Risk Management Manual of Examination Policies - FDIC

BANK SECRECY ACT, ANTI-MONEY LAUNDERING,
AND OFFICE OF FOREIGN ASSETS CONTROL
sufficient information to the wire transfer department.
Because the deficiencies are isolated to transactions
originating in a few locations, examiners determine that the
deficiencies are not systemic and the overall program
remains effective. However, because it is evident in
interviews with several branch employees that their
training in this area has been lacking, examiners also cite
an apparent violation of Section 326.8(c)(4) and request
that the institution implement a comprehensive training
program that encompasses all of its service locations.
Example 3
Examiners at the independent BSA examination of
Bullwinkle Bank and Trust, Moose-Bow, Iowa, a $30
million financial institution, were provided no written BSA
policies after several requests. However, actual internal
practices for BSA compliance were found to be fully
satisfactory for the size and BSA risk-level of the financial
institution. Given the low risk profile of the institution,
including a nominal volume of reportable transactions
being processed by the institution, the BSA/AML
procedures in place are sufficient for the institution.
Therefore, examiners cite only an apparent violation of
Section 326.8(b)(1) for failure to develop an adequate
written BSA compliance program that is approved by the
financial institution’s board of directors.
Example 4
Appropriately following pre-examination scoping
requirements, examiners obtain information from their
Regional SACM or other designees on previous SAR
filings relating to money laundering. Upon arrival at
Mission Achievement Bank, Agana, Guam, a $250 million
financial institution with overseas branches, examiners
determine that several of the accounts upon which money
laundering SARs had been previously filed are still open
and evidencing ongoing money laundering activity.
However, the financial institution has failed to file
subsequent SARs on this continued activity in these
accounts and/or the parties involved. Consequently, the
examiner appropriately cites apparent violations of Section
353.3(a) of the FDIC Rules and Regulations for failure to
file SARs on this ongoing activity. Further analysis
identifies that the failure to appropriately monitor for
suspicious or unusual transactions in its high-risk accounts
and subsequently file SARs is a systemic problem at the
financial institution. Because of the institution-wide
problem, the examiner cites an apparent violation of
Section 326.8(c)(1) for inadequate internal controls.
Furthermore, after consultation with the Regional SACM,
the examiner concludes that the institution’s overall BSA
program is inadequate because of the failures to identify
Section 8.1
and report suspicious activities and, therefore, cites an
apparent violation of Section 326.8(b)(1).
The examples below provide examiner guidance for
preparing written comments for apparent violations of the
BSA and implementing regulations. In general, write-ups
should fully detail the nature and severity of the
infraction(s). These comments intentionally omit the
management responses that should accompany all apparent
violation write-ups.
Part 326.8(b)(1) of the FDIC Rules and Regulations
Part 326.8(b)(1) requires each bank to “develop and
provide for the continued administration of a program
reasonably designed to assure and monitor compliance
with recordkeeping and reporting requirements” of the
Bank Secrecy Act, or 31 CFR 103. The regulation further
states that “the compliance program shall be written,
approved by the bank’s board of directors, and noted in the
minutes.”
The Board and the senior management team have not
adequately established and maintained appropriate
procedures reasonably designed to assure and monitor the
financial institution’s compliance with the requirements of
the BSA and related regulations. This assessment is
evidenced by the weak internal controls, policies, and
procedures as identified at this examination. Furthermore,
the Board and senior management team have not made a
reasonable effort to assure and monitor compliance with
recordkeeping and reporting requirements of the BSA. As
a result, apparent violations of other sections of Part 326.8
of the FDIC Rules and Regulations and 31 CFR 103 of the
U.S. Treasury Recordkeeping Regulations have been cited.
Part 326.8(b)(2) of the FDIC Rules and Regulations
Part 326.8(b)(2) states that each bank must have a
customer identification program to be implemented as part
of the BSA compliance program.
Management has not provided for an adequate customer
identification program. Current policy requirements do not
meet the minimum provisions for a customer identification
program, as detailed in 31 CFR 103. Current policies and
practices require no documentation for new account
openings on the Internet with the exception of a
“verification e-mail” sent out confirming that the signer
wants to open the account. Signature cards are mailed offsite
to the Internet customer, who signs them and mails
them back without any evidence of third-party verification,
such as notary seal. Based on the risk of these types of
accounts, this methodology for verification is clearly
Bank Secrecy Act (12-04) 8.1-52 DSC Risk Management Manual of Examination Policies
Federal Deposit Insurance Corporation