Banking and Finance Law Daily Wrap Up, BANK SECRECY ACT—Acting FinCEN director emphasizes importance of effective compliance programs, (Mar 28, 2022)

By Robert B. Barnett Jr., J.D.

FinCEN’s acting director calls for continued cooperation and information-sharing between FinCEN and the financial sector in their efforts to stem money laundering.

The Financial Crimes Enforcement Network (FinCEN) and financial institutions must continue their dialog about how best to establish effective money laundering prevention programs, especially given the threats today that range from COVID-19 scams to ransomware attacks to Russian oligarch money laundering, according to remarks made on March 25, 2022, by Himamauli Das, acting FinCEN director, at the Program on Corporate Compliance and Enforcement at NYU Law. Das acknowledged that FinCEN needs to give financial institutions greater room to innovate, if compliance programs are going to be made more effective. FinCEN is also engaged in broader efforts to work with the financial community to make compliance programs more about catching the bad guys than about checking boxes to satisfy federal requirements.

“I do believe that whether you are on the corporate side or approaching these issues as a regulator that we are all working towards to same goals,” Das said. “I look forward to an ongoing partnership…as we move forward together.”

FinCEN administers the Bank Secrecy Act, the U.S.’s primary means of combatting money laundering and terrorist financing. In 2021, Congress enacted the Anti-Money Laundering Act, which amended the Bank Secrecy Act to give FinCEN greater control in regulating anti-money laundering/countering the financing of terrorism (AML/CFT) compliance programs.

Since then, a tension has existed between the obligations placed on financial institution AML/CFT compliance programs and FinCEN’s need to stop money laundering. In December 2021, FinCEN sought public feedback on how FinCEN could modernize and update the AML/CFT framework. Das said that the responses that FinCEN received focused on (1) enhancing the existing public-private information-sharing mechanisms, (2) fostering innovative approaches to BSA compliance, and (3) modifying recordkeeping and reporting obligations.

One concern among commenters was that the current incentives encouraged “check the box” compliance exercises that are resource-intensive. Financial institutions would prefer instead to focus resources based on their individual risk assessments.

Das argued that new technologies offer hope for meeting that goal and for improved implementation of AML/CFT programs. The two main examples he cited were artificial intelligence and machine learning. He also mentioned that FinCEN’s two-year-old Innovation Hours is used to allow FinCEN staff and financial institutions to exchange information on the latest innovative solutions.

“We know that innovation will only happen if the private sector feels it has the latitude to innovate,” Das said. “At FinCEN, we’re committed to ensuring that the space to innovate is as large and as safe as it has to be.”

To that end, Das revealed that FinCEN is exploring the creation of what he called “regulatory sandboxes or structured pilot programs,” which would allow financial institutions to test innovative approaches without significant regulatory oversight. These programs, Das noted, would not necessarily have to involve technology. He cited, for example, a pilot program to allow financial institutions to share Suspicious Activity Reports (SARs) with their foreign affiliates. He then expressed hope that technology-related pilot programs might use AI or machine learning to monitor transactions, conduct customer risk-rating, evaluate institutional risk assessment, employ digital identity tools, and automate SAR filings. Although the sandboxes do not formerly exist yet, Das acknowledged, “we’re going to move as quickly as possible” on it.

Moving on to enforcement, Das lamented the existence of financial institutions with “paper programs,” which look good on paper but which do not provide any meaningful reporting of suspicious activities. FinCEN, he said, will continue to pursue those who fail to satisfy the requirements for protecting against money laundering. This month, for example, FinCEN imposed a $140 million fine against a financial institution that failed to file at least 3,783 SARs over a five-year period. Last August, FinCEN assessed a $100 million fine against BitMEX, a virtual currency exchange, for operating without a compliant AML program and for facilitating more than $200 million in darknet market transactions.

Das also cited ongoing implementation of FinCEN’s Whistleblower Program, which is designed to pay awards to eligible individuals who voluntarily provide FinCEN or DOJ with information about BSA violations. The information must lead to a successful enforcement action, and the whistleblower’s identity will remain confidential (although it can be shared with law enforcement). Retaliation or discrimination by the employer is prohibited.

In recent years, FinCEN’s enforcement focus has evolved, placing an even greater emphasis on effective compliance programs, Das said. In 2020, FinCEN focused on COVID-19-related financial threats, which included medical fraud, imposter scams, cyber-enabled crime, and unemployment insurance system fraud. In 2021, FinCEN pivoted to ransomware, which affected schools, hospitals, energy grid and oil suppliers, and companies of varying sizes. And more recently, FinCEN has been forced to focus on the situation in Ukraine, which has meant looking at tracking, freezing, and seizing oligarch assets and their efforts to launder their corrupt proceeds.

RegulatoryActivity: BankSecrecyAct Covid19 CrimesOffenses EnforcementActions FinTech IdentityTheft Privacy