New Coordinates. Boards of Directors Face Growing AML Accountability By Saverio Mirarchi

Transcription

1 From New Coordinates Boards of Directors Face Growing AML Accountability By Saverio Mirarchi Bank Boards of Directors are coming under mounting pressure to ensure effective Anti-Money Laundering (AML) compliance programs, amid heightened regulatory scrutiny and increasing prosecutorial activity. Enforcement authorities are particularly focused on how well the Board performs its role in instilling a meaningful culture of AML compliance and in ensuring adequate resources to prevent the use of banking systems by criminal and terrorist actors. Saverio Mirarchi Senior Director Treliant Risk Advisors In exploring the AML challenges that Boards face today, this article: presents a sample of recent enforcement actions and their implications; illustrates regulatory and prosecutorial pressures; and discusses Boards involvement in AML, including accountability, interaction with regulators, and management of enforcement actions. Common Themes Emerge from Recent Enforcement Actions Converging pressures on Board members are evident in a sample of recent enforcement actions: BSA / AML Enforcement Snapshot ( ) A sample of enforcement actions from the past three years Bank Year Agency Amount AML compliance continues to be a focus of bank regulators, as it has been for years, and involvement in these enforcement actions by criminal prosecuting authorities has been growing. Large Global Bank 2012 FinCEN, OCC, OFAC, FRB, DOJ $1.9 B Regional Bank 2012 FDIC, FinCEN, DOJ $15 M Large Multinational Bank 2013 OCC, FinCEN, SEC $52.5 M Regional Bank 2013 OCC $10 M Regional Bank 2014 OCC $500 K Large National Bank 2014 OCC $500 K Large Global Bank 2014 OFAC, FRB, DFS, DOJ, $8.9 B The New York County District Attorney s Office Large Global Bank 2014 FinCEN, OCC, FRB $2.05 B Mid-Market Global Bank 2015 FRB, DFS, OFAC, DOJ $1.45 B Mid-Market Investment Bank 2015 FinCEN, SEC $20 M Community Bank 2015 FinCEN, OCC $1.5 M

2 Common themes that can be drawn from these actions include: No bank is immune from regulators increasing scrutiny and findings of noncompliance. Large global banks as well as community banks are being fined and entering into consent orders, settlements, or other resolutions (even excluding what might be considered outliers in which actual intent to violate U.S. law was found, especially by stripping information from wire transfers originating abroad to hide involvement by sanctioned parties.) Another common theme is the failure to implement an effective Bank Secrecy Act/Anti-Money Laundering/Office of Foreign Assets Control (BSA/AML/OFAC) compliance program, based on the absence of one or more required elements. No longer are these violations the domain of the banking regulators alone. There are criminal law enforcement authorities actively investigating and bringing charges for these regulatory violations. Prosecutors Put their Weight behind AML Compliance AML compliance continues to be a focus of bank regulators, as it has been for years, and involvement in these enforcement actions by criminal prosecuting authorities has been growing. The scrutiny is on the four original, main pillars of a BSA program, as required by regulations: a responsible person to oversee the program; policies and procedures and a system of controls; training; and independent review of the program. Added to those original four pillars, by measures including the USA PATRIOT Act, are suspicious activity reporting and the need to monitor customer activity in order to identify suspicious transactions. It is important for bank management and directors who are trying to meet regulatory expectations to understand not only the regulations but how regulators are interpreting them. Recent enforcement actions specify two overarching causes for inadequacy in AML programs: Corporate governance processes are too weak to support a meaningful culture of compliance. Management is unwilling to commit sufficient resources to maintain an adequate BSA compliance program. The underlying deficiencies break down into four categories: 1. tone at the top/culture of compliance; 2. adequacy of resources to sustain a robust AML program; 3. updating of information technology and transaction monitoring systems; and 4. quality of the testing/audit/risk management functions. Terms of Enforcement For this article, the terms BSA, AML, and OFAC compliance programs are used interchangeably, since they are all essentially conflated, stemming in large part from the Federal Financial Institutions Examination Council s Bank Secrecy Act Examination Manual, which brings BSA, AML, and sanctions together. FinCEN is the Treasury Department s Financial Crimes Enforcement Network, the financial intelligence unit (FIU) of the U.S. government that is charged with responsibility for BSA enforcement. FinCEN relies upon the bank regulators to review and identify any issues in or violations of the regulatory requirements. The FIUs from many countries share information concerning financial crime. OFAC is an office of the U.S. Treasury responsible for administration and enforcement of the U.S. sanctions programs. DFS is the New York Department of Financial Services, the state s financial services regulator.

3 Boards Face Legal Complexity The landscape is becoming more and more crowded when it comes to AML compliance violations. Rightly or wrongly, some banks feel they are being ganged up on by multiple regulators and law enforcement authorities, each seeking to require specific remedial actions and impose its own penalties. What had been seen as a purely regulatory matter has increasingly become the basis for criminal action, as provided for under sections of the U.S. Code that impose criminal liability for violation of the AML regulations. Within the code are requirements for financial institutions to have AML programs in place, with the four BSA pillars specified as requirements. There are also specific requirements concerning know your customer programs, including customer due diligence requirements, such as a customer identification program, and enhanced due diligence requirements for customers that are foreign financial institutions and foreign private banking clients. There are also requirements to identify the owners of non-publicly traded entities and to file currency transaction reports and suspicious activity reports. Moreover, there is a section in the code relating to those AML program requirements titled Criminal Penalties. It provides for large fines and imprisonment for anyone who willfully violates the AML regulations. The laws under which the sanctions programs exist also provide for criminal penalties for violation of U.S. sanctions. It is not only the express regulatory requirements that can lead to an enforcement action, but also regulatory expectations. The National Credit Union Administration liquidated a federal credit union in the first quarter of 2015 for various violations, including violation of the Bank Secrecy Act by not implementing an effective AML program. The long list of inadequacies cited by FinCEN in assessing a civil money penalty against the same credit union just months earlier included the lack of an automated system to identify suspicious activity. (The credit union instead relied on its employees to manually investigate accounts.) This credit union was a one-office enterprise with five employees. It took on high risk by banking money services businesses from Mexico and the Middle East, well outside its field of membership, without adequately assessing and managing those risks. This case is but one example of how financial institutions will be held accountable regardless of their size and regardless of whether the control deemed necessary in this case an automated system to monitor for suspicious activity is expressly set forth as a requirement in a regulation. (In this case, it is not.) Directors Viewed as Ultimately Accountable Banking regulators and law enforcement authorities view the Board of Directors as ultimately responsible for an institution s conduct. That view applies to the bank s AML program as well, and it has been emphasized that the AML tone is set at the top. To demonstrate to authorities that the tone is set and correctly directors should consider these steps: get actively engaged with the bank s AML program and activities; understand the program; ensure that it has the necessary resources; receive training on the subject; and direct and oversee management s response to matters requiring immediate attention (MRIAs) and matters requiring attention (MRAs), as identified by bank examiners.

4 Some of this engagement will be evident in the minutes of Board meetings. Included on Board agendas should be an AML risk assessment, the results of which should be reviewed and discussed. The Board should approve the AML program. Directors need to be apprised of significant issues that are identified either internally or by examiners or auditors and kept informed regularly of the progress in addressing them. The Board should question to understand fully and, if necessary, challenge the information presented by management be active rather than passive. Directors should also encourage management to maintain an ongoing dialogue with regulators and develop a good, working relationship with them. It is essential to stay current in this area. With violations and enforcement actions a regular occurrence, it is important for the Board to be briefed on them and given an assessment by management of how the institution implicated compares to its own. Does your institution have the same or similar risk? If not, why not? If so, what is being done to manage the risk? FinCEN issued an advisory in November 2014 highlighting the importance of a strong culture of BSA/AML compliance for a financial institution s leadership, including its Board. It noted the leadership s responsibility for performance in all areas, including compliance with the BSA. The advisory covered the areas already mentioned and more. Regulators emphasis on tone from the top and culture of compliance coincides with a zeroing-in on Boardrooms, especially those of the largest banks, as part of the government s more generally intensified scrutiny of the banking system. The Federal Reserve and other bank regulators are holding frequent meetings with individual directors. Boards are being singled out in regulatory critiques of bank operations and oversight. Boards at small banks are also receiving new attention from their regulators. In these and other examples, the recurring question is whether directors are adequately challenging management and monitoring risks. It is important to note that government officials have grown tired of crocodile tears from companies after a compliance failure. Simply put, regretting bad behavior after the fact is seen as too little, too late in the current environment where AML and sanctions compliance is considered a national security imperative. Government response to this behavior/perception of behavior is trending toward individual liability. So far blame has landed largely in the lap of compliance officers, but the government has made clear that management and members of the Board are also on their radar screen. Organizationally, institutions should be addressing their compliance risks comprehensively, through a filter of financial crime, rather than in separate silos for AML, sanctions, privacy, cybersecurity, and fraud because this is how the government is addressing them. You will want to work in parallel with the government. Board Should Have Hand in Managing Enforcement Actions If your institution is the subject of an investigation or an enforcement action, the Board has a crucial role to play. It helps to have an action or response plan in place even if only to delineate the respective roles and responsibilities. What is the role of the general counsel, of compliance, of internal audit? Who is the quarterback? Who will conduct the internal investigation? Who will perform the remediation? The details, of course, depend on the particular issue or matter, but it is essential to know who on the management team is responsible for what and to bring in outside expertise to help address the matter. Management should make the Board aware at the first moment of a significant occurrence or issue and then keep the Board apprised on a regular basis. And the Board needs to stay involved until the matter is fully resolved.

5 To the extent possible, Board members should use their expertise and relationships with regulators to convey that the Board takes the matter seriously and is committed to ensuring it is remediated. Board members who are former regulators could be especially effective in this regard. Conclusion: From Forewarned to Forearmed No bank, regardless of size or market, is immune from continuing regulatory scrutiny and increasing prosecutorial activity with regard to its AML compliance program. There is more expected today of the Board of Directors in setting the proper tone and ensuring that the institution has an effective program in place. AML is considered a matter of national security, aimed at detecting and deterring money launderers and the financing of terrorism. As such, AML compliance is being taken very seriously by all banking regulators and by law enforcement. Actions are being brought against individuals for failure to meet the requirements of an effective compliance program and, while it is compliance officers who have been targeted thus far, authorities have made it clear that they are going to hold management and the Board of Directors accountable as well. The leaders of financial institutions have been forewarned. They need to become forearmed. Saverio Mirarchi Saverio Mirarchi, Senior Director, advises financial services clients on regulatory requirements and trends in Financial Crimes, i.e., Anti-Money Laundering (AML), Office of Foreign Assets Control (OFAC), U.S. Foreign Corrupt Practices Act (FCPA), Anti-Bribery/Anti-Corruption Compliance, as well as enterprise risk management, and regulatory compliance. During the past 20 years of his distinguished 35 year career, Saverio has worked with a number of financial services organizations in developing compliance strategies and programs. Washington, DC Headquarters rd Street NW Suite 500 Washington, DC T New York, NY 1133 Avenue of the Americas Suite 3100 New York, NY T Dallas, TX 2150 Lakeside Boulevard Suite 250 Richardson, TX T