copyright notice – use of webex login/password for...

www2.acams.org/webinars

COPYRIGHT NOTICE USE OF WEBEX LOGIN/PASSWORD FOR ACAMSCOPYRIGHT NOTICE – USE OF WEBEX LOGIN/PASSWORD FOR ACAMS WEB SEMINARS

Each site license entitles registrant to one login: one phone connection (if accessing audio via teleconference) and one Internet connection for simultaneous Webcast, in one room where an unlimited number of

listeners may participate.

Providing your login instructions and password to another for their use, using your login ID/password more than once, or any simultaneous or delayed transmission, broadcast, re‐transmission or re‐broadcast of this

event to additional sites/rooms by any means (including but not limited toevent to additional sites/rooms by any means (including but not limited to the use of telephone conferencing services or a conference bridge,

whether external or owned by the registrant) or recording is a violation of U.S. copyright law and is strictly prohibited.py g y p


Welcome to the ACAMS Web SeminarWelcome to the ACAMS Web Seminar

Implementing an Automated BSA/AMLImplementing an Automated BSA/AML Monitoring System —A Banker's Perspective

August 22, 201212:00 PM– 2:00 PM EDT

A sound check will be performed 5 minutes before the start time.

2

Technical Assistance


Send a message via the Q & A boxOr Call WebEx Technical Support:

(US & Canada) 866‐229‐3239 (International) 916‐229‐3239

Attendee instructions on how to use Audio BroadcastAttendee instructions on how to use Audio Broadcast Do not close the Audio Broadcast panel

If you are not able to listen to the audio on your computer speakers, press the stop button, wait 5 seconds then press play. , p p yMake sure to adjust the volume button on your computer speakers and also adjust the volume on your sound card. To do this, go to the Start Menu, click Control Panel, then click Sound & Audio Devices and adjust accordingly.If you do not have speakers, please refer to your login instructions for the Teleconference D ti d I t ti l N b d A C dDomestic and International Numbers and Access Code.You may request the Teleconference Number by clicking “Request” under the attendee box on your left hand side.

3


• Can you hear the soundthe sound check?

• It has begun• It has begun

4


Q&AQ&ATo send a question:qLocate the Q & A box on the bottom right hand corner of the WebEx platformright hand corner of the WebEx platform.

Type in your question and click send!

5


Welcome to the ACAMS Web SeminarWelcome to the ACAMS Web Seminar

Implementing an AutomatedImplementing an Automated BSA/AML Monitoring System — A g y

Banker's Perspective

6


Moderator:

Will Voorhees, CAMS Director, Financial Intelligence Unit,SVB Financial Group, Global Banking Operations

Speakers:Chuck Taylor, CAMS Senior Vice President and BSA Officer, Compliance Department, BSA GroupCity National Bank

Tara Dabek, CAMSCompliance AnalystBMO HarrisBMO Harris

Implementing an Automated BSA/AML Monitoring System —A Banker's Perspective


ObjectivesObjectives• Follow up to “Choosing an Automated BSA/AML Monitoring System

• Conquering difficult challenges• Lessons learned• Pitfalls• Pitfalls• Changing processes vs. changing rules• Best Practices• Regulatory hot topics• Checklist for review

8Implementing an Automated BSA/AML Monitoring System —A Banker's Perspective


Models & RulesModels & Rules• What out of the box rules/models toWhat out of the box rules/models to implement?

• Coverage of current system & what’s lackingCoverage of current system & what s lacking• Risk Assessment• Regulatory recommendation• Regulatory recommendation• Custom rules?Ti f / h• Timeframe/phases



Data Acquisitionq• Who needs to be involved?

V d O it ?• Vendor On‐site?• What data do you need?• How do we get what we need?

– Daily full extracts from the core system• What other systems?

– Incremental delivery of files (for real time fraud monitoring)• Debit and POS transactions

– Real time interdiction data mapping• OFAC

/• ACH/IATs• Wires



Data Acquisitionq• Data Types

– Fixed width, delimited (CSV), or XML• Data Uniqueness

Account numbers may not be unique across host– Account numbers may not be unique across host systems

– May require prefix identifiers• LN1234567 = Loan• SV1234567 = Savings• TR1234567 = Trust



What to include?

• Data you need will depend on rules & models chosen y pplus what you may like to mine.

• Teller activity (Checks, cash, monetary instruments, credit card advance & payment, loan payment)credit card advance & payment, loan payment)

• Electronic (Wire, ACH, online, mobile, RDC, ATM/Debit, credit & prepaid card)L W l h b k /d l d• Loan, Wealth management, broker/dealer, trade finance & FX

• Changes in Client data (can you provide delta?)g ( y p )



Mappingpp g

• Vendor will provide mapping document but may notVendor will provide mapping document but may not provide much explanation – ASK questions

• Maybe most important implementation factor• Improper mapping = invalid system• Improper mapping = invalid system• What is the best source for?

– Client information?T i I f i ?– Transaction Information?

• Teller data• All items• Statements• Statements



Configuration vs. Customizationg

• Configurable g– Client and/or vendor is able to change functionality of system

without coding– Little or no costLittle or no cost– May be feasible to do yourself

• Customizable– Vendor must change coding to meet the requested change– Most likely a fee involved– Unlikely that it can be done without vendor assistancey



Configuration vs. Customizationg• Costs

– Configuration costs are a must• Must set up solution to meet your basic needs

– Customization costs are a preference• Is additional customization needed or can you survive with the basics

• Time Implications– Can some rules/thresholds be configured by the vendorCan some rules/thresholds be configured by the vendor– Will customization cause more problems down the road

• Upgrades



Customize to fit current processes vs. Change process to avoid customization

D ’t t h t t & t i t k• Don’t get hung up on status quo & trying to make system fit current processes

• Be flexible and try to use out of the box functionality and configurability with little or no customization

• Use opportunity to review current processes and cut out wasteout waste

• Go paperless• Consolidate many systems

• Move away from manual work and SPREADSHEETSMove away from manual work and SPREADSHEETS



Getting Management on Board with g gChanges and Customization

• During initial request for funds include customization costs & pad it– YOU WILL NEED IT

• When more customization is needed– Get key parties involved earlyDocuments the reasons for customization– Documents the reasons for customization

– Emphasize cost savings (and/or loss if not customized)– Try to go back for more only once



WorkflowWorkflow

• Who needs access toWho needs access to what?

• How will alerts be handled?– Triage?

• Business Unit Hierarchy• Roles & Groups



WorkflowWorkflow• Moving alerts across groups

• Turning alerts into casesWho handlesgroups

– Who handles what alerts?

– Who handles review/assignment

– Is audit trail maintained• AML• SAR• Debit/check fraud

• Turning cases into SARs– Who handles Debit/check fraud

• OFAC/Sanctions

– Is audit trail maintained

review/assignment– Is audit trail maintained



Workflow• Turning SARs into Repeat SARs/High Risk RatingRating– Who handles review/assignmentIs a dit trail maintained– Is audit trail maintained



Workflow ‐ Roles• Setting up Roles

– AdministratorWh ? IT B i ?

– Teller• Monetary Instrument Logs• OFAC Verifications• Who? IT, Business?

– BSA Officer• Case Management• SARs

OFAC Verifications• CTRs

– Personal Bankers• OFAC Verifications

f / l• High Risk Customers• Due Diligence

– Analysts• SAR Filers

– Wire Transfer/ACH Personnel• OFAC Verifications

– Deposit Operations• Debit Card Fraud Alerts• SAR Filers

• CDD/EDD• Fraud/Loss Prevention• Sanctions

Debit Card Fraud Alerts• Account Fraud Alerts• Check Fraud Alerts

– Audit/ExaminersVi O l• View Only

21


Workflow ‐ Reportingp g• Desired reporting may be tied to workflow• Extra steps in workflow can improve data andExtra steps in workflow can improve data and user issues– Step for return to analyst (issues found in alert disposition)

– Supervisor Review stepSAR fil d– SAR filed

– No SAR filed– Pending information– Pending information



Tuningg• Does vendor have suggested rules/thresholds/standards?rules/thresholds/standards?– Before using, do they make sense?O t of the bo parameters are rarel adeq ate– Out of the box parameters are rarely adequate

– Regulators will criticize unless properly supported



Tuningg• Parameters and filters should be reasonable and tailored to the activity that the bank isand tailored to the activity that the bank is trying to identify or control

• Parameters and filters should be reviewed toParameters and filters should be reviewed to identify any gaps that may not have been addressed– Front line noticed customer structuring, kiting, etc. but an Alert was not produced



Tuningg• How many alerts are generated

/• How many alerts lead to investigations/cases• How many investigations/cases lead to SARs

– How can we make more alerts more meaningful• Reduce false positives

– What do the false positives have in common



Tuningg• Increase thresholds for badly performing scenariosscenarios– Reduce false positives

• Lower thresholds for well performingLower thresholds for well performing scenarios– Increase positive alertsp

• Add new scenarios• Remove scenariosRemove scenarios



Tuningg• Can we exclude specific customers from specific scenariosspecific scenarios

• Can we add new alerts to existing cases in progress



The RAD Exam• Regulators have been treating AML Systems as models and subjecting them to Risk Analysismodels and subjecting them to Risk Analysis Division (RAD) Scrutiny similar to credit risk modelsmodels

• Singe factor authenticationPHD l l t ti ti i• PHD level statisticians

• In depth review of data quality and output



System Documentationy• Filtering criteria• Thresholds usedThresholds used• Any rules not being utilized

– WhyWhy• How the above is appropriate for the bank’s risk (tied back to risk assessment)risk (tied back to risk assessment)

• Important to document this to use as a defense during an examinationdefense during an examination



Independent Validationp• Are the models detecting potentially suspicious activity?suspicious activity?

• Are the parties testing the system experienced enough to validate?enough to validate?– Know the particular system?K b t d l & d t lid ti ?– Know about models & data validation?

– Have the ability to test independent factors?



Data QualityQ y“The average organization loses about $8.2 million annually through poor data quality”million annually through poor data quality.‐‐Gartner survey, August 2009



Data Integrity Testingg y g• How often?• What to check?• Review should focus on

specific parameters or filters to ensure thatfilters to ensure that intended information is accurately captured and that the parameter orthat the parameter or filter is appropriate for the bank’s particular risk profileprofile



Data Integrity Testingg y g• Branches

– Number of in Total• Customers

– Number of in Total– Branch Number– Address

– Number of Persons– Number of Businesses

– Contact

• Accounts• Customer Name Search• Customer Number

– Number of in Total Search



Data Integrity TestingData Integrity Testing• Customer Information

– First NameMiddl N

– EmploymentNumber of Accounts– Middle Name

– Last Name– Business Name

Occupation/Industry

– Number of Accounts– Account Status– Account Open Date– Number of Cards– Occupation/Industry

– Address– Phone– Customer Since

Number of Cards– Card Status– Online Limits– Associations/Joint Customer Since

– SSN/EIN– Date of Birth– Identity

/Information

– Transaction Date Range– All Transactions Listedy



Data Integrity Testingg y g• Transactions for CustomerCustomer– Date Range– All Transactions Listed



Data Integrity Testingg y g• Transaction Search

– ACH• Rule Testing

– Cancel each other outACH– ATM– In Branch

Cancel each other out

– POS– Wire



Periodic Reviews• How OftenWh t I l• Who to Involve

• What to Cover



Vendor Managementg• Industry Expertise

– Assess experience and ability to provide the necessary services and support for current and anticipated needs

• Upgrade frequency• Growth

– Evaluate ability to respond to service disruptions• Customer supportCustomer support

– Ability to learn about vendor’s reputation and performance

• User groups• User groups



Vendor Managementg• Operations and Controls

– Adequacy of standards, policies and proceduresAdequacy of standards, policies and procedures relating to internal controls, facilities management, security, privacy protections, maintenance of records, business resumption contingency planning systemsbusiness resumption, contingency planning, systems development and maintenance, and employee background checks

• SAS 70– Changes in key company personnel allocated to the BankBank



Vendor Managementg• Financial Condition

Review of financial statement information– Review of financial statement information– Review of internal and external audit reportsFl t ti i d ’ k t h– Fluctuation in vendor’s market share



Vendor ManagementVendor Management• Quality of Service and Support

– Reports documenting provider’s performanceReports documenting provider s performance– Adequate follow‐up to problems– Appropriate change controlsSignificant system changes– Significant system changes

– Ability of Vendor to support and enhance Bank’s strategic direction

A ti i t d b i d l t l• Anticipated business development goals• Service delivery requirements• Technology initiatives

Responsiveness to complaints– Responsiveness to complaints



Vendor Managementg• Contract Compliance and Revision Needs

Invoices reviewed for proper charges– Invoices reviewed for proper charges• Blended rates/specific rates• Goals/milestones that may trigger payments to theGoals/milestones that may trigger payments to the vendor

– Periodic review of performance relative to service plevel agreements

– Reference checks

42


Vendor Managementg• Business Resumption Contingency Plans

Review of Vendor’s Business Resumption– Review of Vendor s Business Resumption Contingency Plan to ensure that any mission critical services can be restored within ancritical services can be restored within an acceptable timeframe

– Testing of Contingency Plang g y



Lessons Learned• Test before you go live

– Work prior system and new system concurrentlyWork prior system and new system concurrently• Start with a small set of scenarios

– Too many will generate too many alerts– Too many will generate too many alerts• Keep summary documentation for auditors/examinersauditors/examiners– Background of system– User guide/training materialsUser guide/training materials



Lessons Learned• Keep spreadsheet of questions/outstanding items between you and Vendor– Most likely won’t be able to respond at time of question

• Quality of vendor team is very importantQuality of vendor team is very important– Experience– Willingness to help– Availability & responsiveness

• Push back if you need to



Pitfalls• Data mapping between the core banking and transaction monitoring systems undertaken bytransaction monitoring systems undertaken by IT staff alone– BSA personnel should be involvedBSA personnel should be involved– As well as wire room, ACH, Mobile Banking, etc.

• Having unrealistic goal dates• Having unrealistic goal dates– If it can’t be completed in time, accept it



Need a consultant?• Define what expertise you have in house and what’s missing:– Mapping– Data acquisition– Data validation & testingData validation & testing– Tuning

• If team is lacking it may be very beneficial to add lconsulting

• You don’t know what you don’t know



• Don’t be afraid to ask questions• Don’t be afraid to ask for help• Accept the fact that you will

constantly be tuning/tweakingconstantly be tuning/tweaking– Additional documentation

• Don’t overwhelm yourself with too ymany alerts

• Suggest improvements to vendorA d i• Attend user group meetings

• Network with other users ahead of you in the processyou in the process



If you have suggestions for future web seminarsoro

additional questions for today’s experts, please send them to:

[email protected]

Thank you for joining us today!

50


W b S i C ifi f A dWeb Seminar Certificate of AttendanceTo request a certificate of attendance, please fill out the

f f d i f i l drequest form, found in your reference materials, and email the form to [email protected] along with your payment information First certificate is included in costpayment information. First certificate is included in cost of seminars. There is a $40 administrative fee for each additional certificate.

You may also call +1 305.373.0020 to process payment over the phone

51

over the phone.


Next Web Seminar:Next Web Seminar:[Focus on Broker‐Dealers] Examining the

i li h ll fUnique Compliance Challenges of FinCEN’s Proposed Customer Due Diligence (CDD)/Beneficial Ownership Rule

September 19 2012 12 PM to 2:00 PM EDT

52

September 19, 2012 – 12 PM to 2:00 PM EDT