Assessment of Civil Money Penalty Against Hawaiian Gardens Casino, Inc. d/b/a The Gardens Casino

UNITED STATES OF AMERICA DEPARTMENT OF THE TREASURY FINANCIAL CRIMES ENFORCEMENT NETWORK IN THE MATTER OF: ) ) ) ) Number 2016-04 Hawaiian Gardens Casino, Inc. ) dba The Gardens Casino ) ) Hawaiian Gardens, California ) ASSESSMENT OF CIVIL MONEY PENALTY I. INTRODUCTION The Financial Crimes Enforcement Network (FinCEN) has determined that grounds exist to assess a civil money penalty against Hawaiian Gardens Casino, Inc. dba The Gardens Casino (The Gardens), pursuant to the Bank Secrecy Act (BSA) and regulations issued pursuant to that Act.1

The Gardens admits to the facts set forth below and that its conduct violated the BSA. The Gardens consents to this assessment of a civil money penalty and enters into the CONSENT TO THE ASSESSMENT OF CIVIL MONEY PENALTY (CONSENT) with FinCEN. The CONSENT is incorporated into this ASSESSMENT OF CIVIL MONEY PENALTY (ASSESSMENT) by reference. FinCEN has authority to investigate casinos and card clubs for compliance with, and violations of, the BSA pursuant to 31 C.F.R. § 1010.810, which grants FinCEN “[o]verall authority

1 The Bank Secrecy Act is codified at 12 U.S.C. §§ 1829b, 1951-1959 and 31 U.S.C. §§ 5311-5314, 5316-5332. Regulations implementing the Bank Secrecy Act appear at 31 C.F.R. Chapter X.

2 for enforcement and compliance, including coordination and direction of procedures and activities of all other agencies exercising delegated authority under this chapter . . . .” The Gardens is a card club located in Hawaiian Gardens, California and has been in operation since 1995. It contains 225 table games, including baccarat, blackjack, poker, and Pai Gow. The Gardens was a “financial institution” and a “card club” within the meaning of the BSA and its implementing regulations during the time relevant to this action.2 The Internal Revenue Service (IRS) examines card clubs for compliance with the BSA pursuant to authority delegated by FinCEN. In 2011 and 2014, IRS examined The Gardens and identified significant BSA violations. II. DETERMINATIONS From September 1, 2009 through the present, The Gardens willfully violated the BSA’s program and reporting requirements. 3 As described below, The Gardens (a) failed to implement and maintain an effective anti-money laundering program; 4 (b) failed to report certain transactions involving currency in amounts greater than $10,000;5 (c) failed to report certain suspicious activity; 6 and (d) failed to keep certain appropriate records as required by the BSA and its implementing regulations. 7

2 31 U.S.C. § 5312(a)(2); 31 C.F.R. § 1010.100(t). 3 In civil enforcement of the Bank Secrecy Act under 31 U.S.C. § 5321(a)(1), to establish that a financial institution or individual acted willfully, the government need only show that the financial institution or individual acted with either reckless disregard or willful blindness. The government need not show that the entity or individual had knowledge that the conduct violated the Bank Secrecy Act, or that the entity or individual otherwise acted with an improper motive or bad purpose. The Gardens admits to “willfulness” only as the term is used in civil enforcement of the Bank Secrecy Act under 31 U.S.C. § 5321(a)(1). 4 31 U.S.C. §§ 5318(a)(2), 5318(h); 31 C.F.R. § 1021.210. 5 31 U.S.C § 5313 and 31 C.F.R. § 1021.311. 6 31 U.S.C. § 5318(g); 31 C.F.R. § 1021.320. 7 31 C.F.R. § 1021.410.

3 A. Violations of the Requirement to Establish and Implement an Effective Anti-Money Laundering Program The BSA and its implementing regulations require card clubs to develop and implement a written anti-money laundering (AML) program reasonably designed to assure and monitor compliance with the BSA.8 The Gardens is required to implement an AML program that, at a minimum, provided for: (a) a system of internal controls to assure ongoing compliance; (b) independent testing of the card club’s AML compliance program by card club personnel or parties external to the card club; (c) training of personnel; (d) the designation of an individual or individuals responsible for assuring day-to-day compliance; (e) procedures for using all available information to determine and verify name, address, social security or taxpayer identification number, and other identifying information for a person, to the extent determining and verifying the information is otherwise required under the BSA; (f) procedures for using all available information to determine the occurrence of any transactions or patterns of transactions required to be reported as suspicious; (g) procedures for using all available information to determine whether any records must be made and maintained pursuant to the BSA; and (h) for card clubs with automated data processing systems, use of such systems to aid in assuring compliance. 9 The Gardens failed to develop and implement an AML program that adequately provided for several of these requirements.

1. Internal Controls The Gardens failed to implement an adequate system of internal controls to ensure compliance with the BSA. Significantly, many of these problems spanned the course of several

8 31 U.S.C. §§ 5318(a)(2), 5318(h); 31 C.F.R. § 1021.210(b)(1). 9 31 C.F.R. § 1021.210(b)(2).

4 years. And, for many of these issues, IRS examiners first highlighted many of these deficiencies as early as 2011, but The Gardens did not rectify these problems, leading to rediscovery of many of these same internal control violations in the 2014 exam. Moreover, the independent consultant hired by The Gardens also identified many of these problems in 2013; but because The Gardens did not fully implement these recommendations, the problems continued. a. Policies and Procedures The Gardens’ written “Title 31 Compliance Policy” failed to cover all necessary elements required by BSA regulations – a finding further supported by The Gardens’ 2013 independent test. The compliance policy failed to adequately address, or The Gardens failed to implement procedures for – and in some cases, did not even discuss – a number of critical topics: transaction monitoring and red flags; customer identification and verification; preparing and filing currency transaction reports; and addressing adverse findings of independent compliance test results. In short, The Gardens failed to adequately address certain basic components of an anti-money laundering program based on the risks associated with a card club of its size. The Gardens’ inadequate internal controls made it susceptible to money laundering and terrorist financing activity. As discussed in more detail below, IRS examiners identified significant problems with The Gardens’ policies and procedures to file timely and accurate currency transaction reports and suspicious activity reports. Troublingly, many of these problems had been previously identified by the IRS years before during an examination in 2011. In particular, The Gardens had inadequate policies and procedures for customer identification, red flags, and possible structuring— which, as The Gardens’ own 2013 independent test identified, has a “domino effect” on other areas of BSA/AML compliance. Existing policies and procedures were not consistently implemented for customer identification on transactions less than $10,000, which significantly hindered The

5 Gardens’ ability to identify red flags or possible structuring at the facility. This deficiency was identified in the 2011 examination conducted by the IRS as well as the card club’s own 2013 independent test. b. Customer Identification The policies and procedures regarding customer identification were insufficient and were not effectually implemented. For example, The Gardens did not consistently implement its policy and procedure to review the “unknown” multiple transaction log entries for aggregate reportable transactions or potentially structured transactions. IRS examiners identified 62% of cash transactions in the multiple transaction log as conducted by “unknown,” which represents a significant compliance risk. This had a significant impact on the suspicious activity reports and currency transactions reports filed by The Gardens. Indeed, of the suspicious activity reports filed by The Gardens between January 1, 2013 and September 18, 2014, 80% had at least one unknown subject. In fact, according to the 2013 independent test, the Gardens had no policies or procedures in place to address patrons who refused to provide information. The 2013 independent test characterized the lack of these policies and procedures as deficiencies “jeopardizing the [The Gardens’] ability to comply with the laws and regulations under the Bank Secrecy Act.” The 2013 independent test further recommended that “[p]atrons who refuse to provide full identification…be placed on the Barred Patrons list and escorted from the casino property.” One such customer – known to The Gardens only by the alternate name “Michelle” – had been the subject of 15 prior suspicious activity reports and five currency transaction reports, but The Gardens failed to collect any identification on her. Furthermore, “Michelle” used agents, also unidentified by The Gardens, for structuring or attempting to structure transactions. On at least three separate occasions in 2013, The Gardens staff approached the customer to request

6 identification, but were unsuccessful. Despite this suspicious activity and the customer’s refusal to provide identification, the Gardens still allowed the customer, and her agents, to game at the Card Club and conduct financial transactions through 2014. When confronted by IRS examiners, The Gardens’ management argued that they did not believe they were required to bar patrons who refuse to provide identification and that doing this would cause them to lose customers to other card clubs in the area. The Gardens also lacked policies and procedures to explain and document its decisions not to file a suspicious activity report, and did not have policies for conducting 90-day reviews to determine if suspicious activity was continuing. These failures created significant challenges to ensuring that law enforcement received up-to-date information. c. Culture of Compliance According to its charter, The Gardens’ BSA committee included casino management and was required to meet once every three months, but only met once during all of 2013. This is particularly significant, as the charter of the BSA committee states, “[Suspicious Activity Reports] that involve employees or customers that are well known to the casino will be discussed before the [Suspicious Activity Report] is filed.” The fact that the committee did not meet for such a long period, in violation of its own charter, likely prevented the timely reporting of any suspicious activity involving employees or well-known customers. Additional evidence supports the fact that leadership at The Gardens did not take an active role as it should have in promoting a strong culture of compliance. For example, The Gardens’ risk assessment was not comprehensive as it did not discuss risk factors pertaining to the type of clientele served by the card club, the type and volume of transactions, geographic location, and risks associated with services provided. Further, the risk assessment was not reviewed and approved by

7 The Gardens’ leadership. The Gardens’ management also failed to establish policies and procedures regarding customers refusing to provide identification and customers for which there have been multiple suspicious activity and currency transaction reports filed. When problems were identified by The Gardens, they often went uncorrected for extended periods of time. For example, during the 2014 IRS examination, The Gardens’ Compliance Officer stated that some customers made large cash withdrawals with no play; however, despite self-identifying this issue in December 2013, The Gardens failed to implement policies and procedures to handle these situations as of June 2014 – six months later. 2. Compliance Officer The Gardens failed to have a qualified individual or individuals responsible for day-to-day BSA compliance as required by BSA regulations.10 The individual designated with responsibility over the BSA/AML program during the 2014 examination period had not worked in the gaming industry and did not have any BSA/AML experience prior to assuming his new role. The designated compliance officer admitted to the examiner that he was trying to learn BSA regulations and requirements while on the job. These shortcomings had consequences. Indeed, the significant weaknesses and violations identified in The Gardens’ internal controls persisted from 2009 through 2014, indicating that the BSA Compliance Officer did not effectively ensure day-to-day compliance with the BSA and did not effectively correct several BSA compliance deficiencies initially identified in the 2011 examination and continuing through the 2014 examination. And, as detailed below, this failure had a significant negative impact on The Gardens’ BSA filings, including the failure to file multiple suspicious activity reports and the filing of numerous reports with blank fields.

10 31 C.F.R. § 1021.210(b)(2)(iv).

8 3. Procedures for Using All Available Information The regulations covering card clubs (and casinos) require the institution to use all available information to identify and verify customer information including name, permanent address, Social Security number, and to determine occurrences of transactions or patterns of transactions that warrant the filing of a suspicious activity report. 11 The Gardens failed to use several pieces of information at its disposal. For instance, The Gardens had customer information collected through their player club cards, which are scanned and monitored by employees of The Gardens on an hourly basis. This customer information can be used to help identify customers and make determinations about whether filing a currency transaction report or suspicious activity report may be warranted. Like other casinos and card clubs, The Gardens also had significant surveillance covering the cages and casino floor. And (like any other financial institution), The Gardens had ample access to open source information, on the Internet and elsewhere, which would have supplied information that was otherwise omitted from The Gardens’ filings and reports, and which would have helped the card club to detect, report, and prevent illegal activity. The Gardens violated this requirement on multiple occasions, failing to obtain basic customer information. The Gardens did not attempt to match information within its own player club card database, resulting in incomplete filings. The Gardens’ electronic negotiable instrument log failed to list the name of the drawee in 75% of the records reviewed by the IRS examiner. Further, customer records frequently listed a P.O. Box number rather than a permanent address as required by the BSA, 12 despite the fact the card club’s internal records and basic Internet searches would have provided The Gardens all the information needed to complete many of the blank items in their

11 31 C.F.R. § 1021.210(b)(2)(v). 12 31 C.F.R. § 1021.410(b)(9).

9 records. These violations went uncorrected for more than a year after the independent test revealed the deficiency. The Gardens also failed to update and amend BSA reporting when The Gardens obtained new or more accurate information. Eighty percent of suspicious activity reports and five percent of currency transaction reports filed between January 1, 2013 and September 18, 2014 have at least one unknown subject. Similarly, unknown persons conducted an additional 347 transactions between $9,000 and $10,000 recorded in the multiple transaction log – notably, just below the filing threshold for currency transaction reporting – between October 1, 2013 and December 31, 2013. Despite having the tools to acquire and complete data fields in its BSA filings, The Gardens’ currency transaction reports and suspicious activity reports were not amended with updated information. B. Violations of Currency Transaction Reporting Requirements The BSA and its implementing regulations require card clubs to report transactions that involve either “cash in” or “cash out” of more than $10,000 during a single gaming day.13 Card clubs are also required to verify the identity of, and record information from, customers involved in transactions that generate currency transaction reports.14 A card club must aggregate transactions in currency, or treat the transactions as a single transaction, if the card club has knowledge that the transactions are conducted by, or on behalf of, the same person and occur within the same gaming day. 15

13 31 C.F.R. § 1021.311. 14 31 C.F.R. § 1021.312. 15 31 C.F.R. § 1021.313.

10 IRS’s 2011 examination identified 59 instances within the exam scope in which The Gardens filed currency transaction reports with insufficient information. FinCEN independently confirmed that 14.98% of the currency transaction reports filed by The Gardens in calendar year 2011 contained missing or unknown subjects; 14.13% were missing address information or listed a P.O. Box; and 16.81% contained a missing or unknown Social Security number. Notably, even after the IRS warned The Gardens about these problems in the 2011 exam (and The Gardens did not contest or address these IRS findings in their response to the 2011 examination), the problems were worse. In calendar year 2012, missing or unknown subjects were reported on 19.25% of The Gardens’ currency transaction reports; while 16.86% contained missing address information or listed a P.O Box address; and 19.52% had missing or unknown Social Security numbers. C. Violations of Suspicious Activity Reporting Requirements The BSA and its implementing regulations require card clubs to report a transaction that the card club “knows, suspects, or has reason to suspect” is suspicious, if the transaction is conducted or attempted by, at, or through the card club, and if the transaction involves or aggregates to at least $5,000 in funds or other assets.16 A transaction is “suspicious” if the transaction: (a) involves funds derived from illegal activity; (b) is intended or conducted in order to hide or disguise funds or assets derived from illegal activity; (c) is designed, whether through structuring or other means, to evade any requirement in the BSA or its implementing regulations; (d) has no business or apparent lawful purpose or is not the sort in which the particular customer would normally be expected to engage; or (e) involves use of the card club to facilitate criminal activity.17

16 31 C.F.R. § 1021.320(a)(2). 17 31 C.F.R. §§ 1021.320(a)(2)(i)-(iv).

11 As revealed in both the 2011 and 2014 examinations, The Gardens failed to file suspicious activity reports for several suspicious transactions. In the 2011 exam, IRS examiners discovered 14 instances in which The Gardens failed to file a suspicious activity report. These include instances in which customers refused to provide identification but continued gaming, attempted structuring, and suspicious patterns of activity by known customers. Despite these adverse findings from the 2011 examination, the problems persisted. As revealed in the 2014 examination, there were, again, numerous instances in which the Gardens failed to file suspicious activity reports or incompletely filed information on an additional 19 customers. In many instances, the customers in question had previously been subjects of suspicious activity reports filed by The Gardens. These issues – failures to file and failures to provide complete and accurate information – reveal a broader pattern of non-compliance. Even when SARs were filed by The Gardens, they frequently missed critical information and failed to provide context for broader suspicious activity. One customer, who conducted over $600,000 of cash in and cash out transactions over 47 gaming days, was the subject of a series of incomplete SARs filed which did not capture the extent or the nature of the suspicious transactions occurring at The Gardens. Despite conducting transactions for these 47 days, The Gardens failed to capture basic identifying information for the customer in its SARs including a permanent address or Social Security number. In addition, for this individual and generally, The Gardens did not identify patterns of transactions outside of a 24 hour period in its SAR filings. These incomplete filings lessen the value of SARs to law enforcement by failing to meaningfully capture the critical information necessary to understand the underlying criminal activity and the individuals involved. Significantly, some SAR filings, including those pertaining to

12 the above customer, also failed to identify the name of an employee that assisted in conducting structured transactions for this customer.18 D. Violations of Recordkeeping Requirements The BSA imposes special recordkeeping requirements on casinos and card clubs. Casinos and card clubs are required to maintain a separate record, called a negotiable instruments log, containing a list of each transaction between the casino or card club and its customers involving certain monetary instruments having a face value of $3,000 or more. The negotiable instruments log must contain the time, date, and amount of the transaction; the name and permanent address of the customer; the type of instrument; the name of the drawee or issuer of the instrument; and all reference numbers and the name or casino/card club license number of the employee who conducted the transaction. Applicable transactions must be placed on the list in chronological order.19 The Gardens violated this recordkeeping requirement. The 2014 IRS examination identified 40 recordkeeping violations in The Gardens’ negotiable instrument log – 100% of the reportable transactions. Every record on the log was incomplete in one or more ways including, for example, instances of missing the type of instrument, records missing the name of drawee, and multiple customers with a P.O. Box recorded when a permanent address is available and required.

18 In 2009, The Gardens’ surveillance video observed a customer structuring transactions with the assistance of employees. The customer attempted to cash out a $14,833 transaction, then ripped up the required IRS identification form in the presence of the cage cashier when asked to complete it. The customer then went to the Asian VIP section of the Gardens and enlisted the employee listed above, and another employee, to cash out the transaction into $10,000 and $4,000 amounts without providing identification information. Despite the employee’s complicity in this illegal conduct, the employee remained at The Gardens, which acknowledged the complicity (and reported it in a SAR) but continued to allow the employee to facilitate transactions, including this transaction in 2013 (which did not list the employee as a subject in the SAR). 19 31 C.F.R. § 1021.410(b)(9).

13 III. CIVIL MONEY PENALTY FinCEN has determined that The Gardens willfully violated the program, reporting, and recordkeeping requirements of the Bank Secrecy Act and its implementing regulations, as described in this ASSESSMENT, and that grounds exist to assess a civil money penalty for these violations.20

FinCEN has determined that the penalty in this matter will be $2,800,000. IV. UNDERTAKINGS By execution of the CONSENT, The Gardens agrees to the following UNDERTAKINGS: A. Risk Assessment. The Gardens will complete a new risk assessment within 90 days of the date of the CONSENT. The Gardens will provide the risk assessment to FinCEN and IRS. B. External Independent Reviewer. The Gardens will engage and retain an independent, external, qualified, and experienced external auditor (the Third-Party Reviewer), not subject to any conflict of interest, and subject to FinCEN’s determination of non-objection after FinCEN’s review of the engagement contract, to examine The Gardens’ Bank Secrecy Act compliance program and to conduct risk-based independent testing of The Gardens’ BSA/AML Program. The independent testing will test remedial steps taken to address all criticisms in the CONSENT. Three reviews will take place: the first will commence within 90 days of the completion of the risk assessment described above, the second examination will take place no later than 12 months after the completion of the first examination, and the remaining examination will take place no later than 24 months after the completion of the second examination. Each review will cover the prior year, with at least three months of transactional analysis to include a review of SAR filings for that time period. Based on the results of this review, The Gardens will file SARs or amend previously filed SARs, as appropriate, consistent with the SAR regulations for casinos and card clubs, and will

20 31 U.S.C. § 5321 and 31 C.F.R. § 1010.820.

14 advise FinCEN and IRS of the filings. The Third-Party Reviewer will prepare a written report for The Gardens setting forth its findings, and will transmit the report and all draft reports to FinCEN and IRS SB/SE simultaneously with any transmission to The Gardens or its agents. To the extent that the report identifies any material deficiencies in The Garden’ programs and procedures, The Gardens will address and rectify the deficiencies as soon as is reasonably practicable and will advise FinCEN and IRS SB/SE of the remedial steps taken. Failure to comply with any of these UNDERTAKINGS will constitute a violation of the CONSENT. If FinCEN determines that a failure to comply with any of the UNDERTAKINGS has occurred, FinCEN may take any enforcement action against The Gardens it deems appropriate, notwithstanding the below Release in Part VII. Additional actions taken by FinCEN may include, but are not limited to, the imposition of additional civil money penalties, injunctive orders, or ordering other remedial actions within the authorities of FinCEN. V. CONSENT TO ASSESSMENT To resolve this matter, and only for that purpose, The Gardens consents to this assessment of a civil penalty in the sum of $2,800,000, and admits that it violated the BSA’s program and reporting requirements. The Gardens recognizes and states that it enters into the CONSENT freely and voluntarily and that no offers, promises, or inducements of any nature whatsoever have been made by FinCEN or any employee, agent, or representative of FinCEN to induce The Gardens to enter into the CONSENT, except for those specified in the CONSENT. The Gardens understands and agrees that the CONSENT embodies the entire agreement between The Gardens and FinCEN relating to this enforcement matter only, as described in Section III above. The Gardens further understands and agrees that there are no express or implied

15 promises, representations, or agreements between The Gardens and FinCEN other than those expressly set forth or referred to in this document and that nothing in the CONSENT or in this ASSESSMENT OF CIVIL MONEY PENALTY (ASSESSMENT) is binding on any other agency of government, whether Federal, State, or local. VI. PUBLIC STATEMENTS The Gardens expressly agrees that it shall not, nor shall its attorneys, agents, partners, directors, officers, employees, affiliates, or any other person authorized to speak on its behalf, make any public statement contradicting either its acceptance of responsibility set forth in the CONSENT or any fact in the DETERMINATIONS section of the CONSENT. FinCEN has sole discretion to determine whether a statement is contradictory and violates the terms of the CONSENT. If The Gardens, or anyone claiming to speak on behalf of The Gardens, makes such a contradictory statement, The Gardens may avoid a breach of the agreement by repudiating such statement within 48 hours of notification by FinCEN. If FinCEN determines that The Gardens did not satisfactorily repudiate such statement(s) within 48 hours of notification, FinCEN may void, in its sole discretion, the releases contained in the CONSENT and reinstitute enforcement proceedings against The Gardens. The Gardens expressly agrees to waive any statute of limitations defense to the reinstituted enforcement proceedings and further agrees not to contest any admission or other findings made in the CONSENT. This paragraph does not apply to any statement made by any present or former officer, director, employee, or agent of The Gardens in the course of any criminal, regulatory, or civil case initiated against such individual, unless such individual is speaking on behalf of The Gardens or unless The Gardens later ratifies such claims, directly or indirectly. The Gardens further agrees that, upon notification by FinCEN, The Gardens will repudiate such

16 statement to the extent it contradicts either its acceptance of responsibility or any fact in the CONSENT. VII. RELEASE Execution of the CONSENT, and compliance with the terms of this ASSESSMENT and the CONSENT, settles all claims that FinCEN may have against The Gardens for the conduct described in Section III of the CONSENT. Execution of the CONSENT, and compliance with the terms of this ASSESSMENT and the CONSENT, does not release any claim that FinCEN may have for conduct by The Gardens other than the conduct described in Section III of the CONSENT, or any claim that FinCEN may have against any director, officer, owner, employee, or agent of The Gardens, or any party other than The Gardens. Upon request, The Gardens shall truthfully disclose to FinCEN all factual information not protected by a valid claim of attorney-client privilege or work product doctrine with respect to the conduct of its current or former directors, officers, employees, agents, or others. If FinCEN determines, in its sole judgment, that The Gardens has breached any portion of this agreement, FinCEN may void, in its sole discretion, the releases contained in the CONSENT and reinstitute enforcement proceedings against The Gardens. The Gardens expressly agrees to waive any statute of limitations defense to the reinstituted enforcement proceedings and further agrees not to contest any admission or other finding made in the CONSENT. Accepted by: /S/ July 15, 2016 Jamal El-Hindi Date Acting Director, Financial Crimes Enforcement Network U.S. Department of the Treasury