Assessment of Civil Money Penalty in the Matter of Western Union Financial Services, Inc.

UNITED STATES OF AMERICA
DEPARTMENT OF THE TREASURY
FINANCIAL CRIMES ENFORCEMENT NETWORK
IN THE MATTER OF: )
)
) Number 2017-01
Western Union Financial Services, Inc. )
Englewood, Colorado )
ASSESSMENT OF CIVIL MONEY PENALTY
I. INTRODUCTION
The Financial Crimes Enforcement Network (FinCEN) has determined that grounds exist to assess a civil money penalty against Western Union Financial Services, Inc. (WUFSI or the Company) pursuant to the Bank Secrecy Act (BSA) and regulations issued pursuant to that Act.1 WUFSI admits to the facts set forth below and that its conduct violated the BSA. In order to resolve this matter, WUFSI consents to this assessment of a civil money penalty and entered the CONSENT TO THE ASSESSMENT OF CIVIL MONEY PENALTY (CONSENT) with FinCEN. The CONSENT is incorporated into this ASSESSMENT OF CIVIL MONEY PEANLTY (ASSESSMENT) by reference. FinCEN has authority to investigate financial institutions, including money services businesses (MSBs), for compliance with and violation of the BSA pursuant to 31 C.F.R. § 1010.810, which grants FinCEN “[o]verall authority for enforcement and compliance, including coordination and direction of procedures and activities of all other agencies exercising delegated authority under this chapter. . . .”

1 The Bank Secrecy Act is codified at 12 U.S.C. §§ 1829b, 1951–1959 and 31 U.S.C. §§ 5311–5314, 5316–5332. Regulations implementing the Bank Secrecy Act appear at 31 C.F.R. Chapter X.

WUFSI is a wholly owned subsidiary of The Western Union Company (Western Union). WUFSI offers consumer to consumer remittance services through the branded payment services of Western Union, Vigo, and Orlandi Valuta, which comprise a network of approximately 500,000 agent locations in approximately 200 countries and territories worldwide. WUFSI operated as a “financial institution” and a “money services business” within the meaning of the BSA and its implementing regulations during the time relevant to this action.2 Resolution with the United States Department of Justice On the same date as the CONSENT, Western Union entered into a Deferred Prosecution Agreement (DPA) with the United States Department of Justice, Criminal Division, Money Laundering and Asset Recovery Section, and the U.S. Attorney’s Offices for the Middle District of Pennsylvania, Central District of California, Eastern District of Pennsylvania, and Southern District of Florida. 3 The DPA stems from allegations that during the period of 2004 through 2012, Western Union: failed to implement and maintain an effective anti-money laundering (AML) program in violation of the BSA and its regulations; and aided and abetted wire fraud.4

As part of the DPA, the Department of Justice acknowledged that since at least September 2012, Western Union implemented compliance enhancements to continuously improve its anti-fraud and anti-money laundering programs. Further, Western Union agreed to continue to enhance its AML and anti-fraud programs, and to pay to the United States the sum of $586 million for restitution to the victims of the fraud.

2 31 U.S.C. § 5312(a)(2); 31 C.F.R. § 1010.100(t)(3).
3 United States v. The Western Union Company, et al., CR-17-__ (M.D. Pa. 2017). The CONSENT is expressly conditioned on the U.S. District Court for the Middle District of Pennsylvania’s acceptance of the DPA. If the DPA does not become effective, the CONSENT shall be deemed null and void. 4 31 U.S.C. §§ 5318(h), 5322; 18 U.S.C. §§ 1342, 1343.

Resolution with the Federal Trade Commission
On the same date as the CONSENT, the Federal Trade Commission (FTC) entered into a Stipulated Order for Permanent Injunction and Final Judgement (Order) with Western Union. The Order is in resolution of the FTC’s allegations that Western Union failed to take timely, appropriate, and effective measures to mitigate fraud in the processing of money transfers sent by consumers. Western Union has neither admitted nor denied the FTC’s allegations. As part of the Order, Western Union has agreed to the appointment of an independent compliance auditor to ensure, among other things, that thorough due diligence is conducted on all prospective and existing Western Union agents, and that necessary steps are taken to monitor and investigate agent activity. Western Union has also agreed to a monetary judgment in the amount of $586 million which will be satisfied by complying with the payment requirements of its DPA with the United States Department of Justice, as referenced above in this CONSENT.
II. DETERMINATIONS
Prior to 2012, WUFSI willfully violated the BSA’s program, recordkeeping and reporting requirements.5 As described below, WUFSI failed to adequately implement and maintain an effective, risk-based AML program by failing to implement or execute effective policies, procedures, and internal controls reasonably designed to assure ongoing compliance (in particular, failures to suspend or terminate certain agent locations in a timely manner); and failing to conduct

5 In civil enforcement of the BSA under 31 U.S.C. § 5321(a)(1), to establish that a financial institution or individual acted willfully, the government need only show that the financial institution or individual acted with either reckless disregard or willful blindness. The government need not show that the entity or individual had knowledge that the conduct violated the BSA, or that the entity or individual otherwise acted with an improper motive or bad purpose. WUFSI admits to “willfulness” here only as the term is used in civil enforcement of the BSA under 31 U.S.C. § 5321(a)(1).

adequate due diligence on certain foreign agents and subagents in Latin America. WUFSI also failed to file timely suspicious activity reports (SARs).6 A. Violation of the Requirement to Implement an Effective Anti-Money Laundering Program The BSA and its implementing regulations require MSBs to develop, implement, and maintain an effective written AML program that is reasonably designed to prevent the MSB from being used to facilitate money laundering and the financing of terrorist activities.7 At a minimum, an MSB is required to implement a written AML program that: (a) provides for a system of internal controls reasonably designed to assure ongoing compliance; (b) designates an individual or individuals responsible for assuring day to day compliance with the program and BSA requirements; (c) provides training for appropriate personnel, including training in the detection of suspicious transactions; and (d) provides for independent review to monitor and maintain an adequate program.8 Prior to 2012, in certain instances, WUFSI failed to implement or execute effective internal controls sufficient to reasonably assure that the institution did not facilitate money laundering transactions including illicit transactions related to fraud. Specifically, WUFSI failed to maintain adequate policies, procedures, and internal controls for conducting due diligence on its agents, to terminate or suspend agent locations involved in potential money laundering and fraud transactions, and to implement or execute internal controls reasonably designed to prevent

6 Pursuant to WUFSI’s agreement with the states of Arizona, California, New Mexico and Texas, a court appointed monitor previously identified recommended program enhancements such as determinations made in this
Section. At all times since the commencement of such agreement, WUFSI has been working to remediate the
recommended program enhancements made pursuant to the agreement with the states of Arizona, California, New Mexico and Texas, many of which are reiterated in the CONSENT. WUFSI’s court appointed monitor has certified that such remediation has been successfully completed. 7 31 U.S.C. § 5318(h); 31 C.F.R. § 1022.210(a). 8 31 C.F.R. §§ 1022.210(c), (d).

fraud. As a result of WUFSI’s AML failures, certain agent locations and outlets that WUFSI suspected were involved in fraud and money laundering were able to continue to use WUFSI’s money transfer system to facilitate their activity. MSBs that do business through agents or counterparties located outside of the United States must implement and maintain as part of their AML program risk-based policies, procedures, and controls reasonably designed to identify and minimize money laundering and other illicit financing risks associated with such business. FinCEN guidance has stated that “[t]o the extent [MSBs] utilize relationships with foreign agents or counterparties to facilitate the movement of funds into or out of the United States, they must take reasonable steps to guard against the flow of illicit funds, or the flow of funds from legitimate sources to persons seeking to use those funds for illicit purposes, through such relationships.”9 FinCEN has made clear that the AML programs for MSBs engaged in such transactions should, among other things, establish: (1) procedures for conducting reasonable, risk-based due diligence on potential and existing foreign agents and counterparties to help ensure that such foreign agents and counterparties are not themselves complicit in illegal activity involving the MSB’s products and services, including reasonable procedures to evaluate, on an ongoing basis, the operations of those foreign agents and counterparties; (2) procedures for risk-based monitoring and review of transactions from, to, or through the United States that are conducted through foreign agents and counterparties sufficient to enable the MSBs to identify and, where appropriate, report as suspicious such occurrences as instances of unusual wire activity; and (3) procedures for responding to foreign agents or counterparties that present unreasonable risks of

9 FinCEN Guidance (Interpretive Release No. 2004-1), Anti-Money Laundering Program Requirements for Money Services Businesses with Respect to Foreign Agents or Foreign Counterparties, 60 Fed. Reg. 74,439 (Dec. 14, 2004).

money laundering or the financing of terrorism, including procedures that provide for the implementation of corrective action on the part of the foreign agent or counterparty or for the termination of the relationship with any foreign agent or counterparty that an MSB determines poses an unacceptable risk of money laundering.

1. Failure to Conduct Adequate Due Diligence on Foreign Agents/Outlets
   For certain potential and existing agent locations within Latin America, WUFSI failed to establish adequate procedures for conducting reasonable, risk-based due diligence to help ensure that such foreign agent locations and counterparties are not themselves complicit in illegal activity involving WUFSI’s products and services, including reasonable procedures to evaluate, on an ongoing basis, the operations of those foreign agent locations and counterparties. WUFSI’s failure to conduct adequate due diligence on these domestic and foreign agent locations included not conducting adequate reviews (e.g., background checks and on-site reviews) of its higher-risk new agents, and not conducting enhanced due diligence on Latin American-based agent locations that were at higher risk for money laundering. Because of these failures, WUFSI did not have sufficient controls to effectively mitigate its money laundering risks along the southwest border between the United States and Mexico. WUFSI’s failures to conduct sufficient initial due diligence into certain agent locations resulted in providing “new agent” agreements to agents owned by individuals who had previously been terminated by WUFSI for money laundering concerns. For example, in October 2011, with the assistance of law enforcement, WUFSI identified that four commonly owned agent locations in Peru accounted for nearly half of the transactions related to consumer fraud reports in Peru. After these agents processed transactions for another six months, WUFSI

10 Id.

suspended these locations for this activity in April 2012. Despite these suspensions and WUFSI’s determination that the commonly-owned locations were high risk for fraud, WUFSI failed to identify these concerns when it allowed the common owner of these agents to open another location in December 2012. WUFSI failed to implement or execute effective policies and procedures for conducting adequate due diligence to understand the money laundering risks associated with its subagent relationships within Mexico. WUFSI used a “master agent” or “master payee” payment model for remittances. The master agent would in turn contract with subagents to deliver funds to recipients. WUFSI did not have sufficient policies and procedures in place to understand the money laundering risks of its Mexican-based master agents and subagents and conduct ongoing due diligence of their activity. For example, during the period covered by the CONSENT, WUFSI had a number of master agents and subagents in Mexico to provide its services along the southwest border of the United States with Mexico. Despite its knowledge of the money laundering risks associated with the southwest border and the use of money remittances to send narcotics proceeds to Mexico, WUFSI did not have sufficient knowledge of the activities of certain higher-risk subagents and did not itself conduct, or ensure that its master agents conducted, on-site reviews of certain subagents at higher-risk of money laundering. This failure prevented WUFSI from ensuring that its subagents were properly identifying the identification of the person obtaining money in Mexico. WUFSI’s ability to properly monitor these relationships was further affected by its use of three different processing systems for its Mexican-branded remittance services. WUFSI did not transfer the processing of these payments to one system until August 2012.

2. Failure to Terminate High-Risk Agent Locations11
   WUFSI failed to establish or implement sufficient procedures for suspending or terminating foreign agent locations or counterparties that presented unreasonable risks of money laundering including procedures that provide for the implementation of corrective action on the
   part of the foreign agent or counterparty or for the termination of the relationship with any foreign
   agent or counterparty that it determined posed an unacceptable risk of money laundering. Specifically, WUFSI applied disciplinary and termination actions inconsistently across its foreign agent locations. For certain WUFSI agent locations, WUFSI relied on various means to identify agent locations that were potentially complicit in money laundering and/or fraudulent activity. WUFSI reviewed consumer fraud reports, which were reports submitted by customers that were victims of fraud, as well as suspicious activity reporting. WUFSI analysts also generated “60-day fraud reports” for any agent location that had five or more consumer fraud reports over a 60-day period. For agent locations that WUFSI believed were potentially complicit in the activity, WUFSI could implement remedial and disciplinary actions including temporary suspension, training, compliance inspections, and termination. Although WUFSI did rely on these corrective actions, it did not do so on a consistent basis and, at times, allowed business interests to comment on appropriate corrective actions. For example, prior to 2012, WUFSI failed to sufficiently take corrective action against an agent location in the United Kingdom that had over 73 60-day fraud reports and over 2,000 consumer fraud reports sent to WUFSI. From 2005 through 2010, WUFSI identified this agent location as a high fraud risk and potentially complicit in fraud over five times. In each instance,

11 The items set forth in this Section are contained in in the DPA with the U.S. Department of Justice.

WUFSI failed to terminate the relationship and relied on corrective actions that proved insufficient — including compliance reviews, training, and partial suspension. In 2010, WUFSI compliance staff recommended termination or suspension of this agent location in five separate instances as WUFSI analysts continued to identify significant potential fraudulent activity through the agent location. These recommendations did not result in termination of the relationship. WUFSI only issued partial suspensions from engaging in U.S.-originated transfers and then full reinstatement despite the continued presence of potentially fraudulent activity. Despite over seven years of significant potential fraudulent activity, WUFSI did not terminate this relationship until February of 2012. In another example, WUFSI failed to take sufficient corrective action with respect to four agent locations that allowed customers to send remittances to China that displayed characteristics of structuring. From 2003 to 2012, WUFSI filed over 31,000 suspicious activity reports (SARs) on remittances processed by four agent locations that sent funds to China. For one of these agent locations, WUFSI filed over 11,000 SARs. Between 2005 and 2010, WUFSI identified that this agent had multiple compliance deficiencies including failure to file all currency transaction reports (CTRs) and failure to monitor all transactions for suspicious activity. Specifically, WUFSI repeatedly identified that this agent location facilitated transactions of $2,500, just below the $3,000 recordkeeping threshold, but above Western Union’s identification threshold, only minutes apart. Despite continually identifying this activity, WUFSI implemented insufficient corrective action and never suspended this agent location’s relationship and this agent location continued to be one of WUFSI’s top accounts for sending money to China. Despite the repeated identification of compliance deficiencies, potential structuring activity, and the filing of over 11,000 SARs, WUFSI did not terminate this agent location until its owner was arrested in September of 2010.

3. Failure to Implement Sufficient Policies to Prevent Fraud
   Prior to 2012, WUFSI failed to implement a sufficient and adequately adhered to policy for disciplining agent locations that WUFSI personnel should have known or suspected were involved in fraud and/or money laundering. As early as 2004, WUFSI security and compliance staff identified the need to implement additional discipline policies to take corrective remedial action for agent locations that facilitated a high volume of fraud and/or money laundering transactions. In the years following FinCEN’s Interpretative Release,12 various WUFSI compliance staff also drafted or recommended additional policies for the company to reduce the number of fraudulent transactions and discipline foreign agents engaged in fraud or money laundering activity. However, WUFSI had unreasonable delays in implementing some of the policies. B. Violations of the Requirement to Report Suspicious Activity The BSA and its implementing regulations require MSBs to report transactions that the MSB “knows, suspects, or has reason to suspect” are suspicious, if the transaction is conducted or attempted by, at, or through the MSB, and the transaction involves or aggregates to at least $2,000 in funds or other assets.13 A transaction is “suspicious” if the transaction: (a) involves funds derived from illegal activity; (b) is intended or conducted in order to hide or disguise funds or assets derived from illegal activity, or to disguise the ownership, nature, source, location, or control of funds or assets derived from illegal activity; (c) is designed, whether through structuring or other means, to evade any requirement in the BSA or its implementing regulations; (d) serves

12 See supra, n.9.
13 31 C.F.R. § 1010.320(a)(2).

no business or apparent lawful purpose, and the MSB knows of no reasonable explanation for the transaction after examining the available facts, including the background and possible purpose of the transaction; or (e) involves use of the MSB to facilitate criminal activity.14 Like other BSA filings, suspicious activity reports (SARs) play an important role in detecting possible criminal activity. FinCEN and law enforcement use SARs to, among other things, investigate money laundering, terrorist financing and other serious criminal activity. WUFSI’s failure to develop and implement policies and procedures that could be reasonably expected to detect and cause the reporting of suspicious transactions led to unreasonable delay in filing thousands of SARs. Before 2012, in many cases, WUFSI took over 90 days to investigate activity for which it had facts to constitute the basis for filing a SAR. Additionally, although WUFSI filed thousands of SARs on customers of its agent locations, it rarely filed SARs on its agent locations. WUFSI’s practice was not to identify agent locations as “subjects” of SARs unless it found the agent location to be complicit. WUFSI typically only found an agent to be complicit if the agent was arrested, publicly identified to be implicated in illicit transactions, or if WUFSI’s own investigation determined that the agent location was complicit. By not filing these SARs in a timely manner, WUFSI unnecessarily delayed reporting.
III. CIVIL MONEY PENALTY
FinCEN has determined that WUFSI willfully violated the program and reporting requirements of the BSA and its implementing regulations. FinCEN has also determined that grounds exist to assess a civil money penalty for these violations.15

14 Id.
15 31 U.S.C. § 5321; 31 C.F.R. § 1010.820.

FinCEN has determined that the penalty in this matter will be $184 million based on WUFSI’s AML program failures and violations of its SAR filing obligations during the period before 2012. The U.S. Department of Justice will collect $586 million from WUFSI. The U.S. Department of Justice has stated that the funds collected through civil asset forfeiture will be used for restitution of victims of fraud. In recognition of this arrangement, FinCEN will deem its penalty fully satisfied by WUFSI’s payment to the U.S. Department of Justice as required by the DPA.
IV. UNDERTAKINGS
By executing the CONSENT, WUFSI agreed to provide FinCEN with any reports required by the DPA.
V. CONSENT TO ASSESSMENT
To resolve this matter, and only for that purpose, WUFSI consented to this ASSESSMENT of a civil money penalty in the sum of $184 million and admits that it willfully violated the BSA’s program, recordkeeping, and reporting requirements. WUFSI recognizes and states that it entered into the CONSENT freely and voluntarily and that no offers, promises, or inducements of any nature whatsoever have been made by FinCEN or any employee, agent, or representative of FinCEN to induce WUFSI to enter into the CONSENT, except for those specified in the CONSENT. WUFSI understands and agrees that the CONSENT embodies the entire agreement between WUFSI and FinCEN relating to this enforcement matter, as described in Section II above. WUFSI further understands and agrees that there are no express or implied promises, representations, or agreements between WUFSI and FinCEN other than those expressly set forth or referred to in this document and that nothing in the CONSENT or in this ASSESSMENT OF

CIVIL MONEY PENALTY (ASSESSMENT) is binding on any other agency of government, whether Federal, State or local.
VI. PUBLIC STATEMENTS
WUFSI expressly agrees that it shall not, nor shall its attorneys, agents, partners, directors, officers, employees, affiliates, or any other person authorized to speak on its behalf, make any public statement contradicting either its acceptance of responsibility set forth in the CONSENT or any fact in the DETERMINATIONS section of the CONSENT. FinCEN has sole discretion to determine whether a statement is contradictory and violates the terms of the CONSENT. If WUFSI, or anyone claiming to speak on behalf of WUFSI, makes such a contradictory statement, WUFSI may avoid a breach of the agreement by repudiating such statement within 48 hours of notification by FinCEN. If FinCEN determines that WUFSI did not satisfactorily repudiate such statement(s) within 48 hours of notification, FinCEN may void, in its sole discretion, the releases contained in the CONSENT and reinstitute enforcement proceedings against WUFSI. WUFSI expressly agrees to waive any statute of limitations defense to the reinstituted enforcement proceedings and further agrees not to contest any admission or other findings made in the CONSENT. This paragraph does not apply to any statement made by any present or former officer, director, employee, or agent of WUFSI in the course of any criminal, regulatory, or civil case initiated against such individual, unless WUFSI later ratifies such claims, directly or indirectly. WUFSI further agrees that, upon notification by FinCEN, it will repudiate such statement to the extent it contradicts either its acceptance of responsibility or any fact in the CONSENT.
VII. RELEASE
Execution of the CONSENT, and compliance with the terms of this ASSESSMENT and the CONSENT, settles all claims that FinCEN may have against WUFSI for the conduct

described in Section II of the CONSENT. Execution of the CONSENT, and compliance with the terms of this ASSESSMENT and the CONSENT, does not release any claim that FinCEN may have for conduct by WUFSI other than the conduct described in Section II of the CONSENT, or any claim that FinCEN may have against any party other than WUFSI. Upon request, WUFSI shall truthfully disclose to FinCEN all factual information not protected by a valid claim of attorney-client privilege or work product doctrine with respect to the participation of parties other than WUFSI, including employees or agents of WUFSI, or others, regarding the conduct described in Section II of the CONSENT. If FinCEN determines, in its sole judgment, that WUFSI has breached any portion of this agreement, FinCEN may void, in its sole discretion, the releases contained in the CONSENT and reinstitute enforcement proceedings against WUFSI, subject to written notice to WUFSI and an opportunity to cure. WUFSI expressly agrees to waive any statute of limitations defense to the reinstituted enforcement proceedings regarding the conduct described in Section II of the CONSENT, and further agrees not to contest any admission or other findings made in the CONSENT. Accepted by:
/S/ 1/19/17 .
Jamal El-Hindi Date
Acting Director
FINANCIAL CRIMES ENFORCEMENT NETWORK
U.S. Department of the Treasury