When Was Your Last Checkup?

(Do Community Banks Pay the Price for Big Bank Crimes?)

I hate going to the dentist. So, of course, I avoid the annual checkup and the small aches and pains when I eat cold or sweet foods for as long as I can, only to risk ending up rushing to the dentist for an emergency root canal.

Just like avoiding the dentist, we can’t stop having regular checkups of our BSA program to avoid serious problems. It might seem like a waste of time and resources, especially if you feel you have low risk, but the consequences of not being prepared are huge.

Enhanced Scrutiny

I have blogged recently about the enhanced scrutiny that financial institutions are facing recently. Banks, credit unions, and money service businesses are being reviewed more closely than ever in the area of BSA and anti-money laundering. Dollar fines are at a historical high and are being handed out liberally. And because of ineffective programs at Wachovia, Citibank, Zions, Commerzbank, and HSBC, (to name a few); the examiners are playing a role of taking no prisoners as they do their rounds of BSA exams.

A bank should have an effective process in place for looking for criminal activity; after all, that was the purpose of the BSA. However, many small and mid-sized institutions say they are being taken by surprise. I heard a similar theme: “But my last exam was perfect, no problems at all, and now I’m being told that I am failing at one or more of the four mandatory pillars of an effective BSA program. How could this have happened?”

How Did It Happen?

In the case of the giants in the news, it was often a story of years and years of negligence. Many of these institutions were told to improve, and they either chose to ignore the mandate or often did not identify or put any kind of review in place for areas of extremely high risk, such as foreign correspondent activity, bulk cash shipments, and remote deposit capture for foreign Casa de Cambio accounts.

So now the justice department is out for blood, and examiners, after being severely critiqued for not being harder, will have their magnifying glasses out at your next exam. We might not get the benefit of constructive criticism first and then punishment for non-compliance later.

Alert to SAR Ratios

Institutions are reporting to me that they are being told that the volumes of SARs they file have to be a certain ratio to the number of alerts they review or that their volumes are out of proportion to what the same size bank across town is filing. Institutions are desperately looking for suspicious activity that doesn’t exist in many low-risk institutions just so they can make their quotas and, in response, are filing SARs on activity that a larger institution would never bother looking at or even on activity they really do not believe is suspicious just to make their numbers.

Ultimate Goal

The ultimate goal of an effective suspicious activity monitoring program is to catch suspicious activity if it is occurring. But what if there is very little happening at the institution? The majority of small institutions have no bulk cash shipments, foreign remote deposit capture, foreign correspondent accounts, ACH origination, third-party payment processors, prepaid cards, brokers, or politically exposed persons.

Each financial institution should have an effective RISK-BASED BSA/ AML program that includes the four pillars (policies & procedures, internal controls, qualified BSA officer, and independent testing), a regularly updated and thorough risk assessment, and a strong, balanced suspicious activity program. They should regularly evaluate their program and processes and effectively train their employees on BSA and processes. If automated systems are involved, they should test their data regularly to make sure the data they need to look for suspicious activity is coming into the system.

However, all these processes can and should be right-sized according to the risk at the institution. The important thing, regardless of the size of your institution, is to have regular checkups to identify emerging threats and risks and to act on the advice and recommendations made during your checkup.