9/22/2016

1

CUNA Bank Secrecy Act Re-Certification

Fall 2016

Colleen Kelly & Valerie Moss

CUNA Compliance

AGENDA

• Customer Due Diligence Rule

• Money Service Business Accounts

• Marijuana Business Accounts

• Other New Developments

• Frequently Asked Questions (FAQs)

• Review of Basic Requirements

BSA: COMBAT ILLICIT FINANCIAL TRANSACTIONS

9/22/2016

2

BSA Reporting

• Homeland Security: The only way to stop ISIL is to cut off their money supply

• FBI: Approximately 18% of the Bureau’s international terrorism cases had related BSA filings in 2014.

The New CDD Rule

GOOD NEWS:

• Applies to “legal entity” accounts

• Compliance date: May 11, 2018

• Only for new accounts

9/22/2016

3

Beneficial Owner Due Diligence

• Identification & Verification of Beneficial Owners

• Certification Form

• Written Procedures

• Recordkeeping &

Retention

9/22/2016

4

9/22/2016

5

Money Service Businesses

Money Services BusinessesThe following are considered MSBs:

– Currency dealers or exchangers

– Check cashers

– Issuers or sellers of traveler’s checks or money orders

– Providers of prepaid access

– Money transmitters

– US Postal Service (low risk)

9/22/2016

6

Money Services Businesses

Monetary thresholds for:• Currency Dealers or Exchangers

• Check Cashers

• Issuers or Sellers of traveler’s checks or money orders

► Must be transactions in excess of $1000 per person, per day (single or aggregated transactions) to be considered an “MSB”

What do you think?

Your credit union cashes checks and sells money orders.

Are you a money services business?

MSBs: NCUA Expectations• Properly identify member accounts as MSBs;

• Assess the potential risk posed by the member relationship;

• Conduct adequate and ongoing due diligence of the MSB relationship; and

• Ensure the MSB member accounts are appropriately included in the credit union’s suspicious activity monitoring and reporting system.

9/22/2016

7

Money Services Businesses

• Credit unions are expected to apply their risk-based BSA standards to MSBs.

• MSBs should be prepared to produce basic information such as:– Basic identification

– State licensing, if applicable

– FinCEN registration

– Additional helpful information

MSB: Due Diligence

Minimum Expectations:

• Apply CIP (MIP);

• Confirm FinCEN registration;

• Confirm state or local license;

• Confirm agent status; and

• Risk Assessment

MSB: Risk Assessment

To determine level of risk, consider:

• Types of products/services offered by the MSB;

• Location and market served by MSB;

• Anticipated account activity;

• Purpose of the account.

9/22/2016

8

Money Services Businesses

MSBs are subject to BSA regulatory controls:

• Anti-money laundering

• Suspicious Activity Reports

• Currency Transaction Reporting

• Customer Identification Programs

NCUA Expectations

• CU must provide for added costs and staff resources related to MSB accounts;

• Staff must have extensive knowledge and training to service these accounts;

• CU management must consider these issues before adding MSB accounts;

9/22/2016

9

STATES FEDS

High Risk : Marijuana-Related Businesses

Department of Justice:

• IF marijuana use is legal in the state, and

• IF the state has strong and effective state regulatory and enforcement systems;

• THEN prosecuting these businesses is not an efficient use of federal resources

DOJ’S PRIORITIES

9/22/2016

10

FinCEN Guidance

FinCEN: BSA Expectations Regarding Marijuana-Related Businesses, February 2014

Marijuana Limited SAR

Marijuana Priority SAR

Marijuana Termination SAR

Serving Marijuana Businesses: Next Steps

Other New Developments

• Culture of Compliance

• OFAC Updates

• SAR Advisories

• Updated Examination Manual

• GTO Targeting

9/22/2016

11

Culture of Compliance

“Regardless of its size and business model, a financial institution with a poor culture of compliance is likely to have shortcomings in its BSA/AML program.”

-FinCEN Advisory to U.S. Financial Institutions on Promoting a Culture of Compliance (FIN-2014-A007)

Culture of Compliance

1. Your leadership actively supports and understands compliance efforts.

2. Efforts to manage and mitigate BSA/AML deficiencies and risks are not compromised by revenue interests.

3. Relevant information from the various departments within the credit union is shared with compliance staff to further BSA/AML efforts.

Culture of Compliance

4. The credit union devotes adequate resources to its BSA/AML compliance function.

5. The compliance program is effective by, among other things, ensuring that it is tested by an independent and competent party.

6.Your leadership and staff understand the purpose of your BSA/AML efforts and how BSA reports are used.

9/22/2016

12

OFAC Updates

• Amended Cuban Assets Control Regulations

• Sectoral Sanctions Identifications List

• Foreign Sanction Evaders List

• Consolidated Sanctions List

www.treasury.gov/resource-center/sanctions

SAR Advisories• E-Mail Compromise Fraud Schemes (FIN-2016-

A003)

• Human Smuggling & Human Trafficking (FIN-2014-A008)

• Tax Refund Fraud (FIN-2013-A001 & FIN-2012-A005)

• Risks Associated with 3rd Party Payment Processors (FIN-2012-A010)

• Mortgage Loan Fraud (FIN-2012-A009)

• Account Takeover Activity (2011-A016)

9/22/2016

13

1969 Pontiac GTO

Geographic Targeting Order

FinCEN may issue additional recordkeeping and reporting requirements on one or more domestic financial institutions in a geographic area.

9/22/2016

14

FAQs• CTRs & Joint Accounts

• CTR Exemptions

• Businesses with Common Ownership

• CIP & Power of Attorney

• “Initial detection” and SAR filings

• Notifying board of SAR filings

FAQ: CTR & Joint Accounts

Deposits: CTR should list all joint owners on account

Withdrawals: List only the individual who is making the withdrawal UNLESS you have facts to suggest that all or additional joint owners will benefit from the transaction.

FAQ: CTR Exemption

There are two types of exemptions under BSA:

Phase I - credit unions & banks, government agencies, any entity exercising government authority, entities whose common stock is listed on the stock exchange, and any subsidiary of these listed entities.

Phase II – Non-listed businesses,

Payroll members

9/22/2016

15

Summary of Phase I Requirements

Type of Customer Trans Freq

Waiting Period

Ineligible Activity

File DOEP Report

Annual Review

Credit unions & banks

N/A None N/A No No

Govt departmts., agencies, or authorities

N/A None N/A No No

Entities listed on stock exchange

N/A None N/A Yes Yes

Subsidiaries of those listed on stock exchange

N/A None N/A Yes Yes

Source: FIN-2012-G003

Summary of Phase II Requirements

Type of Customer

Trans. Freq.

Waiting Period

Ineligible Activity

File DOEP Report

Annual Review

Non-listed businesses

5 or more transaction /year

2 months, or less after risk based analysis

No more than 50% of gross revenues from ineligible activity

Yes Yes

Payroll Customer

5 or more transaction /year

2 months, or less after risk based analysis

N/A Yes Yes

Source: FIN-2012-G003

CTR EXEMPTIONSPhase II:

Non-listed businesses that:

• Have maintained a transaction account for at least 2 months or granted an exemption after a risk assessment

• Frequently (5/year) engage in currency transactions over $10,000,

• Are organized under a U.S. federal or state law AND

• No more than 50% gross revenue from “ineligible business”

Payroll customers that:

• Have maintained a transaction account for at least 2 months or granted an exemption after a risk assessment

• Regularly withdraw more than $10,000 to pay employees, AND

• Are organized under a U.S. federal or state law

This exemption only applies to payroll withdrawals

9/22/2016

16

FAQs: Businesses with Common Ownership

Rebuttable Presumption: Separately incorporated entities are independent persons.

The currency transactions of separately incorporated businesses should not automatically be aggregated as being on behalf of any one person simply because those businesses are owned by the same person.

FAQ: Power of Attorney & CIP

• Account is opened for a person who lacks legal capacity - the individual with Power-of-Attorney is the “member” for MIP purposes.

• Account is opened for a competent person - the named owner of the account is the “member” for MIP purposes.

FAQ: “Initial Detection”

CUs must file a SAR no later than 30 calendar days from the date of the “initial detection of facts that may constitute a basis for filing a SAR.”

• The phrase “initial detection” does not mean the moment a transaction is highlighted for review.

• The 30-day period does not begin until an appropriate review is conducted and a determination is made that the transaction warrants a SAR filing.

9/22/2016

17

FAQ: Notifying Board of SAR Filings

• Management must “promptly” (e.g., at least monthly) notify the CU’s board (or designated committee) of any SAR filings.

• No required format for sharing SAR information with the board (e.g., summary, spreadsheet, etc.).

• No prohibition on providing actual copies of SARs, however, be mindful of confidentiality requirements.

BSA/AML REQUIREMENTS REVIEW

• Suspicious Activity Reports (SAR)

• Record Keeping

• Information Sharing

• OFAC

• Member Identification Program (MIP)

• Member Due Diligence

• Currency Transaction Reports (CTR)

• BSA Officer

• BSA Training

• Risk Assessment

9/22/2016

18

When to file a SAR?

• Insider abuse involving any amount.

• $5,000+ where a suspect can be identified.

• $25,000+, regardless of a potential suspect.

• $5,000+ that you suspect:

o May involve potential money laundering or other illegal activity (e.g., terrorism financing).

o Are designed to evade the BSA or its implementing regulations (e.g., structuring to evade currency transaction reporting).

o Has no business or apparent lawful purpose.

SAR Timing

• File SAR no later than 30 calendar days from the date of the “initial detection” of facts that may constitute a basis for filing a SAR.”

• No identified suspect? Time period extended to 60 days.

• Continuing suspicious activity? 90-day review, filing deadline of 120 days after the date of the previously related SAR filing.

SARs & Continuing Activity

Day 0: Identification of suspicious activity and subject

Day 30: Deadline for initial SAR filing

Day 120: End of 90 day review

Day 150: Deadline for continuing activity SAR with subject information (120 days from the date of the initial filing on Day 30)

If the activity continues, this timeframe will result in 3 SARs filed over a 12-month period (FinCEN SAR FAQs, Q&A #16).

•

9/22/2016

19

Law Enforcement Requests

• SAR supporting documentation is considered a part of the SAR and must be made available to the CU’s regulator and/or appropriate law enforcement without a subpoena or court order.

• The Right to Financial Privacy Act does not apply to these requests.

Recordkeeping

In general, BSA requires CUs to retain records for 5 years:

• Records related to transactions: 5 years

• SAR/CTR: 5 years from filing date.

• Records related to the identity of a member: keep for 5 years after the account is closed.

• Records related to credit card accounts: 5 years after the account is closed or becomes dormant.

Recordkeeping: Monetary Instruments

• Records of monetary instrument sales in amounts between $3,000-$10,000 must be retained for 5 years, and can be maintained in either a manual or electronic format.

• The physical log requirement was eliminated in the mid-1990s.

9/22/2016

20

Recordkeeping: Funds Transfers

CUs must retain records in connection with funds transfers (e.g., wires) of $3,000 or more for 5 years. The rule does not cover:

• EFTs as defined by the EFTA & Reg E

• ACH transactions

• Transfers where the originator and beneficiary are:

o A domestic bank or credit union

o A federal/state/local government agency or instrumentality

o The same person, and the originator’s & beneficiary’s institution are the same institution.

314(a) Information Sharing

Conduct a one-time search of the CU’s records to identify accounts or transactions of a named suspect. Unless otherwise instructed, search records for:

• Current accounts;

• Accounts maintained during the preceding 12 months; and

• Transactions conducted outside of an account by or on behalf of a named suspect during the preceding 6 months.

314(a) Information Sharing

• Credit union must have a contact person to receive requests from FinCEN

• Requests for information sent every 2 weeks

• Credit union has 14 days to search records

• Report only positive matches to FinCEN

• Must maintain evidence of compliance

• Keep documentation confidential & secure

• Cannot disclose FinCEN request

9/22/2016

21

314(b) Information Sharing

• Complete a notice to share information with FinCEN, which is effective for one year.

• Designate a point of contact for receiving and providing information.

• Establish a process for sending and receiving information sharing requests

• Take reasonable steps to verify that the other institution has also submitted the required notice to FinCEN before sharing any information.

• Have procedures in place to ensure the security and confidentiality of information received from other 314(b) institutions.

OFAC Reporting

• Blocked and rejected transactions must be reported to OFAC within 10 business days from the date that property is blocked or transaction is rejected.

• Potential match: 1-800-540-OFAC (6322)

• Can also report electronically at https://abarrslite.ofac.treas.gov/login.aspx

What to do w/ blocked funds?

• Funds must be held in a “blocked account” where only OFAC-authorized debits are allowed.

• Funds must earn interest at a commercially reasonable rate.

• All holders of blocked property must file a comprehensive annual report on blocked property held as of June 30 by September 30 each year.

•

9/22/2016

22

MIP Requirements

• Must obtain at least 4 pieces of information

• Must verify ENOUGH information to know true identity of member

• MIP procedures must be comprehensive and include difficult situations

Member Due Diligence

• Member’s normal and expected transaction activity

• Changes in the member’s risk profile

• Periodically monitor information to keep it up to date

• Collect from all members – not just high risk

Currency Transaction Reports

Credit unions are required to report:

• Deposits, withdrawals, transfers and other transactions

• Involving currency (cash or coin)

• Exceeding $10,000

Includes single or multiple transactions made on the same day (aggregate weekends, ATM and night deposit transactions)

9/22/2016

23

Currency Transaction Reports

• CTR triggers:– Deposits & Withdrawals

– Denomination exchanges

– Loan payments

– ATM transactions

– Purchase of share certificates

– Fund transfer paid for in currency

– Purchase of monetary instruments

CTR Reminder

• If the CTR deadline is missed, begin the process of completing the forms and contact the BSA Hotline for assistance;

• BSA Helpline: 1-800-949-2732 or FRC@fincen.gov

BSA Compliance Officer

• Must be fully knowledgeable of the BSA and all related regulations.

• Must be fully knowledgeable of the credit union’s products, services, members, geographic location and money laundering risks.

• Should be in a position to regularly apprise the senior management staff and board of directors regarding BSA compliance.

9/22/2016

24

Bank Secrecy Act Training

• All personnel whose duties require knowledge of BSA

• Tailored to specific responsibilities

• New employee orientation

• Periodic training for BSA officers

Bank Secrecy Act Training

• Board of Directors should receive enough training to gain a general understanding to provide adequate oversight

• NCUA recommends BSA training every 12 to 18 months

• Keep records of training programs

BSA Risk AssessmentAssess: products & services,

members,

geographic location

Develop appropriate policies for your risk level,

Risk assessment must be comprehensive and ongoing.

9/22/2016

25

Questions?

• Please send any follow-up questions to cucomply@cuna.coop

• Include “BSA Recertification” in the subject line of your message.

• Good luck on your exam!