800 Overseas Investors Thank You

Alternate title: Keep those SAR Filings Coming! Terrorist financing down 36%!

Please read FinCEN's 15th Issue of The SAR Activity Review – Trends, Tips & Issues (http://www.fincen.gov/news_room/rp/files/sar_tti_15.pdf). It's a blast.

Seriously, you AML officers out there should read it. It gives you a reason to value all the time you spend worrying about whether or not to file a SAR. You and all your AML brethren are making a difference! The SAR report outlines some cases cracked thanks to your efforts (for instance, a foreign national was busted for leading a scheme involving hedge funds and advisory firms that resulted in $21 million in losses for over 800 foreign investors: that makes you feel good about doing all that AML work, right?). ....(right??)

Here's what examiners want to see from you:

1. Complete written procedures.
2. Implementation of written procedures.
3. Monitoring for susp. activity.
4. Reporting of susp. activity.

Here's what examiners are seeing from you:

1. Failure to document reviews of suspicious activity.
2. Incomplete SAR forms.
3. Crappy SAR's: completed inaccurately; inadequate narrative section (why is it suspicious?); includes supporting docs even though it's not supposed to; filed late.
4. Inadequate due diligence on potentially susp. activity--investigate to determine if you should file!

Recent transactions in the sale of unregistered securities or representing fraud/market manipulation are not being reported as required (such as those involving penny stocks). Read the publication for an example that may be familiar to you.

The report includes sound advice on how to maintain a current and effective SAR program at your firm, for instance, by addressing:

• current events and emerging trends: thanks to our little financial crisis, automated surveillance based on certain profiles and parameters don't work like they should (stock price/volume swings--all that is now normal; and customers with 'top reputations' can't be trusted anymore--those darned institutional short sellers!).
• cyber crime: one-two punch, here--electronic intrusion into online brokerage accounts combined with traditional market manipulation (market-savvy hackers, our worst nightmare).
• trade-based money laundering: no, not that kind of trade, this kind: international trade of goods and services. These Marco-Polo types under- or over-invoice or route invoices through various financial institutions (not just banks), leading to multiple payments for the same goods. Sophistication is growing in the illicit trade finance arena.
• reported suspicious activity: evaluate your firm's reporting history; analyze trends; identify similar schemes, common locales or names, or possible red flags; follow enforcement actions.
• identification and analysis of transaction types: don't just think of securities transactions that involve money: there are far more things to worry about! account transfers, free deliveries and receipts, external withdrawal by transfers and internal journal entry transfers. Your program should be able to detect activity and gaps that occur across the full spectrum of operations--all transactions "by, at or through" your broker dealer.
• identification of detection points: all departments and personnel must be adequately incorporated into escalation workflows. Matters such as ID theft, insiders trading, 314a matches, law enforcement subpoenas, customer tax issues, customer due diligence, credit reviews, back office operations, interaction with other financial institutions, and employee financial crime and prohibited trading... they all should feed into the SAR consideration stream.

(Those aren't my big words, by the way--not all of them. That summary is derived from the aforementioned SAR report.)

If you work for a huge firm with well-staffed internal legal, audit and compliance departments, this improvement to your AML/SAR program should seem reasonable. If you are a micro-firm, with one guy who pretty much wears every supervisory hat, well, my advice is to dedicate your summer in an attempt to achieve this level of AML musculature. Good luck. Take steroids.

You know what I think? That small firms should have an AML clearing house that performs their AML responsibilities for them, collectively. I mean, c'mon, it's crazy to imagine small firms being able to implement the goals expressed above. The whole cybercrime topic makes me scream louder than Danny Gokey: it's hard enough to get Outlook to work correctly, let alone defeat intergalactic cyberfiends. Wouldn't it be cool if the several thousand tiny FINRA BD's could outsource their AML stuff to one place? That place would be super-good at their job: they'd use unemployed MBA's and IT jocks to mastermind the most sophisticated and effective AML tools available on our planet, and they'd give the small firms the comfort of knowing that none of their clients was a foreign national perpetrating fraud on a global basis. They'd manage CIP, OFAC, 314a lists, 314b filings, account monitoring, suspicious activity investigations and reporting--and just think! AML audits would be a thing of the past! Instead, SEC or FINRA could do one big audit of the clearing house (let's call it AML, Inc. (tm) for now) to ensure compliance for the thousands of firms. The tiny firms could go back to doing what they do: helping their clients make money in the markets. Ahhhhh. (Un cafe, s'il vous plait...I think I was just dreaming.)

Anyway, 53,022 SAR's filed by the securities and futures industry through 2008. And exactly 6 cases solved. (Okay, I made that second number up.) Keep at it, folks! Some day a SAR you file will be profiled in a FinCEN report, and you'll be able to share your pride with your grandkids.

Oh, wait, no, you won't.

Sharing SAR's: Some Proposed Changes

FinCEN has announced proposed changes to BSA's regulations on SAR sharing and confidentiality rules. Since they're now just proposals subject to comment, I won't detail every change, but here's my summary:

The guidance on sharing with parent entities will remain intact--it will be built into the regulation so as to be all the more official. Here is the original guidance from January 2006: http://www.fincen.gov/statutes_regs/guidance/html/sarsharingguidance01202006.html You remember that it allowed BD's to share a SAR or the existence of a SAR with a holding or parent company, but not with affiliates. The guidance required that a confidentiality agreement be place with the holding co/parent entity.

BD's will now be allowed to share a SAR or the existence of a SAR with affiliate entities--that is, only if those entities are subject to SAR rules (i.e., banks, BD's, mutual funds, thrifts, insurance co's, casinos, money service business--not IA's or unregistered investment companies). BD's can only share this stuff if they filed the SAR and the affiliates can't go on to share the information with others (it's not like Facebook: 'friends of friends' don't get to see stuff...). Like with parent entities, confidentiality agreements should be in place when sharing with affiliates.

Other changes clarify some things that you might have otherwise assumed, like: the sharing prohibition applies to all employees, directors, agents, etc. (not just the firm); BD's can share SAR's or the existence of SAR's with their examining authorities; and BD's and their employees can share the information, facts, and documents underlying a SAR a) with financial institutions for the sake of filing a joint SAR and b) in connection with certain employment references or termination notices.

I would think FINRA would provide an announcement when these changes go into effect, so look for a Notice in the coming months. For the proposals and guidance, go to: http://www.fincen.gov/statutes_regs/frn/pdf/frnSAR_Confidentiality.pdf and http://www.fincen.gov/statutes_regs/frn/pdf/frnSF_SAR_Sharing.pdf .

FinCEN's Better Website

For those of you compliance professionals who keep up with FinCEN announcements, this is not news. For you others--too busy to click every link provided in every notification--check out FinCEN's website. http://www.fincen.gov/ They redesigned it a couple of months ago and I have to say, it's a great improvement. Whereas before, a user had to have a good sense of BSA and other regulation in order to navigate the site, now users are treated more sympathetically. The site presents information grouped in several different ways, such as: industry type (like 'securities & futures' for us), statutes and regulations, forms, and most requested. It's now very easy to find the form you have to file and equally easy to quickly reference all recent published guidance. While I may find it interesting to read about regulations affecting casinos, now I don't have to wade through it on my way to information I really need. Thanks, FinCEN!

(I remember years back putting a call into FinCEN and being extrememly underwhelmed by their adminstrative infrastructure. I have to imagine they've been well funded lately to the point of stepping up their game--hiring good webmasters, for instance. I think this is good. I mean, entities like broker-dealers and the 100's of thousands of people working for them are burdened daily by AML rules: it's only fair that they should expect to rely on a functional support system to enable their efforts.)

Also check out the "international" tab on FinCEN's site. This is nice, in that it provides links to other organizatoins such as OFAC and FATF. You won't find the same ease of locating informaton on these other sites--for instance, to locate the current NCCT list on FATF's site, you have to click Key Topics>Meeting FATF Standards>NCCT Initiative in order to get to a page that has a link (on the right side) to the NCCT list. Which is empty, by the way. The list hasn't had any names since October 2006.

By the way, you know that your AML program requires updating for rule changes and internal, firm policy/personnel changes. The good news is, there haven't been any substantive rule/regulation changes lately. If you haven't looked at your written program recently, take a look. Be sure it includes lots of references to 'risk-based' compliance and also Section 311 of the Patriot Act (on specially-designated nationals). Also make sure you have procedures for maintaining all supporting documentation for SAR filings and for responding to law enforcement requests to keep accounts open. These subjects have shown up recently in FINRA exam results.

Now get back to your more enjoyable reading... on a chaise lounge, in the sun, with some Beth Orton or Matt Costa playing in the background... ahhh, it's August.

Understanding Eliot: Thank Goodness for Rule 3011!

...otherwise, you may not have understood how Eliot Spitzer got caught.

Hmmm, what am I talking about? I'll explain. FINRA (NASD) Rule 3011 is the rule that broker-dealers follow when ensuring anti-money laundering compliance. You BD's set up written programs, supervisory structures, recordkeeping procedures, risk assessment strategies, reporting requirements and red flag escalation practices so that you meet Rule 3011 and the various requirements under even more various rules, regulations, acts and official guidance (such as the Bank Secrecy Act, the Money Laundering Control Act, The Travel Rule and of course, the USA Patriot Act, to name a few). By virtue of this compliance, you're familiar with terms like 'structuring,' 'politically-exposed persons,' and ' suspicious activity reports.' These terms have now migrated all the way from the Federal Register to NY tabloid publications--who'd a thought? But only readers like you, who have been subjected to the recent, rather annoyingly, non-stop attention to the AML subject, can really visualize how Eliot's bust materialized. The going story: he structured payments by wiring funds under the $10,000 reporting threshold; the bank didn't have complete information on the recipient of the third party wires; and Eliot was subjected to heightened scrutiny as a politically-exposed person. Voila. Sounds familiar and justified, non? Not in my understanding...

First of all, structuring to avoid reporting: the BSA's requirement to file reports on transactions exceeding $10,000 refers to currency, not wire transfers. A Currency Transaction Report would not be required for wires over $10,000. It's the Travel Rule that dictates records requirements for wires over $3,000...which brings me to the second point: the bank investigating the recipient of his wire transfers. The Travel Rule requires only that the initiating institution identify the recipient of the wire if it's a third party wire (not going to the sender's other account): the rule doesn't require due diligence on the recipient. If, instead, the institution were receiving a wire for a non-customer (for whom the institution had never done its CIP work), then yes, the institution would have to perform CIP on the recipient to verify his/its identity. This wasn't the case. So Eliot's bank (from what I've read) looked deeper into the receiving party which is what led, ultimately, to the suspicion. Lastly, Eliot's bank applied a higher level of scrutiny than normal, due to his status as a politically-exposed person. The problem here: Section 312 of the Patriot Act requires enhanced scrutiny of senior foreign political figures. The rule says nothing about US political figures. Eliot's bank obviously had its own heightened scrutiny procedures, and they're allowed to do so--all financial institutions may adopt and implement custom, risk-based AML procedures.

So, the escalation of poor Eliot's financial transactions to the level of suspicious activity reporting was based--in part, and according only to my reading of media reports--on bank employees' mistaken or overzealous compliance with AML rules. He didn't avoid CTA reporting under BSA rules; his wire recipients did not require CIP due diligence under the Travel Rule or Section 326 of the Patriot Act; and he as Governor did not require heightened scrutiny under Section 312 of the Patriot Act. And he still got busted.

The questions this fly-smashed-in-the-typewriter trail of events raises are these: Is Spitzer's case indicative of the purpose of federal AML rules and regulations? Does the public think it is acceptable to rely on these anti-fraud/theft/money laundering mechanisms to interfere with someone's private (if pathetic) life? Should banks and broker-dealers really take to heart the current "we're all in law enforcement now" ethic? Is it too much to ask of you, the broker-dealer, to devote time and resources to this type of non-financial crime investigation? Lastly, and importantly for your AML staff: do you understand your true obligations under Rule 3011, the BSA, the Patriot Act and other guiding FinCEN/OFAC rules? If not, my advice is to brush up.

Now if only the federal government had enacted a one-word violation called "hypocrisy." Eliot is clearly guilty of that.

No CIP for clearing firms...but not vice versa

I remember the moment in Miss Anita's 5th grade class when she taught us the definition of vice versa...she used the example, "Jimmy has a crush on Sharon and vice versa." The color I turned!...a lovely shade of bright red. Well here's an announcement that will tickle clearing firms pink.

Fresh off the press: FinCEN has released a no-action position relating to CIP requirements of clearing firms. In summary, if the clearing firm has a written agreement with its introducing firm, and that agreement exclusively allocates to the introducing firm the functions of opening and approving customer accounts and directly receiving and accepting orders from introduced customers, then ONLY the introducing firm must comply with the CIP requirements for BD's. FinCEN has stated in this release that it will not take action against clearing firms in this situation. Of course, the written agreement must be clear in its allocation of duties.

Small introducing firms oftentimes express frustration with CIP rules and state their belief that, since the clearing firm has to ultimately accept the account and since it is the clearing firm that maintains the customer's securities accounts, why does it have to meet CIP rules--why not the clearing firm instead? I think it's interesting that this FinCEN release does not include a vice versa clause...that is, it doesn't offer no-action to introducing firms if the clearing agreement allocates exclusive final account approval to the clearing firm, instead. This clearly codifies the practical understanding of CIP rules: it's the front line that matters. The process of opening accounts and taking orders for transactions is an important first step to AML awareness and compliance. While the clearing firm has credit risk and handles the funds, it's the Rep-Customer relationship that counts when detecting and deterring illegal activities. I'm not saying clearing firms don't have AML obligations in this instance--they do, any many of them, as reiterated in FinCEN's release--but CIP, the cornerstone of a broker-dealer's AML compliance practices, is squarely in the hands of the introducing firms.

I have to be thorough by noting one point: an introducing firm may, indeed, be relieved of some or all of its CIP duties, but only if this arrangement is reasonable, in writing and renewed annually, and the CIP duties are performed by a federally-regulated entity subject to AML regulations. So the clearing firm can, in the end, perform CIP for its introducing firms, but that arrangement must be subject to an iron-clad agreement and is not something that can be inferred based on loose allocation language in a clearing agreement. Most clearing firms do not include CIP agreements in their clearing agreements. Other note: if your firm wants to rely on an SEC-registered IA firm to do CIP for you, it can under a 2004 SEC no-action letter that has been extended to be effective through January 12, 2010. But again, reliance is subject to strict conditions. See: SEC's no-action relief January 2008 .

Here's the link to FinCEN's no-action release: FinCEN's CIP no-action position .

And for the record, Miss Anita was right.

Accentuate the Negative; Or, How to Record Nothing

There's a wonderful song about accentuating the positive and eliminating the negative. It seems in FINRA's case, they want you members to accentuate the negative--that is, to keeps records of what DIDN'T happen.

Specifically, certain examiners have requested that firms that have not filed any suspicious activity reports and have had no suspicions arise (during a certain period of time), put a memo in the AML files to the effect of: "during the period x to y, we did not note any suspicious activity.”

So, while you all have a detailed AML program that explains how you detect illegal activities, how you report them in-house, how you vet them, how you report them to officials and how you document the whole process, the examiners want to see more. They want a record of something that evidences nothing. Or is it, they want a record of nothing that evidences something? Hmmm.

Your firm may want to start documenting such nothingness, if applicable. That way, in your next exam, you won't be surprised by this curious request. Oh, and let's remember not to blame FINRA examiners. I'm serious--they are bending to the will of SEC and federal authorities when enforcing these rules. I bet they think it's curious, too.

Post Primary Thoughts on AML

Hello from NH, where today, at last, we are free of pollsters, campaigners and political junk mail! Quick note: Chris Matthews said we lied to pollsters. We did not. The difference in the numbers was the weather. But we'll let him figure that out...

http://www.finra.org/web/groups/educ_progs/documents/education_programs/p037702.pdf
This is a link to Mary Shapiro's recent webcast text on what to expect in an exam, re: AML compliance. I wanted to comment on two things: independent annual exams and CIP for friends and relatives.

The Independent Exam Quandary
Independent exams must happen every year for almost all firms. If your BD is nothing but a prop desk, it can be every two years. For firms that have anything to do with customers and securities transactions (and yes, you private placement firms out there now know that your are, indeed, conducting securities business), audits of AML programs must take place once/calendar year. FINRA, back in early 2006, clarified this and also what it meant to be independent; they also offered exceptions to the independence standard. That's the background.

What I'd like to comment on is that, if a firm uses an outside party to do the audit, and that same party provided template language for the firm's AML program--but does not otherwise implement or control the firm's AML compliance process in any way--that outside party in my opinion is independent for the purposes of meeting FINRA's expectations. My belief is that, if you look at their exceptions for in-house auditors who are not independent, and imagine a scenario whereby a firm relies on those exceptions (for instance, trains some staff person to do AML testing and has that person report the results to someone other than the AML compliance officer), in most cases, the testing will not be sophisticated enough or adequate to detect important deficiencies. In that scenario, the tester will apply his/her limited knowledge of applicable regulation to broadly review evidence of compliance. This will not result in effective testing and the firm, if failing to comply with the more esoteric or topical requirements, will continue to do so, given the lack of focused and informed reviews.

The other scenario, where an outside consultant who has provided template language--either originally or on an on-going, update basis--and who is engaged daily in the business of compliance; that is, who spends his or her time researching new rules, interpretations and guidance put out by securities or federal regulators, and who visits clients once a year to ensure, in a lengthy and thorough examination process, all aspects of AML compliance, is bound to be more effective than the in-house model. That was a long sentence--my apologies. Remember too that many of these firms who may rely on the in-house model are those who downloaded FINRA's AML template and just barely customized it. The outside consultant procedures+audit model has to be preferable to the FINRA template+in-house audit model, in my opinion. Better to have expertise than confusion.

If your firm runs into an examiner who expresses displeasure with your outside AML auditor because that same auditor provided update language to your written program, you may want to use my argument to defend your choice. Or rely on the the Rule itself, which requires that, in summary, the tester should neither be one who performs the AML functions being tested, nor any designated AML compliance person or a person who reports to either one. You will be meeting this restriction and should be confident about doing so.

CIP for Friends and Relatives
Oh, my second point. In the recent guidance, Ms. Shapiro reiterates what was included in last year's online workshop--that you have to ID your own mother-in-law. Well, here's the exact quote: "Be sure to note that just because a customer is a registered representative’s personal acquaintance, this does not satisfy CIP verification requirements. But, the risk-based approach is flexible enough to make identity verification for personal acquaintances as unobtrusive as possible. For example, if the customer is a relative or a close personal friend of the registered
representative, the firm may not require more than the minimum verification required by the rules, such as checking her driver’s license. However, the verification that is undertaken must still be documented."

You see, the requirement to verify the identities of customers is so bound up in legalese and paranoid FederalSpeak, that broker-dealers cannot be trusted to vouch for the identities of their own family members. Crazy, huh? I'm sure the folks at FINRA hate enforcing this and also find it ludicrous, but as they always say, it's not their Rules, it's the government's. With that sad excuse in mind, don't forget to check your brother's driver's license next time he opens an account--just to be sure he really is your brother.