BSA/AML Examination Manual - ffiec

Enterprise-Wide BSA/AML Compliance Program — Overview
EXPANDED EXAMINATION
OVERVIEW AND PROCEDURES FOR
AN ENTERPRISE-WIDE
COMPLIANCE PROGRAM AND
OTHER STRUCTURES
Enterprise-Wide BSA/AML Compliance
Program — Overview
Objective. Assess the organization’s enterprise-wide program for BSA/AML compliance
through the holding company or lead financial institution. 138
Similar to the approach to consolidated credit, market, and operational risk, effective
control of BSA/AML risk may call for coordinated risk management. An enterprise-wide
BSA/AML compliance program coordinates the specific regulatory requirements
throughout an organization inside a larger risk management framework. Such
frameworks seek a consolidated understanding of the organization’s risk exposure to
money laundering and terrorist financing across all activities, business lines, or legal
entities. For example, the holding company or lead financial institution may have a
centralized function to evaluate BSA/AML risk; this may include the ability to
understand world-wide exposure to a given customer, particularly those considered highrisk
or suspicious, consistent with applicable laws. 139
Many organizations, typically those that are larger or more complex and that may include
international operations, implement an enterprise-wide BSA/AML compliance program
that manages risks in an integrated fashion across affiliates, business lines, and risk types
(e.g., reputation, compliance, or transaction). Aggregating risks on an enterprise-wide
basis for larger or more complex organizations may enable an organization to better
identify risks and risk exposures within or across specific lines of business or product
categories. Consolidated information also assists senior management and the board of
directors in understanding and appropriately mitigating risks across the organization.
Such programs manage risk at both operational and strategic levels.
While there are currently no regulatory requirements for holding companies or lead
financial institutions to adopt an enterprise-wide BSA/AML compliance program, many
138 The lead financial institution is the largest financial institution in the holding company structure in terms
of assets unless otherwise designated by the holding company.
139 For additional guidance, refer to the expanded overview section, “Foreign Branches and Offices of U.S.
Banks,” page 156, and the Basel Committee on Bank Supervision’s guidance Consolidated Know Your
Customer (KYC) Risk Management, located at www.bis.org.
FFIEC BSA/AML Examination Manual 149 8/24/2007