BSA/AML Examination Manual - ffiec

BSA/AML Compliance Program — Examination Procedures
Risk Assessment Link to the BSA/AML Compliance
Program
3. On the basis of examination procedures completed in the scoping and planning
process, including the review of the risk assessment, determine whether the bank has
adequately identified the risk within its banking operations (products, services,
customers, entities, and geographic locations) and incorporated the risk into the
BSA/AML compliance program. Refer to Appendix I (“Risk Assessment Link to the
BSA/AML Compliance Program”) when performing this analysis.
Internal Controls
4. Determine whether the BSA/AML compliance program includes policies, procedures,
and processes that:
Identify high-risk banking operations (products, services, customers, entities, and
geographic locations); provide for periodic updates to the bank’s risk profile; and
provide for a BSA/AML compliance program tailored to manage risks.
Inform the board of directors, or a committee thereof, and senior management, of
compliance initiatives, identified compliance deficiencies, Suspicious Activity
Reports (SARs) filed, and corrective action taken.
Identify a person or persons responsible for BSA/AML compliance.
Provide for program continuity despite changes in management or employee
composition or structure.
Meet all regulatory requirements, meet recommendations for BSA/AML
compliance, and provide for timely updates to implement changes in regulations.
Implement risk-based customer due diligence (CDD) policies, procedures, and
processes.
Identify reportable transactions and accurately file all required reports, including
SARs, Currency Transaction Reports (CTRs), and CTR exemptions. (Banks
should consider centralizing the review and report-filing functions within the
banking organization.)
Provide for dual controls and the segregation of duties to the extent possible. For
example, employees that complete the reporting forms (such as SARs, CTRs, and
CTR exemptions) generally should not also be responsible for the decision to file
the reports or grant the exemptions.
Provide sufficient controls and monitoring systems for the timely detection and
reporting of suspicious activity.
FFIEC BSA/AML Examination Manual 35 8/24/2007