Using BSA Hot Topics to Strengthen Your BSA Program in 2020

Other common 2019 findings include:

Suspicious Activity Monitoring & Reporting

• Insufficient identification or alert of unusual activity – technology may be insufficient
• No formal, documented SAR decision-making process (either an experienced approver or committee)
• No documented escalation criteria for closing accounts and/or notifying law enforcement
• For continuing SARs, the review did not encompass the entire relationship
• Not all transaction types were monitored either manually or by AML software
• Reports/alerts not reviewed within a reasonable timeframe (timeframe should be documented in procedures); alerts should have secondary reviews (or a QC sampling of such)
• Documentation not including the date of review and date of determination of filing a SAR or a no-file determination
• Deficient narrative – insufficient detail and does not tell the story of the suspicious activity; watch for banking acronyms that the reader may not understand
• No-file documentation not thorough; should be as robust as a SAR narrative
• Untimely filing of SARs
• Lack of continued SAR filing when suspicious activity is still occurring
• Disclosing SAR information (watch out for M & A requests, cannot disclose during due diligence)

Independent Testing

• BSA Officers were involved in the audit process; must be autonomous and only comment, correct, and track findings
• Level of scope of testing insufficient; must be right-sized based on institution risk and dive down into true transaction testing
• Automated system not properly optimized or incoming source data incomplete
• No succession planning for the BSA Officer

Training

• Better Board of Director training needed – should be in person; the Board has the fiduciary responsibility for the institution and needs to understand BSA to be charged with oversight and the culture of compliance
• Updated annual training needed – not the same computer-based training every year; needs to be refreshed to add new threats and innovative products/services
• Should include policies & procedures for certain lines of business
• Should be documented with types of training and which individuals received training; if it is not documented it didn’t happen

Customer Due Diligence (CDD) and Enhanced Due Diligence (EDD)

• Onboarding deficiencies – all customers must be risk-rated at account opening by truly assessing the risks (this is one of the most common findings)
• Not gathering expected customer activity at account opening and understanding the customer’s expected transactional patterns
• No policy on account opening refusal
• Insufficient and/or infrequent monitoring of higher risk accounts
• Written procedures should be risk-based; what type of EDD should be conducted on various customers such as cash-intensive businesses, PEPs, MRBs, MSBs, etc.
• Procedures should include how often EDD reviews will be performed for moderate risk customers and high-risk customers
• No explicit formalized CDD requirements for beneficial owners
• Unreliable risk rating and inability to detect suspicious activity within higher-risk accounts
• Not able to determine whether the actual activity is reasonable for customer/line of business
• Unusual activity or variance from expected activity is not properly analyzed and is not reasonably explained
• EDD review did not encompass related accounts; it must review the entire customer relationship
• EDD review did not have thorough documentation with supporting evidence

OFAC

• Insufficient OFAC risk assessment; this can be part of your overall BSA risk assessment or separate, but must be thorough enough to identify your institution’s overall OFAC risk
• No formal assessment of interdiction systems for sensitive rates (i.e., fuzzy logic)
• Violations discovered that were not self-disclosed – self-disclosure can lessen OFAC penalties significantly
• OFAC scanning should be conducted on entities where an OFAC subject has a 50% or greater interest in the entity