COMPLIANCE MANAGEMENT: THE ART OF BOARD REPORTING

Transcription

1 COMPLIANCE MANAGEMENT: THE ART OF BOARD REPORTING 2015 Temenos USA, Inc. All rights reserved. Leah M. Hamilton Chief Compliance Officer, TriComply Services

2 WHAT YOU WILL LEARN: 2 How to write a Board Report Handouts Word document template/example 2

3 HOW TO WRITE A COMPLIANCE BOARD REPORT 3 How to write a compliance report once to meet the needs of multiple audiences Board of Directors Senior Management Operations Examiners 3

4 HOW TO WRITE A COMPLIANCE BOARD REPORT 4 Executive Summary What did you audit, monitor, review? Who performed it? Purpose? For what period? Assumptions/Constraints The review was not intended to identify all violations with the Truth in Lending Act. The review was intended to identify areas of control weaknesses with compliance with the requirements of Section 32 HOEPA and Section 35 HPML under Regulation Z. 4

5 HOW TO WRITE A COMPLIANCE BOARD REPORT 5 Executive Summary What were your overall findings? <Institution Name> is adequately addressing the requirements of <Institution Name> is not sufficiently addressing the requirements of The <Institution Name> is adequately addressing its responsibilities. It has evaluated its risks and has created an appropriate set of policies, procedures, and practices to effectively and efficiently manage those risks. 5

6 HOW TO WRITE A COMPLIANCE BOARD REPORT Executive Summary What is the overall risk rating you have assigned based on your findings? Overall, we have assigned a Compliance Risk Rating of 2 Satisfactory (with correction action response needed from management). The risk rating scoring legend has been provided in Appendix A to this report. Appendix A Risk Rating Score System The rating system consists of four ratings: Risk Rating 1 Satisfactory No Corrective Action Response from Management Needed Risk Rating 2 Satisfactory Corrective Action Response Needed from Management Risk Rating 3 Needs to Improve Corrective Action Response Needed from Management Risk Rating 4 Unsatisfactory Senior Management Attention Needed with Corrective Action # 6

7 HOW TO WRITE A COMPLIANCE BOARD REPORT Executive Summary Summary of Areas Reviewed Area Reviewed Exceptions Risk Rating 2014 FDIC Examiner BSA recommendation Completed BSA/AML Program Exceptions noted Moderate Customer Due Diligence (CDD)- Including EDD Procedures for High Risk Customers Information Sharing OFAC Compliance Including ACH Procedures Currency Transaction Reporting (CTRs) Exceptions noted Low CTR Exemption Monitoring Suspicious Activity Reviews (SARs) Exception noted Low Wire Transfer Procedures and Recordkeeping Monetary Instruments International transportation of currency Domestic and Foreign correspondent accounts Money Service Business (MSB) procedures Exception Noted Low Electronic banking relating to international transactions Record retention # 7

8 HOW TO WRITE A COMPLIANCE BOARD REPORT Scope and Methodology What reviewed Considerations Process employed Our audit assessed the Institution s compliance with the Institution Secrecy Act (BSA) and Anti-Money Laundering (AML) laws and implementing regulations for the period January 1, 2014 through December 31, The Scope also took into account items rated as high on the Institution s BSA Risk Assessment. Additional scrutiny was placed on high risk items. The procedures we employed during the review of the Institution s BSA/AML Program were designed to determine the extent to which the Institution s program conformed to current regulatory expectations as published in the current version of the FFIEC s BSA Examination Manual. 8

9 HOW TO WRITE A COMPLIANCE BOARD REPORT Summary of Findings and Recommendations Always start with prior examination findings until they are completely resolved What did you review? Area reviewed include transaction volume counts What were your observations? Include error/exception counts Copy to work paper binder What are your recommendations? What action has been taken/needs to be planned? Management Response 9

10 HOW TO WRITE A COMPLIANCE BOARD REPORT BSA/AML Program During our review, we considered whether the Institution has developed, administers, and maintains an effective program for compliance with the BSA and its implementing regulations. We reviewed whether the program contains the following required minimum elements: A system of internal controls to ensure ongoing compliance; Independent testing of BSA/AML compliance; A specifically designated person or persons responsible for managing BSA compliance (BSA compliance officer). Training for appropriate personnel; and A customer identification program. BSA/AML Policy Review The BSA/AML Policy was reviewed to ensure all essential components were adequately represented. The Institution has implemented policies, procedures, and processes that are commensurate with the Institution s BSA/AML/OFAC risk profile. No exceptions to the policy were noted. 10

11 HOW TO WRITE A COMPLIANCE BOARD REPORT CTR Exemptions The regulations have historically recognized that the routine reporting of some types of large currency transactions does not necessarily aid law enforcement authorities and may place unreasonable burdens on banks. Consequently, a bank may exempt certain types of customers from currency transaction reporting. The Institution does grant exemptions as provided under the regulations and has established a set of standards to control how the exemption process. The CTR Exemption List was also reviewed as part of the audit. Observation: In reviewing the CTR Exemption List, as of December 31, 2014, the Institution has identified five (5) Phase I exemptions and seven (7) Phase II exemptions. These exempt businesses are monitored for compliance to the CTR Exemption guidelines. No exceptions were noted. 11

12 HOW TO WRITE A COMPLIANCE BOARD REPORT Money Service Businesses (MSB) MSBs offer check cashing, money orders, traveler s checks, money transfers, currency dealing or exchange, and pre-paid access (formerly stored value) products and are subject to BSA requirements. It is the Institution s practice to not have MSB customers. Observation: We identified one business account that was a Money Service Business. Recommendation: The Institution should close the account and update its policy to reflect that it does not accept MSB customers. Additionally, training should be provided to applicable staff to ensure the policy is adhered. Action Taken: Management closed the account during the audit. The Institution s policy was updated to reflect the Institution s position that Money Service Business accounts will not be opened in the future. 12

13 BOARD REPORTING EXAMPLE Ability to Repay Section (c)(1) of Regulation Z requires that a creditor make a reasonable and good faith determination at or before con-summation that the consumer will have a reasonable ability to repay a covered transaction [i.e., a closedend mortgage secured by a dwelling] according to its terms. Section (c)(2) of Regulation Z requires that a creditor making the determination required by Section (c)(1) must consider: (i) The current or reasonably expected income or assets, other than the value of the dwelling securing the loan; (ii) Consumer s current employment status, if income from employment is relied upon; (iii) Consumer s monthly payment on covered transactions calculated in accordance with Section (c)(5); (iv) Consumer s monthly payment on any simultaneous loan that the creditor knows or has reason to know will be made, calculated in accordance with Section (c)(6); (v) Consumer s monthly payment for mort-gage-related obligations, as defined in Section (b)(8); (vi) Consumer s current debt obligations, alimony and child support; (vii) Consumer s monthly debt-to-income ratio or residual income in accordance with Section (c)(7); and (viii) Consumer s credit history. Observation: It is the Institution s policy to adhere to the ATR requirements. We reviewed (25) closed-end mortgages subject to the ATR requirements. (4) loan files do not contain verification of the consumer s employment status where the income appears to be relied upon in determining the consumer s ability to repay. Recommendation: The Institution should update its written procedures to reflect the Institution s policies and practices with respect to ATR. We would also recommend a secondary review of the loan file prior to closing to ensure compliance with ATR due to the heightened risk under abusive in UDAAP as well as potential Regulation Z violations. Additional training should also be provided to lending staff regarding such policies and procedures, including the risk related to such errors or omissions. Risk Rating: 2 Action Taken: During our review, Loan Operations determined that the documentation for (2) of the loan files was mis-filed in another consumer s loan file; (1) file had scanning issues but the hard copy file did have the information; and for (1) loan the information was not obtained until after the loan closed. Additionally, the Loan Operations Manager developed improved procedures to reflect the Institution s ATR policies, provided additional training and implemented additional monitoring procedures to ensure the processes are followed. # 13

14 HOW TO WRITE A COMPLIANCE BOARD REPORT Action Plan 14

15 HANDOUTS Word document Board Report Sample provided in your download materials Includes Action Plan 15

16 RESOURCES Don t know where or how to start your finding in the report? FDIC Exam Manual Violations codes Section II

17 QUESTIONS?