BSA/AML Examination Manual - ffiec

Enterprise-Wide BSA/AML Compliance Program — Overview
organizations view this as an effective tool in managing the BSA/AML risks associated
with failure to comply with BSA laws and regulations, or the corresponding laws in
foreign jurisdictions in which they operate. A sound practice for complex organizations
is to establish corporate standards for BSA/AML compliance that reflect the expectations
of the organization’s board of directors. Senior management should ensure that these
standards are implemented across the organization through effective programs tailored to
the activities, business lines, or legal entities. This allows the holding company or lead
financial institution to demonstrate to its board of directors that it has effective
BSA/AML compliance programs in place across the consolidated organization. Each
program should reflect the organization’s business structure and be tailored to its size,
complexity, and legal requirements that may vary due to the specific business line or host
country jurisdiction. 140
The enterprise-wide program should include a central point where BSA/AML risks
throughout the organization are aggregated. Structurally, the point of consolidation could
be established at either the level of the holding company or the lead financial institution.
Therefore, organizations that implement an enterprise-wide program should assess risk
both individually within business lines and on a consolidated basis across all activities
and legal entities. Enterprise-wide systems that operate on a global basis need to
consider the various jurisdictions in which they operate as well as the AML laws and
requirements they are subject to, and then incorporate these into their overall compliance
program. Internal audit should assess the level of compliance with the enterprise-wide
BSA/AML compliance program.
Examiners should be aware that some complex, diversified banking organizations may
have various subsidiaries that hold different types of licenses and banking charters or
may organize business activities and BSA/AML compliance program components across
their legal entities. For instance, a highly diversified banking organization may
consolidate all its funds transfer functions in a national bank subsidiary, while
centralizing its audit function at the holding company. This arrangement may present a
challenge to the examiner reviewing a legal entity within the organization, as it may be
difficult to evaluate that entity’s BSA/AML compliance.
Subsidiaries, Affiliates, and Business Lines
A holding company or a lead financial institution may decide to implement an enterprisewide
BSA/AML compliance program, either comprehensively or for specific business
functions (e.g., audit or suspicious activity monitoring systems). Where business specific
functions are so managed, examiners must identify during an examination or inspection,
which portions of the BSA/AML compliance program are part of the enterprise-wide
program. This information is critical when scoping and planning a BSA/AML
examination.
140 Policies and procedures at the branch or subsidiary level should be consistent with, although not
necessarily identical to, group or holding company standards.
FFIEC BSA/AML Examination Manual 150 8/24/2007