Heather Jones September 2016 Carma Parrish September 2016 POLICY: BSA Risk Assessment Policy BOD Approved Date: September 2016

Transcription

1 Heather Jones September 2016 September 2016 POLICY: BSA Risk Assessment Policy BOD Approved September 2016 Purpose Formally document the Credit Union s assessment of its products and services, lines of businesses, member base and geographies where business is conducted. This assessment will be used to insure that the Credit Union establishes and maintains a BSA/AML program, complete with systems and controls, commensurate with its risk for money laundering activity. Our ultimate goal is to prevent the Credit Union s products and services from being used to facilitate money laundering and terrorist financing. Recognizing Risk and Mitigating Risk Factors Identifying and Monitoring High Risk Entities Certain types of businesses, transactions and geographic locations may lend themselves more readily than others to potential criminal activity. Businesses Non traditional financial entities, such as: Currency exchange houses, also known as giros or casas de cambio. Money transmitters. Check cashing facilities. Casinos and card clubs. Offshore corporations and bank s located in tax and/or secrecy havens. Leather goods stores. Car, boat, and plane dealerships. Used automobile or truck dealers and machine parts manufacturers. Travel agencies. Brokers/dealers. Jewel, gem, and precious metal dealers. Import/export companies. Auctioneers. Deposit brokers. Pawn brokers. Professional service providers (lawyers, accountants, investment brokers). Cash intensive businesses, such as convenience stores, restaurants, retail stores, and parking garages. Ship, bus, and plane operators. Telemarketers. 1

2 Heather Jones September 2016 September 2016 POLICY: BSA Risk Assessment Policy BOD Approved September 2016 Credit Union Functions and Transactions Internet banking. Wire transfers/cash management functions. Transactions in which the primary beneficiary or counterparty is Undisclosed. Loan guarantees schemes. Transactions involving large amounts of traveler s checks, official bank Checks, money orders, and stored value cards. Pouch activity. Geographic Locations Countries in which the production or transportation of illegal drugs may be taking place. Bank secrecy havens. Emerging countries that may be seeking hard currency investments. Countries identified in FinCEN advisories. Major money laundering countries and jurisdictions identified in the U.S. Department of State s annual International Narcotics Control Strategy Report 2 Countries identified by the Financial Action Task Force on Money Laundering (FATF) as non cooperative countries and territories. Countries are listed on the CU answers base as suspect countries and updated accordingly These and other Internet link resources are available on the Compliance Intranet site: FATF Non Cooperative Countries & Territories (NCCT) List: www1.oecd.org/fatf/ncct_en.htm FinCEN Advisories: Employment Screening New hires should be screened prior to hiring to insure we know the true identity and past history of our officers and employees. The Credit Union Orders credit reports and drug screening test on all new hires. High Employee Turnover High turnover, especially in key positions, can be a critical risk factor. Stricter internal controls and heightened scrutiny of accounts may be required to reduce risk until new hires are thoroughly trained in Credit Union policies and procedures. The Credit Union regularly audits all maintenance 2

3 Heather Jones September 2016 September 2016 POLICY: BSA Risk Assessment Policy BOD Approved September 2016 done on all accounts as well as transactions of the employees accounts. Compensation Plans Credit Union compensation plans should not create incentives for employees to ignore bank account opening processes or possible suspicious activity. Commissions based on the number of new accounts or an increase of managed assets may provide an incentive for employees to neglect member documentation requirements or other account opening practices. Strong internal controls on new account documentation can be a mitigating factor to reduce risk. Insider Complicity Employees assigned to higher risk areas of the Credit Union and higher risk accounts should be subject to heightened scrutiny. Their accounts should be reviewed routinely for any unusual or suspicious activity. Lifestyle vs. salary should be emphasized. Tests for insider complicity should also be part of a Credit Union s audit program. BSA/AML Program Weaknesses in the Credit Union s BSA/AML program will directly impact the Credit Union s ability to manage AML risk effectively. An effective program is thorough and changes frequently to keep pace with new criminal trends. Written BSA/AML Program BSA/AML policies and procedures must be clearly defined for all areas of the Credit Union. Program must address issues including but not limited to: individuals with compliance responsibilities, internal controls, cash tracking and reporting, managing exempt persons, FBARs and other required BSA reporting, OFAC (SDN list and countries under sanction), suspicious activity reporting, enhanced due diligence account monitoring, USA PATRIOT Act issues such as a CIP program, foreign correspondent bank services, information sharing procedures and requirements for monitoring government lists. Program must be approved by the Credit Union s Board of Directors and disseminated to staff. CIP/KYC Programs An effective CIP program is an essential element of our risk management program. A well designed and managed CIP process will serve to mitigate risks because it will insure that we KNOW OUR CUSTOMER. 3

4 Heather Jones September 2016 September 2016 POLICY: BSA Risk Assessment Policy BOD Approved September 2016 Suspicious Activity Program Employees must be trained to identify and report suspicious activity for further investigation. Individual(s) with SAR filing responsibilities must be trained on proper investigative techniques, SAR completion, filing electronically, record retention and interaction with law enforcement. Monitoring High Risk Entities Program should be in place to monitor accounts of member s and accounts identified as high risk as stated in the Due Diligence section of NorthPark s BSA Policy. Procedures should also be in place to conduct a thorough due diligence review of all members exempted from currency transaction reporting in the event NorthPark chooses to do CTR exemptions. At this time NorthPark Credit Union does not exempt any accounts from currency transaction reporting. Transaction testing is critical to a good EDD program which the credit union performs annually. Training The BSA/AML officer and support staff must receive ongoing training to stay abreast of BSA/AML issues. Employees should be trained on issues that specifically affect their area(s) of responsibility. Program should clearly define training requirements for BSA staff, new hires, and employees. All employees shall have mandatory training annually by a qualified compliance specialist. Independent Testing A required component of every BSA/AML program. NorthPark Credit Union has an outside audit annually. 4

5 POLICY: BSA Risk Assessment Policy BOD Approved Draft BSA/AML RISK ASSESSMENT Credit Union Name NorthPark Community Credit Union Date August 29, 2016(Board Review) Sept. 26, 2016 (Board Approval) Risk Rating 1. MEMBER BASE Low to Moderate 70 % Stable, known member base. (Low risk.) 30 % Member base is more diverse and transient due to metropolitan location including main employee group DAS. (Moderate risk) 0 % A large and growing deposit base in a wide and diverse geographic area. (High risk.) Page 5

6 POLICY: BSA Risk Assessment Policy BOD Approved Draft Total Assets (enter date) $52,197, Retail Member Base Consumer 6,568 Commercial: 0 Number of Alien Members Members with a Foreign Address Or Foreign Citizenship 27 0 Number of PIC, Pouch, and Payable Through Accts 0 Number of Foreign Correspondent Accts Number of Broker Accts 0 Public Funds: 0 (Less than 1 %) (June 30, 2016) Total 6568 (June 30, 2016) (June 30, 2016) Alien members with Total Deposits of $1 mil or more: 0 Risk Rating 2. CREDIT UNION /BRANCH OFFICE LOCATIONS Page 6

7 POLICY: BSA Risk Assessment Policy BOD Approved Draft a) Current number of branch office locations (do not include Loan Production Offices (LPOs) and Deposit Production Offices (DPOs): Three b) Current number of loan production office (LPO) locations: 0 c) Current number of deposit production office (DPO) locations: 0 d) Please list general location of each new office scheduled to open within the next year: e) Determine whether any branch is located in a High Intensity Drug Trafficking Area (HIDTA) or High Intensity Money Laundering and Related Financial Crime Area (HIFCA). None Page 7

8 POLICY: BSA Risk Assessment Policy BOD Approved Draft You may review following sites for specific information regarding these designations. HIDTA: and HIFCA: Page 8

9 POLICY: BSA Risk Assessment Policy BOD Approved Draft [X ] No, we do not establish accounts for customers in any HIDTA or HIFCA area. (Low risk.) [ ] Yes, we establish accounts and provide services to persons located in the following HIDTA or HIFCA areas. Please quantify your findings and document procedures in place to manage risk in your business line associated with this risk factor. (Moderate to High risk.) 3. PRODUCTS & SERVICES AML Risk Rating Risk Assessment and Risk Management Factors (Please describe in detail all internal controls, policies and procedures designed to control risk identified during the review process. Quantify total accounts & $ in each product line.) Page 9

10 POLICY: BSA Risk Assessment Policy BOD Approved Draft ATMs New updated and compliant ATM s were installed in 2012 that have on us deposit capability in addition to normal ATM functions. On a weekly basis, NorthPark staff retrieve and verify cash in the ATM canister through dual control measures. Deposits are retrieved and processed daily by 2 employees as a dual balance procedure. Bond Accounting & Investments Bond Sales & Accounting Brokered Accounts Safekeeping NORTHPARK does not participate in Bond Sales & Accounting. NORTHPARK purchases brokered investment CDs from Primary Financial, A Credit Union Service Organization. Primary Financial has a comprehensive BSA/AML policy and procedures manual. NORTHPARK does not participate in Safekeeping. Asset/Liability Management NORTHPARK has contracted with Accolade to provide the ALM reports. Investment Portfolio Mgmt. NORTHPARK purchases investment CDs only. The contract is with Primary Financial. See above. NORTHPARK does not participate in Federal Funds Programs. Page 10

11 POLICY: BSA Risk Assessment Policy BOD Approved Draft Federal Funds Programs NORTHPARK does not participate in Repurchase Programs. Repurchase Program NORTHPARK does not participate in Training/Seminars of this nature. Training/Seminars Brokerage & Securities Services Annuities & Brokerage services NORTHPARK has a third party vendor relationship with Westpoint Financial Group, a subsidiary of Mass Mutual Insurance. Westpoint Financial Group provides brokerage and securities services to our membership on a member initiated basis. Mass Mutual Investor Services Compliance Manual has 30 pages dedicated to BSA/AML Policies and Procedures. All financial advisors have a rigorous training schedule that includes training in BSA/AML risks. This training is done on an annual basis. In addition, controls are in place to identify and document transactions that are considered unusual or risky (i.e. a short term transaction on a long term product). Investment Advisor Independent Investment Adv. Professional Asset Mgmt. All services provides by WestPoint Financial are on a member initiated basis. Page 11

12 POLICY: BSA Risk Assessment Policy BOD Approved Draft Online securities trading Retirement Services Including self directed Safekeeping Westpoint Financial Services does not provide this service. Correspondent Banking NORTHPARK does not provide any type of Correspondent Banking. Brokered CDs DeNovo Services Page 12

13 POLICY: BSA Risk Assessment Policy BOD Approved Draft Domestic Banks Federal Funds Program Foreign Banks Pouch Activity 30 Day Loans A new product has been created called the 30 Day Loan. The Credit Union procedures in place to mitigate risk of loss to the credit union through application fees and interest earned. Limits have also been put into place to mitigate risk also. Diligent collections efforts are also in place to control losses to the credit union. BSA/OFAC/CIP policies and procedures are also followed on both current and new members who apply. Page 13

14 POLICY: BSA Risk Assessment Policy BOD Approved Draft Credit Cards Credit cards are processed through the NORTHPARK loan department. A complete application is taken with Credit Reports, OFAC and SafeScan. All CIP policies and procedures are followed. When a NorthPark member attempts to use their credit card outside of the United States the credit card is automatically blocked for usage when unless approved by Management, therefore mitigating risk. Fraud detection programs (such as Falcon reports and CAMS Alerts) are in place to reduce fraud and manage risk on NORTHPARK credit card portfolio. All non U.S. transactions are blocked, unless the block is requested to be removed by the member. VISA implemented a Case Manager program that alerted participating financial institutions of potential compromised cards. When prompted by an , Management monitors all potential compromised activity on NORTHPARK debit and credit cards with the assistance of the branch managers,designated MSR s, and Loan Officers. If the risk level of the potential compromise is rated high, then the old card is blocked and a new card is ordered. All CIP, OFAC and BSA policies and procedures are followed. Page 14

15 Electronic Banking Services POLICY: BSA Risk Assessment Policy BOD Approved Draft ACH Services NORTHPARK members must request this service. An ACH Authorization form is completed by the member and verified by staff. When necessary, the credit union can return unauthorized ACH withdrawals. NORTHPARK only originates ACH debits from other Financial Institutions. We no longer do ACH credits to other Financial Institutions. All IAT (International ACH) are automatically scanned through OFAC by our core processor. In the event the IAT has a match the core processor alerts the credit union through a daily exception report. This report is worked daily by the accounting department. The ACH is not processed until the possible match has been cleared. ATM/Debit Cards Member must have ATM card and PIN number to access account. Vantiv is the vendor who will be servicing our debit, credit and ATM cards. The Vantiv system has in place the ability to select a personal PIN. Verification of personal information as well as activation with a documented phone number is required. If the member tries to activate the card with a non documented phone number it will fail and activation will have to be done by the Credit Union. This is done only after verification that the person calling is the member. Only 1 card per member on the account. Omni Shield Plus by Vantiv monitors fraud alerts and fraud detection by placing a block due to unusual card usage. This program is designed to mitigate risk and limit fraud. The credit union does not allow deposits into Foreign ATM s. Only NorthPark Members are allowed to deposit at the 3 Branch ATM s owned by NorthPark to mitigate risk and limit fraud. NorthPark now only issues chip cards for debit and credit cards on all new and reissue cards upon natural expiration date. This is in place to mitigate risk and limit fraud. Page 15

16 POLICY: BSA Risk Assessment Policy BOD Approved Draft Internet Banking Online Transfer Service NORTHPARK members automatically have access to internet banking. The credit union has a challenge question based Multi Factor Authentication (MFA) program in place to offer additional security. Members must have their account number and a password (within specifications.) All passwords for online banking are rated to ensure members choose passwords to better protect their accounts. Members are only allowed 3 attempts to enter the correct password and security question answer combination before the password is disabled. This mitigates the risk of someone from trying to guess a members password or security question. These passwords are encrypted in CU*Base files and not visible to member or CU staff. Each computer used for internet banking purposes must be registered by the member. Confirmation E mail notification and secure online banking messages for personal information changes are in place for all online banking changes. Members who choose to use Mobile Banking and Mobile Texting must register their cell phone numbers through their online banking. They can only access their accounts through the one cell phone they register. Again an e mail notification is sent to the member for notification. NORTHPARK allows for single account transfers only. Cross member account transfers are permitted, but controlled by the credit union management. The member who makes the transfer cannot view the receiving accounts information for privacy purposes unless they are primary or joint on that account. This is also requested by the member but activated by management or designated employees. Members can also make account to account transfers through our Bill Pay feature to other financial institutions. The member must first go through a verification process put in place by Bill Pay and be accepted by the account funds being transferred to. No Page 16

17 POLICY: BSA Risk Assessment Policy BOD Approved Draft Online Bill Payment Cash Management Services International account to account transfer can be made. This bill pay feature is for domestic financial institutions only. NORTHPARK members must apply for Online Bill Pay. Online bill pay is limited to accounts in good standing. Member is notified per when bill payment is set up. Fraud Net is a cutting edge fraud detection system that identifies fraudulent bill pay activity in real time. This detection tool helps the credit union meet FFIEC requirements to monitor suspicious activity. NorthPark is converting to a new Bill Pay product that now is integrated with CU*Answers It s Me 247 which mitigates the risk of going out to a 3 rd party vendor. This new system also collects from the members account first before sending out the payment, therefore mitigating risk of negative checking losses. Stored Value Cards Gift Cards Reloadable Cards NORTHPARK does not offer cash management services. NorthPark no longer offers gift or reloadable cards to its membership. Member automatically is given audio/telephone banking services at account opening. A staff member verifies account information and gives telephone banking procedures to the new member. Account information is accessible by member number and PIN number. Telephone banking is limited to single account transfers and inquiries. Cross account transfers are Page 17

18 POLICY: BSA Risk Assessment Policy BOD Approved Draft Telephone Banking Account Inquiry Funds Transfers permitted, but controlled by the Credit Union. The member transferring funds cannot view any information on the deposit account due to privacy unless they are primary or joint on the receiving account. This request to jump between accounts is activated and controlled by the Credit Union. Visa Credit Cards Consumer Business Visa Credit Cards are mailed to the member address on file. The member can request the card be mailed to the credit union for security reasons. Only 1 card per member on the account. When a card is lost or stolen, the system requires the cancellation of the questionable card before a new card can be issued. Fraud Scout card activity monitoring is in place to block unusual card usage. This program is designed to mitigate risk and limit fraud. Soft blocks are placed on cards that fall outside normal activity levels set up by Vantiv (check card vendor) and NORTHPARK. All non U.S. transactions are blocked, unless the block is requested to be removed by the member and approved by staff. All debit cards, credit cards, and ATM cards are blocked until a transaction caught by Fraud Scout can be verified. The card will remain in a blocked status until verified and removed by NorthPark staff with Direct Access (Vantiv). NorthPark now only issues chip cards for debit and credit cards on all new and reissue cards upon natural expiration date. This is in place to mitigate risk and limit fraud. Factoring NORTHPARK does not participate in Factoring financial transactions. Page 18

19 POLICY: BSA Risk Assessment Policy BOD Approved Draft Insurance NORTHPARK offers insurance products to our members through third party vendors who all have privacy and confidentiality disclosures in place that monitor client s personal information and transactions. NORTHPARK offers collateral protection services through a third party vendor, Allied Solutions. They provide Credit Life and Disability, Gap, and MBI products. The company has a confidentiality disclosure that details the company s identification and privacy procedures. Lending NORTHPARK runs SafeScan on all loan applicants through credit reporting. All existing members are checked against an OFAC list as updates are reported by the core system. A report is generated on Monday if there are any possible matches. All new members are checked against OFAC at account opening as well as loan opening. All approved loan applicants must become members of NORTHPARK in order to receive loan proceeds. Normal CIP, OFAC, and BSA/AML procedures are followed at new account opening, as well as the loan officer verifies all personal information listed on CBR with information on file. Most loans are closed in person with loan personnel. In the event that a direct loan is closed outside a branch setting, a notarized signature is required before the loan is funded. Consumer Indirect Lending. The NORTHPARK online membership application is used in all indirect loan transactions. This loan application contains information regarding the Patriot Act. All loans funded indirectly require a membership account. Account opening procedures are performed by Page 19

20 POLICY: BSA Risk Assessment Policy BOD Approved Draft NORTHPARK staff only and all CIP, OFAC and BSA/AML policies are followed. Regarding share and CD secured loans, lending policies and procedures were updated to include verification of deposit procedures. NorthPark no longer offers Commercial Loans or Participation Loans. Commercial Home Equity Loans are handled very similarly to consumer loans in regards to member identification and verification. Residential appraisals are used to determine property values. All appraisers must be on the board approved list with NorthPark. In the event a NORTHPARK approved appraiser discovers health or safety issues they must include their findings in the body of the appraisal. All Suspicious findings should be reported to the local authorities and if known by the BSA Officer a Suspicious Activity Report should be filed. Real Estate Page 20

21 POLICY: BSA Risk Assessment Policy BOD Approved Draft Residential Lending Mortgage Origination NORTHPARK partners with Neighborhood Mortgage Solutions (NMS), a Fannie Mae Direct Lender to process, fund and close all first mortgage originations. OFAC and Safe Scan is ran on every applicant s CBR by NMS. In addition, all individuals who have a home mortgage with NMS that is initially funded by NORTHPARK must be a NORTHPARK member. CIP, OFAC and BSA policies and procedures are used to determine their identity and eligibility. NORTHPARK processes the loan administrative portion of the loan itself and uses NMS (Neighborhood Mortgage Solutions) to process, underwrite and preparing closing documents. Loans are closed at a title company and then sold to NMS. NORTHPARK shares in the servicing of the loan with NMS. NMS requires an Errors and Omission Policy to mitigate risk of fraud and loss. NorthPark has two reputable Lenders Sterns and Quicken loans as wholesalers for Government and Conventional Loans. They assume all risk and do all the underwriting. Separate vendors were selected for competitive pricing and work flow. Private Banking NORTHPARK does not offer Private Banking Services. Page 21

22 POLICY: BSA Risk Assessment Policy BOD Approved Draft Retail Banking Deposit accounts Checking Savings and MM Certificates of Deposit Monetary Instruments Official Checks & Money Orders All deposit accounts are opened after OFAC scans are checked. In addition, CIP, OFAC, and BSA policies and procedures are followed on all new potential members. Savings and Checking accounts are opened after a Safe Scan has been performed on all individuals through a credit report. A Customer Due Diligence (CDD) program has been developed that will identify high risk deposit accounts. All new accounts are run through Safe Scan. Monitoring unusual activity will be a component of this CDD program. A Suspicious Activity Report (SAR) will be filed on any unusual activity. In all deposit transactions, cash amounts are monitored with purchases of $3000 to $10,000 in a cash transaction log. Cash amounts over $10,000 are reported on a Cash Transaction Report (CTR) and filed. CTR s are built into the core processor system to populate with all cash in or out over $10,000. A report is also generated for aggregated transactions that meet the over $10,000 threshold to complete and file a CTR. These reports are tested annually for accuracy. Monetary Instruments are sold to NORTHPARK members only. The BSA Officer receives an Aggregated Cash Purchase Report that identifies all monetary instrument purchases $3000 and over. This report is monitored and researched for unusual transactions. A SAR is filed in the event suspicious activity is noted. The Credit Union does not offer Gift or Reloadable cards. Page 22

23 POLICY: BSA Risk Assessment Policy BOD Approved Draft Trust Services Employee Benefit Plans Personal Trust Investment Management Corporate Trust Custodial Accounts NORTHPARK does not offer Trust Services. Wire Transfer Services All out going and in coming wire transfers ) are checked against an OFAC scan, both by NORTHPARK and Corporate Central Federal Credit Union.This includes scans on the sender, the recipient, and all financial institutions involved in the wiring instructions. Wire transfers are not accepted or sent to countries that are blocked by OFAC. All wires in and out are logged by the MSR that sent or accepted the wire. All Wires must be approved by a second person designated Page 23

24 POLICY: BSA Risk Assessment Policy BOD Approved Draft by Management. All outgoing wires require proper and compliant paperwork provided by the Credit Union to be filled out in full and signed before the wire is performed. The BSA Officer receives a monthly report of all wires in and out. This report is checked at the end of every month for suspicious activity and compliance. These wires are scanned and stored for 5 years. NorthPark has added a third level of authentication when sending wires out for our membership. Our third party vendor Corporate Central Federal Credit has paired with Symantic Verisign ID security system. The employee processing the wire must use all three levels of authentication: username, password and a security code. These new procedures help with protecting our members from identity theft and losses to the credit union. The Credit Union has chosen to stop outbound International wires for our members due to the risk involved. SUMMARY Page 24

25 POLICY: BSA Risk Assessment Policy BOD Approved Draft NorthPark Community Credit Union is a credit union that has a large percentage of stable, known members. NORTHPARK has grown considerably over the adding additional products and services, third party vendor relationships. With this growth comes the potential for greater risk to the credit union. NORTHPARK s policies and procedures have been updated to mitigate this risk, as well as staff training has kept pace with this growth. The Credit Union has an extensive Vendor Due Diligence program and staff in place to monitor 3 rd party vendors that the Credit Union uses to perform daily operations. The Credit Union has daily reports of aggregated cash in and out as well as purchases $3, and over. These daily reports are logged and tracked for suspicious transactions. The reports include all transactions done by all account holders including ATM and Shared Branch deposits and withdrawals. The Credit Union has chosen to limit cash withdrawals for Shared Branches to $1, per day and $ per day for ATM s unless approved by Management. Risk Assessment Conducted By: Updated September, 2016 Heather Jones, HR/Operations Manager,CEO Kristin Good, Accounting Manager Brandi Hoffenbacher, Lending Manager Department Operations CEO Accounting Lending Date Submitted for Board approval 09/26/ /26/16 resubmitted for approval Page 25

26 Risk Rating Guidelines: POLICY: BSA Risk Assessment Policy BOD Approved Draft High (H) This product/service/factor presents risk for laundering money or establishing a conduit for terrorist financing. Mitigating risk factors are not, or cannot, be established to effectively preclude this possibility. Robust AML policies and procedures and internal controls must be in place for all products and services noted to be high risk. Moderate (M) Product/Service/Factor provides opportunities for money laundering or terrorist financing; however, effective mitigating risk factors and internal controls are in place to reduce exposure. Low (L) Product/Service/Factor is not generally found to represent a risk for money laundering or terrorist financing; OR Product/Service/Factor may present a low risk for money laundering or terrorist financing and mitigating risk factors and internal controls are in place to reduce exposure. Remember, ask yourself: 1) CIP/KYC Do we have procedures in place to truly know the customers utilizing this product/service? Are they being followed? Page 26

27 POLICY: BSA Risk Assessment Policy BOD Approved Draft 2) How attractive is this product/service to a money launderer or terrorist (history of use for money laundering, easy access, anonymity, portability, etc.)? 3) What is target market for this product/service? 4) Are monitoring processes in place to identify and investigate unusual activity? 5) Determine OFAC risk in each product line and insure procedures are in place to manage risk. Please document any special policies or procedures you currently have in place, or plan to implement, to manage risk associated with your findings, including training. Examples: We have determined that it is not within our risk tolerance at this time to open deposit accounts via our Internet Web Site. OR Training has been scheduled for second quarter to train account officers on Credit Union policies and procedures to identify and monitor high risk members. Page 27