Risk Management Manual of Examination Policies - FDIC

BANK SECRECY ACT, ANTI-MONEY LAUNDERING,
AND OFFICE OF FOREIGN ASSETS CONTROL
Automated Clearing House Transactions and
Electronic Initiation Systems
Additionally, the National Automated Clearing House
Association (NACHA) has provided standards which
mandate the use of security measures for automated
clearing house (ACH) transactions initiated through the
Internet or electronically. These guidelines include
ensuring secure access to the electronic and Internet
systems in conjunction with procedures reasonably
designed to identify the ACH originator.
Interagency guidance on authenticating users of technology
and the identity of customers is further discussed in FDIC
FIL-69-2001, “Authentication in an Electronic
Environment.” This FIL not only identifies the risk of
access to systems and information, it also emphasizes the
need to verify the identity of electronic and/or Internet
customers, particularly those who request account opening
and new services online.
MONITORING BANK SECRECY ACT
COMPLIANCE
Section 8(s) of the Federal Deposit Insurance Act, which
implements 12 U.S.C. 1818, requires the FDIC to:
• Develop regulations that require insured financial
institutions to establish and maintain procedures
reasonably designed to assure and monitor compliance
with the BSA;
• Review such procedures during examinations; and
• Describe any problem with the procedures maintained
by the insured depository institution within reports of
examination.
To satisfy Section 8(s) requirements, at a minimum,
examiners must review BSA at each regular safety and
soundness examination. In addition, the FDIC must
conduct its own BSA examination at any intervening
Safety and Soundness examination conducted by a State
banking authority if such authority does not review for
compliance with the BSA. Section 326.8 of the FDIC’s
Rules and Regulations establishes the minimum BSA
program requirements for all state nonmember banks,
which are necessary to assure compliance with the financial
recordkeeping and reporting requirements set forth within
the provisions of the Treasury regulation 31 CFR 103.
Part 326.8 of the FDIC’s Rules and
Regulations
Minimum Requirements of the
BSA Compliance Program
Section 8.1
The BSA compliance program must be in writing and
approved by the financial institution’s board of directors,
with approval noted in the Board minutes. Best practices
dictate that Board should review and approve the policy
annually. In addition, financial institutions are required to
develop and implement a Customer Identification Program
as part of their overall BSA compliance program. More
specific guidance regarding the CIP program requirements
can be found within the “Customer Identification Program”
discussion within this section of the DSC Risk
Management Manual of Examination Policies (DSC
Manual).
A financial institution’s BSA compliance program must
meet four minimum requirements, as detailed in Section
326.8 of the FDIC’s Rules and Regulations. The
procedures necessary to establish an adequate program and
assure reasonable compliance efforts designed to meet
these minimum requirements are discussed in detail below:
1. A system of internal controls. At a minimum, the
system must be designed to:
a. Identify reportable transactions at a point where
all of the information necessary to properly
complete the required reporting forms can be
obtained. The financial institution might
accomplish this by sufficiently training tellers and
personnel in other departments or by referring
large currency transactions to a designated
individual or department. If all pertinent
information cannot be obtained from the
customer, the financial institution should consider
declining the transaction.
b. Monitor, identify, and report possible money
laundering or unusual and suspicious activity.
Procedures should provide that high-risk
accounts, services, and transactions are regularly
reviewed for suspicious activity.
c. Ensure that all required reports are completed
accurately and properly filed within required
timeframes. Financial institutions should consider
centralizing the review and report filing functions
within the banking organization.
d. Ensure that customer exemptions are properly
granted, recorded, and reviewed as appropriate,
including biennial renewals of “Phase II”
exemptions. Exempt accounts must be reviewed
at least annually to ensure that the exemptions are
still valid and to determine if any suspicious or
unusual activity is occurring in the account. The
DSC Risk Management Manual of Examination Policies 8.1-31 Bank Secrecy Act (12-04)
Federal Deposit Insurance Corporation