Bank Secrecy Act Staying One Step Ahead of Your BSA Examiner

1. Bank Secrecy ActStaying One Step Ahead of Your BSA Examiner September 2009 AMLA Chicago Chapter Event

2. Most frequent apparent violations cited during exams Technical violations, including best practices related to CIP / enhanced due diligence Part 353 violations Pillar violations, including best practices for suspicious activity monitoring systems and the independent test Program violations Questions Session Agenda

3. Apparent Violations

4. Technical violations Part 353 violations Pillar violations Program violations Hierarchy of Violations

5. Failure to file / aggregate Incomplete filing Lack of identification Untimely filing CTR Related Violations

6. Lack of monitoring and review - Confirm eligibility for exempt status - Review for suspicious activity - Document the review Exemption Related Violations

7. Monetary Instruments Missing activity / aggregation Funds transfers Lacking the required information on the transmittal Monetary Instrument Sales & Funds Transfers Records RelatedViolations

8. Failure to obtain minimum information Failure to document resolution of discrepancy in identification information Failure of CIP to contain procedures for verifying customer identity CIP Related Violations

9. Individual customer – occupation and source of funds Business customers – Basic information: location, ownership, business structure, anticipated level of activity, primary products and services Enhanced Due Diligence - Best Practices

10. Business customers (continued) - Enhanced information: financial services providers Sources of Cash: selling of money orders, traveler’s checks, stored value cards Uses of Cash: check cashing, lending activities, ATMs Enhanced Due Diligence (continued)

11. List should be periodically updated Documentation of enhanced monitoring needed High Risk Customers – Best Practices

12. Determination of MSB status Registration requirements Risk-based additional due diligence Money Service Businesses – Best Practices

13. Lack of searching all required records: - Monetary instrument sales to non-customers - Funds transfers by non-customers - Trust, insurance subsidiary activity Inadequate continuity plans for performing searches 314 (a) Related Violations

14. Lack of filing SARs for transactions designed to evade reporting requirements Lack of filing SARs for transactions with no business or apparent lawful purpose Untimely filing Failure to notify Board Suspicious Activity Reporting Related Apparent Violations

15. PillarApparent Violations

16. Lack of effective suspicious activity monitoring and reporting systems Lack of adequate large currency transaction identification / aggregation Failure to search records as required by 314 (a) Various other deficiencies, such as the failure to implement an effective CIP program Internal ControlsPillar Violations

17. All banks should have monitoring systems for the following: 1) Large cash transactions 2) Monetary instrument sales 3) Funds transfers 4) ACH activity Suspicious Activity Monitoring – Best Practices

18. Monitoring systems – automated versus manual Automated reports – periodic review of filtering criteria and thresholds Activity should be compared to CDD information Large Cash Transaction Monitoring – Best Practices

19. Incoming Currency Structuring Activity with no business or apparent lawful purpose Outgoing Currency Structuring Activity with no business or apparent lawful purpose Large Cash Transaction Monitoring (continued)

20. Cash purchases Non-cash purchases: 1) Structuring 2) No business or lawful purpose Monetary Instrument Sales Monitoring – Best Practices

21. Uses of non-cash sales Non-suspicious Moving of funds to another institution Hiding funds from spouse Suspicious Tax evasion Hiding funds from court system (bankruptcy, judgments, divorce) Medicaid fraud Monetary Instrument Sales Monitoring (continued)

22. Log of activity containing originator, beneficiary, name and location of outside institution Monitor periodically for unusual activity, including the review of international wires Funds Transfers Monitoring – Best Practices

23. Capabilities of ACH reporting system Controls for outgoing ACH activity Review of incoming ACH activity Automated system benefits Review of cross-border activity ACH Monitoring - Best Practices

24. Inadequate scope: - the lack adequate transaction testing - the review of suspicious activity monitoring and reporting - customer due diligence / enhanced due diligence - review and verify the accuracy of reporting systems Independent Testing Pillar Violations

25. Risk-based, incorporating the bank’s BSA/AML risk assessment Internal auditor, outside auditor, consultant, or other qualified individual independent of the BSA/AML function Agreements should grant examiners access to workpapers Examiners will request workpapers during exams Independent Testing FIL-38-2008

26. Lack of appropriate training – outside training generally needed annually Lack of BSA Officer involvement in the day-to-day activity BSA OfficerPillar Violations

27. Over-reliance on on-line training Lack of documentation Failure to cover bank’s CIP procedures Training Pillar Violations

28. Missing CIP program in an area – loans, insurance subsidiary, trust department Lack of CIP policy CIP Pillar Violations

29. Lack of an effective BSA program Program reflects such systemic or pervasive deficiencies that the BSA/AML program is deemed ineffective at assuring and monitoring compliance with the BSA Program Violations

30. FFIEC BSA Exam Manual available at http://www.fdic.gov/regulations/examinations/bsa/ MSB information available at: http://www.fincen.gov/financial_institutions/msb/ Resources

31. Regional FDIC BSA Contact: John Lombardo Case Manager Special Activities 312-382-7516 Contacts

32. Questions?