How Sept. 11 Transformed Anti-Laundering Efforts

WASHINGTON — Unlike other changes spurred by the Sept. 11 attacks — like full-body scans and the term "homeland security" — patrolling the flow of illegal money was not a new concept in the fall of 2001.

The nation already had an anti-money laundering regime — mostly focused on drug traffickers — and banks were required to report suspicious transactions.

But the terrorist attacks, and the ensuing passage of the USA Patriot Act, opened a new chapter in anti-laundering enforcement that effectively rewrote the whole story from scratch.

"Up until 2001, a lot of banks were de-emphasizing anti-money laundering policies and procedures — not that banks wouldn't have them, but it wasn't considered a major priority. 9/11 dramatically changed that," said John Byrne, the executive vice president of the Association of Certified Anti-Money Laundering Specialists and a former AML executive with Bank of America Corp.

Ten years later, anti-laundering compliance is a central occupation for financial services firms, and many observers agree the ramped-up efforts by the government and banks to monitor transactions more closely has made us safer without driving banks out of business. Still, some say it took a long time to get there, and there are still holes to fill.

"Literally, it has taken a decade to really get your compliance arms around the USA Patriot Act for banks," said L. Richard Fischer, a partner at Morrison & Foerster. "Yes, there are issues that come up, and you see financial penalties periodically, sometimes very large, and yet in my judgment it's worth the fight in the sense that there is substantial benefit not only for the nation, … but also good for the financial institution itself."

Like many other elements of the Patriot Act, however, the resulting emphasis on banks keeping closer track of their customers and their money has raised significant civil liberties concern. Observers said the government must put limits on how much information a bank should be gathering about its customers and allow federal agencies to better share their intelligence with banks, instead of just vice versa.

"The enhanced programs and the enhanced effort … has also led to an unintended but unfortunately widespread belief among law enforcement and regulators that institutions should also take on the nearly impossible task of preventing financial crime," said Peter Djinis, a Sarasota, Fla.-based lawyer specializing in AML enforcement. "That's not so much detecting, but literally stopping it. Experience has taught us that the private sector can only play a supportive role at best in repelling financial criminals."

Following the attacks, banks joined congressional efforts to improve the nation's security apparatus. Before Sept. 11, some lawmakers — chiefly Sen. Carl Levin, D-Mich., whose hearings on improving ant-laundering enforcement had produced recommendations for reforms — had already constructed a template that was the basis for the financial-related provisions in the Patriot Act.

"They tried to get the legislation passed after the hearings, but some of the senators thought it would overburden the industry. Then, 9/11 happened. Immediately, people were looking for legislation to fix what happened," said Bob Serino, of counsel at BuckleySandler LLP and a former anti-laundering official at the Office of the Comptroller of the Currency.

The new law passed just weeks after the terrorist attacks with broad bipartisan and industry support.

"The financial industry had lost many of its own, and was united with the government in efforts to respond to the terrorist attacks," said Michael Dawson, a managing director at Promontory Financial Group who previously worked at the Treasury Department on counterterrorism initiatives.

The legislation strengthened key areas of AML regulation that had originated under the Bank Secrecy Act and been in use for the nineties-era war on drugs.

Although some banks had anti-laundering policies before the fall of 2001, the Patriot Act mandated them and subjected banks and nonbanks to exams over their AML policies.

While the suspicious activity report had been mandatory since 1996, the Patriot Act required banks to provide more details on any transactions they deemed potentially illicit, and extended the form to other industries, including money services businesses, casinos and pawn brokers.

Regulators also began to crack down on improper anti-laundering filings, leading to a huge increase in their overall numbers. Prior to 2001, banks filed a little more than 200,000 SARs each year. During the past three years, such filings have been near or above 700,000 annually.

Banks also became subject to "Know Your Customer" rules requiring customers to provide proof of their identities when they opened an account.

The Financial Crimes Enforcement Network, a unit of the Treasury Department since 1990, saw its rulemaking authority expanded to include monitoring of terrorism finance activities. Fincen became the gatekeeper for a new stepped-up effort for institutions to share information about suspicious customers with the government and with each other.

Steve Hudak, a spokesman for Fincen, said the terrorist attacks and the new legislation intensified the focus of bankers and regulators to refine AML enforcement.

"It's easy to forget that SAR reporting was only around for five years before 9/11. The Bank Secrecy Act established a foundation for collecting SARs and" currency-transaction reports "and those reports proved to be extremely useful in the future in combating terrorist finance," he said. "The Patriot Act reaffirmed that and broadened the scope of Fincen's responsibilities and also greatly solidified the relationship between the government and the financial industry in sharing information and working together to protect the financial system from criminals and possible terrorist financers.

"Particular programs are now part of the AML vocabulary, like section '314A' of the law, that allows direct communication between Fincen and law enforcement and the banking industry so information could be quickly gathered on any terrorist finance suspect."

Lawmakers granted banks a few concessions to ease their concerns about the new requirements, including allowing AML procedures to be risk-based.

"The government avoided, I think, what sometimes is the default approach, which is to be proscriptive. Instead, they said, 'You shall have a program and you, the financial industry, … shall determine the nature of the risk that you face,'" said Michael Zeldin, who was a special counsel on money-laundering issues in the Justice Department's criminal division and is now global leader on the anti-money laundering/trade sanctions team at Deloitte Financial Advisory Services LLP.

But it has taken years for the industry to adjust to the new regime, and in certain areas banks and policymakers are still adapting. Indeed, the Patriot Act was not the end of recent reforms to the AML landscape.

Just this summer, Fincen finalized a rule demanding stronger efforts to defend against laundering prepaid card products. The rule was required by the sweeping credit card reform law passed two years ago. Last year's Dodd-Frank Act also included new AML requirements.

Fischer said the Sept. 11 attacks and the security enhancements that followed did not necessarily replace efforts to stop the flow of drug money with counterterrorism, but rather led to a renewed focus on AML for monitoring all types of criminal activities. In fact, many recent AML-related enforcement orders against banks have involved accounts tied to narcotics operations.

"Now there is clearly a dual emphasis," he said. "They still have a primary focus on money-laundering for criminals, primarily drugs. But there is a new focus. Call it a dual focus or an additional focus on terrorist financing."

Despite the renewed focus on AML in the past decade, banks found several hiccups along the way to strengthening their reporting and monitoring, some of which they are still dealing with today.

Dawson said that after enactment of the Patriot Act, some institutions regretted pushing for a risk-based approach in their AML program because it led to a kind of guessing game between banks and their regulators about what types of anti-laundering steps were appropriate.

"Banks had wanted Congress to take a risk-based approach in the Patriot Act rather than a bright-line approach, and the industry by and large was satisfied with the final legislation," Dawson said. "But when rules were promulgated, the industry discovered that it was harder to put a risk-based approach into practice than a bright-line approach."

Institutions have also had to grapple with concerns that, despite the voluminous reporting now required at great cost to them, the government only looks at a small portion of the information that is submitted.

"As far as the rules and requirements, Fincen has been reasonable. But it's a constant, constant ramping up of monitoring, which is really outside of the Patriot Act. All of the elements that are required to meet the standards that are in place have just really increased," said Robert Rowe a vice president and senior counsel at the American Bankers Association.

But the industry is still hoping for improvement in the flow of information between banks and the government. While institutions report ample data to law enforcement, they in turn would like officials to share more information with them or at least be more responsive with feedback about the banks' reporting.

"Bank-to-bank works pretty well. Bank-to-government works pretty well. Where there is an opportunity for enhancement is in better information-sharing from the government to the private sector," said Zeldin.