BSA/AML Hot Topics and UIGEA Daniel Hastings Financial Institution Examiner - FDIC

Transcription

1 BSA/AML Hot Topics and UIGEA Daniel Hastings Financial Institution Examiner - FDIC

2 Common BSA Deficiencies Revised FFIEC BSA/AML Examination Manual Proposed CDD Requirements for Financial Institutions Suspicious Activity Monitoring Software Operation Choke Point Unlawful Internet Gambling Enforcement Act (UIGEA) Q&A Session

3 Internal Controls Risk Assessment CDD/EDD Suspicious Activity Monitoring Implementation of policies and procedures BSA program has not kept pace with growth and risk profile BSA Officer Lack of expertise/qualifications and employee turnover Insufficient resources

4 Independent Testing Inadequate scope Failure to identify deficiencies Not performed in a timely manner Training Not provided annually Not tailored to specific job duties Bank policies and procedures are not covered

5 2014 Revision was released on 12/2/2014 Examination procedures to be used for all BSA exams starting 1/2/2015 Overall, changes did not implement any new guidance Changes reflect previously issued guidance, instruction, regulation, and interpretations Table of Contents show which sections contain updates

6 The more significant updates include: Regulatory citations were changed from 31 CFR 103 to 31 CFR Chapter X FinCEN reporting system requires mandatory electronic filing Additional guidance on SAR disclosures and sharing with head office, controlling companies and certain U.S. affiliates Expanded section on aggregating transactions for CTRs for businesses with common ownership

7 Banks with lower OFAC risks may periodically compare the customer base Requirements for Correspondent Accounts (foreign) Section 311, Special Measures Assess foreign bank s AML program Review account activity and transactions to identify variances from foreign bank s customer base Focus on nested transactions with designated higherrisk entities Understand AML regime of foreign jurisdiction where the bank operates

8 Expanded section on bulk shipments of currency Prepaid access replaces Electronic Cash section Role of third parties Card form and capabilities Prepaid access risks Risk mitigation

9 Third Party Payment Processors (TPPP) TPPP Risk profiles vary depending on customer base Adds to risk mitigation review of databases to ensure TPPP owners/operators not subject to law enforcement actions Banks should ensure that agreements provide timely access to necessary information Relationships should be periodically audited, including merchant client lists Return rate monitoring should include returns for other reasons such as NSF or administrative reasons Thresholds established for returns. Transactions should be monitored for patterns attempting to evade NACHA limits on returned entries.

10 Embassy, Foreign Consulate, and Foreign Mission Risk Assessment Appropriate due diligence Possible additional risk mitigants: Entering into a written agreement defining the use of account: Available services and transactions Access limitations Offer limited purpose accounts: Payroll Rent and utilities Account monitoring remains essential

11 Non-Bank Financial Institutions Now includes loan or finance companies and operator of credit card systems. Includes the FinCEN definition for MSBs: Dealer in foreign exchange, check casher, issuer or seller of traveler s checks or money orders, money transmitter, provider of prepaid access, seller of prepaid access, US postal Service MO. Discusses the particulars of prepaid access cards and qualified exclusions on prepaid access cards. Qualified exclusions: Open loop not exceeding $1,000 maximum value on any day Provide access to employment benefits, incentives, wages or salaries. Unless can use internationally, person-to-person, or reloaded from non-depository source. Discusses virtual currency administrators and exchangers as a money transmitter.

12 Beneficial Ownership 31 CFR Chapter X: Rin-1506-AB15 Ownership Control Strengthens existing CDD expectations Establishes a categorical requirement to identify beneficial ownership of accountholders, subject to risk-based verification

13 Each individual who owns 25 percent or more May require info on multiple corporate entities and legal structures Individual who exercises significant managerial control If no individual owns 25% or more, may identify beneficial owner under the control prong

14 Data integrity Default settings vs. custom settings Periodic tuning and calibration Document/Justify rule settings (thresholds, transaction exclusions, etc.) Conversion rates alerts to SAR filings False positives (alerts w/ no SAR filings) Coverage of new products and services Consideration of new fraud/money laundering typologies

15 Independent validation Performed periodically Evaluate effectiveness of suspicious activity monitoring system Check coding of rule sets Review controls over rule changes Assess integrity and accuracy of MIS used in BSA/AML program Determine if rule sets are reasonable and comprehensive OCC Supervisory Guidance on Model Risk Management

16 Common Problems No rule sets for transaction velocity No coverage of certain product and/or services Insufficient grouping of transactions despite commonalities Thresholds too high / Rules too prescriptive resulting in very few alerts Timeliness of alert resolution and SAR filings Documentation of decisions to not file a SAR Separation of duties: identification of suspicious activity vs investigation

17 Background Accusations of DOJ targeting legal/legitimate businesses (e.g. payday lenders) Supervisory Insights Summer 2011 Issue

18 FDIC Position For legal operations, risk should be appropriately recognized and controlled FDIC never requires de-risking of legal business lines or accounts Business decision of management

19 Joint Rule Published twice in Code of Federal Regulations (CFR) 12 CFR Part 233 (FRB) and 31 CFR Part 132 (U.S. Department of Treasury) Joint Rule Effective Date January 19, 2009 Compliance with Joint Rule required as of June 1, 2010 Subsequent Interagency Guidance issued by: Board of Governors of the Federal Reserve System Federal Deposit Insurance Corporation National Credit Union Administration Office of the Comptroller of the Currency Office of Thrift Supervision

20 UIGEA prohibits gambling businesses from processing restricted transactions Bet/Wager involving the Internet and that is unlawful under any federal or state law UIGEA also requires regulations for certain entities to have policies and procedures Must be reasonably designed to identify and block or otherwise prevent or prohibit the processing of restricted transactions Institutions non-exempt participants in many cases

21 General Requirements for Financial Institutions Establish/Implement policies and procedures o Safe Harbor if Rule s P&P examples are implemented Notice to commercial accountholders prohibition of restricted transactions o Applies to both new and existing accounts Establish risk-based approach to conduct due diligence on commercial accountholders o If posing more than minimal risk, certification or copy of license/commitment may be needed

22 Payment System Non-Exempt Participants Safe Harbor Policies and Procedures: General Requirements Card Systems (credit, debit, stored value) 1. Card Issuers 2. Merchant Acquirers 3. Operators 4. Third-party Processors Automated Clearing House 1. RDFI, credit transactions 2. ODFI, debit transactions 3. Gateway operator for cross-border debits 4. Third-party processors for any of 1, 2, or 3 Due diligence or Use of codes to identify restricted transactions and ongoing monitoring for codes; and Restricted transactions procedures. Due diligence; Restricted transaction procedures; and For inbound cross-border ACH debit transactions, notice to correspondent bank in case of actual knowledge of restricted transactions. Wire Transfer Beneficiary s bank Due diligence and Restricted transactions procedures. Check Collection 1. Depository bank 2. First U.S. bank for cross-border check receipts Due diligence; Restricted transactions procedures; and For cross-border transactions, notice to correspondent bank in case of actual knowledge of restricted transactions. Money Transmitting Businesses Operators of money transmitting businesses that permit initiation of funds transmissions remotely, such as via Internet or telephone. Due diligence; Ongoing monitoring by the operator to detect potential restricted transactions; and Restricted transactions procedures. NOTES: Due Diligence includes the following: Written notice to all commercial accountholders that the account must not be used for restricted transactions; and Risk Assessment for each commercial account opened on/after Rule s compliance date to make minimal risk determination; and Obtaining required documentation if commercial customer presents more than minimal risk Restricted transactions procedures are to be followed when an institution has actual knowledge that a commercial customer received funds in a restricted transaction. Procedures should address continued transaction processing, account review, SAR filing, and account closure.

23