The BSA provides FinCEN with broad supervisory and enforcement authority, allowing FinCEN to impose civil penalties not only against domestic financial institutions, but also against partners, directors, officers, and employees of such entities who themselves participate in misconduct. We do consider potential individual liability. We also have the authority to obtain injunctions against institutions, as well as individuals, that we believe are involved in violations of the BSA.

FinCEN’s enforcement authority extends across the broad range of industries covered by the BSA. In our BSA oversight role, we, of course, focus on compliance in all our regulated industry sectors. But nowhere is FinCEN’s role more important than in those sectors of the financial industry where it is the only Federal regulator with anti-money laundering (AML) enforcement authorities – sectors such as casinos and card clubs.

Partnerships

Since joining FinCEN a little over two years ago, I have gained a deeper understanding of the relevant perspectives and equities that exist across diverse financial sectors. FinCEN is in a novel position as a regulator. It must vigorously enforce the rules that financial institutions (such as casinos and card clubs) are required to follow to guard against money laundering, terrorist finance, and other financial crime. However, FinCEN must also work in partnership with these same financial institutions. In fact, the BSA was created to protect the integrity of the U.S. financial system by leveraging the assistance of financial institutions—like casinos—to make it more transparent and resilient to crime and security threats, and by providing information useful to law enforcement and others to combat such threats.

Public-private partnerships are increasingly important for FinCEN to succeed in its mission, so I hope to impart the value of proactive engagement with the casino industry to combat illicit financial activity. As a former prosecutor and now someone who oversees the FinCEN division that enforces the BSA, I am aware of some of the challenges faced by many of you in fulfilling your obligations under the BSA. Due to their cash intensive nature, casinos and card clubs have historically been susceptible to abuse by certain criminal actors. That type of vulnerability requires significant resources from your institutions to combat threats posed by those who seek to exploit your businesses for illicit purposes.

Now, before I get too far into this presentation, I want to recognize the obvious: casinos and card clubs, like other financial institutions, are increasingly spending time and money to comply with the BSA. And, FinCEN is committed to working with you to maximize our ability to be effective partners. That’s why I would like to have a conversation with you today to discuss FinCEN’s regulatory approach, in general, as well as how it relates specifically to casinos and card clubs. And, while I suspect you may not have all of your questions answered by the end of my presentation, I hope to at least take a few steps towards enhancing your understanding.

My goal today is to 1) provide a brief overview of a few of our recent enforcement actions; 2) dispel certain myths or misconceptions about the filing of Suspicious Activity Reports (SARs); 3) help you to appreciate the immense value of your work to FinCEN and law enforcement; and 4) give you some insight into our regulatory enforcement process by outlining some of the factors we consider in determining the amount of our civil money penalties.

In September 2015, FinCEN settled an investigation with a Las Vegas-based casino that agreed to an $8M civil money penalty. Several failures at the casino caused systemic and severe AML compliance deficiencies. In sum, the casino’s compliance program failed to incorporate policies and procedures for its “private gaming salons,” which are reserved for their wealthiest clientele who may gamble millions of dollars in a single visit, and which openly allowed patrons to gamble anonymously. The casino admitted that, despite the elevated money laundering risks present in these salons, they failed to appropriately review their customer’s activities, which allowed some of the most lucrative and riskiest financial transactions to go completely unreported. These salons were marketed through branch offices in the U.S. and abroad, particularly in Asia, but failed to adequately monitor transactions, such as large wire transfers, conducted through these offices for suspicious activity.

This was a significant action not just for the nature and scale of the violations, but also due to terms by which the case was resolved. FinCEN has been committed to ensuring that financial institutions violating the BSA rectify their deficiencies and improve their compliance. In this case, in addition to the civil money penalty, the casino agreed to a remedial framework that committed it to conduct periodic external audits, independent testing, adopt a rigorous training regime, engage in a “look-back” for suspicious transactions, and report to FinCEN on mandated improvements.

In many of FinCEN’s enforcement actions, you’ll see that the financial institution (e.g., casino, card club, bank, or MSB) failed to establish and implement policies and procedures that were appropriately risk-based and reasonably designed to assure and monitor compliance with the BSA—and that failure then snowballed and led to other BSA violations. This strikes at the heart of the theme of this conference, and one of the themes that FinCEN has been emphasizing for years: culture of compliance. The “tone at the top” regarding an institutions’s BSA compliance cascades downward and has a significant impression on staff at all levels of opertations.

Culture of compliance was also an important theme of an assessment that we issued in April 2016. Our investigation found that the casino’s willful and repeated violations stemmed, in part, from significant failures with their culture of compliance. Management repeatedly ignored their compliance officer, and failed to use all available information it collected on its customers to assist with completing its BSA filing obligations, which resulted in repeated failures to file currency transaction reports (CTRs) and SARs. Nor can compliance merely exist on paper; for instance, this institution had a SAR review committee, but it never met. And, in fact, some of its members didn’t even know that they were on the committee. Now, I recognize that there may be different views among compliance officers on whether or not to have a SAR review committee. But, if you choose to go that route, I strongly suggest ensuring members are at least notified that they are on the committee. They should not learn about it the first time from the IRS. These facts, among others, demonstrate that a culture of compliance was clearly lacking for this casino. Should you have questions about promoting a culture of compliance, I encourage you to review our public advisory on the subject that can be found on FinCEN’s website.

Another of the elements that is central to these enforcement actions is the emphasis on violations of a financial institution’s obligation to identify and report suspicious activity. Just last month, FinCEN announced a $2.8 million settlement with a California card club for willful violations of the BSA. This was only the second assessment against a card club in FinCEN’s history—but this action was notable for several other reasons. First, it highlighted the importance of KYC: knowing your customers. Of the SARs filed by this card club over a 20-month period, 80% had at least one unknown subject. Put simply, when you don’t know who is gaming at your casino or card club, complying with your regulatory obligations becomes increasingly difficult. It is imperative that policies and procedures are in place to assist with knowing your customer and meeting your reporting and recordkeeping requirements. The assessment against this card club also stressed the importance of how customers who engage in suspicious activity should be handled by a casino. It highlighted an unknown customer on whom there were 15 SARs filed, and who refused to provide identification on multiple occasions. Nevertheless, this customer was allowed to continue to gamble there without any additional due diligence or further action taken by the card club—despite an independent test that made this very recommendation. This card club put profits before compliance—but it ultimately cost them.

Further, this action also demonstrated the importance of filing quality SARs. The card club in this case would file numerous SARs on customers, but none of these SARs indicated or reflected the fact that the customers in question were prior subjects of SARs or identified patterns of suspicious activity. Including such contextual information is a statutory requirement as part of a casino or card club’s BSA program. This requirement plays a critical role in providing law enforcement with the information they need—which the BSA expressly states as one of the underlying purposes of the SAR provisions. Finally, the action we took in this case continued our practice of establishing a remedial framework to help rectify the deficiencies highlighted in our assessment

That describes three of our most recent casino or card club actions.

Myth #1: No one reads the SARs we file.

I can understand the origin of this myth. Everyone wants to know and be sure that their SAR filings are serving their purpose; assisting law enforcement investigations and stopping illicit behavior. There are certainly important reasons for some of the silence on this: SAR confidentiality, law enforcement sensitivities, intelligence concerns, among other reasons all can make it difficult to give feedback on specific filings by financial institutions. However, it bears repeating what both our former Director and my immediate predecessor have stated at conferences in the past: these files don’t go into a “black hole,” but rather are used to confront serious threats. Not every SAR results in a criminal prosecution. But, as a former prosecutor, I routinely used the same BSA data that your casinos and card clubs report to FinCEN to build my cases. We exercised the “enterprise theory” of investigation and prosecution to target entire conspiracies and organizations at all levels—including leadership. Now, in my role at FinCEN, I see how important our partner regulators and stakeholders also view this data.

Taken together, BSA data includes nearly 190 million records and there are around 55,000 added each day. The reporting contributes critical information that is routinely analyzed, resulting in the identification of suspected criminal and terrorist finance activity and the initiation of investigations. Domestically, FinCEN grants more than 10,000 agents, analysts, and investigative personnel from over 350 unique federal, state, and local agencies across the United States with direct access to the reporting. There are approximately 30,000 searches of the BSA data taking place each day.

In addition, more than 100 SAR review teams and financial crimes task forces across the country bring together prosecutors and investigators from different agencies to review BSA reporting related to their geographic area of responsibility and insatiate investigations. Based on prior analysis, it has been determined that, collectively, these teams reviewed approximately 60% of all SARs filed.

Every day, we see the BSA data being used by our law enforcement partners. The FBI reports that in 2015, BSA filings were associated with about 38.1% of its pending drug cases, 31.2% of its pending transnational organized crime cases, 27.3% of its complex financial crime cases, and 14.3% of its international terrorism cases.

For specific examples of the significant role casino SARs play in law enforcement investigations, I would invite you to look at our recent Law Enforcement Awards Ceremony. This ceremony took place in May at the Treasury Department headquarters next to the White House, and a representative of the American Gaming Association participated. One of the award winning cases involved IRS-Criminal Investigation Division using SARs and CTRs to uncover a scheme where a family’s financial advisor corruptly depleted all of the financial resources of an impaired adult for his personal gain. BSA reports from multiple financial institution—including casinos—identified the perpetrator of the scheme, and noted an increase in cash transactions in his personal accounts. Other BSA reports identified unusual cash withdrawals from the victim’s accounts. Investigators used the information provided by the reporting financial institutions to uncover the full magnitude of the scheme and to successfully prosecute the perpetrator. Ultimately, the perpetrator pled guilty to federal charges of money laundering, and wire and mail fraud, and was sentenced to several years of imprisonment and ordered to pay hundreds of thousands of dollars in restitution.

Other examples of where BSA filings contributed to a successful U.S. law enforcement case can be found on our website.

Internationally, FinCEN also facilitates the sharing of information for criminal and terrorism investigations on both a bilateral and multilateral basis through the Egmont Group of Financial Intelligence Units. The Egmont Group, currently comprised of over 150 member jurisdictions, provides an unparalleled, preexisting platform for the secure exchange of financial intelligence. Egmont members exchange information pursuant to guidelines meant to encourage the widest range of international cooperation and dissemination of financial intelligence while at the same time protecting each jurisdiction’s equities in security, confidentiality, and sovereignty. In response to some recent world events, FinCEN has been called upon to provide any relevant BSA data it has received from financial institutions.

Next, I want to take a moment to tackle a closely related myth that helps further demonstrate the value your SAR and CTR filings play.

Myth #2: Low-dollar SARs are meaningless to law enforcement.

This is a common myth across all financial sectors. And, I think this myth may stem from not fully appreciating or understanding how valuable a complete and accurately filed SAR can be in an investigation. It’s easy to think that filing a SAR on suspicious activity that has a low dollar amount, or even on an attempted transaction, may not look like it has the same appeal as one filed on a transaction for millions of dollars, but that is only part of the picture.

What does this mean for your SAR filed on a low-dollar amount transaction? Well, regardless of the amount, the reporting aids in expanding the scope of ongoing investigations by pointing to the identities of previously unknown subjects, exposing accounts and hidden financial relationships, or revealing other information such as common addresses or phone numbers that connect seemingly unrelated participants in a criminal or terrorist organization and, in some cases, even confirming the location of suspects. The reporting—even of transactions involving low dollar amounts—has served to unmask relationships between illicit actors and their financing networks, enabling law enforcement to target the underlying conduct of concern, and to disrupt their ability to operate. Your filing may just be the source of a missing piece of information that is needed in an investigation.

Law enforcement also uses the reporting to identify significant relationships, patterns, and trends. Your filings contribute to a more comprehensive picture that informs our understanding and analysis of criminal typologies. FinCEN includes an Intelligence Division that uses SARs and other reports to conduct strategic analysis to identify new trends and emerging threats in illicit finance. It assesses AML compliance across industries, identifying new illicit finance trends and developing typologies for illicit activity. The Intelligence Division then compiles much of this analysis into finished¬¬ intelligence products that are disseminated across FinCEN, the law enforcement community, and the federal government.

Myth #3: Casinos and Card Clubs are not expected to know a customer’s source of funds.

We hear this one a lot. I touched on it earlier when discussing some of FinCEN’s recent enforcement actions. And, in fact, I believe that FinCEN has been clear about the expectations in this area. In a 2014 speech to casinos and card clubs right here in Las Vegas, our former Director, Jennifer Shasky Calvery, explicitly stated that “casinos are required to be aware of a customer’s source of funds under current AML requirements.”

But this requirement goes beyond a speech given by FinCEN—the regulations themselves support this statement. Casinos and card clubs are required to develop and maintain a robust risk-based AML program. And, more specifically, the regulations impose an additional requirement that explicitly states that casinos must implement reasonably-designed procedures for “using all available information to determine… the occurrence of any transactions or patterns of transactions required to be reported as suspicious.”

However, please note that this requirement extends beyond your BSA program to your SAR filings as well. Regulations explicitly require casinos and card clubs to file SARs on “funds derived from illegal activity” and funds or assets derived from illegal activity including “ownership, nature, source, location, or control of such funds or assets.” In short, identifying and understanding a customer’s source of funds is not simply a “best practice,” it’s a regulatory expectation that casinos take all reasonable steps to do so.

FinCEN also encourages information sharing with other casinos and financial institutions pursuant to Section 314(b) of the USA PATRIOT ACT in suspected money laundering and terrorist financing cases. It is a voluntary program that can assist in helping casinos and card clubs obtain missing information to meet their regulatory obligations. Section 314(b) provides a safe harbor that offers protections from liability. When a financial institution notifies FinCEN of its intention to participate in this information sharing program, FinCEN first validates the registration. Once approved, the financial institution is provided access to the most current list of 314(b) participants, which is used by the financial institution to validate that they are sharing with a legitimate participant. Additional information about the 314(b) program can be found on the FinCEN web site.

Myth #4: SARs are subjective; based on the AML program size and risk-appetite of my institution.

This myth suggests that filing SARs are a matter of opinion, or that it’s relative to the make-up of the institution. But if that were true, then there is no way a financial institution can ever violate the statute—the defense would just be: “in my subjective opinion, that’s not SAR-worthy.” We would be left just to agree to disagree. Obviously, an effective AML system cannot work like that. Similarly, some financial institutions hold on to the myth that their AML program should be based on their risk appetite or risk tolerance. This view may be compounded by the misperception that SAR filings can be proportionally based on the size of an AML program.

These related myths are also contradicted by the rule [31 CFR 1021.320(a)(2)], that says “knows, suspects, or has a reason to suspect” illicit activity. So if you have a reason to suspect it, then you are required to file. It is that simple. Filing SARs does not depend on an AML program’s perceived risk appetite and it cannot be curtailed because of perceived AML program resource deficiencies.

This observation is not meant to spur specious or “defensive” filings; to the contrary, suspicious activity monitoring and SAR filing do require some judgment. Decisions are not always clear-cut. There are going to be times when someone says, “yeah, I think you probably should have filed a SAR, but it was not unreasonable to think otherwise.” If you act reasonably, and do your investigation, and—and this is important—think through and document your reasons for not filing a SAR, then we are not going to second-guess those reasonable decisions, even if FinCEN or an examiner may have made a different decision. However, I must emphasize financial institutions like yours and those of your clients must have appropriate risk-based AML programs in place.

FinCEN does not maintain a strict matrix for assessing penalties. Rather, FinCEN weighs a number of factors and considerations when determining CMPs. I believe that overall, this model promotes greater fairness and proportionality in our enforcement actions. At its broadest level, this approach allows FinCEN the flexibility to move beyond a “one-size fits all” approach to tailor penalties to appropriately reflect the nature of the violation. And, it works to provide parity with CMPs imposed in similar cases. As I mentioned earlier, we devote a tremendous amount of time to ensuring that our public enforcement assessments clearly explain the nature of the violations underlying our enforcement action. The rationale should, in most instances, be evident.

I would like to spend some time discussing these factors to give you a better sense of how FinCEN arrives at a CMP.

1) The Nature and Seriousness of Violations

This is fairly obvious. FinCEN will consider the nature and seriousness of the violations in assessing an appropriate penalty or other relief. This factor involves both a qualitative and a quantitative analysis. For example, what elements of a BSA program are deficient or missing? A financial institution that has significant deficiencies in multiple program pillars over an extended period of time may be in a different position than an institution that has failed to comply with a single program area for a short period of time. Importantly, FinCEN’s consideration of the nature and seriousness of violations may play a critical role in determining what, if any, corrective actions—or undertakings—may need to occur to remedy existing errors.

2) Knowledge and Intent

Of course, willfulness is an element in all BSA cases. Financial institutions or individuals that cause AML deficiencies by recklessly failing to comply with their obligations under the BSA, or turn a blind eye to compliance deficiencies will be considered to have acted willfully for the resulting violations.

In some instances, we have seen cases where an employee or officer of the institution has been complicit in illicit transactions, or the institution has had direct notice of ongoing money laundering or BSA violations but allowed it to continue. For example, prior exam findings, or receipt of a grand jury subpoena. Cases in which the IRS examiners have found repeat violations over multiple exams receive heightened scrutiny from FinCEN and tend to be subject to greater penalties. However, this does not mean that a clean exam, or one with few findings, will never result in a CMP. Your IRS examiner is an important source of information on whether your casino’s AML program is on the right track. We are also aware of disturbing instances in which our IRS examiners were denied access to critical information and key personnel during the exam process. Obviously, obstructing the examination process and failing to address repeated violations are heavily weighted factors that we consider in enforcement actions and penalty determinations. In such a case—or where the deficiencies or illegal activities are only discovered through examination or law enforcement investigation—it is likely a higher CMP will be imposed.

In contrast, a violator’s decision to self-disclose the wrongdoing in a timely manner may indicate a willingness to accept responsibility; it may also suggest a stronger likelihood of future compliance. FinCEN may consider the degree to which a financial institution or individual has cooperated with FinCEN, examiners, or law enforcement. A strong level of cooperation may be a mitigating factor in determining a penalty. Such cooperation includes, but is not limited to, the subject’s compliance with document requests, professionalism towards and cooperation with examiners, and being fully truthful and forthcoming during interviews.

3) Remedial Measures

FinCEN’s enforcement actions have begun to focus more specifically on how financial institutions can work to correct the errors identified in our investigations. Some of our enforcement actions have included “undertakings” that aim to ensure that the financial institution rectifies identified problems. For example, we may insist on corporate monitor arrangements as part of our enforcement settlements. Our enforcement undertakings may require a casino to have more stringent independent testing for a given period of time, demonstrated training improvements, or updates to their written policies and procedures. Additionally, if specific concerns arise over transactions, FinCEN may require a SAR look-back as part of the consent order as well. These undertakings serve as a way to remedy any potential violations and ensure that future issues do not arise. Accordingly, FinCEN may consider a lower penalty relating to situations in which the institution takes effective, immediate remedial action after a violation is revealed. However, remedial measures alone may not warrant a reduced penalty. For example, if it is determined that an entity had disregarded its compliance program, caused significant violations, and then seeks to offset its penalty payments with compliance expenditures it should have made at the outset.

4) Financial Condition of the Financial Institution or Individual

FinCEN may consider a financial institution’s size and financial condition, including its assets, income, and projected revenue when determining an appropriate penalty that will be sufficient to ensure future compliance without jeopardizing the solvency of the financial institution. Similarly, in cases against individuals, FinCEN may consider the person’s assets and income when considering the penalty amount. This is a factor that would not be reflected in our public assessments, as we keep such information confidential.

5) Payments and Penalties Related to Other Enforcement Actions

Other civil, regulatory, or criminal agencies (state or federal) may sometimes impose a fine, penalty, or other financial assessment against a subject for other violations stemming from conduct that is similar or related to the conduct that gave rise to the BSA violations. Penalties imposed by other agencies should always be considered in analyzing a proposed civil money penalty by FinCEN. Significantly, however, such penalties may—but will not necessarily—affect the size of the penalty that FinCEN decides to impose. And, generally, FinCEN will not agree to have its CMP be completely concurrent with that of another federal or state agency.

6) Other Factors

The factors and considerations are non-exhaustive, which is why I believe FinCEN’s approach to determine a CMP works better than a matrix. There may be other circumstances not described above, which might call for a larger or smaller penalty. Also, it would be unusual for all factors to apply in any given case. Similarly, several factors may overlap, or there may be instances where one factor is more significant than others and should receive greater weight. Regardless of the situation, I can assure you this: there is a process in place to provide your institution an opportunity to be heard. When you receive notice of a FinCEN enforcement action, you and your institution will be invited to present the Enforcement Division with any information you feel is relevant to the determination of a CMP. We will fully consider and evaluate the information, and be prepared to discuss our positions. Open dialogue is mutually beneficial. We want our Assessments to be factually accurate based on the evidence, and the CMP to be fair and appropriate. However, when we propose a certain CMP amount, it is usually pretty firm—all factors have been fully considered and vetted. It is not like buying a used car—we do not start high in anticipation that you will come in low with a counteroffer. There is no “walk to the middle.”

Now that I have gone through the factors that inform a CMP, I want to emphasize the importance of building and sustaining a culture of compliance in your respective institutions. From an enforcement perspective, most of the CMP factors lead back to one single point of failure—a failed compliance culture. How this failure reveals itself in an investigation may differ from institution to institution, but the core breakdown is the same. This suggests to me that each institution should engage in some honest self-examination and ask itself whether its culture of compliance is merely lip service or whether it is real. We are seeing some meaningful improvements, but more work still needs to be done. I believe that it can be done but it will take real, sustained commitment.

FinCEN is a critical partner in the fight against money laundering and terrorist financing. Our talented and dedicated team is committed to that mission. We have an incredible opportunity to serve the American public and to contribute to the safety of this country. FinCEN will meet the challenges ahead working together with you, law enforcement, and our regulatory and foreign partners. We see casinos and card clubs as important partners in our efforts and I hope that you see us that way as well.

I look forward to answering your questions about FinCEN and the work of our Enforcement Division. But, first, I would like to remind everyone that our website, fincen.gov, has a wealth of information and resources that can help you learn more about FinCEN, with links to enforcement actions, guidance, answers to frequently asked questions and more. Similarly, I encourage you to reach out to the FinCEN Resource Center at 1-800-767-2825 or [email protected] if you ever have questions about your regulatory requirements. I would like to conclude my presentation where I began by thanking each and every one of you for doing your part to protect the financial system from abuse by illicit actors. We cannot do our work without the help from industry, so we value your sustained commitment. Thank you.