GAO’s FinCEN audits: access logs show a gate, not who was affected

Primary documents: U.S. Government Accountability Office, Status of Treasury’s Safeguards for Providing Access to Information on Corporate Ownership (23 June 2026) and Currency Transaction Reports: Improvements Could Reduce Filer Burden While Still Providing Useful Information to Law Enforcement (2025). These examine US financial-crime databases used by humans, not an AI agent or the Chinese, Iranian or Malian state operators. Their value for the AI-surveillance access test is the concrete difference between grant, log and population/outcome measures; do not transfer US safeguard compliance to foreign surveillance.

A positive control counterexample: FinCEN’s beneficial-ownership pilot makes other agencies apply for access with an agreement, standards and certification. Its system records dates, usernames, requests on behalf of others and query justifications; FinCEN samples queries monthly for justification mismatches and excess searching, reports escalations and audits authorized agencies annually. GAO verified review documentation for three access requests; FinCEN’s available monthly reviews through July 2025 found no negative findings, and officials said later ones also found none as of March 2026. Access may be restricted for noncompliance; this is evidence of an actual institutional owner with a revocable gate and log, not a measured prospective prevention rate for rogue agents, proof all inquiries were lawful or an observed AI-specific control. Annual audits of four pilot agencies had no completion timetable reported by GAO. A coding fault temporarily halted automated deletion of inactive users during March–April 2025, illustrating why formal policy is not equivalent to continuously operating enforcement.

A different database exposes the blind spots: In its currency transaction report (CTR) audit GAO analyzed agency portal views/exports and five agencies’ internal-system records. For reports filed 2014–23, about 9.1 million of 167.5 million (5.4%) had a recorded portal access; this excludes agency integrated systems, information obtained directly from banks and fields visible in a search-result preview before opening the report. Bulk download creates the reverse error: a logged access does not prove a human read that report. Agencies’ internal systems log access differently. After a June 2024 retention change the main portal limited access to the preceding 10 years and current year, but GAO says CBP, FBI and ICE retained copied CTRs indefinitely in internal systems. FinCEN cannot revoke already copied data simply by changing that portal’s retention. GAO’s survey found law enforcement widely considered CTRs useful, but only an estimated 13% of surveyed agencies tracked use, and few recorded links to investigations, convictions or recovered funds. Useful legitimate work and rights impacts require outcome records beyond query volume.

Implication and caveat: Even if a hosted model account is cut off, installed collectors, copied records and other local models can persist; even if the database owner closes future access and logs queries, old copies and unlogged views may survive. This is an inference from distinct systems, not a finding that the Chinese officer used FinCEN, or that any cited state program abused CTR data. A credible field test must enumerate all data copies and integrations; match signed query identities to agent tool calls and on-prem logs, approval and send records, subject-level consequences, plus an equivalent human team. The strongest skeptic: separate data custody, expiring access, real monthly query reviews and annual audits exist in US government systems; neither the availability of an AI assistant nor a 25-million-SIM design figure proves millions of wrongful dossiers. These audits supply a feasible data-owner countermeasure and show exactly what it does not establish.