Bank Secrecy Act. Presented by: Martin (Marty) Mitchell, CRCM Managing Director, ProBank Austin

Transcription

1 Presented by: Martin (Marty) Mitchell, CRCM Managing Director, ProBank Austin Robert J. (Bob) Mullenbach, CRCM Managing Director, Compliance Division Deputy, ProBank Austin

2 Key Points 1. BSA Compliance remains at the top of the regulator s concerns and focus; 2. EVERY employee has personal skin when in comes to BSA compliance at your financial institution; 3. SAR filing is THE focus, and will continue to increase in volume and in complexity; 4. Beneficial Ownership and CDD will at least level the playing field as all will have to comply though will make servicing business members much more challenging; 5. Cyber-Events and Cyber Crime, Compromise Fraud, Human Trafficking/Human Smuggling, marijuana pot banking, vulnerable adult exploitation; de-risking, and residential real estate all-cash transactions are the hot buttons. -2-

3 It s the Law Financial Recordkeeping and Currency and Foreign Transaction Reporting Act - Currency Transaction Reporting (CTR) and Recordkeeping Requirements Money Laundering Control Act - Money laundering became a crime - FIs established formal BSA Program Anti- Drug Abuse Act - Civil Asset Forfeiture -3-

4 Written Policy Four (today) / Soon to be Five Tenets / Pillars + 2 Appointment of a BSA Officer ( Designated Prisoner ). System of Internal Controls. Independent Testing (annual basis - at least). Training - Everyone needs to be trained. Appropriate risk-based procedures for conducting ongoing Customer Due Diligence (Final Rule 05/11/2016 Applicability 05/11/2018.) - Risk-Assessment All compliance programs. - Customer/Member Identification Program (CIP/MIP) Added by Title III. -4-

5 Amendments to AML Program Under the Final Rule, the five pillars of BSA become: 1. A system of internal controls to assure ongoing compliance; 2. Independent testing for compliance to be conducted by bank personnel or by an outside party; 3. Designation of an individual or individuals responsible for coordinating and monitoring day-to-day compliance; 4. Training for appropriate personnel; and -5-

6 Amendments to AML Program 5. Appropriate risk-based measures for conducting ongoing member due diligence, to include but not be limited to: Understanding the nature and purpose of member relationships for the purpose of developing a member risk profile; and Conducting ongoing monitoring to maintain and update member information and to identify and report suspicious transactions. NOTE: All DFIs will also be expected to comply with the regulation(s) of its Federal functional regulator governing such program. Applicability Date is 05/11/

7 Money Laundering?? Very Simply - It s criminal finance!! A person who conducts a financial transaction WITH KNOWLEDGE that the funds or property involved are the proceeds of a crime, and who intends to further that crime or to conceal or disguise those proceeds is indeed laundering money. -7-

8 Money Laundering Placement - Getting the money into the bank; Layering - Hiding the source or destination of the funds to disguise from where it comes, or to where it goes; Integration - Combining illegitimate funds with legitimate funds, to make the illegitimate appear legitimate. -8-

9 Director Responsibilities - BSA In addition to the standard director responsibility of establishing and monitoring adherence to policies and procedures required by statute, regulation, or the principles of safety and soundness, to comply with BSA, the board and the members thereof should: 1. Ensure that the institution has established and the board has approved an appropriate (BSA) - Anti-Money Laundering (AML) program // OFAC(?); BSA/AML program will include annual training for all appropriate personnel, including the Board. The Board will appoint a competent BSA officer to oversee the BSA/AML program and should also consider back-up. -9-

10 Board BSA Expectations The Board is responsible for: 1. Approving the BSA/AML compliance program, and for overseeing the structure and management of the DFI s BSA/AML compliance function; 2. Setting an appropriate culture of compliance, (See FinCEN Advisory 2014-A007 on Promoting a Culture of Compliance ), establishing clear policies regarding the management of key BSA/AML risks, and ensuring that these policies are adhered to in practice. -10-

11 Advisory to U.S. DFIs on Promoting a Culture of Compliance FinCEN Advisory FIN 2014-A007 08/11/14 To strengthen its BSA/AML compliance culture, a DFI can ensure that: - Leadership actively supports and understands compliance efforts; - Compliance should not be compromised by Revenue Interests; - Information should be shared throughout the Organization; - Leadership should provide adequate human and technological resources; - Program should be effective and tested by Independent and Competent Party; & - Leadership and Staff should understand the purpose of their BSA efforts, and how BSA reports are used. -11-

12 Board BSA Expectations Added 2010 BSA/AML Examination Guide The Board should ensure that: a) Senior management is fully capable, qualified, and properly motivated to manage the BSA/AML compliance risks arising from the DFI business activities in a manner that is consistent with the Board s expectations; b) BSA/AML compliance function has an appropriately prominent status with the organization; c) Its views about the importance of BSA/AML compliance are understood and communicated across all levels of the organization; and d) Senior Management has established appropriate incentives to integrate BSA/AML compliance objectives into management goals and compensation structures across the organization, and that corrective actions, including disciplinary measures, if appropriate, are taken when serious BSA/AML compliance failures are identified. -12-

13 Competency Factors BSA Officer Level of authority and responsibility within the bank is critical the BSA officer may delegate BSA/AML duties to other employees, but the BSA officer is responsible for overall BSA/AML compliance, with the board ultimately responsible for such; Fully knowledgeable of the BSA and all related regulations; Understand the bank s products, services, clients, and geographic locations, and the potential money laundering and terrorist financing risks associated with those activities; Expertise, authority, and time to satisfactorily complete the job; Responsible for carrying out the direction of the board and ensuring that employees adhere to the bank s policies, procedures, and processes. -13-

14 Director Responsibilities BSA 2) Report any suspicious transaction relevant to any possible violation of law or regulation; (31USC5318(g)(1)) 3) Receive periodic updates from management covering BSA compliance initiatives, any compliance deficiencies, corrective actions taken, and the risk assessment efforts expended by the financial institution; and -14-

15 Director Responsibilities BSA 4) Receive periodic reports of Suspicious Activity Reports (SARs) filed by the institution. Note: No financial institution or director, officer, employee or agent may notify any person involved in the suspicious transaction that the suspicious transaction has been reported. Disclosure of such information could result in a civil penalty from $25,000 to $100,000, as well as possible criminal penalties (not more than $250,000 and five years in prison) for a willful disclosure of such SAR information should the regulatory agency or the Treasury Department decide to pursue such action. (31USC5321(a)(1) and 5322(a)). -15-

16 Director Responsibilities BSA When you sum it all up, from a BSA standpoint, the Board is: - Ultimately Responsible; and - Personally Liable. -16-

17 Common Themes from Headline E/As Report Suspicious Activities (especially Ponzi schemes); Management and Accountability to ensure that senior management and line of business management are accountable for fulfilling BSA/AML/OFAC responsibilities, the Board shall incorporate BSA and OFAC compliance into performance evaluations for senior and line of business management. Authority The Bank shall ensure that compliance staff has the appropriate level of authority to implement the BSA/AML compliance program, and as needed, question account relationships and business plans. Compliance staff shall maintain independence from the business line and not be subject to any form of evaluation or performance input from the business line; Staffing - Sufficient Personnel with requisite expertise, training, skills, and authority; Systems - Maintain accurate systems for all bank areas to produce and aggregate periodic reports designed to identify unusual or suspicious activity, including patterns of activity, to monitor unusual or suspicious activity on a consolidated basis; Develop appropriate CDD policies, procedures. Audit - develop and maintain an effective program to audit the BSA/AML program, one that focuses transactional testing on higher-risk accounts or geographic areas of concern; -17-

18 BSA/AML Risk Assessment Risk assessment is the second key to both a successful BSA compliance program, and the second key factor to surviving the BSA exam. Development of BSA/AML risk assessment generally involves two steps: Identify specific risk categories unique to the FI (products, services, clients, entities, and geographic locations) Quantity of Risk; Conduct a more detailed analysis of the data identified to better assess the risk within these categories Quality of Risk Controls in place; Quantity minus Quality = Residual Risk. There are many effective methods and formats used in completing a BSA/AML risk assessment, and the examiners will not advocate a particular method or format. -18-

19 Risk Assessments Three different types of Risk Assessments should be prepared: Institution Wide look at everything products, services, clients, entities, and geographic markets; Client Specific should have a high-risk client list; and OFAC related. Three populations of users should find the risk assessments helpful : Federal Examiners; Management; and Audit. -19-

20 Suspicious Activity Report BSA SAR FinCEN Form 111 BSA SAR (Form 111 THE SAR) mandatory utilization was 04/01/13 five forms down to one multi-industry form; Proposal to modify the form issued 02/02/17; Modify and increase the number of categories reported and tracked; Add an entire section dedicated to cyber and cyber-events ; E-filing makes report available within two days versus the previous two months in the paper submission world; Statues, regulations, guidelines, advisories will not change only the paper. -20-

21 -21-

22 -22-

23 2016 SAR Activity Distribution 958,737 // 1,975,641 (a/o 02/28/2017) 1 Suspicious Concerning the Source of Funds 282, % 2 Multiple Transactions Below Ctr Threshold 251, % 3 Suspicious Use of Multiple Locations 183, % 4 Transaction Out of Pattern for Customer(s) 164, % Transaction with No Apparent Economic, Business, 5 or Lawful Purpose 163, % 6 Check 152, % 7 Suspicious EFT/Wire Transfers 125, % 8 Two or More Individuals Working Together 117, % 9 Identity Theft 110, % 10 Other Other Suspicious Activities 106, % -23-

24 2016 SAR Activity Distribution 11 Credit/Debit Card 104, % 12 Provided Questionable or False Documentation 82, % 13 Suspicious Use of Multiple Accounts 74, % 14 Counterfeit Instrument (Other) 73, % 15 Other Fraud (Type) 66, % 16 Other Money Laundering 65, % 17 Consumer Loan 57, % 18 Multiple Individuals with Same or Similar Identities 52, % 19 ACH 48, % 20 Suspicious Use of Noncash Monetary Instruments 37, % 21 Wire Transfer 35, % 22 Alters Transactions to Avoid Ctr Requirement 30, % 23 Forgeries 28, % 24 Other Identification Documentation 28, % 25 Account Takeover 27, % 26 Multiple Transactions Below Bsa Recordkeeping Threshold 25, % 27 Elder Financial Exploitation 20, % -24-

25 2016 SAR Activity Distribution 1 California 164,915 2 New York 102,147 3 Texas 86,542 4 Ohio 82,317 5 Delaware 75,455 6 Florida 68,926 7 Virginia 52,143 8 North Carolina 48,311 9 Georgia 33, Pennsylvania 33, Illinois 32, New Jersey 32, South Dakota 20, Utah 19, Arizona 18, Washington 18, Massachusetts 18, Maryland 17, Michigan 17, Tennessee 14,

26 2016 SAR Activity Distribution UT 1 Credit/Debit Card 7, % 2 Suspicious Concerning the Source of Funds 4, % 3 Transaction Out of Pattern for Customer(s) 4, % 4 Identity Theft 3, % 5 Other Fraud (Type) 3, % 6 Suspicious Use of Multiple Locations 3, % 7 Two or More Individuals Working Together 3, % 8 Multiple Transactions Below Ctr Threshold 2, % Transaction with No Apparent Economic, 9 Business, or Lawful Purpose 2, % 10 Suspicious EFT/Wire Transfers 1, % 11 Suspicious Use of Multiple Accounts 1, % 12 Other Other Suspicious Activities 1, % 13 Suspicious Use of Noncash Monetary Instruments 1, % 14 Consumer Loan 1, % 15 Check 1, % 16 Multiple Transactions Below Bsa Recordkeeping Threshold 1, % 17 Other Money Laundering % 18 Account Takeover % -26-

27 2016 SAR Activity Distribution UT Top 10 Metropolitan Filing Areas 1 Salt Lake City, UT Metro Area 9,672 2 Provo-Orem, UT Metro Area 1,563 3 Ogden-Clearfield, UT Metro Area 1,105 4 St. George, UT Metro Area Logan, UT-ID Metro Area Cedar City, UT Micro Area Heber, UT Micro Area 80 8 Brigham City, UT Micro Area 55 9 Vernal, UT Micro Area Price, UT Micro Area

28 Three Legal Definitions The transaction is illegal; The transaction is designed to evade the reporting requirements of BSA; or The transaction is inconsistent with the customer s/member s normal behavior. -28-

29 SAR Test The transaction has no business or apparent lawful purpose, or is not the sort in which the particular customer would normally be expected to engage, and the financial institution knows of no reasonable explanation for the transaction after examining the available facts, including the background and possible purpose of the transaction. -29-

30 -30-

31 Confidentiality of SARs Final Rule Under the Final Rule: A SAR, and any information that would reveal the existence of a SAR are confidential, and shall not be disclosed except as authorized in the regulation. Underline was added 01/03/

32 Confidentiality of SARs Final Rule No Bank, S&L, or Credit Union, nor any director, officer, employee, or agent of any of the above, shall disclose a SAR or any information that would reveal the existence of a SAR. If any of the above are subpoenaed or otherwise requested to provide such information, we shall decline to do so, and notify both FinCEN and our primary regulator. -32-

33 Unauthorized Disclosure Penalties The unauthorized disclosure of a SAR is a violation of Federal law and both civil (Maximum $100,000) and criminal (Maximum of $250,000 and/or five years in prison) penalties may be imposed. DFI could be fined $ 25,000/day for each day the violation continues. -33-

34 Customer/Member Due Diligence Requirements For Financial Institutions Final Rule 05/11/16 81FR FinCEN has published in the Federal Register, the Final Rule to amend the BSA Rules to clarify and strengthen customer due diligence requirements. The Rules contain explicit customer due diligence requirements and include a new requirement to identify and verify the identity of beneficial owners of legal entity customers, subject to certain exclusions and exemptions. Announced: May 05, 2016 Published: May 11, 2016 Effective Date: July 11, 2016 Applicability Date: May 11,

35 Beneficial Ownership Covered financial institutions (CFI) are required to establish and maintain written procedures that are reasonably designed to identify, and verify, the beneficial owners of legal entity customers, and include such procedures in their anti-money laundering programs. These procedures shall enable the financial institution to: 1. Identify the beneficial owner of each legal entity customer at the time a new account is opened, unless the customer is otherwise excluded; and 2. Verify the identity (the existence of, not the status) of each beneficial owner presented to it according to risk-based procedures to the extent reasonable and practical. (Documentary and Non- Documentary Verification current MIP) It is important to update your AML/BSA procedures to include these new requirements -35-

36 Beneficial Owner Who? The term Beneficial Owner is defined using two prongs, an Ownership prong, and a Control Prong; Ownership Prong each individual, if any, who directly or indirectly, through any contract, arrangement, understanding, relationship, or otherwise, owns 25% or more of the equity interests of a legal entity customer; AND Control Prong a single individual with significant responsibility to control, manage, or direct a legal entity customer, including an executive officer or senior manager (E.g., CEO, CFO, COO, Managing Member, General Partner, President, Vice President, or Treasurer), or any other human who regularly performs similar functions. -36-

37 Beneficial Owner Legal Entity Customer Legal Entity Customers include: Corporation; Limited Liability Company; Any other entity created by the filing of a public document with the Secretary of State, or similar office. (This does not include Sole Proprietorships or unincorporated associations, even though such businesses may file with the Secretary of State to register a trade name or establish a tax account); General and Limited Partnerships; Statutory Business Trusts created through the filing with a State Office; and Any similar entity formed under the laws of a foreign jurisdiction that opens a new account. Both Ownership and Control Prongs apply to the above -37-

38 Beneficial Owner Legal Entity Member Legal Entity Customers also include: Non-Profit Corporations - Non Profit corporations or similar entities (charitable, non-profit, not-for-profit, nonstock, public benefit or similar corporations) are subject to the Control Prong of the beneficial ownership requirement. Only the Control Prong applies to the above. (Small community organizations such as Scout troops and youth sports leagues are unincorporated associations rather than legal entities and therefore are not subject to the beneficial ownership requirements -38-

39 Beneficial Owner Legal Entity Member Legal Entity Members do NOT include: Sole Proprietorships; Unincorporated Associations small community organizations, Scout troops, youth sport leagues, bowling leagues are not business entities still have to do CIP; Most Trust accounts; Credit Unions, Savings Associations, and Banks; Government Agencies at Federal, State, and Local levels; Publically Traded Companies so long as common stock is publically traded on NY, AMEX, and NASDAQ national security markets, et al; No Prongs apply to the above -39-

40 Martin (Marty) Mitchell, CRCM Managing Director, ProBank Austin 6200 Dutchmans Lane, Suite 305 Louisville, Kentucky (800) , Ext Robert J. (Bob) Mullenbach, CRCM Managing Director, Compliance Division Deputy, ProBank Austin 6200 Dutchmans Lane, Suite 250 Louisville, Kentucky (800) , Ext