Congress Urged to Reform AML Rules, Repeal Corporate Transparency Act Amid Rising Fraud Costs

Witnesses from the ranks of business and banking told lawmakers that efforts to fight payment and investment scams must be aided by a “whole government” approach, along with fine-tuning of suspicious activity reporting — in addition to a repeal of the Corporate Transparency Act.

Tuesday, (April 1), the House Financial Services Subcommittee on National Security, Illicit Finance, and International Financial Institutions held a hearing titled “Following the Money: Tools and Techniques to Combat Fraud” that delved into the rising costs of fraud, and the ways in which advanced technologies can be, and are being, leveraged by criminals and banks as they do battle with one another.

But most witnesses charged that existing regulations have not kept pace with new attack vectors, and impose burdens on smaller businesses as they seek to comply with those regulations.

Subcommittee Chair Warren Davidson, R-Ohio, said in his opening remarks that the Federal Trade Commission has estimated that U.S. consumers lost $5.7 billion to investment scams last year.

“Criminals are increasingly finding ways to bypass U.S. financial regulations to scam Americans into draining their life savings for the sake of their own illicit gain,” he said.

Eyeing the Bank Secrecy Act

Separately, in demonstrating the scope of illicit activity, Kathy Stokes, director of fraud prevention at the AARP, said in her testimony that even the FTC has underreported the amount of money stolen annually; in 2023, there were reports that the money stolen from fraud topped $158 billion.

“These criminal enterprises leverage a vast array of tools to commit their crimes, including all methods of communication and forms of payment, complex impersonation schemes, anonymous shell companies, and human trafficking,” Stokes said.

And Jacqueline Burns Koven, head of cyber threat intelligence for the blockchain data platform Chainalysis, pointed to the rise of pig butchering and other scams, but added that there are no mechanisms or obligations through which state, local and federal agencies share information with each other and with the private sector, while crypto firms and financial institutions share scam information to the agencies through suspicious activity and transaction level reports.

BSA Outdated?

With a nod to the Bank Secrecy Act, which has been in place for decades, Rep. Davidson said that the there must be continuous assessment of the tools — including suspicious activity reports (SARs, tied to transactions over $5,000) and currency transaction reports (CTRs, for transactions above $10,000) used to combat the fraudsters.

“The reporting burden keeps growing with no obvious improvement of effectiveness,” said Davidson who noted that the numbers have not been adjusted for inflation. “FinCEN [Financial Crimes Enforcement Network] estimated that an average total of 12,600 SARs and 57,000 CTRs were filed each day for fiscal year 2023.

“According to a December 2024 GAO report, law enforcement agencies accessed only 5.4% of total CTRs filed to FinCEN between 2014-2023. Not very efficient,” he said.  He urged that the thresholds be examined for (possibly higher) adjustment.

Jeff Brabant, VP of federal government relations at the National Federation of Independent Business, urged lawmakers to repeal the Corporate Transparency Act, which he said exposes smaller firms to data privacy threats as they report beneficial ownership data to FinCEN.

“The federal database will be breached and it will be hacked,” he told the subcommittee. “This is why Congress and the Treasury must immediately and permanently delete the records of the millions of U.S. small business owners who already filed their [reports].”  He stated that the businesses — numbering about 33 million firms — are filing details that otherwise could be accessed by government agencies without subpoenas or warrants.

In the meantime they tend to hire accountants or counsel to assist with the filings, which adds to operating costs and regulatory burdens, while fraudsters try to get them to share information through phishing and other scams that come from seemingly official communications or websites.

Strategic Approach

Darrin McLaughlin, executive vice president and chief anti-money laundering (AML) and sanctions officer for Flagstar Bank, appeared before the panel on behalf of the American Bankers Association, and said that 1 in 3 adults in the U.S. had experienced financial fraud in just the last 12 months.

“Bad actors have leveraged cutting-edge technologies, social media and telecommunications to target Americans’ life savings,” he told the subcommittee.

“We need a strategic approach” that includes the banking industry, the government and other stakeholders, he said, and that “regulatory reforms let us focus on the real threat.”

Banks have embraced AML compliance and anti-fraud programs, he said, to detect anomalous patterns of fund flows. As for the SARs, he said, “By the time law enforcement receives the reports, it is often too late.”  He added that the “federal government has a database that is bursting with information that should be shared with the private sector.”

Although thousands of SARs are filed, he said, they may not in fact reflect illicit activity. “It would help banks to see analysis of these reports and other information the government may have.”

He advocated “meaningful reform” of the BSA, creating a more risk-based approach to AML, and streamlined reporting that allows banks to focus on higher risk-customers (especially when $10,000 is no longer an unusually large sum of money), where in his testimony he said that “BSA program rules should be amended to explicitly allow this reallocation of resources away from lower-risk and toward higher-risk customers and activities.”

During questioning, Davidson asked McLaughlin what has worked — and has not worked — as banks battle the fraudsters. McLaughlin pointed to a greater emphasis on education and “investment in advanced technologies” on the part of banks “to catch the fraud at the front door, as we call it, before they are able to transact with the institutions. There have also been advancements in the models and the scenarios for which we monitor customer behavior.”

Separately, Rep. Frank Lucas, R-Okla., asked about the burdens placed on small businesses for reporting, and Brabant said, by way of example, the mandate to report “substantial control” has been broadly defined: “So if you’re a restaurant manager and you have no ownership stake, you [still] may have substantial control. One of the challenges when you’re a small business owner is, ‘What senior staff do I have to put in?’ FinCEN doesn’t really define this, and you’re worried about going to jail for 10 years because you might not have put enough senior staff down.”