Judy Graham, Program Officer Office of Examination and Insurance New Examination Procedures, Common Concerns & 2017 Outlook from a Regulators Perspective January 2017

Overview Supervisory Priorities for 2017 Bank Secrecy Act Regulations Compliance Concerns Supervisory Focus Customer Due Diligence Regulation

Supervisory Priorities 2017 Letter to Credit Unions – January 2017 Streamlined small credit union exam procedures Assets > $50 million CAMEL rates of 1, 2, or 3 Extended Examination Cycle Letter to Credit Unions 16-CU-12

Supervisory Priorities 2017 Cybersecurity Assessment Cybersecurity Assessment Tool Bank Secrecy Act Compliance Internal Controls and Fraud Prevention Interest Rate and Liquidity Risk LCU 16-CU-08

Supervisory Priorities 2017 Commercial Lending LCU 16-CU-11 Consumer Compliance Military Lending Act – LCU 16-CU-07 Servicemembers’ Civil Relief Act

NCUA BSA Regulations 12 USC 1786(q)(2) requires NCUA to conduct a review of the BSA compliance program at each examination of a federally insured credit union.   12 CFR. 748.2 requires every federally insured credit union to establish a BSA compliance program that: Establishes a system of Internal Controls to ensure ongoing BSA compliance Provides for Independent Testing for BSA compliance by the credit union or outside party Designates a BSA Compliance Officer responsible for monitoring day-to-day compliance Establishes a BSA Training program for appropriate employees and volunteers Establishes a Customer Identification Program

Compliance Concerns Information Sharing (FinCEN 314(a) lists) Check the lists timely Document activity Activity Report available in SISS Update point of contact info Credit Union Online at www.NCUA.gov Up to four points of contact may be provided Up to three week time lag for changes to take effect

Compliance Concerns Internal Controls Review and update risk assessment Maintain adequate Suspicious Activity Monitoring System Perform proper Member Due Diligence procedures

Compliance Concerns Independent Testing Include all credit union operations Risk based Should be recent (12 to 18 months) Should be independent

Compliance Concerns Training Risk-based Recent (12 to 18 months – depending on risk) Document training Cover BSA requirements and credit union’s policies & procedures Include training for Board of Directors/Supervisory Committee

Supervisory Focus – Money Services Businesses (MSBs) MSBs offer one or more of the following services: Issuers or sellers of money orders or traveler’s checks Check cashers Dealers in foreign exchange Must conduct more than $1,000 in money services business activity with the same person (in one type of activity) on the same day -OR- Provides money transfer services in any amount Provider or Seller of Prepaid Access – various limits apply

Due Diligence Expectations - MSBs Not all MSBs pose the same level of risk, and not all MSBs will require the same level of due diligence NCUA Letter to Credit Unions 14-CU-10 Interagency Guidance Issued April, 2005 Minimum Due Diligence Expectations Perform CIP Confirm FinCEN registration, if applicable Confirm state or local licensing, if applicable Conduct BSA/AML risk assessment Conduct Enhanced Due Diligence, if applicable

Risk Assessment Purpose of the account Anticipated account activity Types of products and services offered Locations and markets served

Due Diligence Expectations Enhanced Due Diligence* Review the MSB’s BSA/AML Program Review results of the MSB’s independent testing Review written procedures for the operation of the MSB Conduct on-site visits Review list of agents, including locations Review written employee screening practices * This list is not all inclusive, nor are all of the steps listed on this slide required. Each credit union must make the determination of the enhanced due diligence steps it will take depending upon the level of perceived risk posed by each account.

Customer Due Diligence (CDD) FinCEN finalized CDD Rule May 11, 2016 – effective May 11, 2018 Credit unions already expected to conduct adequate CDD as part of internal controls Rule clarifies existing CDD expectations Rule also requires CUs to obtain Beneficial Ownership information related to legal entities Ownership Control Certification Form Available NCUA working with other regulators regarding examination expectations

Resources NCUA website: www.ncua.gov NCUA Examiner’s Guide AIRES BSA Questionnaire NCUA Compliance Self-Assessment Guide Interagency Statement on Enforcement of BSA\AML Requirements FFIEC BSA/AML Examination Manual: www.ffiec.gov FinCEN Website: www.fincen.gov

Office Contact Page Feel free to contact our office with questions or comments. Primary Staff: Judy Graham Program Officer jgraham@ncua.gov Office Phone: 703-518-6392 Secondary Staff: eimail@ncua.gov