Recommendation: The Director of FinCEN should develop and implement written policies and procedures to help promote the greater use of BSA reports by law enforcement agencies that do not have direct access to the BSA database. Such policies and procedures could include outreach strategies and educational or training materials. (Recommendation 1)

Agency: Department of the Treasury: Financial Crimes Enforcement Network
Status: Open

Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: Regarding financial sector cyber risk mitigation efforts, we recommend that the Secretary of the Treasury, in coordination with the Department of Homeland Security and other federal and nonfederal sector partners, track the content and progress of sectorwide cyber risk mitigation efforts, and prioritize their completion according to sector goals and priorities in the sector-specific plan. (Recommendation 1)

Agency: Department of the Treasury
Status: Open

Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: Regarding the financial sector-specific plan, we recommend that the Secretary of the Treasury, in coordination with the Department of Homeland Security and other federal and nonfederal sector partners, update the financial services sector-specific plan to include specific metrics for measuring the progress of risk mitigation efforts and information on how the sector's ongoing and planned risk mitigation efforts will meet sector goals and requirements, such as requirements for the financial services sector in the National Cyber Strategy Implementation Plan. (Recommendation 2)

Agency: Department of the Treasury
Status: Open

Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: The Associate Director of FinCEN's Global Investigations Division should provide additional direction for self-initiated GTOs, including how the agency will plan to (1) oversee covered businesses, (2) inform and obtain feedback from appropriate law enforcement agencies, and (3) evaluate the GTOs to determine the appropriate course of action. (Recommendation 1)

Agency: Department of the Treasury: Financial Crimes Enforcement Network
Status: Open

Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: We recommend that the Commissioner of Internal Revenue update and implement policies and procedures for developing a courier contingency plan to prohibit managers responsible for overseeing the preparation of taxpayer receipts for deposits from also transporting them to financial institutions. (Recommendation 20-01)

Agency: Department of the Treasury: Internal Revenue Service
Status: Open

Comments: The IRS agreed with this recommendation and stated that the Wage and Investment organization will update the Courier Contingency Plan polices and procedures to provide for appropriate segregation of duties or other curative measures.

Recommendation: We recommend that the Commissioner of Internal Revenue establish and implement manual refund procedures to direct (1) initiators to document (e.g., record on the taxpayers' accounts or annotate on the related manual refund forms) the justification for bypassing the IAT tool warning related to potential duplicate tax refunds on taxpayers' accounts and (2) managers to monitor whether such warnings were bypassed and review the justifications for reasonableness prior to approving manual refund forms. (Recommendation 20-02)

Agency: Department of the Treasury: Internal Revenue Service
Status: Open

Comments: The IRS agreed with this recommendation and stated that the Wage and Investment organization agrees that actions need to occur to address duplicate tax refund conditions through improved manual refund procedures to require (1) initiator to document the justification for bypassing the Integrated Automated Technologies (IAT) tool warning related to potential duplicate tax refunds on taxpayers' accounts and (2) managers to review the justification documented for bypassing the IAT tool warning for reasonableness prior to approving manual refund forms. However, IRS also stated that it was unable to commit to implementing a corrective action plan at this time due to budgetary constraints on system enhancements.

Recommendation: We recommend that the Commissioner of Internal Revenue establish and implement actions to provide reasonable assurance that business units record the acceptance of goods and services in a timely manner in accordance with IRS policies and procedures. (Recommendation 20-03)

Agency: Department of the Treasury: Internal Revenue Service
Status: Open

Comments: The IRS agreed with this recommendation and stated that the CFO organization will determine the reasons for business unit(s) non-compliance with established policies and procedures related to timely recording of receipts and acceptance of goods and services and, based on this evaluation, develop an action plan that once completed will provide additional tools to aid the business units in reasonably ensuring compliance with established requirements.

Recommendation: We recommend that the Commissioner of Internal Revenue establish and implement actions to provide reasonable assurance that the future lease payment amounts for non-cancellable operating leases are calculated correctly. (Recommendation 20-04)

Agency: Department of the Treasury: Internal Revenue Service
Status: Open

Comments: The IRS agreed with this recommendation and stated that the CFO organization will update policies and procedures to include additional instructions needed to calculate the future lease payments due on the non-cancelable leases with terms greater than one year and will also create an automated calculation to determine the number of remaining months of lease payments.

Recommendation: The Director of the Federal Insurance Office should publicly communicate information about when it is considering certifying an event as an act of terrorism under TRIA. (Recommendation 1)

Agency: Department of the Treasury: Office of the Under Secretary for Domestic Finance: Office of the Assistant Secretary for Financial Institutions: Office of Financial Institutions Policy: Federal Insurance Office
Status: Open

Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: The Director of the Federal Insurance Office should document an agreement with DHS about DHS's role, and how the agencies share information, during the process of certifying an event as an act of terrorism under TRIA. (Recommendation 2)

Agency: Department of the Treasury: Office of the Under Secretary for Domestic Finance: Office of the Assistant Secretary for Financial Institutions: Office of Financial Institutions Policy: Federal Insurance Office
Status: Open

Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: The Director of the Federal Insurance Office should document an agreement with DOJ about DOJ's role, and how the agencies share information, during the process of certifying an event as an act of terrorism under TRIA. (Recommendation 3)

Agency: Department of the Treasury: Office of the Under Secretary for Domestic Finance: Office of the Assistant Secretary for Financial Institutions: Office of Financial Institutions Policy: Federal Insurance Office
Status: Open

Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: The Secretary of Homeland Security should direct the Director of ICE to develop a strategy for the TTU program to ensure that ICE has a plan to guide its efforts to effectively partner with existing TTUs, and to expand the program, where appropriate, into additional countries. (Recommendation 1)

Agency: Department of Homeland Security: Office of the Secretary
Status: Open

Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: The Secretary of Homeland Security should direct the Director of ICE to develop a performance monitoring framework for the TTU program that would enable the agency to systematically track program results and how effectively it is achieving the program's goals. (Recommendation 2)

Agency: Department of Homeland Security: Office of the Secretary
Status: Open

Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: The Commissioner of Internal Revenue should update the FAQs issued in 2019 to include a statement that the FAQs may serve as a source of general information but cannot be relied upon by taxpayers as authoritative since they are not binding on IRS. (Recommendation 1)

Agency: Department of the Treasury: Internal Revenue Service
Status: Open

Comments: IRS disagreed with this recommendation. In an August 2020 letter, IRS stated that the 2019 currency FAQs are illustrative of how longstanding tax principles apply to property transaction and IRS does not take positions contrary to public FAQs. However, if IRS intends the public FAQs on virtual currency to be binding on IRS it could address our recommendation by publishing the FAQs in the Internal Revenue Bulletin. Doing so would render a disclaimer statement unnecessary and would satisfy the intent of the recommendation. We will continue to follow up with IRS on this recommendation and will provide an update if IRS takes action.

Recommendation: The Commissioner of Internal Revenue should take steps to increase third-party reporting on taxable transactions involving virtual currency, which could include clarifying IRS's interpretation of existing third-party reporting requirements under the Internal Revenue Code and Treasury Regulations, or pursuing statutory or regulatory changes. (Recommendation 2)

Agency: Department of the Treasury: Internal Revenue Service
Status: Open

Comments: IRS agreed with this recommendation. In August 2020, IRS informed us that IRS's Office of Chief Counsel and the Department of the Treasury are developing guidance that will address third-party reporting on certain taxable transactions involving virtual currency. IRS expects that this guidance will also propose rules to avoid duplicate reporting under other information reporting regimes that may apply to transactions involving virtual currency. We will continue to monitor IRS's efforts to increase third-party reporting on taxable transactions involving virtual currency.

Recommendation: The Commissioner of Internal Revenue should clarify the application of reporting requirements under FATCA to virtual currency. (Recommendation 3)

Agency: Department of the Treasury: Internal Revenue Service
Status: Open

Comments: IRS disagreed with this recommendation. In an August 2020 letter, IRS said it intends to focus on developing guidance regarding information reporting on certain virtual currency transactions involving U.S. businesses instead of clarifying the application of reporting requirements under FATCA to virtual currency. IRS stated that additional guidance on FATCA requirements may be appropriate in the future as the workings of foreign virtual currency exchanges become more transparent over time. We found that many virtual currency stakeholders were uncertain about how, if at all, FATCA requirements apply to virtual currency and would benefit from clarifications to the guidance. We will continue to follow up with IRS on this recommendation and will provide an update if IRS takes action.

Recommendation: The Director of FinCEN, in coordination with IRS as appropriate, should make a statement about the application of foreign account reporting requirements under the Bank Secrecy Act to virtual currency readily available to the public. (Recommendation 4)

Agency: Department of the Treasury: Financial Crimes Enforcement Network
Status: Open

Comments: FinCEN agreed with this recommendation. When we can confirm that FinCEN has taken action we will provide updated information.

Recommendation: The Commissioner of Internal Revenue should assess options for updating Publications 590-A and 590-B to either include more information or direct taxpayers to other resources for IRA owners with investments in unconventional assets. Such information could include: storage requirements for IRA investments in certain precious metals; valuation methods for hard-to-value IRA assets; the Department of Labor's process for granting exemptions to IRA prohibited transactions rules; and IRA investments with the potential to create unrelated business income tax liabilities. (Recommendation 1)

Agency: Department of the Treasury: Internal Revenue Service
Status: Open

Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: The Commissioner of Internal Revenue, building on forthcoming compliance research using new IRA asset data, should evaluate the feasibility of requiring disclosure for high-risk IRA asset types associated with abusive schemes as transactions of interest. (Recommendation 2)

Agency: Department of the Treasury: Internal Revenue Service
Status: Open

Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: The Commissioner of Internal Revenue should develop resources (such as training materials or job aids) for Small Business/Self-Employed examiners conducting IRA owner audits that explain how IRAs with unconventional assets can generate unrelated business income tax liability, and how examiners can refer cases to unrelated business income experts in IRS for assistance. (Recommendation 3)

Agency: Department of the Treasury: Internal Revenue Service
Status: Open

Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: The Board of Governors of the Federal Reserve System should, in coordination with the other federal banking regulators, and with input from BSA/AML examiners and other relevant stakeholders, take steps to improve examiners' ability to evaluate the effectiveness of banks' BSA/AML compliance controls with respect to money transmitter accounts. Steps may include providing updates to examination procedures, examiner training, or a combination of methods. (Recommendation 1)

Agency: Federal Reserve System
Status: Open

Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: The Comptroller of the Currency should, in coordination with the other federal banking regulators, and with input from BSA/AML examiners and other relevant stakeholders, take steps to improve examiners' ability to evaluate the effectiveness of banks' BSA/AML compliance controls with respect to money transmitter accounts. Steps may include providing updates to examination procedures, examiner training, or a combination of methods. (Recommendation 2)

Agency: Department of the Treasury: Office of the Comptroller of the Currency
Status: Open

Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: The Chairman of the Federal Deposit Insurance Corporation should, in coordination with the other federal banking regulators, and with input from BSA/AML examiners and other relevant stakeholders, take steps to improve examiners' ability to evaluate the effectiveness of banks' BSA/AML compliance controls with respect to money transmitter accounts. Steps may include providing updates to examination procedures, examiner training, or a combination of methods. (Recommendation 3)

Agency: Federal Deposit Insurance Corporation
Status: Open

Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: The Chairman of the National Credit Union Administration should, in coordination with the other federal banking regulators, and with input from BSA/AML examiners and other relevant stakeholders, take steps to improve examiners' ability to evaluate the effectiveness of banks' BSA/AML compliance controls with respect to money transmitter accounts. Steps may include providing updates to examination procedures, examiner training, or a combination of methods. (Recommendation 4)

Agency: National Credit Union Administration
Status: Open

Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: The Director of FinCEN, after consulting with the Commodity Futures Trading Commission (CFTC), should consider prioritizing the inclusion of the primary SRO conducting BSA examinations in the futures industry in the Bank Secrecy Act Advisory Group (BSAAG) on a more consistent basis and also making the primary futures industry association a concurrent member. (Recommendation 1)

Agency: Department of the Treasury: Financial Crimes Enforcement Network
Status: Open

Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: The Director of FinCEN, after consulting with CFTC, should take steps to explore providing direct BSA data access to the National Futures Association. (Recommendation 2)

Agency: Department of the Treasury: Financial Crimes Enforcement Network
Status: Open

Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: The Director of FinCEN should review options for FinCEN to more consistently and publicly provide summary data on the usefulness of BSA reporting. This review could either be concurrent with FinCEN's BSA value study or through another method. (Recommendation 3)

Agency: Department of the Treasury: Financial Crimes Enforcement Network
Status: Open

Comments: As of August 2020, FinCEN officials told us that they began to implement a strategy to communicate the results of its BSA Value Study (completed in April 2020) and more generally publicize statistics on the value that BSA reporting provides to industry and the public. According to FinCEN officials, they have made some progress in implementing the communication strategy, including briefing key public and private sector stakeholders and developing fact sheets, videos and other materials for eventual public release, and expect to complete the initial phase of the communication plan by the end of 2020.

Recommendation: The Director of FinCEN should review options for establishing a mechanism through which law enforcement agencies may provide regular and institution-specific feedback on BSA reporting. Options should take into consideration providing such feedback to cover different types of financial institutions and those with significant financial activity. This review could either be part of FinCEN's BSA value study or through another method. (Recommendation 4)

Agency: Department of the Treasury: Financial Crimes Enforcement Network
Status: Open

Comments: According to FinCEN officials, it will use measures outlined in response to Recommendation 3 and information gathered from the BSA Value Study to develop a specific action plan to better collect data for FinCEN and its law enforcement and other partners in a way that allows them to communicate more consistent feedback to reporting entities, and address the gaps and recommendations from the study. FinCEN anticipates the development and approval of the action plan by the end of 2020.

Recommendation: The Director of CFPB should communicate to CRAs its expectations regarding reasonable procedures for assuring maximum possible accuracy of consumer report information. (Recommendation 1)

Agency: Consumer Financial Protection Bureau
Status: Open

Comments: In a January 2020 update, CFPB reemphasized statements made in its comment letter, including its expectation for CRAs to fully comply with applicable federal consumer financial laws and the role of case law in providing guidance to CRAs. CFPB additionally noted that its publicly available examination procedures discuss factors that CFPB will consider in evaluating compliance with the reasonableness standard under the Fair Credit Reporting Act (FCRA). CFPB stated that since publication of the report, it has taken actions to convey expectations to CRAs, including holding a joint workshop with FTC in December 2019 on consumer reporting accuracy and publishing a Supervisory Highlights special edition focused on consumer reporting. More direct communication of CFPB's expectations can provide CRAs with clearer information on what actions might constitute a FCRA violation and how CRAs should comply with the reasonableness standard. We maintain that providing additional information to CRAs about its expectations for key FCRA requirements could help CFPB to promote consistency and transparency in its supervisory approach and that the recommendation should be addressed.

Recommendation: The Director of CFPB should communicate to CRAs its expectations regarding reasonable investigations of consumer disputes. (Recommendation 2)

Agency: Consumer Financial Protection Bureau
Status: Open

Comments: In a January 2020 update, CFPB restated the requirements for a reasonable investigation under the Fair Credit Reporting Act (FCRA) and noted that court cases have articulated what qualifies as a reasonable investigation. CFPB also noted that a 2011 FTC report summarizes how the courts and FTC have interpreted these obligations, and that CFPB issued a bulletin on reasonable investigations in September 2013. CFPB stated that it has and will continue to communicate its expectations to CRAs regarding applicable provisions of FCRA. We maintain that providing additional information to CRAs about its expectations for key FCRA requirements could help CFPB to promote consistency and transparency in its supervisory approach and that the recommendation should be addressed.

Recommendation: The Director of CFPB should provide written clarification to nonbank private student loan lenders on their authorities under the Fair Credit Reporting Act to offer private student loan rehabilitation programs that include removing information from credit reports. (Recommendation 1)

Agency: Consumer Financial Protection Bureau
Status: Open

Comments: As of November 2019, CFBP does not plan to act on this recommendation because the law does not require nonbank private student loan lenders to seek CFPB's approval of student loan rehabilitation programs. CFPB stated that if a financial institution chooses to offer a private student loan rehabilitation program it would be protected under the Fair Credit Reporting Act. We maintain that clarification from CFPB that nonbank lenders have the authority to offer these programs could--depending on CFPB's interpretation--result in additional lenders offering rehabilitation programs that would allow more borrowers the opportunity to participate, or it could help ensure that only those entities CFPB has interpreted as being eligible to offer programs are doing so.

Recommendation: The Director of CFPB, after consulting with the prudential regulators and relevant industry groups, should provide written clarification on what information in a consumer's credit report constitutes a private student loan reported "default" that may be removed after successful completion of a private student loan rehabilitation program. (Recommendation 2)

Agency: Consumer Financial Protection Bureau
Status: Open

Comments: As of November 2019, CFPB stated that action on this recommendation is premature pending ongoing work by an industry association on what information may be removed from a credit report after successful completion of a private student loan rehabilitation program. We will continue to follow up with CFPB on its monitoring of this effort and consultation with relevant regulators.

Recommendation: The Director of the Division of Risk Management Supervision of FDIC should take steps to improve the completeness of matters requiring board attention (MRBA) data in its tracking system, in particular, by developing a structure that allows examiners to record MRBAs at progressively more granular levels (from a broad level such as examination area to more specific levels, including risk or concern type). (Recommendation 3)

Agency: Federal Deposit Insurance Corporation
Status: Open

Comments: FDIC agreed that a structure should be enhanced to allow staff to further categories MRBAs at the point of entry into the system. As of March 2020, no action has been taken on this recommendation. GAO will continue to monitor for any updates to FDIC procedures.

Recommendation: Congress should consider amending the Internal Revenue Code, Bank Secrecy Act of 1970, and other statutes, as needed, to address overlap in foreign financial asset reporting requirements for the purposes of tax compliance and detection, and prevention of financial crimes, such as by aligning the types of assets to be reported and asset reporting thresholds, and ensuring appropriate access to the reported information.

Agency: Congress
Status: Open

Comments: No legislative action enacted as of January 2020. Congress has not amended the Internal Revenue Code, Bank Secrecy Act of 1970 and other statutes as needed to address overlap in foreign financial asset reporting requirements, as GAO suggested in April 2019. GAO continues to believe that if Congress were to modify these various statutes, the reporting burden created by navigating multiple reporting requirements will be reduced. Modifying these statutes will also allow for the use foreign financial asset information collected under the Foreign Account Tax Compliance Act to prevent and detect financial crimes.

Recommendation: The Commissioner of Internal Revenue should develop a plan to mitigate risks with compliance activities due to the lack of accurate and complete Taxpayer Identification Numbers of U.S. account holders collected from FFIs. (Recommendation 1)

Agency: Department of the Treasury: Internal Revenue Service
Status: Open

Comments: The Internal Revenue Service (IRS) has taken several steps to improve collection of accurate and complete taxpayer identification numbers (TINs) from foreign financial institutions (FFIs). For example, in December 2019, IRS officials said they began identifying 2017 records submitted by FFIs without valid TIN fields or corresponding dates of birth for account holders. IRS also launched a campaign to identify FFIs that did not file a Form 8966 with IRS. While these steps can improve the quality of account data submitted by FFIs, IRS still faces ongoing risks that receiving inaccurate or incomplete TINs pose to efforts to identify and combat taxpayer and FFI noncompliance. Additionally, IRS has not yet developed a plan that elaborates on these risks and identifies steps to mitigate them, as we recommended in April 2019. Without such a strategy, IRS may fail to identify opportunities to adjust compliance programs to better enforce FFI reporting of valid TINs and identify U.S. persons who are not complying with FATCA reporting requirements.

Recommendation: The Commissioner of Internal Revenue should ensure that appropriate business units conducting compliance enforcement and research have access to consistent and complete data collected from individuals' electronic and paper filings of Form 8938 and elements of parent individual tax returns. As part of this effort, the Commissioner should ensure that IRS provides clear guidance to the business units for accessing such data in IRS's Compliance Data Warehouse. (Recommendation 2)

Agency: Department of the Treasury: Internal Revenue Service
Status: Open

Comments: The Internal Revenue Service (IRS) has taken several steps to address this recommendation. According to IRS Information Technology division officials, as of December 2019, they deliver paper and electronically filed Form 8938 data to IRS's Research, Applied Analytics, and Statistics organization on a monthly basis, and makes such data available in the Compliance Data Warehouse (CDW) for use by agency officials. According to Large Business and International (LB&I) Division officials, IRS's enforcement functions also have access to this data. One outcome of this access, according to LB&I officials, is the use of FATCA data in the development of compliance examination leads. However, IRS has not yet developed clear guidance for business units to access relevant data from Forms 8938 and elements of parent individual tax returns in CDW, as we recommended. Without such guidance, CDW users may be less likely to effectively leverage CDW data for examination purposes.

Recommendation: The Commissioner of Internal Revenue should employ a comprehensive plan for managing efforts to leverage FATCA data in agency compliance efforts. The plan should document and track activities over time to
• ensure individuals and FFIs comply with FATCA reporting requirements;
• assess and mitigate data quality risks from FFIs;
• improve the quality, management, and accessibility of FATCA data for compliance, research, and other purposes; and
• establish, monitor, and evaluate compliance efforts involving FATCA data intended to improve voluntary compliance and address noncompliance with FATCA reporting requirements. (Recommendation 3)

Agency: Department of the Treasury: Internal Revenue Service
Status: Open

Comments: In September 2019, IRS's Deputy Commissioner for Services and Enforcement said that IRS disagreed with our April 2019 recommendation. The Deputy Commissioner said that resources that would be dedicated to update a comprehensive plan unique to FATCA-such as the FATCA Compliance Roadmap-are better spent on enforcement activities. The Deputy Commissioner also said that IRS's strategy for FATCA compliance will instead be part of IRS's Large Business & International (LB&I) Division's overall portfolio management strategy. Implementing enforcement activities could increase taxpayers' and foreign financial institutions' (FFIs) compliance with FATCA reporting requirements. While IRS does not have to revise and reemploy its FATCA Compliance Roadmap, it can employ a comprehensive plan as part of LB&I's portfolio management strategy to evaluate FATCA enforcement activities already in place, and determine the extent to which these activities improve voluntary compliance and address noncompliance with FATCA reporting requirements. Without such a plan, IRS risks not maximizing efforts to manage and address the myriad of challenges it faces in effectively ensuring taxpayer compliance.

Recommendation: The Commissioner of Internal Revenue should assess factors contributing to unnecessary Form 8938 reporting and take steps, as appropriate, to address the issue. Depending on the results of the assessment, potential options may include:
• identifying and implementing steps to further clarify IRS Form 8938 instructions and related guidance on IRS's website on determining what foreign financial assets to report, and how to calculate and report asset values subject to reporting thresholds; and
• conducting additional outreach to educate taxpayers on required reporting thresholds, including notifying taxpayers that may have unnecessarily filed an IRS Form 8938 to reduce such filings. (Recommendation 4)

Agency: Department of the Treasury: Internal Revenue Service
Status: Open

Comments: As of February 2020, IRS officials said the agency is in the process of obtaining 2017 and 2018 tax data to analyze the number of unnecessary filings of Form 8938. Completing this data analysis and identifying the full range of factors contributing to unnecessary Form 8938 reporting will allow IRS to better address such factors. These efforts, in turn, will reduce the risk that taxpayers file-and IRS processes-forms that taxpayers were not required to submit to IRS.

Recommendation: The Secretary of the Treasury should lead efforts, in coordination with the Secretary of State and Commissioner of Social Security, to establish a formal means to collaboratively address ongoing issues—including issues accessing financial services and employment and obtaining SSNs—that U.S. persons living abroad encounter from implementation of FATCA reporting requirements. (Recommendation 5)

Agency: Department of the Treasury
Status: Open

Comments: The Department of the Treasury (Treasury) has taken some steps to implement GAO's April 2019 recommendation. Specifically, Treasury proposed changes to the Internal Revenue Service (IRS) relief procedures to abate assessments for certain expatriating taxpayers and is working with IRS and the Department of State (State) to publicize the procedures. In addition, Treasury led efforts with IRS, State, and the Social Security Administration (SSA) to develop frequently asked questions that combine relevant guidance for individuals to obtain a Social Security number, renounce U.S. citizenship, and comply with U.S. tax obligations. However, as of December 2019, Treasury lacked a collaborative interagency mechanism to address ongoing issues U.S. persons living abroad continue to encounter from implementation of Foreign Account Tax Compliance Act (FATCA) reporting requirements. In November 2019, Treasury said it was not the appropriate agency to lead these coordination efforts. However, GAO continues to believe that because Treasury is ultimately responsible for effectively administering FATCA, it is in a better position than State or SSA to establish an effective collaborative mechanism. Doing so will help agencies address the ongoing issues Americans living abroad experience from FATCA.

Recommendation: The Secretary of State, in coordination with the Secretary of the Treasury and Commissioner of Social Security, should establish a formal means to collaboratively address ongoing issues—including issues accessing financial services and employment and obtaining SSNs—that U.S. persons living abroad encounter from implementation of FATCA reporting requirements. (Recommendation 6)

Agency: Department of State
Status: Open

Comments: The Department of State (State) has taken several steps to implement GAO's April 2019 recommendation. In September 2019, State worked with the Department of the Treasury (Treasury), the Internal Revenue Service (IRS), and Social Security Administration (SSA) to develop and post online frequently asked questions on how to obtain a Social Security number, renounce U.S. citizenship, and comply with U.S. tax obligations. Additionally, State officials participated in an October 2019 webinar hosted by IRS regarding newly approved tax relief procedures for certain former citizens who have renounced U.S. citizenship and seek to be federal tax compliant. State also established procedures with SSA for its embassies and consulates abroad to help U.S. citizens apply for a Social Security number during the passport application process without SSA permission, thus removing a significant barrier in serving U.S. citizens abroad. However, as of December 2019, State lacked a collaborative interagency mechanism with Treasury to address ongoing FATCA implementation issues related to access to foreign financial services and denial of employment and promotion opportunities overseas. Treasury is responsible for leading efforts to establish such a mechanism; however, State's participation in such a mechanism on a continuing basis will help agencies address remaining issues Americans living abroad experience from FATCA.

Recommendation: The Commissioner of Social Security, in coordination with the Secretaries of State and Treasury, should establish a formal means to collaboratively address ongoing issues—including issues accessing financial services and employment and obtaining SSNs—that U.S. persons living abroad encounter from implementation of FATCA reporting requirements. (Recommendation 7)

Agency: Social Security Administration
Status: Open

Comments: The Social Security Administration (SSA) has taken or plans to take steps to implement GAO's April 2019 recommendation. SSA worked with the Department of the Treasury (Treasury), the Internal Revenue Service, and the Department of State (State) to develop and post online frequently asked questions on how to obtain a Social Security number, renounce U.S. citizenship, and comply with U.S. tax obligations. Additionally, in October 2019, SSA said it plans to conduct outreach events for U.S persons living abroad who need Social Security numbers. However, as of December 2019, SSA lacked a collaborative interagency mechanism with Treasury and State to address ongoing FATCA implementation issues, such as recurring issues U.S. persons may have obtaining Social Security numbers. Treasury is responsible for leading efforts to establish such a mechanism; however, SSA's participation in such a mechanism on a continuing basis will help agencies address remaining issues Americans living abroad experience from FATCA.

Recommendation: The Director of CFPB should identify additional sources of information, such as through registering CRAs or leveraging state information, that would help ensure the agency is tracking all CRAs that meet the larger participant threshold. (Recommendation 1)

Agency: Consumer Financial Protection Bureau
Status: Open

Comments: In July 2020, CFPB staff noted that they have reviewed state CRA registration information available to them, are working to obtain additional state registration information, and are exploring additional ways to leverage the information. GAO will continue to monitor CFPB's progress in leveraging additional sources of information that would help identify larger participant CRAs.

Recommendation: The Director of CFPB should assess whether its process for prioritizing CRA examinations sufficiently incorporates the data security risks CRAs pose to consumers, and take any needed steps identified by the assessment to more sufficiently incorporate these risks. (Recommendation 2)

Agency: Consumer Financial Protection Bureau
Status: Open

Comments: In July 2020, CFPB staff noted that they were assessing whether, and if so, how and when, to incorporate data security risks into their supervisory prioritization. As part of that evaluation, CFPB is assessing whether those processes should incorporate data security risks CRAs pose to consumers in light of the agency's statutory authorities, supervisory responsibilities, and resources. GAO will continue monitoring CFPB's assessment of prioritization of CRA data security risks.

Recommendation: Congress should consider providing the Federal Trade Commission with civil penalty authority for the privacy and safeguarding provisions of the Gramm-Leach-Bliley Act to help ensure that the agency has the tools it needs to most effectively act against data privacy and security violations. (Matter for Consideration 1)

Agency: Congress
Status: Open

Comments: As of July 2020, Congress has not passed legislation to provide FTC with civil penalty authority for the privacy and safeguarding provisions of the Gramm-Leach-Bliley Act.

Recommendation: The Senior Deputy Comptroller for Large Bank Supervision should revise Large Bank Supervisions policy to require documentation of examination teams internal deliberations that lead to consequential decisions for the bank, such as the decision whether to issue a Matter Requiring Attention, among others. (Recommendation 1)

Agency: Department of the Treasury: Office of the Comptroller of the Currency
Status: Open

Comments: As of July 2020, OCC continued to disagree with GAO's recommendation and stated that it neither has taken nor plans to take any actions to address it. We maintain that consistently documenting internal deliberations that lead to consequential decisions for the bank could increase the transparency and accountability of examination teams' findings and decisions.

Recommendation: The Senior Deputy Comptroller for Large Bank Supervision should revise Large Bank Supervisions policy to require that bank examination teams retain drafts of key documents, including the conclusion memorandum and supervisory letter, that record the supervisory review process. (Recommendation 2)

Agency: Department of the Treasury: Office of the Comptroller of the Currency
Status: Open

Comments: As of July 2020, OCC continued to disagree with GAO's recommendation and stated that it neither has taken nor plans to take any actions to address it. We maintain that revising the policy to ensure that drafts of key documents are not deleted will help OCC increase the transparency and accountability of the supervisory review process.

Recommendation: The Senior Deputy Comptroller for Large Bank Supervision should revise Large Bank Supervisions policy to require documentation of communications with banks, including those between executive and senior management and banks, that inform supervisory decisions. (Recommendation 3)

Agency: Department of the Treasury: Office of the Comptroller of the Currency
Status: Open

Comments: As of July 2020, OCC continued to disagree with GAO's recommendation and stated that it neither has taken nor plans to take any actions to address it. We maintain that having meeting minutes and other documentation of key communications would provide OCC with a more complete and transparent record of the information banks provide to examiners and how that information impacts supervisory decisions.

Recommendation: The Senior Deputy Comptroller for Large Bank Supervision should systematically track and monitor Large Bank Supervisions use of informal recommendations. (Recommendation 4)

Agency: Department of the Treasury: Office of the Comptroller of the Currency
Status: Open

Comments: As of July 2020, OCC continued to disagree with GAO's recommendation and stated that it neither has taken nor plans to take any actions to address it. We maintain that tracking and monitoring the use of informal recommendations could increase transparency of the supervisory process, which could help Large Bank Supervision mitigate the risk of regulatory capture.

Recommendation: The Chief Counsel should develop a policy for Large Bank Supervision (1) to check employees active conflicts of interests during the staffing process for examinations and other supervisory activities and (2) to document the results of this check. (Recommendation 6)

Agency: Department of the Treasury: Office of the Comptroller of the Currency
Status: Open

Comments: As of July 2020,, OCC continued to disagree with GAO's recommendation and does not plan to develop a policy to check if employees have active conflicts of interest during the staffing process for examinations and other supervisory activities. OCC noted in its December 2018 response letter to the report that they believed such a policy would shift the responsibility for ensuring compliance with recusal requirements from employees to those responsible for staffing. We maintain that this recommendation does not aim to alleviate the personal responsibility all employees have to comply with recusal requirements. Rather, our recommendation aims to strengthen the due diligence of those responsible for staffing by requiring an independent, preliminary check of active conflicts of interest.

Recommendation: The Director of the Consumer Financial Protection Bureau should engage in collaborative discussions with other relevant financial regulators in a group that includes all relevant stakeholders and has defined agency roles and outcomes to address issues related to consumers' use of account aggregation services. (Recommendation 5)

Agency: Consumer Financial Protection Bureau
Status: Open

Comments: In a May 2018 letter, the Acting Director of the Bureau stated that the Bureau has previously issued principles that include reasonable and practical means for consumers to dispute and resolve instances of unauthorized payments conducted in connection with or as a result of authorized or unauthorized data sharing access. The letter notes that the Bureau is committed to monitoring developments in data aggregation markets and will continue to assess how the Bureau's consumer protection principles may be best realized, including engaging in discussions with other relevant federal and state financial regulators. In October 2018, Bureau staff advised us that they made a presentation on existing consumer protections that would appear to be applicable to consumers using data aggregators at the June 28, 2018 meeting of the Fintech Interagency Discussion Group, which includes OCC, the Federal Reserve, the Federal Deposit Insurance Corporation, and the National Credit Union Administration. They noted they are monitoring private sector efforts related to resolving data aggregation issues and that additional discussions among the regulators about these issues will be held in the future. We will recontact the agency in the future to obtain information on additional actions it has taken. In January 2020, GAO met with CFPB to discuss the recommendation and potential outcomes that could close the recommendation. CFPB officials stated that they will be hosting a public forum on data aggregation in February 2020. They noted that results from the public forum could include action related to the data aggregation recommendation.

Recommendation: The Chair of the Board of Governors of the Federal Reserve System should engage in collaborative discussions with other relevant financial regulators in a group that includes all relevant stakeholders and has defined agency roles and outcomes to address issues related to consumers' use of account aggregation services. (Recommendation 6)

Agency: Federal Reserve System: Board of Governors
Status: Open
Priority recommendation

Comments: In a May 2018 letter, the Chair of the Federal Reserve Board noted that the Federal Reserve recognizes the importance of working together to determine how best to encourage socially beneficial innovation in the marketplace, while ensuring that consumers' interests are protected. The letter noted that the Federal Reserve staff have been meeting with other regulators and industry participants. The Chair states that the Federal Reserve will continue to facilitate and engage in collaborative discussions with other relevant financial regulators in these and other settings to help market participants address the important issues surrounding reimbursement for consumers who use financial account aggregators and experience unauthorized transactions. In October 2018, Federal Reserve staff advised us that issues related to data aggregation were discussed at a June 28, 2018 meeting of the Fintech Interagency Discussion Group, which includes OCC, the Federal Reserve, the Federal Deposit Insurance Corporation, the National Credit Union Administration, and the Consumer Financial Protection Bureau. They noted that they are monitoring private sector efforts related to resolving data aggregation issues and expect to hold additional discussions among the regulators about these issues in the future. In March 2019, the agency noted that it continues to collaborate on this issue. As of February 2020, the agency had no further updates on this recommendation. We plan to follow up with Federal Reserve staff to obtain updates on these efforts in the future.

Recommendation: The Chairman of the Federal Deposit Insurance Corporation should engage in collaborative discussions with other relevant financial regulators in a group that includes all relevant stakeholders and has defined agency roles and outcomes to address issues related to consumers' use of account aggregation services. (Recommendation 7)

Agency: Federal Deposit Insurance Corporation
Status: Open
Priority recommendation

Comments: In November 2018, FDIC staff confirmed that they have engaged in collaborative discussions with other relevant financial regulators regarding issues related to consumers' use of account aggregation services and associated liability issues. We followed up in April 2019 and they confirmed that their collaboration had yet to produce outcomes that would satisfy the recommendation.

Recommendation: The Chairman of the National Credit Union Administration should engage in collaborative discussions with other relevant financial regulators in a group that includes all relevant stakeholders and has defined agency roles and outcomes to address issues related to consumers' use of account aggregation services. (Recommendation 8)

Agency: National Credit Union Administration
Status: Open

Comments: In July 2018, NCUA staff indicated that staff from their agency had recently participated in a discussion forum with other federal regulators and other stakeholders on fintech, and, in particular, account aggregation challenges. They stated that they intend to continue to engage other regulators and related industry stakeholders on fintech topics and emerging technology that can have an impact on credit unions and their consumers. In October 2018, NCUA staff advised us that they have been discussing issues related to data aggregation at meetings of the Fintech Interagency Discussion Group, which includes OCC, the Federal Reserve, the Federal Deposit Insurance Corporation, the National Credit Union Administration, and the Bureau of Consumer Financial Protection. In November 2019, NCUA staff said that the agency continues to participate in meetings through the Fintech Interagency Discussion Group and had taken part in a Data Symposium held by the San Francisco Federal Reserve. We plan to follow up with NCUA staff to obtain updates on these efforts and resulting outcomes in the future.

Recommendation: The Comptroller of the Currency should engage in collaborative discussions with other relevant financial regulators in a group that includes all relevant stakeholders and has defined agency roles and outcomes to address issues related to consumers' use of account aggregation services. (Recommendation 9)

Agency: Department of the Treasury: Office of the Comptroller of the Currency
Status: Open

Comments: In a May 2018 letter, OCC noted that its staff have met with the other banking regulators and with market participants about account aggregation issues in the past. In October 2018, OCC staff advised us that issues related to data aggregation were discussed at a June 28, 2018 meeting of the Fintech Interagency Discussion Group, which includes OCC, the Federal Reserve, the Federal Deposit Insurance Corporation, the National Credit Union Administration, and the Bureau of Consumer Financial Protection. We followed up in January 2020 and they confirmed that their collaboration had yet to produce outcomes that would satisfy the recommendation. We plan to follow up with OCC staff to obtain updates on these efforts in the future.

Recommendation: The Chairman of the National Credit Union Administration should formally evaluate the feasibility and benefit of establishing an office of innovation or clear contact point, including at least a website with a dedicated email address. (Recommendation 11)

Agency: National Credit Union Administration
Status: Open

Comments: NCUA officials told us that in August 2018 the agency established a working group to formally evaluate the feasibility of establishing a dedicated work unit to oversee and lead fintech and innovation efforts, including creating a website and monitoring a dedicated e-mail account. NCUA officials indicated that as of November 2019 the working group was deliberating key considerations related to establishing a dedicated work unit. We plan to follow up with NCUA staff to obtain updates on these efforts in the future.

Recommendation: The Chair of the Board of Governors of the Federal Reserve System should formally evaluate the feasibility and benefits to their regulatory capacities of adopting certain knowledge-building initiatives related to financial innovation. (Recommendation 12)

Agency: Federal Reserve System: Board of Governors
Status: Open

Comments: In a May 2018 letter, the Chair of the Federal Reserve Board noted that the Federal Reserve recognizes the importance of formally increasing its knowledge base related to financial innovation. The letter noted that the Federal Reserve has recently organized two nationwide teams of experts tasked with monitoring fintech and related emerging technology trends as they relate to its supervisory and payment system mandates, respectively. These new teams include representation from all of the Federal Reserve System's Reserve Banks and have leadership from Board staff. These teams' critical objectives include ensuring that fintech-related information is shared across the Federal Reserve System and is used to inform relevant supervisory, policy, and outreach strategies. As of February 2020, the agency had no updates on this recommendation. We plan to follow up with Federal Reserve staff to obtain updates on these efforts in the future.

Recommendation: The Chairman of the Commodity Futures Trading Commission should formally evaluate the feasibility and benefits to their regulatory capacities of adopting certain knowledge-building initiatives related to financial innovation. (Recommendation 13)

Agency: Commodity Futures Trading Commission
Status: Open

Comments: We followed up in January 2020 and CFTC described its efforts to address this recommendation, which were encouraging. We are awaiting documentation of these efforts and when we confirm the agency's actions, we will provide updated information.

Recommendation: The Chairman of the National Credit Union Administration should formally evaluate the feasibility and benefits to their regulatory capacities of adopting certain knowledge-building initiatives related to financial innovation. (Recommendation 15)

Agency: National Credit Union Administration
Status: Open

Comments: NCUA officials told us that, as of November 2019, the internal working group that the agency established in August 2018 was evaluating the feasibility and benefits of adopting certain knowledge-building initiatives related to financial innovation. Specifically, the working group was assessing initiatives such as stakeholder outreach, research and collaboration opportunities, grants and other technical assistance, and existing supervisory tools. We plan to follow up with NCUA staff to obtain updates on these efforts in the future.

Recommendation: The Director of CFPB should issue public information on its plans for reviewing regulations applicable to banks and credit unions, including information describing the scope of regulations the timing and frequency of the reviews, and the extent to which the reviews will be coordinated with the federal depository institution regulators as part of their periodic EGRPRA reviews. (Recommendation 2)

Agency: Consumer Financial Protection Bureau
Status: Open

Comments: CFPB staff noted in a letter in April 2018 that CFPB had issued requests for information (RFI) on the regulations their agency had adopted and inherited from other agencies. These requests seek public comment on the need to amend these regulations. They noted that they included in their spring and fall 2017 Semiannual Regulatory Agenda descriptions of two initiatives intended to review their regulations to identify opportunities to modernize and streamline provisions. In addition, they noted they had created an internal task force to coordinate and bolster continuing efforts to identify and relieve regulatory burdens. They stated that they would continue to publish information on their plans for reviewing regulations as appropriate. We plan to continue following up with CFPB to determine the extent to which they have published information on their plans to review the burden of their agency's regulations.

Recommendation: As the Board of Governors implements plans to develop an ERM framework, it should include a component to identify and assess risks of regulatory capture across the LISCC program. (Recommendation 1)

Agency: Federal Reserve System: Board of Governors
Status: Open

Comments: In September 2020, the Federal Reserve told us the status of their response to this recommendation had remained unchanged since their August 2018 update. In August 2018, the Board of Governors reported to us that it was developing its ERM framework. The Board added that it was establishing a Board Risk Committee (comprised of senior leaders) to oversee its ERM program and serve as the central forum for addressing Board-wide risk issues. The Board also said that it has begun to implement a number of strategic components of the ERM framework. In August 2019, the Board stated that in their view, the ERM framework they are developing would not significantly alter the management processes that the Board and System have in place under the LISCC program that continue to work effectively. The Board reported to us that it has continued to develop the ERM program with guidance of the Board Risk Committee, which meets quarterly, and continues to serve as the central forum for Board-wide risk issues and oversight of the ERM program. In August 2020, the Board added that it would take several years to develop the ERM program. The Board also will continue to implement strategic components of the ERM framework throughout the Board.

Recommendation: The Board of Governors should finalize and implement program-wide guidance for the LISCC Reserve Banks on implementing LISCC policies. (Recommendation 2)

Agency: Federal Reserve System: Board of Governors
Status: Open

Comments: In September 2020, the Federal Reserve told us the status of their response to this recommendation had remained unchanged since their August 2019 update. In August 2019, the Board of Governors told us that the LISCC supervisory program had taken several steps to "finalize and implement program-wide guidance for the LISCC Reserve Banks on implementing LISCC policies." The Board reported that in 2017 it had issued a near-final LISCC program manual, which they said will memorialize all aspects of the LISCC supervisory program. The Board added the updated manual will reflect the results of a self-assessment of the LISCC Program's first full year of operations under the LISCC core program model, and the initial implementation of the new Large Financial Institution Ratings Framework. The Board also said that, since the last update, the LISCC supervisory program's operating policies, procedures, and templates for the conduct of supervisory activities have been completed and implemented.

Recommendation: The Board of Governors should streamline its conflict-of-interest disclosure review process for participants in the LISCC program, such as by storing disclosure information in compatible electronic systems. (Recommendation 4)

Agency: Federal Reserve System: Board of Governors
Status: Open

Comments: In September 2020, the Federal Reserve told us the status of their response to this recommendation had remained unchanged since their August 2018 update. In August 2018, the Board of Governors told us that they were assessing the feasibility of integrating existing electronic systems. They added that they have drafted guidance that develops a LISCC-specific conflicts of interest and examiner credential program that will seek to ensure consistency in the interpretation and application of conflicts of interest rules for all staff, both at the Board and the Reserve Banks, that participate in the LISCC supervisory program. They said that the Board plans to issue this guidance and begin implementation of a more consistent and centralized disclosure review approach in 2018. In addition, they said that they have begun collecting and storing conflicts of interest disclosure information for all LISCC participants, including Board LISCC staff, in one electronic system. They added that they have provided initial training to Board LISCC staff on the disclosure review process and the electronic system to ensure consistent collection of conflicts of interest data for all LISCC participants.

Recommendation: The Board of Governors should systematically collect and maintain information on the institutions supervisory employees work for before they are hired by the Federal Reserve and their employment destination when they leave. (Recommendation 5)

Agency: Federal Reserve System: Board of Governors
Status: Open

Comments: In September 2020, the Federal Reserve told us the status of their response to this recommendation had remained unchanged since their August 2018 update. In August 2018, the Board of Governors told us that they had implemented policies intended to mitigate the risk that an employee may be influenced by prior employment or the prospect of future employment and place their private interests ahead of the organization's supervisory mission. As an example, they said that recently the Federal Reserve broadened the scope of post-employment restrictions applicable to senior examiners. They added that the Board has begun to develop a more systematic approach to collect and monitor pre- and post-employment data through the use of an electronic system. They said that this updated electronic system is scheduled to be released, for both Board and Reserve Banks use, in 2019.

Recommendation: The Board of Governors should conduct a periodic self-assessment of ethics programs, policies, and procedures that apply to LISCC program participants. (Recommendation 6)

Agency: Federal Reserve System: Board of Governors
Status: Open

Comments: In September 2020, the Federal Reserve told us the status of their response to this recommendation had remained unchanged since their August 2018 update. In August 2018, the Board of Governors told us that their Ethics program staff and Supervision & Regulation staff are jointly assessing the current ethics programs, policies, and procedures applicable to LISCC program participants. The Federal Reserve expects to finalize and implement new conflicts of interest policies and procedures applicable to LISCC participants in 2019.

Recommendation: To strengthen the scenario design process, the Federal Reserve should assess--and adjust as necessary--the overall level of severity of its severely adverse scenario by expanding consideration of the trade-offs associated with different degrees of severity.

Agency: Federal Reserve System
Status: Open
Priority recommendation

Comments: In January 2019, the Federal Reserve said it had initiated two projects that would allow a more efficient evaluation of multiple scenarios, including assessing trade-offs associated with different levels of scenario severity. In December 2019, Federal Reserve staff provided updates on these projects, which remain in progress. We will continue to monitor the Federal Reserve's completion and implementation of these projects and any additional actions it takes that may be responsive to our recommendation.

Recommendation: To improve understanding of the range of potential crises against which the banking system would be resilient and the outcomes that might result from different scenarios, the Federal Reserve should assess whether a single severe supervisory scenario is sufficient to inform CCAR decisions and promote the resilience of the banking system. Such an assessment could include conducting sensitivity analysis involving multiple severe supervisory scenarios--potentially using CCAR data for a cycle that is already complete, to avoid concerns about tailoring the scenario to achieve a particular outcome.

Agency: Federal Reserve System
Status: Open
Priority recommendation

Comments: In January 2019, the Federal Reserve said it had initiated two projects that would allow a more efficient evaluation of multiple scenarios. In December 2019, Federal Reserve staff provided updates on these projects, which remain in progress. We will continue to monitor the Federal Reserve's completion and implementation of these projects and any additional actions it takes that may be responsive to our recommendation.

Recommendation: To improve the Federal Reserve's ability to manage model risk and ensure that decisions based on supervisory stress test results are informed by an understanding of model risk, the Federal Reserve should design and implement a process to test and document the sensitivity and uncertainty of the model system's output--the post-stress capital ratios used to make CCAR quantitative assessment determinations--including, at a minimum, the cumulative uncertainty surrounding the capital ratios and their sensitivity to key model parameters, specifications, and assumptions from across the system of models.

Agency: Federal Reserve System
Status: Open
Priority recommendation

Comments: In January 2019, the Federal Reserve said it had previously initiated multiple projects to fully respond to our recommendation, several of which were now complete. In December 2019, Federal Reserve staff provided updates on the remaining projects, which remain in various stages of completion. We will continue to monitor the Federal Reserve's completion and implementation of these projects and, once we receive documentation demonstrating the completion of responsive actions, we will update the status of this recommendation.

Recommendation: To improve the Federal Reserve's ability to manage model risk and ensure that decisions based on supervisory stress test results are informed by an understanding of model risk, the Federal Reserve should design and implement a process to communicate information about the range and sources of uncertainty surrounding the post-stress capital ratio estimates to the Board during CCAR deliberations.

Agency: Federal Reserve System
Status: Open
Priority recommendation

Comments: In January 2019, the Federal Reserve said it had previously initiated a project to fully respond to our recommendation. In December 2019, Federal Reserve staff provided updates on the project, but as of February 2020, had not provided documentation fully supporting implementation of a process consistent with our recommendation. We will continue to monitor the Federal Reserve's completion and implementation of this project, and we will update the status of this recommendation once we receive documentation demonstrating the completion of responsive actions.

Recommendation: To improve the Federal Reserve's ability to manage model risk and ensure that decisions based on supervisory stress test results are informed by an understanding of model risk, the Federal Reserve should design and implement a process for the Board and senior staff to articulate tolerance levels for key risks identified through sensitivity testing and for the degree of uncertainty in the projected capital ratios.

Agency: Federal Reserve System
Status: Open
Priority recommendation

Comments: In January 2019, the Federal Reserve said it had previously initiated a project to fully respond to our recommendation. In December 2019, Federal Reserve staff provided updates on the project, but as of February 2020, had not provided documentation fully supporting implementation of a process consistent with our recommendation. We will continue to monitor the Federal Reserve's completion and implementation of this project, and we will update the status of this recommendation once we receive documentation demonstrating the completion of responsive actions.

Recommendation: To ensure that FHFA has adequate authority to ensure the safety and soundness of the enterprises and to clarify its supervisory role, Congress should consider granting FHFA explicit authority to examine third parties that do business with and play a critical role in the operations of the enterprises.

Agency: Congress
Status: Open

Comments: As of March 2020, Congress has not taken action on this matter.

Recommendation: Congress should consider whether additional changes to the financial regulatory structure are needed to reduce or better manage fragmentation and overlap in the oversight of financial institutions and activities to improve (1) the efficiency and effectiveness of oversight; (2) the consistency of consumer and investor protections; and (3) the consistency of financial oversight for similar institutions, products, risks, and services. For example, Congress could consider consolidating the number of federal agencies involved in overseeing the safety and soundness of depository institutions, combining the entities involved in overseeing the securities and derivatives markets, transferring the remaining prudential regulators' consumer protection authorities over large depository institutions to the Consumer Financial Protection Bureau, and the optimal role for the federal government in insurance regulation, among other considerations.

Agency: Congress
Status: Open

Comments: At least two bills have been introduced in the 115th Congress that would change the financial regulatory structure, to some degree, to address fragmented and overlapping regulatory authorities among agencies, as GAO suggested in February 2016. The Financial CHOICE Act of 2017 (H.R. 10) was introduced on April 26, 2017, passed the House in June 2017 and the Senate held hearings in July 2017. Among other things, the Financial CHOICE Act of 2017 calls for the federal financial regulatory agencies to implement policies and procedures to minimize the duplication of effort with respect to enforcement actions. For example, it eliminates the authority of the Consumer Financial Protection Bureau to supervise and examine financial institutions and also eliminates the regulatory and enforcement authority of the agency with respect to unfair, deceptive, and abusive acts and practices by depository institutions. Such actions could help reduce fragmentation and overlap in the financial regulatory structure. In addition, the Economic Growth, Regulatory Relief, and Consumer Protection Act (S.2155) was introduced on November 16, 2017 and passed in the Senate in March 2018. The bill, to some extent, may help address fragmentation, overlap, and duplication in the financial regulatory structure. For example, the bill helps to address fragmentation in insurance oversight by finding that the federal agencies and office involved in insurance regulation should achieve consensus with state insurance regulators when they participate in negotiations on insurance issues before any international forum of financial regulators or supervisors, and create an advisory committee to discuss and report on insurance policy issues including international issues. GAO will continue to monitor the reform efforts to determine the extent to which they could help to address fragmentation and overlap between the federal financial regulatory agencies and reduce opportunities for inefficiencies in the regulatory process and inconsistencies in how regulators conduct oversight activities over similar types of institutions, products, and risks.

Recommendation: Congress should consider whether legislative changes are necessary to align FSOC's authorities with its mission to respond to systemic risks. Congress could do so by making changes to FSOC's mission, its authorities, or both, or to the missions and authorities of one or more of the FSOC member agencies to support a stronger link between the responsibility and capacity to respond to systemic risks. In doing so, Congress could solicit information from FSOC on the effective scope of its collective designation authorities, including any gaps.

Agency: Congress
Status: Open

Comments: While some legislative action has been taken that may alter FSOC's authorities, it is not clear that the legislation would address GAO's February 2016 suggestion. The Financial CHOICE Act of 2017 (H.R. 10) was introduced on April 26, 2017, passed the House in June 2017, and the Senate held hearings in July 2017. The bill would change FSOC's authorities by repealing its authorities to designate non-bank financial institutions and financial market utilities (i.e., payment, clearing, and settlement systems) as "systemically important." In addition, the Economic Growth, Regulatory Relief, and Consumer Protection Act (S.2155) was introduced on November 16, 2017 and passed in the Senate in March 2018. The bill may alter some of FSOC's authorities. However, it is unclear if these acts would alter FSOC's mission to better align it with its authorities to respond to systemic risk or addresses a gap in systemic risk mitigation mechanisms. Without legislative changes that would align FSOC's authorities with its mission, FSOC may lack the tools it needs to comprehensively address systemic risks that may emerge and a gap will continue to exist in the mechanisms for mitigating systemic risks. GAO will continue to monitor the reform efforts to determine the extent to which they help to align FSOC's authorities with its mission to respond to systemic risks.

Recommendation: To ensure that NCUA has adequate authority to determine the safety and soundness of credit unions, Congress should consider modifying the Federal Credit Union Act to grant NCUA authority to examine technology service providers of credit unions.

Agency: Congress
Status: Open

Comments: In July 2015, we suggested that Congress modify the Federal Credit Union Act to grant NCUA authority to examine technology service providers of credit unions. As of July 2020, Congress had not granted NCUA this authority.

Recommendation: To enhance the effectiveness of its preparations for conducting a retrospective review of its QM regulations, HUD should develop a plan that identifies the metrics, baselines, and analytical methods to be used. Furthermore, to account for and help mitigate the limitations of existing data and the uncertain availability of enhanced datasets, HUD should include in its plan alternate metrics, baselines, and analytical methods that could be used data were to remain unavailable.

Agency: Department of Housing and Urban Development
Status: Open

Comments: In February 2017, HUD noted that it does not currently collect data on the annual percentage rate (APR) for each loan that would allow for a perfect comparison to the average prime offer rate. According to HUD, its Office of Housing has on its long-term list of systems priorities to collect specific information from the Uniform Closing Data that could be used to conduct such a comparison. However, HUD stated that it has not received adequate funding to meet these systems enhancements. According to HUD, it is considering the feasibility and potential utility of alternative data sources or the use of a proxy in an appropriate methodology. For instance, whether it may be possible to approximate the APR based upon the note rate and information on closing costs that is collected in the current data system, or alternatively, whether the APR could be obtained or approximated through matching Home Mortgage Disclosure Act data for FHA loans. In a September 2020 email, HUD officials stated that HUD has certain unique considerations for review of its own QM rule as compared to the other federal agencies covered in the GAO report. HUD officials explained that HUD's QM rule implemented certain changes intended to conform with the Consumer Financial Protection Bureau's (CFPB) rule and constituted only a small subset of FHA's overall requirements related to underwriting and loan characteristics. According to HUD officials, HUD's QM rule was intended to make conforming changes to FHA's requirements, as statutorily required, in order to bring them into greater alignment with the new CFPB-promulgated QM rule requirements. They stated that HUD assesses FHA loan performance on an ongoing basis through a variety of mechanisms including the annual audit requirement and monitoring of the overall market and mortgage portfolio. According to the HUD officials, these mechanisms are used to assess the need for adjustments in underwriting criteria and mortgage insurance premiums as well as to assess the health and risks to safety and soundness of the MMIF Fund. HUD officials said that given these considerations, there is no specific stand-alone full evaluation of the HUD QM rule planned at this time.

Recommendation: To help ensure that FSOC is comprehensively identifying and considering companies, the Secretary of the Treasury in consultation with FSOC members, should establish procedures to evaluate companies in Stage 2 and Stage 3 under both statutory determination standards when an evaluation in either stage concludes that a company does not meet one of the standards, or document--on a company-specific or more general basis--why the second determination standard is not relevant for determination evaluations.

Agency: Department of the Treasury: Financial Stability Oversight Council
Status: Open

Comments: In December 2019, FSOC adopted final interpretive guidance that revises its approach to evaluating and determining whether to designate nonbank financial companies. The final revised guidance prioritizes an activities-based approach to identifying and addressing potential risks to financial stability and states that FSOC will pursue company-specific determinations only if the activities-based approach is not sufficient. The guidance further states that if FSOC does consider a company-specific determination, its evaluation will focus primarily on the first determination standard. The guidance does not indicate the establishment of procedures to evaluate companies under both determination standards for the purpose of comprehensively identifying and considering companies or to document why the other standard is not relevant. We will continue to monitor FSOC's implementation of the guidance and any additional actions that may be responsive to our recommendation.

Recommendation: To help ensure that FSOC is comprehensively identifying and considering companies, the Secretary of the Treasury in consultation with FSOC members, should develop a process to collect information necessary for Stage 1 analysis, as appropriate, from certain nonbank financial companies for which public or regulatory information is otherwise unavailable. For example, FSOC could have companies for which such information is unavailable and that meet certain characteristics (such as quantitative thresholds similar to those used in Stage 1) report necessary information to the Office of Financial Research.

Agency: Department of the Treasury: Financial Stability Oversight Council
Status: Open

Comments: In December 2019, FSOC adopted final interpretive guidance that revises its approach to evaluating and determining whether to designate nonbank financial companies. The final revised guidance introduces a new stage 1 of the designation process in which FSOC would notify a nonbank financial company under review and consider available public and regulatory information. While the guidance states that a company under review in stage 1 may submit information it deems relevant to the evaluation, FSOC would not require the company to submit information during stage 1. We will continue to monitor FSOC's implementation of the revised guidance and any additional actions that may be responsive to our recommendation.

Recommendation: Congress should consider strengthening the current consumer privacy framework to reflect the effects of changes in technology and the marketplace--particularly in relation to consumer data used for marketing purposes--while also ensuring that any limitations on data collection and sharing do not unduly inhibit the economic and other benefits to industry and consumers that data sharing can accord. Among the issues that should be considered are: (1) the adequacy of consumers' ability to access, correct, and control their personal information in circumstances beyond those currently accorded under FCRA; (2) whether there should be additional controls on the types of personal or sensitive information that may or may not be collected and shared; (3) changes needed, if any, in the permitted sources and methods for data collection; and (4) privacy controls related to new technologies, such as web tracking and mobile devices.

Agency: Congress
Status: Open

Comments: As of July 2020, Congress has not taken action on this matter.

Recommendation: FSOC and OFR should clarify responsibility for implementing requirements to monitor threats to financial stability across FSOC and OFR, including FSOC members and member agencies, to better ensure that the monitoring and analysis of the financial system are comprehensive and not unnecessarily duplicative.

Agency: Department of the Treasury: Financial Stability Oversight Council
Status: Open

Comments: In October 2019, Treasury staff said that steps continue to be taken to clarify roles and responsibilities across FSOC and OFR for monitoring threats to financial stability. Treasury staff said that they are working with OFR to reorganize and restructure the organization to better fulfill its mission and support FSOC. That work is still underway and will include additional clarification of roles and responsibilities. In June 2019, the Senate confirmed a new OFR Director. Treasury published a report in response to the President's executive order (13772) on Core Principles for Regulating the United States Financial System that recommended the structure and mission of the Office of Financial Research should be reformed to improve its effectiveness and to ensure greater accountability. We will continue to monitor progress in implementing these steps.

Recommendation: FSOC and OFR should clarify responsibility for implementing requirements to monitor threats to financial stability across FSOC and OFR, including FSOC members and member agencies, to better ensure that the monitoring and analysis of the financial system are comprehensive and not unnecessarily duplicative.

Agency: Department of the Treasury: Financial Stability Oversight Council: Office of Financial Research
Status: Open

Comments: In October 2019 Treasury staff said that steps are being taken to clarify roles and responsibilities across FSOC and OFR for monitoring threats to financial stability. Treasury staff said that they are working with OFR to reorganize and restructure the organization to better fulfill its mission and support FSOC. That work is still underway as staff from both entities meet on a weekly basis and will include additional clarification of roles and responsibilities. The Senate confirmed a new OFR director in June 2019. In June 2017, Treasury published a report in response to the President's executive order (13772) on Core Principles for Regulating the United States Financial System that recommended the structure and mission of the Office of Financial Research should be reformed to improve its effectiveness and to ensure greater accountability. We continue to monitor FSOC and OFR actions that would be responsive to clarifying responsibilities for monitoring threats to financial stability.

Recommendation: While creating control systems at the same time that the emergency programs were being designed and implemented posed unique challenges, the recent crisis provided invaluable experience that the Federal Reserve System can apply in the future should the use of these authorities again become warranted. Going forward, to further strengthen policies for selecting vendors, ensuring the transparency and consistency of decision making involving the implementation of any future emergency programs, and managing risks related to these programs, the Chairman of the Federal Reserve Board should direct Federal Reserve Board and Reserve Bank staff to strengthen procedures in place to guide Reserve Banks' efforts to manage emergency program access for higher-risk borrowers by providing more specific guidance on how Reserve Bank staff should exercise discretion and document decisions to restrict or deny program access for depository institutions and primary dealers that would otherwise be eligible for emergency assistance.

Agency: Federal Reserve System: Board of Governors
Status: Open

Comments: We most recently sought information from the Board of Governors of the Federal Reserve System in July 2018 regarding the status of the recommendation but did not receive any new information. Therefore, the recommendation remains open.

Recommendation: While creating control systems at the same time that the emergency programs were being designed and implemented posed unique challenges, the recent crisis provided invaluable experience that the Federal Reserve System can apply in the future should the use of these authorities again become warranted. Going forward, to further strengthen policies for selecting vendors, ensuring the transparency and consistency of decision making involving the implementation of any future emergency programs, and managing risks related to these programs, the Chairman of the Federal Reserve Board should direct Federal Reserve Board and Reserve Bank staff to document a plan for estimating and tracking losses that could occur under more adverse economic conditions within and across all emergency lending activities and for using this information to inform policy decisions, such as decisions to limit risk exposures through program design or restrictions applied to eligible borrowing institutions.

Agency: Federal Reserve System: Board of Governors
Status: Open

Comments: We most recently sought information from the Board of Governors of the Federal Reserve System in July 2018 regarding the status of the recommendation but did not receive any new information. Therefore, the recommendation remains open.

Recommendation: While creating control systems at the same time that the emergency programs were being designed and implemented posed unique challenges, the recent crisis provided invaluable experience that the Federal Reserve System can apply in the future should the use of these authorities again become warranted. Going forward, to further strengthen policies for selecting vendors, ensuring the transparency and consistency of decision making involving the implementation of any future emergency programs, and managing risks related to these programs, the Chairman of the Federal Reserve Board should direct Federal Reserve Board and Reserve Bank staff to document the Federal Reserve Board's guidance to Reserve Banks on types of emergency program decisions and risk events that require approval by or consultation with the Board of Governors, the Federal Open Market Committee, or other designated groups or officials at the Federal Reserve Board.

Agency: Federal Reserve System: Board of Governors
Status: Open

Comments: We most recently sought information from the Board of Governors of the Federal Reserve System in July 2018 regarding the status of the recommendation but did not receive any new information. Therefore, the recommendation remains open.

Recommendation: Should the program be extended beyond 2009, to ensure that the maximum amount of capital ends up in low-income community businesses, Congress may wish to consider offering grants to CDEs that would provide the funds to low-income community businesses. If it does so, Congress may wish to require Treasury to gather appropriate data to assess whether and to what extent the grant program increases the amount of federal subsidy provided to low-income community businesses compared to the NMTC; whether the grant program otherwise affects the success of efforts to assist low-income communities; and how costs for administering the program incurred by the CDFI Fund, CDEs, and investors would change. One option may be for Congress to set aside a portion of funds to be used as grants and a portion to be used as tax credit allocation authority under the current structure of the program in a future allocation round to facilitate comparison of the two program structures.

Agency: Congress
Status: Open

Comments: No legislative action has been identified as of March 2020. Section 141 of division Q of the Further Consolidated Appropriations Act, 2020, extended NMTC through 2020 (Public Law 116-94). However, this act did not offer grants in lieu of credits, as GAO suggested in January 2010. The Joint Committee on Taxation estimates the cost of this extension to be approximately $1.5 billion. Offering grants in lieu of NMTCs could result in a greater portion of the federal subsidy reaching low-income community businesses.

Recommendation: To address the current information gap in Regulation SHO for prime brokerage arrangements and mitigate the impact of any unintended consequences caused by SEC rules, as well as ensure consistent implementation of SEC rules by the industry, the Chairman of the Securities and Exchange Commission should finalize, in an expedited manner upon finalization of the temporary rule, the revised 1994 Prime Broker Letter.

Agency: United States Securities and Exchange Commission
Status: Open

Comments: As of June 4, 2019, the revised Prime Broker letter has not been finalized. Staff from the Reg SHO team in SEC's Trading and Markets division stated that they have regularly and continuously asked the industry for comments on the Prime Broker Letter without receiving any real progress. Their most recent request for comments was emailed to industry counsel on May 22, 2019. Industry counsel acknowledged the request but have yet to provide comments.