Practical Suggestions for an Effective AML/OFAC Compliance Function Institute of International Bankers 2013 Annual Anti-Money Laundering Seminar Paul S. Pilecki May 7, 2013 2013 Kilpatrick Townsend
Recent Developments 2013 Kilpatrick Townsend
Testimony of Comptroller of the Currency Thomas Curry 2013 Kilpatrick Townsend
Recent Agency Testimony Comptroller of the Currency Thomas Curry testified on BSA/AML/OFAC before the Senate Banking Committee on March 7 Key points BSA compliance is inherently difficult, combining the challenges of sifting through large volumes of transactions to identify money laundering and terrorist financing involving individuals who are expert in, and dedicated to, concealing the true nature of the transactions. Sophistication of the criminal enterprises requires that banks and other financial institutions devote increasingly larger amounts of resources to maintain effective compliance programs. Corporate governance weaknesses and the effects of austerity programs instituted during the financial crisis are the biggest reasons for recent BSA/AML compliance breakdowns. 4
Industry Trends and Concerns Corporate Governance Lack of strong corporate governance principles necessary to create a culture of compliance. Imbalance in both: Independence of the compliance function; and Organizational incentives that emphasize revenues and growth over balanced risk management. Compliance Resources Lack of sufficient staffing High turnover rates Cutbacks in the compliance areas Third-Party Relationships Weak oversight of service providers Improper levels of due diligence of third-parties expose banks to greater risks 5
Industry Trends and Concerns Money launderers and terrorist financiers migrating to smaller, less sophisticated, financial institutions International focus or components New technology and products Bulk cash and structured deposits 6
Recent Enforcement Action Requirements Corporate Governance BSA Officer with sufficient knowledge, funding, authority, independence, compensation, and supporting staff to perform assigned responsibilities. Effective governance structure to allow the BSA Officer and the compliance function to administer the program independently by reporting to the Board of Directors directly with clear lines of responsibility beginning with senior management and each line of business. Clearly defined channels for informing the board and senior management of compliance initiatives, compliance risks, new product development, compliance deficiencies, and corrective actions. Well-defined succession plans for ensuring program continuity. 7
Recent Enforcement Action Requirements Policies and procedures to ensure that the bank s risk profile is periodically updated to reflect higher risk banking operations and new products and services. Strong BSA/AML audit function that ensures identified deficiencies are promptly addressed and corrected. Robust enterprise-wide compliance to ensure the global AML program is commensurate with the risks and all relevant affiliates are included. Limitations and restrictions on products and services due to inadequate BSA/AML controls. Removal and prohibitions from the banking industry. 8
Notable OCC Enforcement Cases Wachovia Bank N.A. $50 million civil money penalty $110 million forfeiture by DOJ Bulk cash repatriation money laundering scheme Remote Deposit Capture linked by the OCC to the bulk cash activity HSBC Bank USA, N.A. October 2010 C&D for compliance and BSA violations involving bulk cash activity December 2012 $500 million civil money penalty for failure to address prior violations Deferred Prosecution Agreement with DOJ $1.256 billion forfeiture 9
Notable OCC Enforcement Cases JPMC Bank, N.A. (January 2013 C&D) Internal control deficiencies Lack of independent testing Customer due diligence inadequacies Ineffectual risk assessment Lack of enterprise-wide controls to assess, aggregate, and monitor customer activity through foreign branch locations Lack of effective communication between affiliated branches of suspicious customer activity 10
Testimony of Federal Reserve Board Governor Jerome Powell 2013 Kilpatrick Townsend
Recent Agency Testimony FRB Governor Jerome Powell testified on BSA/AML/ OFAC before the Senate Banking Committee on March 7 Key points Monitoring systems should be accompanied by a strong training program to ensure that personnel, including those in offshore offices, are familiar with U.S. regulatory requirements and bank policies. Misconduct in recent foreign bank cases relates primarily to the manner in which these firms handle cross-border payments. An OFAC compliance program should identify higher risk areas, designate a responsible officer, and implement appropriate controls, testing, and training. 12
Powell Testimony Foreign banks often operate in jurisdictions that do not impose the economic sanctions imposed by the United States. A transaction is subject to U.S. law if it is routed through the United States--typical for dollar payments. Foreign banks have not always had in place the mechanisms [outside the United States] to ensure that transactions routed through the United States comply with U.S. law. Many FRB enforcement actions directed at remedying these situations. 13
ABN AMRO Case As part of remedial actions ordered in 2004, ABN AMRO discovered that certain payment messages sent through the United States deleted the name of a U.S. sanctioned party from the SWIFT message sent to the United States. A complementary payment instruction with the sanctioned party information was routed outside the United States. FRB ordered ABN AMRO to take steps to prevent circumvention of U.S. sanctions filters. 14
FRB View of Import of Cases FRB has also acted against other international banks for similarly evasive misconduct. Cases reflect FRB view that international banks have an obligation to ensure that they do not interfere with the ability of U.S. banks to comply with the sanctions laws. FRB will also act at the holding company level for compliance failures at U.S. subsidiaries. 15
Economic Sanctions Developments 2013 Kilpatrick Townsend
Iranian Economic Sanctions Programs The U.S. Government continues to strengthen its sanctions against Iran. Most recently, OFAC implemented section 503 and 504 of the Iran Threat Reduction and Syrian Human Rights Act of 2012. Narrows the Significant Reduction exception to apply only to transactions that (i) facilitate bilateral trade in goods or services between the country that is granted the exception and Iran; and (ii) require that funds owed under the bilateral trade be credited to an account located in the country granted the exemption and not be repatriated to Iran. Eliminates the distinction between state-owned or controlled foreign financial institutions (other than central banks) and private foreign financial institutions. Clarifies that countries that have reduced their Iranian crude oil purchases to zero may continue to receive the Significant Reduction exception. 17
BSA/AML Risk Assessment (Examination Manual at 22-31) 2013 Kilpatrick Townsend
BSA/AML Risk Assessment Each institution should develop a program to identify and manage risks Target areas that present higher money laundering and terrorist financial risks Development of a successful risk assessment generally involves two steps: Identification of specific risk categories; and Analysis of specific risk categories 19
BSA/AML Risk Categories Products and Services Foreign Correspondent Banking Trade Finance Private Banking Non-deposit Account Services Trust and Asset Management Services Electronic Banking Services International Funds Transfer Services Pouch Activity Sales of Monetary Instruments Bulk Cash Repatriation Remote Deposit Capture 20
BSA/AML Risk Categories Customers and Entities Foreign Financial Institutions (banks, money services businesses, casas de cambio) Non-bank Financial Institutions (casinos, broker/dealers in securities, dealers in precious metals, stones, and jewels) Senior Foreign Political Figures Shell Companies Private Investment Companies and International Business Companies Nonresident Aliens Third-Party Relationships and Payment Processors 21
BSA/AML Risk Categories Geographic Locations Countries or regions subject to economic sanctions programs administered by OFAC Countries identified by the U.S. government as supporting international terrorism Jurisdictions of Primary Money Laundering Concern Offshore Financial Centers Countries and jurisdictions known for money laundering, tax havens, and foreign corruption High Intensity Drug Trafficking Areas High Intensity Financial Crime Areas 22
Analysis of Risk Categories Purpose of the analysis is to give management a better understanding of the risk profile of the institution in order to develop appropriate internal controls and to direct its resources Level and sophistication of analysis should be commensurate with the sophistication of the products and services offered by the financial institution 23
Analysis of Risk Categories Purpose of the accounts Actual or anticipated activity in the accounts Significant cash activity Nature of the customer s business/activity Customer s location Types of products and services used by the customer Repetitive SAR filings 24
BSA/AML Compliance Programs (Examination Manual at 32-43) 2013 Kilpatrick Townsend
Enterprise-wide Compliance Programs As a result of the efforts of the Financial Action Task Force ( FATF ), any bank doing business in the United States has a robust AML compliance regime in its home country The regulatory expectation is that there will be coordinated efforts among geographic components of an organization U.S. sanctions programs have potential effects on non-u.s. operations and their dealings with U.S. counterparties even if a U.S. office is not involved 26
Key Components of an Effective AML Program Culture of compliance within the organization Senior management support of the compliance program Sound risk management Customer due diligence procedures and customer profiling to identify high-risk accounts Strong information technology and monitoring processes Sufficient staffing and expert resources 27
Key Components of an Effective AML Program Periodic testing for suspicious activity Employee training, continuing education, and retention Ongoing review of and dissemination of knowledge of regulatory requirements Effective communication with regulators Effective use of new technologies Proper incentives for both the compliance functions and the business lines Identification and management of high-risk products, services, and areas Periodic re-evaluation of technology and monitoring processes 28
Developing a BSA/AML Compliance Program Compliance program should be structured to address the risk profile developed during the BSA/AML Risk Assessment Compliance program must enable the financial institution to monitor and control its BSA/AML risk on an on-going basis Compliance program must apply across all of the financial institution s business lines and activities Particular emphasis must be afforded to high risk customers, products, services, and geographic locations Periodic review and updating of the BSA/AML Risk Assessment and Compliance Program are essential Commensurate with the enterprise-wide compliance program 29
Required Components of a BSA/AML Compliance Program Four Pillars of a BSA/AML Compliance Program: BSA Compliance Officer Internal Controls Training Program Independent Testing (31 CFR 1020.210; Examination Manual at 33-37) Customer Identification Program ( CIP ) 30
BSA Compliance Officer Sufficient knowledge of the BSA Fully knowledgeable of the products and services offered by the financial institution Understand the customers, geographic locations, and potential money laundering and terrorist financing risks inherent in the operations Responsibilities for other areas/functions should be limited to allow for the proper attention to BSA/AML compliance Report directly to the board of directors or senior management 31
BSA Compliance Officer Sufficient funding Authority over compliance matters Function independently from the business lines Adequate compensation Support staff to carry-out assigned responsibilities and maintain compliance 32
Internal Controls Establish a culture of compliance to ensure staff adherence to BSA/AML internal controls Designed to limit and control risks identified during the BSA/AML risk assessment Sophistication of internal controls must be commensurate on the size, structure, risks, and complexity of the financial institution Provide for periodic updates to the BSA/AML risk assessment Allow the BSA Compliance Officer to administer the program independently by reporting directly to the board of directors or senior management 33
Internal Controls Inform the board of directors or senior management, of compliance initiatives, compliance risks, new product developments, identified compliance deficiencies, and corrective action taken Provide for program continuity despite changes in management or employee composition or structure Provide compliance staff with the appropriate level of authority and independence Implement policies and procedures that clearly outline the responsibilities of senior management and relevant employees and hold them accountable 34
Internal Controls Periodically update the Bank s risk profile to reflect higher risk banking operations and new products and services Implement an enterprise-wide management information system that enables management to manage risk on a timely basis Include a strong audit function to identify and address deficiencies promptly Promptly act to correct any compliance deficiencies 35
Customer Due Diligence Cornerstone to strong BSA/AML compliance Effective CDD policies, procedures, and processes provide the critical framework that enables the bank to comply with regulatory requirements and to report suspicious activity Contain a clear statement of management s overall expectations Establish specific staff responsibilities, including who is responsible for reviewing or approving changes to a customer s risk rating or profile (31 CFR 1020.220; and 1020.600 et seq.) 36
Customer Due Diligence Obtain identification information Determine beneficial ownership, if necessary Determine source of wealth Describe initial funding of the account Develop understanding of use of the account and approximate levels of account activity Verify the identification information OFAC review 31 CFR 1020.220 37
Enhanced Due Diligence Enhanced Due Diligence for high risk customers: Purpose of the account Source of funds and wealth Individuals with ownership or control over the account, such as beneficial owners, signatories, or guarantors Proximity of the customer s residence, place of employment, or place of business to the bank Description of the customer s primary trade area and whether international transactions are expected to be routine Explanations for changes in account activity 31 CFR 1020.220; and 1020.600 et seq. 38
Account Monitoring On-going monitoring of customer activity Recordkeeping and reporting requirements Risk assessment and risk management evaluate customer risk, employee risk, vendor risk, and activity risk Continually review and test the monitoring thresholds Make periodic reports to senior management Create exceptions reports to flag potential problems 39
Training Ensure that appropriate personnel are trained in applicable aspects of the BSA Reinforce the importance that the board and senior management place on the bank s compliance with the BSA and ensure that all employees understand their role in maintaining an effective BSA/AML compliance program Include regulatory requirements and the bank s internal BSA/ AML policies, procedures, and processes Include information related to applicable business lines, such as correspondent banking, trade finance activities, and international and private banking Incorporate current developments and changes to the BSA and any related regulations, internal policies, procedures, processes, and monitoring systems 40
Independent Testing Critical to ensure the testing is independent Testing must occur every 12-18 months depending on the risk profile Evaluate the quality of BSA/AML risk identification and management Provide for transaction testing for compliance with BSA reporting and recordkeeping requirements Focus on high-risk areas in order to identify and evaluate all pertinent issues 41
Independent Testing An evaluation of the overall integrity and effectiveness of the BSA/AML compliance program, including policies, procedures, and processes An evaluation of management s efforts to resolve violations and deficiencies noted in previous audits and regulatory examinations A review of staff training for adequacy, accuracy, and completeness A review of the effectiveness of the suspicious activity monitoring systems (manual, automated, or a combination) used for BSA/AML compliance 42
Oversight Responsibilities 2013 Kilpatrick Townsend
Senior Management Support and Awareness Senior management support and communication of expectations to all employees Establishing an escalation procedure to notify senior management of significant findings and events Involvement in ongoing compliance training programs Involvement in problem resolution Directing independent audit to test compliance programs 44
Employee Training and Education A core requirement under the law A key focus area for examiners Helps create a strong compliance culture Needs to include all levels of the organization Update continually to stay current with new developments Should reflect industry best practices Should involve periodic seminars, conferences Keep detailed records of training efforts 45
Staying Current with Regulatory Requirements Maintain knowledge of current regulatory requirements Examiners will note insufficient knowledge of regulatory requirements Important to be on distribution lists for regulatory releases Become involved in industry groups and task forces Encourage and support professional development of compliance staff Communicate within the organization concerning new developments, especially when new resources will be needed 46
Working Relationship with Regulators Use examination findings as a tool for assessing compliance and an opportunity for making improvements Open communication will better enable you to resolve problem issues when they arise A good relationship will enhance the perception that the organization has a culture of compliance Important source of information on trends and developments in the area Inform regulators of significant developments No surprises 47
Coordination with Head Office Head Office must understand the legal and regulatory requirements applicable to the U.S. offices Head Office personnel responsible for independent testing or oversight must obtain training related to BSA/AML compliance Head Office must be given sufficient access to information in order to monitor the activity of the U.S. operations Establish robust information sharing practices between Head Office and U.S. offices Transaction information Customer information 48
Considerations Related to Enforcement and Supervisory Action 2013 Kilpatrick Townsend
Compliance Program Violations Failure to adopt or implement a written BSA compliance program that adequately covers the four required elements: internal controls, independent testing, designated compliance officer, and training Defects in the BSA compliance program elements that indicates that either the written program or its implementation is not effective 50
An Ineffective Compliance Program Could Be Sanctioned Egregious facts exist Senior management is not involved in compliance or problem resolution Lack of sufficient staff dedicated to compliance Disregard of compliance policies and no disciplinary action against employees involved No corrective action taken Lack of cooperation with regulators and law enforcement 51
Factors in Referrals of Enforcement Matters to FinCEN Number of Violations Nature of Violations Longevity of the Violations Rate of Compliance Basis of Discovery Existence of Compliance Program Corrective Action by Bank 52
Questions Paul S. Pilecki Kilpatrick Townsend & Stockton LLP 607 14 th Street, NW Suite 900 Washington, DC 20005 ppilecki@kilpatricktownsend.com (202) 824-1415 53