Banking and Finance Law Daily Wrap Up, BANK SECRECY ACT—OIG finds flaws in FinCEN’s management of BSA data access, (Feb 20, 2026)

By Nora Macaluso

An audit found FinCEN fell short in areas including documentation and management of bulk data access.

The Financial Crimes Enforcement Network (FinCEN) “did not manage aspects of BSA data access in compliance with applicable laws, regulations, directives, SOPs [standard operating procedures], or government-wide standards,” the Treasury’s Office of Inspector General said in a report.

The report, the third in a series documenting the results of an OIG audit of FinCEN’s management of Bank Secrecy Act (BSA) data, contains 14 recommendations for FinCEN to address those shortcomings. The OIG said FinCEN management concurred with the recommendations and provided corrective actions the agency has taken or plans to take. Those measures “generally met the intent of our recommendations,” the OIG said.

Findings include that FinCEN failed to document its assessments or conduct reevaluations of the need for bulk data access; did not update its BSA System of Records Notice (SORN), a document explaining how a federal agency collects, maintains, uses, and disseminates records about individuals; and failed to execute or update memorandums of understanding (MOUs) with some agencies and accurately track and maintain data MOUs.

FinCEN signs MOUs with agencies for which it has approved requests for access to the BSA database, and an agency coordinator authorizes agency employees to access the database through the FinCEN Portal, a web-based application for offsite users. Agencies are sometimes provided with bulk data; as of 2019, FinCEN had shared this access with 11 agencies, which then granted access to about 35,000 external users, the report said.

The report said FinCEN did not document its assessments or conduct reevaluations of the need for bulk data access and did not properly update its SORN or ensure compliance with applicable SOPs or government-wide standards.

“We non-statistically tested 62 of 469 external agencies with BSA data access and found that FinCEN did not properly maintain and execute all its MOUs,” the report said. FinCEN also provided platform program access to users from 11 agencies without executing MOUs, and did not update its MOUs or accurately track agencies that had them, the OIG said.

The OIG report recommended, among other things, that the FinCEN director conduct and document an assessment of FinCEN’s decision to offer bulk data access, including assessing the potential risks and how those risks are being mitigated; update its bulk data access SOP to specify how to conduct and document reviews of requests and periodic reevaluations of agencies’ need for bulk data access, including which personnel are responsible for conducting these reviews and approving access; and review and update procedures and documents.

FinCEN management said expects to complete work addressing most of the recommendations this year.

The 42-page report includes details about the audit and its findings, along with FinCEN’s management response.

RegulatoryActivity: BankSecrecyAct OversightInvestigations