The Western Union Company (“Western Union”) entered into a deferred prosecution agreement (“DPA”) on January 19th with the Department of Justice, based on alleged willful failures to maintain an effective AML program and the aiding and abetting of wire fraud. The DPA involved a combined $586 million monetary penalty and also involved related civil enforcement actions by the Federal Trade Commission and FinCEN. The agreement has been well-publicized and its details will not be repeated here; very generally, the DPA rests on allegations involving conduct stretching from 2004 through 2012 and an overall failure by Western Union to detect and prevent a kaleidoscope of illicit behavior by customers, from structured transactions to an international consumer fraud scheme to potential drug distribution. To be sure, this is a significant agreement – but it echoes the same general sort of facts and allegations which have become almost standard in large AML enforcement actions. However, the Western Union action contains at least one interesting wrinkle.
The Assessment of Civil Money Penalty by FinCEN against Western Union Financial Services, Inc. (“WUFSI”), a wholly-owned subsidiary of Western Union, contains in part the following allegation, which rests upon the fact that WUFSI’s business structure depended upon the use of various agents and subagents to process the money that was being transmitted:
WUFSI’s failure to develop and implement policies and procedures that could be reasonably expected to detect and cause the reporting of suspicious transactions led to unreasonable delay in filing thousands of [Suspicious Activity Reports, or] SARs. Before 2012, in many cases, WUFSI took over 90 days to investigate activity for which it had facts to constitute the basis for filing a SAR. Additionally, although WUFSI filed thousands of SARs on customers of its agent locations, it rarely filed SARs on its agent locations. WUFSI’s practice was not to identify agent locations as “subjects” of SARs unless it found the agent location to be complicit. WUFSI typically only found an agent to be complicit if the agent was arrested, publicly identified to be implicated in illicit transactions, or if WUFSI’s own investigation determined that the agent location was complicit. By not filing these SARs in a timely manner, WUFSI unnecessarily delayed reporting.
Although the precise facts are unclear, the above allegation charges WUFSI with not filing SARs on its own agents; merely filing SARs about activity by customers was insufficient. Although in theory the principle that SARs must be filed as to suspicious activity by insiders or agents is not controversial, the above language arguably creates – on the facts – a surprisingly high demand on financial institutions attempting to police their own. It was not enough for WUFSI to file a SAR when its “own investigation determined that the agent location was complicit.” It is unclear what standard is envisioned by FinCEN: should WUFSI have filed SARs on an agent even if its own investigation did not determine on the facts that the agent was complicit, but it was still possible that the internal investigation came to the wrong conclusion? Alternatively, is FinCEN contemplating that financial institutions should launch internal investigations with much greater frequency, even if the potential red flags regarding a particular situation are relatively limited? Granted, this enforcement action occurred within the context of a variety of other alleged transgressions, and the above conduct should not be viewed in a vacuum. It is possible that FinCEN is alleging – although this is not explicit – that WUFSI was ignoring red flags and was initiating internal investigations only when an agent’s misconduct was very flagrant.
Perhaps the facts underlying the above allegation were clear and egregious. Even so, and just like with court opinions, the devil often lies in the application of very broad enforcement language to the next case, which is perhaps not so clear. The quoted language creates the specter that a financial institution has some sort of obligation in the view of FinCEN regarding its own people and agents which transcends the pursuit of an investigation and a decision to put matters to rest if the investigation does not confirm the existence of misconduct. If institutions must second-guess their own investigations, it is unclear exactly what they must do.
