1. Barbara Stettner, Partner Heath Tarbert, Partner Allen & Overy LLP*
US Anti-Money Laundering and Financial Crimes Compliance for Financial Institutions
November 17, 2015
Barbara Stettner, Partner
Heath Tarbert, Partner
Allen & Overy LLP

2. *
Introduction
The United Nations Office on Drugs and Crime has estimated that globally $800 billion to $2 trillion are laundered annually, or 2% to 5% of global GDP.
US anti-money laundering (AML) laws and regulations apply to a wide range of financial institutions (Covered Financial Institutions or CFIs), including banks, broker- dealers, thrifts, insurers, money transmitters, mutual funds, futures commission merchants, and many other types of institutions that handle money.
US federal AML framework is contained in the Bank Secrecy Act (BSA), as amended by the USA PATRIOT Act (PATRIOT Act).
The Financial Crimes Enforcement Network (FinCEN), a unit of the Treasury Department, leads AML regulation and enforcement in the US.
FinCEN coordinates with other federal financial regulators (e.g., the SEC, Federal Reserve, OCC, FDIC), SROs (e.g., FINRA), and state regulators (e.g., NYDFS), which also have authority to promulgate and enforce AML requirements.
The Financial Action Task Force (FATF) is an inter-governmental body that sets many international AML standards. *

3. *
Introduction
Separately, the Office of Foreign Assets Control (OFAC) administers economic sanctions that prohibit transactions with certain designated foreign nationals, governments, and industries in service of US foreign policy and national security objectives.
Though the scope of each sanctions program varies, all US persons are generally subject to these requirements, including financial institutions of every kind.
While this presentation does not include an in-depth discussion of OFAC sanctions issues, it’s important to remember that they often arise in the same context as AML and are dealt with through closely- related compliance functions. *

4. Introduction (cont'd) This presentation explains: *
The laws and regulations governing the US AML regime.
The actions that Covered Financial Institutions must take or refrain from taking to ensure compliance.
Regulatory and enforcement trends, including significant recent enforcement actions and rulemakings. *

5. What is Money Laundering?*
What is Money Laundering?

6. What is Money Laundering?*
What is Money Laundering?
Money laundering traditionally refers to the process of making illegally-gained proceeds or other "tainted funds" appear legal or "clean." However, it has evolved to include the acceptance of funds as part of any scheme to violate the law.
The US AML laws therefore apply to activities in which clean funds are directed to illicit purposes, including:
Terrorist Financing: the processing of funds, which may have been legally-obtained, to sponsor or facilitate terrorist activity
Tax Evasion: placement of legally-obtained funds as part of a tax avoidance scheme *

7. Money-laundering: Illustration*
Money-laundering: Illustration *

8. Terrorist Financing and Tax Evasion*
Terrorist Financing and Tax Evasion
In other cases, clean funds are subjected to layering techniques in order to disguise an illicit purpose.
Terrorist Financing
Tax Evasion *

9. US Anti-Money Laundering Laws and Regulations*
US Anti-Money Laundering
Laws and Regulations

10. Bank Secrecy Act (BSA) *
Otherwise known as the Currency and Foreign Transactions Reporting Act, the BSA provides the statutory basis for programmatic, reporting, and recordkeeping requirements related to AML under US law.
Among other things, the BSA requires CFIs to:
Keep records of cash purchases of negotiable instruments
File reports of cash transactions exceeding $10,000 (daily aggregate amount)
Report suspicious activity that might signify:
Money laundering
Tax evasion
Other criminal activities *

11. USA PATRIOT Act of 2001 (PATRIOT Act)*
USA PATRIOT Act of 2001 (PATRIOT Act)
The PATRIOT Act amended the BSA and added new requirements:
Voluntary and Mandatory Information Sharing: Information sharing by CFIs with government agencies, as well as voluntary information sharing among CFIs.
Customer Identification: Adoption of customer identity verification programs by banks (known as Customer Identification Procedures or CIPs), including mandatory Enhanced Due Diligence (EDD) programs for certain high-risk customers.
Programmatic AML: Adoption of an individualized, risk-based AML compliance program by all financial services institutions, with approval by the Board of Directors. *

12. BSA Programmatic Requirements*
BSA Programmatic Requirements

13. BSA Compliance for CFIs: Programmatic AML Requirements*
BSA Compliance for CFIs: Programmatic AML Requirements
The BSA requires covered banking institutions to institute a risk- based compliance program. The program must include, at a minimum:
Internal controls to ensure ongoing compliance.
Independent testing as part of internal or external audits.
Designation of persons responsible for coordinating and monitoring the compliance program.
Training for employees.
A Customer Identification Program (CIP). *

14. 1) Internal Controls Requirement*
1) Internal Controls Requirement
CFIs should have internal controls in place that:
Use a risk-based approach to identify banking operations that are vulnerable to abuse and tailor customer due diligence (CDD) policies, procedures, and processes accordingly.
Inform the board of directors and senior management of compliance issues, corrective actions taken, and any SARs filed.
Provide for adequate supervision of employees that handle currency transactions, complete reports, grant exemptions, or monitor for suspicious activity.
Comply with all regulatory recordkeeping and reporting requirements and provide for timely updates in response to changes in regulations.
Train employees and incorporate BSA compliance into the job descriptions and performance evaluations. *

15. 2) Independent Testing Requirement*
2) Independent Testing Requirement
Testing for compliance should incorporate:
A test of internal procedures for monitoring compliance with the BSA.
A sampling of all transactions and report filings such as SARs and CTRs.
A test of the adequacy of CDD and CIP practices.
A review of management reporting of BSA-related activities and compliance efforts. *

16. 3) Designated Persons Requirement*
3) Designated Persons Requirement
A CFI’s board of directors must designate a senior official (BSA compliance officer) responsible for BSA compliance.
The board is responsible for ensuring that the BSA compliance officer has sufficient authority to administer an effective BSA/AML compliance program.
The BSA compliance officer should be fully knowledgeable of the BSA and all related regulations. The officer should also understand the CFI’s products, services, customers, entities and geographic locations, and the potential money laundering and terrorist financing risks associated with those activities.
Other individuals in each office, department, or regional headquarters should be given responsibility for day-to-day compliance. *

17. 4) Training Requirement*
4) Training Requirement
A CFI's training program must provide training for all operational personnel whose duties may require knowledge of AML requirements, including line employees, bookkeeping personnel, wire room staff, and IT. Training should cover:
The CFI’s AML policies and procedures, including for CTR and SAR filings.
Identification of money laundering red flags for spotting suspicious transactions and guidance on when and how to escalate a concern.
The purpose and importance of a strong CDD program and CIP requirements.
Procedures for conveying new AML rules, regulations or internal policy changes to all appropriate personnel in a timely manner.
Procedures for reporting AML matters, including SAR filings, to senior management and the board of directors.
Key Takeaway: Front line employees must be empowered and encouraged to escalate potential “red flags.” *

18. 5) Customer Identification Program (CIP)*
5) Customer Identification Program (CIP)
A CFI must have CIP practices in writing that allow it to form a reasonable belief that it knows the true identity of each customer.
At a minimum, a CFI must obtain the following identifying information from each customer before opening an account:
For Individuals: Name, date of birth, address and identification number.
For Entities: Name, tax information, and address.
The CIP must include procedures for providing customers with adequate notice, usually given through standard disclaimers, that the bank is requesting information to verify their identities. *

19. Reliance on another CFI’s CIP*
Reliance on another CFI’s CIP
A CFI may rely on another CFI’s CIP procedures only if strict conditions are met:
Reliance on the other CFI’s CIP is reasonable under the circumstances.
The other CFI is also required to maintain a BSA/AML program and is regulated by a federal banking agency.
Investment adviser No-Action Letter allows reliance on advisers’ AML, even though they are not presently required to maintain these programs
The other CFI enters into a contract requiring annual certification that:
It has implemented its AML program.
It will perform all specified requirements of the CFI's CIP. *

20. Applying Risk-Based CIP and CDD*
Applying Risk-Based CIP and CDD
Low Risk =
Min. CIP
High Risk =
Govt-Mandated
Due Diligence
Moderate Risk = Broad Middle
Ground for Firm Discretion
Minimum customer identification procedures (“CIP”)
Different from suitability inquiry/KYC
Collect basic client information (includes name, address, DOB, SSN or passport # for individuals)
Verify client identity through documents (e.g., driver’s license or passport) or non-documentary means (e.g., online database, financial reference)
Keep records for 5 years
“Customer” is a person that opens a new account
“Account” is, generally, a formal banking relationship = very broad *

21. Enhanced Due Diligence Procedures*
Enhanced Due Diligence Procedures
For customers that are deemed to be higher-risk, CFIs should obtain Enhanced Due Diligence (EDD) information such as:
Purpose of the account
Source of funds and wealth
Individuals with ownership or control over the account, such as beneficial owners, signatories or guarantors
Occupation or type of business
Financial statements
Bank references
Domicile (where the business is organized)
Proximity of the customer's residence, place of employment or place of business to the bank
Description of the customer's primary trade area and whether international transactions are expected to be routine
Description of the business operations, the anticipated volume of currency and total sales, and a list of major customers and suppliers
Explanations for changes in account activity
EDD is required for certain customers using private banking and correspondent accounts. *

22. Enhanced Due Diligence: Politically-Exposed Persons*
Enhanced Due Diligence: Politically-Exposed Persons
FATF recommends heightened diligence for all “politically-exposed persons” or PEPs.
PEPs include not only government officials and agents of state-owned enterprises themselves, but also their known agents, affiliates, family members, and other close associates of these persons.
PEPs should be considered for heightened scrutiny in risk-based screening programs.
Additionally, the PATRIOT Act requires that EDD be applied for correspondent accounts and private banking services that are provided to PEPs. *

23. PATRIOT Act Special Rules for Correspondent Accounts*
PATRIOT Act Special Rules for Correspondent Accounts
Correspondent account banking is common for banks whose customers are internationally active.
The PATRIOT Act amended the BSA to require special actions to prevent abuse of correspondent accounts:
Prohibition on holding correspondent accounts for foreign shell banks, unless the foreign bank is a regulated affiliate.
Certification required for all overseas accounts, with Safe Harbor based on triennial recertification.
Monitoring correspondent accounts for changes in use or status, including an account holder’s PEP status. *

24. BSA Reporting and Recordkeeping*
BSA Reporting and Recordkeeping

25. BSA Compliance for Banks: Reporting and Recordkeeping Requirements*
BSA Compliance for Banks: Reporting and Recordkeeping Requirements
In addition to the programmatic requirements described, CFIs must observe a range of reporting and recordkeeping requirements contained in the BSA.
Procedures for making and recording filing determinations should be integrated in the compliance program as a whole – e.g., subject to auditing, contained in training, etc. *

26. BSA Recordkeeping Requirements*
BSA Recordkeeping Requirements
A CFI must maintain specific records related to its BSA and AML requirements. Records must generally be kept for five years.
CFIs must keep records of every funds transfer of $3,000 or more for which it acts as an originator, recipient, or intermediary. CFIs must also keep records of every cash sale of between $3,000 and $10,000 of:
Checks.
Drafts.
Cashier's checks.
Money orders.
Traveler's checks. *

27. Information Transfer Requirements: The Travel Rule*
Information Transfer Requirements: The Travel Rule
The “Travel Rule” requires that certain origination and recipient information travel with a wire transfer.
Failure to comply with the information transfer requirements has been the subject of investigations and enforcement actions by both state and federal authorities.
‘Wire-stripping’ of dollar-denominated transfers through US branches resulted in $8.9 billion settlement paid by BNP-Paribas and $1.45 billion by Commerzbank, among other recent penalties.
N.Y. Dept. of Financial Services also suspended BNP-Paribas’s license to engage in certain dollar-clearing transactions for one year.
These punishments were levied even though the wire-stripping originated in non-US branches that were not subject to the BSA. *

28. Travel Rule Requirements*
Travel Rule Requirements
The information required to be collected and retained depends on a CFI’s role in a funds transfer.
If a CFI is acting as an originator's bank, for example, it must collect and retain the:
Name and address of the originator.
Amount of the payment order.
Date of the payment order.
Any payment instructions.
Identity of the beneficiary's institution.
If available, the beneficiary's name and address, account number and any other specific identifier. *

29. Reporting Requirements*
Reporting Requirements
CFIs must file various reports under the BSA, including:
Currency Transaction Reports (CTRs) (FinCEN Form 112) for each deposit, withdrawal, exchange, or other transaction(s) exceeding $10,000.
Reports of International Transportation of Currency or Monetary Instruments (CMIR) (FinCEN Form 105) for movement of currency, travelers check, or monetary instruments exceeding $10,000.
Foreign Bank Account Report (FinCEN Form 114) if it holds more than $10,000 aggregate in deposits or securities at a non-US bank.
Suspicious Activity Reports (FinCEN Form 111) when there is reason to believe a transaction might involve a legal or regulatory violation.
FinCEN has implemented a mandatory E-Filing system for these and most other BSA filings. *

30. Suspicious Activity Reports (SARs) in Detail*
Suspicious Activity Reports (SARs) in Detail
CFIs must file reports of suspicious transactions that there is reason to believe may involve a legal or regulatory violation.
The report is filed with the Financial Crimes Enforcement Network (FinCEN) and must include:
The person or entity involved in the transaction.
The amount of money involved in the transaction.
The nature of the suspicious activity.
The date or date range of the suspicious activity. *

31. Spotting Red Flags for SAR Filings*
Spotting Red Flags for SAR Filings *

32. Mandatory SAR Filings * A CFI is required to file a SAR for:
Transactions of $5,000 or more* involving potential BSA violations or money laundering if the bank suspects or has reason to suspect that the transaction either:
Involves funds from illegal activities.
Is designed to evade BSA requirements.
Has no business or apparent lawful purpose or is not the type of transaction the customer would be expected to engage in.
Involves the use of the bank to facilitate criminal activity.
Known or suspected criminal violations involving $5,000 or more when a suspect is identifiable, or $25,000 or more when there is no identifiable suspect.
Known or suspected violations involving insider abuse in any amount. *
*$2,000 or more for certain money-services businesses, such as money wire and currency exchange providers.

33. *
Voluntary SAR Filings
Even if reporting is not required, CFIs may file a report of any suspicious transaction they believe is relevant to the possible violation of any law or regulation.
The decision of whether to file a SAR should be made in close consultation between the compliance department and persons responsible for the line of business. Records must be kept even in cases in which the CFI elects not to file a SAR.
Line employees must be familiar with red flags and know when to escalate.
SAR Secrecy: Whether mandatory or voluntary, information surrounding the internal reporting of suspicious activity and the existence of a SAR must not be disclosed to any customer and should be kept compartmentalized within the CFI. *

34. Trends and Recent Developments*
Trends and Recent Developments

35. Enforcement Trends: Major Penalties*
Enforcement Trends: Major Penalties
Commerzbank AG (2015): $1.45 billion fine and cease and desist order for insufficient risk management, ineffective AML oversight, and failure to provide timely and accurate information for foreign-based customer transactions to its New York branch.
DeutscheBank (2015): $58 million fine for AML violations linked to OFAC evasion that occurred between 2001 and 2006.
BNP Paribas (2014): $8.9 billion fine for falsifying business records, conspiracy, and violating US sanctions against Cuba, Iran and Sudan. 
HSBC Bank USA (2012): $1.92 billion fine and five-year deferred prosecution agreement (DPA) for failing to maintain an effective AML compliance program, address BSA/AML alerts, to designate high-risk customers.
Standard Chartered Bank (2012, 2014): $967 million in combined penalties for insufficient oversight of its US sanctions compliance program, BSA and AML obligations, and SAR filing requirements. *

36. Enforcement Trends: New Risks*
Enforcement Trends: New Risks
AML risks can emerge from unexpected sources:
Pump-and-Dump Schemes (2015): FinCEN fined broker-dealer Oppenheimer & Co. $20 million for AML deficiencies. The CFI failed to report suspicious movement and sudden liquidation of penny stocks as part of pump-and-dump schemes by 16 different clients.
Telephone Scammers (2014): FinCEN fined Moneygram CCO $1 million for failure to prevent or report a scheme by fraudulent telemarketers that convinced victims to wire money to through Moneygram.
Ponzi Schemes (2013): FinCEN fined TD Bank $52 million for failure to report $900 million in suspicious transactions by a Florida-based scammer. TD’s former Regional VP also faced civil charges for false representations regarding measures TD took to restrict the affected accounts. *

37. Lessons from Enforcement: Tailoring AML*
Lessons from Enforcement: Tailoring AML
Mechanical check-the-box compliance programs are not enough:
CFIs must be alert for signs of structuring and attempts to circumvent reporting requirements.
Detailed risk-rating that reflects a CFI’s actual customer base and lines of business is key.
AML officers must engage the business lines directly to keep compliance practices relevant. *

38. Lessons from Enforcement: Global Outlook*
Lessons from Enforcement: Global Outlook
US-based branches of CFIs must be attuned to global risks:
Highest-common denominator compliance among multinational CFIs is a best practice.
Regulators will want to see that US branches of non-US CFIs have clear policy with Board of Director approval, adequate resources, and support of higher-ups.
Policies should ensure that non-US branches cooperate with US compliance requirements and information requests, in keeping with local laws. *

39. New Regulatory Developments*
New Regulatory Developments
FinCEN Proposed Rulemaking on Customer Due Diligence
Comment period closed October 2014.
Applies to CFIs that are currently required to have CIPs.
The proposed rules would:
Require CFIs to identify and verify the identity of natural person beneficial owners of legal entity customers (with some exceptions).
No requirement to verify status.
Impose explicit CDD requirements for all other customers.
Codify the “pillars” of CDD programs:
Identifying and verifying identity of customers.
Identifying and verifying identity of beneficial owners of legal entity customers.
Understanding the nature and purpose of customer relationships.
Conducting ongoing monitoring of customers and transactions.
Adopt risk-based procedures for conducting CDD. *

40. New Regulatory Developments*
New Regulatory Developments
FinCEN Proposed Rulemaking on CDD (cont.)
Definition of “Beneficial Owner”
Ownership Test: Any individual who, directly or indirectly, though any means, owns 25% or more of the equity interests of a legal entity customer; or
Control Test: An individual with significant responsibility to control, manage, or direct a legal entity customer, including an executive officer or senior manager, or individual with similar functions.
Definition of “Legal Entity”:
Broad, and would extend to any U.S. or foreign corporation, partnership, LLC, or similar legal entity.
Exclusions for those entities excluded from the definition of “customer” under existing CIP requirement, as well as certain issuers, investment companies, advisers, CFTC-registered entities and charities.
CFIs would be required to identify beneficial owners at time of account opening, verify within a reasonable time thereafter. *

41. New Regulatory Developments: Investment Adviser AML*
New Regulatory Developments: Investment Adviser AML
Proposed Rule published in September 2015 would include registered investment advisers within the definition of CFIs.
The Proposed Rule would:
require investment advisers to adopt a risk-based AML program, including policies and procedures for CIP, CDD, trainings, and auditing.
require investment advisers to comply with most BSA reporting and recordkeeping requirements, including making SAR and CTR filings and responding to FinCEN information requests.
subject advisers’ AML policies to SEC examination.
As drafted, the Proposed Rule does not differentiate between advisers to separate accounts and pooled investment vehicles, or for providers of only sub-advisory services.
Comment period concluded on November 2, 2015, with further action from FinCEN expected in mid to late 2016. *

42. Helpful Resources FinCEN Guidance Page FINRA AML Guidance Page*
Helpful Resources
FinCEN Guidance Page
FINRA AML Guidance Page
The FFIEC BSA/AML Examination Manual *

43. *
OFAC Sanctions and AML

44. Office of Foreign Assets Control*
Office of Foreign Assets Control
The US Treasury's Office of Foreign Assets Control (OFAC) regulations prohibit all US persons from engaging in transactions with specified persons, countries, and governments, and certain other classes of transactions.
Specifically, US persons must:
Block accounts and other assets of "Specially Designated Nationals" (SDNs) and "Blocked Persons."
Prohibit unlicensed trade and financial transactions with specified countries.
Block prohibited transactions with SDNs and Blocked Persons, or reject transactions that facilitate dealings with Blocked Persons. *

45. OFAC Compliance Program Requirements*
OFAC Compliance Program Requirements
OFAC rules do not include specific programmatic compliance requirements. However:
Companies are strictly liable for any violation that occurs.
The adequacy of a Subject Person’s risk-based compliance program is an explicit consideration for OFAC in determining the appropriate enforcement action.
Other OFAC enforcement considerations include remedial response and cooperation in disclosing the violation.
OFAC’s enforcement guidelines include risk matrices that can be used to help tailor compliance practices appropriately. *

46. *
Linking OFAC and AML
OFAC best practices include organizational, procedural, training, and independent testing measures similar to those required by the BSA.
Like the BSA, OFAC also requires certain filings related to blocked assets and prohibited transactions.
The records generated by BSA compliance practices – in particular CIP and CDD information and Fund Transfer information – should all be used for to OFAC screening.
Because the legal risks are linked, compliance and business personnel must understand how the systems interact. *

47. *
Questions

48. For Further Information or Questions Contact:*
For Further Information or Questions Contact:
Barbara Stettner
Allen & Overy LLP
1101 New York Avenue, NW
Washington, DC
Heath Tarbert *