Assessment of Civil Money Penalty Against American Express Bank International and American Express Travel Related Services Company, Inc

UNITED STATES OF AMERICA
DEPARTMENT OF THE TREASURY
FINANCIAL CRIMES ENFORCEMENT NETWORK
AMERICAN EXPRESS BANK INTERNATIONAL
MIAMI, FLORIDA
AMERICAN EXPRESS TRAVEL RELATED
SERVICES COMPANY, INC.
SAL T LAKE CITY, UTAH
)
)
)
)
)
)
)
)
)
)
)
Number 2007- 1
IN THE MATTER OF:
ASSESSMENT OF CIVIL MONEY PENALTY
I. INTRODUCTION
Under the authority of the Bank Secrecy Act and regulations issued pursuant to that Act,! the Financial Crimes Enforcement Network has determined that grounds exist to assess a civil money penalty against American Express Bank International, Miami, Florida, ("the Bank") and American Express Travel Related Services Company, Inc., Salt Lake City, Utah, (collectively, "American Express"). To resolve this matter, and only for that purpose, American Express has entered into a CONSENT TO THE ASSESSMENT OF CIVIL MONEY PENALTY ("CONSENT") without admitting or denying the determinations by the Financial Crimes Enforcement Network, as described in SectionsIII and IV below, except as to jurisdiction in
Section II below, which is admitted.
The CONSENT is incorporated into this ASSESSMENT OF CIVIL MONEY PENALTY ("ASSESSMENT") by this reference.
II. JURISDICTION
American Express Bank International is an Edge Act corporation organized under section 25A of the Federal Reserve Act. The Board of Governors of the Federal Reserve System ("Federal Reserve") is the federal functional regulator for American Express Bank International and examines the Bank for compliance with the Bank Secrecy Act, its implementing regulations, and similar rules under Title 12 of the United States Code. 131 U.S.c. § 5311 et seq. and 31 C.P.R. Part 103.

American Express Travel Related Services Company is a money services business, located in Salt Lake City, Utah, that issues, sells and redeems traveler's checks, exchanges currency and provides check cashing and money transmission services, within the United States and U.S. Territories. At all relevant times, the aforementionedAmerican Express entities were "financial institutions" within the meaning of the Bank Secrecy Act and the regulations issued pursuant to that Act.2
III. DETERMINATIONS
A. Summary
American Express Bank International's anti-money laundering program was deficient in three of the four core elements. Namely, the Bank failed to implement adequate internal controls, failed to conduct adequate independent testing, and failed to designate compliance personnel to ensure compliance with the Bank Secrecy Act. American Express Bank International's high-risk customer base, product lines, and international jurisdiction of operations required elevated measures to manage the risk of money laundering and other financial crimes. Nevertheless, the Bank conducted business without adequate systems and controls reasonably designed to manage the risk of money laundering, including the potential for Black Market Peso Exchange3 transactions that may be used by Colombian drug cartels to launder the proceeds of narcotics sales. American Express Bank International's failure to comply with the Bank Secrecy Act and the regulations issued pursuant to that Act were serious, repeated and systemic. Additionally, a review by the Financial Crimes Enforcement Network of American Express Travel Related Services Company revealed a substantial number of failuresto file timely, accurate and complete suspicious activity reports involving over $500 million in suspicious transactions. B. Violations of the Requirement to Implement an Anti-Money Laundering Program American Express Bank International provides traditional private banking services, including secured lending and asset management to a target customer base of high net-worth individuals and their businesses throughout Latin America. The Financial Crimes Enforcement Network determined that American Express Bank International violated the requirement to establish and implement an adequate anti-money laundering program. Since April 24, 2002, the Bank Secrecy Act and its implementing regulations have required banks to establish and implement anti-money launderingprograms.4 The anti-money laundering program of American Express Bank International would meet these requirements if the program conforms to rules of the Federal Reserve that govern anti-money laundering programs. The Federal Reserve has required a program reasonably designed to assure 231 US.C. § 5312(a)(2) and 31 C.F.R. § 103.11. 3See FinCEN Advisorv Issue 9 (November 1997) and FinCEN Advisorv Issue 12 (June 1999), at www.fincen.gov. 431 US.c. § 5318(h)(I) and 31 C.F.R. § 103.120.

and monitor compliance with reporting and record keeping requirements under the Bank Secrecy Act.5 Reporting requirements under the Bank Secrecy Act include the requirement to report suspicious transactions.6 The Board of Governors of the Federal Reserve System also requires that an anti-money laundering program contain the following elements: (1) system of internal controls; (2) independent testing for compliance; (3) designation of an individual, or individuals, to coordinate and monitor day-to-day compliance; and (4) training of appropriate personne1.7

1. Internal Controls
   American Express Bank International failed to implement internal controls reasonably designed to comply with the Bank Secrecy Act. American Express Bank International conducted business without adequate systems and controls, as appropriate and practical, to detect and timely report suspicious activity. American Express Bank International did not implement adequate policies, procedures and internal controls across the institution, particularly with regard to customers presenting a higher risk for money laundering. The Bank repeatedly failed, over the course of multiple regulatory examinations dated June 2,2003, July 6,2004, July 11, 2005, and September 12, 2006, with increasingly adverse findings, to implement effective account monitoring controls to ensure compliance with the Bank Secrecy Act. For example:
   . Review parameters for customer account activity were not risk focused, nor designed to target specific account activity with an elevated potential for money laundering; Review parameters for transaction activity in a number of customer accounts were set at a high or excessive level, thereby substantially reducing the likelihood that suspicious activity would be detected; Processes for exempting certain accounts from transaction monitoring reviews to detect suspicious activity lacked any writtenjustification or rationale for the exemptions; Measures to fully identify account relationships involving Private Investment Companies (PICs) and bearer share accounts, to assess and manage the potential risk for money laundering in these accountswere not effectively implemented; and Periodic reviews of high-risk accounts, to determine whether account activity deviated from expected activity in customer profiles, were not conducted in a manner to adequately detect and report suspicious activity, or in accordancewith Bank policy. Furthermore, these periodic reviews were conducted on an individual account level, as opposed to an entire aggregate customer relationship basis. As a result, when a customer maintained multiple accounts, aggregate activity across these accounts was not captured and analyzed to gain a complete picture of the potential for money laundering and other illicit activity. . . . . The internal control processes governing the suspicious activity reporting program at American Express Bank International were not sufficient to comply with the Bank Secrecy Act. 5 12 C.F.R. § 208.63(b)(1) and 12C.F.R. § 211.5(m). 631 C.F.R. § 103.18. 712 C.F.R. § 208.63(c)(1) - (4) and 12 C.F.R. § 211.5(m).

The monitoring system for suspicious activity reporting compliance at the Bank exhibited persistent data integrity issues. These issues were so seriousthat American Express Bank International suspended use of the system in early 2007, and implemented an interim monitoring system, pending correction of data integrity issues and review of system thresholds for suspicious activity monitoring. In addition, in September 2006, prior to suspending the use of the suspicious activity monitoring system, the Bank had a backlog of hundreds of suspicious activity alerts awaiting review. Furthermore, one individual had authority to unilaterally clear suspicious activity alerts without adequate oversight or controlsto ensure appropriate and timely disposition of the alerts. As a result of these problems, American Express Bank International failed to file timely suspicious activity reports.
2. Independent Testing
American Express Bank International's independent testing of its Bank Secrecy Act program was ineffective. Internal Audit Staff lacked sufficient training and knowledge to facilitate compliance with the Bank Secrecy Act. Audit scopeswere not always tailored or designed to capture and test for compliance with certain requirements of the Bank Secrecy Act. Internal Audit staff also failed to conductsufficient customer transaction testing to adequately evaluate the overall sufficiency of the anti-money laundering program at the Bank. Furthermore, Internal Audit failed to assist management with tracking and following-up on previously identified regulatory examination deficiencies. In addition, Internal Audit failed to conduct adequate testing of the suspicious activity monitoring system or identify the numerous data integrity concerns associated with this system for an extended period of time. The ineffectiveness of the Internal Audit function at American Express Bank International contributed to the failure to identify significant deficiencies in this system before 2007.
3. Designation of an Individual or Individualsto Ensure Compliance with the
Bank Secrecy Act
In view of the scope, volume and nature of activity at American Express Bank International, management failed to designate enough personnel to ensure day-to-day compliance with the Bank Secrecy Act. Furthermore, compliance roles and responsibilities were not adequately defined and implemented with respect to gathering, integrating and responding to information such as validating customer records, reconciling data involving high-risk customers with customer profile documentation, and escalating or sharing identified negative customer information among appropriate personnel at the Bank. For example, management failed to ensure that compliance personnel independently validated customer information provided by the account relationship managers, and periodic customer account reviews did not document an analysis of transactional activity for deviations from expected activity. In addition, reviews performed by compliance personnel were conducted on a singular account basis rather than in the context of a customer's entire relationship with the Bank.

c. Violations of the Requirement to Report SuspiciousTransactions
The Financial Crimes Enforcement Network has determined that American Express violated the suspicious transaction reporting requirements of the Bank Secrecy Act and regulations issued pursuant to that Act. These reporting requirementsimpose an obligation on financial institutions to report transactions that involve or aggregate to at least $5,000, are conducted by, at, or through the financial institution, and that the institution "knows, suspects, or has reason to suspect" are suspicious.8 A transaction is "suspicious')if the transaction: (1) involves funds derived from illegal activities, or is conducted to disguise funds derived from illegal activities; (2) is designed to evade the reporting or record keeping requirements of the Bank Secrecy Act or regulations under the Bank Secrecy Act; or (3) has no business or apparent lawful purpose and the financial institution knows of no reasonable explanation for the transaction after examining the available facts, including background and possible purpose of the transaction. 9 Financial institutions must report suspicious transactions by filing suspicious activity reports and must generally do so no later than thirty (30) calendar days after detecting facts that may constitute a basis for filing such reports. 10 If no suspect was identified on the date of detection, a bank may delay the filing for an additional thirty (30) calendar days in order to identify a suspect, but in no event may the bank file a suspicious activity report more than sixty (60) calendar days after the date of initial detection. 11 American Express violated the suspicioustransaction reporting requirements of 31 U.S.c. § 5318(g) and 31 C.F.R. § 103.18 or31 C.F.R. § 103.20,by failing to timely and/or accurately file a substantial number of suspicious activity reports. The Financial Crimes Enforcement Network determined that American Express Travel Related Services Company failed to timely file over 1,000 Suspicious Activity Report by Money Services Business forms ("SAR-MSB"), during the period from May 7,2006 through May 7, 2007, with suspicious transactions totaling over $500 million. Furthermore, a total of 1,639 SAR-MSBs filed by American Express Travel Related Services Company, between May 7,2006 and May 7, 2007, were found tocontain over 2,000 errors. Numerous filings contained multiple errors where sections of the form requiring data were left blank, incorrectly completed, or referred to another section of the form that lacked the referenced information. American Express Travel Related Services Company often completed critical reporting fields by referencing the narrative portion of the form, or attachments,in direct contradiction to the form instructions. The SAR-MSB filing instructions explain how reporting fields are to be populated so data is retrievable and available to law enforcement. Contrary to the instructions on 831 C.F.R. § 103. 18(a)(2) and 31 C.F.R. § 103.20(a)(3). For purposes of31 C.F.R. § 103.20(a)(3), the
$5,000 aggregate threshold applies to suspicious transactions derived from a review of clearance records of money orders or travelers checks that have been sold or processed by an issuer. All oth~r suspicious transactions require reporting when the transaction aggregates to $2,000 as defined under 31 C.F.R. § 103.20(a)(2). 931 C.F.R. § 103.18(a)(2)(i) - (iii) and 31 C.F.R. § 103.20(a)(2)(i)- (iii). 31 C.F.R. § 103.20(a)(2)(iv)also defmes a transaction as suspicious when it involves use of the money services business to facilitate criminal activity. 1031 C.F.R. § 103.18 and 31 C.F.R. § 103.20. 1131 C.F.R. § 103.18(b)(3).

the fonn, American Express Travel Related Services Company utilized phrases such as "See Narrative" and "See Attachment" in contradiction of the obligation to complete multiple Part I Subject Infonnation reporting fields and PART III Transaction Location Infonnation reporting fields in the SAR-MSBs even when the infonnation to complete the required fields was known. Moreover, there were multiple instances where the narrative portion of the fonn was referenced in a field that required specific data. However, in some instancesthe narrative portion did not contain any infonnation relating to the blank reporting field, thereby significantly undennining the purpose of the required reporting fieldsto make infonnation available for use in investigations by government authorities. The above described delays and errors impaired the usefulness of the suspicious activity reports by not providing law enforcement with more timely and accurate infonnation related to over $500 million in suspicious transactions.
IV. CIVIL MONEY PENALTY
Under the authority of the Bank Secrecy Act and the regulations issued pursuant to that Act,12 the Financial Crimes Enforcement Network has detennined that a civil money penalty is due for violations of the Bank Secrecy Act, and the regulations issued pursuant to that Act, as described in this ASSESSMENT. Based on the seriousness of the violations at issue in this matter, and the financial resources available to American Express, the Financial Crimes Enforcement Network has detennined that the appropriate penalty in this matter is $25,000,000.
V. CONSENT TO ASSESSMENT
To resolve this matter, and only for that purpose, American Express Bank International and American Express Travel Related Services Company, without admitting or denying either the facts or detenninations described in Sections III and IV above, except as to jurisdiction in
Section II, which is admitted, consent to the assessment of a civil money penalty in the aggregate
sum of$25,000,000, of which $20,000,000 is allocated to American Express Bank International and $5,000,000 is allocated to American Express Travel Related Services. This assessment is being issued concurrently with the Deferred Prosecution Agreement and accompanying $55,000,000 forfeiture by the Department of Justice against American Express Bank International, and a Cease and Desist Order and $20,000,000 civil money penalty by the Federal Reserve against American Express Bank International. As for the method of payment, the $25,000,000 civil money penalty by the Financial Crimes Enforcement Network shall be deemed as satisfied by a single $10,000,000 payment to the Department of the Treasury. The remaining $15,000,000 of the Financial Crimes Enforcement Network's penalty against American Express Bank International shall be deemed as satisfied by a portion of the $55,000,000 forfeiture to the Department of Justice. American Express agrees to pay the amount of $10,000,000 within five (5) business days of this ASSESSMENT to the Department of the Treasury. 12 31 D.S.C. § 5321 and 31 C.F.R. § 103.57.