Bank Secrecy Act Violation: How One Credit Union Caught It, Survived and Avoided Millions in Fines

MEDFORD, N.Y.-Ed Boughal, CEO of Suffolk Federal Credit Union, thought he was doing the right thing when he decided the credit union was large enough to hire an internal auditor. Previously, the job had been farmed out and Suffolk FCU was given a clean bill of health. When the newly-hired internal auditor performed her first review, Boughal discovered this was not entirely true. She found numerous instances where Currency Transaction Reports should have been filed and were not. Financial institutions are supposed to file CTRs with each single or multiple transaction involving currency totaling more than $10,000, under the Bank Secrecy Act. CTRs are used in criminal, tax, and regulatory investigations and proceedings, according to the Financial Crimes Enforcement Network’s (FinCEN’s) Web site (www.fincen.gov). Boughal said an experienced branch manager challenged the audit, so the CEO requested that the internal auditor perform the audit again. She came to the same conclusions. Boughal eventually fired the branch manager for this situation and other reasons, he said. When the information was handed over to NCUA, the agency ran with it. Suffolk was warned of the possibility of millions of dollars in fines. NCUA Director of External Affairs Nicholas Owens said, “It is NCUA’s policy to not discuss supervision issues of a credit union. In regard to BSA, the NCUA expects credit unions to perform proper due diligence on all critical aspects of BSA compliance.” “I think everybody’s getting caught up in the same thing after 9/11. It’s a classic overreaction.” Boughal said. He admitted the credit union had a 20% failure rate to file CTRs, but having caught the problem, voluntarily handing the internal audit over to NCUA, and beginning work to correct it, Boughal thought the agency reaction was a bit much. However, he added, “As a CEO, you have to be very careful of the times.” He pointed out that NCUA Board Member JoAnn Johnson had testified before the Senate Banking Committee on BSA compliance around the same time. Boughal, concerned about the possibility of millions in fines against the $685 million credit union, went to FinCEN and explained the situation. The filing failures were not malicious; tellers were just trying to get members through the lines at two of Suffolk FCU’s busiest branches, he surmised. He admitted the tellers were not properly educated on the importance of the CTRs. The FinCEN agent recommended he explain the situation in writing and there likely would not be any fines. Suffolk FCU was never assessed a monetary penalty, but the credit union paid. At the end of 2004, NCUA slapped Suffolk FCU with a Letter of Understanding and Agreement (LUA), the only credit union to receive one for a BSA violation in recent times. “I felt we were penalized for taking the correct action,” Boughal said. Under the LUA, Suffolk FCU was required to: 1)take immediate steps to investigate CTR and Suspicious Activity Report violations from Jan. 1, 1999 to present. The credit union also had to create a schedule of all cash activity greater than $7,000 and file missing CTRs and subsequent SARs by Oct. 31, 2005. 2)update its compliance program by Nov. 30, 2004 with an eye toward its BSA policy; 3)lower its cash activity report threshold from $7,000 to $3,000 by Nov. 30, 2004; 4)hire an independent outside consultant/auditing firm with BSA expertise by March 31, 2005; 5)hire an outside firm to validate that management has completed these steps by Dec. 31, 2005; 6)provide, at a minimum, semi-annual training on BSA-related transactions; 7)conduct monthly BSA compliance audits until there are three consecutive months without any violations and perform them quarterly after that at least through the end of 2005. According to Boughal, the credit union has complied with all this, yet the LUA has not been lifted. NCUA would not comment on the institution’s compliance or when the LUA might be terminated. Going back over five years of paperwork searching for failures to file CTRs cost $50,000 just in hiring new staff to do it, Boughal explained. He called the requirement a “political reaction.” He stated, “FinCEN, they don’t want that. You’re just dumping paper on their desk.” Suffolk FCU also hired an outside firm to revamp its BSA policy. In addition, NCUA is in the credit union every six months for examination. For the last exam last October, NCUA was at the credit union eight weeks, Boughal said. The agency found everything in order, he said. Boughal added, “The real issue is how we hurt the members.” He said having to keep up normal business operations while performing the review caused a strain. “It’s the zealous application of the laws that cause the unintended consequences,” he opined. “They’re trying to cure something that is political in nature. A regulator with the best of intentions can get caught up in the hot button issue at the time.” Boughal said he felt “to a certain extent we were made an example of.” First, because of the battle against terrorist financing, and, second, he believed the agency was not happy that he contacted FinCEN directly. He also said the time taken to do the second internal audit may have hurt him. For credit unions that find themselves in BSA trouble in the future, Boughal offered, “Don’t be so headstrong. Work with the examiner as much as you can. Don’t argue about the substance of it.” But, most importantly, he said, make sure your institution is in compliance and the internal audit regularly reviews that. “It was an experience,” he lamented. “It was not a very nice experience.” [email protected]