Assessment of Civil Money Penalty with Undertakings in the Matter of Hartsfield Capital Securities, Inc.

UNITED STATES OF AMERICA DEPARTMENT OF THE TREASURY FINANCIAL CRIMES ENFORCEMENT NETWORK IN THE MATTER OF No. 2003-05 HARTSFIELD CAPITAL SECURITIES, INC. Alpharetta, Georgia ASSESSMENT OF CIVIL MONEY PENALTY WITH UNDERTAKINGS I. INTRODUCTION The Secretary of the United States Department of the Treasury has delegated to the Director of the Financial Crimes Enforcement Network (“FinCEN”) the authority to determine whether a financial institution has violated the Bank Secrecy Act, 31 U.S.C. §§5311 et seq., and the Bank Secrecy Act regulations, 31 CFR Part 103, and what, if any, sanction is appropriate.

In order to resolve this matter, and only for that purpose, Hartsfield Capital Securities, Inc. (“Hartsfield”), has entered into a CONSENT TO THE ASSESSMENT OF CIVIL MONEY PENALTY WITH UNDERTAKINGS (“CONSENT”) dated November 19, 2003, without admitting or denying FinCEN’s determinations described in Sections III and IV below, except as to jurisdiction in Section II below, which is admitted. The CONSENT is incorporated into this ASSESSMENT OF CIVIL MONEY PENALTY WITH UNDERTAKINGS (“ASSESSMENT”) by this reference.

II. JURISDICTION Hartsfield, a Georgia corporation formed in 1998, is a securities broker-dealer located in Alpharetta, Georgia. Since Hartsfield is registered as a broker-dealer with the Securities and Exchange Commission (“SEC”), Hartsfield is a “financial institution” under 31 U.S.C. §5312(a)(2)(G) and 31 CFR 103.11(f), and a “covered financial institution” under 31 CFR 103.175(f). As of June 30, 2003, Hartsfield had total assets of $23,931, and net capital of $6,357. For the fiscal year ended December 31, 2002, Hartsfield had total revenue of $116, 983. Hartsfield is subject to comprehensive regulation by the SEC and the National Association of Securities Dealers, Inc. (“NASD”). III. FINCEN’S DETERMINATIONS A. Violations of Correspondent Account Rules FinCEN has determined that Hartsfield failed to take reasonable measures to prevent foreign shell banks from indirectly using correspondent accounts at Hartsfield. A covered financial institution is prohibited from establishing, maintaining, administering, or managing a

correspondent account for a foreign shell bank. 31 U.S.C. §5318(j)(1); 31 CFR 103.177(a)(1). In addition, a covered financial institution must take reasonable measures to ensure that any correspondent account it establishes, maintains, administers, or manages for a foreign bank is not being used by the foreign bank to provide banking services indirectly to a foreign shell bank. 31 U.S.C. §5318(j)(2); 31 CFR 103.177(a)(1).

Under the safe harbor provided by 31 CFR 103.177(b), a covered financial institution that receives a complete certification in a timely manner is in compliance with the provisions described above (absent notice that information in the certification may be inaccurate). The certification is set forth in an appendix1 and includes, among other things, representations from the foreign bank that (a) the foreign bank is not a foreign shell bank and (b) the correspondent account is not being used by the foreign bank to provide banking services indirectly to a foreign shell bank. In lieu of obtaining the certification, a covered financial institution may obtain “documentation of the information required by [the] certification.” 31 CFR 103.177(d)(1). For correspondent accounts existing on or before October 28, 2002, covered financial institutions were required, under 31 CFR 103.177(d)(1), to obtain complete certifications or documentation on or before March 31, 2003, or close the accounts within a commercially reasonable period of time.2 Because the requirement was absolute, and because broker-dealers expressed concerns about their ability to meet the original deadline, FinCEN extended the deadline by over three months, from its original date of December 26, 2002.3 As of April 22, 2003, Hartsfield had seventeen delivery-versus-payment brokerage accounts established for foreign customers, sixteen of which are “foreign banks,” as the term is defined in 31 CFR 103.175(g) and 31 CFR 103.11(o). Moreover, sixteen of the accounts are “correspondent accounts,” as the term is defined in 31 CFR 103.175(d).4 For six of the correspondent accounts, Hartsfield received no certifications or documentation whatsoever. Hartsfield did not close the accounts, as required by 31 CFR 103.177(d)(1), until the matter was raised by the SEC on April 22, 2003. A representative of Hartsfield met personally with the customers for the accounts “during the week of July 17, 2003,” approximately one month after Hartsfield received the June 16, 2003, deficiency letter from the SEC, and over three months after the March 31, 2003, deadline for obtaining the 1 See Appendix A to Subpart I of 31 CFR Part 103. 2 The preamble to 31 CFR 103.177 makes it clear that the provision permitting covered financial institution to delay closing correspondent accounts for a “commercially reasonable” period of time was intended to facilitate the orderly closure of the accounts, by permitting covered financial institutions to address, among other things, issued raised by “open securities or futures positions…or transaction accounts with outstanding checks or other transactions that need to be accounted for.” See 67 FR 60562. 3 See 67 FR 78383. 4 A “correspondent account” is “an account established . . . for a foreign bank to receive deposits from, [or] to make payments or other disbursements on behalf of[,] a foreign bank, or to handle other financial transactions related to the foreign bank.” 31 CFR 103.175(d). For covered financial institutions that are registered broker-dealers, the term would include “any account . . . that permits the foreign bank to engage in securities transactions, funds transfers, or other financial transactions through [the] account.” See 67 FR 60562. This would clearly cover any delivery￾versus-payment brokerage account established for a foreign bank. 2

certifications or documentation. Hartsfield eventually closed the accounts after the July meetings with the customers. Moreover, for ten of the correspondent accounts, Hartsfield received certifications or documentation that omit required representations concerning direct and/or indirect services being provided to foreign shell banks through the correspondent accounts. Hartsfield has yet to receive certifications or documentation that contain all of the required representations, and the accounts remain active, with Hartsfield engaged in ongoing trading relationships through the accounts. B. Recordkeeping Violations FinCEN has determined that Hartsfield failed to keep certain records concerning correspondent accounts for foreign banks, as required by the Bank Secrecy Act. A covered financial institution that maintains a correspondent account for a foreign bank must keep records (a) identifying the owners of the foreign bank and (b) containing the name and address of a person, residing in the United States, who will act, in connection with requests for records concerning the correspondent account, as an agent for service of legal process. 31 U.S.C. §5318(k)(3)(B); 31 CFR 103.177(a)(2). Under the safe harbor provided by 31 CFR 103.177(b), a covered financial institution that obtains a complete certification in a timely manner is in compliance with 31 U.S.C. §5318(k)(3)(B) and 31 CFR 103.177(a)(2) (absent notice that information in the certification may be inaccurate). The covered financial institution could also comply with the provisions by obtaining “documentation of the information required by [the] certification.” 31 CFR 103.177(d)(1). If the covered financial institution has not, by the March 31, 2003, deadline, received a complete certification, or documentation of the information required by the certification, the covered financial institution must close all correspondent accounts with the foreign bank within a commercially reasonable period of time. 31 CFR §103.177(d)(1). For six of the correspondent accounts, Hartsfield received no certifications or documentation whatsoever. Hartsfield’s failure to close these correspondent accounts within a commercially reasonable period of time after the March 31, 2003, deadline violates the recordkeeping provisions in 31 U.S.C. §5318(k)(3)(B) and 31 CFR 103.177(a)(2). Also, for ten of the correspondent accounts, Hartsfield received certifications or documentation that omit information on the ownership of the foreign bank or on agents for service of legal process. Hartsfield has yet to receive certifications or documentation that contain all of the required information, and the accounts remain active, with Hartsfield engaged in ongoing trading relationships through the accounts. The failure to obtain information on agents for service of legal process is of particular concern, since the information is essential for perfecting legal process on foreign banks and for ensuring that domestic law enforcement agencies have access to foreign bank records. Foreign bank records could be used to reconstruct deposits and other transactions between foreign banks 3

and their customers, thereby assisting law enforcement in their investigation of money laundering and terrorist financing.5 C. Violations of Anti-Money Laundering Program Requirements FinCEN has determined that Hartsfield violated the anti-money laundering (“AML”) program requirements in the Bank Secrecy Act. 31 U.S.C. §5318(h)(1) requires a broker-dealer registered with the SEC to establish an AML program that includes the following elements: internal policies, procedures, and controls; a compliance officer; an ongoing employee training program; and an independent audit function to test programs. Under section 352(b) of the USA PATRIOT Act, all broker-dealers registered with the SEC must have established, on or before April 24, 2002, an AML program that complies with the requirements of 31 U.S.C. §5318(h)(1). Under 31 CFR 103.120, a broker-dealer registered with the SEC, and subject to regulation by the NASD, complies with the requirements of 31 U.S.C. §5318(h)(1) if the broker￾dealer “implements and maintains an [AML] program that complies with the rules, regulations, or requirements of [the NASD] governing such programs.” On April 22, 2002, the SEC approved NASD Rule 3011, which requires brokers-dealers regulated by the NASD to “establish a written AML program reasonably designed to achieve and monitor compliance with the Bank Secrecy Act . . . and the [Bank Secrecy Act regulations].” NASD Rule 3011 lists the basic elements that each AML program must contain. The elements are similar to those enumerated in 31 U.S.C. §5318(h)(1), with the addition of a specific requirement that each AML program address the reporting of suspicious transactions. In addition, NASD Rule 3011 states explicitly that each AML program must be approved, in writing, by a member of the broker-dealer’s senior management. Although section 352(b) of the USA Patriot Act required Hartsfield to establish a fully compliant AML program on or before April 24, 2002, Hartsfield had established no AML program whatsoever until August 1, 2002, more than three months after the April 24, 2002, deadline. Moreover, the AML program established by Hartsfield on August 1, 2002, lacked the basic elements enumerated in 31 U.S.C. §5318(h)(1) and NASD Rule 3011; the program did not provide for independent testing or for the appointment of a compliance officer responsible for implementing and monitoring the program’s day-to-day operations and internal controls, and did not address procedures for the filing of suspicious activity reports. In addition, the AML program lacked policies, procedures, and internal controls, not specifically enumerated in 31 U.S.C. §5318(h)(1) and NASD Rule 3011, that are nevertheless essential to “achieving and monitoring compliance with” the Bank Secrecy Act and the Bank Secrecy Act regulations. These include policies, procedures, and internal controls that relate to the following: customer 5 The Secretary of the Treasury or the U.S. Attorney General “may issue a summons or subpoena to any foreign bank that maintains a correspondent account in the United States and request records related to such correspondent account, including records maintained outside of the United States relating to the deposit of funds into the foreign bank [emphasis added].” 31 U.S.C. §5318(k)(3)(A)(i). The summons or subpoena “may be served on the foreign bank in the United States . . . if the foreign bank has a representative in the United States [emphasis added].” 31 U.S.C. §5318(k)(3)(A)(ii). Similar language is contained in 31 CFR 103.185. 4

identification; heightened supervision of foreign domiciled, private banking, foreign official, or suspicious accounts; account monitoring; and identification of money laundering red flags. Although Hartsfield responded by revising its AML program on March 18, 2003, the revised program was not approved by a member of Hartsfield’s senior management until the matter was raised by the SEC on April 22, 2003. Mr. Banzhaf finally approved the revised program on April 23, 2003, a year after the deadline for the establishment of a fully compliant AML program. D. Civil Money Penalties for Hartsfield’s Correspondent Account Violations Unlike the civil penalty provisions of 31 U.S.C. §5321(a)(1), which require a finding of willfulness to impose a penalty for violation of the Bank Secrecy Act and certain implementing regulations, Section 5321(a)(7), which applies to violations of Section 5318 (i) and (j) as well as Section 5318A, does not contain such a requirement. Therefore, FinCEN is not required to show that Hartsfield’s violations of the correspondent account provisions in 31 U.S.C. §5318(j)(2) were willful. FinCEN can assess a penalty upon a showing that these provisions were violated. FinCEN notes, however, that the violations in this case were neither inadvertent nor immaterial, and Hartsfield was plainly on notice of the applicability of the statutory requirements to its foreign bank customers. Hartsfield clearly violated 31 U.S.C. §5318(j)(2). Section 5318(j)(2) provides that the reasonable steps to prevent the provision of indirect services to shell banks shall be delineated by regulation. The implementing regulation, 31 CFR 103.177(d)(1), clearly and unambiguously required Hartsfield to obtain the required documentation and, if it did not, to close the correspondent accounts, and to refrain from executing, after March 31, 2003, any transactions through the accounts. Hartsfield’s multiple failures to do so violated Section 5318(j)(2). E. Hartsfield’s Violations of the AML Program Requirements Were Willful FinCEN has determined that Hartsfield’s violations of the AML program requirements were willful. The USA Patriot Act clearly imposed an April 24, 2002, deadline on broker￾dealers to establish a fully-compliant AML program. This deadline was well-publicized by FinCEN, the SEC, and the NASD. The NASD published an “AML Program Template,” which addresses the deadline. Moreover, the April 24, 2002, deadline is re-stated in NASD Rule 3011, and the NASD issued a special notice to NASD members that addressed the deadline.6

Nevertheless, Hartsfield established no AML program whatsoever until August 1, 2002, more than three months after the deadline. Moreover, when Hartsfield finally established an AML program, the program lacked the basic elements required by the Bank Secrecy Act, including approval by senior management. As a result, Hartsfield’s failure to establish an AML program was willful. 6 See Special NASD Notice To Members 02-21. 5

IV. CIVIL MONEY PENALTY Under 31 U.S.C. §5321(a)(1), FinCEN may impose, for willful violations of the Bank Secrecy Act or the Bank Secrecy Act regulations, a civil money penalty of not more than the greater of the amount involved in the transaction and $25,000, up to a maximum of $100,000. Moreover, under 31 U.S.C. §5321(a)(7), FinCEN may impose, for any violation of 31 U.S.C. §5318(j), a civil money penalty equal to twice the amount of the transaction, up to a maximum of $1,000,000. FinCEN has determined that, for the violations of the Bank Secrecy Act and the Bank Secrecy Act regulations described in this Assessment, and considering all of Hartsfield’s relevant circumstances, a civil money penalty of $10,000 against Hartsfield is appropriate. V. CONSENT TO ASSESSMENT In order to resolve this matter, and only for that purpose, Hartsfield, without admitting or denying either the facts or determinations described in Sections III and IV above, except as to jurisdiction in Section II, which is admitted, consents to the assessment of a civil money penalty against it in the sum of $10,000. Hartsfield agrees to pay the amount of $10,000 within twenty (20) business days of the execution of this ASSESSMENT . Such payment shall be: a. made by certified check, bank cashier’s check, or bank money order; b. made payable to the United States Department of the Treasury; c. hand-delivered or sent by overnight mail to Nicholas A. Procaccini, Assistant Director and Chief Financial Officer, FinCEN, 2070 Chain Bridge Road, Suite 200, Vienna, Virginia 22182; and d. submitted under a cover letter, which references the caption and file number in this matter. Hartsfield recognizes and states that it entered into the CONSENT freely and voluntarily and that no offers, promises, or inducements of any nature whatsoever were made by FinCEN or any employee, agent, or representative of FinCEN to induce Hartsfield to enter into the CONSENT, except for those specified in the CONSENT. Hartsfield understands and agrees that the CONSENT embodies the entire agreement between Hartsfield and FinCEN relating to this enforcement matter only, as described in Section III above. Hartsfield further understands and agrees that there are no express or implied promises, representations, or agreements between Hartsfield and FinCEN other than those expressly set forth or referred to in the CONSENT and that nothing in the CONSENT or this ASSESSMENT is binding on any other agency of government, whether federal, state, or local. 6

VI. UNDERTAKINGS By its execution of the CONSENT, Hartsfield, in order to resolve this matter, and only for that purpose, and without admitting or denying either the facts or the determinations described in Sections III or IV above, except as to jurisdiction in Section II, which is admitted, agrees to the following UNDERTAKINGS:

1. Within thirty (30) business days of the execution of this ASSESSMENT, Hartsfield shall either close the ten correspondent accounts for which Hartsfield received incomplete certifications or documentation, or obtain complete certifications or documentation for the ten correspondent accounts, such complete certifications or documentation to include, among other things, (a) representations that the customers for the accounts are not foreign shell banks, and that the accounts are not being used by the customers to provide banking services indirectly to foreign shell banks, (b) the required information on agents for service of process, and (c) any required information on the ownership of the customers.
2. Hartsfield shall, immediately upon execution of this ASSESSMENT, and until Hartsfield has received such complete certifications or documentation, refrain from permitting the execution of any transactions through the ten correspondent accounts.
3. Hartsfield shall document its compliance with the preceding UNDERTAKINGS. Hartsfield shall provide FinCEN with copies of all documentation relating to its compliance with the preceding UNDERTAKINGS, including any certifications or documentation obtained pursuant to the preceding UNDERTAKINGS, within forty-five (45) business days of the execution of this ASSESSMENT. Failure to comply materially with the UNDERTAKINGS will constitute a violation of the CONSENT. In the event FinCEN determines that a material failure to comply with the UNDERTAKINGS has occurred, FinCEN may take any action against Hartsfield it deems appropriate, after providing Hartsfield with adequate opportunity to respond. Actions taken by FinCEN may include, without limitation, the imposition of a civil money penalty, or ordering other remedial sanctions with FinCEN’s authority. 7

VII. RELEASE Hartsfield understands that its execution of the CONSENT and compliance with the terms of this ASSESSMENT and the CONSENT constitute a complete settlement of civil liability for the violations of the Bank Secrecy Act and the Bank Secrecy Act regulations described in this ASSESSMENT and the CONSENT.

By: ___//s// William F. Baity, Acting Director FINANCIAL CRIMES ENFORCEMENT NETWORK U.S. Department of the Treasury Date: ______November 24, 2003 8