Enforcement Alert: FinCEN Leverages “Gap Rule” for Violations of the Bank Secrecy Act

On September 15, 2023, the U.S. Department of the Treasury’s Financial Crimes Enforcement Network (“FinCEN”) announced its first “Gap Rule” enforcement action in a Consent Order with Bancrédito International Bank and Trust Corporation (“Bancrédito”), a Puerto Rican international banking entity (IBE).  This action marks FinCEN’s first use of its extended enforcement authority over banks without a federal functional regulator (31 C.F.R. § 1020.210(b), effective March 15, 2021) (the “Gap Rule”)) requiring them to have an anti-money laundering (AML) compliance program, and represents FinCEN’s first enforcement action against an IBE that was notably regulated only by the Office of the Commissioner of Financial Institutions of Puerto Rico (OCIF).  As part of the enforcement action, FinCEN assessed a $15 million civil monetary penalty against Bancrédito for willful violations of the Bank Secrecy Act (BSA).  Bancrédito admitted to failing to timely report suspicious transactions to FinCEN with Suspicious Activity Reports (SARs), failing to maintain a due diligence program for foreign correspondent accounts, and failing to implement an AML program. The Consent Order further highlighted that, during the relevant period, FinCEN had issued two advisories to financial institutions warning of the AML risks associated with Venezuela-connected customers and transactions and describing relevant red flags, putting Bancrédito on notice of the risks associated with its Venezuelan customers and business. 

FinCEN Firsts

• This enforcement action marks the first of its kind against an IBE and the first enforcement action under the Gap Rule. This action may signal a future focus on IBEs and the more than 500 banks that lack a federal functional regulator but are newly required to establish and maintain an AML compliance program under the BSA.[1]

• This enforcement action also represents the first action to be announced under FinCEN’s new Director, Andrea Gacki, who was appointed on July 13, 2023, and previously served as Director of the Office of Foreign Assets Control (OFAC).

Exercise of Gap Rule is Consistent with Expansion of Enforcement Priorities under AMLA

Effective March 15, 2021, FinCEN’s Gap Rule removed the AML program exemption for banks that lacked a federal functional regulator, including private banks, non-federally insured credit unions, certain trust companies, and IBEs.[2] These financial institutions were already required to comply with certain BSA obligations, such as filing SARs and currency transaction reports (“CTRs”). The Gap Rule, however, expanded the requirements for existing policies and procedures, including applying (1) minimum standards for AML programs, (2) customer identification programs, and (3) beneficial ownership requirements to those institutions.[3]

FinCEN’s exercise of its enforcement authorities under the Gap Rule is in line with expectations that the agency will focus on using the expanded authorities created by the sweeping reforms contained in the Anti-Money Laundering Act of 2020 (“AMLA 2020”). Aimed at strengthening the existing AML regime, the AMLA 2020 provided for, among other authorities, expanded whistleblower rewards and protections, the establishment of a beneficial ownership registration database, new BSA violations and enhanced BSA penalties for repeat and egregious violators and expanded extraterritorial subpoena power. To meet the demands anticipated by the expansion of FinCEN’s enforcement authorities, through Congressional appropriations, FinCEN expects to grow its ranks by an additional 60 employees, bringing total personnel count to over 400.  In addition, last year, FinCEN announced the formation of an Office of the Whistleblower. With a newly installed Director, financial institutions can expect to see increased enforcement efforts.

Bancrédito

Founded in 2008, Bancrédito was the oldest and one of the largest IBEs in Puerto Rico, providing banking services to foreign financial institutions primarily located in Central America and the Caribbean.[4] In January 2023, Bancrédito was seized by OCIF and placed into receivership after the bank became embroiled in a political bribery scandal involving its founder. Notably, the bank’s receiver signed FinCEN’s Consent Order, but, according to news reports, this was opposed by the bank’s sole shareholder, Bancrédito Holding Corporation, which denied any wrongdoing by the bank, and claimed that the receiver violated its fiduciary duty to the bank by agreeing to FinCEN’s penalty.

Even before the bribery scandal, Bancrédito had faced recurring regulatory scrutiny. As reported in numerous OCIF examinations, Bancrédito incurred repeated deficiencies and violations.[5]  According to the Consent Order, Bancrédito’s customer base, especially those customers with ties to the high-risk jurisdiction of Venezuela, placed the bank at an elevated risk, warranting robust BSA compliance. The Consent Order further notes that, during the relevant time period, FinCEN had issued two advisories warning of the AML risks associated with customers and transactions connected to Venezuela, which put Bancrédito on notice. According to the Consent Order, Bancrédito’s AML program nevertheless failed to appropriately account for these risks and the bank incurred numerous deficiencies and violations, reported in various OCIF examinations resulting in a Consent Order with OCIF in 2015.

FinCEN’s Consent Order

In the 2023 FinCEN Consent Order, Bancrédito admitted that it (1) failed to timely and adequately file SARs on suspicious transactions moving through the bank, (2) failed to establish an appropriate due diligence program for correspondent accounts for foreign financial institutions, and (3) failed to implement and maintain an adequate AML program. The Consent Order notes that, prior to 2016, and despite warnings from its primary regulator, Bancrédito did not file a single SAR on any transaction, despite moving large amounts of money internationally on behalf of high-risk customers, including customers located in Venezuela.  FinCEN independently identified hundreds of millions of dollars in additional suspicious transactions on which Bancrédito failed to file timely SARs, a sample of which are described in detail in the Consent Order. FinCEN also identified tens of thousands of transactions by high-risk accountholders processed through Bancrédito’s foreign correspondent accounts, representing hundreds of millions of dollars.  Bancrédito is also required to surrender its license to operate in the United States and to preserve all business records related to BSA compliance for a period of five years.

Factors affecting the size of the penalty are carefully detailed in the Consent Order, consistent with FinCEN’s 2020 Statement on Enforcement of the BSA. FinCEN’s penalty against Bancrédito is also in line with its more recent AML and Countering the Financing of Terrorism Priorities

(June 30, 2021), as required under the AMLA 2020.  

[1] Institutions lacking a federal functional regulator include state-chartered banks, non-depository trust companies, non-federally insured credit unions, and some international banking entities. Federal functional regulators include the Board of Governors of the Federal Reserve System, the Federal Deposit Insurance Corporation, the National Credit Union Administration, the Office of the Comptroller of the Currency, the Office of Thrift Supervision, the Securities and Exchange Commission, and the Commodity Futures Trading Commission. 

[2] IBEs were identified in the U.S. Department of the Treasury’s 2022 National Money Laundering Risk Assessment as having an elevated risk of money laundering. 

[3] See Customer Identification Programs, Anti-Money Laundering Programs, and Beneficial Ownership Requirements for Banks Lacking a Federal Functional Regulator, 81 Fed. Reg. 58425 (proposed Aug. 25, 2016) (to be codified at 31 C.F.R. Parts 1010 and 1020) (“Although banks that lack a Federal functional regulator have not been required to establish an AML program, they are required to comply with many other BSA requirements.”).

[4] IBEs operate in Puerto Rico under the International Banking Center Regulatory Act of 1989 but are prohibited from providing financial services to residents of Puerto Rico.  

[5] Bancrédito’s recidivist behavior included OCIF citations for AML-related deficiencies in 2010, 2012, and 2014, a consent order with OCIF in 2015, and citations for additional violations in 2017 and 2019. Bancrédito entered into a Memorandum of Understanding with OCIF in late 2021 under which it paid a fine and agreed to undertake remedial measures to address the ongoing violations.