Bank Secrecy Act and Anti-Money
Total Page:16
File Type:pdf, Size:1020Kb
ALERT JUNE 2020 Bank Secrecy Act and Anti-Money-Laundering Compliance in the COVID-19 Era: How Financial Institutions Can Manage Increased Risk From Stimulus and PPP Payments Justin C. Danilewitz | JosephA. Valenti | Allison L. Burdette The CARES Act pumped over two trillion dollars into the American economy, with much of that money going directly to individuals in the form of stimulus checks or to small businesses in the form of Paycheck Protection Program (“PPP”) loans. Many of those recipients will spend that money lawfully in any number of ways. Yet, as many recently announced prosecutions make clear, the stimulus and PPP injections have increased the opportunities for fraud. In turn, compliance risks are heightened for financial institutions—particularly Bank Secrecy Act and Anti-Money-Laundering (“BSA/AML”) risks. [1] In this article, we draw upon our experience in the federal government as well as in private practice to offer practical compliance guidance for financial institutions. Applying Risk-Based Post-COVID (and Traditional) BSA/AML Controls Regional banks, Small Business Administration (“SBA”) lenders, credit unions, community banks, and other financial institutions serving individuals or small businesses will need to remain vigilant in detecting COVID- related fraud, implementing new (often automated) controls to identify suspicious activity, and conducting prompt and accurate analysis of transactions and accounts. BSA/AML regulations continue to apply to all financial institutions, and safe-harbor provisions in the CARES Act and related regulations allowing lenders to rely upon borrower certifications may offer limited protections if lenders have not implemented risk-based compliance programs capable of detecting and preventing COVID-related fraud.[2] Particularly as consumers begin to spend their stimulus payments and PPP loan recipients seek forgiveness of their loans under the CARES Act, the risks to financial institutions from inadequate compliance programs will increase. Thus, with the money now disbursed, monitoring how it is spent will increase in importance. Meanwhile, many traditional red flags have not changed. For instance, large cash deposits from any entity that has not traditionally made such deposits with a clearly identifiable legitimate source (e.g., a licensed bar, a landscaping company, or a hair salon) typically warrant further inquiry from a financial institution because of concerns the funds may be illicit proceeds from what are known as “specified unlawful activities” or “SUAs.” But the infusion of funds in the current climate, which may be legitimately derived stimulus funds or PPP funds, may make it more difficult to identify suspicious deposit activity. After all, these infusions are by definition unusual for all individuals and entities receiving them. Financial institutions must not allow this high “noise” level to drown out the proverbial “signal” of illicit activity. DELAWARE FLORIDA ILLINOIS MARYLAND MASSACHUSETTS MINNESOTA NEW JERSEY NEW YORK PENNSYLVANIA WASHINGTON, DC www.saul.com ALERT On the other hand, seemingly normal activity may itself stand out as unusual, given the “new normal” to which all businesses have grown accustomed. For example, if a bar or hair salon continued making typical cash deposits during a lengthy span of a stay-at-home order requiring closure of such businesses, financial institutions may be viewed as being “on notice” of the “unusual” or “suspicious” activity. Thus, further inquiry may be warranted, but existing controls and algorithms may not be effective to detect this activity. At the same time, such technology-assisted surveillance would need to account for instances of appropriate continued transaction activity, such as a landscaping business continuing to generate cash. Thus, the technology must be sensitive and case-specific—while avoiding the generation of false positives or negatives—to ensure the compliance program is cost-effective, efficient, and timely. Improvements to existing computer software, or the development of improved artificial-intelligence tools, may be necessary to elevate potentially suspicious activity for human-level review and analysis. Using 2008 Financial-Crisis Lessons to Formulate Post-COVID BSA/AML Controls Understanding financial flows in a post-stimulus world will also be important. Looking back to the 2008 financial crisis, examples of how individual stimulus payments were spent may help to inform the analysis.[3] Individual stimulus payments are intended to be used for mortgage/rent, utilities, debt relief, groceries, transportation, medical expenses, and other essentials. Financial institutions should therefore naturally anticipate an uptick in activity relating to those payment/spending channels. But other financial transactions may warrant closer scrutiny. For instance, an account’s receipt of dozens of payments from seemingly unrelated parties may indicate use of a personal account as a business account—perhaps even for a stimulus-payment-centered Ponzi scheme or an illegal hoarding/price-gouging reseller of essential supplies. Where numerous individuals in a locality begin sending money to a new business, further investigation may be warranted, as local medical-supply, debt-relief, energy-switching/utility, or tax scams may be involved. A classic red flag associated with illegal online gaming remains prevalent today, where the unlawful gaming operation uses a false industry code (e.g., jewelry store) and/or an overseas location to bypass restrictions imposed by financial institutions and payment processors. This activity is often revealed when consumers receive credits or “refunds” (e.g., gaming winnings being paid) to their accounts that are larger than the initial “purchases.” Public reports, client inquiries, and conversations with numerous prosecutors and compliance officers around the country reveal that the PPP loans are creating similar issues. Small and large businesses alike, all desperate to open their doors to returning employees and customers, are actively seeking masks, hand sanitizer, cleaning products, and other recommended products and services. Meanwhile, opportunistic sellers may take advantage of this desperate need by either promising (and failing) to deliver these essential supplies, or delivering inferior product.[4] Naturally, these same individuals will seek ways to wash their ill- gotten gains by laundering them back into the financial system. FinCEN Guidance on COVID-19 Red Flags in Financial Transactions Indeed, FinCEN dedicated the first of its forthcoming advisories to this issue of scam detection, noting that “FinCEN identified the following red flag indicators to help financial institutions identify COVID-19- related medical scams, and to assist financial institutions in detecting, preventing, and reporting suspicious transactions associated with the COVID-19 pandemic”:[5] • A government agency publicly identifying a party (or one of its beneficial owners) to the transaction as selling fraudulent products or otherwise involved in crime; DELAWARE FLORIDA ILLINOIS MARYLAND MASSACHUSETTS MINNESOTA NEW JERSEY NEW YORK PENNSYLVANIA WASHINGTON, DC 2 ALERT • A web-based search or review of advertisements showing a party is selling at-home COVID-19 tests, treatments, vaccines, or cures or highly sought-after goods, such as hand sanitizer, toilet paper, masks, or anti-viral/disinfectant cleaning supplies—which either do not exist or are only legitimately available from well-known distributors; • A party’s website reflecting one or more suspicious indicia, including: ○ a name/web address or online branding photographs similar to real and well-known companies, ○ a limited internet presence, ○ a newly created website (particularly with no pre-existing physical business presence), ○ online contact or WHOIS information that is inconsistent with the confirmed websites of the known brand it purports to be, ○ a location outside of the United States, and/or ○ the ability to purchase pharmaceuticals without a prescription when one is usually required; • Corporate database searches revealing a merchant’s listing contains: ○ a vague or inappropriate company name, ○ a historic brand name that has been retired or updated, ○ multiple unrelated names, ○ a suspicious number of name variations, ○ multiple “doing business as” (DBA) names, or ○ information that does not align with its business model; • Repeated delays or refusals when asked to provide invoices, shipment tracking, or other documentation supporting the stated purpose of the transaction; • Invoice data or price advertising showing highly sought-after goods being sold at deeply discounted or highly inflated prices; • An inability to explain how highly sought-after goods were obtained for sale; • A personal account receiving payments related to the sale of medical supplies or deposits with payment messages suggesting that business is being conducted; • An individual retail customer of a financial institution setting up a medical supply company after January 2020 or selling highly sought-after goods online; • A new account receiving a large payment shortly after opening that was not mentioned during the account-opening process; • Requiring unusual payment terms or methods (such as a pre-paid card, the use of a money services business, convertible virtual currency, or payment via an electronic funds transfer to a high-risk jurisdiction or a country that is not normally part of the supply chain for the items at issue); DELAWARE FLORIDA ILLINOIS