1. Bank Secrecy Act Staying One Step Ahead of Your BSA Examiner September 2009 AMLA Chicago Chapter Event

2. Session Agenda Most frequent apparent violations cited during exams Technical violations, including best practices related to CIP / enhanced due diligence Part 353 violations Pillar violations, including best practices for suspicious activity monitoring systems and the independent test Program violations Questions

3. Apparent Violations

4. Hierarchy of Violations Technical violations Part 353 violations Pillar violations Program violations

5. CTR Related Violations Failure to file / aggregate Incomplete filing Lack of identification Untimely filing

6. Exemption Related Violations Lack of monitoring and review - Confirm eligibility for exempt status - Review for suspicious activity - Document the review

7. Monetary Instrument Sales & Funds Transfers Records Related Violations Monetary Instruments –Missing activity / aggregation Funds transfers –Lacking the required information on the transmittal

8. CIP Related Violations Failure to obtain minimum information Failure to document resolution of discrepancy in identification information Failure of CIP to contain procedures for verifying customer identity

9. Enhanced Due Diligence - Best Practices Individual customer – occupation and source of funds Business customers – Basic information: location, ownership, business structure, anticipated level of activity, primary products and services

10. Enhanced Due Diligence (continued) Business customers (continued) - Enhanced information: financial services providers Sources of Cash: selling of money orders, traveler’s checks, stored value cards Uses of Cash: check cashing, lending activities, ATMs

11. High Risk Customers – Best Practices List should be periodically updated Documentation of enhanced monitoring needed

12. Money Service Businesses – Best Practices Determination of MSB status Registration requirements Risk-based additional due diligence

13. 314 (a) Related Violations Lack of searching all required records: - Monetary instrument sales to non-customers - Funds transfers by non-customers - Trust, insurance subsidiary activity Inadequate continuity plans for performing searches

14. Suspicious Activity Reporting Related Apparent Violations Lack of filing SARs for transactions designed to evade reporting requirements Lack of filing SARs for transactions with no business or apparent lawful purpose Untimely filing Failure to notify Board

15. Pillar Apparent Violations

16. Internal Controls Pillar Violations Lack of effective suspicious activity monitoring and reporting systems Lack of adequate large currency transaction identification / aggregation Failure to search records as required by 314 (a) Various other deficiencies, such as the failure to implement an effective CIP program

17. Suspicious Activity Monitoring – Best Practices All banks should have monitoring systems for the following: 1) Large cash transactions 2) Monetary instrument sales 3) Funds transfers 4) ACH activity

18. Large Cash Transaction Monitoring – Best Practices Monitoring systems – automated versus manual Automated reports – periodic review of filtering criteria and thresholds Activity should be compared to CDD information

19. Large Cash Transaction Monitoring (continued) Incoming Currency – Structuring –Activity with no business or apparent lawful purpose Outgoing Currency – Structuring –Activity with no business or apparent lawful purpose

20. Monetary Instrument Sales Monitoring – Best Practices Cash purchases Non-cash purchases: 1) Structuring 2) No business or lawful purpose

21. Monetary Instrument Sales Monitoring (continued) Uses of non-cash sales – Non-suspicious Moving of funds to another institution Hiding funds from spouse –Suspicious Tax evasion Hiding funds from court system (bankruptcy, judgments, divorce) Medicaid fraud

22. Funds Transfers Monitoring – Best Practices Log of activity containing originator, beneficiary, name and location of outside institution Monitor periodically for unusual activity, including the review of international wires

23. ACH Monitoring - Best Practices Capabilities of ACH reporting system –Controls for outgoing ACH activity –Review of incoming ACH activity Automated system benefits Review of cross-border activity

24. Independent Testing Pillar Violations Inadequate scope: - the lack adequate transaction testing - the review of suspicious activity monitoring and reporting - customer due diligence / enhanced due diligence - review and verify the accuracy of reporting systems

25. Independent Testing FIL-38-2008 Risk-based, incorporating the bank’s BSA/AML risk assessment Internal auditor, outside auditor, consultant, or other qualified individual independent of the BSA/AML function Agreements should grant examiners access to workpapers Examiners will request workpapers during exams

26. BSA Officer Pillar Violations Lack of appropriate training – outside training generally needed annually Lack of BSA Officer involvement in the day-to-day activity

27. Training Pillar Violations Over-reliance on on-line training Lack of documentation Failure to cover bank’s CIP procedures

28. CIP Pillar Violations Missing CIP program in an area – loans, insurance subsidiary, trust department Lack of CIP policy

29. Program Violations Lack of an effective BSA program Program reflects such systemic or pervasive deficiencies that the BSA/AML program is deemed ineffective at assuring and monitoring compliance with the BSA

30. Resources FFIEC BSA Exam Manual available at http://www.fdic.gov/regulations/examinations/bsa/ http://www.fdic.gov/regulations/examinations/bsa/ MSB information available at: http://www.fincen.gov/financial_institutions/msb/

31. Contacts Regional FDIC BSA Contact: John Lombardo Case Manager Special Activities 312-382-7516

32. Questions?