EXHIBIT A¶
UNITED STATES DISTRICT COURT FOR THE SOUTHERN DISTRICT OF NEW YORK¶
GOVERNMENT OF THE UNITED STATES VIRGIN ISLANDS,¶
Plaintiff, v.
¶
JPMORGAN CHASE BANK, N.A.,¶
Defendant/Third-Party Plaintiff.¶
Case No. 1:22-cv-10904-JSR¶
REPORT OF ROBERT J. JR.¶
B. Underreporting Incentives at Significant Financial Institutions.¶
- As noted above, independent oversight of financial institutions’ compliance with their obligations to report suspicious activity is important because economic incentives can lead rational bank executives to prefer that the bank underreport suspicions about their customers.{sup}
21
{sup}19 Returning to the possibility that board-oversight failures in this area can lead to liability for breach of directors’ fiduciary obligations, see supra note 8, I note that the Delaware courts recently dismissed a Caremark claim, even post-Marchand, in the cybersecurity context. Importantly, however, there Chancery made clear the importance of the absence of an allegation that the firm violated positive law. Construction Indust. Laborers Pension Fund v. Bingle, 2022 WL 4102492 (Del. Ch. 2022) (granting a motion to dismiss while noting that there, unlike here, there was “no credible allegation that the Company violated positive law,” and concluding that, “absent statutory or regulatory obligations, how much effort to expend to prevent criminal activities by third parties against the corporate interest requires an evaluation of business risk, the quintessential board function”).¶
{sup}20 For example, SEC rules now require, for “entities that directly support any one of six key securities market functions” such as market surveillance, a report on internal controls related to surveillance systems to be presented to the entity’s board of directors. Sec. & Exch. Comm’n, Final Rule, Regulation Systems Compliance and Integrity, Release No. 34-73639 (2015). That rule builds on years of SEC regulatory guidance requiring board and regulator oversight of significant financial institutions’ cybersecurity compliance plans. See, e.g., Sec. & Exch. Comm’n, Final Rule, Regulation Systems Compliance and Integrity, Release No. 34-73639 (November 19, 2014), at 364 (“To help ensure that persons at the highest levels of an SCI entity are made aware of any issues raised in the [entity’s] SCI review, the Commission is also adopting a requirement for each SCI entity to submit to its board of directors … a report of the SCI review and any response by senior management within 60 calendar days …”).¶
{sup}21 An important area of financial-regulation literature contends that banks have incentives to overreport their suspicions to regulators, because “crying [█]” in this way “can dilute the information value of reports,” reducing the risk that law enforcement make use of the reports against the bank’s clients. Elod Takats, A Theory of “Crying [█]”: The Economics of Money Laundering Enforcement, 27 J. L. & ECON. ORG. 32 (2011). Evidence on that hypothesis is mixed, however, compare id. and Lucia Dalla Pellegrino & Donato Masciandaro, The Risk-Based Approach in the New European Anti-Money Laundering Legislation: A Law and Economics View, 5 REV. L. & ECON. 931 (2009) (providing evidence of the “crying [█]” effect in Europe) with Brigitte Unger & Frans Van Waarden, How to Dodge Drowning in Data? Rule-and Risk-Based Anti Money Laundering Policies Compared, 5 REV. L. & ECON. 953 (2009) (“[U]nlike in other countries, this ‘crying [█]’ problem"" “did not happen in the¶
To see why, note that a bank’s risk of detection for underreporting is low and distant in time, while costs of reporting suspicions about one’s own customers can be meaningful and prompt.22¶
-
Acknowledging that bank executives have reason to permit underreporting of clients’ suspicious activities, regulators, boards, and advisors have all urged financial institutions to be wary of the risk of noncompliance in this area.23 To address that risk, most banks “follow certain accepted organizational structuring practices” identified by banking regulators.24 One such practice is the segregation of the “function that carries out . .. revenue generation” from the “function that … exercise[s] institutional controls such as the … reduction of regulatory risk.”25
-
The revenue-risk segregation precept draws on longstanding accounting principles governing internal controls in business organizations. Since the Treadway Commission’s 1992 report and the adoption of the Sarbanes-= Act, for example, effective internal controls have addressed the risk known as “management override.” The principle is straightforward: internal
Netherlands”) and Mario Gaza, Francesco Manaresi, Domenico Junior Marchetti & Marco Marinucci, The Impact of Anti-Money Laundering Oversight on Banks’ Suspicious Activity Reporting: Evidence from Italy, BANK OF ITALY OCCASIONAL PAPER No. 491 (2019) (finding, using a difference-in-differences design, that an increase in regulator oversight of suspicious-activity reporting led to an increase in reports—and, “[c]rucially, this effect is not limited to low-quality reports, as feared in the literature,” but instead includes higher-quality reports as well).¶
Without taking a view on that empirical question, I offer three observations. First, much of this literature was produced before the development of modern data-analysis techniques, such as those I saw in use in both the Division of Enforcement and Division of Trading and Markets at the SEC, that allow regulators to process significant amounts of data rapidly. Second, sophisticated financial-institution counsel and regulators themselves certainly do not take the view that overreporting is a problem; to the contrary, as explained above, their concern has been underreporting. Finally, note that underreporting is not necessarily mutually exclusive with the “crying Mr’ hypothesis. A bank might, for example, rationally choose to overreport its suspicions about accounts that arc relatively less profitable while underreporting suspicions about accounts that are more profitable.¶
22 Because the legal standards governing reporting are subjective, banks have considerable flexibility in determining not to report suspicions to regulators. Mariano-Florentino Cuellar, The Tenuous Relationship Between the Fight Against Money Laundering and the Disruption of Criminal Finance, 93 J. CRIM. L. & CRIMINOLOGY 311, 431 (2003). For a model describing the limits of the incentive contract between the government and banks with respect to reporting, see Ricardo Azevedo Araujo, Assessing the Efficiency of Anti-Money Laundering Regulation: An Incentive-Based Approach, II J. MONEY LAUNDERING CONTROL 67 (2008); Donato Masciandaro, Money Laundering: The Economics of Regulation, 8 EUR. J. L. & ECON. 225 (1999).¶
23 Many large law-firm financial-institution practices have issued more than one memorandum to their financial-services clients urging: “When in [d]oubt, file a SAR.” PAUL HASTINGS, STAY CURRENT: FINCEN SHARPENS TEETH WITH NEW ENFORCEMENT DIVISION (October 2013).¶
4 Jeffrey R. Boles, Financial Sector Executives as Targets for Money Laundering Liability, 52 AM. BuS. L. J. 365, 388 n.139 (2015) (citing BASEL COMM. BANKING SUPERVISION, SOUND MANAGEMENT OF RISKS RELATED TO MONEY LAUNDERING AND FINANCING OF TERRORISM 2 (2014)).¶
25 Boles, supra note 24, at 388.¶
controls must be designed to limit profit-motivated managers’ ability to stop compliance-related information from reaching the board.¶
-
The reason for the principle is equally clear: managers have economic incentives to keep choices related to balancing revenue and risk from the board. As the American Institute of Certified Public Accountants explained in 2005, when “management is under pressure,” “particularly [when] the consequences of failing to meet financial goals can be significant,” management may wish to impede reporting to the board.26
-
At financial institutions, which must balance profit opportunities with their legal obligations to report their own customers’ suspicious activities, risks related to management override are especially acute. Accordingly, for decades bank examiners have been concerned with board and senior-executive oversight of exceptions to bank policies. For example, the 2002 Comptroller of the Currency’s handbook on internal bank controls requires bank examiners to “[d]etermine whether the board and senior management have established effective control activities in all lines of business,” “including whether processes exist to ensure that” “[p]olicy overrides are minimal,” and “exceptions are reported to management.” In the end, according to bank examiner manuals, a bank’s “board of directors bears ultimate responsibility to determine [its] AML risk appetite as part of [the bank’s] business strategy.”27
-
One might argue that none of this is necessary because banks pay financial penalties, and suffer reputational costs, when their underreporting is detected by law-
{sup}\$6 AMERICAN INSTITUTE OF CERTIFIED PUBLIC ACCOUNTANTS, MANAGEMENT OVERRIDE OF INTERNAL CONTROL: THE ACHILLES’ HEEL OF FRAUD PREVENTION (2005). That is especially true, the Institute said, “when an individual believes internal control can be overridden,” “for example, because [a senior) individual is in a position of trust or has knowledge of specific deficiencies in internal control.” Id.¶
{sup}27 Boles, supra note 24, at 390 (citing FDIC, RISK MANAGEMENT MANUAL OF EXAMINATION POLICIES Section 4.1 (2005)). The FDIC’s description of decisions related to “AML risk appetite” as part of a bank’s “business strategy” implicates the question noted above, viz., whether a board’s determination to take risk regarding compliance with law can be properly described as a business judgment as a matter of Delaware law, see supra notes 8, 18 (citing Bingle, 2022 WL 4102492 (Del. Ch. 2022)), a question beyond the scope of this report.¶
enforcement authorities, and that such costs will induce an optimal level of reporting.28 And in fact several significant financial institutions, including JPM, HSBC, Citigroup, TD Bank, U.S. Bancorp, and Western Union, among others, have paid billions in penalties for underreporting suspicious activity? Another possibility, however, is that bank executives rationally choose to underreport such activity, anticipating that the business benefits of underreporting exceed the expected costs of any fines and reputational consequences. On that view, penalties should not be expected to induce bank executives to design their internal oversight functions in a fashion that will lead the bank to report all the suspicious activity the law requires them to report.30¶
- To consider these possibilities, for purposes of this report3 I I collected data on
i11While some existing literature suggests that these costs may not be meaningful, see. e.g., KAREN NERSHI, STUDIES IN THE POLITICAL ECONOMY OF ANTI-MONEY LAUNDERING REGULATION 44 (2021), as noted above, rather than rely exclusively on this literature I have separately collected and analyzed data on that subject for purposes of forming my opinions in this case.¶
{sup}29 HSBC forfeited more than $1.2 billion in connection with its failures to report customers’ suspicious activities in 2012. Staff of Sen. Permanent Subcomm. on Investigations, Comm. on Homeland Security & Governmental Affairs, 112th Cong., U.S. Vulnerabilities to Money Laundering, Drugs, and Terrorist Financing: HSBC Case History, at 4 (2012). Citigroup, after being subject to consent orders from the OCC, FDIC, and the California Department of Financial Services, nevertheless failed to address AML deficiencies that led to a $140 million fine in 2015. Federal Deposit Insurance Corporation (“FDIC”), Press Release, FDIC and CDBO Assess Civil Money Penalties Against Banamex USA. Century City, CA (July 22, 2015). TD Bank was assessed a $37.5 million penalty by Treasury’s FinCEN in 2013 for failure to report suspicious activity related to what was later found to be a “massive Ponzi scheme.” FinCEN, Press Release, FinCEN Fines TD Bank for Failing to Report Nearly SI Billion in Suspicious Transactions Related to Florida Ponzi Scheme (Sept. 23, 2015) (“In the face of repeated alerts on [certain] accounts by the Bank’s money-laundering surveillance software over an 18 month period, the Bank did not do enough to prevent the pain and financial suffering of innocent investors.” (quoting FinCEN’s Director)). U.S. Bancorp paid $528 million to settle the Department of Justice’s charges that it willfully failed to file SARs. U.S. Department of Justice, United States Attorney’s Office for the Southern District of New York, Press Release, Manhattan U.S. Attorney Announces Criminal Charges Against U.S. Bancorp for Violations of the Bank Secrecy Act (February 15, 2018) (quoting United States Attorney Geoffrey Berman as expressly noting that the bank chose to “operate its [AML] program ‘on the cheap,’” leading to a failure to file SARs). And Western Union paid $184 million to settle FinCEN’s charges that the firm failed to implement an adequate AML system and thus file timely SARs. FinCEN, Press Release, FinCEN Fines Western Union Financial Services, Inc. for Past Violations of Anti-Money Laundering Rules Coordinated Action with DOJ and FTC (January 19, 2017).¶
{sup}" Congress may also have understood that banks have little incentive to report their customers’ suspicious activity; the 1992 law creating the SAR-filing obligation included a safe harbor for liability for disclosing suspicious activity, regardless whether the bank’s report is “required by [law] or [made] in an excess of caution.” Lee v. Bankers Trust Co., 116 F.3d 540, 544 (2d Cir. 1999) (citing 31 U.S.C. § 5318(gX3) & 12 C.F.R. § 208.20(k)).¶
{sup}31 As prior research in this area has noted, “[o]nly recently have scholars started to investigate the impact of financial penalties andpotential reputational risks for banks likely to develop lax reporting standards.” Florcncio dc Silanes, A. McCahery & Paul C. Pudschedl, Corporate Governance and Value Preservation: The Effect of the FinCEN Leak on Banks, 85 L. & CONTEMP. PROBS. 247, 249 (2022). Using data from the Violation Tracker database, id. at 258, that study shows that publicly traded financial institutions suffer “a significant decrease¶
enforcement activity by federal regulatory agencies and the Department of Justice related to financial institutions’ failure to file SARs between 2010 and the present.32 Focusing only on publicly traded financial institutions, I then conducted an event study measuring abnormal returns for those institutions’ shares around the date the enforcement action was announced.¶
Figure 1 below summarizes the results of that study:¶
FIGURE L CUMULATIVE ABNORMAL RETURNS AROUND UNDERREPORTING ENFORCEMENT ACTIONS.33¶
- As Figure 1 shows, immediately after the announcement of enforcement actions for failure to file SARs, financial institutions that are subjects of those actions experience a price decline. But—consistent with prior literature on this subject—Figure 1 shows that this effect is temporary, as those negative returns are reversed just 40 days after announcement?’
of firm value in excess of the fines imposed,” but “the negative reaction to the fine announcement is limited to already eroded in the eleven-day event window,” such that the fines do not appear to “alter investors’ confidence in the long-term value [prospects] of the banks involved,” id.¶
32 My primary data source is the Bloomberg Law Anti-Money Laundering Enforcement Tracker, which collects and tags data on AML-related violations, providing among other details dates on which those enforcement actions were publicly announced. I supplemented Bloomberg data with hand-collected detail on publicly announced enforcement actions related to failure to file SARs. I then merged that dataset with information from the Center for Research in Security Prices (CRSP) database to allow me to perform an event study.¶
33 The event study approach described in Figure I follows the finance literature, modeling expected returns over a one-year trading window using the Fama and three-factor model. I then compute abnormal returns over the [-30, +90] window to examine the abnormal component of the market reaction to the announcement of enforcement actions for failure to file SARs.¶
34 See de Silanes, McCahery & Pudschedl, supra note 31 (similarly finding that the short-term negative effect is “already eroded in the eleven-day event window”).¶
In fact, in the 40 to 60 day window there is some evidence that the defendant financial institutions begin to outperform the market. Like the prior literature, Figure I suggests that the significant penalties imposed in the past have provided limited reason for bank executives to resist their incentives to report less suspicious activity than the law requires.¶
- At the SEC, I saw the problem of financial institutions’ incentives to underreport suspicious activity up close. Specifically, I oversaw enforcement actions related to failure to file SARs, which the SEC often charges as a violation of SEC Rule 17a-8.35 During my tenure, the Commission brought such charges against Charles Schwab,36 UBS,37 and TD Ameritrade,38 among others. I also reviewed and voted on actions related to failures to include required “red flag” information in filed SARs, in particular narrative detail that would aid regulators in preventing illegal activity.39 While on the SEC, I learned that such actions were brought by SEC Staff regularly because financial institutions often failed to report suspicious activity.
{sup}" See 17 C.F.R. § 240.17-8 (requiring broker-dealers subject to SEC oversight to comply with certain BSA regulations, including 31 C.F.R. § 1023.320 (referring to SAR filing and recordkeeping requirements)).¶
{sup}36 U.S. Sec. & Exch. Comm’n, Litigation Release No. 34-24189 (N.D. Cal. July 2, 2018) (charging, and settling for a $2,800,000 fine and the entry of a permanent injunction, a complaint related to a failure to file SARs).¶
{sup}37 U.S. Sec. & Exch. Comm’n, Release No. 34-84828, In the Matter of UBS Financial Services Inc. (December 17, 2018) (instituting and settling, for a $5 million fine, proceedings relating to a failure to file SARs).¶
{sup}" U.S. Sec. & Exch. Comm’n, Release No. 34-84269, In the Matter of TD Ameritrade, Inc.(September 24, 2018) (instituting and settling, for a $500,000 fine, proceedings relating to a failure to file SARs).¶
{sup}" SEC v. Alpine Sec. Corp., 413 F.Supp.3d 235, 245 (S.D.N.Y. 2019), ard, SEC v. Alpine Sec. Corp., 982 F.3d 68 (2d. Cir. 2019), “the narrative section of the [SAR] is critical. The care with which it is completed may determine whether or not the described activity and its possible criminal nature are clearly understood by investigators” (emphasis in original) (quoting FinCEN, Proposed Collection, Comment Request, Suspicious Activity Report by the Securities and Futures Industry, 67 Fed. Reg. 50,751 (Aug. 5, 2002)).¶
B. Consideration of Alternative Relief.¶
- As noted above, during my time on the Commission I reviewed and voted on enforcement actions related to financial institutions’ failure to file SARs. I also reviewed and voted on cases where, as here, the defendant financial institution was charged with
Several such cases involved defendants who repeatedly failed to abide their reporting obligations. In these cases, the SEC Staff often recommended, and I voted to support, the use of relief other than damages or monetary penalties.¶
- Table 2 below identifies and summarizes a selection of cases involving such relief both during and after my time on the Commission:
| Date | Defendants | Excerpt from Commission Determination | Relief |
|---|---|---|---|
| 3/28/2018 | Aegis Capital Corporation | ”Aegis, a registered broker-dealer, failed to file [SARs] on hundreds of transactions when it knew, suspected, or had reason to suspect that the transactions involved the use of the broker-dealer to facilitate fraudulent activity or had no business or apparent lawful purpose.” {sup}97 | Required to retain an independent compliance consultant at defendant’s expense and adopt recommendations subject to SEC review. |
| 7/2/2018 | Charles Schwab | ”Schwab violated Exchange Act Section 17(a) and Rule 17a-8 by failing to file [SARs] on suspicious transactions by independent investment advisers that Schwab terminated from its custodial platform. Schwab terminated the Advisers for engaging in activity Schwab determined violated its internal policies and presented risk to Schwab or its customers.” {sup}98 | Permanently enjoined from violation of Section 17(a) of the Securities Exchange Act of 1934. |
| 12/19/2018 | Central States Capital Markets | ”These proceedings arise out of the failure of [defendant] a registered broker-dealer, (1) to file Suspicious Activity Reports (“SARs”) when it knew, suspected, or had reason to suspect that certain transactions were conducted in order to hide or disguise funds derived from illegal activity or had no apparent lawful purpose, and (2) to accurately document the procedures set forth in its customer identification program.” {sup}99 | Required to retain an independent compliance consultant to review firm’s AML program. |
| 5/15/2019 | Wilson-[REDACTED] & Co., Inc. | ”[Defendant] failed to file [SARs] when it knew, suspected, or had reason to suspect that certain penny [REDACTED] transactions it executed on behalf of its customers involved the use of its firm to facilitate fraudulent activity or had no business or apparent lawful purpose. During the relevant period, Wilson ignored numerous red flags listed in its AML policies, failed to properly investigate certain conduct, and ultimately failed to file SARs on the suspicious activity.” {sup}100 | Required to retain an independent compliance consultant with expertise in AML programs. |
| 12/5/2021 | Wedbush Securities | ”[Defendant] failed to file [SARs] for certain suspicious transactions that it executed on behalf of its offshore customer … .” {sup}101 | Required to retain an independent compliance consultant with expertise in AML programs. |
Table 2. Sample of SEC Matters Using Alternative Relief in Cases Involving Failure to File SARs.¶
- The sample of SEC cases involving financial-institution underreporting shown in
Table 2 provides examples of two alternative types of relief I often oversaw during my time as a¶
{sup}97 U.S. Sec. & Exch. Comm’n, In re Aegis Capital Corp., Admin. Proc. File No. 3-18412 (March 2, 2018).¶
{sup}" Complaint in SEC v. Charles Schwab, No. 18-cv-3942 (N.D. Cal. July 2, 2018).¶
{sup}99 U.S. Sec. & Exch. Comm’n. /n re Central States Capital Markets, LLC, Admin. Proc. File No. 3-18940 (December 19, 2018).¶
{sup}100 U.S. Sec. & Exch. Comm’n. In re Wilsonn& Co.. Inc., Admin. Proc. File No. 3-19167 (May IS, 2019).¶
l°1 U.S. Sec. & Exch. Comm’n, In re Wedbush Securities Inc., Admin. Proc. File No. 3-20679 (December 15, 2021).¶
Commissioner.102 Both types of relief, and the circumstances in which the relief is warranted, can be understood in terms of the economic analysis described in this report.¶
-
First, Table 2 shows that as a condition of settlement the Commission has often required defendants in these cases to retain an independent compliance consultant (“ICC”) with expertise in assuring compliance with BSA reporting requirements. To see why such relief can be warranted, note that financial institutions and their executives have incentives to prefer that the institution underreport its suspicions about its customers, and that there is reason to think that the deterrence effects of underreporting penalties are limited. In such circumstances, economic penalties alone may not be sufficient to induce future compliance with reporting requirements. And since bank-governance principles call for independent oversight of reporting-related risk, from a social point of view an ICC may provide what a private entity could not on its own.
-
Second, Table 2 notes a case in which the defendant consented to a permanent injunction against future violations of Section I 7(a) of the Securities Exchange Act. To see why such relief can be helpful in these cases, recall the economic principle that the deterrence created by a liability regime can be expressed as the product of the probability of detection and the magnitude of the sanction.103 The costs of repeat litigation—whether for private plaintiffs or for government—can be considerable, and potential defendants know that. Understanding this ex ante, a potential actor will evaluate the probability of detection, in part, as a function of prospective plaintiffs’ cost of further litigation in the future.
-
In the presence of recidivism, initiating repeat litigation requires the examination of new (albeit familiar) facts and the funding of attorneys’ fees. By contrast, an award of
{sup}103 Rather than provide a representative sample, Table 2 simply surveys cases relating to underreporting brought by the Commission recently to offer context for the sought in cumstances.¶
{sup}103 Becker, supra note 92; or, with apologies, see Wendell The Path of the Law, 10 HARV. L. REv. 457, 459 (1897) (“If you want to know the law and nothing else, you must look at it as a bad man …”).¶
injunctive relief promises prospective plaintiffs, and particularly the government, that rights may be enforced in contempt proceedings, reducing the costs of future action and, in turn, increasing the ex ante deterrent effects of the relevant judgment.¶
- That is one reason why my former agency often seeks, and obtains, injunctive relief requiring defendants to retain ICCs and forswear further violations of the securities laws. Such injunctions may require tailoring to the facts of a particular offender and offense. 104 But particularly in cases where the government has reason to believe that the defendant has economic incentives not to comply with the law in the future, these injunctions can be important tools to help public enforcement authorities induce compliance in the presence of limited resources.
* * * *¶
- The information financial institutions are required to provide to law enforcement is crucial to the prevention of wrongdoing. But because they lack economic incentives to report their suspicions about their own clients, separation of banks’ business and compliance functions is necessary to ensure banks report all the information the law requires when the law requires it. JPM’s internal governance did not achieve that separation, and the tragic events that followed have imposed untold costs upon society. Appropriate remedies may be informed by JPM’s and its limited financial incentives to comply in the future.
Robert J. Jr.¶
June 16, 2023¶
{sup}101 Compare SEC v. Manor, 458 F.2d 1082, 1103 (2d Cir. 1972) and SEC v. Zwick, 2007 WL 831812 (S.D.N.Y. 2007) with SEC v. Goble, 2012 WL 1918819 (11th Cir. 2012).¶