for Boards 2015 Spring Leadership Development Conference

Transcription

1 for Boards 2015 Spring Leadership Development Conference With Barb Boyd, CUCE Compliance Content Manager MCUL CU Solutions Group 1

2 AGENDA Purpose Compliance Culture Compliance Program Reporting Information Sharing OFAC Penalties for Non Compliance

3 Purpose of Bank Secrecy Act 3

4 BSA/AML Purpose Purpose: To help identify the source, volume and movement of currency and other monetary instruments transported or transmitted into or out of the U.S. or deposited into financial institutions To aid in the investigation of money laundering, tax evasion, international terrorism and other criminal activity 4

5 BSA/AML Purpose BSA. Purpose 5

6 BSA/AML Purpose Blocked Funds in 2013 in BILLIONS! 6

7 BSA/AML Purpose Why BSA Board Training? FFIEC BSA/AML Manual: While the board of directors may not require the same degree of training as banking operations personnel, they need to understand the importance of BSA/AML regulatory requirements, the ramifications of noncompliance, and the risks posed to the credit union. Board training must provide for a general understanding of the BSA. 7

8 8

9 Compliance Culture FinCEN s latest guidance: On August 11, 2014 the Financial Crimes Enforcement Network issued Advisory FIN A007. The guidance was provided due to shortcomings in compliance due to a lack of involvement from institutions senior management. It pointed to the poor culture of compliance which existed in part due to a lack of leadership to improve and strengthen organizational compliance with Bank Secrecy Act (BSA) obligations. 9

10 Compliance Culture Board of Directors, executive and senior management should actively support, understand and be engaged in compliance efforts. FinCEN notes that if a compliance program is going to be effective it has to have demonstrated support from leadership and states, in addition to supporting a culture of compliance, an appropriate understanding of BSA/AML obligations and compliance will help an organization s leadership make informed decisions with regard to the allocation of resources. FinCEN defines the leadership of a credit union as: Board of Directors, executive and senior management, and management. 10

11 Compliance Culture Managing and mitigating BSA deficiencies and risks should not be compromised by revenue interests. The new FinCEN guidance directs that compliance staff should be empowered to implement the credit union s BSA compliance program and have the authority and autonomy to work independently and take appropriate actions to address and mitigate the credit union s BSA/AML risks. 11

12 Compliance Culture Relevant information should be shared throughout the credit union. Operating departments and employees should work together throughout the credit union to share information with compliance staff to help combat and prevent fraud that can negatively impact the credit union. 12

13 Compliance Culture Adequate human and technological resources should be devoted to compliance functions. In FinCEN s guidance they note that the failure of an institution s leaders to devote sufficient staff to the BSA/AML compliance function may lead to other failures. Credit union leaders are urged to ensure that there is enough devoted staff to effectively manage the credit union compliance program. 13

14 Compliance Culture Credit union leadership and staff should understand the purpose of BSA efforts and reporting. In addition to having staffing resources sufficient to manage the credit union s compliance program, FinCEN also requires that credit union leadership and staff be trained to understand the importance of compliance with BSA and its importance to safeguarding our nation. 14

15 Compliance Program 15

16 Compliance Program Every credit union must have a written compliance program that is tailored to its level of risk. 16

17 Compliance Program Directors are responsible for ensuring that their credit unions have a written BSA compliance program that is tailored to its level of risk. Written policies, procedures and processes Must be written, approved by the board of directors and noted in the board minutes. 17

18 Compliance Program Made up of the following: Risk Assessment Internal Controls Independent Testing Designation of BSA/AML Compliance Officer Training Customer (Member) Identification Program (CIP) 18

19 Compliance Program Risk Assessment The risk assessment will determine the policies, procedures and processes for BSA/AML compliance. 19

20 Compliance Program Internal Controls Written policies, procedures and practices must be designed to limit and control risks, and to achieve compliance with the BSA. 20

21 Compliance Program Independent Testing Independent internal auditor or external auditor should evaluate the credit union s BSA/AML compliance program and compliance with the Bank Secrecy Act and OFAC requirements at least every 12 to 18 months. 21

22 Compliance Program BSA/AML Compliance Officer Must be appointed (NCUA Part 748.2) Responsible for management of the credit union s BSA compliance program. Board must ensure the BSA/AML compliance officer has the sufficient authority and resources to administer the compliance program. Line of communication should allow the BSA/AML compliance officer to regularly apprise the board and senior management of ongoing BSA/AML compliance. 22

23 Compliance Program Training All appropriate personnel must be trained in the applicable aspects of the BSA. This includes more than front line staff. 23

24 Compliance Program Member Identification Program Must be written, approved by the board and incorporated in the compliance program Must include: Account opening procedures that specify the identifying information obtained from each member; Reasonable and practical risk-based procedures for verifying the identity of each member; and Comparison of identity with government lists. 24

25 Reporting 25

26 BSA Reporting Currency Transaction Reports (CTRs) Must be filed for each deposit, withdrawal, payment, transfer or other transaction involving currency (cash) of more than $10,000. Must aggregate multiple transactions by or on behalf of one person in one business day; consolidate the transactions and report them as one if the total exceeds $10,000. Must be filed within 15 days after the date of the transaction. May be fined up to $10,000 per day for each CTR not filed. 26

27 BSA Reporting Suspicious Activity Reports (SARs) Credit unions are required to file a SAR with respect to the following: Criminal violations involving insider abuse in any amount; Criminal violations aggregating $5,000 or more when a suspect can be identified; and Criminal violations aggregating $25,000 or more regardless of a potential suspect. SARs must be filed no later than 30 calendar days from the date of the initial detection of the suspicious activity. 27

28 BSA Reporting Suspicious Activity Reports (SARs) Credit union directors, officers, employees and agents that report a suspicious transaction to the appropriate authorities are granted a safe harbor from any civil liability under any law or regulation, regardless of whether such reports are filed pursuant to the SAR instructions. This safe harbor applies to SARs filed within the required reporting thresholds as well as those filed voluntarily on any activity below the threshold. 28

29 BSA Reporting All Bank Secrecy Act reporting must be completed electronically. 29

30 Information Sharing 30

31 Information Sharing Sections 314(a) and (b) of the USA PATRIOT Act Two types of information sharing: Between the law enforcement and financial institutions [314(a)]; and Between financial institutions [314(b)] 31

32 Information Sharing Information Sharing - 314(a) Requests Between the Credit Union and Law Enforcement FinCEN may require a credit union to search its records to determine whether it maintains or has maintained accounts for, or engaged in transactions with, a specified person, entity or organization during the past 12 months (or 6 months if there is a transaction where no account is involved). Must report to FinCEN within 14 days, unless the request specifies otherwise. Sent out once every 2 weeks via secure website. Must be kept confidential. 32

33 Information Sharing Information Sharing - 314(b) Requests Between financial institutions. Must notify FinCEN of its intent to engage in information sharing, and that it has established and will maintain adequate procedures to protect the information. A notice to share information is effective for one year. Should ensure other CU filed its required FinCEN notice. Cannot share SARs or SAR filing information. If request relates to a transaction subject to a SAR, disclose only the transaction and member information requested. 33

34 Information Sharing Information Sharing National Security Letters (NSLs) Written investigative demands issued by the local Federal Bureau of Investigation (FBI) and other federal government authorities to obtain financial records from financial institutions. Highly confidential examiners will not review Policies and procedures should be in place to process and maintain confidentiality of NSLs. SARs should not include their existence. Questions regarding NSLs should be directed to the local FBI office. 34

35 OFAC 35

36 OFAC OFAC regulations require the following: Blocking accounts and other property of specified countries, entities and individuals. Prohibiting or rejecting unlicensed trade and financial transactions with specified countries, entities and individuals. Reporting blocked and prohibited transactions to OFAC. 36

37 OFAC OFAC Reporting: Blocked transactions within 10 days of the occurrence, and annually by September 30 (for those blocked as of June 30) Prohibited transactions within 10 days of the occurrence Must keep full and accurate record of each blocked and rejected transaction for 5 years after the date of the transaction For blocked property, records must be retained for 5 years after the property is unblocked 37

38 Penalties 38

39 Penalties 39

40 Penalties Credit unions Cease and Desist Order Loss of charter (criminal and civil) Criminal money penalties up to the greater of $1 million or twice the value of the transaction Civil money penalties 40

41 Penalties Individuals Removal and bar from banking (criminal and civil) Criminal fine of up to $250,000, five years in prison, or both for willful violations of the BSA and for structuring transactions to evade BSA reporting requirements Criminal fine of up to $500,000, ten years in prison, or both for violating BSA and any other U.S. law or engaging in a pattern of criminal activity Civil money penalties 41

42 Resources 42

43 Resources MCUL: (InfoSight) NCUA: CUNA: NASCUS: FinCEN: IRS Detroit Computing Center: (800) FinCEN s Financial Institutions Terrorist Hotline to report terrorist activity against the U.S.: FinCEN s BSA/AML Examination Manual: FBI: OFAC: Interagency Statement 43

44 Contact Information Sarah Stevenson Regulatory & Legislative Affairs Specialist (800) , ext. 494 MaryJo White Regulatory & Legislative Affairs Specialist (800) , ext. 459 Barb Boyd Compliance Content Manager (800) , ext