This section would include any projected strategic and regulatory BSA/AML risks identified that may have an impact on the corporation such as:
1. Products and services currently under consideration by the New Product Committee 2. Future mergers or acquisitions
3. Upcoming changes in regulations, e.g., FinCEN’s Advanced Notice of Proposed Rule Making on Beneficial Owners
The risk assessment should include any BSA/AML projected risks and management’s plan on how to mitigate the risks identified.
Page 24 of 35 Auditing to determine the adequacy of a BSA/AML risk assessment requires significant time and commitment. The larger and more complex the organization, the more detailed both the audit and risk assessment process will be. Don’t forget to “Think Enterprise Wide”. When auditing the risk assessment, the risks of each Business Unit are a major consideration. How the risks are interrelated among BUs across the entire enterprise must be considered and subjected to detailed analysis. The risk assessment process should be comprehensive, transparent and well documented. When completing the risk assessment process effectively, the end result will create the reliable conclusions necessary to establish appropriate policies, procedures, processes and systems required to develop the organization’s Enterprise Wide BSA/AML Compliance Program, which is ultimately designed to measure and minimize risks associated with BSA/AML laws and regulations.
RISK VS.
REWARD
CONCLUSION:
THINK
ENTERPRISE
WIDE
Page 25 of 35
Appendix A
SAMPLE SPREADSHEET
Business Units BSA/AML Risk Identification and Evaluation
Of Products and Services, Inherent Risks, Mitigating Controls and Residual Risks
Business Unit Name
Products/Services Inherent Risks Mitigation/Controls Residual Risk
Risk
Rating
Risk Rating
*List each product/service offered through BU
*List applicable BU responsibilities & duties specific to each, including how they comply with duties such as the examples listed below:
*List inherent risk of each product/service.
*List red flags indentified.
*Indicate inherent risk rating of each product/service/red flag identified.
High, Mod or Low
* List each mitigating control for each product or red flag identified for each product/ service.
*List systems used for mitigation/controls.
*Indicate residual risk rating of each product/service/red flag identified.
High, Moderate or Low risk rating after analysis of mitigating controls
# of Associates/Training Suspicious Activity Monitoring
Client Services Offered
314a Requirements
CTR Requirements
MIL Requirements
Funds Transfer Requirements
Internal Risk Assessment
CIP Requirements
Include a chart to summarize all products and services listed to include, number of clients, number of transactions, dollar amounts, and all information that applies to each specific BU. The goal of each spreadsheet is to define each BU, products/services they offer, the BSA/AML responsibilities specific to each BU and how each BU complies with their BSA/AML responsibilities, including monitoring for suspicious activity. Each BU spreadsheet should also list every product or service offered by the BU, including any associated red flags; identify the inherent risks associated with each risk identified, the associated mitigating controls and the resulting residual risk. The BU, products/services and applicable risk ratings are recorded on Appendix B.
Page 26 of 35
Appendix B
SAMPLE SPREADSHEET
RISK EVALUATION OF BUSINESS UNITS/PRODUCTS AND SERVICES
Date:
List each BU & related product/service
Bank Name FINAL BSA/AML WEIGHTED RISK SCORE 100% 2.0200
MODERATE
RISK NUMERIC EQUIVALENT 0 to 1.9999 = LOW RISK
2 to 2.9999 = MODERATE RISK 3 + = HIGH RISK
This chart represents a sample of a partial list of Business Units and their related products/services within the organization. All BUs should be included on the chart, along with applicable ratings and the Final Risk Weight of each BU as determined after completing appropriate analysis. The Final Risk Weighted Score can then be calculated to determine the Bank’s Final BSA/AML Weighted Risk Score, which will be recorded on Appendix D.
Page 27 of 35
Appendix C
SAMPLE SPREADSHEET
CORPORATION RISK EVALUATION OF COMPANY/PRODUCTS AND SERVICES
Date:
NAME OF SUBSIDIARY OWNED BY BANK BSA/AML RISK ASSESSMENT Summary of Quantitative Risk by Company
Page 28 of 35
Appendix D
SAMPLE SPREADSHEET
Summary of Corporation’s Enterprise Wide BSA/AML Quantitative Risk
CORPORATION NAME ENTERPRISE WIDE BSA/AML RISK ASSESSMENT
Sample Summary of Quantitative Risk by Company
Date:
Company
BSA/AML Rating
Risk Numeric Equivalent
Risk Weight
Risk Weighted
Score
BANK NAME owned by the Corporation MODERATE 2.000 90% 1.800
•Subsidiary owned by the Bank MODERATE
•Subsidiary owned by the Bank MODERATE
•Subsidiary owned by the Bank MODERATE
•Company owned by the Subsidiary LOW
Subsidiary owned by the Corporation LOW 1.000 2% 0.020 Subsidiary owned by the Corporation MODERATE 2.000 8% 0.160 •Company owned by the subsidiary MODERATE •Company owned by the subsidiary MODERATE
CORPORATION NAME ENTERPRISE WIDE BSA/AML FINAL WEIGHTED RISK SCORE
100% 1.980 MODERATE
RISK NUMERIC EQUIVALENT 0 to 1.4999= LOW RISK
1.5000 to 2.9999 = MODERATE RISK 3 + = HIGH RISK
This chart represents a summary of the Final BSA/AML Weighted Risk Scores of the Bank and all Subsidiaries and Companies owned by the Corporation. Information recorded on this chart is transferred from Appendix B & Appendix C. The Risk Weight and Risk Weighted Score of each entity is calculated to determine the Corporation’s Enterprise Wide BSA/AML Final Weighted Risk Score.
Page 29 of 35
Appendix E
BSA RISK ANALYSISCUSTOMERS/ACCOUNTS, PRODUCTS/SERVICES AND GEOGRAPHIES
(4)This chart primarily represents general federally defined BSA related risk categories which present “heightened risk” from the BSA/AML perspective. BSA risks applicable to each bank can vary depending on the specific risk characteristics associated within each category of risk. By identifying bank unique risk characteristics within each category, the bank can reasonably ascertain its overall general risk within each category in order to develop a risk based and focused BSA/AML program to address and mitigate those risks.
Sources: Federally defined categories of high-risk products found in the SAR Activity Reviews, the FFIEC BSA/AML Examination Manual, and the Treasury Department’s National Money Laundering Strategy documents, etc.
Categories: Customers/Accounts Products/Services Geographies
RISK: Whether individuals and business customers create AML risk based on financial situation, occupation, reasons for accounts, currency activity in accounts, etc.
Whether products and services are the type most likely used by money launderers to hide and disguise illegitimate monies.
Whether branch, service locations, means of service delivery and demographics create AML risk due to higher criminal money laundering activity in the area.
Characteristics LOW 314a “hits” – no positive hits
Exempt customers – none to less than 5
Existing, stable, known, long time customers with little change
Family/living trust deposit accounts
High risk customers/businesses – none to few
Non-governmental organizations and foreign charities - none to few
OFAC “hits” – no positive hits
Personal investment companies (PICS) accounts in Charleston, SC (or other designated cities/states) – none to few
Professional Service Providers – intermediaries between its client and the bank – lawyers, accountants, investment brokers and other such third parties – none to few
Retail banking customers (checking and savings accounts) – mostly
SARs filed on customers
Subpoenas or summonses – few received from law enforcement, IRS, etc.
US Resident Customers/Accounts only (no international)
Account opening – in-person only
ACH services – none offered or offered domestic only
Brokered deposit accounts – not offered
Commercial loans – domestic only
Consumer loans – domestic only
Electronic banking (online account opening, internal banking transactions and telephone banking) – not offered
Foreign correspondent accounts – none/not offered
International accounts – not offered
Internet banking – not offered
Large currency transactions – few to limited activity
Monetary Instruments - - travelers checks, official bank checks and money orders – sold to existing customers only
Mortgage loans
Night deposit
Private banking services offered (high net worth individuals) – not offered
Safe deposit boxes
Savings and CD’s
Telephone transfer availability
Trust services – none/not offered
Website informational, not transactional
Wire transfers – limited and domestic only
Acquisitions, branching or mergers – none recently
Branches – few in number – 1 or less
Deposits taking only facilities - none
Domestic operations only (no foreign)
HIDTAs or HIFCA’s or other high risk geographies – no offices (none identified in SC)
Market Area – narrow and defined – mostly small towns and rural
No formal communications from OFAC indicating compliance
Commercial customers with minimal cash activity or foreign wires or customers
Customer base increasing due to branching
Domestic LLC’s, LLP’s
Domestic none profit accounts
Exempt customers – moderate number
Growing customer base due to expanding business
High risk customers/business – (check cashers, conv. stores, non-res.
aliens, foreign customer) moderate number
International accounts – few accounts or such accounts with unexplained cash activity
Mail drop address on account
Medicare supplies sales due to
ACH services – high domestic activity and some international
Brokered deposit accounts – few domestic only
Checking and NOW accounts – domestic
Commercial loans – international
Consumer loans – international
Credit cards/cash advances
Drafting of funds from other banks
Electronic Banking – Bank does or is beginning to offer e-banking services
Electronic payment services offered
Foreign correspondent – few accounts, but no payable thru accounts
Home equity loans
Internet banking (transactional) offered to domestic and existing customers only
Large currency transactions – moderate to large volume or
Acquisitions, branching or mergers – Some recent local and domestic activity
Branches – moderate number
Communications from OFAC include warning letters only, no OFAC violations noted
Domestic operations only with some in high risk geographies (no foreign)
Market Area – broader (multiple counties, within the same state – all cities, suburbs)
Personnel – Lower turnover of key but frontline staff in branches may have changed
The bank is located in or conducting major business transactions in either an HIDTA or HIFCA area
Page 30 of 35
Medicare fraud
Mostly US Resident Customers/Accounts and a few international
Movie Theaters
New customers – moderate number
Non resident aliens – none to few
OFAC “hits” – few positive hits
Personal investment companies (PICS) accounts – moderate number
SAR’s – moderate number filed
US resident customers assigning POA
structured transactions
Loans secured by savings/CD’s
Loans to closely held corporations
MMDA’s offered
Monetary Instruments - - travelers checks, official bank checks and money orders – sold to non customers but limited activity
Non deposit investment products (such as insurance)
Private banking services offered – moderate number mostly domestic and few/no foreign customers
Telephone delivery system for new accounts
Trust services – moderate number offered
Wire transfers – moderate number w/
few international
HIGH 314a “hits” – history of a large number of positive
Accountants/Tax Preparers
Adult book stores/massage parlors
Antique dealers
Art dealers – high end
Attorneys
Auctioneers
Auto dealers – new and used
Auto salvage or collision repair shops
Auto wash
Bail bond companies
Bank insiders
Barbers, hair dressers & nail salons
Bartenders and dancers
Boat captains
Bowling alleys/leagues
Brothel houses
Cash intensive businesses (convenience, liquor stores, restaurants, truck stops)
Casinos
Cattle buyers
Charitable and non-governmental organizations
Cigarette outlets
Cleaning services
Commercial customers with high cash activity
Commercial customers with international business including foreign wires
Coin or gold bullion dealers
Construction companies/contractors
Convenience stores
Customers sending or receiving funds from any NCCT nation
Customers with foreign business
Customers with privately owned ATM’s
Day care centers
Drug stores
Embassy and Foreign Consulates
Ethnic groceries
Exempt customers – high number
Flea markets
Foreign corporation accounts with transactions
Foreign LLC’s, LLP’s
Fruit stands - generic and ethnic
Furniture rental stores
Gas stations
Gun dealers
High risk customers – (check cashers, conv. stores, non-res. aliens, foreign
Accounts opened through the internet, mail, wire or by phone (non branch; non face to face)
ACH services – high domestic and/or international activity
Brokerage Department/Operations
Brokered deposit accounts – large number Domestic and/or international
Business cash management accounts
Customer directed (non discretionary) accounts such as custodial, investment advisory and revocable trusts
Electronic banking products and services – wide array offered including account transfers, e-bill payment or accounts opened via internet
Electronic cash
Embassy Banking
Foreign branches
Foreign Correspondent bank relationships
International Transportation of Currency and Monetary Instruments
Internet banking (transactional) offered to and accessible by new and international customers
Investment Advisory/Management
Large Currency transactions – high volume; may include some structured transactions
Lending activities (CD or stock secured, etc.)
Loan guarantee schemes
Monetary Instruments Sales – travelers checks, official bank checks and money orders – especially large numbers or amounts or consecutively numbered or sold to non customers
New products and services (assess risk early to build in controls to mitigate risks)
Offshore activity
Parallel Banking – domestic and foreign bank controlled by one person/entity
Payable thru accounts – Large number of foreign correspondent accounts including payable thru
Payroll cards offered
Pouch services w/ foreign banks, persons or businesses
Private Banking activities (domestic and foreign) – significant activity
PUPID – pay upon proper ID wire transfers
Acquisitions, branching or mergers recent local/domestic and international activity
Branches – high number
Deposit taking facilities
HIDTA’s – Bank has branches located in a High Intensity Drug Trafficking Areas
HIFCA’s – Bank has branches located in High Risk Financial Crime Areas
Highly diverse metro areas or universities located nearby
Large and growing deposit base in a wide and diverse geographic area
OFAC has sent bank reprimand or penalty notification letter
Personnel – High amount of turnover especially in key personnel positions
BANK OPERATING OR CUSTOMERS DOING BUSINESS IN:
Bank secrecy havens
Countries identified in FINCEN advisories
Countries in which production or transportation of illegal drugs may be occurring
Emerging countries that may be seeking hard currency investments
FATF – Countries identified as non cooperative
High risk locations for sending and receiving wires
INSCR – designated money laundering countries and jurisdictions
Market Area – interstate, large diverse metro areas and/or international
NCCTS – Non cooperative countries territories (Myanmar and Nigeria)
OFAC sanctioned countries, including state sponsors of terrorism
OFCs Offshore Financial Centers
Other countries identified by the bank or FINCEN as high risk because of prior experiences, transaction history or other factors
Page 31 of 35
customer) significant number
Home Health services
Import/export companies
Internal accounts with unexplained cash activity – high number
International customers/accounts/
activity – substantial
Internet companies
Jewelry, Gem and precious metal dealer (retail and wholesale)
Laundromats/dry cleaners
Lawn mowing/landscaping
Large customer base over a diverse geographic area
Leather goods stores
Liquor stores
Money Service Businesses
Motels especially no name
New customers – large number
Newsstands
Night clubs
Non resident alien assigning POA
Non-bank financial institution (MSB’s) relationships to include domestic and foreign currency exchanges, money transmitters, check cashing, smart cards and e-cash
Non-resident aliens
OFAC “hits” – large number of positive hits
Out of market customers – significant numbers
Painters
Pay day lenders
Phone card sales/companies
Plumbers
Physicians
Pawnbrokers, loan or finance companies
Personal investment companies (PICS) accounts
Pizza Parlors
Politically exposed persons (PEP’s)
Preachers
Real estate agents – cash sales of RE
Restaurants – ethnic
Retail stores
SAR’s filed – large number filed
Seafood distributors/shrimp boats
Securities Brokers
Self storage facilities
Senior Foreign Political Figures
Stock brokerage (broker dealer)
Subpoenas or summonses – high number received from law enforcement, IRS, etc.
Subprime lenders
Tanning booths
Tattoo/body piercing parlors
Taxi cabs/cab companies
Telemarketers
Title companies
Travel agencies
Trucking companies – especially on US border
Trucks – ice cream/hot dog, etc.
Insurance companies serving uninsurable
Used car dealers
Vending machine companies
Video gaming/poker businesses
Remote deposit capture
Special use or concentration accounts (intra-day, suspense, etc.)
Stored value/smart cards offered
Telephone banking with significant international accounts
Third party payment processors
Trade financing with unusual pricing features
Trust Accounts – significant number including charitable trusts and foundations (domestic and foreign)
Trust accounts with foreign grantors or beneficiaries
US Dollar Drafts
Wire transfers – frequent wires from personal or business accounts to/from money laundering havens
Wire transfers – high number of non-customer wires
Wire Transfers – large number of international wires
Section 311 Countries
State Dept. identified countries supporting international terrorism aka “Patterns of Global Terrorism”
Page 32 of 35
APPENDIX I: RISK ASSESSMENT LINK TO THE BSA/AML COMPLIANCE PROGRAM
FFIEC Bank Secrecy Act/Anti-Money Laundering Examination Manual
Page 33 of 35
APPENDIX J: QUANTITY OF RISK MATRIX
Banks and examiners may use the following matrix to formulate summary conclusions. Prior to using this matrix, they should complete the identification and quantification steps detailed in the BSA/AML Risk Assessment Overview section at pages 22 to 30 of the FFIEC Bank Secrecy Act/Anti-Money Laundering Examination Manual.
Low Moderate High
Stable, known customer base.
Customer base increasing due to branching, merger, or acquisition.
A large and growing customer base in a wide and diverse geographic area.
No electronic banking (e-banking) or the Web site is informational or
nontransactional.
The bank is beginning e-banking and offers limited products and services.
The bank offers a wide array of e-banking products and services (i.e., account transfers, e-bill payment, or accounts opened via the Internet).
On the basis of information received from the BSA-reporting database, there are few or no large currency or structured transactions.
On the basis of information received from the
BSA-reporting database, there is a moderate volume of large currency or structured transactions.
On the basis of information received from the BSA-reporting database, there is a significant volume of large currency or structured transactions.
Identified a few higher-risk
customers and businesses. Identified a moderate number of higher-risk customers and businesses.
Identified a large number of higher-risk customers and businesses.
No foreign correspondent financial institution accounts. The bank does not engage in pouch
activities, offer special-use accounts, or offer payable through accounts (PTA), or provide U.S. dollar draft services.
The bank has a few foreign correspondent financial institution accounts, but typically with financial institutions with adequate AML policies and procedures from lower-risk countries, and minimal pouch activities, special-use accounts, PTAs, or U.S. dollar draft services.
The bank maintains a large number of foreign correspondent financial institution accounts with financial institutions with
inadequate AML policies and procedures, particularly those located in higher-risk
jurisdictions, or offers substantial pouch activities, special-use accounts, PTAs, or U.S. dollar draft services.
The bank offers limited or no private banking services or trust and asset management products or services.
The bank offers limited domestic private banking services or trust and asset management products or services over which the bank has investment discretion.
Strategic plan may be to increase trust business.
The bank offers significant
domestic and international private banking or trust and asset
management products or
services. Private banking or trust and asset management services are growing. Products offered include investment management services, and trust accounts are predominantly nondiscretionary versus where the bank has full investment discretion.
Few international accounts Moderate level of Large number of international
Page 34 of 35
or very low volume of currency activity in the accounts.
A limited number of funds transfers for customers, noncustomers, limited third-party transactions, and no foreign funds transfers.
A moderate number of funds transfers. A few international funds transfers from personal or business accounts with typically lower-risk countries.
A large number of noncustomer funds transfer transactions and payable upon proper identification (PUPID) transactions. Frequent funds from personal or business accounts to or from higher-risk jurisdictions, and financial secrecy havens or jurisdictions.
The bank is not located in a
The bank is not located in a