Assessment of Civil Money Penalty Against Oppenheimer & Co., Inc.

1 UNITED STATES OF AMERICA DEPARTMENT OF THE TREASURY FINANCIAL CRIMES ENFORCEMENT NETWORK IN THE MATTER OF: ) ) Number 2015-01 Oppenheimer & Co., Inc. ) New York, NY ) ASSESSMENT OF CIVIL MONEY PENALTY I. INTRODUCTION The Financial Crimes Enforcement Network (FinCEN) has determined that grounds exist to assess a civil money penalty against Oppenheimer & Co., Inc., (“Oppenheimer” or “the Firm”) pursuant to the Bank Secrecy Act (“BSA”) and regulations issued pursuant to that Act.1

Oppenheimer admits to the facts set forth below and that its conduct violated the BSA. Oppenheimer consents to the assessment of a civil money penalty and enters the CONSENT TO THE ASSESSMENT OF CIVIL MONEY PENALTY (“CONSENT”) with FinCEN. The CONSENT is incorporated into this ASSESSMENT OF CIVIL MONEY PENALTY (“ASSESSMENT”) by reference. FinCEN has the authority to investigate brokers and dealers in securities (“broker￾dealers”) for compliance with and violation of the Bank Secrecy Act pursuant to 31 C.F.R. § 1010.810, which grants FinCEN “[o]verall authority for enforcement and compliance, including coordination and direction of procedures and activities of all other agencies exercising delegated authority under this chapter.” Oppenheimer was a “financial institution” and a “broker-dealer” within the meaning of the Bank Secrecy Act and its implementing regulations during the time

1 The Bank Secrecy Act is codified at 12 U.S.C. §§ 1829b, 1951-1959 and 31 U.S.C. §§ 5311- 5314, 5316-5332. Regulations implementing the Bank Secrecy Act appear at 31 C.F.R. Chapter X.

2 relevant to this action. 31 U.S.C. § 5312(a)(2) and 31 C.F.R. § 1010.100(t). Oppenheimer is a full service, self-clearing broker-dealer headquartered in New York. The Firm provides a full range of brokerage and investment services to customers in the United States and internationally. As of December 31, 2013, Oppenheimer reported total assets of more than $2.5 billion. FinCEN previously assessed a civil money penalty against Oppenheimer for similar Bank Secrecy Act violations. In 2005, FinCEN and the New York Stock Exchange assessed a civil penalty of $2.8 million against the Firm for failing to implement an adequate anti-money laundering (“AML”) program and for failing to identify and report suspicious transactions. In addition, in August 2013, the Financial Industry Regulatory Authority (“FINRA”) fined Oppenheimer $1.425 million for violations of securities laws and anti-money laundering failures.2

Resolution with the Securities and Exchange Commission. The Securities and Exchange Commission (“SEC”) is Oppenheimer’s primary federal regulator and, through its National Exam Program, examines broker-dealers, including Oppenheimer, for compliance with the BSA and its implementing regulations and similar rules under Title 15 of the United States Code. The SEC simultaneously brought an enforcement action against Oppenheimer In the Matter of Oppenheimer & Co. Inc. (Administrative Procedure File No. _________) for failing to report a customer’s suspicious activities occurring through its Oppenheimer account, in violation of the Exchange Act, § 17(a) and Rule 17a-8 thereunder. The SEC also cited Oppenheimer for other violations, including willfully aiding and abetting a customer’s violation of the Exchange Act, § 15(a) (broker-dealer registration

2 http://disciplinaryactions.finra.org/viewdocument.aspx?DocNB=33961.

3 provision); willfully violating the Exchange Act, § 17(a) and Rule 17a-3(a)(2) (requiring broker￾dealers to maintain ledgers accurately reflecting liabilities and expenses); willfully violating Rule 17a-3(a)(9) (for failing to accurately maintain records for each account showing the true beneficial owner); and willfully violating Securities Act, § 5(a) and (c) (securities registration provision); and, pursuant to Exchange Act, § 15(b)(4)(E), failing to prevent and detect violations of § 5. For all of these violations, the SEC ordered Oppenheimer to cease and desist from committing or causing any violations of the relevant provisions of the federal securities laws and to pay $10 million: $4,168,400 in disgorgement, $753,471 in prejudgment interest, and $5,078,129 in civil penalties. The SEC further stated in its Order that “[a] penalty amount that includes an additional $10 million is appropriate for the conduct at issue herein, however, in light of the civil money penalty paid to FinCEN[], no additional penalty is being ordered at this time. Oppenheimer’s total obligation to pay in the [SEC] proceeding would be $20 million in the event it fails to pay [FinCEN].” Finally, the SEC censured Oppenheimer and required the broker￾dealer to retain an Independent Consultant to review and provide recommendations for certain aspects of its compliance program, including its AML program. II. DETERMINATIONS From 2008 through May 2014, Oppenheimer willfully violated the Bank Secrecy Act.3

As described in more detail below, Oppenheimer (a) failed to implement an adequate anti-money

3 In civil enforcement of the Bank Secrecy Act under 31 U.S.C. § 5321(a)(1), to establish that a financial institution or individual acted willfully, the government need only show that the financial institution or individual acted with either reckless disregard or willful blindness. The government need not show that the entity or individual had knowledge that the conduct violated the Bank Secrecy Act, or that the entity or individual otherwise acted with an improper motive or

4 laundering program, 31 U.S.C. § 5318(h) and 31 C.F.R. § 1023.210; (b) failed to implement an adequate due diligence program for a foreign correspondent account, 31 U.S.C. § 5318(i)(1) and 31 C.F.R. § 1023.610; and (c) failed to comply with notification requirements under rules imposing Special Measures under Section 311 of the USA PATRIOT Act against three foreign financial institutions of primary money laundering concern. 31 CFR §§ 1010.653, 1010.654, 1010.655. A. Violation of the Requirement to Implement an Anti-Money Laundering Program The Bank Secrecy Act and its implementing regulations require all broker-dealers to establish and implement anti-money laundering programs. 31 U.S.C. § 5318(h). A broker￾dealer is deemed to have satisfied Bank Secrecy Act AML program requirements if it implements and maintains an AML program that complies with any applicable regulations of its Federal functional regulator and self-regulatory organization (“SRO”) governing such programs. 31 C.F.R. § 1023.210. FINRA is Oppenheimer’s SRO and examines the Firm for compliance with the Bank Secrecy Act and its implementing regulations and for compliance with FINRA Rule 3310. FINRA requires each broker-dealer under its supervision to establish and maintain a written AML program that, at a minimum, includes (a) policies, procedures, and internal controls reasonably designed to achieve compliance with the Bank Secrecy Act; (b) policies and procedures that can be reasonably expected to detect and cause the reporting of suspicious transactions under 31 U.S.C. § 5318(g); (c) designation of an AML compliance officer; (d) ongoing training of appropriate personnel; and, (e) independent testing of the firm’s AML

bad purpose. Oppenheimer admits to “willfulness” only as the term is used in civil enforcement of the Bank Secrecy Act under 31 U.S.C. § 5321(a)(1).

5 program to be conducted annually, unless the firm does not execute transactions for customers or otherwise hold customer accounts or act as an introducing broker with respect to customer accounts, in which case independent testing must be conducted biennially. From 2008 through 2011, Oppenheimer violated the Bank Secrecy Act’s AML program requirements by conducting business without establishing and implementing adequate policies, procedures, and internal controls reasonably designed to detect and report suspicious activity related to penny stock transactions in customer accounts. FinCEN identified 16 customers, some with multiple accounts, who engaged in patterns of suspicious trading through branch offices located in five different states. The majority of the suspicious sales exhibited the same two significant red flags: (1) the securities were penny stocks for which no registration statement was in effect for the sale, and (2) the customers repeatedly deposited large blocks of the securities, many in paper certificate form, sold them shortly after the deposit, and immediately, or shortly thereafter, transferred the proceeds out of their Oppenheimer account. The sales also raised other red flags that should have prompted further inquiry by Oppenheimer, including the following: • The customer opened one or more accounts and immediately deposited large quantities of penny stocks. • The customer deposited large amounts of penny stocks and then immediately transferred those shares out of their Oppenheimer account to an account at another broker-dealer with no apparent lawful purpose.

6 • Some share certificates were recently issued (some as recently as the date of deposit) and/or they represented a large percentage of the public float. 4 In some instances, the amount of shares deposited actually exceeded the issuer’s publicly stated number of shares outstanding. • The customer appeared to be acting as an agent for an undisclosed principal, rather than in the customer’s own name. Some certificates stated that they were for the benefit of undisclosed third parties and some certificates were deposited into accounts owned by persons other than the titled owner of the certificate. • The customer was the subject of a disciplinary action by the SEC or FINRA or was the subject of news reports indicating possible regulatory violations. • The customer appeared to be affiliated with the issuers of the unregistered stock they sold through Oppenheimer. • The customer had multiple accounts under a single name or multiple names for no apparent reason and the customer conducted a large number of inter-account or third￾party transfers. • The customer sold in the midst of a sudden spike in investor demand for, and rising price in, an ordinarily low-volume, low-priced security. • The customer was promoting the penny stock that he owned. • The issuer did not file reports with the SEC or publish current financial reports. • The issuer had been through several recent name changes.

4 The public float is the portion of a company’s outstanding shares that is in the hands of public investors and is available for trading.

7 All of the securities involved in the suspicious activity were penny stocks. Penny stocks are low-priced, generally thinly traded and highly speculative securities. Penny stocks can be highly volatile and vulnerable to manipulation by stock promoters and pump-and-dump schemes. For these reasons, trading in such stocks presents a heightened AML risk. The AML risk is further heightened when the trading is conducted through patterns of activity in which a customer deposits large quantities of securities and then immediately, or shortly thereafter, liquidates those securities and wires the proceeds out of the account, as repeated here multiple times by multiple customers. Many of these transactions were not only suspicious, but they also violated federal securities laws in that they constituted unregistered offerings. 5 The identified Oppenheimer customers engaged in a pattern of penny stock transactions that the Firm knew, suspected, or had reason to suspect violated registration requirements and consisted of the type of illegal conduct that should have caused Oppenheimer to file Suspicious Activity Reports. Oppenheimer acknowledged the increased AML risk from penny stock trading in its written policies and procedures that governed the monitoring of customer accounts for ongoing suspicious activity. Those policies specifically identified penny stock trading as a potential red flag that should be reported to the Compliance Department or AML Group. Despite its written policies, Oppenheimer personnel did not systematically review customer trading in penny stocks for suspicious activity. Oppenheimer’s compliance structure created information silos that also contributed to its failures to detect and report suspicious activity. Oppenheimer structured its overall compliance

5 FINRA determined in August 2013 that, between 2008 and 2010, Oppenheimer sold more than a billion shares of twenty low-priced, highly speculative penny stocks without registration or an applicable exemption, in violation of Section 5 of the Securities Act of 1933. http://www.finra.org/web/groups/industry/@ip/@enf/@ad/documents/industry/p315930.pdf.

8 function, including AML compliance, in a manner that effectively isolated each group of employees responsible for reviewing particular information or activity from other employees responsible for different, but related, information and activity. During the relevant period, Oppenheimer’s Compliance Department was organized into several groups, each with a manager who reported to the Chief Compliance Officer. The AML Group and the Surveillance Group were the groups within the Compliance Department that dealt most closely with AML compliance. Although both groups reported directly to the Chief Compliance Officer, Oppenheimer failed to incorporate a mechanism into its structure to ensure adequate information sharing between these disparate groups. As a result, while each group possessed information that in combination would have identified more significant suspicious activity, full information was not shared across groups or elevated to the Chief Compliance Officer. In this regard, as explained in more detail below, this structure contributed to Oppenheimer’s failures to detect, monitor, and report suspicious activity. Oppenheimer’s AML Officer reported directly to the Firm’s Chief Compliance Officer and managed a team of AML analysts, who reported directly to him. The AML Group’s responsibilities included addressing matters referred to it by branch management and other employees and to conduct independent risk-based reviews for suspicious activities. Areas assessed by these AML reviews included reviewing new accounts, monitoring and examining unusual movements of money and assets, monitoring accounts with “hold mail” instructions, and monitoring activities at certain overseas branches identified as presenting a high level of risk. The Surveillance Group was responsible for reviewing a wide range of reports detailing particular trading activity, but did not review for the type of suspicious activity discussed herein. The Surveillance Group did not review any reports of large deposits of penny stocks or reports of

9 sales that might have raised red flags for the suspicious activity described above. This division of responsibility and the resultant silos of information contributed to the Firm’s failure to identify and investigate the suspicious penny stock activity at issue in this matter. Oppenheimer’s handling of its customer account for Gibraltar Global Securities, Inc. (“Gibraltar”), a Bahamas-based broker-dealer, illustrates the failings of the Firm’s compliance structure. Oppenheimer automatically designated Gibraltar as a medium-risk account in June 2007 because it was a Bahamas entity. The Firm’s AML Officer then coded the account as high￾risk because it was a foreign broker-dealer. On January 8, 2009, the AML Group received a system-generated alert when the Firm’s automated monitoring system identified a third-party wire that had been sent from Gibraltar’s account. In response to this alert, an analyst in the AML Group conducted a review and identified journal entries between Gibraltar and an unrelated Oppenheimer customer. After conducting further due diligence, the analyst determined that Gibraltar, a foreign financial institution (“FFI”), had violated an Oppenheimer policy that restricted FFI account activity to proprietary trading and he informed the AML Officer of his findings. The AML Officer reported the AML Group’s finding to the Branch Administrative Manager of the branch that held the Gibraltar account, and he sent a written disciplinary memorandum to the broker responsible for handling the account. He also elevated his concern with Gibraltar’s activity to Oppenheimer’s Chief Compliance Officer and to the Surveillance Manager. Although the AML Officer believed he had effectively managed the AML risk associated with the Gibraltar account, he was not aware of either the full extent of Gibraltar’s suspicious activity or the fact that Gibraltar continued to deposit and liquidate third-party securities for

10 several more months. As described below, there were other employees at Oppenheimer who were aware of the continued activity but who failed to alert the AML Group: • In response to concerns raised by the AML Group, the Surveillance Manager instructed a surveillance analyst to conduct a follow-up review of Gibraltar. The analyst identified red flags and reported her findings to the Surveillance Manager, who in turn says she passed this information on to her direct supervisor, the Chief Compliance Officer. Significantly, neither the Surveillance Manager nor the Chief Compliance Officer shared the information with the AML Group and no one instructed the Surveillance analyst to monitor Gibraltar going forward. • The broker team who acquired the Gibraltar account from its prior broker, who left the Firm shortly after receiving the written warning, appeared to know that Gibraltar was routinely evading the Firm’s restriction on third-party activity. For example, unbeknownst to management and the AML team, e-mails between the broker team and Gibraltar suggest that Oppenheimer’s brokers advised Gibraltar how to hide the fact that it was depositing and selling shares on behalf of a third party. • The Branch Operations Manager, who oversaw compliance for the broker team on the Gibraltar account, approved multiple DTC transfers to third-party accounts, in violation of Firm policy and contrary to the AML Officer’s specific instructions to the Branch that such transfers were not allowed. 6 None of the above information was conveyed to the AML Officer or his staff. When Oppenheimer made a decision in June 2009 to close the Gibraltar account, the AML Officer was

6 DTC, or Depository Trust Company, is a clearinghouse used by brokerage firms to electronically process and settle securities trades.

11 not involved in the decision. Moreover, if suspicious activity was the reason for the closure, the AML Officer was not made aware of that and no personnel at Oppenheimer reported the suspicious activity. The information silos created by Oppenheimer’s compliance structure prevented the AML Group from receiving the information necessary to understand the full extent of Gibraltar’s activity and contributed to its failure to effectively monitor the account for suspicious activity. B. Violation of the Requirement to Conduct Due Diligence on a Foreign Correspondent Account Foreign correspondent accounts are gateways to the U.S. financial system. As part of their AML obligations, U.S. broker-dealers maintaining correspondent accounts in the United States for foreign financial institutions must apply due diligence to those correspondent accounts. 31 U.S.C. § 5318(i)(1). Broker-dealers must develop risk-based policies, procedures, and controls that are reasonably designed to gather all relevant due diligence information concerning such foreign correspondent accounts, employ this due diligence information to determine whether an account is subject to enhanced due diligence, conduct assessments of money laundering risks for each account, and comply with suspicious activity reporting requirements. 31 C.F.R. §§ 1010.610(a)(1), (2), and (3). Oppenheimer’s written AML policy required special due diligence on FFIs and restricted activity in accounts held by FFIs to proprietary business for the entity that opened the account, unless it was granted one of the exceptions detailed in the Firm’s AML procedures. As noted above, Oppenheimer designated Gibraltar, a Bahamas-based broker-dealer, as a high-risk account in July 2007 because it was a foreign broker-dealer. Gibraltar began trading in its Oppenheimer account in May 2008. Gibraltar is one of the Oppenheimer customers that

12 engaged in the illegal penny stock trading.7 Despite expressly acknowledging the high risk that Gibraltar’s account presented, however, Oppenheimer took no steps to assess Gibraltar’s risk as an FFI and further failed to conduct adequate due diligence when it opened the account. Oppenheimer did not inquire into the AML or supervisory regime of Gibraltar’s country of jurisdiction or consider Gibraltar’s AML policies and procedures. 31 C.F.R. § 1010.610(a)(1) - (3). Oppenheimer’s policies also required its AML unit to conduct periodic reviews of all FFI accounts. Notwithstanding these written policies, Oppenheimer did not put adequate procedures in place to actually implement them. This resulted in the failure to monitor and detect suspicious and prohibited activity. Oppenheimer failed to adequately monitor Gibraltar’s transactions and consequently failed to detect or investigate the numerous suspicious transactions conducted through the account, including prohibited third-party activity. Gibraltar used its account at Oppenheimer to act as an agent for undisclosed principals, repeatedly depositing and liquidating securities for the benefit of third parties. By failing to conduct appropriate due diligence for the Gibraltar account and failing to adequately monitor transactions conducted by the account, Oppenheimer violated the Bank Secrecy Act. C. Violation of Rules Imposing Special Measures Under Section 311 of the USA PATRIOT Act Financial institutions, including U.S. broker-dealers, must comply with rules imposing Special Measures under Section 311 of the USA PATRIOT Act. Section 311 was enacted to promote the prevention, detection, and prosecution of international money laundering and the financing of terrorism. The statute grants the Director of FinCEN the authority, upon finding

7 See, http://www.finra.org/web/groups/industry/@ip/@enf/@ad/documents/industry/p315930.pdf.

13 that reasonable grounds exist for concluding that a foreign jurisdiction, institution, class of transaction, or type of account is of “primary money laundering concern,” to issue rules imposing “special measures” against the “primary money laundering concern.” Since 2002, the Director of FinCEN has made several such findings and imposed Special Measures against foreign jurisdictions and foreign financial institutions.8

Between March 2006 and March 2007, FinCEN imposed Special Measures against three foreign financial institution of primary money laundering concern. 31 CFR §§ 1010.653, 1010.654, 1010.655. The rules imposing the Special Measures included (1) a prohibition on opening or maintaining correspondent accounts for the financial institution named in the rules, and (2) a requirement to conduct due diligence on correspondent accounts to prevent indirect use of correspondent accounts by the named financial institutions. The due diligence requirement obligated the broker-dealer to notify its correspondent account holders that the correspondent account may not be used by the financial institution of primary money laundering concern. Oppenheimer violated the notification requirements of these Special Measures by failing to send notice to the Firm’s correspondent accounts regarding the Special Measures or the prohibition on the opening of correspondent accounts for the three named financial institutions. During a FINRA examination of Oppenheimer in November 2011, Oppenheimer acknowledged that it was not aware of its obligation to send notices to its correspondent accounts and admitted that it had failed to send the required notices. It was not until 2014 that the Firm finally satisfied the notification requirements, despite having been reminded of this obligation by FINRA in 2011. Although no determination has been made that Oppenheimer conducted business with the foreign financial institutions of primary money laundering concern, the Firm nonetheless failed

8 http://www.fincen.gov/statutes_regs/patriot/section311.html

14 to comply with the notice requirement and, in doing so, left the door open for such access to occur. III. CIVIL MONEY PENALTY FinCEN has determined that Oppenheimer willfully violated requirements under the Bank Secrecy Act to implement an adequate anti-money laundering program and an adequate due diligence program for a foreign correspondent account, and willfully violated the notification requirements in rules imposing Special Measures under Section 311 of the USA PATRIOT Act, as described in the CONSENT, and that grounds exist to assess a civil money penalty for these violations. 31 U.S.C. § 5321 and 31 C.F.R. § 1010.820. FinCEN has determined that the penalty in this matter will be $20 million. IV. CONSENT TO ASSESSMENT To resolve this matter, and only for that purpose, Oppenheimer admits that it violated the Bank Secrecy Act and consents to the assessment of a civil money penalty in the amount of $20 million, of which $10 million will be concurrent with the penalty, disgorgement, and prejudgment interest imposed by the SEC. Accordingly, the assessment will be satisfied by paying $10 million to the United States Department of the Treasury and by paying $10 million in satisfaction of, and in accordance with, the penalty imposed by the SEC. Oppenheimer further agrees to provide FinCEN copies of any reports or other recommendations prepared by any Independent Consultant retained to review and provide recommendations for certain aspects of its compliance program, including its AML program. Oppenheimer recognizes and states that it enters into the CONSENT freely and voluntarily and that no offers, promises, or inducements of any nature whatsoever have been

15 made by FinCEN or any employee, agent, or representative of FinCEN to induce Oppenheimer to enter into the CONSENT, except for those specified in the CONSENT. Oppenheimer understands and agrees that the CONSENT embodies the entire agreement between Oppenheimer and FinCEN relating to this enforcement matter only, as described in Section II above. Oppenheimer further understands and agrees that there are no express or implied promises, representations, or agreements between Oppenheimer and FinCEN other than those expressly set forth or referred to in this document and that nothing in the CONSENT or in this ASSESSMENT is binding on any other agency of government, whether Federal, State, or local. V. RELEASE Execution of the CONSENT, and compliance with the terms of this ASSESSMENT and the CONSENT, settles all claims that FinCEN may have against Oppenheimer for the conduct described in Section II of the CONSENT. Execution of the CONSENT, and compliance with the terms of this ASSESSMENT and the CONSENT, does not release any claim that FinCEN may have for conduct by Oppenheimer other than the conduct described in Section II of the CONSENT, or any claim that FinCEN may have against any director, officer, employee, or agent of Oppenheimer, or any party other than Oppenheimer. Upon request, Oppenheimer shall truthfully disclose to FinCEN all factual information not protected by a valid claim of attorney￾client privilege or work product doctrine with respect to the participation of its current or former directors, officers, employees, agents, or others. BY: /S/ January 26, 2015

---

Jennifer Shasky Calvery Date: Director FINANCIAL CRIMES ENFORCEMENT NETWORK (FinCEN) U.S. Department of the Treasury