed but they are still concerned about 
(1) how some CIP requirements will be interpreted during compliance 
examinations, (2) the lack of feedback from law enforcement on 
information provided by financial institutions through section 314(a), 
and (3) the extent to which they can share information with each other 
under section 314(b). 

The six federal financial regulators and five SROs in our review have 
issued examination guidance covering sections 326 and 314, subsequently 
trained examiners, and begun examining financial institutions for 
compliance with CIP and section 314. GAO's review of examinations 
showed progress, but coverage varied in part because the examinations 
were conducted during early implementation. One aspect of CIP that was 
not always covered in examinations was whether financial institutions 
had adequately developed a CIP appropriate for their business lines and 
types of customers. However, this aspect of CIP is critical for 
ensuring that the identification and verification procedures are 
appropriate for types of customers and accounts that are at higher risk 
of being linked to money laundering or terrorist activities. Some 
examinations also revealed implementation difficulties related to CIP 
that could lead to inconsistencies in the way examiners conduct 
examinations. For example, some examiners did not differentiate between 
the CIP requirement and other procedures that require customer 
identification information. Coverage in the examinations GAO reviewed 
of how institutions had implemented section 314 requirements was 
somewhat lower than for CIP, in part, because CIP received more 
attention from examiners and information sharing between financial 
institutions is voluntary. In the examinations GAO reviewed, apparent 
violations of the CIP requirement and section 314(a) regulations were 
mostly addressed through informal actions between the institution and 
the regulator. 

Officials from the Department of Justice and other law enforcement 
agencies told us that CIP and section 314 have assisted them in the 
investigation of money laundering and terrorist financing cases. Some 
officials said that CIP has been useful because financial institutions 
have more information on their customers so they obtain more useful 
information when issuing grand jury subpoenas and other requests for 
information. Many officials said the 314(a) process had improved 
coordination between the law enforcement community and the financial 
industry and increased the speed and efficiency of investigations. 

What GAO Recommends: 

To help financial institutions implement their CIPs, GAO recommends 
that Treasury, through FinCEN and with the federal financial regulators 
and SROs, develop additional guidance on ongoing implementation issues. 
To improve examinations of compliance with CIP, GAO also recommends 
that FinCEN work with the federal financial regulators to develop 
additional guidance for examiners. Treasury agreed with GAO's 
recommendations. 

www.gao.gov/cgi-bin/getrpt?GAO-05-412. 

To view the full product, including the scope and methodology, click on 
the link above. For more information, contact Yvonne Jones at (202) 512-
2717 or jonesy@gao.gov. 

[End of section] 

Contents: 

Letter: 

Results in Brief: 

Background: 

Developing Regulations for CIP and Section 314 That Applied to a Wide 
Range of Financial Institutions Was Difficult and Complex: 

Treasury and the Federal Financial Regulators Have Reached Out to the 
Financial Industry to Assist It in Implementing CIP and Section 314 
Rules, but Industry Concerns Remain: 

Financial Regulators and SROs Have Updated Examination Guidance and 
Trained Examiners to Evaluate Compliance with CIP and Section 314: 

Examinations and Enforcement Actions Highlight Progress and 
Difficulties in Overseeing Compliance with the CIP Requirement and 
Section 314: 

Law Enforcement Officials Believe That Section 314(a) and CIP Have Been 
Valuable Tools in Terrorist and Money Laundering Investigations: 

Conclusions: 

Recommendations for Executive Action: 

Agency Comments and Our Evaluation: 

Appendixes: 

Appendix I: Scope and Methodology: 

Appendix II: Comments from the Department of the Treasury: 

Appendix III: Comments from the National Credit Union Administration: 

Appendix IV: Comments from the Securities and Exchange Commission: 

Appendix V: GAO Contacts and Staff Acknowledgments: 

Related Products: 

Tables: 

Table 1: Banking Regulators Anti-Money Laundering Training-2004: 

Table 2: Securities Regulators Anti-Money Laundering Training-2004: 

Table 3: Coverage of CIP in Our Sample of Examinations Conducted 
between October 1, 2003, and May 31, 2004: 

Table 4: Anti-Money Laundering Policies That Depend on Procedures to 
Verify Customer Identities: 

Table 5: Coverage of Section 314(a) in Our Sample of Examinations 
Conducted between October 1, 2003, and May 31, 2004: 

Table 6: Coverage of Section 314(b) in Our Sample of Examinations 
Conducted between October 1, 2003, and May 31, 2004: 

Table 7: Examples of Minor and Significant 314(a) Deficiencies and 
Violations Identified in the Sample: 

Table 8: Examples of Minor and Significant CIP Deficiencies and 
Violations Identified in the Sample: 

Table 9: Recent Enforcement Actions and Civil Money Penalties against 
Banks That Included CIP and Section 314(a) Violations: 

Table 10: Recent Enforcement Actions against Securities Broker-Dealers 
That Included CIP and Section 314(a) Violations: 

Table 11: Description of Our Approach for Sampling Examinations 
Covering CIP and Section 314: 

Figures: 

Figure 1: Key Dates in the Rulemaking Process for CIP: 

Figure 2: Requirements for Customer Identification and Verification 
Procedures: 

Figure 3: Key Dates of the Rulemaking Process for Section 314: 

Figure 4: The 314(a) Information Sharing Process after the Moratorium: 

Abbreviations: 

BSA: Bank Secrecy Act: 

CBOT: Chicago Board of Trade: 

CFTC: Commodity Futures Trading Commission: 

CIP: Customer Identification Program: 

CME: Chicago Mercantile Exchange: 

EOUSA: Executive Office for U.S. Attorneys: 

FAQ: Frequently Asked Question: 

FBI: Federal Bureau of Investigations: 

FDIC: Federal Deposit Insurance Corporation: 

FFIEC: Federal Financial Institutions Examination Council: 

FinCEN: Financial Crimes Enforcement Network: 

ICE: Immigration and Customs Enforcement: 

MOU: Memorandum of Understanding: 

NCUA: National Credit Union Administration: 

NFA: National Futures Association: 

NYSE: New York Stock Exchange::: 

OCC: Office of the Comptroller of Currency: 

OFAC: Office of Foreign Assets Control: 

OTS: Office of Thrift Supervision: 

SAR: Suspicious Activity Report: 

SEC: Securities and Exchange Commission: 

SRO: Self Regulatory Organization: 

USA PATRIOT Act: Uniting and Strengthening America by Providing 
Appropriate Tools Required to Intercept and Obstruct Terrorism Act: 

Letter May 6, 2005: 

The Honorable F. James Sensenbrenner, Jr.: 
Chairman: 
Committee on the Judiciary: 
House of Representatives: 

The Honorable John N. Hostettler: 
Chairman: 
Subcommittee on Immigration, Border Security, and Claims: 
Committee on the Judiciary: 
House of Representatives: 

Following the terrorist attacks on September 11, 2001, Congress passed 
the USA PATRIOT Act (PATRIOT Act), arming the U.S. government with new 
tools for investigating terrorism and terrorist financing.[Footnote 1] 
The passage of the PATRIOT Act was prompted, in part, by the enhanced 
awareness of the importance of combating terrorist financing as part of 
the U.S. government's overall anti-money laundering efforts, because 
terrorist financing and money laundering can involve similar techniques 
and use the U.S. financial system to support criminal activity. Title 
III of the PATRIOT Act amended the Bank Secrecy Act[Footnote 2] (BSA)-
-the key statute that governs the U.S. government's anti-money 
laundering regulatory structure. Two provisions of Title III--sections 
314 and 326--were specifically highlighted by the National Commission 
on Terrorist Attacks Upon the United States (also known as the 9-11 
Commission) in its report on terrorist financing as being important 
provisions in detecting and preventing terrorist financing. The 
Financial Crimes Enforcement Network (FinCEN), the federal financial 
regulators, and self-regulatory organizations (SRO) are responsible for 
ensuring that the financial institutions comply with the BSA and BSA 
regulations through examinations and enforcement actions.[Footnote 3]

Section 326 of Title III required the Secretary of the Treasury to 
develop regulations establishing minimum standards for financial 
institutions to follow when verifying the identity of its customers in 
connection with the opening of an account.[Footnote 4] In May 2003, the 
Department of the Treasury (Treasury), through FinCEN, and the federal 
financial regulators jointly adopted these regulations prescribed by 
section 326 regarding certain financial institutions.[Footnote 5] The 
compliance date for these new regulations was October 1, 2003. These 
regulations require financial institutions to establish a written 
customer identification program (CIP) that includes procedures for 
obtaining minimum identification information from customers that open 
an account with the financial institution, such as a person's date of 
birth, a government identification number, and physical address. The 
regulations stipulated that the CIP must include risk-based procedures 
for verifying the identification of a customer that enable the 
financial institution to form a reasonable belief that it knows the 
true identity of the customer. The regulations implementing section 326 
are commonly referred to as the Customer Identification Program 
regulations and will be referred to collectively as the "CIP 
requirement" or the "CIP rule" in this report.[Footnote 6]

The provisions of section 314 are aimed at encouraging information 
sharing among financial institutions, their regulators, and law 
enforcement authorities.[Footnote 7] Section 314(a) directed the 
Secretary to adopt regulations that encourage regulators and law 
enforcement authorities to share information with financial 
institutions regarding individuals, entities, and organizations engaged 
in or reasonably suspected based on credible evidence of engaging in 
terrorist acts or money laundering activities. Treasury, through 
FinCEN, adopted final regulations implementing section 314 information 
sharing procedures in September 2002. The 314(a) regulations set forth 
the process by which law enforcement agencies provide names and 
identifying information on suspects to FinCEN.[Footnote 8] FinCEN 
distributes this information to financial institutions across the 
country and requires that institutions search their accounts to 
identify any matches. Section 314(b) provides a mechanism to encourage 
financial institutions, upon notice to the Secretary, to share 
information with one another regarding individuals, entities or 
countries suspected of possible terrorist or money laundering 
activities by providing financial institutions with a safe harbor from 
liability for disclosing nonpublic personal customer information. 
Treasury adopted regulations to clarify which financial institutions 
could share information under section 314(b) and establish the process 
to be followed by financial institutions that wish to voluntarily share 
information about their customers and avail themselves of the statutory 
safe harbor from liability for disclosing such customer 
information.[Footnote 9]

To help ensure that the requirements of sections 314 and 326 of the 
PATRIOT Act are being implemented effectively, you requested that we 
determine how (1) Treasury (through FinCEN) and the federal financial 
regulators developed the regulations and addressed challenges, (2) 
FinCEN and the federal financial regulators informed and educated 
financial institutions about the new regulations and the challenges 
such institutions encountered during implementation, (3) the federal 
financial regulators have updated examination guidance and trained 
examiners with respect to sections 314 and 326, (4) the federal 
financial regulators have examined firms for compliance and taken 
enforcement actions with sections 314 and 326, and (5) the new 
regulations implementing sections 314 and 326 have affected federal law 
enforcement investigations and Department of Justice prosecutions of 
money laundering and terrorist financing cases. 

We determined how Treasury (through FinCEN), and the federal financial 
regulators developed the regulations and overcame challenges by 
reviewing documentation of the rulemaking process, including comment 
letters, and interviewing agency officials. To determine how FinCEN and 
the regulators have educated the industry, we interviewed officials 
from FinCEN, the federal financial regulators, and SROs about how they 
have informed and educated the industry and reviewed outreach materials 
provided to us. We identified implementation challenges encountered by 
financial institutions through interviews of company officials and 
industry trade associations representing banks, credit unions, 
securities broker-dealers, mutual funds, futures commission merchants, 
and futures introducing brokers. To determine how the regulators and 
SROs have updated examination guidance and trained examiners, we 
reviewed draft and final guidance, collected information on examiner 
training courses and the number of examiners trained for fiscal year 
2004, and interviewed officials on their examination guidance and 
training programs. We also attended an anti-money laundering course for 
banking examiners. To determine how the regulators and SROs have 
examined for compliance and taken enforcement actions, we collected 
data on the number of exams completed from October 1, 2003, through May 
31, 2004, and reviewed a sample of 176 examinations from six federal 
financial regulators and five SROs.[Footnote 10] We randomly selected 
approximately 20 examinations from each regulator and SRO to ensure 
that the sample was not biased, but our sample should not be 
interpreted to be representative of all examinations conducted during 
this time period. We also interviewed officials from FinCEN, the 
federal financial regulators, and SROs about their examination and 
enforcement policies and reviewed recent formal enforcement actions. To 
determine how these new regulations could improve law enforcement 
investigations, we interviewed officials representing several law 
enforcement agencies and Department of Justice officials, including 
supervisory prosecutors who have been involved with money laundering 
and terrorist financing cases. 

We conducted our work between February 2004 and March 2005 in 
accordance with generally accepted government auditing standards. 
Additional information on our scope and methodology is discussed in 
appendix I. 

Results in Brief: 

Treasury and the federal financial regulators had to overcome many 
challenges to develop regulations implementing the requirements of 
sections 314 and 326. Developing regulations under section 326 was 
particularly difficult because Treasury and the federal financial 
regulators wanted to ensure that CIP procedures were appropriate and 
consistent across a wide variety of financial institutions that have 
diverse business models and financial products. In addition, some 
financial institutions have arrangements with other institutions to 
process customer transactions. These arrangements and the diversity of 
business models created challenges for Treasury and the federal 
financial regulators and concerns among the industry about reasonable 
levels of accountability for verifying the identity of customers. 
Developing regulations for section 314 presented practical problems on 
how to develop a process for information sharing between law 
enforcement and industry and a process that allows financial 
institutions to share information with each other. Soon after 
finalizing regulations, due to feedback from industry that it was 
overwhelmed by law enforcement information requests, FinCEN suspended 
the section 314(a) information sharing process and developed a more 
streamlined approach. Establishing an information sharing process under 
section 314(b) that defined the parameters of information sharing 
entitled to the safe harbor protection also presented difficulties 
because Treasury had to consider how to encourage information sharing 
while still protecting the customers' right to privacy. 

Treasury, the federal financial regulators, and SROs have reached out 
to the financial industry to help financial institutions understand and 
comply with the CIP and the section 314 information sharing 
regulations, though several implementation challenges remain. Treasury, 
the federal financial regulators, and SROs have distributed written 
guidance to firms under their jurisdiction, addressed practical, 
implementation issues at numerous venues such as industry conferences, 
and clarified the regulations during compliance examinations. These 
efforts addressed some industry concerns, such as the extent to which 
firms should verify the identity of existing customers. However, 
industry officials told us that they continue to experience challenges 
in implementing CIP procedures and they are concerned about how some of 
the requirements will be interpreted during examinations. For instance, 
some industry officials said they remain unsure how examiners will 
determine that firms have taken sufficient steps to verify the identity 
of customers and when firms can rely on each other to perform all or 
some components of a CIP. While industry officials agreed that FinCEN 
has streamlined and improved the 314(a) information sharing process 
since the first information request went out in November 2002, the 
implementation of the 314(a) process has highlighted the tension 
between law enforcement's duty to protect sensitive information and the 
need for law enforcement information to help industry better monitor 
possible financial crimes, including terrorist financing and money 
laundering. Industry officials continued to be concerned about the 
limited feedback received from law enforcement despite government 
efforts to aggregate and supply information to industry on the results 
of their reporting. Industry officials also said that, although the 
314(b) provision has been useful, distinguishing between information 
that they can and cannot share under the provision is sometimes 
difficult. 

All of the federal financial regulators and SROs in our review issued 
examination guidance to assess compliance with the CIP requirement and 
the section 314 information sharing regulations of the PATRIOT Act, and 
subsequently trained their examiners on the new provisions. Banking 
regulators jointly issued final examination guidance for section 314 in 
October 2003, and the CIP requirement in July 2004. Although banking 
regulators did not issue guidance for CIP until several months after 
the regulation took effect, examiners were assessing firms for 
compliance with the CIP requirement using draft guidance beginning in 
October 2003. SEC and the securities SROs issued final guidance 
individually for both provisions. CBOT and CME issued final guidance 
jointly in February 2004 but were examining firms for compliance with 
the PATRIOT Act as early as May 2002. NFA issued examination guidance 
for both provisions by October 2003. Federal financial regulators and 
SROs continue to update staff on changes to examination procedures 
using a variety of tools, including teleconferences, monthly or bi- 
annual staff meetings, interagency bulletins, e-mails, and formal and 
informal training sessions. By June 2003, all federal financial 
regulators and SROs had included section 314 regulations and CIP 
requirements in their examiner training curricula. Both banking and 
securities regulators used formal training courses that are instructor- 
led and computer-based. Instruction was also provided internally or by 
external sources including industry experts and a financial regulators 
training school. CFTC and the futures SROs provided instructor-led and 
on-the-job training. 

The federal financial regulators and SROs have been examining financial 
institutions for compliance with CIP and section 314 and taking 
enforcement actions, but coverage of the provisions in the exams we 
reviewed varied. In addition, our review revealed some implementation 
difficulties particularly related to the CIP requirement that could 
reduce its effectiveness as it applies to high-risk customers and lead 
to examination inconsistencies. Our review of a sample of 176 
examinations conducted from October 1, 2003, through May 31, 2004, 
showed that CIP procedures were reviewed in 95 percent of the 
examinations in our sample. While most examinations reviewed whether a 
financial institution had procedures for meeting the minimum standards 
for a CIP, fewer examinations (about 56 percent) documented a review of 
the financial institution's risk-based approach for CIP. Therefore, it 
was not clear whether all examiners understood that CIP procedures 
should be more rigorous at financial institutions that have the types 
of accounts and customers that are at a higher risk for money 
laundering or terrorist activities as opposed to just meeting the 
minimum CIP requirements. Also, a few examinations revealed incorrect 
interpretations by examiners of certain aspects of the CIP requirement 
that could lead to inconsistencies in how financial institutions 
understand and apply the CIP requirement. For example, in six 
examinations, the examiner confused the CIP requirement with other anti-
money laundering procedures that require customer identification 
information. About 76 percent of the examinations covered section 
314(a) provisions in part because some regulators were still developing 
examination procedures, and about 55 percent of the examinations 
covered section 314(b) in part because the sharing of information 
pursuant to this provision is voluntary. The extent of coverage in the 
examinations of the various aspects of the CIP requirement and section 
314 provisions may have also varied because (1) examiners used 
different approaches to document their work and therefore may have 
limited our ability to fully know what was reviewed and (2) the 
examinations we reviewed were conducted during early implementation. 
Because the regulations were new and many deficiencies were technical 
mistakes, federal financial regulators and SROs mostly took informal 
actions to address deficiencies or violations of CIP and section 314. 

Officials from the Department of Justice and other law enforcement 
agencies told us that section 314(a) and the CIP requirement have 
assisted in the investigation of money laundering and terrorist 
financing cases. Many of the law enforcement officials we interviewed 
said that the 314(a) information sharing process has improved 
coordination between law enforcement agencies and financial 
institutions and has increased the speed and efficiency of 
investigations. For example, a senior official from the Federal Bureau 
of Investigation (FBI) described how a 314(a) information request led 
to the identification of additional accounts associated with a suspect 
across 23 states and 45 financial institutions. Prior to learning this 
new information, the FBI was aware of only four accounts. The law 
enforcement officials we spoke with also believed that the section 
314(a) process facilitates the flow of information between law 
enforcement and financial institutions because the process connects law 
enforcement with approximately 20,000 financial institutions, and the 
314(a) information requests include points of contact with law 
enforcement. Some law enforcement officials told us that CIP has also 
been useful because financial institutions have more information about 
their customers. Therefore, law enforcement agencies obtain more 
consistent and useful customer information when issuing grand jury 
subpoenas and 314(a) requests. Justice officials, including those from 
U.S. Attorneys offices who have prosecuted money laundering and 
terrorist financing cases, told us that decisions about whether to 
pursue an investigation and prosecute money laundering cases depend on 
a myriad of factors and are made on a case-by-case basis. Therefore, 
although they believe that the section 314(a) and CIP requirements are 
important to law enforcement and provide valuable information to 
investigations, they did not believe that these new tools will 
necessarily result in an increase in the number of money laundering and 
terrorist cases that they choose to prosecute. 

In this report, we make recommendations to Treasury, through FinCEN, to 
work with the federal financial regulators to develop guidance that 
should address industry concerns about some of the CIP requirements and 
improve examinations of CIPs. In responding to our draft report, 
Treasury agreed that additional guidance would improve implementation 
of these regulations. 

Background: 

Money laundering is the process used to transform monetary proceeds 
derived from criminal activities into funds and assets that appear to 
have come from legitimate sources. Terrorist financing is generally 
characterized by different motives than money laundering and the funds 
involved often originate from legitimate sources. However, the 
techniques for hiding the movement of funds intended to be used to 
finance terrorist activity--techniques to obscure the origin of funds 
and the ultimate destination--are often similar to those used to 
launder money. Therefore, Treasury, federal law enforcement agencies, 
and the federal financial regulators often employ similar approaches 
and techniques in trying to detect and prevent both money laundering 
and terrorist financing. 

Following the September 11 terrorist attacks, Congress passed the USA 
PATRIOT Act, which was enacted on October 26, 2001. Title III of the 
PATRIOT Act amended the BSA. The BSA was enacted by Congress in 1970 
and requires that financial institutions file reports and maintain 
records with respect to certain transactions in currency and monetary 
instruments that are determined to have a high degree of usefulness in 
criminal, tax, or regulatory investigations and, as amended by the 
PATRIOT Act, these records and reports also have a high degree of 
usefulness in the conduct of intelligence or counterintelligence 
activities.[Footnote 11] As a result, the BSA helps to provide a paper 
trail of the activities of money launderers for law enforcement 
officials in pursuit of criminal activities. Congress has amended the 
BSA several times to give the U.S. government a wider variety of 
regulatory tools to combat money laundering. In addition to requiring 
regulations for information sharing and customer identification 
programs, Title III of the PATRIOT Act expands Treasury's authority to 
regulate the activities of U.S. financial institutions and requires a 
wide variety of types of financial institutions to maintain anti-money 
laundering programs. 

Agencies under the Departments of the Treasury, Justice, and Homeland 
Security are to coordinate with each other and with federal financial 
regulators in combating money laundering and terrorist financing. 
Within Treasury, FinCEN, under delegated authority from the Secretary 
of the Treasury, is the administrator for the BSA and supports law 
enforcement agencies by collecting, analyzing, and coordinating 
financial intelligence information to combat money laundering. As a 
bureau of Treasury, FinCEN clears all BSA regulations through Treasury. 
In August 2004, FinCEN created an Office of Compliance to oversee and 
work with the federal financial regulators on BSA examination and 
compliance matters. FinCEN signed a Memorandum of Understanding (MOU) 
with the banking regulators in September 2004 that laid out procedures 
for the exchange of certain BSA information. The MOU requires that the 
federal banking regulators provide information on examination policies 
and procedures and on significant BSA violations or deficiencies that 
have occurred at the financial institutions they supervise, including 
relevant portions of examination reports and information on follow-up 
and resolution. FinCEN will also provide information to the banking 
regulators, including information on FinCEN enforcement actions and 
analytical products that will identify various patterns and trends in 
BSA compliance. FinCEN has been working on similar MOUs with SEC and 
CFTC; however, as of March 25, 2005, no effective dates have been set 
for either of them. 

Department of Justice components involved in efforts to combat money 
laundering and terrorist financing include the Criminal Division's 
Asset Forfeiture and Money Laundering Section and Counterterrorism 
Section, the FBI, the Bureau of Alcohol, Firearms, and Explosives, the 
Drug Enforcement Administration, and the Executive Office for U.S. 
Attorneys (EOUSA) and U.S. Attorneys Offices. The Department of 
Homeland Security's Bureau of Immigration and Customs Enforcement (ICE) 
also investigates cases involving money laundering and terrorist 
activities. 

The federal financial regulators who oversee financial institutions and 
examine them for compliance with anti-money laundering laws and 
regulations include the federal banking regulators--the Federal 
Reserve, OCC, OTS, FDIC, and NCUA--and SEC, which regulates the 
securities markets, and the CFTC, which regulates commodity futures and 
options markets. Because the U.S. securities and futures markets are 
regulated through a combination of self-regulation (subject to federal 
oversight) and direct federal regulation, the SROs also oversee 
compliance with anti-money laundering laws and regulations. Two of the 
SROs--NASD and NYSE--oversee registered broker-dealers. NFA oversees 
futures commission merchants and introducing brokers in 
commodities.[Footnote 12] In addition to NFA, a number of the futures 
commission merchants are overseen by futures exchanges, including the 
New York Mercantile Exchange, CME, and CBOT. 

Developing Regulations for CIP and Section 314 That Applied to a Wide 
Range of Financial Institutions Was Difficult and Complex: 

Treasury and the federal financial regulators encountered numerous 
challenges as they developed regulations to implement sections 314 and 
326. Key challenges related to implementing section 326 included 
developing regulations that could be applied consistently across a 
financial industry that has diverse business models, customer 
relationships, and financial products. In addition, many financial 
institutions have arrangements with other institutions to process 
customer transactions. These arrangements and the need to build in a 
risk-based approach to customer identification created concerns among 
the regulators and industry about reasonable levels of accountability 
for verifying the identity of customers. Developing regulations for 
section 314 presented practical problems on how to develop a process 
for information sharing between law enforcement and industry and a 
process that allows financial institutions to share information with 
each other. 

Development of the CIP Requirement Highlighted Difficulties in Applying 
Requirements Consistently to a Wide Range of Financial Products and 
Businesses: 

Treasury and the federal financial regulators had to resolve several 
issues through an interagency process when developing the regulations 
for CIP, such as defining "customer" and "account" for the purposes of 
the regulations and determining how much flexibility to give firms in 
verifying the identity of customers. Because the regulations for CIP 
would apply to a diverse financial industry, FinCEN and the regulators 
formed a working group and gathered information from industry officials 
about their different business models and customer relationships. 
According to FinCEN officials, the interagency process employed to 
issue joint regulations was the first that included Treasury and the 
seven federal financial regulators. Specifically, Treasury and the five 
banking regulators (FDIC, Federal Reserve, NCUA, OCC, and OTS) jointly 
adopted a CIP rule covering banks, thrifts, and credit unions.[Footnote 
13] Treasury and SEC jointly adopted separate rules for broker-dealers 
and mutual funds.[Footnote 14] Treasury and CFTC jointly adopted a rule 
for futures commission merchants and introducing brokers.[Footnote 15] 
As shown in figure 1, the rulemaking process took over a year and a 
half to complete. 

Figure 1: Key Dates in the Rulemaking Process for CIP: 

[See PDF for image] --graphic text: 

Timeline from October, 2001 to October, 2003.

October, 2001 to May, 2003: Rulemaking process; 
July, 2003 to September, 2003: Notice of inquiry; 
October, 2003, on: Financial institutions expected to have customer ID 
program in place. 

October 26, 2001: USA PATRIOT Act enacted.

July 2002: Publication of Treasury's and regulators' joint notices of 
proposed rulemaking. 

September 6, 2002: Comment period closed. Treasury and regulators 
received approximately 500 comments in response to the proposed CIP 
rules. 

May 9, 2003: Treasury and regulators jointly adopted the final CIP 
rules. 

July 1, 2003: Treasury published a Notice of Inquiry seeking comments 
on the rules: (a) recordkeeping requirements and (b) types of 
identification documents. 

September 25, 2003: Treasury summarized the comments from its July 1, 
2003, Notice of Inquiry and made no changes to the final rules. 

October 1, 2003: Compliance date for financial institutions subject to 
the CIP rules.

Source: GAO.

[End of figure] 

Following the issuance of the joint notices of proposed rulemaking in 
July 2002, Treasury and the federal financial regulators collectively 
received approximately 500 comments, many of which expressed concerns 
about the types of accounts and customers that should be subject to 
CIP. For instance, some comments questioned whether an account 
established as part of an employee benefit plan should be subject to 
CIP regulations, the extent to which the risk-based approach should be 
used, and the need for Treasury and the federal financial regulators to 
be more specific about the methods of verification. Other comments 
proposed that the entire process be risk-based without any minimum 
requirements. Some comments also addressed how financial institutions 
could rely on or share responsibility with another institution for 
verifying the identity of a shared customer account. This reliance 
aspect is important for some types of financial institutions that have 
securities and futures products. For example, in the securities 
industry, many brokers interact with customers (introducing brokers) 
but rely on another broker for clearance, settlement, and custody 
purposes (clearing firms). Typically under this arrangement the 
introducing broker interacts with the customer by taking orders and 
making recommendations and the clearing firm holds the customer assets. 
Treasury and the regulators also considered how financial institutions 
could verify customer identities for customers who open accounts by 
mail, by phone, or over the Internet. 

Treasury and the federal financial regulators ultimately established 
minimum identification requirements and mandated that financial 
institutions develop risk-based procedures for verifying the identity 
of each customer to the extent reasonable and practicable. The 
verification procedures included documentary and nondocumentary methods 
to cover the variety of approaches customers use to open accounts. The 
final rules published on May 9, 2003, provide a framework with minimum 
standards for identifying customers, while allowing financial 
institutions flexibility to design and implement CIPs according to risk-
based procedures for verifying identity based on their business lines, 
types of customers, and methods of opening accounts. Figure 2 
illustrates requirements for identification and verification 
procedures. 

Figure 2: Requirements for Customer Identification and Verification 
Procedures: 

[See PDF for image] 

[End of figure] 

In addition to establishing minimum identification standards and a risk-
based approach for verification procedures, the final rule requires 
that financial institutions develop CIPs that include procedures for 
(1) making and maintaining a record of information required to be 
obtained from the customer at the time the account is opened and 
retaining the information for five years after the date the account is 
closed,[Footnote 16] (2) providing notice to the customer that their 
identity will be verified, and (3) determining whether a person appears 
on any list designated by Treasury (in consultation with the federal 
financial regulators) as a federal government list of known or 
suspected terrorists or terrorist organizations that must be checked by 
financial institutions as part of the CIP requirement. Treasury has not 
designated a list for the CIP requirement at this time. 

The final rule also allows financial institutions to rely on another 
financial institution to perform any procedures of its own CIP for 
customers that the two financial institutions share provided that, 
among other requirements, the financial institution that is being 
relied on enter into a contract certifying annually to the relying 
financial institution that it has implemented its own anti-money 
laundering program and that it will perform the specified requirements 
of the relying financial institution's CIP. The rule also requires that 
the financial institution being relied on is regulated by a federal 
functional regulator. The final rules stated that financial 
institutions were expected to be in compliance with the final rules no 
later than October 1, 2003. 

Treasury issued a Notice of Inquiry in July 2003 (see fig. 1) 
approximately 2 months after the final CIP rules had been adopted, 
soliciting additional comments about two aspects of the final CIP rules 
that concerned some interested parties, including members of Congress 
and law enforcement officials. The Notice of Inquiry sought additional 
comments on (1) whether and under what circumstances financial 
institutions should be required to retain photocopies of identification 
documents relied on to verify customer identity and (2) whether there 
are situations when the regulations should preclude reliance on certain 
forms of foreign government-issued identification to verify customer 
identity. Treasury received over 34,000 comments in response to the 
Notice of Inquiry from a wide variety of individuals and entities, 
including members of Congress, the Department of Justice, the financial 
services industry, advocacy groups, and interested citizens. 

Treasury did not make any changes to the final CIP rules for two 
reasons. First, it concluded that requiring photocopies in all cases is 
not consistent with the risk-based approach for CIP. In its official 
disposition of comments to the notice, Treasury said that the decision 
to make photocopies should be at the discretion of the financial 
institution rather than an across-the-board requirement. Second, 
Treasury decided that specifying individual types of documents that 
cannot be relied upon to verify customer identities did not make sense 
from a regulatory perspective because the relative security and 
reliability of various identification documents that are available is 
constantly changing. The comments received in response to the Notice of 
Inquiry primarily related to encouraging Treasury to take an official 
position on whether the Mexican consular identification document, the 
Matricula Consular is a reliable document for verifying 
identification.[Footnote 17] Treasury concluded that because the 
relative security and reliability of identification documents are 
constantly changing, any list of unacceptable documents would quickly 
become outdated and may provide financial institutions with an 
unwarranted sense of security concerning documents that do not appear 
on such a list. Therefore, Treasury decided not to prescribe a specific 
list of documents that are acceptable or not acceptable in the 
regulation, but rather committed to providing financial institutions 
with information relating to the security and reliability of 
identification cards. 

Developing Section 314 Regulations Required Balancing the Needs of Law 
Enforcement and Industry: 

When developing section 314 regulations, Treasury (through FinCEN) had 
to determine the extent to which financial institutions should share 
information about customers with law enforcement officials and with 
each other. Treasury adopted final regulations in September 2002. 
Figure 3 shows the key dates in the rulemaking process for section 314. 

Figure 3: Key Dates of the Rulemaking Process for Section 314: 

[See PDF for image] --graphic text: 

Timeline from October, 2001 to February, 2003. 

October, 2001 to November, 2002: Rulemaking process; 
November, 2002 to February, 2003: Moratorium; 
February, 2003, on: FinCEN reinstates 341a information requests. 

October 26, 2001: USA PATRIOT Act enacted. 

March 4, 2002: FinCEN published for comment a notice of proposed 
rulemaking. 

April 3, 2002: Comment period ended. FinCEN received approximately 180 
comments. 

September 26, 2002: FinCEN issued final rule.

November 4, 2002: FinCEN sent first 314(a) information request 
throughout the U.S.

November 26, 2002: To address implementation problems, FinCEN and 
regulators issued a Joint Agency Notice announcing a brief moratorium 
on 314(a) information requests and compliance with existing requests. 
During the moratorium, FinCEN, after discussions with relevant federal 
law enforcement and regulatory agencies, revised the 314(a) information 
request process to address logistical issues and to develop additional 
guidance on the information request process. 

February 17, 2003: FinCEN reinstated 314(a) information requests. 

Source: GAO. 

[End of figure] 

For section 314(a), FinCEN implemented a process in which law 
enforcement agencies provide information on potential suspects to 
FinCEN. FinCEN distributes these 314(a) information requests across the 
country to financial institutions that are required to search their 
accounts and transactions to identify any matches. 

The process was temporarily suspended in November 2002, based on 
feedback from financial institutions that they were overwhelmed or 
confused by the process. Some institutions did not know what to do with 
the information requests, while others were not sure which accounts or 
transactions to search. Following consultations with law enforcement 
and the federal financial regulators to streamline the process, FinCEN 
resumed 314(a) information requests in February 2003. FinCEN and 
industry officials agreed that, since the moratorium, FinCEN has 
implemented a more streamlined process that has improved the clarity 
and efficiency of 314(a) information requests. Officials from FinCEN 
and law enforcement agencies have also established procedures to vet 
requests sent by law enforcement agencies to ensure that they are 
related to terrorist or significant money laundering activities. (See 
fig. 4.) Before putting a name on the information request list, FinCEN 
officials said that they follow up with the requesting law enforcement 
agent to obtain more information to determine whether the case merits 
the use of the 314(a) process and to verify that the agent will be 
available to respond to any financial institution that finds a match 
when the request goes out. FinCEN also sends each law enforcement 
requester a feedback form on the usefulness of the information 
obtained. For example, the feedback form asks if law enforcement 
officials served grand jury subpoenas based on the information obtained 
from the 314(a) process. In addition, law enforcement officials said 
that they have taken steps to caution agents against overusing the 
314(a) process, and that the 314(a) process is not meant to replace the 
need for a subpoena or more rigorous investigation methods. 

Figure 4: The 314(a) Information Sharing Process after the Moratorium: 

[See PDF for image] 

[End of figure] 

FinCEN sends out the 314(a) information request list every 2 weeks. The 
information requests include suspects related to terrorist cases and 
significant money laundering investigations. FinCEN tries to limit the 
number of subjects on the bi-weekly information request. The request 
contains as much identifying information as possible, such as dates of 
birth, social security numbers, and addresses as well as aliases so the 
number of records that are to be searched for can be extensive. 
[Footnote 18] Financial institutions have 2 weeks to respond. Urgent 
requests can also be distributed with shorter turnaround time when 
deemed necessary. 

The rulemaking process for section 314(b) addressed the need to 
encourage information sharing among financial institutions while still 
protecting customers' right to privacy and established a mechanism for 
financial institutions to satisfy the statutory notice requirement. 
Section 314(b) of the PATRIOT Act allows financial institutions, upon 
providing notice to Treasury, to share information regarding 
individuals, entities, and countries suspected of possible terrorist or 
money laundering activities.[Footnote 19] The final rule requires that 
to be protected by the safe harbor from liability for sharing 
information pursuant to section 314(b), financial institutions must 
comply with the procedures prescribed by the rule, including providing 
notice annually to FinCEN of their intent to share information with 
other institutions. The rule also requires that prior to sharing 
information, a financial institution must verify that the financial 
institution with which information will be shared has also filed a 
notice with FinCEN. FinCEN determines that the notice requirement 
sufficiently reminds financial institutions of their need to safeguard 
information that is obtained using section 314(b). 

Treasury and the Federal Financial Regulators Have Reached Out to the 
Financial Industry to Assist It in Implementing CIP and Section 314 
Rules, but Industry Concerns Remain: 

Treasury and the federal financial regulators have taken several steps 
to help the financial industry understand and comply with the CIP and 
314 information sharing regulations; however, the need for agency 
coordination has slowed the issuance of additional guidance. Industry 
officials said that although the government's guidance has been 
helpful, it does not completely address their questions and compliance 
concerns particularly related to the CIP rule. The implementation of 
the 314(a) information sharing process has highlighted the tension 
between law enforcement officials' duty to protect sensitive 
information and the need for information from law enforcement to help 
industry monitor, identify, and report possible financial crimes, 
including terrorist financing and money laundering. Finally, industry 
officials said that they appreciate the safe harbor provided by 314(b), 
but some officials said distinguishing possible money laundering and 
terrorist activities from other types of financial crimes not covered 
by section 314(b), such as fraud, has been difficult. 

Treasury and the Regulators Have Assisted Industry in Implementing CIP 
and Section 314 Requirements, but Interagency Coordination Has Slowed 
Issuance of Additional Guidance: 

Treasury and the federal financial regulators have sought to educate 
the financial community to help it understand the new requirements, but 
the need for interagency coordination has slowed regulators' issuance 
of additional guidance. Regulators and SROs used established, formal 
channels (such as Web site postings and existing regulatory memorandums 
distribution channels) to distribute guidance to firms describing the 
regulations, clarifying when the regulations would become effective, 
and offering advice about implementation. Officials from the regulatory 
agencies and SROs also informed firms of the regulations and addressed 
practical issues during numerous industry-related conferences, 
conference calls, and training sessions. Moreover, agency officials 
said that during compliance exams conducted before and soon after the 
regulations became effective, examiners clarified particular aspects 
and helped firms establish compliant programs. 

Treasury and the federal financial regulators have provided specific 
guidance related to the CIP rule and section 314 in the form of 
responses to "frequently asked questions" or "FAQs." In August and 
October 2003, Treasury and SEC issued limited FAQ guidance related to 
mutual funds and broker-dealers, respectively. In January 2004, 
Treasury and the banking regulators jointly issued FAQ guidance that 
addressed several issues related to CIP. Among other topics, the 
answers clarified the definitions of a customer and an account in 
different situations and discussed how firms should apply the rules to 
existing customers. In July 2004, Treasury and CFTC issued FAQ guidance 
concerning CIP that was similar to the banking regulators' guidance. 

FinCEN issued FAQs for the 314 information sharing regulations in 
February 2003. These FAQs were initially posted on FinCEN's public Web 
site but, according to FinCEN officials, they were removed due to law 
enforcement concerns that this guidance could give criminals an 
advantage. FinCEN officials said they have now posted these FAQs to its 
secure Web site that financial institutions access to obtain the 314(a) 
information requests and will send the FAQs to a financial institution 
upon request. 

According to FinCEN, because of the joint nature of the CIP rules, all 
of the affected regulators and FinCEN must coordinate when issuing 
guidance to assure consistency in the implementation of the 
regulations. Such coordination has slowed the issuance of further 
guidance. Similar to the challenges they encountered in the rulemaking 
process, the financial regulators and FinCEN face continuing challenges 
in developing guidance that applies to diverse types of financial 
products and businesses. FinCEN and the federal financial regulators 
began developing a second series of CIP FAQs pertaining primarily to 
banks in early 2004. Some officials told us that this guidance has 
taken longer to finalize because of difficulties reaching agreements on 
which questions to address and how to answer them. FinCEN officials 
told us that although some of the officials had signed off on the draft 
FAQs, agreement was not reached among two of the regulators on one 
outstanding question until February 2005. FinCEN officials told us 
that, although these are questions pertaining to CIPs, some questions 
have broader policy implications for the affected agencies. FinCEN 
released the draft for internal approval by the financial regulators on 
March 25, 2005, and the final CIP FAQs were jointly issued by Treasury, 
FinCEN, and the banking regulators on April 28, 2005. Officials from 
CFTC and FinCEN told us that they hoped guidance in the form of an FAQ 
addressing the CIP issue related to customers of executing and carrying 
brokers would be released soon, but it has also taken some time to 
finalize the guidance. SEC officials told us that they have been 
waiting for the second set of banking FAQs and will then adapt the 
first and second set of CIP FAQs for securities firms. 

The industry officials we spoke with largely agreed that the regulators 
have provided valuable information and services helping them to 
understand the regulations. Some officials lauded the time and effort 
regulators have taken to inform firms of the new regulations and answer 
difficult, practical questions. 

Industry Officials Believe That More Guidance from FinCEN and Financial 
Regulators Would Help Address Some CIP Implementation Challenges: 

Industry officials we met with said that while regulators' guidance has 
been helpful, it does not address all of their questions and concerns, 
thus making it difficult for them to know if they are in full 
compliance with the requirements. Industry officials said that although 
their institutions had customer identification procedures in place 
prior to the PATRIOT Act, they revised their forms, processes, and 
systems to meet the minimum CIP requirements. Many industry officials 
said that CIP regulations have challenged them to organize and document 
their identification procedures, create new forms and processes to 
notify customers of the new procedures, and reconfigure systems in 
order to store information required by the regulations for the 
specified period. Industry officials also said that implementing CIP 
has improved the consistency of customer identification procedures 
across different business lines in their own institutions and should 
improve consistency across the various financial sectors. 

CIP FAQs that FinCEN and the federal financial regulators issued for 
bank, securities, and futures firms in 2003 and 2004 responded to 
several of the industry's implementation concerns. For example, the 
FAQs for banks discussed two issues banks raised during the public 
comment period in the rulemaking process--(1) the extent to which banks 
should verify existing customers and (2) how banks may identify 
customers using nondocumentary sources of identification information. 
The one CIP FAQ for securities firms clarified when an intermediary 
will be deemed the customer for purposes of the CIP rule when opening a 
domestic omnibus securities account to execute transactions for the 
intermediary customers. 

Despite the guidance, industry officials remain concerned about some 
challenges they raised during the comment period and have additional 
concerns. For example, industry officials said they are still uncertain 
how examiners determine that firms have taken appropriate steps to 
verify the identity of customers when the CIP regulations allow firms 
to take a risk-based approach and give them the flexibility to tailor 
their procedures for verifying customers' identities according to their 
location, customers, and products. Industry officials believe that they 
and their examiners may reasonably disagree on the risks posed by 
certain customers and subsequently disagree about when to take extra 
steps to verify the identity of the customers. The officials expressed 
concern that examiners will sanction firms who differed with them, 
despite the fact that the firms followed what they believed were 
reasonable steps to determine the risk of the customers and 
subsequently took reasonable steps to verify their identity. For 
example, one industry representative told us that in a recent exam an 
examiner questioned the firm's designation of high-risk countries--the 
firm planned to take more stringent steps to verify the identity of 
customers depending on the risk ranking of high-risk countries. 
According to the industry official, the examiner thought that two of 
the countries on the risk matrix should have been placed in a higher 
risk category but did not provide a basis for believing that certain 
countries should be higher on the firm's risk ranking. 

Some industry officials also said that they were unsure how examiners 
expected them to verify the identity of institutions and people when 
reliable identification information is unavailable, such as for people 
from countries where sources of identification may not be reliable. CIP 
rules require that financial institutions collect a government 
identification number for corporations as well as individuals. Some 
industry officials said that a foreign government identification number 
for institutions or corporations can be very difficult to verify and 
therefore the collection of the identification number is virtually 
worthless. Also, one of the documentary methods for verifying the 
identity of a corporation is to obtain the articles of incorporation, 
but these documents can also be difficult to use to verify identities 
for foreign entities. Some securities industry officials told us that 
foreign incorporation documents are difficult to obtain and sometimes 
impossible because the country does not make this information available 
to the public. Similarly, officials from mutual fund firms expressed 
uncertainty concerning how examiners will assess their practices for 
verifying the identity of some customers processed online or over the 
telephone. The officials explained that they often use credit reports 
and other nondocumentary sources to verify these types of customers, 
and such sources are not always available for some customers, such as 
young customers or some senior customers. 

Additionally, some industry officials expressed uncertainty about the 
reliance provision of the CIP rule. Specifically, industry officials 
said that they did not know the scope of a reasonable reliance 
agreement and which firm is liable for mistakes. Even after regulators 
issued guidance on the reliance provision in the first series of CIP 
FAQs, some industry officials said that they remain uncertain about the 
scope of reasonable reliance agreements in some instances. Industry 
officials in the futures industry told us that they hope that the 
federal government will provide guidance on how the CIP requirement 
affects the relationship between executing brokers and carrying brokers 
in "give up" relationships.[Footnote 20] CFTC and NFA officials said 
that the regulations suggest that for an executing broker to invoke the 
reliance provision in give-up transactions, carrying brokers must 
certify that they have verified the identity of each customer whose 
trades are given up to the carrying broker, thus requiring numerous 
verifications, which could overwhelm the daily operations of the firms 
with CIP requirements. In February and March 2005, CFTC and FinCEN 
officials told us that they were working to issue additional guidance 
concerning these give-up relationships and they hoped it would be 
issued shortly. In addition, some industry officials said that they 
avoid relying on other firms because they did not know how examiners 
would determine which firm will be responsible for mistakes. During the 
rulemaking process, officials from the securities sector expressed this 
same concern. Some industry officials told us that examiners did not 
fully understand the reliance provision. The securities industry 
officials told us that the reliance provision was meant to ensure that 
the CIP requirement did not result in duplicative efforts. Because of 
these concerns, some firms may not take advantage of the provision. 

Industry Officials Faced Some Implementation Challenges and Question 
Whether the 314(a) Information Sharing Process Improves Communication 
with Law Enforcement: 

The implementation of the 314(a) information sharing process has 
created some practical challenges and highlighted the tension between 
law enforcement officials' duty to protect sensitive information and 
industry's need for information useful in identifying and reporting 
financial crimes, including terrorist financing and money laundering. 
One challenge industry officials said they faced was their inability to 
simultaneously search the multiple customer databases they are required 
to search, which forces them to search numerous databases individually. 
Some industry officials told us that they have dedicated significant 
staff hours to conduct the searches, developed search programs 
specifically for 314(a) information requests, and hired third-party 
vendors to conduct the searches. 

Despite the attempts to lessen the burden of the 314(a) process, some 
industry officials said that they have been disappointed with how 
federal law enforcement agencies appear to be using the process. 
Industry officials said that they expected law enforcement officials to 
request information only for select, serious threats and primarily 
terrorist-related activities; however, they questioned the significance 
of some of the information requests they have received because 
requesting law enforcement agents have not followed up matches by 
sending subpoena requests or returning telephone calls concerning the 
matches. FinCEN and law enforcement agency officials responded that 
they continue to refine the process for vetting requests and preventing 
agents from overburdening financial institutions with unnecessary 
requests. 

Also, some industry officials asked why law enforcement officials could 
not provide more information about cases involving their institutions, 
how to treat particular suspicious customers, and profiles of 
terrorists and other criminals. The industry officials said that such 
information would help them to recognize and report a potential 
criminal or terrorist and enable them to update their criteria for 
assessing the risk of individual customers, thus strengthening due 
diligence systems and improving their contributions to law enforcement 
officials' anti-money laundering and anti-terrorism efforts. Law 
enforcement and FinCEN officials said that although they greatly 
appreciate the information provided by firms via the 314(a) process, 
providing feedback to firms on particular cases can be a challenge, 
particularly when cases involve sensitive information. In August 2004, 
the FBI created a list of terrorist financing indicators to assist 
financial institutions in identifying and reporting suspicious activity 
that may relate to terrorism. FinCEN forwarded this information to 
financial institutions through the 314(a) distribution channels. 
Consistent with the statements of the law enforcement officials we 
spoke with, the 9-11 Commission praised the benefits of the section 
314(a) information sharing process, but also expressed concerns about 
the extent to which law enforcement should share sensitive law 
enforcement or intelligence information. The 9-11 Commission noted that 
providing financial institutions with information concerning ongoing 
investigations opens up the possibility that the institutions may leak 
sensitive information, compromise investigations, or violate the 
privacy rights of suspects. 

In response to the industry's request for more information concerning 
the value of the 314(a) process, FinCEN periodically publishes 314(a) 
fact sheets. These fact sheets provide industry with summary data on 
314(a) requests over a specific time period, including the law 
enforcement agencies making requests and the number of search warrants, 
grand jury subpoenas, and indictments attributable to information firms 
provide through the 314(a) process. Regulators, industry officials, and 
law enforcement officials also jointly publish semiannual Suspicious 
Activity Report (SAR) Activity Reviews, which provide information on 
trends and patterns in financial crimes and how industry's 
contributions through reporting suspicious activity and responding to 
314(a) requests have helped investigations. Furthermore, as stated in 
its Fiscal Year 2006-2008 Strategic Plan, released in February 2005, 
FinCEN plans to seek faster and more efficient technical channels for 
dialog between government and the financial industry. For example, 
FinCEN officials told us that they hope to use FinCEN's new secure 
information sharing system to provide financial institutions additional 
feedback information. 

Industry Officials Expressed Some Confusion about Types of Suspicious 
Activity That Can Be Shared under Section 314(b): 

Although industry officials said section 314(b) is a helpful tool and 
has enabled them to share information in a new way, some officials said 
it is not always easy to determine if the suspicious activity is money 
laundering or terrorist activity or other financial crimes. As noted 
earlier, section 314(b) of the PATRIOT Act provides a safe harbor for 
financial institutions to protect them from liability for sharing 
information only if it relates to individuals, entities, organizations, 
and countries suspected of possible terrorist or money laundering 
activities. Some industry officials stated that sometimes it is 
difficult to distinguish fraudulent activity from possible money 
laundering, thus making it hard to determine if a firm can share 
information about that activity with other firms participating in the 
314(b) network. As a consequence, some financial institutions may be 
reluctant to use the 314(b) process. 

On the positive side, industry officials who had used the process said 
that the 314(b) provision has allowed firms to share useful information 
regarding potential money laundering or terrorist activities with other 
institutions that they previously had little or no interaction with. 
The officials said that such sharing has helped them efficiently 
collect otherwise unattainable information about customers, enabling 
their firms to practice better due diligence. Furthermore, some 
officials from the banking industry said the 314(b) safe harbor 
provision has encouraged them to give and receive information that 
uncovers diverse criminal activities because money laundering is a 
predicate to a wide variety of crimes. 

Financial Regulators and SROs Have Updated Examination Guidance and 
Trained Examiners to Evaluate Compliance with CIP and Section 314: 

Since February 1 and October 1, 2003--when financial institutions were 
to be in compliance with regulations for sections 314 and CIP of the 
PATRIOT Act, respectively--banking, securities, and futures regulators 
and SROs issued examination guidance and trained examiners to assess 
firms for compliance with both provisions. The five banking regulators 
jointly issued guidance for CIP and section 314. The SEC and the 
securities SROs we reviewed issued final guidance for both provisions 
individually, and the futures SROs we reviewed issued final guidance 
jointly in February 2004 through the Joint Audit Committee--a 
consortium of futures exchanges. NFA updated and issued its guidance by 
October 2003 for both provisions. All federal financial regulators and 
SROs continue to update staff on changes to examination procedures and 
have trained examiners to assess firms for compliance with CIP and 
section 314. 

All Financial Regulators and SROs Have Issued Final Guidance and 
Procedures for CIP and Section 314 and Used a Variety of Methods to 
Communicate Changes to Their Staff: 

The banking regulators jointly issued guidance and procedures for 
section 314 on October 20, 2003, and for CIP on July 28, 2004. Although 
banking regulators did not issue final examination guidance for CIPs 
until several months after the regulations took effect, examiners were 
assessing firms' CIPs using draft or interim guidance beginning in 
October 2003. SEC issued final guidance and procedures for broker- 
dealers in September 2003 and April 2002 for mutual funds.[Footnote 21] 
SEC's guidance for mutual fund examination does not address examination 
for compliance with section 314(a) requests to mutual funds. SEC 
officials told us that FinCEN is currently not including mutual funds 
in the 314(a) process.[Footnote 22] Also, SEC officials said that 
because mutual fund shares are typically purchased through a principal 
underwriter, which is a registered broker-dealer, most mutual fund 
accounts would likely be covered by broker-dealers who receive 314(a) 
information requests. 

Development of examination guidance for all of the federal financial 
regulators and the SROs continues to evolve as events change the 
requirements financial institutions must adhere to in order to maintain 
sound anti-money laundering programs. FinCEN is working to provide 
support to regulators that have been delegated compliance examination 
responsibilities for financial institutions and has become more 
involved in helping regulators develop examination guidance and best 
practices. For example, federal banking regulators, working on an 
interagency basis through the Federal Financial Institutions 
Examination Council (FFIEC) and with FinCEN, have drafted joint 
examination guidance that was being field tested as of March 2005. The 
targeted issue date for this guidance is June 30, 2005.[Footnote 23] 
Banking agency officials told us that this is the first time they have 
developed joint anti-money laundering guidance and procedures and that 
they are more comprehensive than any they have issued in the past. As 
part of this effort, the banking regulators plan to distribute the new 
examination manual to examiners on a CD that will also include the most 
current anti-money laundering examination guidance and procedures. SEC 
officials told us that they also plan to revise the examination 
guidance and procedures for broker-dealers and mutual funds based on 
lessons learned from examinations conducted last year. FinCEN officials 
told us they intend to also work jointly with SEC and CFTC to 
coordinate efforts among securities and futures regulators and work 
together on new or revised guidance and procedures. However, FinCEN 
officials told us that they have not been involved with SEC and CFTC in 
developing examination guidance to date and they are still in the 
process of establishing MOUs with the two regulators.[Footnote 24]

All of the SROs in our review issued final examination guidance and 
procedures for the CIP rule and section 314 of the PATRIOT Act. The 
securities SROs issued final examination guidance for both provisions 
by October 2003. However, NASD and NYSE began examining firms for 
compliance with section 314 as early as October 2002 and January 2003, 
respectively. The futures exchanges jointly issued final guidance for 
both provisions in February 2004 through a consortium of futures 
exchanges called the Joint Audit Committee.[Footnote 25] The CFTC, 
which performs regulatory oversight of the Joint Audit Committee, 
conducts an annual review of all Joint Audit Committee programs. The 
anti-money laundering program used by the Joint Audit Committee is 
among the programs reviewed annually by the CFTC. CME and CBOT had 
begun assessing firms for account verification, which closely resembles 
the CIP requirement, by May 2002. NFA updated its guidance to reflect 
the CIP requirement in October 2003 and April 2003 for section 314 and 
immediately began assessing firms for compliance with both provisions. 
NFA officials said they expect to issue revised examination guidance in 
2005 for section 326 to address whether, and under what circumstances, 
an executing broker in a give-up transaction is required to apply its 
CIP to the give-up customer.[Footnote 26]

The federal financial regulators and the SROs included in our review 
told us they have updated staff about changes to examination guidance 
and procedures using a variety of techniques including teleconferences, 
monthly or biannual staff meetings, interagency bulletins, email 
notifications, and training sessions. For example, banking and 
securities regulators including the Federal Reserve, OCC, FDIC, SEC, 
and NASD use teleconferences that are broadcast to headquarters and 
district offices to update staff on changes to examination guidance, 
post updates on the organization's Intranet, or use biannual and 
monthly staff meetings. CFTC and the futures SROs including, CBOT, CME, 
and NFA update staff through monthly staff meetings and email. NCUA and 
NYSE send emails to staff that outline or highlight major changes to 
examination guidance. The banking regulators also issue agencywide 
regulatory bulletins and letters to update examiners. 

Financial Regulators and SROs Updated Their Training Program and Have 
Begun to Train Examiners to Evaluate Financial Institutions for 
Compliance with the CIP Requirement and Section 314: 

All federal financial regulators and SROs in our review updated their 
anti-money laundering training to include CIP and section 314. The 
federal financial regulators and SROs began including CIP and section 
314 in training for anti-money laundering examination staff between 
January 2002 and June 2003. Banking and securities regulators use 
formal training courses that are both instructor-led and computer-based 
and industry experts to train staff administering anti-money laundering 
examinations. Banking regulators also send examiners to training 
offered by FFIEC. Training at most futures SROs we interviewed is more 
informal and occurs mostly on the job due to the relatively small 
examination staffs at these organizations. However, NFA and CFTC offer 
instructor-led training. 

Banking Regulators Use Formal Training Courses and FFIEC to Provide 
Staff Training: 

All of the federal banking regulators provide instructor-led courses in 
anti-money laundering and Web-based training. This training introduces 
BSA and PATRIOT Act requirements and includes standard presentations 
and theoretical as well as hands-on training. Their anti-money 
laundering training curriculum includes instruction in various 
examination techniques designed to help examiners recognize potential 
money laundering risks confronting financial institutions and to learn 
procedures for assessing the soundness of an institution's anti-money 
laundering program. The federal banking regulators also send staff to 
conferences sponsored by trade associations that offer multiday focused 
courses and provide informal resources for self-training such as 
subscriptions to online newsletters. 

However, each banking regulator approaches training differently. For 
example, OTS and NCUA require all new staff to attend a basic training 
course in anti-money laundering. According to OTS officials, regional 
conference training, which is attended primarily by examiners, is an 
important part of bringing examiners up to speed on anti-money 
laundering examination procedures. NCUA also uses regional conferences 
to train large numbers of its examination staff. For example, in 2002, 
NCUA used regional conferences to provide training on sections 314 and 
326 of the PATRIOT Act to all examination staff. 

FDIC and the Federal Reserve both have examiners that are anti-money 
laundering specialists who serve as a training resource to other 
examiners. Both agencies train examiners who are primarily responsible 
for conducting anti-money laundering examinations. At the Federal 
Reserve, anti-money laundering examination specialists interact on a 
daily basis with examination staff engaged in anti-money laundering 
examinations to offer case-specific guidance regarding the 
requirements. The Federal Reserve also provides on-site examiner 
training at the individual Reserve Banks, which emphasizes requirements 
under section 314 and 326 of the PATRIOT Act as warranted. Similar to 
the Federal Reserve, FDIC uses staff experienced in conducting anti- 
money laundering examinations as a resource for examiners. Currently, 
FDIC has 321 anti-money laundering specialists who serve as a resource 
and as trainers for other examiners. However, FDIC recently trained 
every examiner on staff, approximately 1,721 as of 2004, in anti-money 
laundering requirements. In addition, many of its supervisory and legal 
professionals are pursuing anti-money laundering specialist 
certifications. OCC has four different training schools, which all 
provide live, instructor-led training in anti-money laundering 
requirements. Finally, in an effort to build up staff with anti-money 
laundering expertise, OCC has a formal on-the-job training program for 
anti-money laundering and finances certifications in anti-money 
laundering examination for some of its examiners. 

Banking regulators also send examiners to FFIEC's interagency anti- 
money laundering training workshops. We were able to attend one of 
these workshops and observed that the course covered the CIP 
requirement and section 314, in addition to other anti-money laundering 
requirements. The course included lectures by experienced examiners, 
presentations by FBI and Internal Revenue Service officials, reading 
materials, and case study exercises. Many of the case study exercises 
demonstrated how to identify suspicious transactions and how 
transaction testing could reveal weaknesses in a financial 
institution's anti-money laundering program.[Footnote 27] Table 1 
provides additional information about training at each of the banking 
regulators. 

Table 1: Banking Regulators Anti-Money Laundering Training-2004: 

Regulator: OCC; 
Training description: OCC offers instructor-led classroom anti-money 
laundering training for its examiners at its Consumer Compliance: 
Basic, Anti-Money Laundering and Terrorist Financing, FinCEN Database 
Training, and Bank Supervision Schools. As part of OCC's entry-level 
training, examiners complete 1 week of classroom training and one week 
of course preparation in the Consumer Compliance: Basic School that 
includes BSA modules; In 2004, 49 examiners attended the Consumer 
Compliance: Basic School, 114 attended the Anti-Money Laundering and 
Terrorist Financing School, 45 attended the FinCEN Database Training 
School, and 62 attended the Bank Supervision School; In addition to 
formal course offerings, OCC periodically provides training in the form 
of agencywide teleconferences and it finances the industry Certified 
Anti-Money Laundering Specialist certification for some of its 
examiners. 

Regulator: OTS; 
Training description: OTS requires all examiners administering anti-
money laundering examinations to complete 3 weeks of classroom training 
courses called "Compliance I" and "Compliance II" that includes modules 
on BSA and the PATRIOT Act; In addition to formal course offerings, OTS 
provides Web-based anti-money laundering training. In 2004, 463 
examiners were trained in anti-money laundering requirements. 

Regulator: NCUA; 
Training description: All new examination staff are required to 
complete a year-long training curriculum that includes instructor-led 
training classes and on-the-job training in anti-money laundering; 
Seasoned examiners are trained on an on-going basis using a combination 
of instructor-led training sessions and regional conferences. In 2004, 
NCUA recorded 957 participants in training sessions in anti-money 
laundering requirements and had 551 examiners on staff. This means that 
each examiner at NCUA participated in approximately two training 
sessions in anti-money laundering requirements in 2004. 

Regulator: FDIC; 
Training description: FDIC examiners receive anti- money laundering 
training in their formal assistant examiner school and formal 
commissioned examiner school. In 2004, 71 examiners received anti-money 
laundering training in assistant examiner school and 40 examiners 
received training in the commissioned examiner school; As of 2004, FDIC 
trained every examiner on staff (1,721) in anti-money laundering 
requirements. To meet this requirement, FDIC established a curriculum 
comprised of several Web-based components. The components are a 
combination of externally provided courseware, internally developed 
presentations, and exercises designed to strengthen examiners' 
knowledge of topics covered; Specialized anti-money laundering training 
has included outside seminars and conferences, such as industry-
sponsored events and regulatory conferences. FDIC also conducts 
training during examinations. This training is targeted to the 
individual examiner and addresses the unique business lines and 
practices at the bank being examined. 

Regulator: Federal Reserve; 
Training description: The Anti-Money Laundering Compliance Section 
interacts on a daily basis with the examination staff engaged in anti-
money laundering examinations at the 12 reserve banks to offer case-
specific guidance regarding anti-money laundering requirements; In 
2004, the Federal Reserve trained 192 anti-money laundering examination 
specialists; As part of the Federal Reserve's entry-level training, 
examiners are required to complete an anti-money laundering online 
training course. 

Source: OCC, OTS, NCUA, FDIC, and Federal Reserve. 

[End of table]

Securities Regulators Provide Training to Staff via Formal Instructor- 
Led Classes and Also Use Industry Experts: 

Similar to the banking regulators, the securities regulators and SROs 
also provide formal classroom instruction in anti-money laundering 
review and some Web-based training, but their approaches differ. SEC 
provides training to more seasoned staff in anti-money laundering while 
anti-money laundering training is available to all staff at the 
securities SROs. However, SEC and NASD are beginning to tailor training 
in anti-money laundering review for newer staff. For example, beginning 
in 2005, SEC's training for new examiners will include an anti-money 
laundering workshop. According to SEC, this effort responds to the 
increasing importance of anti-money laundering issues and serves to 
alert less experienced examiners to SEC's new coordination efforts with 
FinCEN. Similarly, NASD has recently enhanced its new examiner training 
program through the implementation of a formal classroom training 
program. As part of this 6-week course, participants will go through 2 
full days of training devoted to anti-money laundering requirements, 
including the CIP requirement and section 314 of the PATRIOT Act. NYSE 
provides training using a combination of internal and industry experts. 
Its training program includes several sessions on anti-money laundering 
and is administered by both internal employees who have an extensive 
knowledge of the area and outside experts from law and accounting 
firms. 

Securities regulators also coordinate with each other to provide joint 
training for their examiners. In February 2005, SEC, NASD, and NYSE 
prepared a 2-day training session devoted to anti-money laundering 
requirements. This training included presentations from FBI, FinCEN, 
industry experts, and officials from each of the three securities 
regulators. The SROs also work together to provide training about 
timely and relevant examination and compliance topics. According to 
NASD and NYSE officials we interviewed, the SROs periodically prepare 
joint training sessions, which cover topics such as anti-money 
laundering requirements. Table 2 provides additional information about 
training at SEC and the securities SROs. 

Table 2: Securities Regulators Anti-Money Laundering Training-2004: 

Regulator/SRO: SEC; 
Training description: Formal instructor-led training is provided in two 
different curriculums called "Phase II" and "Phase III." Training is 
geared toward more seasoned and mid-level staff. In 2004, SEC trained 
237 of these staff in anti-money laundering requirements; SEC's Joint 
Regulatory Training Program, which is coordinated with NYSE and NASD, 
brings exam staff from all three regulators together to discuss and 
learn about regulatory issues in the securities industry including anti-
money laundering requirements. 

Regulator/SRO: NASD; 
Training description: Most training is available online and there is 
also significant formal classroom training. NASD also sponsors 
symposiums and seminars on anti-money laundering requirements for 
broker-dealer examinations; As of October 25, 2004, new or 
inexperienced examination staffs can participate in a 6-week course 
through NASD's Examiner University, which devotes 2 days to anti-money 
laundering requirements. 

Regulator/SRO: NYSE; 
Training description: Formal instructor-led training on anti-money 
laundering is part of the exchange's ongoing "Regulatory Training 
Program," which uses internal and external speakers such as industry 
experts to present information to staff on important anti-money 
laundering issues as they relate to examination and enforcement. 

Source: SEC, NASD and NYSE. 

[End of table]

Futures SROs Provide Instructor-Led and On-the-Job Training: 

Futures SRO officials at CBOT and CME told us that anti-money 
laundering training was conducted primarily on the job because these 
organizations have relatively small examination staffs. According to 
officials at these organizations, more seasoned, senior staff is 
responsible for training new staff on how to conduct anti-money 
laundering reviews. NFA also provides on-the-job training; however, all 
examiners are required to attend formal training in anti-money 
laundering such as instructor-led training sessions and technical 
roundtables on various anti-money laundering issues. In June and July 
2004, the NFA's compliance department conducted two technical 
roundtables, which focused primarily on CIP requirements. In addition 
to in-house training, NFA also hosts outside agencies, such as FinCEN, 
to make presentations on relevant and timely issued related to anti- 
money laundering requirements. NFA invites other futures SROs including 
CME and CBOT to most of their training sessions. According to officials 
at all of the futures SROs, on-the-job and formal, classroom training 
for examination staff on the CIP requirement and section 314 started as 
early as May 2002. The CFTC also provides in-house training 
opportunities for its entire staff, which includes examiners who 
conduct oversight examinations of SROs. The training covers all aspects 
of the anti-money laundering regulatory requirements applicable to 
futures firms. 

Examinations and Enforcement Actions Highlight Progress and 
Difficulties in Overseeing Compliance with the CIP Requirement and 
Section 314: 

The federal financial regulators and SROs responsible for examining 
financial institutions' compliance with anti-money laundering laws and 
regulations have conducted examinations that cover compliance with, and 
have taken enforcement actions concerning, violations of both the CIP 
requirement and section 314 and its corresponding regulations, but 
coverage of these requirements varied in the examinations we reviewed. 
Most of the examinations in our sample assessed whether financial 
institutions had developed CIPs and procedures for complying with the 
regulations implementing section 314(a), but specific aspects of the 
procedures reviewed were not always documented. Some examinations 
highlighted the difficulties examiners and financial institutions have 
encountered in understanding CIP requirements. Compliance with section 
314(b) and the implementing regulations was not routinely assessed in 
part because information sharing under 314(b) is voluntary. The 
regulators and SROs used informal actions to address the deficiencies 
or apparent violations identified in the examinations in our sample. 
Since the regulations became effective, some of the regulators have 
also taken formal enforcement actions that include violations of the 
CIP requirement and the regulations adopted under section 314(a). 
Finally, in conducting our work for this objective, we encountered 
difficulties in obtaining the information on examinations and 
violations from two of the regulators that revealed weaknesses in their 
processes for tracking anti-money laundering compliance. 

Most Examinations in Our Sample Reviewed CIP, but Coverage of Certain 
Aspects Varied: 

As shown in table 3, about 95 percent of the examinations in our sample 
(168 of 176) documented some type of review of financial institutions' 
CIP procedures. However, coverage varied when we looked for (1) 
evidence that the examiner reviewed CIP and (2) documentation of 
specific aspects of the examiners' reviews, such as reviewing the 
financial institution's methods of verifying customers' identities or 
testing the CIP procedures. When we reviewed the examinations for 
coverage of the CIP requirement, we specifically looked for 
documentation that the examiner assessed whether (1) the financial 
institution had developed a CIP and written procedures for CIP; (2) the 
CIP procedures included collecting appropriate customer information 
including the minimum requirements, such as date of birth for 
individuals; (3) the CIP procedures included verifying customer 
information using documentary or nondocumentary methods; (4) the 
financial institution was using risk-based procedures for verification, 
such as determining how much information to verify depending on its 
assessment of the risk of the customer or type of account or collecting 
additional information; and (5) the CIP had been adequately implemented 
by testing a sample of accounts. 

Generally, we saw documentation showing that examiners reviewed the 
financial institution's written CIP procedures. Most examinations in 
our sample had evidence that the review included assessing written 
procedures for CIP (157 of 176 or 89 percent), and the procedures 
included appropriate customer identification information (144 of 176 or 
82 percent) and methods of verification (143 of 176 or 81 percent). 
Fewer examinations--approximately 56 percent (99 of 176)--assessed 
whether the financial institution was using a risk-based approach. Our 
review leads us to believe that the risk-based aspect of CIP is an area 
that could be difficult for both financial institutions and examiners 
to interpret consistently, because determining the level of risk of a 
customer or account can be difficult and depends on several factors, 
such as the customer's line of business, the process used to open the 
account, and whether the customer is in the United States or overseas. 

Because it can be difficult to determine the customer's risk level, it 
is not surprising that some examiners would focus on reviewing the 
minimum requirements, such as the requirements to collect minimum 
information on customers. OCC officials told us that they developed 
some internal guidance to assist OCC examiners in understanding the 
risk-based aspect of CIP early in 2004 because some examiners were 
confused about it. This guidance explained that limited identification 
and verification procedures may be appropriate for local residents and 
businesses, but enhanced procedures may be needed for nonlocal 
customers, non face-to-face customers (such as customers who conduct 
transactions by mail, telephone, and Internet), and high-risk accounts 
(such as private investment corporations, offshore trusts, and foreign 
customers). The guidance also provided examples of types of enhanced 
verification procedures, such as customer callbacks, credit 
verification, and on-site visits that could be used to verify the 
identity of higher-risk customers. Finally, the guidance stated that 
for most banks a single set of procedures for verifying the identity of 
customers would not be adequate. FDIC had also incorporated some 
examples in examination guidance updated in December 2004 that included 
examples of how CIP procedures may differ depending on the risk of the 
customer or type of account. One example in FDIC's guidance explained 
when a bank may want to obtain more information on a business or 
company. The guidance said that although obtaining information on 
signatories, beneficiaries, principals, and guarantors is not a minimum 
requirement for CIPs, in the case of opening an account for a 
relatively new or unknown firm, it would be in the bank's interest to 
obtain and verify a greater volume of information on signatories and 
other individuals with control or authority over the firm's account. It 
is important that examiners determine whether financial institutions 
have developed risk-based procedures in addition to developing 
procedures that meet the minimum requirements, because (1) the 
regulations require that financial institutions develop risk-based 
procedures and (2) the risk-based procedures allow for more rigorous 
verification procedures on those types of customers thought to be more 
at risk of engaging in money laundering or terrorist activities. 

Table 3: Coverage of CIP in Our Sample of Examinations Conducted 
between October 1, 2003, and May 31, 2004: 

Regulator or SRO: Banking: FDIC; 
Number of examinations in sample: Banking: 20; 
Evidence that CIP was generally reviewed: Banking: 20. 

Regulator or SRO: Banking: Federal Reserve; 
Number of examinations in sample: Banking: 20; 
Evidence that CIP was generally reviewed: Banking: 20. 

Regulator or SRO: Banking: NCUA; 
Number of examinations in sample: Banking: 20; 
Evidence that CIP was generally reviewed: Banking: 20. 

Regulator or SRO: Banking: OCC; 
Number of examinations in sample: Banking: 20; 
Evidence that CIP was generally reviewed: Banking: 17. 

Regulator or SRO: Banking: OTS; 
Number of examinations in sample: Banking: 16; 
Evidence that CIP was generally reviewed: Banking: 14. 

Regulator or SRO: Securities: SEC--Broker-Dealers; 
Number of examinations in sample: Banking: 11; 
Evidence that CIP was generally reviewed: Banking: 11. 

Regulator or SRO: Securities: SEC--Mutual Funds; 
Number of examinations in sample: Banking: 6; 
Evidence that CIP was generally reviewed: Banking: 5. 

Regulator or SRO: Securities: NASD; 
Number of examinations in sample: Banking: 20; 
Evidence that CIP was generally reviewed: Banking: 20. 

Regulator or SRO: Securities: NYSE; 
Number of examinations in sample: Banking: 21; 
Evidence that CIP was generally reviewed: Banking: 19. 

Regulator or SRO: Futures: NFA; 
Number of examinations in sample: Banking: 18; 
Evidence that CIP was generally reviewed: Banking: 18. 

Regulator or SRO: Futures: CBOT; 
Number of examinations in sample: Banking: 2; 
Evidence that CIP was generally reviewed: Banking: 2. 

Regulator or SRO: Futures: CME; 
Number of examinations in sample: Banking: 2; 
Evidence that CIP was generally reviewed: Banking: 2. 

Total; 
Number of examinations in sample: Banking: 176; 
Evidence that CIP was generally reviewed: Banking: 168 (95%). 

Source: GAO analysis of examination sample. 

[End of table]

The results of our review of examinations showed considerable variation 
when we looked for documentation showing whether the examiner tested 
CIP procedures. We found that only about 43 percent (75 out of 176) 
examinations tested procedures, in part because our review looked at 
examinations during the early implementation phase and the examination 
guidance issued by some regulators does not require that they test 
procedures. Federal Reserve and FDIC officials said that during the 
early phase of implementation examiners may have focused on reviewing 
the procedures with the intent of testing procedures in the next 
examination cycle. SEC officials said that since many of their broker- 
dealer examinations that we reviewed were oversight examinations of 
examinations conducted by NASD or NYSE, SEC examiners would not always 
conduct testing. Officials from NASD and NYSE told us that some of the 
smaller broker-dealers may not have opened any new accounts between 
October 1, 2003, and the time of the examination and, therefore, the 
examiner would not have tested accounts. NYSE officials also said that 
CIP was not reviewed in one examination in our sample because the 
examiner determined that the firm did not have any customers and did 
not interact with the public. 

The regulators and SROs varied in their examiner guidance for testing 
procedures. The banking regulators use a risk-based approach to their 
examinations that determines what procedures are performed. Under this 
risk-based approach to examinations, the examiners first determine 
whether the financial institution has a strong compliance program and a 
history of compliance and then tailors the examination procedures based 
on this risk assessment and review of past examinations. For example, 
Federal Reserve officials explained that an examiner's review of the 
independent testing of an institution's anti-money laundering 
procedures may reduce the need for the examiner to also test certain 
procedures.[Footnote 28] When the banking regulators issued their joint 
examination guidance and procedures for CIP in July 2004, the guidance 
directed examiners to determine whether and to what extent to test CIP 
procedures based on a risk assessment, prior examination reports, and a 
review of the bank's audit findings. Although the SEC examination 
procedures for broker-dealers that we reviewed did not include 
procedures for testing, an SEC official told us that the initial 
request letters sent to institutions include a request for customer 
account information so that examiners can test those accounts for CIP 
compliance. SEC's procedures that we reviewed for mutual funds included 
procedures for sampling accounts and testing CIP procedures for 
examinations of funds' transfer agents that maintain customer account 
information.[Footnote 29] NASD and NYSE have instructions that include 
sampling accounts to determine whether the financial institution's CIP 
procedures are being implemented properly. The examination procedures 
used by NFA and the futures exchanges also include procedures to test 
the CIP procedures against a sample of high-risk accounts. 

We also looked to see if examiners conducted any testing of high-risk 
accounts because the results of such testing would provide a clearer 
indicator of whether the financial institution was exercising more due 
diligence on riskier accounts.[Footnote 30] We saw evidence that 
examiners tested a sample of high-risk accounts for CIP compliance in 8 
of 176 of the examinations. Several regulatory officials told us that 
the institutions in our sample may not have had high-risk accounts. For 
example, many of the NFA examinations included documentation saying 
that the institution did not have any high-risk accounts and therefore 
a sample of such accounts were not tested. Also, NCUA and OTS officials 
said that the probability that the institutions they regulate would 
have high-risk accounts was small. 

Although most of the examinations had documentation that the examiner 
had reviewed CIP, the documentation, such as the examination report or 
a summary written by an examiner, did not always specify how the review 
was conducted.[Footnote 31] Therefore, some of the variation in the 
results from our examination review may also be due to differences in 
the way examiners document their work. We observed a variety of methods 
for documenting examination procedures that were conducted and 
examination results. Some of the federal financial regulators and SROs 
used a system of recording the completion of examination procedures, 
such as a questionnaire or worksheet, which generally made it easy to 
follow what the examiner had done but did not always include the same 
aspects that we were reviewing. For example, NCUA examiners document 
their examinations using a questionnaire. However, this questionnaire 
does not ask the examiner to document whether he or she tested CIP 
procedures. In the one instance in which we saw documentation of 
testing by NCUA, the NCUA examiner had documented a deficiency in the 
credit union's CIP procedures based on looking at a sample of accounts. 
An FDIC official told us that examiners may not document that they 
tested procedures unless it showed a deficiency. Some examiners 
documented their review by making notes on copies of the financial 
institution's procedures. Finally, some examinations, such as a few of 
the examinations conducted by the Federal Reserve and OCC, used 
memorandums that discussed the findings of the examination. However, 
the memorandums may not have specified all of the aspects of CIP that 
were reviewed. In addition, OCC officials told us that OCC does not 
require examiners to document every procedure that they complete or 
what they do not do in an examination. 

The Results of Our Examination Review Highlighted Some Difficulties in 
Understanding CIP Requirements: 

Our review of some of the examinations in the sample revealed that 
examiners and financial institutions may not always understand the 
requirements for CIP or interpret them in the same way. The aspects of 
CIP that raised questions about whether examiners or financial 
institutions understand them are (1) the differences between CIP and 
know-your-customer procedures; (2) the differences between the 
requirements to check government lists for CIP versus other government 
lists such as OFAC; and (3) the extent to which a financial institution 
performs CIP procedures for existing customers. Some confusion or lack 
of understanding is to be expected during the early phases of 
implementing new requirements. However, these differences in 
understanding have resulted in inconsistencies in the examination 
process and may have created further confusion and misunderstandings. 

CIP and Other Procedures That Require Customer Identification: 

A potential challenge to assessing compliance with CIP are the 
similarities among CIP requirements and other procedures that require 
customer identification for anti-money laundering purposes, including 
what has been called "know-your-customer" or "customer due diligence" 
(CDD) procedures. Also, although not an issue in the examinations we 
reviewed, section 312 of the PATRIOT Act adds another customer due 
diligence requirement and could lead to misunderstandings about 
appropriate due diligence. Section 312 requires appropriate, specific 
and, where necessary, enhanced, due diligence for correspondent 
accounts and private banking accounts established in the United States 
for non-U.S. persons.[Footnote 32] FinCEN adopted an interim final rule 
for section 312 on July 23, 2002. In the interim rule, FinCEN noted 
that the requirements of this provision placed on financial 
institutions are significant and therefore, additional time was 
necessary to consider what is appropriate for the final rule. 

As shown in table 4, CIP, know-your-customer procedures, and section 
312 have some similarities. All three require some level of collecting 
customer identification information and taking steps to verify that 
information and the risk-based aspect of CIP could overlap or duplicate 
know-your-customer procedures and section 312 requirements. However, 
know-your-customer procedures typically require more information than 
CIP. According to the 1997 BSA examination manual issued by the Federal 
Reserve, a know-your-customer policy begins with obtaining 
identification information and taking steps to verify information-- 
similar procedures to CIP. However, know-your-customer procedures also 
include obtaining information on the source of funds used to open an 
account and determining whether to obtain information on beneficial 
owners of certain types of accounts such as trusts. One goal of know- 
your-customer procedures is to collect sufficient information so that 
the financial institution knows what to expect in terms of customer 
account activity so that it can adequately monitor for unusual or 
suspicious activities. 

Table 4: Anti-Money Laundering Policies That Depend on Procedures to 
Verify Customer Identities: 

Anti-Money laundering policy: Customer Identification Program (CIP); 
Description of the procedures: 
* Minimum requirements include customer name, date of birth, physical 
address, and government-issued ID number; 
* Identification verification procedures are risk-based; Rationale for 
procedures: Collecting identification information and verifying 
customers' identities make it more difficult for money launderers and 
other criminals to use the U.S. financial system and should provide 
useful information to law enforcement if the customer becomes a suspect 
in an investigation. 

Anti-Money laundering policy: Know-Your-Customer; 
Description of the procedures: 
* Identification information is collected, but there are no minimum 
requirements; 
* Customer information usually includes source of funds and information 
on beneficial owners of certain accounts; 
* Procedures include taking steps to verify the identity of the 
customer; Rationale for procedures: Information on a customer's 
identity and expected transactions enables the institution to 
effectively monitor for suspicious transactions and comply with 
requirements to report suspicious activity reports. 

Anti-Money laundering policy: Due Diligence for Private Banking 
Accounts of Non-U.S. Persons[A]; 
Description of the procedures: 
* Minimum requirements include identifying the nominal and beneficial 
owners of, and the source of funds deposited into such an account; 
* Enhanced scrutiny of accounts held by or on behalf of a senior 
foreign political figure or any immediate family member or close 
associate; 
* Procedures are risk-based; Rationale for procedures: Due diligence 
procedures are intended to guard against money laundering and enable 
the financial institution to report any suspicious transactions related 
to types of accounts that have been known to be used for money 
laundering. 

Source: GAO analysis. 

[A] Section 312 requires that banks also conduct due diligence for 
foreign correspondent accounts whereas the private banking requirement 
applies to banks and broker-dealers. For the purpose of illustrating 
how the different rules' requirements are similar without becoming too 
complicated, we are only showing the requirement for private banking 
accounts of non-U.S. persons. 

[End of table]

In 6 examinations in our sample of 176, we found evidence that 
examiners were confusing know-your-customer procedures with CIP. For 
example, in 1 examination, the examiner documented a review of CIP but 
the documentation included a copy of the financial institution's know- 
your-customer procedures that had been in place since 1997 and had not 
been updated to include the minimum identification standards and other 
CIP requirements, such as recordkeeping procedures. As a consequence, 
this institution may be doing less than what CIP requires. In another 
examination, the examiner reviewed the institution's know-your- 
customer procedures, which included the minimum CIP requirements but 
also directed employees to do more due diligence than CIP may require 
depending on a risk assessment of the account and customer. As a 
consequence the examiner and institution may believe that compliance 
with CIP requires more procedures than necessary. Draft examination 
guidance that the banking regulators intend to issue in June 2005 may 
improve understanding of the difference. The draft guidance explains 
that customer due diligence begins with customer identification and 
verification but also involves collecting information in order to 
evaluate the purpose of the account to be able to detect, monitor, and 
report suspicious activity. One regulatory official told us that the 
banking regulators now refer to know-your-customer procedures as 
"customer due diligence."

CIP Requirements for Checking Government Lists: 

In 7 examinations, we found that the examiner confused the CIP 
requirement to check government lists of suspected terrorists with 
another government requirement to freeze assets and block transactions 
of designated persons and entities. Treasury's Office of Foreign Assets 
Control (OFAC) requires financial institutions to freeze assets or 
block transactions of people and entities on the List of Specially 
Designated and Blocked Persons.[Footnote 33] Therefore, financial 
institutions check customers against this list to ensure that they are 
in compliance. In these 7 examinations, the examiners noted that the 
financial institution was not compliant with the CIP requirement to 
check government lists because the institution was not checking 
customers against the OFAC list. However, as FinCEN and the banking 
regulators noted in the first set of CIP FAQs, lists published by OFAC 
whose independent requirements stem from statutes other than the 
PATRIOT Act and are not limited to terrorism, have not been designated 
for purposes of the CIP rule. 

Applying CIP to Existing Customers: 

Two examinations documented disputes or confusion about the extent to 
which financial institutions should apply the CIP requirement to 
existing customers who open new accounts. In one examination, the 
examiner cited a CIP deficiency because the institution had not updated 
the address information for all of its existing customers. However, the 
CIP rule only applies when an existing customer is opening a new 
account and the CIP rule does not expect institutions to update records 
on existing customers if it has a reasonable belief that it knows the 
true identity of its customers. As stated in FAQs for the CIP rule 
issued by FinCEN and the banking regulators, a bank can demonstrate it 
has a reasonable belief that it knows its customers' true identities if 
it had comparable procedures in place prior to October 1, 2003, or 
provide documentation showing that it has had a long-standing 
relationship with a particular customer. In the other examination, the 
institution and the examiners were familiar with the CIP requirements 
but differed in interpreting the extent to which an institution can 
develop a policy that exempts existing customers who open new accounts. 
The institution disputed the examiners' finding that it was not in 
compliance with CIP because it had assumed it knew the identity of all 
of its customers who had opened accounts prior to January 2000. The 
institution argued that it had procedures in place prior to 2000 that 
were similar to CIP procedures and therefore did not have to apply the 
CIP requirement to existing customers who open new accounts. 

Most Examinations in Our Sample Covered Section 314(a), While about 
Half Covered Section 314(b) in Part Because It Is Voluntary: 

As shown in table 5, most of the examinations in our sample--about 76 
percent--included a review of compliance with section 314(a), but 
documentation of specific aspects of section 314(a) were somewhat less. 
We found documentation in 58 percent (91 of 157) of the examinations in 
which the examiner determined that the financial institution was 
receiving 314(a) information requests from FinCEN. We also looked for 
evidence of whether the examiner tested the 314(a) procedures and found 
documentation of testing for about 16 percent (25 of 157) of the 
examinations. 

Although many of the examinations had documentation that the examiner 
had reviewed section 314(a), the documentation, such as the examination 
report or a summary written by an examiner, did not always provide 
enough specificity for us to determine if the examiner had verified 
that the financial institution was receiving the requests or tested the 
procedures. Also, in some cases, the examination procedures did not 
require that examiners test 314(a) procedures. Neither NFA nor the 
exchanges require in their examination guidance that examiners test the 
314(a) procedures to check if all of the required types of records are 
searched, but they do require that the examiner determine if the 
financial institution responded within 2 weeks if it had a customer 
account that matched a subject on the 314(a) request. An SEC official 
told us that it would be difficult to test the 314(a) procedures in 
many cases because many financial institutions destroy the 314(a) 
information requests after they have searched their accounts. The 
examination procedures for section 314(a) issued by the banking 
regulators are also conducted under a risk-based approach. Under the 
risk-based approach, examiners may determine the need to select a 
sample of positive matches or recent 314(a) requests to test the 
procedures. 

Table 5: Coverage of Section 314(a) in Our Sample of Examinations 
Conducted between October 1, 2003, and May 31, 2004: 

Regulator or SRO: Banking: FDIC; 
Number of examinations in sample: 20; 
Evidence that section 314(a) was generally reviewed: 19. 

Regulator or SRO: Banking: Federal Reserve; 
Number of examinations in sample: 20; 
Evidence that section 314(a) was generally reviewed: 18. 

Regulator or SRO: Banking: NCUA; 
Number of examinations in sample: 20; 
Evidence that section 314(a) was generally reviewed: 20. 

Regulator or SRO: Banking: OCC; 
Number of examinations in sample: 20; 
Evidence that section 314(a) was generally reviewed: 7. 

Regulator or SRO: Banking: OTS; 
Number of examinations in sample: 16; 
Evidence that section 314(a) was generally reviewed: 14. 

Regulator or SRO: Securities: SEC--Broker-Dealers[A]; 
Number of examinations in sample: 11; 
Evidence that section 314(a) was generally reviewed: 8. 

Regulator or SRO: Securities: NASD; 
Number of examinations in sample: 20; 
Evidence that section 314(a) was generally reviewed: 18. 

Regulator or SRO: Securities: NYSE; 
Number of examinations in sample: 21; 
Evidence that section 314(a) was generally reviewed: 12. 

Regulator or SRO: Futures: NFA[B]; 
Number of examinations in sample: 5; 
Evidence that section 314(a) was generally reviewed: 2. 

Regulator or SRO: Futures: CBOT; 
Number of examinations in sample: 2; 
Evidence that section 314(a) was generally reviewed: 0. 

Regulator or SRO: Futures: CME; 
Number of examinations in sample: 2; 
Evidence that section 314(a) was generally reviewed: 2. 

Total; 
Number of examinations in sample: 157; 
Evidence that section 314(a) was generally reviewed: 120 (76%). 

Source: GAO analysis of examination sample. 

[A] The SEC sample for section 314(a) excludes examinations of 6 mutual 
fund entities. 

[B] The NFA sample for section 314(a) excludes examinations of 15 
introducing brokers. 

[End of table]

The samples for SEC and NFA are smaller in our review of section 314(a) 
because certain types of financial institutions do not typically 
receive the 314(a) information requests from FinCEN. According to SEC 
and FinCEN officials, under the 314(a) process, information requests 
are generally sent out to banks, credit unions, broker-dealers, and 
futures commission merchants because these types of financial 
institutions have an established infrastructure for capturing point of 
contact information. Also, SEC officials told us that because mutual 
fund shares are typically purchased through a principal underwriter, 
which is a registered broker-dealer, most mutual fund accounts would 
likely be covered by broker-dealers who receive 314(a) information 
requests. Therefore, SEC does not examine mutual funds for compliance 
with section 314(a) at this time. SEC officials said that because many 
of the examinations of broker-dealers in our sample were oversight 
examinations of NASD and NYSE, some examinations would not necessarily 
review all aspects of a financial institution's anti-money laundering 
program. 

The number of examinations in our sample of NFA examinations that 
covered section 314(a) is fewer than for CIP because most of the 
examinations included in our NFA sample were examinations of 
introducing brokers. NFA officials explained that introducing brokers 
do not typically receive 314(a) requests because under industry 
regulation every customer of an introducing broker must also be a 
customer of a futures commission merchant. Therefore, if introducing 
brokers were required to conduct 314(a) searches, they would be 
searching the same universe of customers covered by the 314(a) requests 
sent to futures commission merchants. Also, two of the NFA examinations 
of futures commission merchants did not cover section 314(a) because 
(1) NYSE and NASD had recently examined one of the firms and had 
covered it and (2) NFA limited the scope of the examination of the 
other firm based on prior NFA examinations that found the procedures 
were adequate. The two CBOT examinations did not cover section 314(a) 
because the examinations we reviewed were conducted prior to the 
issuance of the futures exchanges' revised examination guidance and 
procedures in February 2004 that were updated to include section 
314(a). 

Some of the OCC and NYSE examinations also did not cover a review of 
section 314 procedures because our review occurred during the early 
implementation phase and their examination approaches were still 
evolving. According to OCC officials, OCC examinations in our sample 
did not always cover section 314(a) procedures because during this time 
period OCC was in the process of implementing its approach to reviewing 
the PATRIOT Act provisions. In February 2004, OCC issued guidance to 
its examiners to identify those banks with a high risk money laundering 
profile with the intent of giving those institutions a higher priority 
in the examination cycle for covering the PATRIOT Act provisions. 
Because OCC examiners were just beginning to review the PATRIOT Act 
provisions during the time of our review, some examinations may have 
not covered all aspects of the PATRIOT Act. OCC officials also said 
that some examiners may have focused on CIP because CIP procedures are 
more complex. OCC officials said that compliance with section 314 and 
the CIP requirement would be examined in all large banks by March 2005 
and in all small and mid-sized banks by end of 2006. NYSE examinations 
did not always cover section 314(a) procedures, in part, because NYSE 
examination procedures were not clear about how examiners should review 
section 314(a) procedures. Initially, NYSE had included an examination 
procedure covering section 314(a) within its examination objective 
covering the firm's anti-money laundering program. NYSE officials 
created a separate examination objective for section 314(a) while we 
were conducting our review and told us that the revised questions and 
procedures were incorporated into the anti-money laundering examination 
module in December 2004. 

As shown in table 6, about 55 percent of the examinations in our sample 
covered section 314(b). The sharing of information with other financial 
institutions pursuant to section 314(b) is voluntary. As a consequence, 
some examiners may have chosen not to examine for compliance with 
section 314(b) regulations and some federal financial regulators and 
SROs did not develop examination procedures for determining compliance 
with section 314(b) regulations. SEC did not include section 314(b) in 
its examination procedures for mutual funds because it is voluntary. 
The futures SROs--NFA, CME, and CBOT--also did not include procedures 
for examining compliance with section 314(b) regulations. An NFA 
official told us that they did not review 314(b) because it is 
voluntary. Most of the regulators and SROs that examined section 314(b) 
procedures emphasized in their guidance that the provision is voluntary 
and financial institutions can choose not to share customer information 
with other financial institutions or share customer information without 
the benefit of the safe harbor. However, financial institutions may 
choose to share information without providing notice to FinCEN and be 
at risk of violating privacy laws. An NYSE official told us that they 
assess compliance with section 314(b) regulations to ensure that the 
financial institution will not violate privacy laws. The procedures 
issued jointly by the federal banking regulators state that the failure 
to follow the section 314(b) procedures is not a violation of section 
314(b) but could lead to a violation of privacy laws or other laws and 
regulations. 

Table 6: Coverage of Section 314(b) in Our Sample of Examinations 
Conducted between October 1, 2003, and May 31, 2004: 

Regulator or SRO: Banking: FDIC; 
Number of examinations in sample: 20; 
Covered section 314(b): 11. 

Regulator or SRO: Banking: Federal Reserve; 
Number of examinations in sample: 20; 
Covered section 314(b): 8. 

Regulator or SRO: Banking: NCUA; 
Number of examinations in sample: 20; 
Covered section 314(b): 20. 

Regulator or SRO: Banking: OCC; 
Number of examinations in sample: 20; 
Covered section 314(b): 4. 

Regulator or SRO: Banking: OTS; 
Number of examinations in sample: 16; 
Covered section 314(b): 11. 

Regulator or SRO: Securities: SEC--Broker-Dealers; 
Number of examinations in sample: 11; 
Covered section 314(b): 7. 

Regulator or SRO: Securities: SEC--Mutual Funds; 
Number of examinations in sample: 6; 
Covered section 314(b): 0. 

Regulator or SRO: Securities: NASD; 
Number of examinations in sample: 20; 
Covered section 314(b): 16. 

Regulator or SRO: Securities: NYSE; 
Number of examinations in sample: 21; 
Covered section 314(b): 20. 

Regulator or SRO: Futures: NFA; 
Number of examinations in sample: 18; 
Covered section 314(b): 0. 

Regulator or SRO: Futures: CBOT; 
Number of examinations in sample: 2; 
Covered section 314(b): 0. 

Regulator or SRO: Futures: CME; 
Number of examinations in sample: 2; 
Covered section 314(b): 0. 

Total; 
Number of examinations in sample: 176; 
Covered section 314(b): 97 (55%). 

Source: GAO analysis of examination sample. 

[End of table]

Federal Financial Regulators and SROs Generally Used Informal Actions 
to Address CIP and Section 314(a) Deficiencies and Violations: 

Because the regulations were new and many deficiencies and violations 
were technical mistakes, the federal financial regulators and SROs 
mostly took informal actions[Footnote 34] to address deficiencies and 
apparent violations associated with section 314 and CIP. In our sample 
of 176 examinations, 32 examinations reported deficiencies or apparent 
violations related to section 314(a) and 79 examinations reported 
deficiencies or apparent violations relating to CIP requirements. 

The federal financial regulators and SROs used different terms to 
classify problems associated with section 314 and CIP and other 
elements of institutions' anti-money laundering programs. For example, 
some regulators would generally identify section 314 or CIP problems as 
"violations" or "apparent violations," while some of the banking 
regulators would use the term "deficiency" in some cases and 
"violation" in other cases. Officials from one of the banking 
regulators told us that they are in the process of developing guidance 
on the matter. To allow for comparison and aggregation across the 
different regulators and SROs, we examined problems identified as both 
violations and deficiencies for our analysis. The varying terminology 
has an impact on the banking regulators' reporting systems, since some 
regulators track apparent violations but do not track deficiencies. 
This issue will be examined in more depth in other work we are 
conducting on the banking regulators and BSA examinations and 
enforcement. 

The types of section 314(a) deficiencies and violations in our sample 
varied. Table 7 lists examples of the types of deficiencies and 
violations in the examinations we identified as being minor or 
significant. We defined those deficiencies and violations as minor when 
the financial institution was generally receiving 314(a) requests and 
searching its accounts, but its procedures needed enhancements. Those 
deficiencies and violations that we defined as significant were 
situations in which the institution was not receiving 314(a) requests 
or adequately searching accounts. 

Table 7: Examples of Minor and Significant 314(a) Deficiencies and 
Violations Identified in the Sample: 

Minor deficiencies and violations: 
* Point of contact information was incorrect; and; 
* Institution had not formalized its 314(a) procedures. 

Significant or major deficiencies and violations: 
* Institution's point of contact was not receiving 314(a) requests; 
and; 
* Institution did not have internal procedures in place to respond to 
314(a) requests. 

Source: GAO analysis of examination sample. 

[End of table]

The severity of CIP deficiencies and violations also varied. We defined 
CIP deficiencies and violations as being minor when the financial 
institution generally had CIP procedures, but some aspects needed 
enhancements or were incomplete according to the regulatory 
requirements. Situations in which the institution did not have any CIP 
procedures or the examiner found that the institution was generally not 
following its CIP procedures we defined as significant. Table 8 lists 
some examples of minor and significant CIP deficiencies and violations 
in our sample of examinations. 

Table 8: Examples of Minor and Significant CIP Deficiencies and 
Violations Identified in the Sample: 

Minor deficiencies and violations: 
* CIP testing is not included in the institution's BSA/AML audit plan; 
* CIP policy did not adequately address when it will rely on another 
firm to perform customer identification procedures; 
* Institution did not provide adequate notice to customers that the 
bank will gather personal information to verify their identities; and; 
* Institution failed to develop and adopt a board approved, written 
CIP; although institution was in compliance with the substance of 
section 326. 

Significant or major deficiencies and violations: 
* Institution did not follow its identification verification 
procedures; and; 
* Institution did not have a CIP. 

Source: GAO analysis of examination sample. 

[End of table]

In many cases, the examinations included documentation showing that 
institution management agreed to correct deficiencies or violations. In 
several instances, the examination included documentation in which the 
board of directors of the institution is directed to address the 
deficiencies. For example, the Federal Reserve required a board of 
directors to address a bank's failure to maintain documentation of its 
314(a) searches and to address the violation within 30 days of the 
examination. Similarly, NCUA noted that a credit union lacked CIP 
policies and procedures and directed its board of directors to address 
the apparent violation within a specific timeframe. Additionally, in a 
few cases, examiners documented that deficiencies or violations were 
corrected during the exam. For example, a financial institution 
examined by NASD updated its procedures for addressing FinCEN 
information requests while examiners were on-site. 

Recent Formal Enforcement Actions Have Cited Violations of CIP and 
Section 314(a): 

Although none of the examinations in our sample resulted in formal 
enforcement actions,[Footnote 35] recent formal enforcement actions 
involved violations of the CIP requirement and the regulations under 
section 314(a). The federal financial regulators have independent 
statutory authority to institute formal enforcement actions themselves, 
and they may also refer BSA violations to FinCEN for formal enforcement 
action.[Footnote 36] Under delegated authority, FinCEN is the 
administrator of the BSA and has the authority to enforce BSA 
regulations.[Footnote 37] FinCEN's Office of Compliance and Regulatory 
Enforcement evaluates enforcement matters that may result in a variety 
of remedies, including the assessment of civil money penalties. 

The federal banking regulators have the authority to take formal 
enforcement action if they determine that a financial institution is 
engaging in unsafe or unsound practices or has violated any applicable 
law or regulation.[Footnote 38] According to officials from the federal 
banking regulators, they would take formal action, such as issuing a 
cease and desist order, if they detected systemic or willful violations 
of the BSA.[Footnote 39] Violations of formal agreements or orders, 
such as a cease and desist order, may result in the assessment of civil 
money penalties. According to a September 2004 MOU among the federal 
banking regulators and FinCEN, the federal banking regulators have 
agreed to promptly notify FinCEN of significant BSA violations or 
deficiencies by financial institutions under their 
jurisdiction.[Footnote 40] SEC officials said that significant and 
willful BSA violations would be referred to its enforcement division, 
as well as FinCEN.[Footnote 41] Similarly, NASD and NYSE have their own 
rules to enforce anti-money laundering regulations[Footnote 42] and 
officials from NASD and NYSE said that they would take formal actions 
and may make a formal referral to FinCEN if they encountered certain 
BSA violations. Officials from CFTC and the three futures SROs in our 
review also said that they would take formal action for significant BSA 
violations under their own rules to enforce anti-money laundering 
regulations as well as refer the violations to FinCEN.[Footnote 43]

We identified several formal enforcement actions taken by the federal 
banking regulators and FinCEN that included violations of CIP that 
demonstrate how violations of CIP and section 314(a) are enforced (see 
table 9). Only one enforcement action--AmSouth--included a violation of 
section 314(a). These enforcement actions generally consisted of civil 
money penalties, supervisory or written agreements, or cease and desist 
orders. In each of these actions, the financial institution agreed to 
comply with the enforcement action. 

Table 9: Recent Enforcement Actions and Civil Money Penalties against 
Banks That Included CIP and Section 314(a) Violations: 

Financial institution: Abacus Federal Savings Bank; 
Agency: OTS; 
Date: 10/2003; 
Enforcement action/civil money penalty: $175,000 civil money penalty; 
CIP or section 314 violation: In the Cease and Desist Order issued on 
the same day as the civil money penalty, OTS ordered Abacus to 
implement an adequate AML program that included an adequate CIP. 

Financial institution: Fort Lee Federal Savings Bank; 
Agency: OTS; 
Date: 2/2004; 
Enforcement action/civil money penalty: Supervisory agreement; 
CIP or section 314 violation: As part of the agreement, Fort Lee agreed 
to update its BSA and OFAC policies and procedures, including its CIP. 

Financial institution: BAC Florida Bank; 
Agency: FDIC; 
Date: 4/2004; 
Enforcement action/civil money penalty: Cease and desist order; 
CIP or section 314 violation: Among other things, FDIC cited the bank 
for failing to implement an effective customer identification program. 
The bank was required to develop an effective customer due diligence 
program and provide for internal controls, independent testing, 
suitable training, and a BSA officer to ensure compliance. 

Financial institution: Hudson United Bank; 
Agency: FDIC; 
Date: 5/2004; 
Enforcement action/civil money penalty: Cease and desist order; 
CIP or section 314 violation: Among other things, FDIC ordered Hudson 
to complete a review of its CIP. 

Financial institution: Riggs National Bank; 
Agency: OCC and FinCEN; 
Date: 5/2004; 
Enforcement action/civil money penalty: $25 million civil money 
penalty[A]; 
CIP or section 314 violation: In addition to other BSA violations, 
FinCEN and OCC found that Riggs did not adequately implement enhanced 
due diligence and CIP programs. 

Financial institution: First Midwest Bank; 
Agency: Federal Reserve; 
Date: 7/2004; 
Enforcement action/civil money penalty: Written agreement; 
CIP or section 314 violation: Bank agreed to submit to the Federal 
Reserve an acceptable enhanced written customer due diligence program 
within 60 days of the agreement. 

Financial institution: ABN AMRO Bank; 
Agency: Federal Reserve[B]; 
Date: 7/2004; 
Enforcement action/civil money penalty: Written agreement; 
CIP or section 314 violation: The bank agreed to submit an acceptable 
written customer due diligence and CIP program within 60 days of the 
agreement. As part of the program, the bank agreed to determine the 
appropriate documentation necessary to verify the identity and business 
activities of its customers. . 

Financial institution: AmSouth Bank; 
Agency: FinCEN and Federal Reserve; 
Date: 10/2004; 
Enforcement action/civil money penalty: $10 million civil money 
penalty[C]; 
CIP or section 314 violation: AmSouth's AML program lacked adequate 
internal controls and procedures that were necessary to enable the 
performance of appropriate customer due diligence, including compliance 
with section 314(a). AmSouth agreed to submit an acceptable written 
customer due diligence program within 30 days of the agreement. 

Financial institution: First Community Bank; 
Agency: FDIC; 
Date: 10/2004; 
Enforcement action/civil money penalty: Cease and desist order; 
CIP or section 314 violation: FDIC cited the bank for failing to 
implement effective customer identification procedures, among other 
things. Bank required to establish a CIP and 314 information sharing 
guidelines within 60 days of the order. 

Financial institution: Beach Bank; 
Agency: FDIC; 
Date: 11/2004; 
Enforcement action/civil money penalty: Cease and desist order; 
CIP or section 314 violation: Among other things, FDIC cited the bank 
failing to implement an effective customer identification program. FDIC 
ordered the bank to develop and implement a written plan for the 
continued administration of its CIP program and procedures within 60 
days of the order. 

Financial institution: Liberty Bank of New York; 
Agency: FDIC; 
Date: 11/2004; 
Enforcement action/civil money penalty: Cease and desist order; 
CIP or section 314 violation: FDIC ordered the bank to revise and 
enhance its customer identification program and account opening 
procedures. 

Financial institution: Security State Bank; 
Agency: FDIC; 
Date: 12/2004; 
Enforcement action/civil money penalty: Cease and desist order; 
CIP or section 314 violation: Among other things, FDIC ordered the bank 
to establish an adequate independent testing program within 60 days of 
the order. As part of this program, the bank was ordered to test its 
customer identification program, customer due diligence, and compliance 
with information sharing requirements. 

Source: GAO analysis of regulatory enforcement actions. 

[A] OCC and FinCEN assessed concurrent $25 million civil money 
penalties. The agencies stated that the penalties would be satisfied by 
one payment of $25 million to Treasury. 

[B] The State of Illinois Department of Financial and Professional 
Regulation was also part of the written agreement. 

[C] AmSouth also forfeited $40 million as part of a deferred 
prosecution agreement with the Justice Department. 

[End of table]

Two of these enforcement actions provide additional examples of how CIP 
has been confused with know-your-customer policies. In two of the cases 
above, Beach Bank and BAC Florida Bank, FDIC's cease and desist orders 
cited institutions for violations of 31 C.F.R. � 103.121 by "failing to 
implement an effective customer identification program and/or effective 
'Know Your Customer' policies and procedures." While 31 C.F.R. � 
103.121 requires banks to implement a CIP appropriate for their size 
and type of business, it does not require banks to adopt know-your- 
customer policies and procedures. Know-your-customer procedures 
generally require more information than CIP. 

We also identified five formal enforcement actions brought against 
broker-dealers for violations of CIP and section 314(a) requirements. 
According to NASD, the firms that were the subject of the NASD 
enforcement actions in table 10 were generally firms with limited risk 
profiles. Most of the firms did not have extensive client bases, a 
large number of registered representatives, and multiple branch 
offices. Therefore, the fine amounts reflect both the smaller size and 
financial resources of the firms and the lower risk of money laundering 
inherent in their business models. 

Table 10: Recent Enforcement Actions against Securities Broker-Dealers 
That Included CIP and Section 314(a) Violations: 

Financial institution: Hartsfield Capital Securities Inc; 
Agency: FinCEN; 
Date: 11/2003; 
Enforcement action: $10,000 civil money penalty; 
CIP or section 314(a) violation: After identifying violations during an 
examination, SEC referred this case to FinCEN. FinCEN found that 
Hartsfield lacked policies, procedures, and internal controls relating 
to its CIP. 

Financial institution: Harrison Securities, Inc; 
Agency: NASD; 
Date: 12/04; 
Enforcement action: Firm expelled from NASD; 
CIP or section 314(a) violation: Among other things, the firm did not 
have procedures for responding to 314(a) requests. 

Financial institution: Investors Brokerage of Texas, Ltd; 
Agency: NASD; 
Date: 12/04; 
Enforcement action: $10,000 fine and censure; 
CIP or section 314(a) violation: Among other things, the firm's AML 
program did not adequately establish a CIP. 

Financial institution: Trident Partners; 
Agency: NASD; 
Date: 2/05; 
Enforcement action: $17,500 fine and censure; 
CIP or section 314(a) violation: Among other things, the firm failed to 
receive FinCEN 314(a) notices because it failed to update its AML 
contact information. 

Financial institution: FSC Securities Corp; 
Agency: NASD; 
Date: 3/05; 
Enforcement action: $40,000 fine and censure; 
CIP or section 314(a) violation: Among other things, the firm failed to 
maintain adequate procedures that addressed keeping confidential FinCEN 
information requests. 

Source: GAO analysis of regulatory enforcement actions. 

[End of table]

Regulators' Processes for Tracking Examination Information Varied with 
Some Having Weaknesses That Could Affect Their Ability to Monitor Anti- 
Money Laundering Compliance: 

Reviewing examination data and 176 examinations across six regulators 
and five SROs provided us an opportunity to see a wide range of 
practices for managing anti-money laundering oversight programs. One of 
the key practices that varied across programs was the tracking system 
used to track examination information. The information that was 
provided to us on the examinations and apparent violations that covered 
section 314 and CIP raised broader issues about how the regulators and 
SROs track anti-money laundering compliance information. To select our 
sample of examinations, we requested information on the examinations 
and apparent violations that covered section 314 and CIP, but two of 
the regulators could not easily obtain this information from their 
tracking systems. Although we assessed the reliability of the data we 
received, we did not conduct broad assessments of the information 
systems and processes regulators and SROs use to track examinations in 
this report, in part, because we have other work reviewing the banking 
regulators' anti-money laundering examinations and enforcement programs 
and SEC's examination programs that both include reviewing how they 
track examinations. However, we highlight the problems we encountered 
in this review because the problems could affect regulators' ability to 
monitor compliance with sections 314 and CIP as well as other anti-
money laundering requirements. 

Generally, OCC, FDIC, OTS, and NCUA were able to respond to our data 
request using their examination tracking systems and provide 
information on examinations that would most likely cover section 314 
and CIP by identifying examinations that covered anti-money laundering 
compliance and information on apparent violations. The information 
varied in determining whether the examinations actually covered CIP and 
section 314 during the period of time between October 1, 2003, and May 
31, 2004, because the regulators began examining for these provisions 
at different times. For example, OCC's system is designed to capture 
examination areas but examiners were not provided guidance to begin 
reviewing PATRIOT Act provisions until late February 2004, and 
therefore, the system was not always recording that they had performed 
modules covering the PATRIOT Act sections for the period of our review. 
Also, NCUA officials told us that we were more likely to be able to 
review examinations that covered section 314 and CIP in examinations 
completed on or after February 2004, because those examinations were 
more likely to have used the revised examination questionnaire for anti-
money laundering compliance that had been installed on computers in 
December 2003. 

The Federal Reserve had some difficulty responding to our request 
because the Federal Reserve's existing automated tracking system for 
examinations did not capture sufficient detail on whether its 
examinations cover a review of anti-money laundering compliance. 
Although full-scope examinations are all supposed to cover anti-money 
laundering compliance, many of the Federal Reserve's target 
examinations may also cover anti-money laundering compliance, but their 
tracking system does not capture this level of detail. Therefore, the 
Federal Reserve could not readily identify the population of 
examinations that would most likely cover CIP and section 314. Also, 
although the Federal Reserve tracks information on apparent violations, 
its tracking system does not track deficiencies. This distinction was 
important to our information request because the Federal Reserve had 
not had any apparent violations related to section 314 or CIP, but its 
Federal Reserve Banks had reported deficiencies in quarterly reports to 
the Federal Reserve Board. However, the information in the quarterly 
reports was not sufficiently detailed enough for identifying specific 
examinations that had deficiencies related to CIP or section 314. 
Therefore, the Federal Reserve Board had to request this information 
from the 12 Federal Reserve Banks who had to manually go through 
examination files and compile the information. Federal Reserve 
officials told us that they are making significant enhancements to the 
tracking system to capture additional information on Bank Secrecy Act 
and anti-money laundering compliance. 

SEC's examination tracking system is supposed to capture information on 
whether the examination included certain focus areas, such as a review 
of anti-money laundering compliance. However, when attempting to 
respond to our information request on broker-dealer examinations, SEC 
discovered that the information from its tracking system did not appear 
to be accurate. According to an SEC official, SEC information on anti- 
money laundering examinations for broker-dealers was not always 
accurate because examiners were not always inputting all of the focus 
areas that they covered, including anti-money laundering. Therefore, 
SEC conducted a word search through its database of examination reports 
to identify examinations that covered section 314 and CIP and 
identified about 26 examinations to respond to our information request. 
After our data request, SEC officials emailed a reminder to examination 
staff of the importance of accurately filling out all examination 
information in the tracking system, including identifying when anti- 
money laundering is a focus area, and asked that they review the 
accuracy of this information for completed examinations and update it 
as necessary. For mutual fund examinations, SEC used the same tracking 
system to identify all routine examinations of mutual funds during our 
examination review period because anti-money laundering was expected to 
be a focus area for all routine examinations and did not encounter the 
same problem. NASD and NYSE were able to identify examinations and 
apparent violations of section 314 and CIP using their examination 
tracking systems. 

The futures SROs provided us information without any difficulty. 
According to an NFA official, once NFA had identified through its 
tracking system the population of examinations that covered anti-money 
laundering compliance and those examinations that included an apparent 
violation, the examinations were reviewed to identify whether the 
apparent violation was related to section 314 or CIP. CME and CBOT each 
only have approximately 30 to 40 futures commission merchants at any 
point in time that they track and had only completed a few examinations 
during the time period for our examination review and therefore did not 
have difficulty responding to our information request. 

Law Enforcement Officials Believe That Section 314(a) and CIP Have Been 
Valuable Tools in Terrorist and Money Laundering Investigations: 

Law enforcement officials praised the 314(a) process, stating that it 
has improved coordination between law enforcement agencies and 
financial institutions and indicated that CIP has also assisted 
investigations. The 314(a) process has resulted in discovery of 
additional accounts held by suspects and issuance of grand jury 
subpoenas, search warrants, arrests, and indictments. Most law 
enforcement officials we interviewed also believed that CIP 
requirements have helped investigators by ensuring that better and more 
detailed information is collected and maintained at financial 
institutions. Although CIP and 314(a) processes are useful tools for 
investigating money laundering and terrorist financing cases, the 
decision to bring charges in specific cases is always discretionary. 

Law Enforcement Officials Believe That the Section 314(a) Process Has 
Improved Coordination with Financial Institutions and Has Led to More 
Efficient Investigations: 

Officials from the Department of Justice and other law enforcement 
agencies told us that the 314(a) process has improved coordination 
between law enforcement agencies and financial institutions and has 
increased the speed and efficiency of investigations. Department of 
Justice officials, including supervisory prosecutors in two U.S. 
Attorneys Offices, with whom we spoke, said that the 314(a) process 
facilitated the flow of information between financial institutions and 
law enforcement officials by connecting FinCEN to approximately 20,000 
financial institutions. 

Investigators use the information FinCEN gathers from these financial 
institutions as evidence in building cases against potential money 
launderers and terrorist financers. FinCEN recently reported that the 
314(a) system has processed 381 requests since it resumed operation in 
February 2003. Of the total number of requests processed, 137 of them 
were submitted by federal law enforcement agencies in the conduct of 
terrorist financing investigations and 244 in the conduct of money 
laundering investigations. FinCEN also reported that 314(a) feedback 
from law enforcement requesters has been overwhelmingly positive. In 
approximately 2 years, February 2003 through March 2005, 314(a) 
requests submitted by law enforcement have resulted in the 
identification of thousands of new accounts and transactions. According 
to information that law enforcement provides to FinCEN, the 314(a) 
process has provided information that helped support the issuance of 
more than 800 subpoenas, 11 search warrants, and 9 arrests. However, 
FinCEN officials cautioned that this information represents feedback 
from only 10 percent of the cases for which 314(a) information requests 
were made and that FinCEN does not verify the accuracy of the data 
provided by law enforcement officials. 

Almost all of the law enforcement officials we interviewed said that 
the 314(a) process improved the speed and efficiency of investigations 
by allowing investigators to query a large number of financial 
institutions in a short amount of time. One FBI official we interviewed 
showed us information on how a 314(a) request led to identification of 
additional suspect accounts across 23 states and 45 financial 
institutions. Prior to submitting the request, the FBI was aware of 
only four accounts. One law enforcement official told us that prior to 
section 314, law enforcement officials often sent subpoenas to 
individual banks for information. They could not, however, 
simultaneously request financial institutions across the country to 
search accounts or transactions for groups of individuals or even one 
person. According to FBI officials, the 314(a) process improves the 
efficiency of investigations because agents spend less time finding the 
suspect's specific financial transactions or accounts. The results from 
a 314(a) request may also help law enforcement to eliminate false 
leads. One prosecutor told us that the 314(a) process had been used 3 
or 4 times during investigations of terrorist financing or money 
laundering cases. However, all of the law enforcement officials we 
interviewed told us that they are very judicious in their use of 314(a) 
requests, in part, because they were aware of the costs to the 
financial services industry and also because submitting the request can 
expose a covert operation. For instance, it is possible that a 
financial institution will take some action, permissible under the law, 
but which has the unintended effect of compromising the 
investigation.[Footnote 44]

According to some law enforcement officials, the 314(a) process also 
allows investigators to track down sophisticated criminals who might 
normally elude typical investigative approaches. For example, one 
prosecutor told us that a potential money launderer or terrorist 
financer with a lot of knowledge and sophistication about financial 
institutions might have been able to circumvent traditional approaches 
used to collect information, such as surveillance or tracing financial 
transactions to individual financial institutions. However, in her 
view, the 314(a) process has allowed investigators to cast a wider net 
thereby significantly improving the investigative effort. 

Information Collected through CIP Can Assist Money Laundering and 
Terrorist Financing Investigations: 

Many of the law enforcement officials we interviewed said financial 
institutions are collecting and maintaining better and more detailed 
information as a result of CIP requirements. One prosecutor told us 
that as a result of section 326 regulations, grand jury subpoenas can 
be used to obtain more substantive and detailed information on 
accounts. This improvement was due to the fact that the CIP rule 
requires financial institutions to consistently gather more information 
from a customer when an account is opened. For example, investigators 
and prosecutors are now able to receive social security numbers, dates 
of birth, and complete addresses when they issue subpoenas. The same 
prosecutor told us that in the past, subpoenaed account information 
concerning criminal suspects was often incomplete. For instance, 
instead of a physical address they would receive only a P.O. Box or 
mailbox associated with the account. Standardization of account opening 
procedures has also made it easier for law enforcement to make positive 
matches with suspects on 314(a) lists. Prior to the enactment of the 
PATRIOT Act, some financial institutions already had established 
policies and procedures to verify customer identities, but the 
financial services industry overall was not subject to uniform minimum 
requirements for identifying and maintaining customer information. As a 
result, law enforcement officials did not always know what kind of 
information they would acquire from institutions pursuant to a subpoena 
or warrant.[Footnote 45]

Successful Prosecutions of Terrorist Financing and Money Laundering 
Cases Depend on Numerous Factors: 

Although the CIP requirement and 314(a) requests have made useful 
information available to federal prosecutors who are investigating and 
prosecuting terrorist financing and money laundering cases, prosecution 
of specific cases is always discretionary. Department of Justice 
officials, including prosecutors in U.S. Attorneys Offices, said that 
case specific factors continue to determine whether or not a prosecutor 
will bring charges on a terrorist financing or money laundering case. 
There are no specific monetary thresholds or criteria that determine 
when a prosecutor will pursue a money laundering or terrorist financing 
case. One prosecutor told us that these provisions helped prosecutors 
better understand the financial lay of the land in anti-money 
laundering and terrorist financing and that the use of the provisions 
by law enforcement leads to better investigations. It is not feasible, 
however, to enumerate how many cases were successfully prosecuted as a 
direct result of Suspicious Activity Reports or 314(a) requests since 
each prosecution is unique and based on many factors. 

Prosecutors in two U.S. Attorney's Offices also told us that the 
provisions, while helpful, could not alter the fact that anti-money 
laundering and terrorist financing cases are resource intensive and 
complex. Prosecutors told us that reviewing transactions for a typical 
money services business or currency exchange was time consuming and may 
typically involve review of voluminous daily transaction records. Once 
the transaction analysis is performed, the information then must be 
reviewed in coordination with other evidence to determine if it can 
support proof beyond a reasonable doubt, and whether the evidence used 
to build the case is suitable for presentation in court. 

Conclusions: 

Since the passage of the PATRIOT Act, the U.S. government and the 
financial industry have worked together to develop and implement the 
regulations required by the PATRIOT Act. It was challenging to develop 
joint regulations that covered so many sectors of the financial 
industry. The financial industry has implemented procedures to comply 
with the PATRIOT Act's regulations, including the CIP requirement and 
the information sharing provisions in section 314, but it has 
encountered several challenges along the way and there are some 
concerns and issues that remain outstanding. FinCEN, the federal 
financial regulators, and SROs have made a concerted effort to reach 
out to and educate the industry on its responsibilities for customer 
identification and sharing information with law enforcement. However, 
the interagency process has delayed the release of additional guidance 
for CIP. The implementation challenges that industry officials shared 
with us demonstrate that the government will need to continue its 
education efforts and work with industry to resolve outstanding issues. 
Primarily, industry officials are unclear about the regulators' views 
on what constitutes sufficient verification procedures for certain high-
risk customers, such as foreign individuals and companies and whether 
they and their examiners would view a customer and the appropriate 
level of verification in the same way. Therefore, industry officials 
would like to receive more guidance from FinCEN and the regulators on 
issues such as these. 

FinCEN, the federal financial regulators, and SROs have also taken 
steps to implement section 314 and CIP and have begun examining 
financial institutions and taking enforcement action for violations. 
However, our review revealed examiner difficulties in assessing 
compliance with CIP that could reduce its effectiveness at uncovering 
suspicious or questionable customers or lead to inconsistencies in the 
way examiners conduct examinations. Because our review found that not 
all examinations documented a review of the risk-based aspect of CIP, 
we believe that some examiners and financial institutions may not fully 
understand how the CIP requirements should be applied to higher risk 
customers. The primary reason that Treasury and the federal financial 
regulators adopted the risk-based approach to verifying customer 
identity was so that financial institutions would be able to focus more 
effort on high-risk customers. Also, some of the other difficulties we 
found in our review of examinations highlight how inconsistent 
interpretations can occur during examinations. For example, some 
examiners came to different conclusions about how the CIP requirement 
is applied to existing customers that open new accounts. Because 
examination findings can cause a financial institution to change its 
practices, such inconsistencies could lead to significant variations in 
policies and procedures among financial institutions based on differing 
interpretations of the CIP requirements by examiners. 

Although our review focused on two specific anti-money laundering 
regulations, the enforcement of these regulations occurs under the 
broader BSA regulatory structure and, hence, the results of our review 
should be understood in this broader context. Enforcing the BSA, as 
amended by the PATRIOT Act, is a shared responsibility among FinCEN and 
the federal financial regulators. As the administrator of BSA, FinCEN 
has responsibility for enforcement of the provisions added by the 
PATRIOT Act, but FinCEN relies on the federal financial regulators to 
conduct examinations and alert it to violations that warrant an 
enforcement action. This arrangement is even more complicated for 
securities and futures financial institutions because SEC and CFTC 
largely rely on the SROs to conduct examinations and enforce rules and 
regulations. Since the passage of the PATRIOT Act, FinCEN and the 
financial regulators have been working more closely together to better 
coordinate BSA examinations and enforcement and to improve the 
consistency of the information they provide to the financial industry. 
FinCEN's new Office of Compliance and MOU with the federal banking 
regulators are good first steps in better BSA oversight and 
enforcement. In addition, FinCEN and the federal banking regulators 
have worked together to develop interagency anti-money laundering 
examination procedures for the first time. FinCEN is in the process of 
reaching similar MOU agreements with SEC and CFTC. Whether in issuing 
guidance for industry or examiners, FinCEN will need the continued 
cooperation of all seven financial regulators to effectively address 
problems and inconsistencies in the U.S. anti-money laundering 
regulatory system. 

Recommendations for Executive Action: 

To improve implementation of sections 326 and 314 of the PATRIOT Act, 
we are making two recommendations: 

* To build on education and outreach efforts and help financial 
institutions subject to the CIP requirement effectively implement their 
programs, we recommend that the Secretary of the Treasury, through 
FinCEN and in coordination with the federal financial regulators and 
SROs, develop additional guidance covering ongoing implementation 
issues related to the CIP requirement. Specifically, additional 
guidance on the CIP requirement that provides examples or alternatives 
of how to verify the identity of high-risk customers, such as foreign 
individuals and companies, could help financial institutions develop 
better risk-based procedures. 

* To enhance examination guidance covering the CIP requirement and 
ensure that examiners are well-informed about CIP requirements, we 
recommend that the Director of FinCEN work with the federal financial 
regulators to develop additional guidance for examiners to use in 
conducting BSA examinations. Specifically, the guidance should clarify 
that complying with the CIP requirement is more than determining 
whether the minimum customer identification information has been 
obtained--the examiner should determine whether a financial 
institution's CIP contains effective risk-based procedures for 
verifying the identity of customers. Secondly, the guidance should 
clarify how CIP fits into other customer due diligence practices, such 
as know-your-customer procedures. Finally, the guidance should reflect 
the FAQs on CIP issued for industry, which addressed the difficulties 
in interpretation we observed for checking government lists and 
applying the CIP requirement to existing customers. 

Agency Comments and Our Evaluation: 

We provided a draft of this report for review and comment to the 
Departments of the Treasury, Justice, and Homeland Security; 
seven federal financial regulators (Federal Reserve, FDIC, OCC, OTS, 
NCUA, SEC, and CFTC) and five SROs (CBOT, CME, NFA, NASD, and NYSE). We 
received written comments from the Department of the Treasury, NCUA, 
and SEC. These comments are reprinted in appendixes II, III, and IV. 
The Departments of the Treasury and Justice, the Federal Reserve, FDIC, 
OCC, SEC, CFTC, NASD, NYSE and NFA also provided technical comments and 
clarifications, which we incorporated in this report where appropriate. 
The Department of Homeland Security, OTS, CME, and CBOT had no 
comments. 

In its written comments, Treasury said that despite the considerable 
educational and outreach efforts already undertaken by FinCEN, there 
was still some confusion and lack of clarity on the part of both the 
federal financial regulators and SROs, and the regulated industries and 
examiners who conduct compliance inspections of these industries. 
Treasury concurred with our recommendations that additional guidance 
would improve implementation of these regulations. Treasury also 
commented that, with the diversity of financial institutions that must 
comply with CIP regulations, firms need the flexibility to implement 
programs tailored to their own size, location, and type of business and 
to allow them to use a risk-based approach to verify the identity of 
their respective customer bases. In its written comments, NCUA also 
supported our recommendations. Both agencies commented that Treasury 
and the federal banking regulators plan to issue new BSA examination 
procedures in June 2005. In its written response, SEC commented that 
consistent with our recommendation, the federal financial regulators 
are continuing to work cooperatively to ensure that they provide 
consistent guidance on interpretive and compliance issues. Concerning 
difficulties SEC had with its examination tracking system when 
responding to our information request, SEC also said that its staff is 
formulating improvements to the existing automated tracking system. 

Unless you publicly announce its contents earlier, we plan no further 
distribution of this report until 30 days after the date of this 
report. At that time, we will send copies of this report to the 
Departments of the Treasury, Homeland Security, and Justice; 
the Federal Reserve Board, FDIC, OCC, OTS, NCUA, CFTC, SEC, NASD, NYSE, 
NFA, CBOT, CME, and interested congressional committees. We will also 
make copies available to others on request. In addition, this report 
will be available at no cost on our Web site at [Hyperlink, 
http://www.gao.gov]. 

If you or your staff have any questions about this report please 
contact me at (202) 512-2717 or Barbara Keller, Assistant Director, at 
(202) 512-9624. GAO contacts and key contributors to this report are 
listed in appendix V. 

Signed by: 

Yvonne D. Jones: 
Director, Financial Markets and Community Investment: 

[End of section]

Appendixes: 

Appendix I: Scope and Methodology: 

To determine how Treasury and the federal financial regulators 
developed the regulations for CIP and section 314 and identify 
challenges, we reviewed documents related to the rulemaking process 
including comment letters and the Federal Register notices of the final 
rules and interviewed officials from Treasury (FinCEN), Justice, the 
federal financial regulators, and SROs. 

To identify the government's education and outreach efforts, we 
interviewed officials from Treasury (FinCEN), the federal financial 
regulators, and SROs about how they have informed and educated the 
industry and reviewed education and outreach materials provided to us. 
To identify implementation challenges encountered by financial 
institutions, we interviewed company officials and industry trade 
associations representing banks, credit unions, securities broker- 
dealers, mutual funds, futures commission merchants, and futures 
introducing brokers. We also reviewed letters that company officials 
and industry representatives sent to Treasury and the federal financial 
regulators during the rulemaking process as well as after the final 
rules were issued that expressed concerns and challenges they had about 
implementing procedures to comply with CIP and section 314 regulations. 

To determine the extent to which the federal financial regulators and 
SROs have updated examination guidance and trained examiners on CIP and 
section 314, we reviewed copies of draft and final versions of 
guidance; collected information on examiner training courses related to 
anti-money laundering and the number of examiners trained in 2002, 
2003, and 2004; and interviewed officials on their examination guidance 
and training programs. We also observed one anti-money laundering 
training course taught by the Federal Financial Institutions 
Examination Council (FFIEC) that provides training to bank examiners. 

To determine the extent to which the federal financial regulators have 
examined for compliance and taken enforcement actions on CIP and 
section 314 regulations, we collected data on the number of exams 
completed from October 1, 2003, through May 31, 2004, and the number of 
violations for CIP and section 314 regulations for the same time period 
from six federal financial regulators and five SROs. The data from the 
regulators and SROs generally came from information systems and 
reporting processes used to collect and track information on 
examinations and violations. There was some variability in how the 
regulators and SROs defined examinations, violations, and the start and 
end dates for examinations and therefore the data are not comparable. 
However, we determined that the data provided to us were generally 
reliable for our purposes. Our data reliability assessments generally 
involved interviewing officials about the management of the data and 
basic tests of the data to determine if it appeared accurate. We 
attempted to select approximately 20 examinations from each regulator 
and SRO. To ensure that we would be able to review a sufficient number 
of examinations with the types of violations related to CIP and section 
314 requirements and how the regulators and SROs addressed violations, 
we sampled proportionally more examinations that included violations of 
CIP and section 314 than examinations without violations, though in 
some cases the number of examinations that had such violations were 
less than 10 and, therefore, the sample would not include 
proportionally more examinations with violations. We reviewed a total 
of 176 examinations. However, the number of examinations varied widely 
between organizations, and in the cases of CBOT and CME, all available 
examinations were selected because the number of examinations was 
small.[Footnote 46] While the selections of individual examinations 
were made randomly within the subsets of violation and nonviolation 
examinations to minimize the possibility of bias in our sample, the 
arbitrary totals selected were small in number and not representative 
of the true ratio of violation to nonviolation examinations within the 
organization nor the volume of examination activity across the 
organizations. Therefore, these samples are not statistically 
representative. However, our review of the examinations enabled us to 
describe the approaches used by the regulators to examine for 
compliance and highlight issues that may present challenges for 
examiners in interpreting the new regulations and appropriately 
assessing financial institutions for compliance. Table 11 displays the 
final sample size for each of the regulators and SROs and also explains 
why some examinations initially selected were not part of our final 
sample. 

Table 11: Description of Our Approach for Sampling Examinations 
Covering CIP and Section 314: 

Regulator or SRO: FDIC; 
Population of examinations from which we sampled[A]: 1,333; 
Number of exams initially sampled: 20; 
Number of exams in final sample: 20; 
Number of examinations with no violations of CIP or section 314: 7; 
Number of examinations with violations of CIP and/or section 314: 13. 

Regulator or SRO: Federal Reserve; 
Population of examinations from which we sampled[A]: 414; 
Number of exams initially sampled: 20; 
Number of exams in final sample: 20; 
Number of examinations with no violations of CIP or section 314: 8; 
Number of examinations with violations of CIP and/or section 314: 12. 

Regulator or SRO: NCUA; 
Population of examinations from which we sampled[A]: 2,109; 
Number of exams initially sampled: 20; 
Number of exams in final sample: 20; 
Number of examinations with no violations of CIP or section 314: 8; 
Number of examinations with violations of CIP and/or section 314: 12. 

Regulator or SRO: OCC--small & mid-size banks; 
Population of examinations from which we sampled[A]: 39; 
Number of exams initially sampled: 16; 
Number of exams in final sample: 16; 
Number of examinations with no violations of CIP or section 314: 12; 
Number of examinations with violations of CIP and/or section 314: 4. 

Regulator or SRO: OCC--large banks; 
Population of examinations from which we sampled[A]: 9; 
Number of exams initially sampled: 4; 
Number of exams in final sample: 4; 
Number of examinations with no violations of CIP or section 314: 3; 
Number of examinations with violations of CIP and/or section 314: 1. 

Regulator or SRO: OTS[B]; 
Population of examinations from which we sampled[A]: 245; 
Number of exams initially sampled: 20; 
Number of exams in final sample: 16; 
Number of examinations with no violations of CIP or section 314: 9; 
Number of examinations with violations of CIP and/or section 314: 7. 

Regulator or SRO: SEC-Broker Dealers; 
Population of examinations from which we sampled[A]: 26; 
Number of exams initially sampled: 11; 
Number of exams in final sample: 11; 
Number of examinations with no violations of CIP or section 314: 5; 
Number of examinations with violations of CIP and/or section 314: 6. 

Regulator or SRO: SEC--Mutual Funds[C]; 
Population of examinations from which we sampled[A]: 71; 
Number of exams initially sampled: 11; 
Number of exams in final sample: 6; 
Number of examinations with no violations of CIP or section 314: 6; 
Number of examinations with violations of CIP and/or section 314: 0. 

Regulator or SRO: NASD; 
Population of examinations from which we sampled[A]: 654; 
Number of exams initially sampled: 20; 
Number of exams in final sample: 20; 
Number of examinations with no violations of CIP or section 314: 5; 
Number of examinations with violations of CIP and/or section 314: 15. 

Regulator or SRO: NYSE; 
Population of examinations from which we sampled[A]: 86; 
Number of exams initially sampled: 21; 
Number of exams in final sample: 21; 
Number of examinations with no violations of CIP or section 314: 15; 
Number of examinations with violations of CIP and/or section 314: 6. 

Regulator or SRO: NFA[D]; 
Population of examinations from which we sampled[A]: 193; 
Number of exams initially sampled: 20; 
Number of exams in final sample: 18; 
Number of examinations with no violations of CIP or section 314: 5; 
Number of examinations with violations of CIP and/or section 314: 13. 

Regulator or SRO: CME; 
Population of examinations from which we sampled[A]: 2; 
Number of exams initially sampled: 2; 
Number of exams in final sample: 2; 
Number of examinations with no violations of CIP or section 314: 1; 
Number of examinations with violations of CIP and/or section 314: 1. 

Regulator or SRO: CBOT; 
Population of examinations from which we sampled[A]: 2; 
Number of exams initially sampled: 2; 
Number of exams in final sample: 2; 
Number of examinations with no violations of CIP or section 314: 2; 
Number of examinations with violations of CIP and/or section 314: 0. 

Source: GAO analysis and samples of regulator and SRO data. 

[A] The population of examinations from which we pulled our sample 
should not be interpreted as the total number of examinations covering 
anti-money laundering compliance during this time period. Rather, the 
population generally represents the examinations identified by the 
regulator or SRO as more likely to cover section 314 and CIP. We also 
deleted some examinations provided to us in the original data sets 
because they fell outside our timeframes or were ineligible for our 
purposes (e.g., examinations conducted by a state regulator). 

[B] The original OTS sample mistakenly had 3 duplicate exams in the 
violation sample. An additional exam was dropped at OTS request because 
an examiner needed the workpapers for a follow-up exam. Therefore, the 
OTS sample changed from 20 examinations to 16 exams. 

[C] Our initial sample of mutual funds was based on data provided by 
SEC that included examinations of transfer agents in which anti-money 
laundering compliance was not required to be a part of the examination. 
Therefore, we had to drop four transfer agents that we had initially 
selected in our sample. Also, our sample of mutual funds picked up a 
Unit Investment Trust, which is not subject to anti-money laundering 
rules at this time and so we dropped it from our sample. Overall, the 
original sample of 11 mutual fund entities was reduced to 6. 

[D] Two examinations in the NFA sample were dropped because one firm 
was withdrawing its registration and the other examination was a 
limited scope exam on the firm's financial position; therefore, these 
examinations should not have been in the sample. 

[End of table]

After selecting our sample of examinations, we requested the 
examination reports and related workpapers associated with each 
examination from each of the regulators and SROs. We developed a data 
collection instrument to review the examination documentation. The data 
collection instrument was developed by reviewing the regulation 
requirements for CIP and section 314 and the examination procedures 
developed by the regulators and SROs. After each examination was 
reviewed once using the data collection instrument, a second person 
reviewed the examination using the data collection instrument a second 
time to ensure the reliability of our coding of the review questions 
and accuracy of data entry. We used the results from the data 
collection instrument to determine how the regulators and SROs reviewed 
compliance and how regulators and SROs dealt with deficiencies and 
violations related to CIP and section 314. We also identified formal 
enforcement actions that were completed during the time of our review 
and included violations of CIP or section 314 regulations. Finally, we 
interviewed officials from FinCEN, the federal financial regulators, 
and SROs about their examination and enforcement policies. 

To determine how these new regulations have and could improve law 
enforcement investigations and prosecutions of money laundering and 
terrorist activities, we interviewed officials representing several law 
enforcement agencies, including the FBI and ICE, and Department of 
Justice officials. We interviewed supervisory prosecutors from two U.S. 
Attorneys offices as well as supervisory officials at the Asset 
Forfeiture and Money Laundering Section and the Counter-Terrorism 
Section at the Department of Justice who have been involved with money 
laundering and terrorist cases and had experience with section 314 and 
CIP to better understand the factors that are considered when deciding 
whether to prosecute a money laundering or terrorist financing case. We 
also reviewed information that FinCEN collects from law enforcement 
agencies on the results of the 314(a) process. 

We conducted our work in New York City, NY; Chicago, IL; and 
Washington, D.C., between February 2004 and March 2005 in accordance 
with generally accepted government auditing standards. 

[End of section]

Appendix II: Comments from the Department of the Treasury: 

DEPARTMENT OF THE TREASURY:
UNDER SECRETARY: 

WASHINGTON, D.C. 

May 2, 2005: 

Ms. Yvonne D. Jones:
Director, Financial Markets and Community Investment: 
U.S. Government Accountability Office:
441 G Street, N.W.: 
Washington, D.C. 20548: 

Dear Ms. Jones: 

I am writing to provide the Department of the Treasury's comments on 
the draft report entitled, USA PATRIOT Act - Additional Guidance Could 
Improve Implementation of Regulations Related to Customer 
Identification and Information Sharing Procedures. The report was a 
review of the implementation of two provisions of the USA PATRIOT Act -
-Sections 314 and 326 --and it contains two recommendations: (1) 
FinCEN, in consultation with the federal financial regulators and SROs, 
needs to develop additional guidance for industry on ongoing 
implementation issues and (2) FinCEN needs to develop additional 
guidance for examiners to improve the quality and consistency of 
examinations of the customer identification program (CIP) requirement. 

With regard to both recommendations, the Department of the Treasury 
concurs with the findings of the report that additional guidance would 
improve implementation of these regulations. We understand that despite 
the considerable education and outreach already undertaken by FinCEN, 
there still exists some confusion on the part the federal financial 
regulators and SROs, the regulated industries, and the examiners who 
conduct compliance inspections of these industries. FinCEN is committed 
to publishing additional guidance and becoming more involved in helping 
the federal financial regulators develop examination guidance and best 
practices. Moreover, whether in issuing guidance for industry or 
examiners, FinCEN will continue to cooperate with the financial 
regulators to effectively address problems and inconsistencies in the 
U.S. anti-money laundering regulatory system. 

On April 28, 2005, FinCEN issued a new set of inter-agency Qs&As on 
Section 326 that we believe will address a number of areas of concern. 
In addition, through its participation with the Federal Financial 
Institutions Examination Council, FinCEN is working closely with the 
federal banking agencies to develop new uniform examination procedures 
and guidelines to better ensure consistency in Bank Secrecy Act 
compliance examination procedures. These new procedures are expected to 
be issued in June of this year. In addition, FinCEN signed Memoranda of 
Understanding with the federal banking agencies, the IRS, and the New 
York State Banking Department, and they expect to have several 
additional MOUs with other States in the coming months. Through the 
execution of such information sharing agreements, I am confident that 
consistency in the application of the Bank Secrecy Act will be better 
achieved. 

I would like to make one additional comment regarding the risk-based 
aspect of CIP, which was noted in the report as an area that could be 
difficult for both financial institutions and examiners to interpret 
consistently. The report stated that determining the level of risk of a 
customer or account can be difficult and depends on several factors, 
such as the customer's line of business, the process used to open the 
account, and whether the customer is in the United States or overseas. 
While we agree with the report's assessment, we believe that it was 
essential to adopt a risk-based approach. Given the diversity of 
financial institutions that must comply with these regulations, we 
believe that firms need the flexibility to implement programs tailored 
to their own size, location and type of business and to allow them to 
use a risk-based approach to verify the identity of their respective 
customer bases. 

In addition, I would like to request that on page 46 of the report, the 
section entitled, CIP Requirements for Checking Government Lists, the 
following sentence be changed to read as follows: "However, as FinCEN 
and the banking regulators noted in the first set of CIP FAQs, lists 
published by OFAC whose independent requirements stem from statutes 
other than the USA PATRIOT Act and are not limited to terrorism, have 
not been designated for purposes of the CIP rule."

Thank you for the opportunity to respond to this report on the USA 
PATRIOT Act. If you have any questions or wish to discuss these 
comments further, please contact FinCEN's Associate Director, William 
Langford, at 202-354-6414. 

Sincerely,

Signed by: 

Stuart A. Levey:
Under Secretary for Terrorism & Financial Intelligence: 

Cc: Juan C. Zarate, Assistant Secretary, Terrorist Financing & 
Financial Crime; 
William J. Fox, Director, FinCEN: 

[End of section]

Appendix III: Comments from the National Credit Union Administration: 

National Credit Union Administration: 
April 26, 2005: 

Yvonne Jones, Director: 
Government Accountability Office: 
Financial Markets and Community Investment: 
441 G Street, N.W.
Washington, D.C. 20548: 

Dear Ms. Jones: 

We have reviewed your draft report entitled USA Patriot Act: Additional 
Guidance could Improve Implementation of Regulations Related to 
Customer Identification and Information Sharing Procedures (GAO 05- 
412). 

The National Credit Union Administration (NCUA) supports your 
recommendations to provide additional guidance concerning the 
implementation of Customer Identification Programs (CIP) required by 
the USA Patriot Act. 

In January 2004, the federal banking regulators[NOTE 1], Financial 
Crimes Enforcement Network (FinCEN), and the United States Department 
of the Treasury published guidance in the form of Frequently Asked 
Questions (FAQs) addressing CIP. A second set of FAQs will be published 
during 2005. 

In June 2005, the federal banking regulators plan to publish 
examination procedures for compliance with the Bank Secrecy Act. The 
procedures address CIP concepts, including risk assessment and due 
diligence practices. While FinCEN contributed to these procedures, NCUA 
anticipates the procedures will be finalized and published by the 
Federal Financial Institutions Examination Council[NOTE 2]. 

Thank you for the opportunity to review and comment on your report. 

Sincerely,

Signed by: 

JoAnn Johnson: 
Chairman:
National Credit Union Administration: 

EI/EAH:eah: 

NOTES: 

[1] The federal banking regulators include the National Credit Union 
Administration, Board of Governors of the Federal Reserve, Federal 
Deposit Insurance Corporation, Office of the Comptroller of the 
Currency, and Office of Thrift Supervision. 

[2] The Federal Financial Institutions Examination Council is a formal 
interagency body empowered to prescribe uniform principles, standards, 
and report forms for the federal examination of financial institutions 
by the Board of Governors of the Federal Reserve System, the Federal 
Deposit Insurance Corporation, the National Credit Union 
Administration, the Office of the Comptroller of the Currency, and the 
Office of Thrift Supervision and to make recommendations to promote 
uniformity in the supervision of financial institutions. 

[End of section]

Appendix IV: Comments from the Securities and Exchange Commission: 

UNITED STATES SECURITIES AND EXCHANGE COMMISSION: 
Office of Compliance Inspections and Examinations: 

WASHINGTON, D.C. 20549: 

April 25, 2005: 

Yvonne D. Jones: 
Director:
Financial Markets and Community Investment: 
United States Government Accountability Office: 
Washington, D.C. 20548: 

Re: USA PATRIOT Act: Additional Guidance Could Improve Implementation 
of Regulations Related to Customer Identification and Information 
Sharing Procedures (GAO-05-412): 

Dear Ms. Jones: 

Thank you for the opportunity to comment on the Government 
Accountability Office's (GAO) draft report entitled USA PATRIOT Act: 
Additional Guidance Could Improve Implementation of Regulations Related 
to Customer Identification and Information Sharing Procedures. 

As you know, the federal financial regulators worked together with 
FinCEN to develop a series of customer identification rules that apply 
equally to different financial institutions, while also taking into 
account the institutions' different business models and customer 
relationships. By creating minimum standards for collecting identifying 
information, these rules have helped ensure that firms can obtain the 
information they need to fulfill their obligations under the rules 
implementing Section 326. Consistent with GAO's recommendation, the 
federal financial regulators are continuing to work cooperatively to 
ensure that they provide consistent guidance on interpretive and 
compliance issues. In addition, the SEC staff regularly works with 
other regulators on anti-money laundering issues, including with FinCEN 
and the securities self-regulatory organizations (SROs), as well as 
with securities industry representatives. 

As the GAO report illustrates, the SEC is committed to its anti-money 
laundering examination program. The examination staff launched its anti-
money laundering initiative with respect to broker-dealers in advance 
of the enactment of the USA PATRIOT Act, and began reviewing certain 
aspects of mutual funds' customer identification programs in advance of 
the adoption of final customer information program rules for mutual 
funds. This provided both examiners and the industry advanced 
opportunity to acclimate to the new requirements. The current 
examination program includes the review of broker-dealers' and mutual 
funds' customer information and information sharing programs, as well 
as oversight of the SROs' anti-money laundering examinations of broker- 
dealers. The GAO report highlighted the importance of the ability to 
track examinations and their results. The SEC staff uses both an exam 
tracking system and a database of examination reports, which are 
designed to complement each other. The SEC's technology staff is 
formulating improvements to the existing automated tracking system. 

Anti-money laundering examinations continue to be a cooperative 
process. The SEC staff conducts joint training sessions with the SROs, 
in which FinCEN participates. The SEC staff also meets regularly with 
the SROs and FinCEN to discuss new developments. In addition, the SEC 
and FinCEN have been discussing methods to share information more 
routinely. 

Thank you and your staff for your courtesy during this review. 

Sincerely,

Signed by: 

Lori A. Richards: 
Director: 

[End of section]

Appendix V: GAO Contacts and Staff Acknowledgments: 

GAO Contacts: 

Barbara I. Keller (202) 512-9624; 
Kay D. Kuhlman (202) 512-2755: 

Staff Acknowledgments: 

William Bates, Davi M. D'Agostino, David Nicholson, Carl Ramirez, Omyra 
Ramsingh, Adam Shapiro, and Kaya Leigh Taylor made key contributions to 
this report. 

[End of section]

Related Products: 

[End of section]

Anti-Money Laundering: Issues Concerning Depository Institution 
Regulatory Oversight. [Hyperlink, http://www.gao.gov/cgi-bin/getrpt?GAO-04-833T]. Washington, D.C.: June 3, 2004. 

Combating Money Laundering: Opportunities Exist to Improve the National 
Strategy. [Hyperlink, http://www.gao.gov/cgi-bin/getrpt?GAO-03-813]. 
Washington, D.C.: September 26, 2003. 

Internet Gambling: An Overview of the Issues. [Hyperlink, 
http://www.gao.gov/cgi-bin/getrpt?GAO-03-89]. Washington, D.C.: 
December 2, 2002. 

Interim Report on Internet Gambling. [Hyperlink, http://www.gao.gov/cgi-
bin/getrpt?GAO-02-1101R]. Washington, D.C.: September 23, 2002. 

Money Laundering: Extent of Money Laundering through Credit Cards is 
Unknown. [Hyperlink, http://www.gao.gov/cgi-bin/getrpt?GAO-02-670]. 
Washington, D.C.: July 22, 2002. 

Anti-Money Laundering: Efforts in the Securities Industry. [Hyperlink, 
http://www.gao.gov/cgi-bin/getrpt?GAO-02-111]. Washington, D.C.: 
October 10, 2001. 

Money Laundering: Oversight of Suspicious Activity Reporting at Bank- 
Affiliated Broker-Dealers Ceased. [Hyperlink, http://www.gao.gov/cgi-
bin/getrpt?GAO-01-474]. Washington, D.C.: March 22, 2001. 

Suspicious Banking Activities: Possible Money Laundering by U.S. 
Corporations Formed for Russian Entities. [Hyperlink, 
http://www.gao.gov/cgi-bin/getrpt?GAO-01-120]. Washington, D.C.: 
October 31, 2000. 

Money Laundering: Observations on Private Banking and Related Oversight 
of Selected Offshore Jurisdictions. [Hyperlink, http://www.gao.gov/cgi-
bin/getrpt?GAO/T-GGD-00-32]. Washington, D.C.: November 9, 1999. 

Private Banking: Raul Salinas, Citibank, and Alleged Money Laundering. 
[Hyperlink, http://www.gao.gov/cgi-bin/getrpt?GAO/T-OSI-00-3]. 
Washington, D.C.: November 9, 1999. 

Private Banking: Raul Salinas, Citibank, and Alleged Money Laundering. 
[Hyperlink, http://www.gao.gov/cgi-bin/getrpt?GAO/OSI-99-1]. 
Washington, D.C.: October 30, 1998. 

Money Laundering: Regulatory Oversight of Offshore Private Banking 
Activities. [Hyperlink, http://www.gao.gov/cgi-bin/getrpt?GAO/GGD-98-
154]. Washington, D.C.: June 29, 1998. 

Money Laundering: FinCEN's Law Enforcement Support Role Is Evolving. 
[Hyperlink, http://www.gao.gov/cgi-bin/getrpt?GAO/GGD-98-117]. 
Washington, D.C.: June 19, 1998. 

Money Laundering: FinCEN Needs to Better Manage Bank Secrecy Act Civil 
Penalties. [Hyperlink, http://www.gao.gov/cgi-bin/getrpt?GAO/GGD-98-
108]. Washington, D.C.: June 15, 1998. 

Money Laundering: FinCEN's Law Enforcement Support, Regulatory, and 
International Roles. [Hyperlink, http://www.gao.gov/cgi-
bin/getrpt?GAO/GGD-98-83]. Washington, D.C.: April 1, 1998. 

Money Laundering: FinCEN Needs to Better Communicate Regulatory 
Priorities and Timelines. [Hyperlink, http://www.gao.gov/cgi-
bin/getrpt?GAO/GGD-98-18]. Washington, D.C.: February 6, 1998. 

Private Banking: Information on Private Banking and Its Vulnerability 
to Money Laundering. [Hyperlink, http://www.gao.gov/cgi-
bin/getrpt?GAO/GGD-98-19R]. Washington, D.C.: October 30, 1997. 

Money Laundering: A Framework for Understanding U.S. Efforts Overseas. 
[Hyperlink, http://www.gao.gov/cgi-bin/getrpt?GAO/GGD-96-105]. 
Washington, D.C.: May 24, 1996. 

(250179): 

FOOTNOTES

[1] Uniting and Strengthening America by Providing Appropriate Tools 
Required to Intercept and Obstruct Terrorism Act (USA PATRIOT Act) of 
2001, Pub. L. No. 107-56, 115 Stat. 272 (2001). We will refer to the 
act as the "PATRIOT Act". 

[2] The body of law commonly referred to as the Bank Secrecy Act 
encompasses numerous provisions enacted by Titles I & II of Pub. L. No. 
91-508, 84 Stat. 1114 (1970), and codified as amended at 31 U.S.C. �� 
5311-5332 and 12 U.S.C. �� 1829b and 1951-1959. BSA requires reports 
and records of transactions involving cash, negotiable instruments, or 
foreign currency and authorizes the Secretary of the Treasury to 
prescribe regulations to ensure that adequate records are maintained of 
transactions that have a high degree of usefulness in criminal, tax or 
regulatory investigations or proceedings, or in the conduct of 
intelligence or counterintelligence activities. 

[3] The seven federal financial regulators are the Board of Governors 
of the Federal Reserve Board System (Federal Reserve), Federal Deposit 
Insurance Corporation (FDIC), Office of the Comptroller of the Currency 
(OCC), Office of Thrift Supervision (OTS), National Credit Union 
Administration (NCUA), Securities and Exchange Commission (SEC) and the 
Commodity Futures Trading Commission (CFTC). The five SROs included in 
our review are NASD (formerly the National Association of Securities 
Dealers) and the New York Stock Exchange (NYSE) for securities broker- 
dealers and the National Futures Association (NFA), Chicago Mercantile 
Exchange (CME), and the Chicago Board of Trade (CBOT) for futures 
commission merchants and introducing brokers. The Internal Revenue 
Service and the Commissioner of Customs also have delegated authority 
to investigate and enforce compliance with certain provisions of the 
BSA regulations. 

[4] Section 326 of the PATRIOT Act added a new subsection (l) to 31 
U.S.C. �5318. 

[5] See Customer Identification Programs for Banks, Savings 
Associations, Credit Unions and Non-Federally Regulated Banks, 68 Fed. 
Reg. 25090 (2003); Customer Identification Programs for Broker-Dealers, 
68 Fed. Reg. 25113 (2003); Customer Identification Programs for Futures 
Commission Merchants and Introducing Brokers, 68 Fed. Reg. 25149 
(2003); and Customer Identification Programs for Mutual Funds, 68 Fed. 
Reg. 25131 (2003). 

[6] Although Section 326 directs Treasury and the federal financial 
regulators to adopt CIP requirements for all "financial institutions," 
which is defined very broadly to encompass a variety of entities, the 
Secretary may exempt certain financial institutions and accounts from 
the CIP requirements. To date, Treasury and the federal financial 
regulators have jointly adopted, and this report is limited to a review 
of, CIP requirements applicable to (a) banks that are subject to 
regulation by one of the federal banking regulators, as well as 
nonfederally insured credit unions, private banks and trust companies; 
(b) securities broker-dealers; (c) futures commission merchants and 
introducing brokers; and (d) mutual funds. Accordingly, unless the 
context otherwise requires, the term "financial institutions" refers to 
those financial institutions subject to the CIP requirements. 

[7] Section 314 is an uncodified provision that appears in the 
Historical and Statutory Notes to 31 U.S.C. � 5311. 

[8] Information Sharing between Federal Law Enforcement Agencies and 
Financial Institutions, 31 C.F.R. � 103.100 (2002). 

[9] Voluntary Information Sharing among Financial Institutions, 31 
C.F.R. � 103.110. 

[10] We selected NASD and NYSE because they oversee the largest 
percentage of firms in the securities industry and NFA, CBOT, and CME 
because they oversee the largest number of firms in the futures 
industry. CFTC was not included in our review of examination guidance 
and sample of examinations because CFTC conducts oversight reviews of 
the SROs and at the time of our review, CFTC officials told us that the 
oversight examinations of SROs they had conducted to date did not focus 
on compliance with sections 314 and 326. 

[11] 31 U.S.C. � 5311. The regulations adopted by Treasury implementing 
the BSA are codified at Part 103 of Title 31 of the Code of Federal 
Regulations (BSA Regulations). As used in this report, and unless 
otherwise specified, BSA collectively refers to the statutory 
provisions and the BSA Regulations. 

[12] NFA also oversees commodity trading advisors and commodity pool 
operators; although the Secretary of the Treasury has deferred 
application of the anti-money laundering requirements to these 
financial institutions for an unspecified period, Treasury has proposed 
rules that would require commodity trading advisors and commodity pools 
to implement anti-money laundering programs. See 68 Fed. Reg. 23640 
(May 5, 2003) (commodity trading advisors); 67 Fed. Reg. 60617 
(September 26, 2002) (unregistered investment companies, including 
commodity pools). Futures commission merchants can be individuals, 
associations, partnerships, corporations, and trusts that solicit or 
accept orders for the purchase or sale of any commodity for future 
delivery on or subject to the rules of any exchange and that accept 
payment from or extend credit to those whose orders are accepted. An 
introducing broker for commodities is a person engaged in soliciting or 
accepting orders for the purchase or sale of any commodity for future 
delivery on an exchange who does not accept any money, securities or 
property to margin, guarantee, or secure any trades or contracts that 
result there from. 

[13] 31 C.F.R. � 103.121. Although the substantive provisions of the 
four joint CIP rules are codified in 31 C.F.R. part 103, subpart I - 
Anti-Money Laundering Programs, each of the federal financial 
regulators concurrently published a provision in its own regulations to 
cross-reference the final rules in order to clarify the applicability 
of the final rules to the financial institutions subject to their 
respective jurisdictions. 

[14] 31 C.F.R. �� 103.122 and 103.131. 

[15] 31 C.F.R. � 103.123. 

[16] Other records of information, such as documents used to verify a 
customer's identity, obtained pursuant to a CIP must be retained for 
five years after the record is made. 

[17] In a 2004 report, we found that consular identification cards are 
issued by some governments to help identify their citizens living in a 
foreign country, but that federal agencies hold different and, in some 
cases, conflicting views on the usage and acceptance of these cards and 
no executive branch guidance is yet available. See U.S. Government 
Accountability Office, Border Security: Consular Identification Cards 
Accepted within United States, but Consistent Federal Guidance Needed, 
GAO-04-881 (Washington, D.C.: Aug. 24, 2004). 

[18] Effective March 1, 2005, FinCEN implemented a Web-based USA 
PATRIOT Act Section 314(a) Secure Information Sharing System. The new 
system allows for a streamlined, secure Web-enabled delivery of 314(a) 
information to financial institutions and more efficient reporting of 
matches back to FinCEN. 

[19] Although there is no statutory requirement that regulations 
implementing section 314(b) be adopted, FinCEN determined that such 
rules were needed to specify the kinds of institutions that would be 
permitted to share information and to clarify how such financial 
institutions could provide the requisite notice of their intent to 
share information. The rules adopted under section 314(b) apply to 
financial institutions that are required to establish and maintain an 
anti-money laundering program, or are treated as having satisfied the 
requirements of Treasury's anti-money laundering program regulations. 
See 31 C.F.R. � 103.110. 

[20] According to CFTC officials, the CIP rule (and other CFTC rules) 
place responsibility for customer identification procedures on futures 
commission merchants that are carrying brokers because they deal 
directly with customers and have the systems and procedures for 
identifying customers. However, a customer may elect to use one or more 
executing futures commission merchants to place a given trade for a 
number of reasons (e.g., the customer's carrying broker may not be a 
member of the particular exchange on which the contract in question is 
listed for trading). In this situation, the customer would need another 
futures commission merchant--the executing broker--to conduct the trade 
(i.e., the executing broker "gives up" the trade). Executing brokers 
have not historically had to identify these types of customers. 

[21] According to the timeline presented in figure 1 in this report, 
SEC's mutual fund exam guidance was updated to include CIP before 
Treasury issued the notice of proposed rulemaking for section 326 in 
July 2002. When we asked SEC to explain the discrepancy, an SEC 
official said that when they began drafting anti-money laundering exam 
guidance, SEC representatives were already in contact, and consulting, 
with Treasury about the new anti-money laundering requirements in the 
PATRIOT Act. As a result, they were aware that the CIP requirement 
would be applied to funds. As a result, SEC decided to include 
guidance, in general terms, for the need for mutual funds to have in 
place, or start developing, programs to verify the identity of 
customers. 

[22] FinCEN said it has limited the scope of financial institutions 
subject to 314(a) requests primarily to securities broker-dealers, 
commodity futures commission merchants, and depository institutions 
primarily to ensure the effective and orderly implementation of the 
system. Unlike mutual funds, these types of institutions have an 
existing federal financial regulator that maintains point of contact 
information. FinCEN has stated that it will consider expanding the 
universe of financial institutions that receive 314(a) requests in the 
future if it is feasible and appropriate. 

[23] The Council is a formal interagency body empowered to prescribe 
uniform principles, standards, and report forms for the federal 
examination of financial institutions. FFIEC was established on March 
10, 1979, pursuant to title X of the Financial Institutions Regulatory 
and Interest Rate Control Act of 1978 (FIR), PL 95-630. OCC, OTS, the 
Federal Reserve, FDIC, and NCUA constitute the FFIEC. 

[24] According to a recent Department of the Treasury Office of the 
Inspector General report that reviewed FinCEN's Office of Compliance, 
the MOU with SEC has been delayed because of fundamental differences. 

[25] The Joint Audit Committee is a representative committee of U.S. 
futures exchanges and regulatory organizations. The committee issues 
guidance used for futures commission merchants' compliance audits, 
provides industry updates, and serves as a forum for futures regulators 
and exchanges to address issues in the commodity and futures industry. 

[26] As noted earlier in this report, give-up relationships occur 
between carrying brokers and executing brokers when the customer of a 
carrying broker elects to use an executing broker to place a given 
trade. 

[27] Transaction testing is used to validate examiners' judgment on the 
reliability of an institution's procedures and internal controls. One 
form of transaction testing is the comparison of day-to-day practices 
to the requirements of policies and procedures (to assess compliance 
with internal systems). This form of testing can reveal whether an 
institution with sound written procedures has actually incorporated 
those procedures into its operations. 

[28] Section 352 of the USA PATRIOT Act requires that financial 
institutions have an independent audit function to test its anti-money 
laundering program. Therefore, examiners would typically review this 
independent testing and such testing could cover CIP since financial 
institutions that are subject to both the anti-money laundering program 
requirement and the CIP requirement must include their CIP as part of 
their anti-money laundering program. 

[29] Transfer agents are not subject to a CIP requirement unless they 
are a bank or a broker-dealer, although many of them perform CIP 
requirements as a service to their affiliated mutual funds and broker- 
dealers. 

[30] According to the CIP examination procedures issued by the banking 
regulators, high-risk accounts may include, but are not limited to, 
foreign private banking and trust accounts, offshore accounts, and out- 
of-area and non face-to-face accounts. 

[31] In determining whether the examination documented a review of CIP 
and section 314, we reviewed examination reports, written summaries of 
examination findings, questionnaires or worksheets used by examiners to 
record their work, and workpapers that may include copies of the 
financial institution's procedures, internal audits, records of 
transaction testing, and memorandums. 

[32] U.S.C. � 5318(i). 

[33] OFAC administers and enforces economic and trade sanctions against 
countries and groups of individuals, such as terrorists and narcotics 
traffickers. OFAC publishes a list of individuals and companies owned 
or controlled by, or acting for or on behalf of, targeted countries. It 
also lists individuals, groups, and entities, such as terrorists and 
narcotics traffickers designated under programs that are not country- 
specific. Collectively, such individuals and companies are called 
"Specially Designated Nationals" or "SDNs." Their assets are to be 
blocked and U.S. persons are generally prohibited from dealing with 
them. 

[34] Regulators may use an informal action when a financial 
institution's overall condition is sound, but it is necessary to obtain 
written commitments to ensure that identified problems and weaknesses 
are corrected. Agreement to an informal action can be evidence of a 
commitment to correct identified problems before they adversely affect 
an institution's performance or cause further decline in its condition. 
Informal enforcement actions include commitment letters, deficiency 
letters, and memorandums of understanding. 

[35] Unlike most informal actions, formal enforcement actions are 
authorized by statute, are generally more severe, and are disclosed to 
the public. Also, formal actions are enforceable through the assessment 
of civil money penalties or fines, and, with the exception of formal 
agreements, through the federal court system. Formal enforcement 
actions include cease and desist orders and other consent orders and 
formal written agreements. 

[36] In addition, SRO rules typically provide for institution of 
enforcement actions against members of the SRO for violation of 
applicable laws and regulations and for the imposition of sanctions on 
members for such conduct. SROs can make referrals to the SEC or CFTC 
for referral to FinCEN. 

[37] See Treasury Department Order No. 108-01, dated September 26, 
2002, and 31 C.F.R. 103.56. The Secretary is authorized to delegate 
such responsibilities to FinCEN pursuant to 31 U.S.C. � 310 �(b)(2)(i) 
and (J). 

[38] 12 U.S.C. � 1818(b). 

[39] A cease and desist order requires an institution to cease and 
desist from unsafe or unsound practices and may require the institution 
to take affirmative action to correct the conditions resulting from any 
such violation or practice. 

[40] The MOU specifies that a "significant BSA violation or deficiency" 
includes systemic or pervasive BSA compliance program deficiencies or 
reporting or recordkeeping violations, as well as a one-time, 
nontechnical BSA violation that demonstrates willful or reckless 
disregard for the BSA requirements or that creates a substantial risk 
of money laundering or the financing of terrorism within the financial 
institution. 

[41] SEC has the authority to take an enforcement action against broker-
dealers and mutual funds who violate anti-money laundering regulations 
set forth in 17 C.F.R. �� 240.17a-8, and 270. 38a-1. 

[42] NASD, Rule 3011(a), (b), (c), (d), and (e); and NYSE, Rule 445. 

[43] CFTC, Rule 42.2; CBOT, Rule 423.05; CME, Rule 981; and NFA, Rule 2-
9(c). 

[44] Requests for information submitted by FinCEN to financial 
institutions pursuant to the rules adopted under 314(a) are 
confidential; however, financial institutions may use information 
provided by a section 314(a) request to determine whether to establish 
or maintain an account, or to engage in a transaction or to assist the 
financial institution in complying with the requirements of the BSA and 
the BSA Regulations. 

[45] See, for example: 31 U.S.C. 5318(h) and the regulations adopted 
pursuant thereto, which require certain financial institutions to adopt 
an anti-money laundering program that includes policies and procedures 
for verifying customer identity; 12 U.S.C. 1829b(c) and the regulations 
adopted pursuant thereto, which require certain financial institutions 
to maintain records and other evidence of customer identities; and 12 
U.S.C. 1818(s) and the regulations adopted pursuant thereto, which 
require certain financial institutions to establish BSA compliance 
programs. 

[46] The samples for CBOT and CME encompass all of the examinations 
that included anti-money laundering compliance completed between 
October 1, 2003, and May 31, 2004. The futures exchanges began anti- 
money laundering examinations in 2002 and plan to reexamine firms for 
anti-money laundering compliance approximately every 3 examination 
cycles, which ranges from 9 to 18 months, unless they are conducting an 
examination to follow-up on deficiencies. Therefore, during our review 
period, the only examinations CBOT and CME conducted were follow-up 
examinations. 

GAO's Mission: 

The Government Accountability Office, the investigative arm of 
Congress, exists to support Congress in meeting its constitutional 
responsibilities and to help improve the performance and accountability 
of the federal government for the American people. GAO examines the use 
of public funds; evaluates federal programs and policies; and provides 
analyses, recommendations, and other assistance to help Congress make 
informed oversight, policy, and funding decisions. GAO's commitment to 
good government is reflected in its core values of accountability, 
integrity, and reliability. 

Obtaining Copies of GAO Reports and Testimony: 

The fastest and easiest way to obtain copies of GAO documents at no 
cost is through the Internet. GAO's Web site ( www.gao.gov ) contains 
abstracts and full-text files of current reports and testimony and an 
expanding archive of older products. The Web site features a search 
engine to help you locate documents using key words and phrases. You 
can print these documents in their entirety, including charts and other 
graphics. 

Each day, GAO issues a list of newly released reports, testimony, and 
correspondence. GAO posts this list, known as "Today's Reports," on its 
Web site daily. The list contains links to the full-text document 
files. To have GAO e-mail this list to you every afternoon, go to 
www.gao.gov and select "Subscribe to e-mail alerts" under the "Order 
GAO Products" heading. 

Order by Mail or Phone: 

The first copy of each printed report is free. Additional copies are $2 
each. A check or money order should be made out to the Superintendent 
of Documents. GAO also accepts VISA and Mastercard. Orders for 100 or 
more copies mailed to a single address are discounted 25 percent. 
Orders should be sent to: 

U.S. Government Accountability Office

441 G Street NW, Room LM

Washington, D.C. 20548: 

To order by Phone: 

Voice: (202) 512-6000: 

TDD: (202) 512-2537: 

Fax: (202) 512-6061: 

To Report Fraud, Waste, and Abuse in Federal Programs: 

Contact: 

Web site: www.gao.gov/fraudnet/fraudnet.htm

E-mail: fraudnet@gao.gov

Automated answering system: (800) 424-5454 or (202) 512-7470: 

Public Affairs: 

Jeff Nelligan, managing director,

NelliganJ@gao.gov

(202) 512-4800

U.S. Government Accountability Office,

441 G Street NW, Room 7149

Washington, D.C. 20548: