Bank Secrecy Act Staying One Step Ahead of Your BSA Examiner September 2009 AMLA Chicago Chapter Event

Session Agenda Most frequent apparent violations cited during exams Technical violations, including best practices related to CIP / enhanced due diligence Part 353 violations Pillar violations, including best practices for suspicious activity monitoring systems and the independent test Program violations Questions

Apparent Violations

Hierarchy of Violations Technical violations Part 353 violations Pillar violations Program violations

CTR Related Violations Failure to file / aggregate Incomplete filing Lack of identification Untimely filing

Exemption Related Violations Lack of monitoring and review - Confirm eligibility for exempt status - Review for suspicious activity - Document the review

Monetary Instrument Sales & Funds Transfers Records Related Violations Monetary Instruments –Missing activity / aggregation Funds transfers –Lacking the required information on the transmittal

CIP Related Violations Failure to obtain minimum information Failure to document resolution of discrepancy in identification information Failure of CIP to contain procedures for verifying customer identity

Enhanced Due Diligence - Best Practices Individual customer – occupation and source of funds Business customers – Basic information: location, ownership, business structure, anticipated level of activity, primary products and services

Enhanced Due Diligence (continued) Business customers (continued) - Enhanced information: financial services providers Sources of Cash: selling of money orders, traveler’s checks, stored value cards Uses of Cash: check cashing, lending activities, ATMs

High Risk Customers – Best Practices List should be periodically updated Documentation of enhanced monitoring needed

Money Service Businesses – Best Practices Determination of MSB status Registration requirements Risk-based additional due diligence

314 (a) Related Violations Lack of searching all required records: - Monetary instrument sales to non-customers - Funds transfers by non-customers - Trust, insurance subsidiary activity Inadequate continuity plans for performing searches

Suspicious Activity Reporting Related Apparent Violations Lack of filing SARs for transactions designed to evade reporting requirements Lack of filing SARs for transactions with no business or apparent lawful purpose Untimely filing Failure to notify Board

Pillar Apparent Violations

Internal Controls Pillar Violations Lack of effective suspicious activity monitoring and reporting systems Lack of adequate large currency transaction identification / aggregation Failure to search records as required by 314 (a) Various other deficiencies, such as the failure to implement an effective CIP program

Suspicious Activity Monitoring – Best Practices All banks should have monitoring systems for the following: 1) Large cash transactions 2) Monetary instrument sales 3) Funds transfers 4) ACH activity

Large Cash Transaction Monitoring – Best Practices Monitoring systems – automated versus manual Automated reports – periodic review of filtering criteria and thresholds Activity should be compared to CDD information

Large Cash Transaction Monitoring (continued) Incoming Currency – Structuring –Activity with no business or apparent lawful purpose Outgoing Currency – Structuring –Activity with no business or apparent lawful purpose

Monetary Instrument Sales Monitoring – Best Practices Cash purchases Non-cash purchases: 1) Structuring 2) No business or lawful purpose

Monetary Instrument Sales Monitoring (continued) Uses of non-cash sales – Non-suspicious Moving of funds to another institution Hiding funds from spouse –Suspicious Tax evasion Hiding funds from court system (bankruptcy, judgments, divorce) Medicaid fraud

Funds Transfers Monitoring – Best Practices Log of activity containing originator, beneficiary, name and location of outside institution Monitor periodically for unusual activity, including the review of international wires

ACH Monitoring - Best Practices Capabilities of ACH reporting system –Controls for outgoing ACH activity –Review of incoming ACH activity Automated system benefits Review of cross-border activity

Independent Testing Pillar Violations Inadequate scope: - the lack adequate transaction testing - the review of suspicious activity monitoring and reporting - customer due diligence / enhanced due diligence - review and verify the accuracy of reporting systems

Independent Testing FIL Risk-based, incorporating the bank’s BSA/AML risk assessment Internal auditor, outside auditor, consultant, or other qualified individual independent of the BSA/AML function Agreements should grant examiners access to workpapers Examiners will request workpapers during exams

BSA Officer Pillar Violations Lack of appropriate training – outside training generally needed annually Lack of BSA Officer involvement in the day-to-day activity

Training Pillar Violations Over-reliance on on-line training Lack of documentation Failure to cover bank’s CIP procedures

CIP Pillar Violations Missing CIP program in an area – loans, insurance subsidiary, trust department Lack of CIP policy

Program Violations Lack of an effective BSA program Program reflects such systemic or pervasive deficiencies that the BSA/AML program is deemed ineffective at assuring and monitoring compliance with the BSA

Resources FFIEC BSA Exam Manual available at MSB information available at:

Contacts Regional FDIC BSA Contact: John Lombardo Case Manager Special Activities

Questions?