BSA/AML Examination Manual - ffiec

Customer Due Diligence — Overview
• Provide guidance for documenting analysis associated with the due diligence process,
including guidance for resolving issues when insufficient or inaccurate information is
obtained.
• Ensure the bank maintains current customer information.
Customer Risk
Management should have a thorough understanding of the money laundering or terrorist
financing risks of the bank’s customer base. Under this approach, the bank should obtain
information at account opening sufficient to develop an understanding of normal and
expected activity for the customer’s occupation or business operations. This
understanding may be based on account type or customer classification. For additional
guidance, refer to Appendix K (“Customer Risk versus Due Diligence and Suspicious
Activity Monitoring”).
This information should allow the bank to differentiate between lower-risk customers and
higher-risk customers at account opening. Banks should monitor their lower-risk
customers through regular suspicious activity monitoring and customer due diligence
processes. If there is indication of a potential change in the customer’s risk profile (e.g.,
expected account activity, change in employment or business operations), management
should reassess the customer risk rating and follow established bank policies and
procedures for maintaining or changing customer risk ratings.
Much of the CDD information can be confirmed through an information-reporting
agency, banking references (for larger accounts), correspondence and telephone
conversations with the customer, and visits to the customer’s place of business.
Additional steps may include obtaining third-party references or researching public
information (e.g., on the Internet or commercial databases).
CDD processes should include periodic risk-based monitoring of the customer
relationship to determine whether there are substantive changes to the original CDD
information (e.g., change in employment or business operations).
Enhanced Due Diligence for High-Risk Customers
Customers that pose high money laundering or terrorist financing risks present increased
exposure to banks; due diligence policies, procedures, and processes should be enhanced
as a result. Enhanced due diligence for high-risk customers is especially critical in
understanding their anticipated transactions and implementing a suspicious activity
monitoring system that reduces the bank’s reputation, compliance, and transaction risks.
High-risk customers and their transactions should be reviewed more closely at account
opening and more frequently throughout the term of their relationship with the bank.
Guidance for identifying high-risk customers may be found in the core overview section,
“BSA/AML Risk Assessment,” page 18.
The bank may determine that a customer poses a high risk because of the customer’s
business activity, ownership structure, anticipated or actual volume and types of
FFIEC BSA/AML Examination Manual 57 8/24/2007