Risk Management Manual of Examination Policies - FDIC

BANK SECRECY ACT, ANTI-MONEY LAUNDERING,
AND OFFICE OF FOREIGN ASSETS CONTROL
inadequate to meet regulatory requirements and sound
customer due diligence.
Part 326.8(c)(1) of the FDIC Rules and Regulations
Part 326.8(c)(1) states, in part, that the compliance
program shall, at a minimum, provide for a system of
internal controls to assure ongoing compliance.
Management has not provided for an adequate system of
internal controls to assure ongoing compliance. Examiners
identified the following internal control deficiencies:
• Incomplete BSA and AML policies for a bank with a
high-risk profile.
• Insufficient identification systems for CTR reporting.
• Late CTR filings.
• Insufficient reporting mechanisms for identification of
structured transactions and other suspicious activity.
• Weak oversight over high-risk customers.
• Insufficient customer identification program and
customer due diligence.
Due to the financial institution’s high-risk profile,
management should go beyond minimum CIP requirements
and do a sufficient level of due diligence that provides for
a satisfactory evaluation of the customer. Management
must provide for adequate reporting mechanisms to
identify large cash transactions as well as suspicious
activity. Timely completion and review of appropriate
reports, in conjunction with a sufficient level of due
diligence, should allow for the accurate and timely
reporting of CTRs and SARs.
Part 326.8(c)(2) of the FDIC Rules and Regulations
Part 326.8(c)(2) states that the compliance program shall
provide for independent testing for compliance to be
conducted by an outside party or bank personnel who have
no BSA responsibility or oversight.
The financial institution’s BSA policies provide for
independent testing. However, the financial institution has
not received an independent review for over three years.
An annual review of the BSA program should be
completed by a qualified independent party. This review
should incorporate all of the high-risk areas of the
institution, including cash-intensive accounts and
transactions, sales and purchases of monetary instruments;
customer exemption list; electronic funds transfer
activities, and compliance with customer identification
procedures.
Part 326.8(c)(3) of the FDIC Rules and Regulations
Section 8.1
Part 326.8(c)(3) states that the compliance program shall
designate an individual or individuals responsible for
coordinating and monitoring day-to-day compliance.
The board of directors has named Head Teller Ben Bison
as the BSA officer. While Mr. Bison has a basic
understanding of CTR filing, he does not have any training
on detecting and reporting suspicious activity.
Furthermore, Ben Bison does not have policy-making
authority over the BSA function. Management needs to
appoint someone with policy-making authority as the
institution’s BSA Officer.
Part 326.8(c)(4) of the FDIC Rules and Regulations
Part 326.8(c)(4) states that the compliance program shall
provide training for appropriate personnel.
Example 1:
While BSA training programs are adequate, management
has trained less than half of the appropriate operational
personnel during the last calendar year. Management must
ensure that all appropriate personnel, including the board
of directors and officers, receive adequate BSA training a
minimum of once per year and ongoing for those whose
duties require constant awareness of the BSA requirements.
Example 2:
BSA training needs improvement. While regular BSA
training sessions are developed and conducted for branch
operations personnel, the training programs do not address
internal BSA policies and, more importantly, BSA and
anti-money laundering regulations. Management must
ensure that comprehensive BSA training is provided to all
directors, officers, and appropriate operational personnel.
Training should be provided at least annually, and must be
ongoing for those whose duties require constant awareness
of BSA requirements. The training must be commensurate
with the institution’s BSA risk-profile and provide specific
employee guidance on detecting unusual or suspicious
transactions beyond the detection of cash structuring
transactions.
Part 353.3 of the FDIC Rules and Regulations and 31
C.F.R. 103.18
Part 353.3(a) and 31 C.F.R. 103.18 state, in part, that
Suspicious Activity Reports (SARs) should be filed when:
• Insider abuse is involved in any amount;
DSC Risk Management Manual of Examination Policies 8.1-53 Bank Secrecy Act (12-04)
Federal Deposit Insurance Corporation