Risk Management Manual of Examination Policies - FDIC

BANK SECRECY ACT, ANTI-MONEY LAUNDERING,
AND OFFICE OF FOREIGN ASSETS CONTROL
institution or its employees. Criminal penalties provide for
imprisonment up to 30 years and fines ranging up to $10
million.
Furthermore, financial institutions are not permitted to
transfer responsibility for OFAC compliance to
correspondent banks or a contracted third party, such as a
data processing service provider. Each financial institution
is responsible for every transaction occurring by or through
its systems. If a sanctioned transaction transverses several
U.S. financial institutions, all of these institutions will be
subject to the same civil or criminal action, with the
exception of the financial institution that blocked or
rejected the transaction, as appropriate.
Examination Considerations
Financial institutions should establish and maintain
effective OFAC programs and screening capabilities in
order to facilitate safe and sound banking practices. It is
not the examiner’s primary duty to identify unreported
accounts or transactions within an institution. Rather,
examination procedures should focus on evaluating the
adequacy of an institution’s overall OFAC compliance
program and procedures, including the systems and
controls in place to reasonably assure accounts and
transactions are blocked and rejected.
In reviewing an institution’s OFAC compliance program,
examiners should evaluate the operational risks the
financial institution is willing to accept and determine if
this exposure is reasonable in comparison with the business
type, department or product, customer base, and cost of an
effective screening program for that particular institution,
based on its risk profile.
The FDIC strongly recommends that each financial
institution adopt a risk-focused, written OFAC program
designed to ensure compliance with OFAC regulations. An
effective OFAC program should include the following:
• Written policies and procedures for screening
transactions and new customers to identify possible
OFAC matches;
• Qualified individual to monitor compliance and
oversee blocked funds;
• OFAC risk-assessment for various products and
departments within the financial institution;
• Guidelines and internal controls to ensure the periodic
screening of all existing customer accounts;
• Procedures for obtaining and maintaining up-to-date
OFAC lists of blocked countries, entities, and
individuals;
Section 8.1
• Methods for conveying timely OFAC updates
throughout the financial institution, including offshore
locations and subsidiaries;
• Procedures for handling and reporting prohibited
OFAC transactions;
• Guidance for SAR filings on OFAC matches, if
appropriate, such as when criminal intent or terrorist
activity is involved;
• Internal review or audit of the OFAC processes in
each affected department; and
• Training for all appropriate employees, including
those in offshore locations and subsidiaries.
Departmental and product risk assessments are
fundamental to a sound OFAC compliance program.
These assessments allow institution management to ensure
appropriate focus on high-risk areas, such as correspondent
banking activities and electronic funds transfers. An
effective program will filter as many transactions as
possible through OFAC’s SDN and Blocked Persons List,
whether they are completed manually or through the use of
a third party software program. However, when evaluating
an institution’s compliance program, examiners should
consider matters such as the size and complexity of the
institution. Adequate compliance procedures can and
should be targeted to transactions that pose the greatest risk
to an institution. Some transactions may be difficult to
capture within a risk-focused compliance program. For
example, a customer could write a personal check to a
blocked entity; however, the only way the financial
institution that the check is drawn upon could block those
funds would be if it reviewed the payee on each personal
check, assuming the information is provided and legible.
Under current banking practices, this would be costly and
time consuming. Most financial institutions do not have
procedures for interdicting these transactions, and, yet, if
such a transaction were to be processed by a U.S. financial
institution, it is a violation of OFAC regulations and could
result in CMPs against the bank.
However, if a financial institution only screens its wire
transfers through the OFAC SDN and Blocked Persons
List and never screens its customer database, that is a much
higher and, likely, unacceptable risk for the financial
institution to assume in relation to the time and expense to
perform such a review. Particular risk areas that should be
screened by all financial institutions include:
• Incoming and outgoing electronic transactions, such as
ACH;
• Funds transfers, including message or instruction
fields;
• Monetary instrument sales; and
Bank Secrecy Act (12-04) 8.1-50 DSC Risk Management Manual of Examination Policies
Federal Deposit Insurance Corporation