Privately Owned ATMs and Money Laundering

Since the first cash dispenser was introduced in 1969, getting money when you need it has become a common convenience and an essential way we get our money. There are 2.2 million automated teller machines (ATMs) in the world—more than 400,000 in the U.S. alone. Privately owned ATMs can be found in convenience stores, restaurants, bars, and grocery stores in large urban and small communities today. Some privately owned ATMs are owned by the proprietor of the business; some are owned by independent sales organizations (ISOs), which own many ATMs and place them in businesses in your community. However, as convenient as they are, privately owned ATMs are particularly susceptible to money laundering and fraudulent activity. Money laundering is the criminal activity of passing ill-gotten “dirty” money through a number of transactions, preferably electronic, so that the funds are “cleaned” to appear as if they were from legal activities. While bank-owned ATMs are subject to supervision by the prudential regulators, there is no federal oversight for privately owned ATMs.

Criminals are using “micro structuring” techniques, which are a variation of a practice sometimes called “smurfing”—the breaking down of large transactions into many smaller ones to evade detection by financial regulators. The deposits and withdrawals businesses transact to maintain their ATMs are so small they can evade detection by financial institutions and regulators. Micro structuring was criminalized by Congress in 1986. Immigration and Customs Enforcement officials say that “millions and millions of dollars” are laundered through micro structuring every year. As a financial institution, it is your responsibility to assess the risks associated with businesses or ISOs that have privately owned ATMs.

The first step in the due diligence process is to determine whether you have any relationships with businesses or ISOs that operate privately owned ATMs. During our Bank Secrecy Act exams, our clients often state that they have no privately owned ATMs. During our review of their cash reports, we may notice larger cash withdrawals, usually in increments of $20 (the typical bill used in ATMs) from businesses. Once we start investigating the activity on the business account, we will notice daily credits from one of the ATM service providers. This credit represents the amount of cash disbursed from the ATM; the business is receiving credit back from the ATM switch. We recommend financial institutions periodically scan their automated clearing house (ACH) files to search for ATM service providers or the term “ATM.” This will help detect accounts that may be associated with privately owned ATMs.

Once you determine you have a relationship with a business that owns or is operating an ATM, you need to enhance your due diligence and suspicious activity monitoring because of the increased risk of money laundering. According to the November 17, 2014, Federal Financial Institutions Examination Council (FFIEC) manual, at a minimum, policies, procedures, and processes should include:

• Review of corporate documentation, licenses, permits, contracts, or references including the ATM transaction provider contract.
• Review of public databases for information on the ATM owners.
• Processes for obtaining the addresses of all ATM locations, ascertaining the types of businesses in which the ATMs are located, and identification of targeted demographics.
• Determination of expected ATM activity levels, including currency withdrawals.
• Ascertainment of the sources of currency for the ATMs by reviewing copies of armored car contracts, lending arrangements, or any other documentation, as appropriate.
• Processes for obtaining information for the ISO regarding due diligence on its sub-ISO arrangements, such as the number and location of the ATMs, transaction volume, dollar volume, and source of replenishment currency.

The annual review of businesses and ISOs with privately owned ATMs should be documented, and periodic site visits are encouraged to help you better understand the business activity. An elevated risk rating may be merited to ensure your privately owned ATM owners are being monitored for suspicious activity. Cash withdrawals should be monitored for unusual trends. A test we perform when we are engaged to do a BSA exam is to compare the amount of debits (cash withdrawals) to the amount of credits (reimbursement from the switch for cash disbursed). If these two amounts are not similar, this should be investigated to understand the variance. Don’t forget to address businesses and ISOs with privately owned ATMs in your BSA/AML risk assessment!

The majority of privately owned ATMs are legitimate, but it is the responsibility of the financial institution to perform enhanced due diligence to ensure money is not being laundered through the ATMs. The more you do to proactively maintain the components discussed in this article, the more effective your program will be.