This is the accessible text file for GAO report number GAO-08-355 
entitled 'Bank Secrecy Act: Increased Use of Exemption Provisions Could 
Reduce Currency Transaction Reporting While Maintaining Usefulness to 
Law Enforcement Efforts' which was released on February 21, 2008. 

This text file was formatted by the U.S. Government Accountability 
Office (GAO) to be accessible to users with visual impairments, as part 
of a longer term project to improve GAO products' accessibility. Every 
attempt has been made to maintain the structural and data integrity of 
the original printed product. Accessibility features, such as text 
descriptions of tables, consecutively numbered footnotes placed at the 
end of the file, and the text of agency comment letters, are provided 
but may not exactly duplicate the presentation or format of the printed 
version. The portable document format (PDF) file is an exact electronic 
replica of the printed version. We welcome your feedback. Please E-mail 
your comments regarding the contents or accessibility features of this 
document to Webmaster@gao.gov. 

This is a work of the U.S. government and is not subject to copyright 
protection in the United States. It may be reproduced and distributed 
in its entirety without further permission from GAO. Because this work 
may contain copyrighted images or other material, permission from the 
copyright holder may be necessary if you wish to reproduce this 
material separately. 

Report to Congressional Committees: 

February 2008: 

Bank Secrecy Act: 

Increased Use of Exemption Provisions Could Reduce Currency Transaction 
Reporting While Maintaining Usefulness to Law Enforcement Efforts: 

GAO-08-355: 

GAO Highlights: 

Highlights of GAO-08-355, a report to congressional committees. 

Why GAO Did This Study: 

To aid law enforcement efforts against financial crimes, under the Bank 
Secrecy Act (BSA) depository institutions must file the Treasury 
Department’s Financial Crimes Enforcement Network’s (FinCEN) currency 
transaction report (CTR) form on their customers’ cash transactions of 
more than $10,000. While FinCEN’s regulations allow institutions to 
exempt certain customers, over 15 million CTRs were filed in 2006. 
Public Law 109-351 directed GAO to report on (1) the usefulness of CTRs 
to law enforcement; (2) depository institutions’ costs of meeting CTR 
requirements; and (3) ways to encourage use of exemptions to avoid 
unnecessary CTRs. Among other things, GAO obtained data from FinCEN on 
CTRs and exemptions from 2004 to 2006, surveyed 115 state and local law 
enforcement agencies and 680 depository institutions, held structured 
interviews with officials of federal agencies and depository 
institutions, and reviewed relevant laws and regulations. 

What GAO Found: 

According to federal, state, and local law enforcement officials, CTRs 
provide unique and reliable information essential to a variety of 
efforts, and recent advances in technology have enhanced law 
enforcement agencies’ ability to use CTR data by integrating it with 
other information. In addition to supporting specific investigations, 
CTR requirements aid law enforcement by forcing criminals attempting to 
avoid reportable transactions to act in ways that increase chances of 
detection through other methods. Linking law enforcement’s use of CTRs 
to specific outcomes is difficult, however, because agencies do not 
track their use of CTRs, which are typically one of many information 
sources used in investigations. FinCEN does not routinely publish 
summary information on law enforcement uses of CTR data—as it does for 
other data required under the BSA—that could help depository 
institutions understand the value of CTRs. 

While fewer than 30 of the largest U.S. depository institutions 
accounted for over half of new CTRs filed during the period GAO 
examined, all of the nation’s approximately 17,000 institutions incur 
some costs to meet CTR requirements. Institutions must have processes 
and staff in place to identify when and if a CTR is required, as well 
as the ability to aggregate same-day cash transactions by or on behalf 
of the same person; file CTRs correctly; and, if desired, establish and 
maintain exemptions for certain customers. Institutions GAO contacted 
were generally unable to quantify these costs, in large part because 
they use the same processes and staff for other purposes. While 
automation has made CTR tasks less difficult, almost all institutions 
reported that they have not completely automated all steps, such as 
reviews of CTRs by institution officials. 

GAO’s work identified a number of factors that deter use of exemptions, 
as well as opportunities for increasing their use, thereby reducing the 
number of CTRs that are likely of little or no value to law enforcement 
efforts. As reasons for not exempting eligible customers, institutions 
cited uncertainty about the documentation required to demonstrate that 
some customers are in fact eligible, along with concern that federal 
banking regulators (who examine institutions for compliance with CTR 
requirements) would find fault. Institutions also cited as deterrents 
the need to meet FinCEN’s regulatory requirements to (1) file an 
exemption form, and annually review the supporting data, particularly 
for hundreds of customers that are specifically exempted by statute; 
and (2) biennially renew eligibility for some customers—a process that 
as a practical matter duplicates the required annual reviews for those 
customers. Institution officials indicated that additional guidance 
from FinCEN, as well as Web-based material to help train their staff in 
making exemption determinations, could increase the use of exemptions. 
Removing regulatory deterrents and providing additional guidance and 
Web-based material could help depository institutions avoid filing 
unnecessary CTRs without harming law enforcement efforts. 

What GAO Recommends: 

GAO recommends that the Secretary of the Treasury direct FinCEN to 
consider routinely publishing summary information on CTR use, revise 
certain regulations that deter exemptions, and provide additional 
guidance and Web-based material to help depository institutions 
interpret exemption requirements. FinCEN concurred with our regulatory 
and guidance recommendations and stated that it will consider options 
for providing feedback on CTR use. 

To view the full product, including the scope and methodology, click on 
[hyperlink, http://www.GAO-08-355]. To view the results of GAO's 
surveys, click on GAO-08-385SP. For more information, contact David G. 
Wood at (202) 512-6878 or woodd@gao.gov. 

[End of section] 

Contents: 

Letter: 

Results in Brief: 

Background: 

CTR Requirements Are Useful to Law Enforcement Efforts in a Variety of 
Ways, but Measuring Their Impact Is Difficult: 

Financial Institutions Incur Some Costs to Meet Requirements Regardless 
of the Number of CTRs They File: 

Uncertainty about Required Documentation and Some Regulatory 
Requirements May Unnecessarily Discourage Use of Exemptions: 

Conclusions: 

Recommendations for Executive Action: 

Agency Comments and Our Evaluation: 

Appendixes: 

Appendix I: Objectives, Scope, and Methodology: 

Appendix II: Law Enforcement Agencies' Use of CTR Data: 

Appendix III: Information on CTRs Filed from 2004 to 2006 : 

Appendix IV: Additional Information on Depository Institutions' Use of 
Exemptions: 

Appendix V: Comments from the Financial Crimes Enforcement Network: 

Appendix VI: Comments from Federal Banking Regulators: 

Appendix VII: GAO Contact and Staff Acknowledgments: 

Related GAO Products: 

99: 

Tables Tables: 

Table 1: Statutory and Regulatory Provisions That Determine Which 
Customers May Be Exempted: 

Table 2: CTR Views by Agencies, Fiscal Years 2004 through 2006: 

Table 3: Exemption Violations Cited in BSA Examinations by FDIC, 
Federal Reserve, and OCC, 2005 and 2006: 

Table 4: Federal Agencies We Interviewed and Number of CTR Views, 
Fiscal Year 2006: 

Table 5: Number of CTRs Filed by Asset Size Category of Depository 
Institutions in 2006: 

Table 6: Survey Population and Response Rate: 

Table 7: Number and Percentage of CTRs Filed by Institution Type, 2004- 
2006: 

Table 8: Mean and Median Numbers of CTRs Filed by Size of Institution, 
2004-2006: 

Table 9: Number of CTRs Based on Aggregated Transactions, 2004-2006: 

Table 10: Number and Percentage Amount of Cash-In Transactions Recorded 
by CTRs, 2004-2006: 

Table 11: Number and Percentage of Cash-Out Transactions Recorded by 
CTRs, 2004-2006: 

Table 12: Number and Percentage of Phase I Exemptions Filed by 
Depository Institutions, 2006: 

Table 13: Number and Percentage of Phase II Exemptions Filed by 
Depository Institutions, 2006: 

Table 14: FinCEN's CTR and Exemption-Related Enforcement Actions on 
Depository Institutions, 1997-2006: 

Figures: 

Figure 1: Extent to Which State and Local Agencies Found That CTRs 
Assisted Them in Verifying Known or Obtaining Previously Unknown 
Information: 

Figure 2: Purposes for Which State and Local Agencies Reported Using 
CTRs and How They Rated CTRs' Usefulness: 

Figure 3: CTRs Filed in 2006 by Banks and Credit Unions, by Asset Size: 

Figure 4: General Process for Filing CTRs: 

Figure 5: Extent to Which Steps in the CTR Process Were Automated at 
Surveyed Institutions: 

Figure 6: Median Time, in Minutes, to Accomplish Each CTR Filing Step: 

Figure 7: Factors That Surveyed Institutions Reported as of Great or 
Very Great Importance to Their Decision to Exempt Phase I and Phase II 
Customers: 

Figure 8: Percentage of Depository Institutions with Customers Eligible 
for Phase I and II Exemptions and Extent to Which They Filed Exemptions 
in 2006: 

Figure 9: An Overview of the Reveal Data Mining System: 

Figure 10: States That Viewed CTR Data, by Number of CTRs Viewed in the 
Gateway Program, Fiscal Year 2006: 

Figure 11: CTRs Filed in 2006, by Institution Asset Size: 

Figure 12: CTRs Filed in 2006, by County: 

Figure 13: Factors That Institutions Considered to Be of Very Great or 
Great Importance When Deciding Not to Exempt a Phase I Eligible 
Customer: 

Figure 14: Factors That Institutions Considered to Be of Very Great or 
Great Importance When Deciding Not to Exempt a Phase II-Eligible 
Customer: 

Abbreviations: 

BSA: Bank Secrecy Act: 

CBRS: Currency Banking and Retrieval System: 

CMIR: Report of International Transportation of Currency or: 

Monetary Instruments: 

CTR: currency transaction report: 

DEA: Drug Enforcement Administration: 

FBI: Federal Bureau of Investigation: 

FDIC: Federal Deposit Insurance Corporation: 

FinCEN: Financial Crimes Enforcement Network: 

HIDTA: High Intensity Drug Trafficking Area: 

HIFCA: High-Intensity Money Laundering and Related Financial Crimes 
Area: 

ICE: Immigration and Customs Enforcement: 

IRS: Internal Revenue Service: 

NCUA: National Credit Union Administration: 

OCC: Office of the Comptroller of the Currency: 

OCDETF: Organized Crime Drug Enforcement Task Force: 

OTS: Office of Thrift Supervision: 

TECS: Treasury Enforcement Communications System: 

SAR: Suspicious Activity Report: 

Letter February 21, 2008: 

The Honorable Christopher J. Dodd: 
Chairman: 
The Honorable Richard C. Shelby: 
Ranking Member: 
Committee on Banking, Housing, and Urban Affairs: 

United States Senate: 

The Honorable Barney Frank: 
Chairman: 
The Honorable Spencer Bachus: 
Ranking Member: 
Committee on Financial Services: 
House of Representatives: 

To assist law enforcement agencies in their efforts to combat money 
laundering, the financing of terrorist activities, and other crimes, 
financial institutions are required to provide the federal government 
with information on customers engaging in certain currency transactions 
under the Bank Secrecy Act (BSA).[Footnote 1] Among other things, the 
BSA--administered by the U.S. Department of the Treasury's Financial 
Crimes Enforcement Network (FinCEN)--and its implementing regulations 
require financial institutions to file currency transaction reports 
(CTR) when their customers make large cash transactions, currently 
defined by regulation as those exceeding $10,000.[Footnote 2] In 2006, 
the government received about 15 million CTRs, the vast majority of 
which were filed by depository institutions (banks, thrifts, and credit 
unions). 

To reduce the number of CTRs with limited usefulness to law enforcement 
efforts, in 1994 Congress enacted provisions allowing depository 
institutions to exempt two broad categories of customers that meet 
specified criteria.[Footnote 3] For these exempted customers, the 
institutions do not have to file CTRs, because the customers' cash 
transactions would likely be of little or no value to law enforcement 
efforts. First, the law required FinCEN to provide appropriate 
exemptions for customers that are another depository institution; 
governmental entities, including state and local governments; certain 
other entities exercising U.S., state, and local governmental 
authority; and "any business or category of business the reports on 
which have little or no value for law enforcement purposes," which 
FinCEN has defined through regulations to generally include companies 
that are listed on any of three stock exchanges (listed companies) and 
subsidiaries that are 51 percent or more owned by a listed company. 
Second, the law authorized FinCEN to establish, through regulation, 
exemptions for "qualified business customers" that maintain an account 
at the depository institution, frequently engage in large cash 
transactions, and meet other criteria specified by regulation. FinCEN's 
regulations provide that certain qualified business customers may not 
derive more than 50 percent of their gross revenue from activities or 
lines of business specifically deemed ineligible, such as the purchase 
or sale of automobiles or gaming of most kinds. Because FinCEN 
promulgated the regulations for these two categories in separate rule- 
making phases, the exemptions are commonly referred to as "Phase I" and 
"Phase II" exemptions, respectively.[Footnote 4] It is up to the 
depository institutions as to whether they actually exempt each of 
their customers who are eligible for exemption; if they do, the 
institutions must file an exemption form documenting the customer's 
eligibility and must review and verify eligibility at least once each 
year. 

Depository institutions have expressed concerns about the cost and 
effort required to meet CTR filing requirements--including the steps 
needed to establish and maintain exemptions for their customers--as 
well as doubts about the usefulness of CTRs to law enforcement 
agencies. They note that they are also required, under the BSA, to file 
with FinCEN Suspicious Activity Reports (SAR) in cases of certain 
transactions that may involve violations of law or regulation, 
including money laundering. However, law enforcement officials have 
maintained that the CTR requirements help deter money laundering and 
that CTRs provide information that is highly useful to their 
investigations. Data from CTRs are aggregated and stored electronically 
in a large database accessible to law enforcement agencies and 
maintained for FinCEN by the Internal Revenue Service (IRS). The 
database also includes information about customers for which 
institutions have filed exemption forms. 

The Financial Services Regulatory Relief Act of 2006 required that we 
examine several aspects of CTRs, including their usefulness to law 
enforcement and the burden on depository institutions filing them, and 
to determine whether CTR filing rules could be modified without harming 
law enforcement operations.[Footnote 5] This report discusses (1) the 
usefulness of CTRs to federal, state, and local law enforcement 
agencies; (2) the costs to depository institutions of meeting CTR 
requirements; and (3) factors that affect depository institutions' 
decisions to exempt or not exempt eligible customers, including 
opportunities for encouraging use of exemptions while maintaining the 
usefulness of CTR data to law enforcement agencies. 

To examine the usefulness of CTRs to federal, state, and local law 
enforcement agencies, we first obtained data from both FinCEN and IRS 
indicating the frequency of access to the CTR database by specific 
agencies. We conducted structured interviews with officials of 12 
federal agencies and organizations--including those that most 
frequently accessed CTR data in 2006, such as FinCEN, IRS, the Federal 
Bureau of Investigation (FBI), the Drug Enforcement Administration 
(DEA), and the U.S. Department of Homeland Security's Immigration and 
Customs Enforcement (ICE). In addition, we used a Web-based instrument 
to survey all 115 state and local law enforcement agencies that had 
access to CTR data as of May 2007; our overall response rate was 77 
percent. We supplemented the survey by interviewing officials of 12 
state and 5 local law enforcement agencies, selected to achieve a mix 
of agencies that had accessed CTR data frequently and agencies that had 
not. We asked officials at the law enforcement agencies to identify how 
information provided by CTRs is useful to their efforts and how 
technological changes have affected the use of CTR data. To 
understanding filing trends and obtain information on depository 
institutions' costs to meet CTR requirements, we first analyzed 
FinCEN's CTR and exemption data covering 3 calendar years--2004, 2005, 
and 2006--to identify the numbers of CTRs and exemptions filed by 
depository institutions of different sizes. For this purpose, we 
established four size categories (based on the dollar value of 
institutions'assets) for banks and thrifts and three categories for 
credit unions.[Footnote 6] To obtain specific information on the costs 
of meeting CTR requirements, we conducted 35 structured interviews with 
officials of depository institutions of different sizes. We asked the 
officials whether they use manual or automated processes and what costs 
they incur to meet CTR requirements, including the costs of filing 
individual CTRs and exemption forms. Finally, to identify the factors 
affecting depository institutions' exemption decisions, as well as 
opportunities for potentially increasing the use of exemptions, we used 
a Web-based instrument to survey 680 of the 3,880 depository 
institutions that filed at least 120 CTRs in 2006, stratified by asset 
size category. Our overall response rate was 68 percent. When 
presenting the survey results, all percentage estimates in this report 
have 95 percent intervals of within plus or minus 8 percentage points 
of the estimate, unless otherwise noted. This report does not contain 
all of the results of our surveys of law enforcement agencies and 
depository institutions, but the surveys and a more complete tabulation 
of the results can be viewed at [hyperlink, http://www.gao.gov/cgi-
bin/getrpt?GAO-08-385SP]. We also analyzed statutory and regulatory 
filing requirements and interviewed officials and examiners from the 
five federal banking regulators to obtain their viewpoints on the 
difficulties, if any, institutions might confront in meeting the CTR 
and exemption filing requirements.[Footnote 7] We also obtained data on 
BSA examinations conducted by each of the regulators for 2005 and 2006, 
particularly data on their citations of depository institutions for 
noncompliance with CTR requirements. Additional details on our methods 
are presented in appendix I. We conducted this performance audit from 
November 2007 through February 2008 in accordance with generally 
accepted government auditing standards. Those standards require that we 
plan and perform the audit to obtain sufficient, appropriate evidence 
to provide a reasonable basis for our findings and conclusions based on 
our audit objectives. We believe that the evidence obtained provides a 
reasonable basis for our findings and conclusions based on our audit 
objectives. 

Results in Brief: 

Federal, state, and local law enforcement officials we interviewed and 
surveyed described a variety of ways in which CTR requirements are 
useful to their efforts; however, measuring their impact is difficult. 
Recent advances in technology, along with FinCEN's distribution of BSA 
data in bulk to certain federal agencies, have enhanced the ability to 
access and integrate CTR data with information from other sources. 
According to law enforcement officials, CTRs provide unique and 
reliable information that is essential to supporting investigations and 
detecting criminal activities, in part because CTRs provide information 
that is often unavailable elsewhere or is more objective or up-to-date 
than that obtained from other sources. In addition to supporting 
individual cases, law enforcement agencies use aggregated CTR data to 
help detect patterns or trends; for example, FinCEN analysts routinely 
analyze CTR data in conjunction with other information to develop "big 
picture" views of suspicious financial activity. Law enforcement 
officials noted that CTR requirements also aid their efforts by making 
it more difficult for criminals to get their illicit proceeds into the 
financial system and forcing them to act in ways that increase chances 
of detection--such as smuggling cash or "structuring" their cash 
transactions to avoid CTRs, which often prompts depository institutions 
to file a Suspicious Activity Report. Linking law enforcement's use of 
CTRs to specific impacts is difficult, however, because agencies do not 
track their use of CTRs, which are typically one of many sources of 
information used to support investigations. FinCEN does not routinely 
publish any summary information on law enforcement's use of CTR data-- 
such as identified trends and case examples--as it does for Suspicious 
Activity Reports. Although concerns about revealing investigatory 
sources and methods limit dissemination of detailed information on how 
law enforcement agencies use CTR data, our interviews with financial 
institution officials suggest that they would better understand the 
value of meeting their requirements if the institutions were provided 
with similar summary information on CTR use. 

Our analysis of CTR data for 2004 to 2006 shows that a large proportion 
was filed by a small number of the largest depository institutions--for 
example, fewer than 30 very large banks accounted for 55 percent of new 
CTRs during the period--and while these institutions likely incur the 
greatest expenditure of time and resources to meet CTR requirements, 
all depository institutions incur some costs regardless of the number 
of CTRs they file. This is because institutions must have processes and 
trained staff in place to identify when and if a CTR is required, 
including the ability to aggregate same-day cash transactions made by 
or on behalf of the same person, and to file CTRs correctly. While 
automation has made these tasks less difficult, most institutions 
reported that their processes still include "manual" steps; for 
example, most institutions reported that their CTRs are reviewed by 
branch managers or compliance officers before being sent electronically 
to FinCEN or by mail to IRS. Institutions we contacted were generally 
unable to quantify their costs for meeting CTR requirements, in large 
part because they use the same personnel and processes for meeting 
other BSA requirements or for other purposes and do not separately 
account for CTR-related costs. However, they noted that personnel costs 
include the cost of training staff on meeting CTR requirements, as well 
as the cost of labor involved in filing CTRs. Reflecting the range of 
numbers of staff that may be involved, officials provided a wide 
variance of estimated personnel costs. For example, while one very 
large bank that filed almost 1 million CTRs in 2006 estimated personnel 
costs, including tellers and compliance officers, of about $5.4 
million, a large bank that filed just under 5,000 CTRs in 2006 
estimated personnel costs at $76,000. Officials at institutions with 
automated processes also cited technology as a significant cost. 

Our survey of depository institutions and interviews with officials 
identified a variety of factors that deter the use of exemptions, as 
well as opportunities for increasing their use without diminishing the 
usefulness of CTR requirements to law enforcement. Our survey results 
showed that many financial institutions with customers considered 
eligible for exemptions do not actually exempt them, but instead 
continue to file CTRs on the customers' transactions--despite the 
institutions' recognition that making use of the exemption provisions 
would enable them to file fewer CTRs. The reasons they cited included 
uncertainty about the documentation needed to demonstrate that certain 
customers are in fact eligible for exemptions, accompanied by concern 
that the federal banking regulators would deem the documentation 
insufficient and cite them for noncompliance with BSA requirements. For 
example, depository institutions that chose to use the Phase II 
exemption relied on various methods--sometimes to a considerable 
extent--to determine and document the portion of the customer's 
revenues derived from ineligible activities, including asking the 
customer for financial statements, tax records, or other documentation 
such as a letter certifying its revenue sources. While our review of 
data from the banking regulators showed relatively few violations 
compared with the number of BSA examinations conducted, we found 
variations in the types of documentation the regulators find 
acceptable. For example, officials from two of the banking regulators 
said that a letter from a customer self-certifying its revenue sources 
could be acceptable to document eligibility for a Phase II exemption, 
while officials from two other regulators indicated that such a letter 
alone would be inadequate documentation. Both the difficulties cited by 
the institutions and the variation among examiners indicate that 
further CTR guidance from FinCEN could be helpful in this regard. Other 
factors discouraging the use of exemptions were the cost and effort 
involved in meeting FinCEN's regulatory requirements to (1) file an 
exemption form, and annually review and update the information, 
particularly for certain customers that are required to be exempted by 
statute as appropriate; and (2) biennially file a form to document the 
continued eligibility of customers that have been exempted under the 
Phase II regulation, which many institutions viewed as redundant in 
light of the required annual review process. Eliminating these 
requirements could encourage institutions to make greater use of 
exemptions. Other opportunities to encourage the use of exemptions 
include (1) shortening the waiting period--currently a full year under 
FinCEN's regulations--before exempting certain customers with frequent 
cash transactions that exceed the $10,000 threshold, and (2) making 
available from FinCEN Web-based material to help train and guide 
depository institutions' staff in making exemption determinations. 
While FinCEN currently provides such material--such as answers to 
frequently asked questions, rulings, and guidance--for other BSA 
requirements, the information on CTR exemption requirements is very 
limited; and about 50 percent of respondents to our survey indicated 
that the availability of such Web-based material from FinCEN would 
increase their use of exemptions. Because the transactions of exempt 
customers are likely to be of little or no value to law enforcement, 
these actions could avoid the burden of filing some CTRs without 
harming law enforcement efforts. 

We are recommending that the Secretary of the Treasury direct FinCEN to 
consider routinely publishing summary information on law enforcement 
uses of CTRs, provide additional guidance on the documentation needed 
to demonstrate eligibility for some customers, revise certain 
regulations that deter exemptions, and provide Web-based material to 
help depository institutions interpret exemption requirements. In 
written comments on a draft of this report, the Director of FinCEN 
concurred with our recommendations seeking regulatory amendments and 
those related to guidance and materials to aid industry in making 
eligibility determinations for CTR exemptions, and said that FinCEN 
will consider options to provide industry with additional feedback on 
the use of CTRs by law enforcement. We also received written comments 
from the Board of Governors of the Federal Reserve System (Federal 
Reserve), Federal Deposit Insurance Corporation (FDIC), National Credit 
Union Administration (NCUA), and Office of Thrift Supervision (OTS) 
that, in a joint letter, reaffirmed their support for effective 
administration of the BSA and said they believe that streamlining and 
clarifying the exemption regulations, as we recommend, would be a 
positive step. 

Background: 

According to BSA's objectives, CTRs are to have a "high degree of 
usefulness" and their uses include criminal, tax, or regulatory 
investigations or proceedings. In 2001, the USA PATRIOT Act added a 
fourth purpose: the conduct of intelligence or counterintelligence 
activities, including analysis, to protect against international 
terrorism.[Footnote 8] CTRs are intended to provide a paper trail for 
federal, state, and local law enforcement agencies in their 
investigations and, thus, potentially hinder using financial 
institutions as intermediaries for the transfer or deposit of money 
derived from criminal activity.[Footnote 9] A CTR records account cash 
withdrawals and deposits, as well as currency exchanges, and wire 
transfers purchased with cash, when the amount of the transaction is 
more than $10,000. In addition to the dollar amount of the cash 
transaction, a CTR records information about the account owner, 
including the owner's occupation, and the identity of the person 
actually conducting the transaction (the conductor), if not the account 
holder. A depository institution must file a CTR for transactions that 
collectively exceed $10,000 during the course of a day if the 
institution has knowledge that they are for or on behalf of the same 
person. 

The Money Laundering Suppression Act of 1994 provided basic criteria 
for establishing and maintaining exemptions and authorized Treasury to 
establish further requirements.[Footnote 10] FinCEN has done so through 
both regulations and "interpretative letters" that supplement the 
regulations to provide further guidance. Table 1 summarizes the 
requirements as outlined in the statute, implementing regulations, and 
interpretive letters. 

Table 1: Statutory and Regulatory Provisions That Determine Which 
Customers May Be Exempted: 

Statutory provision: Customers eligible for exemptions under Phase I: 
Another depository institution; 
Regulatory provision: Customers eligible for exemptions under Phase I: 
A bank, to the extent of such bank's domestic operations. 

Statutory provision: Customers eligible for exemptions under Phase I: A 
department or agency of the United States, any state, or any political 
subdivision of any state; 
Regulatory provision: Customers eligible for exemptions under Phase I: 
The same as statutory provision. 

Statutory provision: Customers eligible for exemptions under Phase I: 
Certain other entities exercising governmental authority on behalf of 
the United States, any state or political subdivision of any state; 
Regulatory provision: Customers eligible for exemptions under Phase I: 
The same as statutory provision. 

Statutory provision: Customers eligible for exemptions under Phase I: 
Any business or category of business the reports on which have little 
or no value for law enforcement purposes; 
Regulatory provision: Customers eligible for exemptions under Phase I: 
Any entity, other than a bank, whose common stock is listed on the New 
York, American, or NASDAQ Stock Exchange, with some exceptions (a 
"listed entity"); and any subsidiary, other than a bank, of any "listed 
entity" that is organized under U.S. law and at least 51 percent of 
whose common stock is owned by the listed entity. 
A nonbank financial institution meeting these criteria may be extended 
only to the extent of its domestic operations. 

Statutory provision: Eligibility criteria for business customers under 
Phase II: Maintains a transaction account at the depository 
institution, and; 
Regulatory provision: Eligibility criteria for business customers under 
Phase II: A commercial enterprise that has maintained a transaction 
account at the bank for at least 12 months. 

Statutory provision: Eligibility criteria for business customers under 
Phase II: Frequently engages in transactions with the depository 
institution that are subject to the CTR reporting requirements, and; 
Regulatory provision: Eligibility criteria for business customers under 
Phase II: Frequently (defined in an Interpretive Letter as at least 8 
times within a 12-month period, excepting certain "seasonal" customers) 
engages in cash transactions in excess of $10,000. 

Statutory provision: Eligibility criteria for business customers under 
Phase II: Meets other criteria which the Secretary determines are 
sufficient to ensure the purposes of the BSA are carried out; 
Regulatory provision: Eligibility criteria for business customers under 
Phase II: Is incorporated or organized under U.S. law, or state law, or 
is registered as and eligible to do business in the United States or a 
state, to the extent of its domestic operations, and to the extent that 
no more than 50 percent of its gross revenues come from activities 
specified as non-eligible business activities. 

Statutory provision: Customers not eligible for exemption: FinCEN must 
establish guidelines, which may include a description of the type of 
business for which no exemption will be granted; 
Regulatory provision: Customers eligible for exemptions under Phase I: 
Businesses for which no exemption as a nonlisted business will be 
granted are those engaged primarily in; 
* serving as financial institutions or agents thereof; 
* purchase or sale of motor vehicles, vessels, aircraft, farm equipment 
or mobile homes; 
* practice of law, accountancy, or medicine; 
* auctioning of goods; 
* chartering or operation of ships, buses, or aircraft; 
* gaming of any kind (other than pari-mutuel betting at race tracks); 
* investment advisory services or investment banking services; 
* real estate brokerage; 
* pawn brokerage; 
* title insurance and real estate closing; 
* trade union activities; and; 
* any other activities that may be specified by FinCEN. 

Source: GAO analysis of 31 U.S.C. § 5313(d) and (e), and 31 C.F.R. § 
103.22(d). 

Note: Phase II exemptions also include a second category referred to as 
"payroll businesses," which are defined in 31 U.S.C. § 
103.22(d)(2)(vii). 

[End of table] 

Legislative proposals would alter the basis for establishing 
exemptions, as well as raise the reporting threshold amount above 
$10,000. For example, in January 2007, the U.S. House of 
Representatives passed the Seasoned Customer CTR Exemption Act of 2007 
(H.R. 323), which would require the Secretary of the Treasury to (1) 
prescribe regulations for exempting "qualified customers," including 
criteria for suspending, rejecting, or revoking exemptions; and (2) 
periodically review the threshold amount and adjust it for inflation as 
appropriate. H.R. 1447, the CTR Modernization Act, introduced in March 
2007, would raise the threshold amount for insured depository 
institutions to $30,000. 

FinCEN's role is to oversee administration of the BSA throughout the 
federal government. Pursuant to this role, FinCEN, among other things, 
develops policy and provides guidance to other agencies and analyzes 
BSA data for trends and patterns. FinCEN relies on the regulators of 
depository institutions--the Federal Reserve Board (Federal Reserve), 
Federal Deposit Insurance Corporation (FDIC), National Credit Union 
Administration (NCUA), Office of the Comptroller of the Currency (OCC), 
and Office of Thrift Supervision (OTS)--to ensure that depository 
institutions comply with BSA reporting requirements. In addition to 
CTRs, depository institutions are required by BSA and its implementing 
regulations to make available information on their customers' 
transactions in certain circumstances: 

* Depository institutions are required to file Suspicious Activity 
Reports (SAR) with FinCEN if a transaction involves or aggregates at 
least $5,000 in funds or other assets, and the institution knows, 
suspects, or has reason to suspect that the transaction is designed to 
evade any requirements of the BSA.[Footnote 11] 

* Under Section 314(a) of the USA PATRIOT Act, federal law enforcement 
agencies, through FinCEN, can reach out to financial institutions to 
locate accounts and transactions of persons suspected of engaging in 
terrorism or money laundering.[Footnote 12] 

FinCEN is responsible for providing these agencies with assistance in 
educating institutions on their BSA responsibilities. To focus and 
direct their efforts in supporting the effectiveness of BSA compliance, 
FinCEN's strategic plan for fiscal years 2006-2008 outlines several 
goals. For example, to assist law enforcement, the plan calls for 
FinCEN to reduce the number of CTRs filed on legitimate financial 
transactions that are of little or no value to law enforcement; and, to 
assist financial institutions, the plan calls for FinCEN to revise its 
data collection forms, regulations, and practices to ensure that FinCEN 
collects the information necessary to meet its mission while minimizing 
reporting burdens on the financial industry. In addition, FinCEN 
indicated in its plan that it would consider providing guidance on BSA 
requirements through written and Web-based materials and by means of a 
call center to respond to specific questions. 

FinCEN, together with the IRS, is responsible for managing and storing 
the BSA data that financial institutions report. Financial institutions 
that submit CTRs in paper form mail them directly to IRS's Enterprise 
Computing Center in Detroit. Institutions that submit data 
electronically transmit them directly to FinCEN, which in turn 
transmits them to the center. The center collects and stores all BSA 
data in its Currency Banking and Retrieval System (CBRS).[Footnote 13] 
For fiscal year 2007, the IRS estimated the total cost of processing 
CTRs to be about $7 million, including about $3.5 million to convert 
CTRs submitted on paper to an electronic format. IRS examiners and 
investigators access BSA data directly through IRS's Intranet, while 
FinCEN has a direct connection to the Enterprise Computing Center. 
Staff at other law enforcement agencies can access BSA data via the 
Internet, and certain federal agencies also periodically receive bulk 
data downloads of BSA data for use at their agencies, as described 
later in this report. 

CTR Requirements Are Useful to Law Enforcement Efforts in a Variety of 
Ways, but Measuring Their Impact Is Difficult: 

Federal, state, and local law enforcement officials we interviewed and 
surveyed said that information in CTRs provided unique and reliable 
information essential to a variety of efforts and that recent advances 
in technology, along with FinCEN's distribution of BSA data in bulk, 
have enhanced their ability to use and analyze CTR information. Law 
enforcement officials stated that, in addition to supporting specific 
investigations, CTR requirements aid their efforts by making it more 
difficult for criminals to get their illicit proceeds into the 
financial system and forcing them to act in ways that increase chances 
of detection. Linking law enforcement's use of CTRs to specific 
outcomes is difficult, however, because agencies do not track their use 
of CTRs, which are typically one of many sources of information used to 
support investigations. FinCEN does not routinely publish any summary 
information on law enforcement's use of CTR data as it does for 
Suspicious Activity Reports, such as identified trends and case 
examples. Although concerns about revealing investigatory sources and 
methods limit dissemination of detailed information on how law 
enforcement agencies use CTR data, our interviews with depository 
institution officials suggest that they would better understand the 
value of meeting their requirements if the institutions were provided 
with similar summary information on CTR use. 

CTRs Provide Unique Information for Investigating Cases and Detecting 
Criminal Activities: 

In part due to advances in technology that have enhanced access to, and 
analysis of, CTR data, law enforcement officials use CTR data to help 
investigate a variety of crimes, including tax evasion, customs 
violations, and drug trafficking. They use CTR data both "reactively"-
-that is, to support existing investigations of one or more suspects-- 
and "proactively"--to analyze patterns or trends that can serve as the 
basis for initiating new investigations. 

Technological Advances Have Increased Access and Analytic Capability: 

In 1993, we reported that CTRs were not used to their full extent by 
law enforcement agencies because the large volume of reports made 
meaningful analysis difficult and access to the data, particularly at 
the state level, was limited and cumbersome.[Footnote 14] However, 
access to BSA data at the federal, state, and local levels has improved 
and technological advances have made meaningful analysis of large BSA 
data sets possible. Consistent with its strategic goal of facilitating 
information sharing through electronic means, FinCEN has increased 
access to CTR (and other BSA) data in two ways. 

First, FinCEN began providing selected federal agencies with access to 
"bulk" CTR data--essentially all of the data resulting from CTRs. In 
2004, FinCEN first provided the FBI with bulk transfer of data, and 
during 2005 and 2006 FinCEN agreed to provide two federal agencies--the 
Secret Service and ICE--and a multiagency program established by the 
Department of Justice (the Organized Crime Drug Enforcement Task Force, 
or OCDETF Fusion Center) with access to a bulk data set.[Footnote 15] 
Receiving these data in bulk, rather than accessing the database 
remotely and querying it for specific records, allows agencies to 
conduct more sophisticated analyses by combining the BSA data with 
other data sets, as can be seen in the following examples. 

* The FBI has combined bulk BSA data into its Investigative Data 
Warehouse, a collection of more than 50 multisource data sets that 
includes counter terrorism data. According to the FBI, access to BSA 
bulk data has significantly increased its usage of CTR data (the bureau 
reported data that indicated approximately 194,000 CTR views from 2004 
through 2006 of the downloaded data). According to FBI officials, about 
40 percent of all FBI terrorism subjects appeared on CTRs that were 
filed between January 1, 2000, and June 30, 2006; further, CTR data 
were the most viewed data in the warehouse. 

* OCDETF's Fusion Center integrated bulk BSA data with drug, financial, 
and gang-related investigative data provided by several other federal, 
state, and local law enforcement agencies. According to OCDETF 
officials, as of June 2007, CTR data had appeared in 61 percent of the 
Fusion Center's analytical products. 

* ICE has combined BSA data with import and export data for selected 
countries to help identify and detect discrepancies or anomalies in 
international commerce that might indicate trade-based money 
laundering. 

Second, FinCEN improved Internet access to CTR data. FinCEN provides 
and grants access using its "Gateway" program, through which law 
enforcement staff may access the database using a system known as 
WebCBRS.[Footnote 16] With WebCBRS, users can download large volumes of 
CTR data--up to 20,000 CTRs on a single query--and export it to a 
spreadsheet application, such as Excel. This allows users to more 
readily conduct proactive analyses, such as identifying transaction 
trends by categories. Most of the law enforcement officials with whom 
we spoke, as well as officials of state and local agencies we surveyed, 
confirmed that WebCBRS is more user friendly than its predecessor and 
has greatly improved their ability to search for and analyze CTR 
data.[Footnote 17] (More detailed information about the technological 
advances enabling greater use of CTR data, along with examples of use 
in specific investigations, is presented in appendix II. Our survey of 
law enforcement agencies and a more complete tabulation of the results 
can be viewed at [hyperlink, http://www.gao.gov/cgi-bin.getrpt?GAO-08-
385SP.]) 

Perhaps reflecting improvements in the ability to access and analyze 
CTR data, the number of agencies using CTR data has increased, and 
officials at some agencies noted that they have incorporated a search 
of CTR data as a routine part of their investigations. For example, 
from 2004 through 2006, the number of agencies that viewed CTR data 
through the Gateway program increased from 109 to 136 and, as of 
October 2007 requests from an additional 110 agencies for access to CTR 
data were pending FinCEN's review. 

Agencies Value CTRs as a Source of Unique, Reliable, and Timely Data: 

Officials from law enforcement agencies we interviewed emphasized that 
CTRs are important because they provide information that is often 
unavailable from other sources, or is more objective or up-to-date than 
that obtained from other sources. They cited ways in which CTRs provide 
more comprehensive or timely information about a suspect's banking 
transactions than they can obtain using other provisions of law. 

More specifically, law enforcement officials frequently identified the 
name of the currency transaction's conductor--the person who actually 
carries out a cash transaction at a financial institution, but who is 
not the holder of the affected accounts--as useful information that is 
unique to CTRs. For example, an FBI official noted a case in which 
analysis of information obtained by searching the CTR database 
conductor field provided the agency with the investigative lead needed 
to track the banking activities of persons who, according to the FBI 
official, were involved in a cocaine distribution ring. The conductor 
information was useful because the main person under investigation in 
the ring had associates open bank accounts in their own names at 
different banks and then made large currency transactions into these 
accounts, resulting in CTRs that recorded the main person under 
investigation as the conductor. Further, FinCEN and other law 
enforcement officials explained that because multiple individuals may 
use the same account to conduct transactions, CTRs often could be used 
to identify unknown persons associated with suspects, thereby expanding 
the scope of investigations. For example, during a 4-year FBI 
investigation, analysis of CTRs showed where suspects were banking as 
they opened and closed accounts, and on which day of the week suspects 
typically made their deposits, allowing the FBI to better plan its 
surveillance. 

Law enforcement officials also noted that CTRs provide a unique source 
of information on the occupations of account holders that often proves 
useful. For example, a DEA official reported that analyzing CTRs by the 
information in the occupation field has allowed him to identify whether 
medical companies or doctors--lines of businesses that typically would 
not be dealing in high volumes of cash--were diverting controlled 
substances for illegal use. Finally, officials from several federal law 
enforcement agencies, including the Bureau of Alcohol, Tobacco, 
Firearms, and Explosives, IRS-Criminal Investigation, ICE, and DEA, 
commented that because depository institutions are required to file 
CTRs soon after a reportable transaction occurs, the CTR database 
provides up-to-date information on large cash transactions.[Footnote 
18] Many federal, state, and local officials we interviewed commented 
that CTRs provided them with ready access to information that they 
could not otherwise obtain in a timely manner. 

Officials contrasted these useful aspects of information from CTRs with 
information they may be able to obtain on suspects' banking activities 
under other provisions of the BSA or other laws: 

* Suspicious Activity Reports (SAR) also provide useful information; 
however, depository institutions have some discretion in determining 
whether a transaction or customer is "suspicious," and therefore the 
institutions determine whether to file a SAR and, if so, what 
information to include. Thus, a SAR might not capture the same level of 
information about specific transactions that a CTR routinely would 
provide. Further, criminals may use several different banks to conduct 
their transactions, and a SAR would reflect the suspicious activity 
only within the bank filing the SAR. 

* The Section 314(a) process, under which federal law enforcement 
agencies may reach out to financial institutions to locate accounts and 
transactions of persons of interest, is reserved for significant money- 
laundering or terrorist-financing investigations, and agencies may make 
such requests only upon approval by FinCEN, which limits the number of 
subjects on the list. Further, according to FinCEN, the request 
provides lead information only--law enforcement agencies must meet the 
legal standards that apply to the investigative tool that it chooses to 
use to obtain documents, such as a subpoena. In addition, officials at 
FinCEN and the IRS noted that the 314(a) process provides law 
enforcement access only to transactions conducted within the last 6 
months, or accounts held within the last 12 months, while the CTR (and 
other BSA) data provide access to data going back 10 years. 

* Obtaining bank records through subpoenas could take months or be 
difficult. Further, in order to subpoena a specific institution, 
officials would need to know that a suspect banked at that institution. 
A majority (55 percent) of the state and local law enforcement 
officials we surveyed noted that it would be "somewhat more" or "much 
more" difficult to obtain information from bank records in this fashion 
than from using CTRs. 

* Other methods of obtaining information about a suspect's bank 
accounts--including "mail covers" (copies, obtained from the U.S. 
Postal Service, of the fronts of envelopes delivered to a suspect), 
subpoenas for credit reports, and surveillance--are time consuming and 
less likely to provide needed information about a bank account, 
according to law enforcement officials. ICE and state officials from 
New York and Texas noted that their agencies could wait days to obtain 
mail covers, with no guarantee of receiving one bearing an address of 
the suspect's financial institution. New York state law enforcement 
officials said that the next best alternative would be to subpoena a 
suspect's credit report, a process that could take 30 days. While the 
credit report may provide useful leads--for example, a suspect's 
mortgage application--that the agency might then subpoena, the time 
required would further lengthen the investigation. 

Agencies Reported Using CTR Data to Support a Wide Variety of 
Investigative Cases: 

Most officials of law enforcement agencies we contacted indicated that 
they most often use CTRs reactively, and many routinely review CTRs at 
the beginning of each investigation.[Footnote 19] For example, tax 
investigators in IRS routinely query BSA data to identify CTRs with 
information that suggests situations such as a business paying 
employees in cash (and thus not withholding taxes). However, law 
enforcement agencies typically did not use CTRs in isolation to develop 
a case; rather, they used CTR data to identify leads for further 
investigation, in part by comparing CTR information with information 
from other sources. As explained by law enforcement officials, the 
information in CTRs is useful in corroborating information contained in 
other BSA reports. For example, agencies may compare information from 
the CTR database to that obtained from Reports of International 
Transportation of Currency or Monetary Instruments (CMIR), which report 
currency transported into the United States, to track how businesses 
dispose of cash.[Footnote 20] Agencies also consult CTR data to obtain 
more detailed information after reviewing SARs. For example, officials 
from a High Intensity Money Laundering and Related Financial Crimes 
Areas (HIFCA) noted that they used CTR data for 105 of the 120 reports 
they filed over a recent 1-year period on investigations initiated 
after reviewing SARs.[Footnote 21] In this regard, many law enforcement 
officials, including those from ICE, IRS, and the U.S. Attorney's 
office, noted that raising the CTR filing threshold of $10,000 would 
affect adversely their ability to deter money laundering, because the 
CTR threshold corresponds to those set in other anti-money-laundering 
provisions. For example, officials from the U.S. Attorney's office 
indicated that the CTR threshold works in tandem with three other 
statutorily mandated reporting thresholds, which are also set at 
$10,000: the CMIR requirement; the Form 8300 requirement; and the bulk 
cash smuggling statute.[Footnote 22] 

That no CTRs have been filed on business activities that might be 
expected to generate them also provides valuable leads to law 
enforcement. For instance, FinCEN, ICE, and DEA conduct analyses 
comparing known cash flows documented through other sources with cash 
flows they would expect CTRs to document. Officials at both FinCEN and 
ICE reported that a search of BSA data for information on a cash 
business revealing no CTRs could alert investigators that the business 
was not using traditional depository institutions and direct their 
focus to nonbank financial institutions such as money services 
businesses or to the possibility of currency smuggling. Similarly, the 
lack of CTRs relating to particular individuals or businesses can 
provide investigative leads. For example, officials from FinCEN and a 
Florida law enforcement agency said that the presence of a CMIR, 
coupled with an absence of related CTRs, could provide intelligence 
that currency transported into the country was subsequently laundered 
into the financial mainstream through "structuring" (making a series of 
cash transactions in amounts less than $10,000). Another law 
enforcement official from Florida indicated that a lack of CTRs 
corroborated findings from her agency's surveillance operations that 
certain laundromats, dry cleaners, and travel agencies had laundered 
millions of dollars. 

As shown in figure 1, the state and local law enforcement agencies we 
surveyed found CTRs to be of most use when developing leads for 
existing investigations. Officials from law enforcement agencies in 
California, New York, and Texas--states that were among the highest 
users of CTR data--indicated that their investigators typically used 
CTRs to identify a subject's bank account numbers and associates who 
might be conducting transactions on behalf of the subject. An official 
from one of these agencies indicated that no other source of 
information enabled investigators to "map" the financial links between 
members of a criminal organization as well as the CTR. 

Figure 1: Extent to Which State and Local Agencies Found That CTRs 
Assisted Them in Verifying Known or Obtaining Previously Unknown 
Information: 

This figure is a bar graph showing extent to which state and local 
agencies found that CTRs assisted them in verifying known or obtaining 
previously unknown information. 

[See PDF for image] 

Source: GAO. 

[End of figure] 

Regarding types of investigations involving CTR data, officials of 
state and local agencies we surveyed reported that they primarily use 
CTRs for money-laundering, fraud, and drug investigations (see fig. 2). 
State law enforcement officials we interviewed told us that they use 
CTRs for a wide variety of investigations relating to money laundering, 
drugs, workers compensation fraud, Medicaid fraud, mortgage fraud, and 
white collar crime. 

Figure 2: Purposes for Which State and Local Agencies Reported Using 
CTRs and How They Rated CTRs' Usefulness: 

This figure is a bar graph showing purposes for which state and local 
agencies reported using CTRs and how they rated CTRs' usefulness. 

[See PDF for image] 

Source: GAO. 

[End of figure] 

State and local officials also indicated that the current threshold 
amount of $10,000 was important to the usefulness of CTRs. 
Specifically, about 58 percent of the state and local officials we 
surveyed stated that increasing the CTR filing threshold would result 
in a "very great" or "great" reduction in the usefulness of the CTR 
filing requirement to their work. A law enforcement investigator from 
Illinois indicated that many of the CTRs that his agency's criminal 
intelligence center reviewed were those that documented total 
transaction amounts between $10,000 and $20,000. Similarly, an 
investigator with a Minnesota law enforcement agency indicated that the 
overwhelming majority of CTRs that he found to be of use to his 
investigations were for transactions between $10,000 and $20,000. 

Law Enforcement Agencies Use Aggregated CTR Data to Help Detect 
Patterns or Trends: 

Law enforcement agencies noted that CTR information also contributes to 
pattern and trend analyses. For example, at the request of DEA, FinCEN 
analyzed CTRs filed by institutions in California by ZIP code, 
providing a statistical overview of financial activity occurring within 
those areas that, combined with other law enforcement intelligence, 
allowed DEA analysts to assess threats on a statewide basis. FinCEN 
officials indicated that their analysts routinely analyze information 
from CTRs in conjunction with information from SARs or other BSA 
reports to develop "big picture" views of suspicious financial 
activity. In addition, ICE officials noted that their analysts often 
analyze the "conductor" and account holder information from CTRs to 
identify individuals moving the largest sums of money on behalf of 
particular account-holders over time to spot any unusual trends. 
Further, ICE officials commented that they proactively search CTR 
information to identify individuals moving large sums of money using 
the same Social Security number with different personal or business 
names (according to the officials, name variations is a common 
technique criminals use to hide their activities and avoid detection). 
According to FinCEN and IRS officials, analytical tools such as data 
mining--the application of database technology and techniques, such as 
statistical analysis and modeling, to uncover hidden patterns and 
subtle relationships in data--have enhanced their investigative efforts 
by improving their ability to identify data patterns and trends 
indicative of money laundering and other financial crimes. 

CTR Requirements Can Cause Criminals to Act in Ways That Increase 
Chances of Detection: 

According to federal law enforcement officials, criminals are forced to 
undertake more risky and suspicious methods of money laundering than 
depositing cash into depository institutions because they are well 
aware of the $10,000 filing threshold for CTRs and the investigative 
paper trail that it creates. While criminals can use a variety of means 
to launder their money, law enforcement officials we interviewed 
pointed to three primary methods that criminals use to avoid the CTR 
filing requirement: structuring; bulk cash smuggling, or physically 
moving cash across borders via courier or secreted in cargo; and trade- 
based money laundering, the process of disguising the proceeds of crime 
and moving value through the use of trade transactions. 

Many federal law enforcement officials said that the CTR reporting 
requirement was critical in supporting the ability of depository 
institutions, as well as their own investigators, to identify 
suspicious activity based on the structuring of financial transactions 
to avoid CTRs. The BSA makes it illegal to structure transactions to 
avoid triggering otherwise applicable reporting requirements, such as 
the CTR, allowing federal prosecutors to file charges against 
individuals who structure their cash transactions.[Footnote 23] The 
structuring in which criminals engage to avoid CTRs may cause a 
depository institution to file a SAR. FinCEN analysis of SARs filed by 
depository institutions from April 1, 1996, through December 31, 2006, 
showed that 1.5 million SARs, or 48 percent of all SARs filed by 
depository institutions during this period, were filed based on 
suspicious activity related to structuring or money 
laundering.[Footnote 24] 

Many law enforcement agencies routinely review SARs for evidence of 
structuring. For example, IRS-Criminal Investigation officials said 
that their agents are required to review SARs that report structuring. 
Officials we interviewed at several law enforcement organizations, 
including three associated with HIFCAs, indicated that they had formed 
teams to review SARs to generate leads for cases based on structuring 
and said that they regarded the CTR filing requirement as essential to 
supporting the ability of depository institutions to identify 
suspicious activity. Federal law enforcement officials also emphasized 
that the $10,000 CTR threshold played a key role, by forcing criminals 
to make many more and smaller transactions than otherwise would be 
required--thus making them more vulnerable to being reported for 
structuring. Officials from IRS, ICE, FBI, and U.S. Attorneys Offices 
indicated that they believed large cash transactions have become more 
uncommon as consumer access to credit and electronic payment options 
increased in the 30 years since the threshold was established, making 
the $10,000 threshold still relevant. 

The existence of the CTR filing requirement also can force criminals 
into riskier activities such as bulk cash smuggling.[Footnote 25] 
According to an ICE official, smuggling illegal proceeds in bulk cash 
form makes criminals more vulnerable to detection because it is easier 
for agents of law enforcement to interdict bulk cash shipments. 
Similarly, an official associated with the Chicago High Intensity Drug 
Trafficking Area (HIDTA) reported observing an increase in bulk cash 
smuggling because criminals would rather take their chances smuggling 
their proceeds in bulk cash to Mexico.[Footnote 26] In response, the 
HIDTA has formed a highway patrol to interdict these cash shipments. 
Officials from ICE, FinCEN, and the Justice Department also reported 
that the increase in recent years of bulk cash smuggling across the 
U.S.-Mexican border was an indicator of CTR success in deterring 
criminals from depositing cash into domestic financial 
institutions.[Footnote 27] 

Measuring Usefulness of CTRs Is Difficult: 

Linking law enforcement's use of CTRs to specific outcome measures is 
difficult because agencies do not track their use of CTRs, which are 
typically only one of many sources of information used to support 
investigations. FinCEN does not routinely publish any information on 
law enforcement's use of CTR data as it does for other information that 
financial institutions provide under the BSA. Although concerns about 
revealing investigatory sources and methods limit dissemination of 
detailed information on how law enforcement agencies use CTR data, our 
interviews with depository institution officials suggest that they 
would better understand the value of meeting their requirements if the 
institutions were provided with summary information on CTR use. 

Agencies Have Difficulties Linking CTRs to Specific Investigation 
Outcomes: 

While CTRs appear to be valuable for law enforcement purposes, linking 
their use to specific case outcomes, such as indictments or 
convictions, is problematic. First, no requirement exists to track the 
use of CTR data in investigations, and almost all of the officials from 
the federal, state, and local law enforcement agencies we contacted 
reported that their agencies did not track their use of CTRs or how the 
CTRs contributed to case outcomes.[Footnote 28] 

As a potential indicator of use, we obtained data from FinCEN and IRS 
on the number of CTR "views"--that is, the number of times that 
agencies accessed an individual CTR record. IRS tabulates views that 
occur when agencies access the database through WebCBRS, including its 
own views through its Intranet access, while FinCEN tabulates views 
occurring through the Gateway program.[Footnote 29] For example, data 
show over 1.6 million views of CTRs by federal, state, and local 
agencies in 2006 (see table 2). 

Table 2: CTR Views by Agencies, Fiscal Years 2004 through 2006: 

Agency: IRS; 
Number of CTR views: 2004: 1,466,518; 
Number of CTR views: 2005: 1,231,345; 
Number of CTR views: 2006: 912,405; 
Number of CTR views: Total: 3,610,268. 

Agency: ICE; 
Number of CTR views: 2004: 213,608; 
Number of CTR views: 2005: 241,692; 
Number of CTR views: 2006: 207,325; 
Number of CTR views: Total: 662,625. 

Agency: FinCEN; 
Number of CTR views: 2004: 208,609; 
Number of CTR views: 2005: 105,266; 
Number of CTR views: 2006: 136,090; 
Number of CTR views: Total: 449.965. 

Agency: DEA; 
Number of CTR views: 2004: 111,294; 
Number of CTR views: 2005: 108,845; 
Number of CTR views: 2006: 108,507; 
Number of CTR views: Total: 328,646. 

Agency: FBI; 
Number of CTR views: 2004: 48,364; 
Number of CTR views: 2005: 62,487; 
Number of CTR views: 2006: 54,290; 
Number of CTR views: Total: 165,141. 

Agency: Federal banking regulators[A]; 
Number of CTR views: 2004: 31,408; 
Number of CTR views: 2005: 54,039; 
Number of CTR views: 2006: 58,006; 
Number of CTR views: Total: 143,453. 

Agency: All other agencies[B]; 
Number of CTR views: 2004: 141,602; 
Number of CTR views: 2005: 182,181; 
Number of CTR views: 2006: 171,943; 
Number of CTR views: Total: 495,726. 

Agency: Total; 
Number of CTR views: 2004: 2,221,403; 
Number of CTR views: 2005: 1,985,855; 
Number of CTR views: 2006: 1,648,566; 
Number of CTR views: Total: 5,855,824. 

Source: GAO analysis of IRS and Department of Homeland Security data. 

Notes: Number of CTR views does not include those from bulk downloads 
by the FBI. 

[A] The Federal Reserve, OCC, OTS, FDIC, and NCUA. 

[B] Other agencies include the Bureau of Alcohol, Tobacco, Firearms, 
and Explosives; United States Secret Service; United States Postal 
Inspection Service; U.S. Attorneys Offices; and the Securities and 
Exchange Commission; state regulatory agencies; and state and local law 
enforcement agencies. 

[End of table] 

According to FinCEN data, among users who accessed the CBRS database 
through the Gateway program, state and local law enforcement agencies 
accounted for about 33 percent and 3 percent of the total CTR views, 
respectively. These users include state bureaus of investigation and 
criminal prosecuting offices, such as state offices of attorneys 
general and county prosecutors' offices. The number of these CTR views 
was concentrated among a few agencies; for example, 10 agencies from 8 
states accounted for almost 64 percent of the total CTR views made by 
state and local law enforcement agencies, according to FinCEN's data. 
(For a map showing views by state, see app. II.) 

However, the numbers of views do not provide any indication of CTRs' 
usefulness to any specific law enforcement effort or establish a link 
to any specific outcome of an investigation. Moreover, data on views 
during this period may not reflect future trends because of the changes 
in access to the CTR database discussed previously. For example, the 
numbers of CTRs viewed by state and local users may increase due to the 
expanding number of users with access and with more understanding of 
how CTRs can assist their efforts.[Footnote 30] Several officials from 
state and local law enforcement agencies we interviewed indicated that 
they believed the use of CTR data through Gateway probably would 
increase as users better understand the value of BSA data. Also, as 
noted, FinCEN has recently made bulk downloads of data available to 
several federal agencies. 

A second difficulty in measuring the impact specifically of CTR 
requirements involves the way that CTRs are used--primarily to support 
investigations that also draw upon many other sources of information. 
Officials from the federal investigative agencies we interviewed 
generally stated that outcome measures, such as indictments or 
convictions, cannot be linked exclusively to CTRs because they are 
typically one of many leads used to develop an investigation. 
Similarly, most--about 82 percent--of the state and local agencies we 
surveyed indicated that the number of investigative leads provided by 
CTRs was the best outcome measure of their CTR use. Further, officials 
from several local law enforcement agencies noted that attorneys often 
negotiate plea agreements with the defendant long before a case goes to 
trial; thus, no matter how critical the role played by a CTR in the 
investigation, there would be no trial in which CTRs could be used as 
evidence. In addition, federal, state, and local law enforcement 
officials reported that they were more likely to use CTRs as a basis 
for obtaining subpoenas to access specific bank account records than to 
use CTRs themselves as evidence in court. Officials from IRS, DEA, and 
Justice said that by the time a case moves to the trial phase, the 
prosecution is more likely to use bank records as evidence because 
those records are generally a more convincing form of evidence of a 
defendant's transactions. However, investigators would use the CTR to 
locate the defendant's bank accounts and identify the correct bank 
records to subpoena. Further, according to an IRS official, CTRs 
generally were presented in court only when bank records were not 
available or could not be made available in a timely manner. 

FinCEN officials reported that the agency does not have outcome 
measures related to CTR use and analysis because many of the cases 
FinCEN supported were complex and might not result in tangible success 
for several years. Officials cited the example of "Operation Cash-Out," 
where FBI authorities eventually charged persons with attempting to 
provide funding to al Qaeda. During this investigation, conducted 
between 2000 and 2006, FinCEN identified more than 14,000 CTRs relating 
to the investigation. 

FinCEN Does Not Publish Information on CTR Uses As It Does for Other 
BSA Data: 

Although FinCEN has taken some steps to promote awareness of CTRs and 
their value to the financial community and law enforcement agencies, it 
does not systematically report information about the numbers of CTRs 
filed or results of CTR use. Bank officials we interviewed and those 
responding to our survey strongly questioned whether the CTRs they were 
filing, especially on customers that they had determined to be at low 
risk for financial crimes, provided any value to law enforcement. Some 
officials stated that their resources would be better directed at 
filing SARs, which they viewed as having greater value to law 
enforcement. Other institution officials noted that law enforcement 
agencies had never contacted them. 

Law enforcement officials have given presentations at banking industry 
conferences on how BSA data helps them in their investigations. These 
industry conferences typically include presentations on how law 
enforcement uses BSA data, but they are not necessarily CTR specific. 
Officials we interviewed and those responding to our survey stated that 
they largely did not understand how the CTRs they filed were being used 
by law enforcement. 

In contrast to this general lack of information on CTR use, FinCEN 
routinely publishes information on the numbers of SARs filed and 
examples of how they have been used by law enforcement agencies. Since 
October 2000, in conjunction with law enforcement and regulatory 
agencies, FinCEN has been issuing the SAR Activity Review, which 
provides information about the preparation, use, and value of SARs that 
depository institutions, as well as other financial institutions, 
filed. For example, the October 2007 edition contained expanded 
descriptions of law enforcement cases to demonstrate the value of BSA 
data to the law enforcement community, including cases that were 
proactively initiated as a result of BSA reports, as well as trends in 
certain crimes identified through SARs. FinCEN also includes some 
information on the results of requests to financial institutions under 
section 314(a) of the USA PATRIOT Act. FinCEN officials told us that 
limited resources currently precluded the agency from routinely 
analyzing and publishing trend information about CTRs filed by 
depository institutions. However, the officials noted that the agency 
recently completed a study of CTR trends and patterns, and they were 
considering whether to include information on CTRs in the SAR Activity 
Review. Many officials we interviewed and those responding to our 
survey indicated that they were genuinely interested in how CTRs were 
being used. Further, our interviews with depository institution 
officials suggest that they would better understand the value of 
meeting their requirements if the institutions were provided with some 
information on CTR use, similar to that reported on uses of SARs. 

Financial Institutions Incur Some Costs to Meet Requirements Regardless 
of the Number of CTRs They File: 

Our analysis of CTRs filed during calendar years 2004 to 2006 shows 
that a large proportion was filed by a small number of the largest 
depository institutions. While these institutions therefore likely 
incur the greatest expenditure of time and resources, all depository 
institutions incur some costs to meet CTR requirements, regardless of 
the number of CTRs they file. This is because institutions must have 
processes and trained staff in place to identify when and if a CTR is 
required, including the ability to aggregate same-day cash transactions 
made by or on behalf of the same person, and to file CTRs correctly. 
While automation has made these tasks less difficult, many institutions 
reported that their processes still include "manual" steps. 
Institutions we contacted were generally unable to quantify their costs 
for meeting CTR requirements, in large part because they use the same 
processes and staff for meeting other BSA requirements or for other 
purposes. 

While Most Depository Institutions File CTRs, a Small Number of the 
Largest Institutions Account for the Majority: 

Our analysis of FinCEN's data on the numbers of CTRs filed annually 
shows that, from 2004 to 2006, a relatively small number of the 
nation's approximately 17,000 depository institutions accounted for the 
large majority of CTRs filed. For example, in 2006, fewer than 30 very 
large banks (those with assets of $50 billion or more) accounted for 
over half (55 percent) of new CTRs during this period, while banks with 
assets between $1 billion and $50 billion accounted for another 30 
percent.[Footnote 31] The largest credit unions--those with assets of 
$100 million or more--accounted for only 1 percent of new CTRs, and 
credit unions in total accounted for less than 2 percent. (For 
illustrative purposes, the remainder of this section focuses on CTRs 
filed in 2006. Details on the numbers of CTRs filed during the 3-year 
period, including analyses by institutions of different sizes, appear 
in app. III.) 

In 2006, nearly two-thirds of depository institutions filed at least 
one CTR--89 percent of banks and 42 percent of credit unions. However, 
the CTRs were concentrated among the larger institutions (see fig. 3). 
For example, the 27 very large banks (representing less than one-half 
of 1 percent of all banks) filed 55 percent of the CTRs filed. 

Figure 3: CTRs Filed in 2006 by Banks and Credit Unions, by Asset Size: 

This figure is a combination of bar graphs showing CTRs filed in 2006 
by banks and credit unions, by asset size. 

[See PDF for image] 

Source: GAO. 

Notes: The size categories are based on institutions' assets, as 
follows: very large banks (greater than $50 billion); large banks 
(greater than $1 billion - $50 billion); midsize banks (greater than 
$100 million - $1 billion); small banks ($100 million or less); large 
credit unions ($100 million or more); midsize credit unions ($10 
million to less than $100 million); and small credit unions (less than 
$10 million). 

[A] The actual percentage for very large banks was 0.2. 

[B] The actual percentage for small credit unions was about 0.01. The 
actual percentage for midsized credit unions was about 0.2 percent. 

[End of figure]  

Further analysis of the CTRs filed in 2006 revealed that the 100 
largest depository institutions filed 7.8 million CTRs, or 65 percent 
of the total. One institution--the single largest filer--accounted for 
1.7 million CTRs (14 percent of the total). The median number of CTRs 
filed by banks in each size category was as follows: very large banks, 
125,202; large, 1,889; midsize, 154; and small, 17. 

Regardless of the Number of CTRs Filed, Institutions Incur Costs to 
Establish and Maintain a CTR Filing Process: 

Some institutions may rarely file CTRs--for example, our analysis 
showed that over 5,900 institutions did not file any CTRs in 2006--but 
nevertheless incur costs to establish a filing process and train their 
staff to meet CTR requirements. All of our survey and interview 
respondents reported that they had established processes to file CTRs 
and thus incurred costs associated with these processes.[Footnote 32] 
While the following briefly summarizes and depicts a typical process, 
we found much variation both within institutions--for example, 
procedures for filing CTRs resulting from aggregated transactions 
differed from those applicable to a single transaction--and among 
institutions. 

At most institutions, the CTR filing process typically involves a 
number of steps and staff members (see fig. 4). The staff may include 
tellers, branch supervisors, and compliance officers.[Footnote 33] A 
teller typically inputs the information needed to fill out the CTR 
form, during or immediately following a cash transaction greater than 
$10,000. The teller completes the form, either by hand or through an 
automated system, and passes it to a branch-level supervisor for 
review. Once this review is complete, the CTR is sent either 
electronically or in hard copy to the institution's compliance office 
for an additional review and compliance check. Once the compliance 
check is complete, the CTR is signed and sent either electronically to 
FinCEN or by mail to the IRS. 

Figure 4: General Process for Filing CTRs: 

This figure is a flowchart showing the general process for filing CTRs. 

[See PDF for image] 

Source: GAO (analysis); Art Explosion (images). 

[End of figure] 

To identify cases in which a CTR may be needed if certain individual 
transactions are aggregated and for other purposes, depository 
institutions generally keep a daily report of transactions across their 
branches and service centers and aggregate the transactions by 
customers' tax identification numbers.[Footnote 34] Typically, 
compliance office staff review the aggregation report to see if any of 
the aggregated transactions made by or on behalf of the same person 
meet the CTR filing threshold. Some depository institution officials we 
interviewed said that reviewing this aggregation report could take from 
1 to 2 hours a day, while others noted that it was a time-consuming 
process because it was a manual or partly manual process. Further, if 
information is missing, additional time is required to obtain it. Our 
analysis of CTR data shows that in 2006, 65 percent of all CTRs filed 
resulted from aggregated, rather than single, transactions. 

Many of our survey and interview respondents said that, in general, 
their CTR process was not complex: Fifty percent said the process was 
very or somewhat simple for their institution to complete. However, 21 
percent of the survey respondents said their process was very or 
somewhat complex. Officials we interviewed and surveyed also noted 
that, in general, a number of variations to the basic process outlined 
in figure 4 exist, depending on circumstances. For example, additional 
time and effort is needed to fill in any required information that a 
teller failed to obtain at the time of a transaction. Similarly, if an 
institution filed a CTR with an error, subsequently filing an amended 
CTR may involve collecting additional information about the 
transaction; and "backfiling" (cases in which an institution files a 
CTR after discovering one needed to be filed) may require time- 
consuming review of an account's transactions over a period of time. 

In addition, we found that while most depository institutions generally 
follow the same process for filing CTRs, significant variations can 
exist among them, which may be attributed to the quantity of CTRs 
filed, the number of staff involved, the degree of automation, or 
institutional preferences in reviewing and processing CTRs. 

Technology Has Expedited Some Steps in the Filing Process, but 
Institutions Have Not Automated All Steps: 

Technology has helped some depository institutions expedite and 
streamline many or some parts of the CTR process. Overall, 78 percent 
of institutions responding to our survey reported that at least one 
part of their CTR filing process was mostly or fully automated. Many of 
the institutions we spoke with have software systems that prompt the 
teller when a CTR is necessary for a transaction, and some institutions 
have systems that allow tellers to electronically access the CTR form 
at their workstation and enter the necessary information. Additionally, 
some depository institutions reported that they had software systems 
that automatically fill in some parts of the form. Also, some banks 
have invested in software that processes CTRs for final reviews by 
their compliance office staff. 

However, the extent of automation varied widely among specific steps in 
the process (see fig. 5), and no survey respondents reported a 
completely automated CTR process. For instance, 35 percent of survey 
respondents said they had a mostly or fully automated process for their 
tellers to fill out CTR forms, while 48 percent reported this step was 
largely manual and 16 percent used a mix of manual and automated steps. 
The step that was most likely to be automated was the aggregating of 
daily cash transactions: 68 percent of survey respondents reported that 
their systems automatically generate this aggregation report. The step 
least likely to be automated was the supervisory review of CTRs; about 
10 percent of survey respondents reported that the review processes at 
the branch level had been automated. While we did not obtain data 
showing how the extent of automation compares with the volume of CTRs 
filed, our structured interviews with officials from depository 
institutions suggest that institutions filing the most CTRs (generally 
the larger institutions) were more likely to have highly automated 
processes than smaller institutions filing fewer CTRs. Because of the 
cost, many smaller banks that do not file as many CTRs may choose not 
to invest in systems that could provide a greater degree of automation. 

Figure 5: Extent to Which Steps in the CTR Process Were Automated at 
Surveyed Institutions: 

This figure is a combination bar graph showing the extent to which 
steps in the CTR process were automated at surveyed institutions. 

[See PDF for image] 

Source: GAO. 

[End of figure] 

The extent of automation could influence the time needed to process 
CTRs. Overall, survey respondents reported a median time of 25.2 
minutes to complete a CTR in 2007 (see fig. 6). In 1998, FinCEN 
estimated that it took about 24 minutes to complete a CTR.[Footnote 35] 

Figure 6: Median Time, in Minutes, to Accomplish Each CTR Filing Step: 

This figure is a bar graph showing median time, in minutes, to 
accomplish each CTR filing step. 

[See PDF for image] 

Source: GAO. 

Note: The median values for each of the steps have been rounded to the 
nearest 0.5 minute. The median values for each step do not necessarily 
sum to the total median time. The 95 percent confidence interval for 
"teller fills out CTR" is from 4.9 to 8 minutes, the interval for "CTR 
sent to IRS" is from 2.6 to 4.1 minutes, and the interval for the 
median time total is from 24.4 to 28.8 minutes. 

[End of figure] 

Although FinCEN has taken steps to encourage institutions to file CTRs 
electronically, 76 percent of our survey respondents said that they 
filed CTRs by mail, while 14 percent reported that they filed 
electronically, 6 percent filed by magnetic media, and 4 percent a 
combination of these methods.[Footnote 36] However, institutions that 
do not file CTRs electronically may account for a small proportion of 
all CTRs. According to FinCEN data, 47 percent of all CTRs filed by 
financial institutions in 2006 were filed electronically, while 22 
percent were filed by mail, and 31 percent were filed by magnetic 
media. Further, the use of electronic filing appears to be growing; in 
fiscal year 2003, only about 5 percent of CTRs were filed 
electronically. Some depository institution officials said the ability 
to e-file has made filing CTRs much easier at their institution. Others 
stated that they choose not to file electronically because the volume 
of CTRs they filed did not justify the required time and effort 
involved. According to FinCEN, electronic filing is best suited for 
institutions that file a larger volume of CTRs; however, the overall 
benefits of e-filing to lower-volume filers--for example, the e-filing 
system provides the institution submitting the CTR with an electronic 
confirmation of its receipt--in many instances may outweigh development 
costs. 

Depository Institutions Could Not Quantify Costs Specific to CTR 
Requirements: 

Although they provided some anecdotal estimates, officials of 
depository institutions we interviewed had difficulty separating costs 
for meeting CTR requirements from other BSA costs, such as preparing 
Suspicious Activity Reports.[Footnote 37] In particular, we found that 
at some banks, some staff and automated systems were used to meet CTR 
and other BSA filing requirements. While we asked institutions we spoke 
with to provide estimates of costs based on categories such as 
personnel, training, and technology, not all institutions were able to 
do so because they do not typically account for CTR costs in this way. 
However, officials from institutions we interviewed did describe 
general types of costs and provided some estimates. 

In general, personnel costs associated with CTRs may include the cost 
of training staff on meeting CTR requirements, as well as the cost of 
labor involved in filing CTRs. They may include salary expenses for 
tellers, branch managers, and BSA compliance staff. Most institutions 
said they provide annual training on when and how to file CTRs, and 
that staff members, including tellers, spent an average of about 1 hour 
each in CTR training. At smaller institutions, fewer staff may receive 
training; for example, a compliance officer at one smaller bank told us 
that 26 staff members received four hours of BSA training annually, a 
portion of which is dedicated to CTRs. In contrast, the BSA officer at 
a very large bank said that 1 hour of CTR training is provided annually 
to 160,000 staff; officials from a very large bank said it registers 
about 40,000 hours in CTR training each year among its staff. Many 
depository institutions indicated that training on CTR requirements was 
part of a larger BSA training course, while a few said they offered 
training modules focused on CTRs. For example, at a cost of $15,000, 
one bank has purchased access to a Web-based training program that 
offers courses on CTRs, as well as other areas of BSA. Furthermore, 
officials at one very large institution noted that, in particular, they 
had to conduct training more often for tellers because of high rates of 
turnover in teller positions. 

While all institutions incur some level of costs for training their 
staff, our interviews suggest that typically the higher the number of 
CTRs an institution filed, the higher the number of associated 
personnel--and therefore presumably training costs. Similarly, the 
labor costs associated with actually preparing CTRs would be expected 
to be larger among the institutions that file the most CTRs--though, as 
noted, such costs are also affected by the type of process used, 
including the degree of automation. The highest-volume CTR filers 
reported having staff solely dedicated to filing CTRs and exemptions; 
for example, one very large bank employed more than 190 staff at CTR 
operations centers, and representatives of another very large bank 
reported 60 staff members who worked exclusively on CTRs. Conversely, 
representatives of one midsized bank said that they had one and a half 
full-time equivalent positions in their compliance office dedicated to 
CTRs. 

Reflecting the range of numbers of staff that may be involved, 
officials provided a wide variance of estimated personnel costs. For 
example, the very large bank with more than 190 dedicated staff (which 
filed over 1 million CTRs in 2006) estimated the cost to be "several" 
million dollars. Other large filers also reported high costs for staff 
salaries that ranged from just less than $1 million to over $5 million. 
For example, one very large bank that filed almost 1 million CTRs in 
2006 estimated the cost at $5.4 million--$3.6 million for the 
approximately 25,000 tellers involved and $1.8 million in personnel 
costs for staff dedicated to CTRs. In comparison, officials from one 
large bank that filed just fewer than 5,000 CTRs in 2006 estimated that 
personnel costs for tellers and compliance office staff were slightly 
more than $76,000 for the year. Similarly, the midsize bank that 
reported one and a half full-time equivalent positions dedicated to 
CTRs, and filed approximately 2,300 CTRs in 2006, estimated personnel 
costs of about $31,000 for the compliance office staff but was unable 
to provide an estimate for the costs associated with the tellers' time. 
Officials from smaller institutions we spoke with generally estimated 
lower costs and indicated that CTR filing responsibilities at their 
institutions were handled by staff that had other responsibilities, as 
well; one estimated that staff time for filing 65 CTRs in 2006 cost a 
little less than $2,000. 

As noted above, institutions have automated processes for meeting CTR 
requirements to differing extents, and officials cited technology as a 
significant cost. For example, one large bank was considering adding a 
CTR module to its current software at a cost of between $60,000 and 
$70,000; another large bank reported recently spending about $30,000 to 
purchase a new software component. However, because many of the 
institutions we spoke with also used these systems for other processes, 
they were not able to break out the costs exclusively for CTRs. For 
example, some officials told us their systems cost in the thousands of 
dollars but that they used the systems for monitoring cash transactions 
for suspicious activities, as well as for preparing CTRs. As a result, 
officials we interviewed said that, even if CTR requirements were 
eliminated, their institutions would still incur both personnel and 
systems costs because of other BSA compliance activities. An official 
of a very large bank said that if the CTR requirement were eliminated, 
the bank would be able to eliminate or reassign 14 staff to other 
activities but still would need to prepare many of the same reports, 
such as aggregation reports, because they are used for other purposes, 
such as identifying suspicious activity. An official of a large bank 
told us if there were no CTR filing requirement, the bank would realize 
reductions in some technology costs but would retain staff involved for 
their expertise and skills in other parts of its BSA program. 

Uncertainty about Required Documentation and Some Regulatory 
Requirements May Unnecessarily Discourage Use of Exemptions: 

FinCEN data show that depository institutions filed about 31,500 Phase 
I and 39,300 initial Phase II exemptions during 2004-2006.[Footnote 38] 
However, according to our survey results, many financial institutions 
with customers considered eligible for exemptions do not actually 
exempt them but instead continue to file CTRs on the customers' 
transactions--despite the institutions' recognition that making use of 
the exemption provisions would enable them to file fewer CTRs. 
(Complete survey results can be viewed at [hyperlink, 
http://www.gao.gov/cgi-bin.getrpt?GAO-08-385SP.] Among the reasons 
cited by institutions was uncertainty about the documentation required 
to demonstrate that some customers are in fact eligible, accompanied by 
some concern that examiners from the federal banking regulators would 
deem the documentation insufficient and cite them for BSA 
noncompliance. Our discussions with examiners revealed variations in 
the types of documentation they find acceptable, although our review of 
data from the banking regulators showed relatively few violations 
concerning exemptions compared with the number of BSA examinations 
conducted. Other factors discouraging use of exemptions were the cost 
and effort involved in meeting FinCEN's regulatory requirements to (1) 
file an exemption form, and annually review and update the information, 
particularly for certain customers that are specifically exempted by 
statute, as appropriate; and (2) biennially file a form to document the 
continued eligibility of customers that have been exempted under the 
Phase II regulations--which as a practical matter duplicates the 
required annual review process for those customers. Factors the 
institutions indicated might encourage use of exemptions included (1) 
shortening the waiting period--currently a full year under FinCEN's 
regulations--before exempting certain customers with a relatively large 
volume of cash transactions, and (2) making Web-based material 
available to help train and guide depository institutions' staff in 
making exemption determinations. Because the transactions of exempt 
customers are likely to be of little or no value to law enforcement, 
actions to encourage depository institutions to make greater use of 
exemptions could avoid the burden of filing some CTRs without harming 
law enforcement efforts. 

While Recognizing the Benefits of Exemptions, Depository Institutions 
Do Not Exempt All Eligible Customers: 

Exemptions allow institutions to avoid filing CTRs for the exempt 
customers, but the institutions are not required to exempt eligible 
customers. According to the results of our survey, institutions that 
made use of exemptions primarily did so because it allowed them to file 
fewer CTRs, was cost-effective, and the determinations involved were 
fairly easy. As shown in figure 7 below, the reasons generally were 
consistent for both Phase I and Phase II exemptions. 

Figure 7: Factors That Surveyed Institutions Reported as of Very Great 
or Great Importance to Their Decision to Exempt Phase I and Phase II 
Customers: 

This figure is a combination bar graph showing factors that surveyed 
institutions reported as of very great or great importance to their 
decision to exempt Phase I and Phase II customers. 

[See PDF for image] 

Source: GAO. 

Note: For the category "other factors," the 95 percent confidence 
intervals for the very great/great importance and some/little or no 
importance estimates are within +/-12 percentage points. 

[End of figure] 

The primary reason cited for using the exemption process was that it 
allowed institutions to file fewer CTRs. While it would be difficult 
for an institution to track the number of CTRs it "saved" or avoided by 
exempting a customer, some had; for example, a smaller institution 
reported that it recently began using exemptions more extensively, and 
by exempting five more Phase II eligible customers, the institution 
anticipated filing almost 200 fewer CTRs. (However, the effect of 
exempting a single customer on the number of CTRs filed cannot be 
generalized; for example, an exemption might avoid 8 CTRs or 100, 
depending on the volume of cash transactions in which the customer 
typically engaged.) Institutions also frequently cited the cost- 
effectiveness of using exemptions; while they had difficulty estimating 
the cost of establishing exemptions, just as they did for the costs of 
filing CTRs, some institutions regarded exempting customers as less 
costly than filing CTRs. Officials at other institutions we interviewed 
cited recent advances in commercial software systems that made 
exemptions easier. For example, software can identify the customers 
potentially eligible for the Phase II exemption due to the volume of 
high cash transactions they engaged in during the year. In addition, at 
least one software vendor makes available for purchase a database of 
companies listed on stock exchanges that are eligible for the Phase I 
exemption. 

Despite the cost-effectiveness of using exemptions, institutions 
responding to our survey did not exempt all of their eligible 
customers. For example, while 77 percent of the institutions reported 
having customers eligible for the Phase I exemption, only 45 percent 
reported that they always or usually filed Phase I exemptions. 
Similarly, 83 percent of the institutions reported having customers 
eligible for the Phase II exemption, but only 49 percent reported that 
they always or usually filed Phase II exemptions (see fig. 8). 

Figure 8: Percentage of Depository Institutions with Customers Eligible 
for Phase I and II Exemptions and Extent to Which They Filed Exemptions 
in 2006: 

This figure is a combination pie and bar graph showing percentage of 
depository institutions with customers eligible for Phase I and II 
exemptions and extent to which they files exemptions in 2006. 

[See PDF for image] 

Source: GAO. 

Note: The shaded portion of each circle equals the percentage of 
institutions reporting that they had customers eligible for the 
exemptions. 

[End of figure] 

Some institutions that file large numbers of CTRs--and, therefore, 
might realize the greatest savings by avoiding CTRs--do not file many 
exemptions. Some of the reasons for this are discussed in the following 
sections. (Further details on the results of our survey, including the 
percentages of institutions that cited specific factors affecting their 
decisions to exempt or not exempt customers, are presented in app. IV 
and in GAO-08-385SP.) 

Uncertainty about Documentation Needed to Demonstrate Eligibility, 
Accompanied by Concerns of BSA Noncompliance, Deterred Some Exemptions: 

The leading reason identified by survey respondents that choose not to 
file Phase II exemptions was difficulty in determining the percentage 
of a customer's gross revenue derived from lines of business not 
eligible for exemption. This difficulty--along with other concerns, 
including that federal banking regulators would deem documentation 
insufficient--contributed to a reluctance to exempt customers that the 
institutions considered potentially eligible. 

The responses of officials of institutions we interviewed were 
consistent with our survey results. Officials explained that a fair 
amount of research was required on their part to determine eligibility 
under the Phase II regulations--for example, examining a business's tax 
returns or financial statements--and that it was not always clear if 
the customer qualified for the exemption because it was difficult to 
determine which part of a business customer's revenue was derived from 
which activity. The depository institutions that chose to use the Phase 
II exemption used various methods to document the portion of revenues 
derived from ineligible activities. Officials of several institutions 
we interviewed said they arrived at this determination after conducting 
what they said was exhaustive research, which included analyzing 
financial statements, searching the Internet, and reviewing available 
documents if the institution had a lending relationship with the 
customer, or asking the customer for documents. Officials of other 
institutions used less labor-intensive methods; for example, an 
official of one midsize institution indicated that the account officer 
simply asked customers about the source of their gross revenue and made 
a notation in the customer's file. Several institutions reported using 
a letter from the customer to self-certify that no more than 50 percent 
of their gross revenue came from activities or lines of business 
ineligible for exemption. 

Officials from the federal banking regulators generally indicated that 
they did not have a standardized expectation for what documentation 
(such as financial statements or tax documents) an institution might 
use to demonstrate the portion of revenues derived from ineligible 
activities. They further noted that examiners have some flexibility in 
determining what level of documentation is required, based on guidance 
in the: 

BSA/AML Examination Manual.[Footnote 39] The same manual is used by 
each of the five federal banking regulators and is available to 
depository institutions to help guide their BSA compliance activities. 
However, our interviews with officials and examiners indicated 
differences among them regarding the type of documentation acceptable. 
For example, federal regulators and examiners we interviewed had 
different views about the use of a self-certifying letter and whether 
depository institutions ought to provide other documentation. While 
Federal Reserve and FDIC officials said the acceptance of a self- 
certifying letter would depend on the circumstances, they generally 
noted that examiners had flexibility in deciding what level of 
documentation would be acceptable. Officials from OTS and OCC, on the 
other hand, indicated that a self-certification letter alone would be 
inadequate to show eligibility. Because, in this instance, the federal 
banking regulators examine institutions for compliance with FinCEN's 
regulations, additional guidance from FinCEN could help reduce the 
difficulties that depository institutions face in making this 
determination and clarifying, for both the institutions and the 
regulators, the types of documentation acceptable for demonstrating 
eligibility. 

Officials and examiners we interviewed from all of the federal banking 
regulators indicated that they have found few problems with exemptions, 
and our review of available violation data for 2005 and 2006 indicated 
that examiners cited relatively few violations for exemptions. We asked 
the regulators to disaggregate their data on violations to distinguish 
those related specifically to exemptions; only the Federal Reserve, 
FDIC, and OCC were able to provide this level of detail. These three 
agencies are responsible for examining about 7,800 depository 
institutions, including the largest banks that likely account for the 
greatest numbers of CTRs. As shown in table 3, the three agencies 
collectively found violations associated with exemptions in less than 5 
percent of the BSA exams they conducted--a combined total of 227 
violations for exemptions in 2005 and 113 violations for exemptions in 
2006. 

Table 3: Exemption Violations Cited in BSA Examinations by FDIC, 
Federal Reserve, and OCC, 2005 and 2006: 

2005; 
Agency: FDIC; 
Number of BSA examinations conducted: 3,029; 
Number of exemption violations issued: 178; 
Percentage of exemption violations per examination: 5.9. 

2005; 
Agency: Federal Reserve; 
Number of BSA examinations conducted: 678; 
Number of exemption violations issued: 10; 
Percentage of exemption violations per examination: 1.5. 

2005; 
Agency: OCC; 
Number of BSA examinations conducted: 1,510; 
Number of exemption violations issued: 39; 
Percentage of exemption violations per examination: 2.6. 

2005; 
Agency: Total; 
Number of BSA examinations conducted: 5,217; 
Number of exemption violations issued: 227; 
Percentage of exemption violations per examination: 4.4. 

2006; 
Agency: FDIC; 
Number of BSA examinations conducted: 2,825; 
Number of exemption violations issued: 80; 
Percentage of exemption violations per examination: 2.8. 

2006; 
Agency: Federal Reserve; 
Number of BSA examinations conducted: 815; 
Number of exemption violations issued: 6; 
Percentage of exemption violations per examination: .7. 

2006; 
Agency: OCC; 
Number of BSA examinations conducted: 1,547; 
Number of exemption violations issued: 27; 
Percentage of exemption violations per examination: 1.7. 

2006; 
Agency: Total; 
Number of BSA examinations conducted: 5,187; 
Number of exemption violations issued: 113; 
Percentage of exemption violations per examination: 2.2. 

Source: GAO analysis of Federal Reserve, FDIC, and OCC data. 

[End of table] 

Similarly, we asked FinCEN for data on BSA enforcement actions it has 
taken against depository institutions related to exemptions. (While 
FinCEN generally coordinates with the federal banking regulators, it 
may independently take enforcement actions, including imposing 
penalties and fines, for BSA violations.[Footnote 40]) FinCEN data show 
that, over the 10-year period 1997 to 2006, it took 110 BSA enforcement 
actions related to exemptions, 4 of which included fines. (More 
detailed information on FinCEN's enforcement actions is presented in 
app. IV.) 

The fairly low incidence of violations associated with exemptions may 
reflect depository institutions' decisions to simply not grant 
exemptions, thus avoiding potential violations. (Some examiners noted 
that they sometimes encouraged depository institutions to use the 
exemption process, for example, if the institution was filing many CTRs 
on customers that were potentially eligible for the exemption.) 
However, our survey and interviews demonstrate that a lack of clear 
guidance from FinCEN for documenting eligibility, and the differing 
interpretations among the federal banking regulators, have the effect 
of dissuading depository institutions from more frequently using the 
Phase II exemption. A minority of our survey respondents indicated that 
they "always" exempt eligible customers--33 percent reported doing so 
for Phase I-eligible customers and 26 percent for Phase II-eligible 
customers. Some depository institution officials noted that any 
compliance deficiency found by BSA examiners was a cause for concern. 
(About 10 percent of survey respondents reported that they had received 
a CTR violation or had been fined since 2000.) An official from the 
very large bank that filed more than 150,000 CTRs in 2006 said it was 
the bank's official policy not to exempt any new customers that were 
eligible for the Phase II exemption because, among other things, the 
bank faced reputation risk if it was cited for a BSA violation, and use 
of the exemption process opened the bank to examiner criticism and 
fines. An official from a large community bank said that the bank did 
not file Phase II exemptions because of concerns about regulatory risk. 
Officials from several depository institutions we interviewed 
specifically said it was not clear to them what level of support was 
needed, and some indicated that they would rather file CTRs than take 
the risk of not satisfying an examiner. 

In a 2002 report on the exemption process mandated by section 366 of 
the USA PATRIOT Act, FinCEN concluded that it should work with the 
federal banking regulators, as well as banks, to reduce "fear of 
adverse regulatory consequences from making incorrect exemption 
determinations."[Footnote 41] Exemptions are addressed in the BSA/AML 
Examination Manual, which was first published in 2005 and, as noted, is 
used by the banking regulators and is available to depository 
institutions. However, 68 percent of our survey respondents said that 
difficulty in determining whether companies derive more than 50 percent 
of their revenues from ineligible business activities was a "very 
great" or "great" factor in their decision not to exempt Phase II- 
eligible customers. Guidance that could help institutions make greater 
use of this exemption would help avoid unnecessary CTRs that are of 
little or no use to law enforcement. 

Biennial Renewals, Which Duplicate Annual Reviews, Discourage Use of 
Some Phase II Exemptions: 

FinCEN's regulations require that depository institutions (1) annually-
-at least once a year--review and verify the information supporting any 
exemptions that they have filed for either Phase I or Phase II 
customers, and (2) biennially file--on March 15 of the second calendar 
year following the initial exemption--a renewal form to continue the 
exemption of Phase II customers. The purpose of the annual review is to 
ensure that the customers continue to qualify for exemption; according 
to FinCEN, the biennial renewal provides formal notification to FinCEN 
that the institution has monitored the customers' transactions as 
required. About 49 percent of our survey respondents indicated that the 
time-consuming nature of the biennial renewal was of great or very 
great importance in contributing to their decision not to exempt 
customers eligible for Phase II exemptions.[Footnote 42] An official 
from the very large bank that filed more than 150,000 CTRs in 2006 said 
it was the bank's official policy not to exempt any new customers that 
were eligible for the Phase II exemption because of the costs 
associated with the biennial renewals and the need to keep track of 
which exemptions had to be renewed in each year. Officials from 
depository institutions we interviewed, particularly those that did not 
exempt customers, also said that the need to conduct this review 
discouraged their use of the exemption. 

Officials of some depository institutions questioned the value added by 
biennial renewals, observing that they were already conducting the 
annual review as well as monitoring all of their customers for 
suspicious activities, which is part of a strong anti-money-laundering 
program pursuant to section 352 of the USA PATRIOT Act. Even officials 
of institutions that nevertheless filed and maintained exemptions 
considered the requirement to be redundant. For example, officials at 
one of the very large banks--which had more than 1,900 Phase II 
exemptions on file--said they filed the "biennial" renewal form every 
year for every customer, because the bank went through the same steps 
for the biennial renewals as it did for each required annual review and 
did not want to risk failing to file a biennial renewal form in the 
correct year. Further, our analysis of FinCEN data revealed that some 
institutions file biennial renewal forms on Phase I customers, although 
they are required only for Phase II customers (in 2006, depository 
institutions filed 1,382 biennial renewals on Phase I customers). 

FinCEN established the biennial renewal requirement based on its 
interpretation of the Money Laundering Suppression Act. Specifically, 
the act requires the Secretary of the Treasury to prescribe regulations 
requiring that depository institutions review, at least annually, the 
qualified business customers that they have exempted and to "resubmit 
information about such customers" to the Secretary.[Footnote 43] 
According to FinCEN, the implementing regulations provided for the 
information to be resubmitted biennially, rather than annually, because 
the statute does not explicitly set a time frame for the 
resubmission.[Footnote 44] Further, FinCEN officials believe that the 
Secretary has general authority to prescribe appropriate exemptions to 
requirements under the BSA, including revising the regulations to 
eliminate the biennial renewals.[Footnote 45] 

FinCEN officials said that the biennial renewal form provides them with 
evidence that the exempt business remains eligible for the exemption 
and that the institution has been monitoring the business for 
suspicious activity. In addition, they reported that FinCEN routinely 
analyzes biennial renewal forms (along with other information) filed on 
and by specific depository institutions that are the subjects of 
compliance or enforcement actions by the federal banking regulators to 
determine if the institutions properly granted exemptions to eligible 
customers. However, these activities essentially duplicate those of the 
bank examiners who, as part of the examination process, ascertain 
whether institutions properly grant exemptions and monitor their 
customers for suspicious activity.[Footnote 46] Examiners from a few of 
the banking regulators indicated that the biennial renewal requirement 
results in depository institutions collecting the same kinds of 
information that they collect as part of the annual review of 
exemptions. Further, all biennial renewals must be filed on March 15, 
regardless of when the exemption was filed. Officials from the Federal 
Reserve noted that meeting both requirements can impose significant 
compliance costs on the institutions, yet the duplication provides no 
offsetting benefit for supervisory efforts. Eliminating the requirement 
for biennial renewals could encourage more institutions to make use of 
Phase II exemptions and reduce the burden associated with filing 
unnecessary CTRs. 

Current Regulations Require Institutions to File Exemptions for 
Customers That Are Statutorily Exempt: 

Recognizing that the cash transactions of customers that are depository 
institutions or governmental entities would likely be of little or no 
use to law enforcement efforts, the Money Laundering Suppression Act 
specifically directed that the Secretary of the Treasury exempt 
depository institutions, as appropriate, from filing CTRs on the 
transactions of these customers. FinCEN did so, but its regulations 
require depository institutions to file exemption forms if they choose 
to exempt these types of customers--and to annually review and verify 
the information supporting the exemption. The statute does not mandate 
annual reviews for these customers. 

In essence, the regulations treat these entities like all other 
customers eligible for Phase I exemptions, including listed companies 
and majority-owned subsidiaries. Accordingly, if depository 
institutions choose to exempt these customers, they must perform the 
same steps and incur costs for annual reviews as they do for other 
customers they exempt. But depository institutions and governmental 
entities, in contrast to other Phase I entities such as publicly traded 
companies, are unlikely to change those characteristics that initially 
qualified them for exemption.[Footnote 47] For example, a governmental 
entity is unlikely to become a private company. In any case, a change 
in the status of a governmental entity or bank would most likely 
require that the exempted bank account be closed and a new one be 
opened--triggering a new consideration for exemption. 

Few institutions we interviewed cited difficulty in determining 
eligibility for their customers that are other depository institutions 
or government entities, and many said that, in these cases, they exempt 
all eligible customers. However, they would have incurred some cost to 
file the form and to annually review the supporting information. In 
response to our survey, officials of depository institutions reported 
that their staff took a median time of about 34 minutes to exempt a 
Phase I customer, and about 14 minutes for the annual review 
process.[Footnote 48] Further, some depository institutions do not 
exempt these customers and continue to incur the cost of filing CTRs. 
For example, our analysis of FinCEN data shows that, in 2006, almost 
87,000 CTRs were filed on over 2,900 depository institutions, and about 
45,000 CTRs were filed on some 5,500 government entities.[Footnote 49] 
These CTRs are unnecessary in that the cash transactions of these 
entities are not likely to have a high degree of usefulness for law 
enforcement. 

According to FinCEN officials, the information provided on the 
exemption forms for these entities is not required for analytical 
purposes per se but rather serves as the basis for recording which 
financial institutions had chosen to exempt specific depository 
institutions and governmental agencies. However, depository 
institutions are separately required to keep records of customers' 
transactions for BSA purposes.[Footnote 50] Federal Reserve officials 
specifically noted that they believed that the automatic exemption of 
domestic depository institutions from the CTR filing requirement should 
be considered and that eliminating the need to file an exemption and 
keep it current for these entities would make the CTR process more 
efficient. Continuing to require depository institutions to file forms 
on these entities--and to incur the cost and effort of annually 
reviewing the information supporting the exemption--discourages use of 
the exemption, resulting in CTRs that are likely to be of little or no 
value to law enforcement. 

Length of Time Allowed Before Frequent Customers Can Be Exempted May 
Result in Unnecessary CTRs: 

FinCEN's Phase II exemption regulations specify that, in order to be 
eligible for exemption, among other things customers must have held an 
account for at least 1 year and must have "frequently" engaged in 
currency transactions in excess of $10,000. In a November 2002 guidance 
memorandum, FinCEN defined "frequently" as at least eight large 
currency transactions in a 1-year period (with an exception for 
seasonal customers).[Footnote 51] Officials of several banks we 
surveyed said that their use of exemptions for Phase II customers would 
increase if they were permitted to exempt businesses with frequent cash 
transactions in less than 12 months. 

As explained by an official of one institution, a year seems to be an 
unnecessarily long time if the business is by nature cash-intensive and 
not suspicious, and the institution regularly files CTRs on the 
business. Or, as other officials noted, a waiting period of less than 1 
year would be appropriate if the ownership of a business changed but 
the transaction activity remained relatively similar to that under the 
previous owner, or if known customers chose to form new businesses. We 
analyzed FinCEN's data to identify the numbers and frequency of CTRs 
filed on customers that were subsequently exempted. We found that, 
among customers that were initially exempted in 2006, the median number 
of CTRs filed in the 12 months preceding the exemption was 14; the 
median number filed in the 8 months preceding exemption was 11; and in 
the preceding 6 months, it was 9.[Footnote 52] This analysis 
demonstrates that many customers that were later exempted engaged in 
more than the 8 transactions in a 12-month period required by FinCEN-- 
generating thousands of unnecessary CTRs. 

FinCEN promulgated its regulations establishing the 12-month 
requirement before enactment of the USA PATRIOT Act. That law provided 
for customer identification programs, for which FinCEN regulations 
require depository institutions to collect sufficient information to 
verify the identity of customers when they first open an 
account.[Footnote 53] Thus, depository institutions must require new 
business customers to provide their name, physical location, and 
taxpayer identification number, at a minimum, at account opening. 
Furthermore, as noted above, BSA compliance programs require depository 
institutions to monitor their customers for suspicious activity. Thus, 
continuing to require a 12-month period before allowing otherwise 
nonsuspicious customers with large numbers of cash transactions to be 
exempted may needlessly cause depository institutions to file CTRs that 
are not highly useful to law enforcement efforts. 

Material to Help Train Institutions on Requirements Could Increase Use 
of Exemptions: 

FinCEN currently provides material on its Web site, such as answers to 
frequently asked questions, rulings and guidance, and information on 
BSA requirements. However, the responses to frequently asked questions 
and rulings and guidance concerning exemptions are limited and 
dated.[Footnote 54] Forty-eight percent of respondents to our survey 
indicated that the availability of Web-based material from FinCEN would 
greatly or moderately increase their use of the Phase I exemption, and 
51 percent of respondents said it would greatly or moderately increase 
their use of the Phase II exemption. Such material would help train 
respondents' staff and guide them in interpreting and applying the 
exemption requirements. Officials of depository institutions we 
interviewed generally indicated that they currently purchase training 
modules from vendors, hire trainers, or have their compliance officers 
develop in-house training. 

Our work suggests that material to help train staff could assist 
depository institutions in making some eligibility determinations under 
both the Phase I and Phase II regulations and help overcome 
difficulties that often dissuade institutions from greater use of the 
exemptions. As previously discussed, our survey results and interviews 
with depository institution officials highlighted difficulties in 
determining the portion of a customer's gross revenue derived from 
lines of business not eligible for the exemption, which dissuaded some 
institutions from using the Phase II exemption. Similarly, about 39 
percent of survey respondents indicated that difficulties in 
determining eligibility was a factor of great or very great importance 
in their decision not to exempt a customer eligible for the Phase I 
exemption.[Footnote 55] The difficulties included determining whether 
customers are "listed" (publicly traded) companies or are majority- 
owned subsidiaries of such companies. FinCEN's regulations provide that 
institutions may, among other things, rely on documents filed with the 
Securities and Exchange Commission or listings of the three stock 
exchanges published in newspapers or available on Web sites.[Footnote 
56] However, officials we interviewed stated that verifying the 
publicly traded status of customers was not always straightforward, and 
it is sometimes difficult to determine ownership structures. For 
example, officials from one bank explained that the bank held a number 
of accounts for a large publicly traded video rental chain; some of the 
stores were corporately owned while others were independent franchises. 
While the company-owned stores would be part of the publicly traded 
company, the franchise operations were not likely to be publicly 
traded. The bank did not exempt any of these accounts, however, to 
avoid the risk of exempting a customer that was not eligible for the 
Phase I exemption. Further, some survey respondents stated they had 
difficulty determining eligibility when a customer is a subsidiary of a 
listed company. One respondent noted that his institution would not 
attempt to exempt such a customer because it was too difficult to 
document eligibility in this case. 

In addition, our analysis of FinCEN's data on exemptions filed from 
2004 through 2006 suggests that institutions might benefit from the 
availability of Web-based material from FinCEN. For example, we found 
that some institutions were filing biennial renewals for Phase I 
exemptions, even though FinCEN regulations require renewals only for 
Phase II exemptions. Also, our interviews with examiners from the 
federal banking regulators indicated that further training might 
encourage appropriate use of exemptions. For example, examiners from 
FDIC and OCC reported that some institutions had difficulty 
distinguishing between businesses eligible for the Phase I and Phase II 
exemptions. Some examiners reported that they were educating depository 
institution staff about the exemption requirements, as well as credit 
union examiners in particular, on the use of Phase I exemptions for 
correspondent banks.[Footnote 57] 

Treasury's 2002 report on the uses of CTRs noted the importance of 
making the exemption system easier for bank personnel to understand. In 
preparing that report, FinCEN relied in part on a contractor's survey 
of depository institutions, including their exemption practices and the 
reasons underlying them. The contractor concluded that FinCEN should 
offer a Web-based training module on its Web site to clarify the 
exemption process. Our work for this report indicates Web-based 
material that would help train staff could encourage institutions to 
make greater use of exemptions, thereby avoiding the filing of CTRs 
that are of little or no use to law enforcement efforts. Providing such 
material on FinCEN's Web site would be a cost-effective way to help 
ensure that all institutions have available up-to-date information on 
how to meet the requirements. 

Conclusions: 

Since GAO reported over a decade ago that the large volume of CTR 
reports had made analysis difficult, expensive, and time consuming, 
developments in information technology have provided law enforcement 
with the capacity to simultaneously analyze large quantities of CTR 
data and link these with other data sets. These technological 
advancements, as well as the advent of bulk data downloads and expanded 
access to CTR data by state and local users, have provided law 
enforcement agencies with greater potential to make use of CTR data in 
their investigations of a wide variety of financial and related crimes. 
Further, in addition to supporting specific investigations, CTR 
requirements aid law enforcement by forcing criminals--who attempt to 
avoid reportable transactions--to act in ways that increase chances of 
detection through other methods. Given the multiplicity of sources that 
federal law enforcement officials may tap in their investigations, and 
the variety of possible case outcomes, it is understandably difficult 
to link the use of CTRs with specific outcomes. However, information 
that law enforcement agencies could provide on how CTRs contribute to 
their efforts, similar to information they provide on their use of 
Suspicious Activity Reports, is not systematically provided to 
depository institutions or shared with state and local law enforcement 
agencies that have more recently gained access to BSA data. Many 
depository institutions indicated a desire for some assurance that the 
information they provide is actually useful to law enforcement efforts. 
FinCEN routinely collects and makes available information on how 
Suspicious Activity Reports have contributed to investigations through 
publication of its SAR Activity Review. A similar approach for 
collecting and publishing CTR information could provide financial 
institutions with evidence that their efforts are contributing to 
detecting and deterring money laundering and other crimes. While 
recognizing that this effort would entail an investment of resources, 
we believe it would prove beneficial by providing depository 
institutions with greater awareness that CTRs are a valuable source of 
data for law enforcement investigations. 

With the partial exception of institutions that file the largest 
numbers of CTRs and have personnel dedicated to that function, most 
institutions are not able to quantify their costs of complying with CTR 
requirements, largely because they use the same personnel and automated 
systems for a variety of purposes. Nevertheless, depository 
institutions expend what could be considered to be significant amounts 
of time and resources to meet the requirements. Most depository 
institutions, based on over 35 years of collective experience in filing 
CTRs, have established processes that have allowed the filing of most 
CTRs to become fairly routine. Yet, while technology has helped them 
meet filing requirements more efficiently, it is clear that most 
institutions' processes involve steps that cannot be completely 
automated. These include reviews by compliance officers or other 
officials to provide assurance that CTRs are correct and will not 
unduly expose their institutions to risk of being cited for BSA 
noncompliance by their examiners. Further, because all institutions are 
subject to compliance with CTR requirements, all incur some costs--for 
example, in training their staff--regardless of the numbers of CTRs 
they file. While impacts could therefore vary among institutions 
depending on the numbers of CTRs they currently file as well as the 
processes they use, steps to reduce the number of unnecessary CTRs 
filed could avoid some costs. 

Increasing use of exemptions would help depository institutions avoid 
filing unnecessary CTRs, as well as reduce the government's costs to 
process them. Institutions we surveyed told us t