RMA Journal, The: Controlling money laundering risks at community banks

Financial services consultants from RSM McGladrey, Inc., discussed the Bank Secrecy Act of 1970 and key compliance issues for community banks during an RMA audioconference in January. Matt Schriner, a certified regulatory compliance manager with RSM McGladrey, who is quoted in this article, was one of the authors of "It's a Regulatory Jungle Out There! The USA PATRIOT Act," which appeared in the February 2003 issue of The RMA Journal.

The Bank Secrecy Act (BSA) requires banks to have a robust anti-money-laundering process in place. Passed in 1970, BSA became a focus issue for regulators and the Treasury Department as a result of the events of September 11,2001.

Basically, the law requires financial institutions to maintain records of personal financial transactions that "have a high degree of usefulness in criminal, tax, and regulatory investigations and proceedings." It also authorizes the Treasury Department to require financial institutions to report any "suspicious transaction relevant to a possible violation of law or regulation." Suspicious Activity Reports are filed with the Treasury Department's Financial crimes Enforcement Network.

Financial services consultants from RSM McGladrey, Inc., discussed the BSA and key compliance issues for community banks during an RMA audioconference in January.

"The Act was overlooked by most financial institutions until the mid-1980s," said Matt Schriner, a certified regulatory compliance manager with RSM McGladrey, who explained that Congress wanted the regulators to start enforcing the regulations to help catch drug dealers. "It still was not a big issue for most financial institutions until about five years ago, when we started seeing more enforcement. And, of course, September 11 made it a top regulatory issue for the primary bank regulators."

Post-September 11, the USA PATRIOT Act reemphasized the importance of strong anti-money-laundering (AML) programs with new AML requirements on nonbank financial services companies. Banking regulators have advised banks that the money laundering requirements found in the USA PATRIOT Act are nothing more than what the BSA already required, said Schriner. "Continue to focus on the Bank Secrecy Act,"he said. "Use the USA PATRIOT Act as a guideline."

Why and How Is Money Laundered?

The answer to "why," of course, is that money is laundered to hide illegal activities, such as tax evasion, drug trafficking, terrorism, gambling, and arms trafficking, by layering legitimate proceeds with illegal cash from sham businesses and sham transactions.

There are three ways to launder money, said Schriner.

1. The money is deposited into a legitimate business, essentially getting rid of the cash.

2. The money might also be directly deposited into the individual's consumer or business account.

3. The money might be indirectly deposited through a sham business.

Key Requirements of the BSA

Banks have four key reporting and training requirements to comply with the BSA.

1. Complete Cash Transaction Reports (CTRs). They are the focus of the anti-money-laundering regulations. Banks must accurately and consistently complete CTRs for cash transactions over $10,000.

2. Identify money laundering.

3. Train employees to detect suspicious activity.

4. Report all suspicious activity.

"Ten years ago, all anybody looked at were CTRs," said Schriner. "Is the financial institution reporting all cash transactions over $10,000? Over time, the regulators have assumed you had a good process if there were no rough edges in your reports. But now they question if you have the processes in place to identify money laundering."

Some of the pitfalls that RSM McGladrey sees in banks' processes are:

* An overreliance on technology. "Technology is always a good control. It should provide effective, consistent treatment. However, when technology fails, we end up with replication of error."

* Insufficient employee training. "We can't underestimate the value of employee knowledge."

* Little technical tripwires. "Do we collect the identification accurately? Do we report accurately those little nitpicky things?"

Noncash could be reportable. In a recent case reported by the Treasury Department, a bank in the Northeast was fined $750,000 for not reporting as a cash transaction the outsourcing of vault cash to an armored car service, which picked up and delivered cash to the bank's retail customers. The armored car service provided the bank with an ACH notification of the transactions. Viewing the transaction as an ACH, not cash, the bank did not report any of those transactions.

"The fact is, noncash could be reportable," explained Schriner. "It wasn't cash to the bank, but it was cash to the third party. We're advising our clients to be wary of that issue on CTR completion. The rule is: If you have an agent doing vault cash processing on your behalf, you must report those cash transactions."

In another case, a bank with significant cash volumes was shipping its cash directly to the Federal Reserve Bank of New York for deposit into the bank's Fed account. "The bank did not have a solid process to identify those cash transactions on a daily basis," said Cathy Reines, managing director of RSM McGladrey's Risk Management Financial Service Group, western region. "They relied on the loan officers, where the relationship resided, to identify those cash transactions. They didn't rely on the accounting department, which was reconciling that Fed account every day and saw that cash deposit every day. It would have been better to rely on the accounting department and use the loan officers as a cross-check, since they were the originators of the information. Obviously, the bank missed numerous CTRs, because the process was not foolproof for those types of transactions.

Reines said they've also seen cases where CTRs were not filed when they should have been because of the institution s overreliance on its own processes. "The bank thinks it has a process to capture all of those CTRs, and it thinks all of the appropriate crosschecks are in place," she said. "Then, we do the independent audit and find processes that are not functioning as the bank believed. Numerous CTRs were not filed because the processes had broken down."

Filing SARs. In the aftermath of September 11, community banks should focus their antimoney-laundering efforts on consistently filing Suspicious Activity Reports.

"How many SARs an institution should have in any given year varies, based on such factors as geography and asset size," said Schriner. "We're seeing significant volumes for the top 20 banks, although a lot of those SARs are credit card fraud and identify theft. A percentage of them, however, are related to money laundering. Sometimes community banks are failing to assess suspicious activity in the area of money laundering. More importantly, some community banks are failing to report when they have knowledge of suspicious activity."

The basic SAR threshold requirement is $5,000 when the suspect is identified and $25,000 if there is no suspect at all, explained Schriner. The SAR must be filed within 30 calendar days after the date of initial detection.

"All instances of money laundering need to be reported," said Schriner. He advised banks to focus on individuals who are structuring transactions to avoid reporting. Upon detection of such structuring, a detailed, narrative description of the known or suspected violation must be reported. "The FBI and other law enforcement agencies have told us they want to use the SAR as a tool for law enforcement solutions, not simply as a document with 43 loose ends to point agencies in different directions."

Customer privacy is a concern for banks filing SAR reports, said Schriner, but he noted the law grants banks a safe harbor if, in good faith, the bank files specific details regarding a suspicious transaction. However, when approached by law enforcement agencies, financial institutions should be careful to respond only to the specific information requested.

The Treasury Department sends the bank a notice regarding the status of the bank's SARs, often saying that because of the dollar amount or the circumstances involved, no further investigation will be done. "Banks should not be discouraged by that, because those SARs are cross-referenced. A second or third one about the customer may be reported by another institution and may initiate further investigations," said Dave Spinner, a manager with RSM McGladrey's Chicago practice.

BSA exemption list. Bankers often question which customers should be put on the exemption list as well as the risks involved in doing it or not doing it. It is not mandated by regulation, but you must consider whether the bank is at risk for filing inaccurate or untimely cash transaction reports (CTRs). The risk might be greater for not meeting all the requirements once someone is placed on the exemption list, such as the annual review and biennial refilings. "Consider what your BSA process is," said Spinner. "Consider also your total management program for cash transaction activity and what fits it best."

Listed companies, of course, receive the exemption. Nonlisted companies are at the bank's option, but regulators appreciate the bank's efforts to do the nonlist exemption. However, it's still necessary to focus on the cash flow pattern of the nonlisted exemptions.

"The reason regulators allowed institutions to put customers on the exemption list was to lessen the burden of filing CTRs," said Spinner. "In the late l990s, there were approximately 12 million CTRs filed on an annual basis. By allowing for this exemption, the Treasury Department hoped to eliminate up to 30% of the CTRs." The exemption process does not eliminate all responsibility for the bank in regard to those exempted businesses. The bank must continue to conduct an annual review of the business activity in addition to the required biennial filing. The bank cannot put customers on the exemption list and forget about them. While a centralized list of exempt customers is no longer required by the regulation, the bank may want to consider using such a list to facilitate monitoring activities to be performed by persons within the bank who are responsible for BSA compliance.

The bank should also consider how biennial reporting best fits into its overall monitoring of the cash activities of its customers. Good record-keeping practices must be implemented for all filed CTRs, SARs, and money instrument logs. The bank must be able to produce those documents whenever the regulators conduct an examination.

Further, community banks need to be able to accurately discuss the cash flow patterns of their nonlisted exemptions. For instance, Schriner noted a bank should be able to discuss why the Dairy Queen had large cash deposits in January when it's located in International Falls, Minnesota.

Know Your Customer

Knowing your customers is one of the best ways to prevent money laundering. "You must know exactly what type of business your customers are in and what their cash flow patterns are," said Spinner. "Your personal bankers should build a banking relationship with customers. If there is a change in the cash flow, they should be aware of it.

"Fine-tune your procedures and prepare written procedures in anticipation of the final USA PATRIOT Act regulation, which will require at least the minimum standards of formal identification and documentation of that identification. The days of opening an account with only a smile and the customer's drivers license are long gone. You now have to be able to identify your customers in all areas of bank-teller transactions, opening of all new accounts, and applications for loans and CDs. Be aware of scams involving various types of loans. There are many ways money can be laundered through your commercial department.

"To monitor particular types of transactions, you can use various aggregation reports, large cash transaction reports, kiting reports, and the daily teller work. It's important to use those reports to determine that the appropriate number of CTRs are filed. You also need to set a dollar threshold within your organization so that when your reports are generated, you can monitor cash activity at certain dollar levels. The threshold, whether $7,500 or $9,000, should be determined by the size of your organization and the volume of various types of cash transactions.

"Next, look at each transaction to determine if it's a possible structured transaction or whether the transaction-related business does have the capabilities of generating that type of cash flow. Make sure that your tracking system captures the various transactions--whether it is set at large cash or aggregated transactions. Someone must review those reports and ask the necessary questions to determine if there is any potential for structuring."

Employee Training

Historically, tellers and customer service representatives have been the bank employees most burdened by anti-money-laundering compliance, because they are the individuals who accept the cash and become accustomed to the customer's business activity. These individuals are in the ideal position to detect unusual cash flow activity.

"The frontline people have to be trained to recognize something unusual," said Reines. "During a recent BSA training session, a banker said his institution has a shoe repair business customer who operates out of a little rundown shack in a not-so-great area of the city. That customer deposits $11,000 to $12,000 on a regular basis. Upon further investigation, the bank found that the customer didn't have a local address. It was in the state of Hawaii. The bank closed the account."

Today, all bank personnel, including tellers, must be aware of when a filing may be required. "A key issue is to tailor training needs toward the audience, which includes everybody within the bank," said Reines. "Money laundering is taking place not just through deposits and loans but through trust accounts and broker or nondeposit investment product accounts. The training most importantly needs to focus on risk.

"Regulatory examination issues have shifted away from accurate completion of CTRs and toward testing of suspicious activity. At least once a year, independent testing must be performed to determine if implementation of the regulations has been effectively maintained by your bank. The testing may be conducted by the bank's internal auditor or by somebody within the organization who understands money laundering and the appropriate systems to identify it. However, the individual conducting the test must be independent-not involved in the policies or the procedures as it relates to BSA or money laundering. Documentation is very important from a regulatory standpoint," said Reines.

OFAC

After September 11, the emphasis of the Office of Foreign Asset Control (OFAC) changed dramatically. OFAC's purpose is to ensure that banks do not facilitate a cashed check or an ACH transaction with any individuals listed on the OFAC list. "Banks should do a risk assessment of the transactions that are flowing through their institution and set dollar thresholds based on the risk associated with those transactions," said Reines. She said that banks also should:

* Compare every wire transaction to the OFAC list.

* Scan checks for individuals you have concerns about.

* Set a threshold based on the size of your institution and your risk tolerance for other checks.

* Identify high-risk transactions and set lower thresholds for them (and vice versa on your lower-risk transactions).

* Consider the consequences of noncompliance because, unlike regulations in which a pattern of noncompliance results in a fine, you will be fined for each instance of noncompliance under these regulations. Reputation risk could also result from noncompliance if the fine is reported by the local newspaper.

RELATED ARTICLE: How Do You Monitor Teller Work?

When the RSM McGladrey consultants say teller work needs to be monitored, they mean that a financial institution should have basic knowledge of its customers, including its commercial customers' transactions. Monitoring can be everything from a formal system to a knowledge-based system where employees pass information on to the BSA officer about anything suspicious or strange in the customer's transaction.

They advise bank management to:

* Check what types of cash are coming into customer accounts by looking at teller work, large cash transaction reports, and cutting reports.

* Put an overall system in place to monitor transactions. There are vendors who sell monitoring systems, but some of those systems are not consistent with the risk or the ability that community banks have to test. Instead, use all the reports that a compliance or a BSA officer uses to monitor the transactions.

* Have cash in and out tickets for the tellers to use when buying or selling cash (if you don't have a system that aggregates the tracking of cash transactions). The reports should disclose whether the cash came from a single transaction or was the result of cash accumulated over the course of the day.

* Make sure the banker who set up the customer account has the responsibility to be aware of changes in the customer's business. That practice also makes good banking sense because there may be a need for additional services that can be determined through monitoring the customer's transactions.

* Identify high-risk accounts such as jewelry stores, auto dealers, accountants, and lawyers.

A best practice for monitoring is to take large currency transaction reports and lower the threshold to a manageable amount. For instance, use a spreadsheet to track the transactions of any customer that consistently has transactions of over $7,000. This practice may help banks identify customers that are structuring transactions to avoid reporting.

Matt Schriner can be reached at mat.schriner@rsmi.com; Kathleen Beans can be reached at kbeans@rmahq.org.

Kathleen Beans is senior writer, public relations manager, and contributing editor to The RMA Journal at RMA -The Risk Management Association.