BSA/AML Examination Manual - ffiec

Enterprise-Wide BSA/AML Compliance Program — Overview
When evaluating the enterprise-wide BSA/AML compliance program for adequacy, the
examiner should determine reporting lines and how each subsidiary fits into the overall
enterprise-wide compliance structure. This should include an assessment of how clearly
roles and responsibilities are communicated across the organization. The examiner
should assess how effectively the holding company or lead financial institution monitors
the compliance throughout the organization with the enterprise-wide BSA/AML
compliance program, including how well the enterprise-wide system captures relevant
data from the subsidiaries.
The evaluation of the enterprise-wide BSA/AML compliance program should take into
consideration available information about the adequacy of the individual subsidiaries’
BSA/AML compliance program. Regardless of the decision to implement an enterprisewide
BSA/AML compliance program in whole, or in part, the program should ensure that
all affiliates meet their applicable regulatory requirements. For example, an audit
program implemented solely on an enterprise-wide basis that does not conduct
transaction testing at all subsidiaries subject to the BSA would not be sufficient to meet
regulatory requirements for independent testing for those subsidiaries.
Holding Company or Lead Financial Institution
Holding companies or lead financial institutions that centrally manage the operations and
functions of their subsidiary banks, other subsidiaries, and business lines should ensure
that comprehensive risk management policies, procedures, and processes are in place
across the organization to address the entire organization’s spectrum of risk. An adequate
holding company or lead financial institution enterprise-wide BSA/AML compliance
program provides the framework for all subsidiaries, business lines, and foreign branches
to meet their specific regulatory requirements (e.g., country or industry requirements).
Accordingly, organizations that centrally manage an enterprise-wide BSA/AML
compliance program should among other things provide appropriate structure; advise the
business lines, subsidiaries, and foreign branches on the development of appropriate
guidelines; and set risk limits consistent with their domestic and international activities.
For additional guidance, refer to the expanded overview section, “Foreign Branches and
Offices of U.S. Banks,” page 156.
Organizations that implement an enterprise-wide BSA/AML compliance program should
assess risk on a consolidated basis across all activities, business lines, and legal entities.
Once the organization appropriately assesses its risk on an enterprise-wide basis, this
process should be ongoing. Business line subsidiaries and foreign branches should
provide periodic updates to the risk assessment process to the central point within the
holding company or lead financial institution. The risk assessment should serve as the
basis for the development of risk-based policies, procedures, and processes within the
activities, business lines, and legal entities. Subsidiary entities should advise the holding
company or lead financial institution on the development of risk-based policies,
procedures, and processes. After the policies, procedures, and processes are complete,
they should be approved by the holding company or lead financial institution.
Increasingly, organizations use software or programming solutions to assist in the
FFIEC BSA/AML Examination Manual 151 8/24/2007