Risk Management Manual of Examination Policies - FDIC

BANK SECRECY ACT, ANTI-MONEY LAUNDERING,
AND OFFICE OF FOREIGN ASSETS CONTROL
• Account beneficiaries, signors, powers of attorney,
and beneficial owners.
As mentioned previously, account and transaction
screening may be done manually, or by utilizing computer
software available from the Treasury website or other third
party vendors. In fact, many institutions have outsourced
this function. If automated, OFAC offers the SDN list in a
delimited file format file that can be imported into some
software programs. Commercial vendors also offer several
OFAC screening software packages with various
capabilities and costs. If an institution utilizes an
automated system to screen accounts and transactions,
examiners should ensure that the institution’s policies and
procedures address the following:
• OFAC updates are timely;
• OFAC verification can be and is completed in a
reasonable time;
• Screening is completed by all of bank departments and
related organizations; and
• Process is reasonable in relation to the institution’s
risk profile.
Wholly-owned securities and insurance subsidiaries of
financial institutions must also adopt an OFAC compliance
program tailored to meet industry specific needs. The
OFAC website provides additional reference material to
these industries concerning compliance program content
and procedures.
OFAC maintains current information and FAQs on its
website. For any questions, OFAC encourages financial
institutions to contact its Compliance Hotline at 800-540-
6322 (7:30am-6:00pm, weekdays).
EXAMPLES OF PROPER CITATION OF
APPARENT VIOLATIONS OF
BSA-RELATED REGULATIONS IN THE
REPORT OF EXAMINATION
The situations depicted in the examples below are intended
to provide further clarification on when and how to cite
apparent violations of the BSA and implementing
regulations, within the context of findings that are typical
for BSA reviews conducted during regular Safety &
Soundness examinations. As is often the case, deficiencies
identified within an institution’s BSA compliance policies
and procedures may lead to the citation of one or more
apparent violations. The identification of numerous and/or
severe deficiencies may indicate an ineffective and
inadequate program. When an institution’s BSA
Section 8.1
compliance program is considered inadequate, an apparent
violation of Part 326.8(b)(1) of the FDIC’s Rules and
Regulations should also be cited.
Example 1
An examiner is conducting a BSA review at Urania Bank,
a $100 million dollar financial institution in El Paso,
Texas. The examiner identifies a systemic violation
because the financial institution has not filed CTRs on cash
purchases of monetary instruments. This is an apparent
violation of 31 CFR 103.22(b)(1). The examiner also
identifies a complete failure to scrub the institution’s
database against 314(a) Requests. This is an apparent
violation of 31 CFR 103.100(b)(2). In addition, the
examiner identifies numerous incomplete CTRs in apparent
violation of 31 CFR 103.27(d). Because of the internal
control inadequacies, the examiner also cites an apparent
violation of Section 326.8(c)(1). The examiner further
determines that the problems are sufficiently serious,
warranting the citation of an apparent violation of Section
326.8(b)(1) for failure to develop and provide for an
adequate BSA program. After doing additional research,
the examiner determines that an apparent violation of
Section 326.8(c)(2) should also be cited for inadequate
independent testing that should have identified the ongoing
weaknesses found by the examiner. Furthermore, the
examiner decides that an apparent violation of Section
326.8(c)(4) should be cited for inadequate training.
Employees are given cursory BSA training each year;
however, no training exists for appropriate identification of
cash activity and adequate CTR filings. The examiner also
determines that an apparent violation of Section
326.8(c)(3) is appropriate because the BSA officer at
Urania Bank comes in only two days per week. This is
clearly inadequate for a financial institution of this size and
complexity, as exhibited by the systemic BSA problems.
In addition to fully addressing these deficiencies in the
Violations and Risk Management sections of the Report of
Examination, the Examiner-In-Charge fully details the
findings, weaknesses, and management responses on the
Examiner Comments and Conclusions pages.
Example 2
Examiners at Delirium Thrift, a $500 million financial
institution in Southern California, begin the BSA review by
requesting the wire transfer log for incoming and outgoing
transactions. Information being obtained by the institution
for the outgoing wire transfers is identified as inadequate.
Consequently, the examiners cite an apparent violation of
31 CFR 103.33(g)(1). Additional research reveals that
deficiencies in the wire log information are attributed to
several branch locations that are failing to provide
DSC Risk Management Manual of Examination Policies 8.1-51 Bank Secrecy Act (12-04)
Federal Deposit Insurance Corporation