NAFCU Compliance Blog

BSA/AML Violations Can Cost You!

Written by Shari R. Pogach, Regulatory Paralegal

Recently the Financial Crimes Enforcement Network (FinCEN) made its annual inflation adjustment to its civil monetary penalty amounts.  News headlines are full of the large institutional fines but you must remember under various statutes, credit unions and individuals are subject to criminal and civil liability for violating anti-money laundering and terrorist financing laws. And, these penalties can be severe.  The Federal Financial Institutions Examination Council (FFIEC) Bank Secrecy Act/Anti-Money Laundering (BSA/AML) Examination Manual outlines potential penalties:

"A person convicted of money laundering can face up to 20 years in prison and a fine of up to $500,000. Any property involved in a transaction or traceable to the proceeds of the criminal activity, including property such as loan collateral, personal property, and, under certain conditions, entire bank accounts (even if some of the money in the account is legitimate), may be subject to forfeiture. ... the U.S. Department of Justice may bring criminal actions for money laundering that may include criminal fines, imprisonment, and forfeiture actions. In addition, banks risk losing their charters, and bank employees risk being removed and barred from banking."

Criminal penalties can be assessed for willful BSA regulation violations.  Any individual, including a credit union employee, found guilty of this is subject to criminal fines of up to $250,000 or five years in prison, or both.  If the individual commits a willful BSA violation while breaking another law or committing other criminal activity, he or she is subject to a fine of up to $500,000 or ten years in prison, or both. Violations of certain BSA provisions or special measures can make an institution subject to a criminal money penalty up to the greater of $1million or twice the value of the transaction.

The federal banking agencies and FinCEN have the authority to bring civil money penalty actions for BSA violations. In addition to criminal and civil money penalty actions, individuals can be removed from banking for violation of anti-money laundering laws "as long as the violation was not inadvertent or unintentional.

Here is a chart of the updated penalty amounts:

Although it hasn't been updated with the new amounts as yet, this IRS webpage has a nice breakdown of BSA penalties with charts indicating the types of violations and who or what is subject to the penalty. 

Three trends can be found in BSA enforcement: 1) an increase in the frequency and size of penalties; 2) an emphasis on the acceptance of responsibility by institutions; and 3) the increased risk of individual liability.  Remember FinCEN's $1 million civil money penalty against Thomas Haider?  Haider was the former chief compliance officer of MoneyGram International.  FinCEN found Haider guilty of willful violations of BSA program requirements and not filing suspicious activity reports.  FinCEN's enforcement action was brought before the courts over the application of the BSA to individuals.  The court found in favor of FinCEN and that Haider could be held liable for violations of the BSA's AML program requirements.  As a result, some regulators are now pursuing other BSA enforcement actions against individual compliance officers.

***

We need your help.  Can you take a moment to answer two short questions? NAFCU is polling credit unions on what week of the month they typically hold their board meetings. Click here to answer! 

FinCEN's CDD Rule: Are Subaccounts Considered New Accounts?

Written by Stephanie Lyon, Regulatory Compliance Counsel

Credit unions generally permit existing members to have more than one share savings and checking account — these are often referred to as subaccounts. Whether opening a new subaccount is considered to be opening a new account is a question the NAFCU Compliance team has received several times since the Customer Due Diligence (CDD) rule was finalized in 2016. This question is relevant because starting May 11th, 2018, any time a legal entity member opens a new account, the credit union will be required to identify and verify the identity of the beneficial owners. See, Final 31 C.F.R. § 1010.230(b)(1).

Unfortunately, FinCEN's CDD rule did not explicitly discuss subaccounts anywhere in the proposed or final rule. However, there are several pieces of information located throughout the preambles to the proposed and final rule as well as guidance documents that seem to indicate opening a subaccount is likely considered to be a new account that will trigger the beneficial ownership identification and verification requirements. 

Definitions of Account and New Account

The CDD rule defines a "new account" as "each account opened at a [credit union] by a legal entity customer on or after the applicability date." Final 31 C.F.R. § 1010.230(g). The rule also defines "account" by cross referencing section 1020.100(a) which implements the Customer Identification Program (CIP) requirements, among other things. Under CIP, an "account" means "a formal banking relationship established to provide or engage in services, dealings, or other financial transactions including a deposit account, a transaction or asset account, a credit account, or other extension of credit." FinCEN and other regulators provided an interpretation of the definition of account that is helpful to determine whether a subaccount could be a new account.

In the Interagency Interpretative Guidance on Customer Identification Program Requirements, FinCEN made it clear that CIP does not have to be performed when an existing "customer" renews a loan or rolls over a share certificate as long as the credit union has a reasonable belief that it knows the true identity of the member. See, 31 C.F.R. § 103.121(a)(3)(ii)(C) – Person with an existing account, Q1. However, that same guidance stated that "[f]or the purposes of CIP, each time a loan is renewed or a [share certificate] is rolled over, the [credit union] establishes another formal banking relationship and a new account is established."

From the guidance and the definitions of account and new account, it does appear that opening a subaccount will be considered forming a new formal banking relationship and require the identification and verification of beneficial owners. But while this guidance is significant in explaining how FinCEN views an existing account and a new account for CIP purposes, it is not fully indicative of whether a subaccount is considered to be a new account for CDD purposes so we have to turn to the actual rule.

Preamble to Proposed and Final CDD Rule

In the proposed rule, there is a footnote that talks about the types of new accounts the rule would affect. The footnote seems to indicate FinCEN did not want to create a blanket exemption from the requirement to collect beneficial ownership information for subaccounts opened by a legal entity member after the compliance deadline. The discussion of this footnote was further explained in the preamble to the final rule in which FinCEN seems to strike a balance between requiring beneficial owner information for subaccounts opened after the compliance deadline and not retroactively requiring the collection of this information for accounts opened before the compliance deadline. Here is a relevant excerpt:

Several commenters sought clarification as to whether a financial institution must identify and verify a legal entity customer's beneficial owners each time it opens a new account at the institution after the rule's compliance deadline, or whether the requirement applies only the first time it opens a new account at such institution. FinCEN has concluded that, while it is not requiring periodic updating of the beneficial ownership information of all legal entity customers at specified intervals, the opening of a new account is a relatively convenient and otherwise appropriate occasion to obtain current information regarding a customer's beneficial owners…

81 Fed. Reg. 29406. Both the footnote and several other areas of the preamble make it apparent FinCEN expects credit unions to collect beneficial ownership information whenever an existing legal entity member does something that modifies the account relationship or triggers a review of the account. Additionally, as there is no guidance indicating that subaccounts are exempt from the definition of a new account, it seems FinCEN considers these to be "new accounts" if opened after the compliance deadline.

Finally, remember that other aspects of the CDD rule require credit unions to monitor members and update member information. This applies to currently opened accounts and accounts opened after the compliance deadline. I wrote a blog on triggering events that may be helpful when reviewing legal entity members.

What Else is New With Marijuana Banking?; Another Credit Union ADA Victory; Help Us Help You!

Written by Pamela Yu, Special Counsel for Compliance and Research

A couple of weeks ago, I blogged about what's new with marijuana banking.  Among other things, I provided an update on one credit union's ongoing efforts to become the first credit union chartered to support the marijuana industry and with a field of membership focused on cannabis groups.

In response to my post, several credit union industry players reached out to ask how many cannabis-friendly credit unions are currently handling marijuana-related accounts. 

Who's Holding All That Cannabis Money? 

Recent reports indicate that legal marijuana sales reached $9.7 billion across the seven states where recreational marijuana was legal and Canada in 2017. That number does not include California, which is projected to hit $3.7 billion in legal cannabis sales by the end of 2018, and $5.1 billion in 2019. Overall, despite continued federal prohibition here in the U.S., North American legal cannabis sales are expected to hit $24.5 billion by 2021.

Because the substance continues to be illegal under the federal Controlled Substances Act, marijuana businesses have remained challenged in obtaining traditional financial services but information from the Treasury Department indicates that more institutions are taking on these accounts.

According to FinCEN's Marijuana Banking Update, based on Suspicious Activity Report (SAR) filings, around 400 depository institutions were actively banking marijuana businesses in the U.S. as of September 30, 2017.  Less than 100 of those were credit unions, while the rest were banks.  FinCEN's data shows that the agency received a total of 39,025 SARs using key phrases associated with marijuana-related businesses by the end September 2017. 

Source: FinCEN Marijuana Banking Update (September 2017)

While the number of institutions serving marijuana businesses has more than tripled since 2014, federal data shows that only a small percentage of the 5,573 federally-insured credit unions across the country are reporting service to marijuana businesses.  The growing industry will likely continue to be underbanked as long as cannabis continues to be federally illegal.

***

Third ADA Win for Credit Unions

On March 5, in another win for the credit union industry, a federal district court in Virginia granted a credit union's motion to dismiss an Americans with Disabilities Act (ADA) website accessibility suit.  See, Carroll v. ABNB Federal Credit Union, No. 2:17-cv-521 slip. op. (E.D. Va. Mar. 5, 2018).  NAFCU filed an amicus brief in this case; we have filed five briefs so far in support of our member credit unions.

As discussed in the latest issue of NAFCU's Compliance Monitor, for the past year credit unions have faced a growing litigation threat due to unclear website accessibility standards under the ADA.  To date, NAFCU is aware that credit unions in at least 24 states have been impacted by ADA website accessibility claims. 

In the latest case to be thrown out, the court found that "because [the plaintiff] has not shown that he (1) is a member of [the credit union], (2) that he is within [the credit union's] membership field, or (3) that he could become a member of [the credit union]," the plaintiff had not alleged a "sufficiently concrete injury in fact" necessary to show legal standing. See, Carroll v. ABNB Federal Credit Union, No. 2:17-cv-521 slip. op. at 8 (E.D. Va. Mar. 5, 2018). 

The court's reasoning regarding the plaintiff's standing was consistent with two other recent decisions in virtually identical suits alleging website violations of the ADA by other credit unions. See, Griffin v. Department of Labor Federal Credit Union, 1:17-CV-1419, slip op. (E.D. Va. Feb. 21, 2018); Carroll v. Northwest Federal Credit Union, l:17-cv- 01205, slip op. (E.D. Va. Jan 26, 2018).

In addition, cases against two Texas credit unions (involving the same plaintiff) were dismissed on March 2. NAFCU also filed an amicus brief in support of one of those credit unions.

Please visit NAFCU's ADA webpage to learn more about this issue, and to keep apprised about what NAFCU is doing to fight for credit unions.

***

Monthly Research Survey: Help Us Help You!

NAFCU's Economic and Research Team conducts monthly surveys of NAFCU member credit unions in order to compile meaningful data reports that you can use to benchmark against your geographic and asset level peers. These survey results are also critical to NAFCU's advocacy efforts on your behalf to federal agencies, such as NCUA, CFPB and the Federal Reserve. Your participation helps us help you!

Today is the last day to share your voice on the topic of Financial Literacy & Community Outreach. We rely on your survey responses for our industry analysis and legislative advocacy efforts on behalf of all credit unions.

NAFCU members can participate in this month's Economic and CU Monitor survey with one of the options below:

• Online survey
• PDF file (please return by email to [email protected])

Deadline for Economic & CU Monitor survey: March 9, 2018

 

OFAC Blacklists the "Thieves-in-Law" Crime Syndicate; January 2018 BSA Blast

Written by Shari R. Pogach, Regulatory Paralegal

Thieves-in-Law, another organized criminal network to be on the lookout for.  And, no, this is not a joke..................

Late last month, the U.S. Department of the Treasury's (Treasury) Office of Foreign Assets Control (OFAC) announced it was targeting one of Russia's oldest and most notorious organized criminal gangs – "Vory v Zakone" or "Thieves-in-Law" (Thieves).  The announcement indicated the criminal network was being targeted for "its involvement in serious transnational criminal activities" across the globe. Ever heard of them?  I hadn't.

As a group, the Thieves-in-Law originated in the former Soviet Union's Stalinist prison camps and gulags.  This Wikipedia entry provides some history along with the rules of conduct for its members.  Members are required to have served several jail sentences, not allowed to get married and take an oath to uphold the group's code that includes living only off their criminal profits and supporting other Thieves members.

Now, apparently, its members are the heads of a vast underworld network that has spread throughout the former Soviet Union, Europe and the United States to the great financial centers.  As a criminal organization, it has engaged in money laundering, extortion, bribery, robbery, identity theft and trafficking.

Individual Thieves engaging in criminal activity in the United States have been targeted by U.S. law enforcement before, but Treasury's designation of the whole network as a "Transnational Criminal Organization" is the first action to treat them as a single group. As OFAC Director John E. Smith stated, “Treasury is designating the Thieves-in-Law as part of a broader strategy to disrupt the financial infrastructure of transnational criminal organizations that pose a threat to the United States and our allies.”      

The Treasury action also targeted 10 individuals and two entities linked to the Thieves-in-Law organization.  This action generally prohibits U.S. persons from conducting financial or other transactions with these individuals and entities, and freezes any assets they may have under U.S. jurisdiction.

***

BSA Blast.  It's 2018 and the first quarter January issue of the BSA Blast is now available. (NAFCU login required).  The articles in this issue cover: 1) a Texas community bank's civil money penalty lesson on the importance of "Knowing Your Customer"; and 2) Citibank's banking regulator fines it $70 million for not correcting its BSA/AML compliance issues.  The BSA training quiz included in this issue focuses on Currency Transaction Reports (CTRs).

314(b): Beware of Oversharing

Written by Jennifer Aguilar, Regulatory Compliance Counsel

Under section 314(b) of the Patriot Act, credit unions, and other financial institutions, are permitted to share information with one another regarding individuals they suspect may be involved in terrorist or money laundering activities. Those institutions who elect to share information under 314(b) are provided with a safe harbor from liability if they notify FinCEN of their intent to share, verify that the institution with whom it will share information with has also notified FinCEN of its intent to share, use the shared information only for the permissible purposes and have procedures in place to protect the shared information. See, 31 C.F.R. § 1010.540(b).

One question that often comes up for 314(b) sharing is what type of information can be shared under the safe harbor. Of course, any information directly related to possible terrorist and money laundering activities may be shared, but what about other types of suspected criminal activities, such as fraud? Information about these types of activities can be shared under the 314(b) safe harbor, but only in certain circumstances. FinCEN guidance in this area can be a bit confusing so it's helpful to break it down into a few steps to determine when credit unions are permitted to share information about these types of activities:

1. Whether the credit union suspects a specified unlawful activity has occurred;
2. Whether a transaction involving the proceeds from that activity has taken place; and
3. Whether that transaction is part of a terrorist or money laundering scheme.

First, what types of activities are considered "specified unlawful activities" (SUAs)? FinCEN guidance points to the Patriot Act to determine which activities are SUAs. The Act defines a "specified unlawful activity" rather broadly to include financial transactions resulting from the distribution of controlled substances or extortion, fraud, bribery, trafficking and counterfeiting, as well as many other federal criminal offenses. See, 18 U.S.C. § 1956(c)(7). So, the first step in determining whether information can be shared under 314(b)'s safe harbor is to review the activity involved and establish that a SUA has occurred or that the credit union suspects a SUA has occurred.

Second, has a transaction involving the proceeds from a SUA taken place? FinCEN 2009-G002 explains that a credit union may share information if it "suspects that the transaction may involve the proceeds of one or more SUAs." This phrasing is important because it establishes the fact that the credit union must first suspect that a SUA has occurred. Additionally, FinCEN 2012-R006 explains that a credit union may not share information solely to determine whether a SUA has occurred. This means that sharing in order establish a suspicion that a SUA has occurred is not permissible; sharing is only permitted once the credit union has already established that it suspects a specified unlawful activity has occurred.

For example, suppose John Doe is a pusher for Jane Doe's international drug operation. John sells the drugs then deposits the proceeds at ABC credit union. Under FinCEN guidance, ABC may not share information in order to determine whether the proceeds came from drug sales. However, ABC may share information once it suspects that the proceeds are from drug sales.

Finally, is the transaction part of a terrorist or money laundering scheme? FinCEN 2009-G002 explains that the purpose of 314(b) sharing is "to identify and report activities that the financial institution 'suspects may involve possible terrorist financing or money laundering.'" Even if the credit union suspects that a transaction involved the proceeds from an SUA, it may only share information if it also suspects that the SUA relates to terrorist or money laundering activities. In the fraud context, this means that even if the credit union suspects a fraud has occurred and there is a transaction involving the proceeds from that fraud, the credit union may only share information about that fraud if the credit union also suspects the fraud is part of a terrorist or money laundering scheme.

When it comes to sharing information about SUAs, a credit union would need to review all the facts involved and ensure that all three elements have been satisfied: the credit union knows or suspects a SUA has occurred, a transaction involving the proceeds from that SUA has occurred and that transaction is part of terrorist or money laundering activities. It is important that all three of these elements are present in order to stay within the 314(b) safe harbor. Sharing information about fraud may be important to help prevent further harm, but, if the fraud does not relate to terrorist or money laundering activities, a credit union may lose its safe harbor protection by oversharing. This of course does not mean that the credit union cannot do anything – state law may allow the credit union to report the fraud to the local police and, depending on the circumstances, a SAR may be appropriate.

Marijuana Banking Just Got More Complicated

Written by Pamela Yu, Special Counsel for Compliance and Research

Well, we can't say we didn't see this coming...we blogged back in March, 2017 on what the change in administration might mean for marijuana banking, and the federal government announced a change in its policy towards marijuana enforcement late last week.

U.S. Attorney General Jeff Sessions changes DOJ's position on marijuana.

In a move long forecasted by many legal and policy observers, last Thursday the attorney general issued a memorandum to rescind Obama-era guidance on federal enforcement of marijuana. Released just days after California became the latest (and largest) state to begin sales of recreational marijuana, the memo directs "all U.S. Attorneys to use previously established prosecutorial principles," in marijuana enforcement, thus eliminating the already-limited guidance that provided some measure of direction in navigating the conflict between federal illegality and state legality of marijuana. This policy shift will significantly heighten risks for credit unions serving state-authorized marijuana-related businesses or operating in states with legalized cannabis.

Sessions' memo rescinds a 2013 directive, written by then-Deputy Attorney General James M. Cole, which instructed federal prosecutors to focus its marijuana enforcement efforts on eight priorities, including keeping marijuana out of the hands of minors and black market criminals and cartels.  It also rolls back a 2014 Cole memo that directed U.S. Attorneys to apply the same eight enforcement priorities in prosecuting financial crimes based on transactions involving marijuana proceeds.  The so-called Cole memo guidance had cleared up some of the uncertainty about how federal prosecutors would address the conflict of laws as states began allowing sales of marijuana for medical and recreational use. 

Today, 29 states and the District of Columbia (DC) permit medical marijuana and, of those, eight states and DC also allow adult-use recreational marijuana. A recent Gallup poll shows that public support for the legalization of marijuana is at an all-time high, with 64 percent of Americans favoring legalization, including for the first time a majority of Republicans (51 percent now support legalizing marijuana).  Nevertheless, marijuana remains a schedule 1 substance under the federal Controlled Substances Act. Thus, a litany of federal criminal statutes may be implicated for credit unions handling marijuana-related funds.

So what does this mean for credit unions?  In short, providing financial services in states where marijuana is legal under state law just got a lot more complicated. 

Marijuana Banking

At this point, is unclear whether the rescission of the Cole memo guidance will mean a federal crackdown on state-sanctioned marijuana.  The roll-back of formal guidance with respect to marijuana enforcement has created a policy void (note that the memo eliminates prior directives but does not replace them with new guidance) but it is too soon to tell if enforcement will significantly increase.  In effect, the Sessions memo empowers the country's 93 U.S. Attorneys to exercise prosecutorial discretion in their respective jurisdictions. We don't know how prosecutors will use this discretion—some jurisdictions may take a more aggressive enforcement posture while others may not—but the door is now open for federal officials to carry out enforcement against marijuana activities in states that have legalized cannabis.  This creates significant legal uncertainty for credit unions that have been serving marijuana-related businesses under the auspices of the Cole memo guidance. 

There are some existing barriers to marijuana enforcement that remain in place.  For example, the Rohrabacher-Blumenauer (also known as Rohrabacher-Farr) appropriations bill provision that has been in place since December 2014 prohibits the Department of Justice (DOJ) from using federal funds to prevent states "from implementing their own state laws that authorize the use, distribution, possession or cultivation of medical marijuana."  However, the provision must be renewed each fiscal year in order to remain in effect and its protections apply only to medical marijuana, leaving particularly vulnerable those credit unions operating in recreational states.

 BSA Compliance

 In 2014, as a supplement to the Cole memo on marijuana-related financial crimes, the Financial Crimes Enforcement Network (FinCEN) issued guidance to clarify "how financial institutions can provide services to marijuana-related businesses consistent with their BSA obligations." See, FIN-2014-G001.   Despite limited protections, together the Cole memos and FinCEN guidance created a framework for credit unions to serve marijuana-related businesses consistent with their legal and compliance obligations. 

However, as we previously cautioned, FinCEN's guidance depends heavily on the enforcement posture articulated in the Cole memos. Now that those memos have been reversed, credit unions can no longer rely on the FinCEN guidance for serving marijuana-businesses, significantly heightening BSA compliance risks. To add fuel to the fire, some credit unions may now be questioning whether their compliance with FinCEN's 2014 instruction to file either a "Marijuana Limited," a "Marijuana Priority," or a "Marijuana Termination" suspicious activity report (SAR) for each transaction involving marijuana-related funds has created a damning paper trail for federal prosecutors.  FinCEN and the DOJ have yet to offer any assurance that SARs issued under FIN-2014-G001 will not be used to prosecute financial crimes, even against those who relied on the guidance in good faith.  While it is perhaps unlikely that marijuana SARs will be used as evidence for the widespread prosecution of financial institutions, it is not outside the realm of possibility that federal authorities could make an example out of a bank or credit union to send the message that federal marijuana enforcement priorities have changed. Regardless, the increased liability and compliance risk will certainly have a chilling effect on the ability for credit unions to provide services to marijuana-related businesses. It is likely FinCEN will release additional guidance or information soon in light of these changes.

Momentum for Change

On a more optimistic note, Thursday's rescission may create momentum for congressional action on marijuana.  Marijuana banking advocates on the Hill have been challenged in mobilizing change.  The uncertainties created by Sessions' action could actually galvanize support in Congress to find a legislative solution to the conflict between federal and state drug laws. With support for marijuana protections in both parties the attorney general's tougher stance on marijuana could—ironically—become the impetus for a statutory solution for marijuana banking.

FinCEN SAR Stats; Sessions Releases Marijuana Memo; Request for BSAAG Nominees

Written by Shari R. Pogach, Regulatory Paralegal

Have you ever wondered what happened to the Financial Crimes Enforcement Network's (FinCEN) Suspicious Activity Report Statistics (SAR Stats)?  Well the data is still available; it's just gone totally interactive.

If you go to FinCEN's website www.fincen.gov, you can find a link for "SAR Statistics."

This link goes to the interactive report generator page:

 


The drop down boxes allow for filtering of the statistical data according to:  industry type; year & month; suspicious activity category/type; states/territories; county/metro & micro area; instrument type(s)/payment mechanism(s); product type; relationship; and regulator.  Each drop down allows for all, one, or multiple filter categories.  Once you have determined your filters, you can then generate a report and export it to a CSV file or to a PDF for further study.

FinCEN's FAQ/Glossary page cautions the statistics are:

"Statistical data for SARs are updated as information is processed and refreshed data is periodically made available for this tool. For this reason, there may be discrepancies between the statistical figures returned from queries performed at different times. In addition, slight differences in query criteria may return different statistical results. Also note that the statistics generated by this tool do not include SAR fields that contain unknown or blank data. To the extent statistics including blank or unknown data are tabulated outside of this tool for other purposes, there may be discrepancies between statistics generated by this tool and those generated through other means. FinCEN makes no claims, promises or guarantees about the accuracy or completeness of the statistical figures provided from this tool and expressly disclaims liability for errors, omissions, or discrepancies in the statistical figures."

Still, the generated reports can indicate trends in your area, state or region of your part of the country and can be a useful additional resource for BSA compliance personnel.  The website indicates the data has been updated as of November 30, 2017.

***

Sessions Releases Marijuana Memo.  Attorney General Jeff Sessions released a memorandum on federal marijuana enforcement policy.  Basically the Department of Justice has rescinded the Obama administration policy of non-interference with marijuana-friendly state laws.  Look for more on this in a blog next week.

***

BSAAG.  FinCEN is asking for nominees for membership on the Bank Secrecy Act Advisory Group (BSSAG).  New members will be selected for three-year membership terms.  If you would like more information or are interested in having NAFCU submit you as a candidate, please email Senior Regulatory Affairs Counsel Michael Emancipator at [email protected] by January 15 as potential nominees must be submitted to FinCEN by January 26, 2018.

Should We Block That Marijuana Transaction?

Written by Pamela Yu, Special Counsel for Compliance and Research

Earlier this year, I blogged about some of the legal and compliance uncertainties and operational challenges facing credit unions that are providing, or interested in providing, financial services to marijuana-related businesses that are legal under state law but remain illegal under the federal Controlled Substances Act (CSA).  I've also blogged about one credit union's efforts to become the first cannabis credit union and the difficulties in banking these unbankable businesses.

Not much has changed in 2017 with respect to resolving the conflict of laws impacting marijuana banking.  But in April West Virginia became the 29^th state to legalize medical marijuana and the November elections saw gains for legalized marijuana advocates.  In the meantime, the attorney general continues to see marijuana as a "life-wrecking" substance that is "only slightly less awful" than heroin.  In short, the debate over state-sanctioned pot is ongoing and the law in this area is far from settled.

Meanwhile credit unions are increasingly being forced to contend with the cannabis conundrum, whether they have chosen to take on marijuana-business accounts or not. Recently, some of our members have contacted NAFCU's Compliance Team for assistance with how to handle marijuana-related transactions. Namely—should a credit union affirmatively block marijuana-related transactions?

Liability Under Federal Law

 Marijuana remains a schedule I controlled substance under the CSA, which makes it illegal under federal law.  See, 12 U.S.C. §812(b)(1).  Thus, federal criminal statutes may be implicated when handling marijuana-related funds.  For example, it is a federal criminal offense to engage in certain financial and monetary transactions with the proceeds of a “specified unlawful activity,” including marijuana-related funds.  See, 18 U.S.C. §§ 1956 and 1957.  It is also a federal criminal offense to transact funds “derived from” marijuana-related activity by or through a money transmitting business. See, 18 U.S.C. § 1960.  Financial institutions that conduct transactions with funds derived by marijuana-related activity may also be subject to criminal liability for failing to identify or report financial transactions involving marijuana proceeds.  See, 31 U.S.C. §5318(g).  In light of these liability concerns, some credit unions are wondering if they have an obligation or affirmative duty to prevent marijuana-related payments or transactions of funds associated with marijuana-related activity.

Blocking Merchant Codes

Ultimately it is a risk-based decision for the credit union, but keep in mind that credit unions are under no legal obligation to supervise their members' behavior nor to enforce federal drug laws.  There is no federal regulatory requirement to affirmatively prevent member transactions to state-sanctioned marijuana-related businesses.  Yet, the liability risk remains.  So what should a credit union do?

Some credit unions have considered taking such action as blocking marijuana-related transactions based on merchant codes.  There is some precedent for this: the Unlawful Internet Gambling Enforcement Act (UIGEA), for example, prohibits gambling businesses from knowingly accepting payments in connection with the participation of another person in a bet or wager that involves the use of the Internet and that is unlawful under any federal or state law (“restricted transactions”). See, 31 U.S.C. §§ 5361-5367.  Under the UIGEA, Treasury and the Federal Reserve Board promulgated regulations requiring certain participants in payment systems that could be used for unlawful Internet gambling to have policies and procedures reasonably designed to identify and block or otherwise prevent or prohibit the processing of restricted transactions. See, Unlawful Internet Gambling Enforcement Act of 2006 Overview.

However, blocking marijuana-related transactions would be an administrative burden—and there are ways to circumvent code-blocking. For example, critics have suggested that the UIGEA has had debatable success in effectively blocking illegal gambling transactions.  One reason that code-blocking has not worked well, according to some reports, is because of a circumvention technique called "factoring."  In factoring, a merchant engaged in illegal gambling submits its card transactions through another merchant's terminal using that merchant's identification number and merchant category code and then pays the other merchant a percentage of the submitted transactions.  While this violates card associations' rules, this type of circumvention illustrates the difficulty in trying to police member behavior.  It is also worth bearing in mind that restrictions on internet gambling transactions are specifically governed by federal law, the UIGEA.  There is no similar statute requiring marijuana-related transactions to be blocked by financial institutions.

Also, there is the risk of over-blocking.  Some merchants may sell both legal and (federally) illegal products—the marijuana merchant for example could sell marijuana as well as tobacco products, e-cigarettes, magazines, T-shirts, hats, etc. So, a customer could shop at a marijuana merchant but only purchase legal products and still be blocked. 

Reputation Risk

Another consideration is reputation risk. Although illegal on the federal level, marijuana is legal at the state level in 29 states.  More and more states are legalizing cannabis, both medically and recreationally, and there is majority and growing public support for legalized marijuana.  Particularly with respect to medical marijuana—where members with legitimate medical conditions may rely on medical marijuana to treat or alleviate serious illnesses including cancer and epilepsy—there could be risks to the credit union's reputation if members become upset that their transactions for medical marijuana are blocked by the credit union, particular if there is no regulatory obligation to do so.

On the other hand, there might be reputation risk to allowing marijuana-related transactions or in not taking some affirmative action to prevent payments to marijuana-related businesses.  For example, a credit union with a field of membership that includes law enforcement agencies could suffer reputational harm in allowing marijuana-related transactions despite continued federal prohibitions against marijuana.

BSA Compliance

If the credit union determines to allow marijuana-related transactions, reporting requirements under the Bank Secrecy Act and anti-money laundering (BSA/AML) rules certainly come into play.  If a transaction appears to be associated with marijuana, FinCEN guidance issued in 2014 is instructive. See, FIN-2014-G001. The FinCEN guidance "clarifies how financial institutions can provide services to marijuana-related businesses consistent with their BSA obligations." See, FIN-2014-G001, p.2.  For example, the credit union may need to file a marijuana-related suspicious activity report (SAR) for member transactions that involve marijuana-related funds. 

The FinCEN guidance discusses three specific marijuana-related SARs: (1) marijuana limited; (2) marijuana priority; and (3) marijuana termination.  BSA obligations are heightened for transactions involving marijuana, even if the transaction is related to a marijuana-related business that is legal under state law.  For instance, all transactions with a marijuana-related business require a SAR, simply by virtue of the fact that the subject is engaged in a marijuana-related business. 

FinCEN's discussion of the "marijuana limited" SAR filing states:

A financial institution providing financial services to a marijuana-related business that it reasonably believes, based on its customer due diligence, does not implicate one of the Cole Memo priorities or violate state law should file a “Marijuana Limited” SAR. The content of this SAR should be limited to the following information: (i) identifying information of the subject and related parties; (ii) addresses of the subject and related parties; (iii) the fact that the filing institution is filing the SAR solely because the subject is engaged in a marijuana-related business; and (iv) the fact that no additional suspicious activity has been identified. Financial institutions should use the term “MARIJUANA LIMITED” in the narrative section.

See, FIN-2014-G001, pp.3-4.  Thus, at a minimum, a "marijuana limited" SAR should be filed for all transactions involving a marijuana-related business or marijuana-related funds.

In the end, this is a complex and still uncertain issue and a lot remains unclear about how credit unions should address state-sanctioned marijuana activities.

FinCEN Launches Information Sharing Exchange Program

Written by Shari R. Pogach, Regulatory Paralegal

The Financial Crimes Enforcement Network (FinCEN) wants to strengthen information sharing with financial institutions.  To help achieve this, it announced it has launched its FinCEN Exchange program to enhance public-private information sharing.  Working closely with law enforcement, FinCEN plans to convene regular briefings with financial institutions to exchange information on important potential illegal finance threats.   The program is intended to help financial institutions better identify risks and better focus on higher priority issues.  This will in turn help FinCEN and law enforcement get critical information to continue the fight against money laundering and other financial crimes.

Participation in the FinCEN Exchange is strictly voluntary with no new regulatory requirements.  It also doesn't replace or affect any existing channels by which law enforcement interacts directly with the financial industry. FinCEN indicates operational briefings under this new program will start in the coming weeks.

Historically, FinCEN has convened over a dozen special briefings in five cities with over 40 financial institutions and multiple law enforcement agencies since 2015.  According to FinCEN, the information given by financial institutions through suspicious activity reports (SARs) after these briefings has helped the public sector map out and target weapons proliferators, sophisticated global money laundering operations, human trafficking and smuggling rings, and corruption and trade-based money laundering networks.  The briefings also helped financial institutions to focus on specific priorities and better identify risks.

The FinCEN Exchange will convene more regularly scheduled and as-needed operational briefings across the nation with law enforcement, FinCEN and financial institutions to exchange information on priority illegal finance and national security threats.  In consultation with law enforcement, FinCEN plans to invite financial institutions to participate based on a variety of factors, including whether an institution may have information that is relevant to a particular topic. 

FinCEN states the form of each briefing may vary but the sharing of information is intended to equip financial institutions to provide more responsive information into SARs. Financial institutions are also highly encouraged, as appropriate, to voluntarily share information with other FinCEN Exchange participants as well as other financial institutions or associations of financial institutions pursuant to Section 314(b) of the USA PATRIOT Act.

CDD Rule: Beware of Events that May Trigger Beneficial Ownership Reviews; CFPB Releases Beta HMDA Platform

Written by Stephanie Lyon, Regulatory Compliance Counsel

I have exciting news to share; on Friday I became a Certified Anti-Money Laundering Specialist through ACAMS. This is a great milestone for me and nothing could commemorate this accomplishment better than a BSA blog.  Enjoy!

As the Customer Due Diligence (CDD) rule's implementation date gets closer, we have seen an increase in questions regarding the types of events that may lead a credit union to review the beneficial ownership information of an existing account. So we thought it would be helpful to go over the rule's requirements and give examples of potential triggering events. Before we dig in, remember that the definition of a beneficial owner includes two prongs—ownership and control—so when talking about updating information on beneficial owners, we are referring to both prongs.

The 5th pillar of BSA compliance established by the final rule requires that credit unions include in their anti-money laundering (AML) programs, CDD procedures for the purpose of developing a member risk profile and conducting ongoing monitoring of these relationships. See, 81 Fed. Reg. 29449. Before you sound the alarm at your credit union, it is important to know that the final CDD rule does not impose a categorical requirement to regularly update the beneficial ownership information on an existing account. See, 81 Fed. Reg. 29421. However, as part of the on-going monitoring, credit unions may encounter some events that could lead the credit union to believe that there has been a fundamental change to the ownership of the account and hence trigger a review of beneficial owners. See, 81 Fed. Reg. 29399.

What Triggers A Review?

The rule states that beneficial ownership information should be updated when, in the normal course of business, the credit union detects a relevant change to the account that may alert the credit union to a change in the beneficial ownership structure. Here is an excerpt to the preamble of the CDD rule in which FinCEN explains this concept:

"…our requirement is consistent with current practice, and we expect monitoring-triggered updating of beneficial ownership information (as with other customer information) only to occur on a risk basis when material information about a change in beneficial ownership is uncovered during the course of a bank's normal monitoring (whether of the customer relationship or of transactions)... However, there is no expectation that a financial institution obtain updated beneficial ownership information from its customers on a regular basis, whether by using the Certification Form in Appendix A or by any other means." 81 Fed. Reg. 29421.

Unfortunately, the CDD rule does not have a prescriptive list of events that will trigger the review of beneficial ownership information for existing business accounts. Rather the rule follows the same risk-based review format of other Bank Secrecy Act (BSA) requirements. These risk-based provisions allow credit unions the flexibility to determine its own triggering events and implement appropriate review procedures. The rule does provide a few examples of events that could lead to a review of an account's beneficial ownership structure such as:

• "a situation where an unexpected transfer of all of the funds in a legal entity's account to a previously unknown individual would trigger an investigation in which the bank learns that the funds transfer was directly related to a change in the beneficial ownership of the legal entity…;
• when a financial institution detects information (including a change in beneficial ownership information) about the customer in the course of its normal monitoring….; [and/or]
• a significant and unexplained change in the customer's activity, such as executing cross-border wire transfers for no apparent reason or a significant change in the volume of activity without explanation." 81 Fed. Reg. 29421, 29399.

So if the credit union uncovers a potential change to the beneficial ownership information during a high risk review of an account, during the investigation of an AML alert or a SAR filing, the rule would require the credit union to seek updated information for the account at that time. Other triggering events that may require updated beneficial ownership information, depending on specific facts and circumstances, include:

• A notable increase in CTR filings for the legal entity or any of the beneficial owners
• The filing of a SAR (depending on the nature and type of suspicious activity)
• Changes regarding the authorized users or signatories for the account
• Changes regarding the beneficial owners, ownership structure, nature of the business or customer base
• Opening a new subaccount for the business
• A request to close an active subaccount without providing a legitimate reason
• A 314(a) match
• Information obtained/provided from or to other FIs through 314(b) information sharing
• Results from a high-risk review of the account
• Law enforcement subpoenas or search warrants
• Transaction monitoring alerts for unexpected activity

Before the rule becomes final, credit unions may want to review their current due diligence process and create additional risk-based procedures that specify which triggering events should lead to a more thorough review of legal entity accounts—including obtaining updated beneficial ownership information.

***

CFPB Releases Beta Version of HMDA Platform. Credit unions will finally be able to test their HMDA data collected in 2017 for reporting to the CFPB in 2018  through the long awaited beta version of the HMDA portal. The portal allows credit unions to establish test log-in credentials, upload sample files, validate the data, receive edit reports, confirm test data submissions and complete test filing processes.

BSA and OFAC Compliance Program Deficiencies Highlighted in Cease and Desist Order; October BSA Blast

Written by Shari R. Pogach, Regulatory Paralegal

I often write about Bank Secrecy Act (BSA) enforcement actions as these tend to illustrate what the regulators are looking for in examining for BSA compliance.  This recent Cease and Desist Order against The Bank & Trust, S.S.B, of Del Rio, Texas, reiterates the need for a robust compliance and risk management program in order to comply with BSA and anti-money laundering (BSA/AML) regulations. The enforcement action also indicates a weakness in this bank's compliance with the Office of Foreign Assets Control of the United States Department of the Treasury (OFAC) requirements.

Under the order, the bank is required to do the following:

• Strengthen board oversight of compliance policies, procedures, standards, staffing and resources;
• Develop an enhanced written BSA/AML compliance program;
• Develop a revised written program for conducting appropriate levels of customer due diligence;
• Develop an enhanced written program designed to reasonably ensure the identification of  and timely, accurate and complete reporting of all known or suspected violations of law or suspicious transactions to law enforcement and supervisory authorities;
• Submit a written plan to ensure qualified independent testing and validation of the bank’s suspicious activity monitoring system;
• Bring in an independent third party to conduct a "look-back" transaction review of the first half of 2016 to see if suspicious activity involving high risk customers and transactions at, by, or through the bank was properly identified and reported; and
• Submit a plan to enhance the bank’s compliance with the OFAC regulations that includes but is not limited to, enhanced OFAC screening procedures, an improved methodology for assessing OFAC risks, and enhanced policies and procedures to ensure compliance with OFAC regulations.

Examples of deficiencies by another institution can be used as road maps to determine where, if any, your own institution's BSA and OFAC compliance programs might have weaknesses.

***

BSA Blast.  The October 2017 issue of the BSA Blast is now available. (NAFCU login required).  The articles in this issue cover: 1) weaknesses in this Florida bank's BSA compliance program are outlined in a very detailed consent order signed with the OCC; and 2) FinCEN issues its first enforcement action against a foreign-located virtual currency exchange.  The quiz included in this issue focuses on FinCEN's advisory guidance on political corruption in Venezuela and OFAC sanctions.

***

2018 BSA Seminar.  Don't have your NAFCU Certified Bank Secrecy Officer (NCBSO)  designation yet?  Make plans to attend NAFCU's 2018 BSA Seminar, August 12-15 in Denver, Colorado.  Advance your career and skills with up-to-the-minute credit union BSA training! 

FinCEN Finalizes Technical Amendments to CDD Rule; CFPB Updates HMDA Guide

Written by Stephanie Lyon, Regulatory Compliance Counsel

FinCEN recently issued technical amendments to its Customer Due Diligence (CDD) rule or as some of you may know it, the Beneficial Ownership rule. These amendments became effective the day they were published in the Federal Register but the compliance deadline is not until May 11, 2018. Unfortunately, the compliance deadline may take away from the enjoyment of celebrating Eat What You Want Day, but I will nonetheless observe this holiday.

I just wanted to note from the onset that these technical amendments do not provide additional guidance on complying with the CDD rule but we do anticipate additional FAQs before the compliance deadline—specifically on complex corporate structures and how deep to dig to find a natural person (finding the heartbeat).

Of the technical amendments, only one part is specifically relevant to credit unions while the other part deals with the training element of the AML program for mutual funds, which was inadvertently omitted from the final rule. See, 81 Fed. Reg. 45183. Here are the applicable corrections noted in the amendment:

Corrections to the Beneficial Owner Certification Form

Under the final CDD rule, credit unions are required to identify up to 4 beneficial owners who own 25% or more of legal entity customers at the time a new account is opened. To comply with this requirement, the credit union may obtain the required information on a standard certification form or through substantially similar means. Credit unions seeking to comply with this requirement through the standard certification form can find an image of the Certification Regarding Beneficial Owners of Legal Entity in Appendix A of the final rule.

The technical amendments made a couple of corrections to the model Certification Form found in Appendix A. The changes are meant to fix inadvertent mistakes instead of imposing additional requirements to obtain information for beneficial owners of legal entities. Here is a summary of the changes:

1. In the first sentence in Part I under the heading “What information do I have to provide?”, the term “foreign persons” is changed to “non-U.S. persons”.
2. In Part II, the heading of Section II b. is changed to “b. Name, Type, and Address of Legal Entity for Which the Account is Being Opened:”
3. In the headings of the last column in the Tables in Section II c and Section II d, the term “Foreign Persons” is changed to “Non-U.S. Persons” and the term “Social Security Number” is added after the term “persons”.
4. In footnote 1, the term “Foreign Persons” is changed to “Non-U.S. Persons” and “a Social Security Number,” is inserted after the word “provide”.

81 Fed. Reg. 45183. For visual learners, such as myself, I summarized the changes in red in the old model form and highlighted the last change in the new model Certification Form:

Change # 1

 

Change #2

Change #3

Change #4

Credit unions that are relying on a forms provider to create the Certification Form may want to ensure the technical amendments are incorporated before the compliance deadline sneaks up. As I recall, the process of requesting a modification to a form, reviewing the changes and approving the final form can take some time so it is important to get the ball rolling. The technical amendment did include a model Certification Form that incorporates the amendments, but the form is spread out into four parts:

https://s3.amazonaws.com/images.federalregister.gov/ER28SE17.004/original.png?1506528076

https://s3.amazonaws.com/images.federalregister.gov/ER28SE17.005/original.png?1506528077

https://s3.amazonaws.com/images.federalregister.gov/ER28SE17.006/original.png?1506528077

https://s3.amazonaws.com/images.federalregister.gov/ER28SE17.007/original.png?1506528093

***

CFPB Updates HMDA Small Entity Compliance Guide. The CFPB just updated their HMDA small entity compliance guide to incorporate the amendments to its 2015 HMDA rule. The updates incorporate changes introduced in the April 2017 HMDA proposal (technical clarifications) and the July 2017 HMDA proposal regarding transactional thresholds for reporting HELOCs.

Regulatory Compliance School and Seminar. I also wanted to say on behalf of the Regulatory Compliance team, thank you for joining us at NAFCU's Regulatory Compliance School and Seminar in sunny San Diego. It is energizing to see so many engaged compliance professionals in one place!

OFAC Requirements for Blocked Property

Written by Stephanie Lyon, Regulatory Compliance Counsel

Last Friday, the Office of Foreign Assets Control (OFAC) released a notice reminding credit unions and other financial institutions that the annual report of blocked property is due by September 30th. As the annual filing is only one of the multiple OFAC requirements for blocked property, we thought it would be helpful to break down the other steps a credit union must take to meet its regulatory requirements.

In general, OFAC regulations require that credit unions block accounts and other property as well as reject unlicensed trade and financial transactions of certain countries, entities, and individuals. See, FFIEC BSA/AML Examination Manual, pp. 147. Aside from that, you may remember that NAFCU blogged earlier this year and noted that OFAC takes a risk-based approach to compliance so credit unions will have the flexibility of determining when and how to run transaction names through OFAC lists. So what happens once the credit union identifies property subject to a blocking program?

Place Funds in Interest-Bearing Accounts

Once the credit union has determined that funds need to be blocked, the blocked property must be placed into an interest-bearing account from which only OFAC-authorized debits may be made. See, 31 C.F.R. § 515.205(a). OFAC defines an interest bearing account as "a blocked account earning interest at no less than the maximum rate payable on the shortest time deposit in the domestic bank where the account is held: Provided however, That such an account may include six-month Treasury bills or insured certificates, with a maturity not exceeding six-months, appropriate to the amounts involved." 31 C.F.R. § 515.205(g).

If the phrase "interest-bearing account" raises a red flag for federal credit unions, it is because NCUA’s Truth in Savings rule prohibits federal credit unions from offering interest-bearing deposit (as defined in in the rule) and may instead offer dividend-bearing deposit accounts. See, 12 C.F.R. § 707, Supp. I, cmt. 707.2(i)-1. 

OFAC and other Treasury regulations are written in a bank-centric manner, so sometimes the language in these regulations have inadvertent construction issues. As there is no carve-out exception for federal credit unions in the section of the regulation that requires placing blocked funds in interest-bearing accounts, many credit unions have interpreted this requirement to mean a dividend-bearing account. To clarify this requirement, NAFCU contacted OFAC's compliance helpline and they agreed with the interpretation that depositing blocked property into dividend-bearing accounts would meet the requirement. However, it would be great to see this glitch clarified by NCUA or OFAC in actual guidance documents such as the NCUA AIRES Exam Questionnaire, OFAC FAQs, or the FFIEC BSA/AML Examination Manual so that federal credit unions could feel more comfortable relying on this interpretation.

As for whether the credit union has to create individual blocked property accounts or one account for all blocked property, OFAC does not have a preference as long as the credit union maintains an audit trail that allows it to determine specific ownership interest of blocked property. See, OFAC FAQs: Sanctions Compliance, Q.32.

Initial Report

Credit unions are also required to file a report of blocked property within 10 business days from the date that property becomes blocked. The report should detail the blocked property and also include information pertaining to payments or transfers that are rejected by the credit union because of a blocked program. See, 31 C.F.R. § 501.603(b)(1)(ii). In the initial report, the credit union must also certify that the blocked funds have been deposited into a blocked account. See, 12 C.F.R. § 501.603(b)(1)(ii).

To ensure all pertinent and required information is included in the initial report, credit unions can use the form provided by OFAC and electronically transmit it to: [email protected] or mail it to: Office of Foreign Assets Control, Compliance Programs Division, U.S. Treasury Department, 1500 Pennsylvania Avenue NW.—Annex, Washington, DC 20220. Credit unions should be aware that there is a separate form for rejected transactions that follows the requirements of section 501.604.

Annual Report

Finally, OFAC requires that credit unions provide a comprehensive list of all blocked property held as of June 30 of the current year by September 30. See, 31 C.F.R. § 501.603. The term blocked property only applies to property that is blocked pursuant to OFAC regulations and does not include property that has been unblocked by general or specific license even if it has not yet been returned to the owner. This means that if the credit union unblocked property on June 29th and returned this property by July 1st, it should not include information on the unblocked property in its annual report. However, note that the regulation also establishes record keeping requirements for all blocked transactions for a period of 5 years after the date of the transaction. See, 12 C.F.R. § 501.601.

The annual reports must be filed using Form TD F 90-22.50, Annual Report of Blocked Property and the form should be sent to [email protected]. In case of additional questions, OFAC recently updated its guidance on filling out the annual blocked property report. The guidance is especially helpful for credit unions with 20 or more blocked accounts as it allows for a spreadsheet instead of a PDF or word document to complete part B of the form.

There you have it— next time you get an OFAC hit subject to a blocking order, you hopefully won't have to go through the entire bank-centric regulation to figure out OFAC's requirements.

A Little of This, A Little of That in the Waning Days of August.........

Written by Shari R. Pogach, Regulatory Paralegal

The Financial Crimes Enforcement Network (FinCEN) recently issued revised Geographic Targeting Orders (GTO) to target shell companies buying luxury properties.  Transactions conducted in Honolulu, Hawaii, are now included under the revised GTO, making a total of seven major metro areas where U.S. title insurance companies are required to identify the natural persons behind shell companies used to pay for high-end real estate.  The August 22, 2017, revised GTO also has broadened the transaction categories to now include wire transfers.  Any covered transaction made "without a bank loan or other similar form of external financing; and ...  made, at least in part, using currency or a cashier’s check, a certified check, a traveler’s check, a personal check, a business check, or a money order in any form, or a funds transfer" must be reported to FinCEN.

In addition to the revised GTO, FinCEN released FIN-2017-A003 to provide financial institutions and the real estate industry with information on the money laundering risks associated with some real estate transactions.  The guidance provides some red flag activity and case examples.  FinCEN also has a frequently asked questions document here.

***

FFIEC BSA/AML Examination Manual Update.  Word on the street is that an interagency group of federal banking regulators has started working on amending the Federal Financial Institutions Examination Council’s Bank Secrecy Act exam manual to account for the new customer due-diligence rule issued by the Financial Crimes Enforcement Network last year.  No details as yet on how in depth the updated manual and standalone sections on the Customer Due-Diligence Rule will address the extent to which financial institutions will have to obtain and verify beneficial ownership data from existing clients or which of the rule's provisions will be prioritized for enforcement. 

***

Useful Tools.  Our credit union industry friend, Andy Keeney, of Kaufman & Canoles, has provided you with these two useful resource tools:  NCUA's List of Required Policies for Board of Directors of Credit Unions and Credit Union Board Compensation by State.

***

Upcoming NAFCU Webcasts.

CUSO Rules and RegulationsWednesday, September 6 | 2:00 p.m. – 3:30 p.m. ET

BSA/AML Risk Assessment: Building a Program to Evaluate Risk and Ensure ComplianceTuesday, September 12 | 2:00 p.m. – 3:30 p.m. ET 

Vendor Management TrainingWednesday, September 13 | 2:00 p.m. – 3:30 p.m. ET

***

A Final Laugh.  Here, courtesy of Payments.com are a few quick stories of some incompetent bank robbers to hopefully give you a chuckle, because we all just need a laugh once in a while.

Law Enforcement to Financial Institutions: SARs Are Being Used to Put Away the Bad Guys; MLA Update

Written by Shari R. Pogach, Regulatory Paralegal

Last week, several of my NAFCU colleagues and I attended the 11^th Mid-Atlantic Anti-Money Laundering Conference, a multi- day symposium held here in Washington, DC, and presented by the FBI, ICE, U.S. Secret Service, IRS and DEA.  This conference is a useful one in that it gives financial institution attendees the opportunity to hear law enforcement cases that illustrate how the "bad guys" are using the U.S. financial system to launder their ill-gotten proceeds.  It's also helpful to hear that the information you all submit doesn't just disappear into a black hole. 

The information provided in Suspicious Activity Reports (SARs) is useful and appreciated.  During the conference, multiple law enforcement investigators noted how important SARs are to their investigations and in one illustrated case, a SAR was the actual trigger for the investigation.  Whether a SAR starts an investigation or enhances an ongoing one, law enforcement stresses that such information sharing is vital.

Some additional takeaways from the conference:

Trends in Red Flag Activity

• Third party service providers and facilitators are moving monies for everyone – the provider simply wants the commission.
• In some cases a third party may have been with an institution for years – look for a sudden spike in activity as it may now be being used as a shell company for money laundering.
• Newly created companies with a great deal of account activity could be a possible indicator of fraudulent activity.
• Sudden usage of dormant accounts – law enforcement sees dormant accounts as vulnerable for fraudulent activity.
• Trade based money laundering, such as textiles, phones, vehicles and electronics, is growing.
• Think about when your institution's systems are sleeping – this vulnerability was handily used in the Bangladesh Bank heist, i.e., weekends, holidays and time zone differences.
• Employee benefit plan and trust fraud – fraud is ripe in instances where there is a single plan administrator. Look out for transactions making no business sense or sudden stoppage of deposits as funds could be improperly rerouted. There is no reason for funds to be transferred out of a pension plan. 
• While it is not illegal for a doctor's office to accept cash payments, it is a little strange especially if the amounts are quite high.
• Commodity purchases are being financed through financial institutions with the repayments being made with drug proceeds. How often do you review your repayments as opposed to deposits?

Maintaining a Strong BSA/AML Program

• Be proactive, not reactive!
• Understand the nature and purpose of your member's business.
• What triggers the re-categorization of your member from low risk to high risk?
• Make sure your BSA staff has the proper stature and influence within your institution. They should be involved with product and member/customer development.
• Your internal controls must not remain static in conjunction with your institution's risk profile.
• Update and evaluate your systems continuously – the robustness and effectiveness must be ongoing along with ongoing validation of rules.
• There should be clear elevation protocols and procedures for reporting of issues.
• Geographic risk must also be taken into consideration even by smaller financial institutions.

***

MLA Update.  The Department of Defense informed NAFCU in a letter that, at this time, it would not delay its October 3 implementation date for credit card compliance under the Military Lending Act rule. More details can be found in this NAFCU Today story, here.

BSA Concerns: From Under-filing to Over-filing SARs

Written by Stephanie Lyon, Regulatory Compliance Counsel

First of all, I wanted to congratulate our newest class of NCBSOs! NAFCU wrapped its second BSA Seminar in beautiful Colorado last week where several questions were asked and concerns raised that are worth noting. Apparently, the latest issue with Bank Secrecy Act (BSA) examinations seems to surround examiners who believe credit unions may be over-filing Suspicious Activity Reports (SARs). FinCEN addressed this issue back in 2004 when it coined the term "defensive filing" to mean "when an institution files a suspicious activity report on an activity or transaction that really is not suspicious."

Prior to this over-filing concern, credit unions were criticized a couple of years ago for potentially under-filing SARs and CTRs. These over/under-filing concerns are leaving credit unions attempting to comply with BSA requirements feeling a little bit like this:

Before we attempt to understand examiners' concerns, let's start with the basics on SAR filings. Under the BSA, credit unions are required to file these reports in several circumstances. For example, credit unions must file a SAR for insider abuse involving any amount (insiders may include employees, officials, and managers). Credit unions are also required to file a SAR when there is a criminal violation of $5,000 or more and the suspect is known or can be identified. See, 31 C.F.R. § 1020.320(a)(2). In instances when the suspect is unknown, the credit union must file a SAR if the criminal violation amounts to $25,000 or more.

Other SAR triggers include transactions conducted or attempted by, at or through the credit union and aggregating $5,000 or more if the credit union suspects, or has reason to suspect that the transaction may involve potential money laundering or other illegal activity. The same requirement applies if the credit union suspects the member may be structuring to evade BSA reporting or if the transaction has no business or apparent lawful purpose. See, 31 C.F.R. § 1020.320(a)(2)(ii)-(iii). Aside from these required filings, the BSA also allows credit unions to file SARs to "report of any suspicious transaction that it believes is relevant to the possible violation of any law or regulation…" See, 31 C.F.R. § 1020.320(a)(1). This is commonly known as a catch-all provision.

Identifying suspicious activity requires some level of subjective judgement as what may appear suspicious account activity for one member may be normal or have a reasonable explanation for another account. Generally, the Bank Secrecy Officer or SAR committee is in the best position to make the judgment call as to whether transactions require a SAR or simply monitoring. For that reason, guidance from the FFIEC BSA/AML Examination Manual explains that examiners should ensure credit unions establish and implement risk-based policies, procedures and processes to comply with the Bank Secrecy Act instead of questioning individual determinations unless the decisions are egregious. Here is an excerpt from the manual regarding the amount of deference that should be given to SAR decision-makers:

"The decision to file a SAR is an inherently subjective judgment. Examiners should focus on whether the bank has an effective SAR decision-making process, not individual SAR decisions. Examiners may review individual SAR decisions as a means to test the effectiveness of the SAR monitoring, reporting, and decision-making process. In those instances where the bank has an established SAR decision-making process, has followed existing policies, procedures, and processes, and has determined not to file a SAR, the bank should not be criticized for the failure to file a SAR unless the failure is significant or accompanied by evidence of bad faith."

So it is clear for BSA examinations, the role of the examiner is not to comb through all credit union's SARs. Rather examiners are tasked with ensuring the credit union is effectively monitoring accounts and transactions, flagging suspicious activity, and reporting the activity per the SAR requirements. After all, FinCEN even recognizes that a "one-size fits all approach" is not appropriate for suspicious activity monitoring and reporting.

The takeaway here is that in the interest of complying with BSA laws, credit unions should ensure they are filing SARs whenever they suspect illegal activity is involved with an account or transaction(s). This is especially important as FinCEN's recent enforcement actions against financial institutions target BSA program failures to detect and report suspicious activity. For more in-depth information on enforcement actions, see NAFCU's quarterly BSA Blast (member log-in required).

 If your examiner feels the credit union is over-filing, this may be a good time to: (1) have a conversation about the appropriateness of the credit union's internal controls, policies and procedures to identify suspicious activity instead of defending specific decisions; and (2) review the SAR narrative to make sure it is effectively explaining why the activity appears suspicious and drawing contrast to the prior use of the account—which according to the FFIEC BSA/AML Examination Manual, examiners "should not criticize the [credit union's] interpretation of the facts."

Because We Will All Age...... A Primer on the Prevention of Elder Financial Exploitation and Abuse

Written by Shari R. Pogach, Regulatory Paralegal

Did you know that June 15 has been designated World Elder Abuse Awareness Day?  I didn't, that is, not until I attended the third global summit conference held here in Washington, DC, on the 15th.   While it seems as though the "Millennials" get all the attention these days, it's also important to remember that a significant portion of our population is getting older.  Some statistics shared by some of the summit speakers:  one in six of the population in Pennsylvania is over the age of 65; by 2019 there will be more people over the age of 60 than under the age of 18 in North Carolina; and over 80 million of the U.S. population will be over 60 by 2050. 

According to an article in the Federal Reserve System's Consumer Compliance Outlook: First Issue 2017, "roughly one in 10 seniors have suffered financial, emotional, physical, or sexual abuse or neglect in the past year, according to one study, with financial abuse occurring the most."  And as people get older, they may develop cognitive impairments, making them prime targets for financial exploitation.  Banks and credit unions are considered key players in helping to prevent and respond to elder financial abuse due to:

• Knowing their customers and members;
• Personal or face-to-face interaction with older consumers making transactions;
• The ability to detect suspicious account activity;
• Mandated to report suspected elder financial exploitation under many states' laws;
• BSA reporting.

In some cases financial institutions have raised concerns about state and/or privacy laws prohibiting them from disclosing a consumer's financial records to authorities and uncertainty as to the best way to proceed.  The article, Combating Elder Financial Abuse, looks to address these types of issues with a review of federal privacy laws, regulatory guidance and sound practices that can be adopted to help protect elderly customers and members from financial abuse.

Some community banks and credit unions are developing special programs oriented to providing age-friendly or safe banking products and services to their older clientele.  The National Community Reinvestment Coalition (NCRC) has a dedicated section on its website with information and recommendations on providing age-friendly or safe banking to protect older adults.  During the summit, a panel from the North Carolina State Employees' Credit Union (SECU) discussed their credit union's impressive program to protect and educate its senior members.  As it is mandatory in North Carolina to report any witnessed senior exploitation, SECU (North Carolina) has worked to educate its staffers on spotting and reporting potential abuse, as well as developing an estate planning and essentials program to help older members establish an affordable estate plan to help protect their economic future. SECU (North Carolina) is willing to share its expertise with other institutions, simply send an email to: [email protected].

As a reminder, here are some additional resources on developing best practices and responses to elder financial exploitation:

• The Consumer Financial Protection Bureau's Recommendations and Report for Financial Institutions on Preventing and Responding to Elder Financial Exploitation.
• Interagency Guidance on Privacy Laws and Reporting Financial Abuse of Older Adults.
• The Federal Trade Commission's Pass It On website page on scams.
• The National Credit Union Administration's The NCUA Report - NCUA's Resources Can Help Credit Unions Detect, Prevent and Report Elder Financial Abuse.

During the summit, a speaker who was a former New York prosecutor talked about a former case of elder financial exploitation.  The case was never brought to trial and sadly the victim died within a year of the abuse coming to light.  The speaker noted that in most instances older victims are extremely embarrassed about being victimized and although it can't be proven to be a direct cause, in most cases the victims die shortly thereafter. 

And, remember folks, we are all aging as you read this.

ICYMI: NCUA Second Quarter News Letter; New Procedures for External Audit Reports

Written By: André B. Cotten, Regulatory Compliance Counsel

Here in DC we have been experiencing an extended chilly, rainy spring, but I hope the weather is better wherever you are. In the month of May, NCUA issued its second quarter newsletter that detailed numerous topics, including but not limited to: consumer compliance risk indicators; share insurance; indirect lending; information security; the new MBL rule; and the fifth BSA compliance "pillar".

In today's blog, I've highlighted a few topics from the second quarter 2017 newsletter. I've also included a note about a recent NCUA Credit Union Express regarding new procedures for delivery and review of external audit reports.

Managing an Indirect Lending Program

Credit unions have increased their lending for both new and used automobiles over the last several years. A key aspect of this growth has been indirect auto lending. To be clear, an indirect lending relationship exists when members within the credit union's field-of-membership apply for credit directly through a car dealer.

Although this indirect lending relationship can be a convenient way of diversifying the credit union's loan portfolios, an indirect lending program does come with potential risks. According to the NCUA Report, a credit union may want to "establish clear expectations and have regular contact with participating dealers to ensure the program is being administered in accordance with the board of director's expectations for risk management."

Credit unions can make strategic decisions when managing an indirect lending program, such as:

• Establishing appropriate growth goals and concentration limits, along with minimum standards for creditworthiness;
• Monitoring the performance and risk-levels of the portfolio;
• Setting loan rates to ensure adequate profitability; and
  
• Taking early action to revise the program when adverse performance trends occur.

The NCUA Report contains a more detailed discussion about preventative management practices.

Credit unions may want to seek to understand the unique risks associated with indirect lending and have the expertise and processes in place to offer this service safely. The credit union will definitely want to monitor trends in the auto lending market, which is currently showing signs of increased credit risk, and regulator evaluating the effectiveness of a credit union's risk-management practices.

FinCEN Adds Fifth BSA Compliance "Pillar"

In 2016, FinCEN issued a final rule that imposed new requirements for identifying and verifying beneficial owners of legal-entity customers. This new rule, which amended the Bank Secrecy Act, became effective in July 2016, and all federally insured credit unions must comply fully by May 11, 2018.

This final rule added a fifth core element to the original four core elements of an effective BSA and anti-money laundering compliance program. Under the new rule, a credit union's program must now include this fifth core element:

• Risk-based procedures for conducting ongoing customer due diligence, to include, but not be limited to:
  • Understanding the nature and purpose of customer relationships for the purpose of developing a customer risk profile; and
  • Conducting ongoing monitoring to identify and report suspicious transactions and, on a risk basis, to maintain the update customer information.

Credit unions will need to develop and maintain compliance procedures to identify and verify the beneficial owners of legal-entity members. In preparation for the May 2018 implementation date, credit unions may want to review their "policies, processes, record-retention practices, information technology systems, employee training and other aspects of their BSA/AML compliance programs".

Please see these additional resources for more information:

“Customer Due Diligence Requirements for Financial Institutions,”

“Frequently Asked Questions Regarding Customer Due Diligence Requirements for Financial Institutions.”

Do You Need to Report an Information Security Incident?

Threats to information security range from unintentional human error to cyberattacks. Since members' sensitive information is constantly at risk, it is important that credit unions understand their reporting requirements when an information security incident occurs.

Regulatory Context

From a federal regulatory perspective, the Gramm-Leach-Bliley Act requires the NCUA Board to establish appropriate standards for federally insured credit unions relating to administrative, technical and physical safeguards for member records and information. Part 748 of NCUA's rules and regulations direct federally insured credit unions to establish a security program that incorporates Gramm-Leach-Bliley requirements and to detail response procedures to unauthorized access to member information.

Appendix B of Part 748 of NCUA's rules and regulations also directs a credit union's response program to contain procedures for notifying the appropriate NCUA regional director. According to the NCUA Report, the credit union may want to plan for the notification to occur as soon as possible after the credit union becomes aware of an incident involving unauthorized access to or use of sensitive member information. In addition, a federal insured, state-chartered credit union may also want to have procedures to notify its state supervisory authority.

Specifically, the preamble to the Federal Register notice for Part 748, Appendix B, states:

"The NUCA Board has concluded that the standard for notification to regulators should provide an early warning to allow [the] NCUA or applicable state supervisory agency to assess the effectiveness of a credit union's response plan, and, where appropriate, to direct that notice be given to members if the credit union has not already done so."

Note, "member information" is a defined term in Appendix A to Part 748, and the term "sensitive member information" is defined in Appendix B to Part 748.

In regards to Appendix B, NCUA Legal Opinion 06-0332 clarifies that "where an incident, even one involving sensitive member information, involves little or no likelihood of harm to the member, a credit union need not notify the NCUA." Consequently, the credit union's risk assessment of the incident is a critical component of your response program, and a material factor in your decision to notify the regional director.

Practical Application

According to the NCUA Report, credit unions may want to consider including details in their response programs concerning their notification procedures for members, regulators and other concerned parties.

To determine whether the regional director notification is warranted, the credit union may want to assess the inherent risk of the incident based on the information available. Then, if applicable, the credit union may want to consider any immediate mitigating actions it took to reduce the risk to the member. If the incident involves sensitive member information and presents the potential for harm (more than little-or no-likelihood of harm) to the member, the credit union may be prompted to notify the NCUA regional director. Federally insured, state-chartered credit unions may also notify their state supervisory authority.

Even if the credit union decided not to notify the NCUA regional director, the credit union may want to retain documentation of its risk assessment to demonstrate compliance with Part 748's reporting expectations.

The NCUA Report also details a best practice for the content of notifications to the NCUA regional director:

• The incident;
• The risk to the member or members;
• The corrective actions taken already;
• Any additional corrective or mitigation actions planned;
• Your coordination with law enforcement; and
• Any other relevant factors.

Note, state supervisory authorities may have their own notification requirements.

Lastly, the credit union may need to notify other parties, such as its insurance or bond company. Notifying your NCUA regional director does not replace other reporting requirements such as: filing a suspicious activity report, notifying the FBI or involving local law enforcement.

For more information, please visit the NCUA's Cybersecurity Resources Webpage.

***

New Procedures for External Audit Reports

Last month, NCUA issued a Credit Union Express that provided an overview of the new procedures for delivery and audit reports. NCUA has recently updated its policies governing how and when examiners will receive external audit reports. This updated procedure is meant to maintain better custody of audit reports. As the NCUA Credit Union Express mentions, "this new policy was created partly in response to a recommendation made by NCUA 's Office of Inspector General during a material loss review. The report recommended examiners obtain audit reports directly from the auditors rather than receiving them from credit union management to avoid any potential manipulation."

As an additional reference, please refer to the recently updated National Supervision Policy Manual (p.52/p.66 with PDF pagination): https://www.ncua.gov/Legal/GuidesEtc/GuidesManuals/SupervisionManual.pdf

FinCEN Gets Its Man – Former MoneyGram Compliance Officer Agrees to Settlement for BSA Violations

Written by Shari R. Pogach, Regulatory Paralegal, NCBSO

On May 4, 2017, the Financial Crimes Enforcement Network (FinCEN) and the U.S. Attorney's Office for the Southern District of New York announced a settlement with Thomas E. Haider, the former chief compliance officer of MoneyGram International, Inc. (MoneyGram). Haider was chief compliance officer for MoneyGram from 2003 to 2008. In that capacity he oversaw the company's fraud department and headed its AML compliance department.

As part of the settlement, Haider agreed to a three-year injunction from performing a compliance function for any money transmitter and to pay a $250,000 penalty.  According to FinCEN, Haider also admitted, acknowledged and accepted responsibility for not:  1) not terminating MoneyGram outlets after receiving information that strongly indicated these outlets were complicit in consumer fraud schemes; 2) not implementing  a policy for terminating outlets posing a high risk of fraud; and 3) structuring MoneyGram’s anti-money laundering (AML) program in way that that information  compiled by the company’s fraud department on outlets, including the number of reports of consumer fraud that particular outlets had accumulated over specific time periods, was not generally provided to the MoneyGram analysts  responsible for filing suspicious activity reports (SARs) on such activity.  

FinCEN initiated its action against Haider back in December 2014, with its announcement of a $1 million civil money penalty assessment and complaint filed in U.S. District Court to enforce the penalty and to prohibit Haider from employment in the financial industry.  Haider fought back by filing a motion to dismiss the suit.  In January 2016, a federal district court in Minnesota ruled that the Bank Secrecy Act (BSA) permits FinCEN to bring suit against individuals for willfully violating the BSA's AML program requirement.  Although the court denied his motion to dismiss, Haider continued to fight by filing a counterclaim in February 2016.  The government responded to Haider's counterclaim and the parties went back and forth through the end of February 2017, until all actions were concluded with the announcement of the settlement, which was approved by U.S. District Judge David S. Doty of the U.S. District Court for the District of Minnesota.

The Haider case has been an interesting one to watch as the government pushed to impose personal liability on compliance professionals over corporate-wide shortfalls.  A FinCEN spokesperson stated this was one of the largest fines ever imposed by FinCEN on an individual.  Acting FinCEN Director Jamal El-Hindi stated, "“FinCEN relies on compliance professionals from every corner of the financial industry. FinCEN and our law enforcement partners need their judgment and their skills to effectively fight money laundering, fraud, and terrorist financing. Compliance professionals occupy unique positions of trust in our financial system. When that trust is broken, it is important that we take action so that the reputations of thousands of talented compliance officers are not diminished by any one individual’s outlying egregious actions. We have repeatedly said that when we take an action against an individual, the record will clearly reflect the basis for that action. Here, despite being presented with various ways to address clearly illicit use of the financial institution, the individual failed to take required actions designed to guard the very system he was charged with protecting, undermining the purposes of the BSA. Holding him personally accountable strengthens the compliance profession by demonstrating that behavior like this is not tolerated within the ranks of compliance professionals.”

Old-Style Scams; Scam-Speak; Upcoming Webcast

Written by Shari R. Pogach, Regulatory Paralegal, NCBSO

I ran across these two enforcement case prosecution actions involving credit unions on the Internal Revenue Service (IRS) website. Criminals continue to think they won't get caught.  Go figure.  Remember real life cases can be useful when training your staff......

Money Laundering Investigation – Fiscal Year 2016

Texas Woman Sentenced for Structuring Financial Transactions

A Texas woman pled guilty to structuring transactions to evade reporting requirements.  According to court documents, the defendant was employed by the Dallas Independent School District (DISD), and received direct payroll deposits from DISD and from the Texas Comptroller Teacher Retirement System of Texas. From January 2007 through November 2009, she had a total of 10 deposits of $6,270 into her credit union accounts. Beginning in December 2009, the cash deposits into the woman's accounts increased dramatically. From January 2010 to late October 2013, the woman structured currency deposits to avoid the $10,000 currency reporting requirements. She made approximately 111 cash deposits totaling more than $580,000. Each deposit was made with the intent to avoid the currency reporting requirements and was part of a pattern of activity involving more than $100,000 in a 12-month period. Funds deposited into her account were used to purchase seven residential properties that she was required to forfeit to the government.  The woman was sentenced to 18 months in prison.

Financial Institution Fraud Investigation - Fiscal Year 2016

Former Credit Union Manager Sentenced for Embezzlement

According to court documents, for more than 15 years, a Michigan woman embezzled $1,945,000 from her employer, a federal credit union, by removing cash from its vault and placing it in her purse. She deposited some of the cash into credit union accounts she controlled, and took the remainder of it home to spend on her own use and enjoyment. She hid her activity by manipulating the credit union’s books and records.  The woman was sentenced to 78 months in prison, two years of supervised release and ordered to pay $1.9 million in restitution.

***

Scam-Speak.  We know that knowledge is power when it comes to fraud prevention.   Are you, your staff and members aware of these schemes used for identity theft and criminal fraud?

Keylogger:  A program that logs sequential strokes on a computer keyboard and sends them to hackers so they can figure out a person's log-in credentials.

Malvertising: Malicious online advertising that contains malware — software intended to damage or disable computers.

Man-in-the-Middle Attack: When a fraudster secretly intercepts and possibly alters messages between two parties who believe they are securely communicating with each other.

Ransomware: A malicious program that restricts or disables a person's computer, hijacks and encrypts files, and then demands a fee to restore the computer's functionality.

Scareware: A program that displays on-screen warnings of nonexistent infections on a person's computer or smartphone to trick a person into installing malware or buying fake antivirus protection.

Skimming: The capture of information from the magnetic stripe on credit and debit cards by "skimmer" devices that are secretly installed on card-reading systems at gas pumps, ATMs and store checkout counters.

Smishing: Phishing attempts that go to a person's mobile devices via text message, telling them to call a toll-free number. Named for SMS (short message service) technology.

Spoofing: Any situation in which a scammer masquerades as a specific person, business or agency, but typically meaning the manipulation of a person's telephone's caller ID to display a false name or number.

Vishing: Short for "voice phishing," the use of recorded phone messages intended to trick a person into revealing sensitive information for identity theft.   

***

Where Shari Was in the World.  In my last blog post I shared some pictures of recent travels.  I heard from several folks with their best guesses but for those still curious......  In order from top to bottom – photos 1 and 2 were taken in Doha, Qatar, where I stopped on my way to visit a friend who is working in Yerevan, Armenia, which are photos 3 and 4.  Photos 5 and 6 were both taken in Reykjavik, Iceland, where I went with a friend from credit union land.

***

NAFCU Webcast.

ACH Rules and Operational Guidance

Wednesday, May 10, 2:00 p.m. – 3:30 p.m. EST

• Learn third party sender registration rule passage and compliance requirements
• Explore Same Day ACH Phase One roll-out experiences
• Examine Phase Two and Three Same Day ACH rules and implementation requirements for ODFIs and RDFIs

FinCEN SAR Stats – Whatever Can They Tell Us?; Where in the World was Shari?

Written by Shari R. Pogach, Regulatory Paralegal, NCBSO

Last month, the Financial Crimes Enforcement Network (FinCEN) released Issue 3 of its SAR Stats Technical Bulletin.  The bulletin contains nationwide and individual state and territory Suspicious Activity Report (SAR) statistics from March 1, 2012, through December 31, 2016. 

So what do the statistics on depository institution SAR filings tell us?  First off, filings by depository institutions across the board continue to increase year by year.  As an example, credit unions filed a total of 94,582 SARs in 2016, up from 86,071 filed in 2015.

In ranking order for 2016, the three most prevalent payment types used in suspicious activity were:  U.S. currency; personal/business check; and funds transfer.  Money laundering, fraud and structuring continue to be the most prevalent types of suspicious activity identified, with a category of "other" types of suspicious activity consisting of 858,314 filings.  Under the "other" category, the top seven suspicious activities reported included: account takeover; bribery or gratuity; counterfeit instrument (other); elder financial exploitation; embezzlement/theft/disappearance of funds; forgeries and identity theft. 

So as the statistics reflect, the “bad guys” still work to use financial institutions to launder ill-gotten proceeds using many of the time-honored ways of attempting to get these funds “clean.”  Of course, when the old ways don’t work, the “bad guys” will look for other ways to launder money.  This USA Today news story discusses how the drug cartels built up a money laundering hub in Doral, Florida.    According to the story, “Federal agents say the criminal organizations use many methods to launder their money, including overseas bank wires and cash smuggling over the border. They also have turned to other laundering areas, like the garment district in Los Angeles and the jewelry centers in New York City, to clean millions in drug profits. But the export shops west of Miami remain among the oldest conduits in the country to launder money — and the most difficult to infiltrate and shut down.”

Basically in this instance the drug cartel set up a money laundering haven where a suburb near Miami “has been home to export shops that sprung up to meet a booming demand for laptops and cellphones in South America. Because of the ample office and warehouse space near Miami International Airport — the largest cargo hub in the nation serving Latin America — the number of export shops mushroomed.  Not only was it an ideal place to do business, but in time, it also came to serve the purpose of the criminal groups. Unlike traditional laundering that relied on the banks to hide ownership of the money, this was different. Under a system known as the "black market peso exchange," the drug groups turned to the exporters to launder their cash and make it more difficult to track.”  The exporters would receive cash, often in duffle bags, would then purchase and receive goods, and then paid the equivalent amount in pesos back the cartel. 

As the SARs statistics reflect and the Florida “black market peso exchange” illustrates, millions of dollars in illicit funds continue to be laundered through the U.S. financial system.  And, you are on the front lines to help prevent this.

***

On a more personal note, I've made a couple of trips to very different parts of the world within the last six months.  So my question to you is this, can you tell where in the world was Shari from these vacay snaps?

Prioritizing Your Efforts……. Superhero Style!

Written By Shereefat Balogun, Regulatory Compliance Counsel

 As compliance professionals, it's so hard being the good guy all of the time because there are so many things to focus on.   In the movies, the superhero has to choose between saving their partner, saving themselves, or completing the mission.  And of course, in the movies the superhero ends up somehow successfully doing all three.  Well, despite the common adage that "life isn't always like the movies", we can rise like the superhero by prioritizing our efforts and focus on the issues that our regulators are focusing on, specifically the CFPB and NCUA.

About three weeks ago, the CFPB issued its monthly report on consumer complaints.  Based on the report's findings, consumer debt collection continues to be a clear focus of the CFPB, as well as credit reporting. 

• Debt Collection- For a few years now, debt collection has been the source of most complaints submitted to the Bureau, and this report continues to highlight that. Debt collection was the most complained about product submitted in January 2017. Generally, consumers complain that collectors contacted them for debts that they do not owe; harass them by making multiple calls weekly or daily, or using false, deceptive, or misleading statements in connection with the debt collection; threatened to take illegal actions, such as arrests or seizure of the consumer's property; and impermissibly contacted or shared information with others, such as employers.  For more on the CFPB's efforts on debt collection practices, check out my previous blog on the topic here.

• Credit Reporting- The CFPB notes that the most common issues identified by consumers are problems with incorrect information on credit reports, which accounted for 76% of the complaints. Other issues identified include, the process for blocking and removing information resulting from identity theft.  The report states that consumers report notifying furnishers of information of identity theft with appropriate documentation, only to have accounts verified as accurate.  Notably, just two weeks ago, the Bureau issued its Supervisory Highlights which focuses on consumer reporting and concludes that the Bureau's work in the consumer reporting market is ongoing and remains a high priority.  Amongst its findings, the CFPB observes: 
  • Weaknesses in compliance management systems, such as weak oversight by management and the Board of Directors over furnishing practices; failure to update policies and procedures; weak training of employees who conduct furnishing and dispute handling operations; and weak monitoring and corrective action.
  • Absence of policies and procedures designed to: handle and investigate direct disputes from consumers; facilitate the creation and retention of documentation to substantiate final dispute decision; prevent duplicative or mixed reporting.
  • False representations by financial institutions in order to obtain a consumers' consumer report. For example, making false statements that a consumer had applied for a loan, and thus the institution had a permissible purpose to obtain the report.

These reports can be a useful tool, as they can help credit unions evaluate which products and services are more problematic and thus, should be addressed in order to avoid or mitigate regulatory risks. 

And let's not forget about our beloved…NCUA! The Supervisory Priorities for 2017 may be helpful in prioritizing our efforts.  Indeed, we referenced the 2017 priorities in a previous blog back in January.  Generally, the guidance informs credit unions of NCUA's primary areas of focus for 2017 as an effort to help prepare for this year's examination process.  As a reminder, this year's supervisory focus will be on:

• Cybersecurity- NCUA will continue to evaluate credit unions' cybersecurity risk management practices and encourages credit unions to use the Cybersecurity Assessment Tool (CAT) to bolster their security and risk management processes.  In case you may have missed it, NAFCU members can take advantage of a user-friendly workbook version of CAT here.
• Bank Secrecy Act Compliance- In 2017, NCUA field staff will focus on credit unions' relationship with money services businesses (MSBs) and other accounts that may pose a higher risk for money laundering.  NCUA expects credit unions to conduct appropriate due diligence, analysis, and monitoring when offering services to MSBs.  NCUA Letter to Credit Unions 14-CU-10 provides guidance on how credit unions can identify and mitigate risks associated with MSBs.
• Internal Controls and Fraud Prevention- NCUA field staff will continue to assess the adequacy of internal controls, as well as procedures and processes designed to prevent and control fraud.
• Interest Rate and Liquidity Risk- NCUA has started using a revised interest rate risk supervisory tool and new examination procedures to assess interest rate risk management practices.  For more information about the revised tool and new procedures, see NCUA Letter to Credit Unions 16-CU-08.  Also, examiners will focus on the relationship between interest rate risk and liquid risk.
• Commercial Lending- As you know, NCUA revised its Member Business Loans/Commercial Lending rule, which became effective January 1, 2017.  Field staff will evaluate a credit union's commercial loan policies and procedures and assess the risk management processes associated with managing a commercial loan portfolio.  NCUA warns that credit unions should be prepared to provide documentation to support management's ability to monitor and manage its commercial loan portfolio.  For more information, see NCUA Letter to Credit Unions 16-CU-11.
• Consumer Compliance- NCUA field staff will examine credit unions' compliance with the Military Lending Act (MLA), as well as the Servicemembers' Civil Relief Act (SCRA).  For more information on the MLA, see NCUA Letter to Credit Unions 16-CU-07.  NCUA Letter to Credit Unions 09-CU-12 provides guidance on complying with the SCRA. In particular, this enclosure provides a good overview of the SCRA requirements.

This month's Compliance Monitor, written by my colleague André Cotten, analyzes the NCUA's supervisory priorities for 2017 in more detail and highlights NCUA and NAFCU resources on each issue.  If you haven't checked it out already, please do!

"S..S..S.. on my chest 'cause I'm ready to save 'em."  Mantra of the year, Yes!!!  Be your credit union's superhero by focusing on the regulators' priorities to help save time, lives, and money.

As always, if you have any questions, please feel free to reach out to us.  We are here for you!

The Feds Might be Coming for Mary Jane

Written by Pamela Yu, Special Counsel for Compliance and Research

Since moving my family from the DC metro area to Denver last summer, curious friends and family have often asked about the marijuana industry out here in the Mile High City.  After eight months in beautiful Colorado, I can report that yes, we have a pot shop just up the street (actually, it's a pretty fancy "cannabis boutique") and yes, the marijuana industry in this state is booming and thriving.  In 2015 alone, Colorado reportedly collected more than $135 million in taxes and license fees related to legal marijuana sales, with more than $35 million of those funds earmarked for public school construction projects.  But is the Mary Jane Gravy Train about to find a major roadblock in its path?

The Trump Administration is signaling that a major shift in federal marijuana enforcement policy may be just around the corner.  As we have blogged about in the past, credit unions providing, or interested in providing, financial services to marijuana-related businesses already face significant legal, compliance and operational challenges, and these difficulties are about to get worse.

By way of background, to date, more than half the country—28 states in total—has legalized marijuana in some form at the state level.  Under the Controlled Substances Act (CSA), however, marijuana remains a schedule I controlled substance, which makes it illegal under federal law to manufacture, distribute, or dispense marijuana.  See, 12 U.S.C. §812(b)(1).  In addition, criminal provisions of federal money laundering statutes, unlicensed money remitter statutes, and the Bank Secrecy Act (BSA) remain in effect with respect to marijuana-related activity.  For example, it is a federal criminal offense to engage in certain financial and monetary transactions with the proceeds of a “specified unlawful activity,” including marijuana-related funds.  See, 18 U.S.C. §§ 1956 and 1957.  It is also a federal criminal offense to transact funds “derived from” marijuana-related activity by or through a money transmitting business. See, 18 U.S.C. § 1960.  Financial institutions that conduct transactions with funds derived by marijuana-related activity may also be subject to criminal liability for failing to identify or report financial transactions involving marijuana proceeds.  See, 31 U.S.C. §5318(g).

As such, financial transactions involving proceeds from marijuana-related activity can still form the basis for federal criminal prosecution, despite growing legalization under state law.  Due to this conflict between federal and state law, credit unions and banks have been challenged in providing financial services to marijuana-related businesses.  Financial institutions have also faced uncertainty about how they can provide services to marijuana-related businesses consistent with their BSA compliance obligations.  As a result, legal marijuana-related businesses remain largely unbanked and typically operate as cash-based businesses, increasing the risk of robbery and other crimes.  Several members of Congress have called for legislative and/or regulatory action to enhance financial access for legal marijuana-related businesses.  In response, under the Obama Administration, the Department of Justice (DOJ) issued "Cole" memos in 2013 and 2014 addressing marijuana enforcement, and the Financial Crimes Enforcement Network (FinCEN) in 2014 issued guidance on BSA expectations regarding marijuana-related businesses. Together, the DOJ memos and the FinCEN guidance created a path—albeit somewhat narrow—for credit unions to serve marijuana-related businesses consistent with their compliance obligations. 

However, recent comments from the White House and the attorney general are strongly hinting at a reversal from the previous administration's policy that the federal government would not direct its investigative and prosecutorial resources to states where marijuana is allowed under state law. 

In February, while drawing some distinction between medical and recreational marijuana, White House press secretary Sean Spicer indicated that "there is still a federal law that we need to abide by when it comes to recreational marijuana," and "I do believe you will see greater enforcement of it."

Meanwhile, during his Senate confirmation proceedings attorney general Jeff Sessions testified that, "I won't commit to never enforcing federal law," after previously stating, "good people don't smoke marijuana."

While still speculative at this point, a change in federal drug enforcement priorities could mean even greater uncertainty for credit unions already serving or looking to serve marijuana-related businesses. The DOJ memos and FinCEN guidance provided a framework for offering financial services to marijuana-related businesses but the fact remains that marijuana is still illegal under federal law.  At the end of the day, agency guidance and enforcement policies are not binding law.  The Trump Administration has full discretion and authority to overturn the DOJ memos and alter federal enforcement priorities with respect to marijuana-related activity.  If that happens, credit unions providing financial services to marijuana-related businesses are vulnerable to uncertain legal and compliance liabilities. 

Keep in mind that FinCEN's guidance relies on the enforcement posture articulated in the 2013 and 2014 DOJ memos:

FinCEN is issuing this guidance in light of recent state initiatives to legalize certain marijuana-related activity and related guidance by the U.S. Department of Justice (“DOJ”) concerning marijuana-related enforcement priorities. This FinCEN guidance clarifies how financial institutions can provide services to marijuana-related businesses consistent with their BSA obligations, and aligns the information provided by financial institutions in BSA reports with federal and state law enforcement priorities.

Accordingly, if federal law enforcement priorities change or the DOJ memos are repealed or revised, credit unions can no longer rely on the FinCEN guidance for serving marijuana-businesses, heightening BSA compliance risks.  It is also unclear at this point how NCUA would respond to any change in federal drug enforcement policy.  While the agency instructed its examiners to follow the DOJ and FinCEN guidance, all bets are off if the current White House reverses course, and NCUA will almost certainly comply with any new directives from the Trump Administration with respect to federal enforcement of marijuana-related activities.

A lot remains uncertain, but if your credit union is serving or looking to serve marijuana-related businesses, be sure to watch this space for updates on any further developments.  Also, as always, feel free to reach out the NAFCU Compliance Team with any questions.

Online Vehicle Fraud Scheme; Egregious BSA Violations; SAR Form Updates

Written by Shari R. Pogach, Regulatory Paralegal, NCBSO

Looking to buy a car?  Have I got a great deal for you! On March 1st, the Department of Justice (DoJ) announced the indictment of 19 individuals as a result of an international investigation into a transnational organized crime network.  Members of the crime network were charged with international fraud and money laundering conspiracies resulting in more than $13 million in losses from over 170 victims, primarily here in the United States. 

Amongst others, one of the alleged schemes involved online vehicle fraud.  Operating out of Europe, a criminal participant would advertise a car he did not own on the Internet.  Such cars were marketed on popular websites aimed at attracting buyers in the U.S. and offered at prices lower than those offered by legitimate sellers.  Then prospective buyers were instructed to deposit money by wire transfer into fraudulent bank accounts.  The monies were immediately withdrawn with the buyer never receiving the car.  According to the indictment at least 170 victims were induced to collectively transfer $4 million controlled by participants in the scheme.

***

Suspicious activity? What suspicious activity? The Financial Crimes Enforcement Network (FinCEN) announced a $7 million civil money penalty against Merchants Bank of California (Merchants) of Carson, CA.  In a nutshell, Merchants failed to fulfill and follow the Bank Secrecy Act (BSA) and anti-money laundering (AML) reporting and recordkeeping requirements. 

According to FinCEN, the bank allowed billions of dollars in transactions, many of which were conducted on behalf of money services businesses (MSBs) owned or managed by bank insiders. The bank specialized in providing services for check-cashers and money transmitters but did so without adequately assessing the money laundering risks or having an effective AML program. Nor did it conduct the required due diligence on its large portfolio of MSB customers in high-risk jurisdictions.  Staff personnel were encouraged to process the transactions without question or face potential dismissal or retaliation.  Bank insiders and leadership staff interfered directly with the BSA staff's attempts to investigate any suspicious activity concerning insider-owned accounts.  Inadequate monitoring of billions of dollars of transactions for suspicious activity meant the bank didn't timely file or even file suspicious activity reports (SARs) on hundreds of millions of dollars of transactions.  In a three-month period, it was found that Merchants processed a combined $192 million in high-risk wire transfers.

***

FinCEN seeks input on SAR form updates. FinCEN is updating and revising some of the fields in the SAR.  Specific changes involve the removal of some current fields and the addition of a category section for "Cyber-event." FinCEN states the data fields reflect the filing requirement for all filers of SARs under the Bank Secrecy Act.  Comments on the changes are due to FinCEN on or before April 3, 2017.

AML Violations Cost Western Union $586 Million; January 2017 BSA Blast

Written by Shari R. Pogach, Regulatory Paralegal, NCBSO

On January 19, 2017, it was announced that the Western Union Company (Western Union) had agreed to forfeit $586 million and enter into agreements with the Department of Justice (DoJ) and the Federal Trade Commission (FTC) for willful anti-money laundering (AML) violations.  Not only did Western Union fail to maintain an effective AML program, it violated the Bank Secrecy Act (BSA) by aiding and abetting wire fraud from 2004 to 2012 by processing hundreds of thousands of transactions for its agents and others involved in international consumer fraud schemes.

The coordinated investigations determined that Western Union agents were:  participating in activities to defraud tens of thousands of U.S. residents via various forms of mass marketing schemes promoting prizes or job opportunities; assisting in hundreds of millions of dollars being sent to China in structured transactions (a great deal of this money was sent by illegal immigrants to pay their human smugglers); and not limiting transactions indicating illegal gaming from Florida to other countries offshore sportsbooks.

On the same day the Financial Crimes Enforcement Network (FinCEN) announced its $184 million civil money penalty against a subsidiary of Western Union, Western Union Financial Services, Inc. (WUFSI) for violating the BSA’s AML requirements.  Specifically FinCEN determined that prior to 2012, WUFSI failed to implement and maintain an effective, risk-based AML program on foreign agents/outlets and to timely file suspicious activity reports (SARs).  The company was found not to have appropriate controls to “effectively mitigate its money laundering risks along the southwest border between the United States and Mexico.  For example, in not performing proper or enhanced due diligence, it was found that some former agents owned by persons formerly terminated by WUFSI for money laundering concerns were able to sign “new agent” agreements and continue to use the company’s money transfer system for their fraud and money laundering activities.  And, before 2012, WUFSI took over 90 days to investigate activity for which the company had the facts as a basis to file a SAR.  WUFSI filed thousands of SARs on customers of its agent locations but only filed such reports on the agent if found to be “complicit.”  Typically an agent was only found to be complicit if the agent was “arrested, publicly identified to be implicated in illicit transactions, or if WUFSI’s own investigation determined that the agent location was complicit.”  This also delayed reporting.

FinCEN determined that WUFSI willfully violated the program and reporting requirements of the BSA and its implementing regulations.  Its $184 million civil money penalty will be deemed satisfied by payment to the DoJ as part of the $586 million forfeiture for the victims of fraud. 

Western Union has also agreed to enhanced compliance obligations.  This includes creating policies and procedures: “for corrective action against agents that pose an unacceptable risk of money laundering or have demonstrated systemic, willful or repeated lapses in compliance; that ensure that its agents around the world will adhere to U.S. regulatory and AML standards; and that ensure that the company will report suspicious or illegal activity by its agents or related to consumer fraud reports.”

***

BSA Blast.  The January 2017 issue of the BSA Blast is available today. (NAFCU login required).  The articles in this issue cover:  the New York State Department Financial Services’ enforcement action against the Agricultural Bank of China for anti-money laundering rules and regulations violations; an example of the importance of updating Bank Secrecy Act compliance programs as an institution’s business model changes; and comments by the deputy director of the Financial Crimes Enforcement Network (FinCEN) on the agency’s current focus.  Also included is a BSA quiz that reviews FinCEN’s last four advisories issued for financial institutions.

2017 NCUA Examinations – Priorities and Exam Flexibility Initiative

Written by Brandy Bruyere, Director of Regulatory Compliance

Happy Wednesday! Many of you probably noticed that NCUA issued its annual Supervisory Priorities last week in Letter to Credit Unions 17-CU-01. Meanwhile, credit unions have had questions about the Letter to Credit Unions on NCUA’s Risk-Based Examination Scheduling Policy (16-CU-12). Today’s blog will provide a high level overview of these two pieces.

Supervisory Priorities. The 2017 Supervisory Priorities are not surprising, our old friends cybersecurity and Bank Secrecy Act compliance remain high on the list. For cybersecurity, NCUA is “encourage[ing] credit unions to use the Cybersecurity Assessment Tool,” (CAT)  and will be “enhancing the examination focus with a structured assessment process.”  In other words, making use of the CAT. NAFCU members can find our user-friendly workbook version of CAT here.

NCUA will also focus on the following:

• internal controls and fraud prevention, including controls for insider fraud
• interest rate and liquidity risk
• commercial lending, including evaluating a credit union’s commercial loan policies and procedures and assess the risk management processes used to manage portfolios
• Military Lending Act compliance

NCUA includes various resources in the letter, but some of these topics like commercial lending/member business lending and interest rate risk are addressed in the updated version of the Examiner’s Guide.

Risk-Based Examination Scheduling Policy. Last month, NCUA issued another Letter to Credit Unions providing some information about its examination flexibility initiative and its efforts to move to an extended examination cycle for some credit unions.

Federally chartered credit unions. Federal credit unions meeting certain eligibility requirements will qualify for an extended exam cycle of 14 to 20 months from the prior examination completion date:

• Assets less than $1 billion;
• CAMEL code 1 or 2, in both the composite rating and the management component rating;
• “Well capitalized” under prompt corrective action (PCA) regulations;
• No outstanding documents of resolution (DOR) items related to significant recordkeeping deficiencies; and
• Not operating under a formal or informal enforcement or administrative order, such as a cease and desist order (C&D), letter of understanding and agreement (LUA), preliminary warning letter (PWL), or a PCA directive.

However, “small credit unions with limited segregation of duties that are otherwise eligible for an extended exam cycle may receive more frequent examinations on a random sample basis.” Also, while NCUA anticipates a full transition to this exam cycle for eligible FCUs within two years, some credit unions may receive examinations earlier than the 14 to 20 month timeframe. This means some credit unions will still have their next exam in the current shorter timeframes. Here is one of the FAQs NCUA issued on the exam flexibility initiative:

“When will eligible credit unions begin the longer, extended cycle?

While some credit unions will begin the new cycle on January 1, it could take up two years to be fully phased-in. NCUA’s regional management team is working on a plan to ensure consistent application across the country. While some exams may need to be performed on an annual basis, others will start to move to a longer cycle in line with the lower range for eligible credit unions. This is similar to what we planned for and experienced when the agency adopted risk-based scheduling in 2001, and an annual examination in 2009.”

What about federally-insured state chartered credit unions? Federally-insured state charters that meet any one of the following three criteria will receive NCUA exams between 8 to 12 months from the prior examination completion date:

• Assets greater than $1 billion;
• NCUA CAMEL code 4 or 5, with assets greater than $50 million; or
• NCUA CAMEL code 3 with assets greater than $250 million.

All other federally-insured state chartered credit unions will be examined by NCUA “based on risk, but no less frequently than once every five years.”

NCUA also states the agency “will make every effort” to conduct its examination jointly with the credit union’s state supervisory authority. To facilitate this, “a joint NCUA-state supervisory working group is being formed” to consider issues like improved coordination of joint exams, reducing redundancy with exam and supervisory approaches, and evaluate the “appropriateness and feasibility” of alternative examination approaches.

Other Changes. NCUA will also implement the following changes in 2017:

• Providing at least four weeks advanced notice when scheduling an exam, unless concerns at the credit union warrant shorter or no notice;
• Improving coordination of document requests tailored to the credit union’s risk profile and products; and
• Separating and emphasizing pre-exam planning & scoping from the beginning of onsite exam work.

***

Get the Latest News from Washington DC. Worried about staying up to date given the changes in Washington? Subscribe to NAFCU Today, our free, daily enewsletter that provides up-to-date information on key legislative, regulatory and compliance issues facing credit unions.

Programming Note – Inauguration Day. Did you know that Inauguration Day is a federal holiday in the DC metro area? As a result, NAFCU will be closed this Friday and back to blogging on Monday. And shake your head at us if you want, but if you’ve seen our traffic on a regular day, it can be almost impossible to get around town when swearing in a new president.  

Should Credit Unions Photocopy Identification Cards?

Written by Shereefat Balogun, Regulatory Compliance Counsel

So last week, I attempted to take some cash out of my credit union’s ATM but the customer in front of me had a bunch of checks she had to deposit and took forever.  I decided to walk into the branch and ask for the cash withdrawal.  The teller asked me for my driver’s license or any similar ID. I told her that I did not have any ID on me (don’t judge me!), but I had my ATM/debit card.  The teller said she would be able to process my request only if the credit union had a copy of my ID on file.  While I understood the benefits of having the copy on file, I could not help but to think about the different compliance issues this raises.  Yes, the copy of the ID is great for verifying your members’ identity or helping to detect fraud.  However, it got me thinking about compliance issues relating to IDs, such as military IDs and fair lending concerns.  Contrary to what we’ve been taught, what’s good for the goose is NOT always good for the gander. 

Bank Secrecy Act and CIP Recordkeeping

The Bank Secrecy Act requires a credit union to know its member (KYC or KYM whichever lingo you prefer) and have a customer identification program (CIP). This includes checking a government identification number, which can be done with documentary evidence like an ID.  So collecting the ID to verify the information is one thing.  But should a credit union keep a copy of the ID in its records?  For recordkeeping purposes, the CIP rule leaves it up to the credit union to determine how it wants to document verification that has been performed.  Generally, the rule requires a credit union to retain a description of the document that was relied on, noting the type of document, any identification number contained in the document, the place and date of issuance, and expiration date.  So, a description is generally sufficient.  Though the credit union may retain a copy of the ID, it certainly is not required.  See, 31 C.F.R. §1020.220(a)(3)(i)(B).  This is also confirmed in FinCEN’s Guidance on Customer Identification Regulations FAQs:

2. Can a bank keep copies of documents provided to verify a customer’s identity, in addition to the description required under 31 C.F.R. § 103.121(b)(3)(i)(B), even if it is not required to do so?

Yes, a bank may keep copies of identifying documents that it uses to verify a customer’s identity. A bank’s verification procedures should be    risk-based and, in certain situations, keeping copies of identifying documents may be warranted. In addition, a bank may have procedures to keep    copies of documents for other purposes, for example, to facilitate investigating potential fraud…

(Emphasis added.)

Keep in mind though, that although there are no federal regulations prohibiting a credit union from photocopying ID, some states prohibit photocopying IDs.  Be sure to check with your individual state law to see if there are any limitations here.

But wait…what about military IDs?  Good question!  While a credit union may use a military ID to collect identifying information for CIP purposes and other purposes, it cannot copy the ID for CIP purposes.  Federal law generally prohibits the copying or scanning of military ID:

Whoever manufactures, sells, or possesses any badge, identification card, or other insignia, of the design prescribed by the head of any department or agency of the United States for use by any officer or employee thereof, or any colorable imitation thereof, or photographs, prints, or in any other manner makes or executes any engraving, photograph, print, or impression in the likeness of any such badge, identification card, or other insignia, or any colorable imitation thereof, except as authorized under regulations made pursuant to law, shall be fined under this title or imprisoned not more than six months, or both.

(Emphasis added.)

As stated above, photocopying military ID can subject a person to fines and imprisonment up to 6 months.  If your BSA/CIP program permits the photocopying of military ID identification, you may want to reassess your CIP requirements. 

To emphasize, the statute prohibits the photocopying the military identification card.  For CIP purposes, it’s our understanding that some credit unions document information found on the military ID since they are unable to make a copy.  This practice is consistent with the CIP recordkeeping requirement discussed above. 

Fair Lending Concerns

So we’ve established that it is customary to collect and retain a copy of a driver’s license for CIP purposes.  However, for purposes of Regulation B and other fair lending laws, credit unions may want to keep that copy out of the member’s loan application file.  For example, Regulation B prohibits financial institutions from considering certain information when evaluating an application and making a credit decision.  Indeed, the FinCEN FAQ highlighted above also warned:

Nonetheless, a bank should be mindful that it must not improperly use any document containing a picture of an individual, such as a driver’s license, in connection with any aspect of a credit transaction.

(Emphasis added.)

Regulation B and Regulation C require a credit union to collect certain information for monitoring purposes.  For instance, Regulation B requires a credit union that receives a credit application to collect certain information, such as ethnicity, sex, and age.  See, 12 C.F.R. §1002.13(a).  Similarly, Regulation C requires a credit union to collect certain data in relation to applications for home purchase loans, home improvement loans, and refinancings.  This information includes information about the ethnicity, race, and sex of the applicant or borrower.  See, 12 C.F.R. §1003.4(a)(10).  When collecting this information, a credit union may list questions regarding the ethnicity, race, and sex of the applicant on the loan application form, or on a separate form that refers to the application.  See, Appendix B to 12 C.F.R. Part 1003.

Although neither rule explicitly instructs credit unions to refrain from maintaining a copy of a driver’s license from a loan file, doing so may increase your fair lending risks, and may lead to examiner scrutiny.

As always, if you have any questions about this blog or any other compliance issue, please feel free to reach out to NAFCU’s Regulatory Compliance Team.  We’re here for you!

OFAC 2016 Fall Symposium: Round-Up of Recent Sanctions

By Stephanie Lyon, Regulatory Compliance Counsel

The U.S. Department of the Treasury’s Office of Foreign Assets Control (OFAC) held its fall symposium in Washington DC, on Wednesday, December 7th. Among the items discussed in this meeting were the recent changes to the Iran and Cuba sanctions and the elimination of the Burma and Côte d'Ivoire sanctions. As the end of the year is approaching, this is the perfect time to highlight some of OFAC’s recent activities. For a comprehensive list of active OFAC sanctions, visit the Sanctions Programs and Country Information Resource Center. Guidance documents are constantly updated so remember to check back with OFAC for up-to-date information.

Iran Sanctions and JCPOA Announcement

Back in 2015, key nations reached a Joint Comprehensive Plan of Action (JCPOA) to ensure that Iran’s nuclear program was implemented with only peaceful intent. On January 16, 2016, the International Atomic Energy Agency (IAEA) verified Iran’s implementation of key nuclear-related measures specified in the JCPOA. Upon verification from the IAEA, the United States lifted nuclear-related sanctions on Iran. What does this mean for credit unions? The JCPOA provisions included removals of Specially Designated Nationals (SDNs) and Blocked Persons List, the Foreign Sanctions Evaders List and the Non-SDN Iran Sanctions Lists which hopefully translates to less false positives. For more information on Iran’s sanctions and the JCPOA, visit the Iran Sanctions Resource Center webpage.

Cuba Sanctions

In 2014, President Obama historically announced the re-establishment of diplomatic relations and an easing of economic and travel restrictions on Cuba. As more Americans are able to travel to Cuba, credit unions began asking a question not considered in 5 decades—whether a credit union can serve members while in Cuba. To assist financial institutions, OFAC published over 100 FAQs that were recently revised in October of this year. Here are a couple of questions pertaining to financial institutions answered in the FAQ guidance:

46. Are authorized travelers in Cuba permitted to use credit or debit cards issued by a U.S. financial institution?

Yes. Travelers are advised to check with their financial institution before traveling to Cuba to determine whether the institution has established the necessary mechanisms for its issued credit or debit cards to be used in Cuba. See 31 CFR § 515.560(c)(5) and 515.584(c).

[…]

61. Is a financial institution required to independently verify that an individual’s travel is authorized when processing Cuba travel-related transactions?

No. A financial institution may rely on U.S. travelers to provide their certifications of authorized travel directly to the person providing travel or carrier services when processing Cuba travel-related transactions, unless the financial institution knows or has reason to know that the travel is not authorized by a general or specific license.

The [Cuban Assets Control Regulations] (CACR) requires persons subject to U.S. jurisdiction providing travel or carrier services to retain for at least five years from the date of the transaction a certification from each customer indicating the section of the CACR that authorizes the person to travel to Cuba. See § 515.572(b). U.S. travelers utilizing a general or specific license are also required to retain for five years records associated with their travel to Cuba.

For more information, guidance and resources on the Cuban Assets Control Regulations, visit the Cuba Sanctions Resource Center.

Elimination of Côte d'Ivoire and of Burma Sanctions

Years ago, Burma and Côte d'Ivoire were plagued with national security, human rights and other internal issues that prompted the United States to enact sanctions against these countries.  After lengthy work by several international organizations both countries held successful presidential elections and moved towards the stabilization of their nations.  On September 14, 2016, after the United Nations Security Council determined Côte d'Ivoire’s emergency situation was resolved, President Obama ended the sanctions program against this nation. See, Côte d'Ivoire Sanctions Resource Center. Similarly, in October 7, 2016, the President signed an Executive Order terminating the emergency with respect to the actions and policies of Burma. See, Burma Sanctions Resource Center.

My favorite quote of Wednesday’s meeting occurred when a panelist discussing the recent elimination of OFAC sanctions simplified the conversation by stating:  “the sanctions for Burma and Côte d'Ivoire are over, let’s just move on.” For credit unions, this means these two countries can now participate in financial markets again which may mean an increase in wire transfers to and from these countries.

OFAC ProTips

Apart from the updates concerning sanctions there were other key takeaways from the symposium:

1. OFAC does not have a requirement that credit unions have a compliance program; rather it recommends a risk-based approach to OFAC compliance. Credit unions may want to keep in mind that regardless of its OFAC approach, if the credit union facilitates a prohibited transaction it will have an OFAC violation. Some resource credit unions may use when assessing an OFAC program are: 
   • NCUA Examiner’s Guide, Ch. 18 (OFAC specific guidance within Bank Secrecy Act section)
     
   • NCUA FCU Handbook, pp. 54-55 (lists NCUA expectations for OFAC compliance)
     
   • NCUA Letter to Credit Unions 05-CU-09 (NCUA acknowledged that while both BSA and OFAC compliance are integral to any anti-money laundering program)
     
   • NCUA Letter to Credit Unions 01-CU-25 (NCUA developed an examiner checklist that may be use to document the review of a credit union’s OFAC compliance program)
     
   • FFIEC BSA/AML Examination Manual, OFAC section & App. M. (OFAC core examination procedures and risk matrix)
2. When identifying names on the SDN or other lists, it may be necessary to search more than just OFAC provided information or resources. This is where the credit union’s risk assessment and subsequent due diligence is key in determining its policies and procedures.
3. If unsure, ask! OFAC has published many resources such as interpretative documents and FAQs to its sanctions programs. It also has an OFAC Compliance Hotline ready to assist. The speakers did emphasize the need for credit unions to provide as much detail as possible when submitting questions to the helpline, especially if the credit union wants to receive a timely response. You can find the contact information for the Hotline here.

***

Upcoming NAFCU Webcast

What's New in the updated FFIEC Cybersecurity Handbook

Live Webcast Tuesday, December 13, 2016 | 2:00-3:30 p.m. ET

• Explore governance of the Information Security Program, including security culture, responsibility and accountability, and resources
• Learn about Information Security Program management, including identification, measurement, mitigation and monitoring
• Discuss Security Operations such as identification, assessment, and threat monitoring
• Measure Information Security Program effectiveness
  

Stay Vigilant Folks – The Bad Guys Can Be Anywhere…….

Written by Shari R. Pogach, Regulatory Paralegal, NCBSO

A government report on money laundering and terrorist financing threats indicates that more than $300 billion in concealed transactions is moved around the United States.  To help combat this growing money laundering threat, the FBI announced the addition of more resources to its Money Laundering Union in the Criminal Investigative Division.  This specialized unit will focus on the professional middlemen who help hide this flow of cash such as lawyers, accountants and brokers.

The FBI website also offers a list of common fraud scams along with tips to help prevent being victimized by such schemes.  Take a look as your members may be susceptible to some of these very scams. 

Here are a few recent cases concerning money laundering and financial fraud from the FBI’s press releases:

Former Scott Credit Union Commercial Loan Officer Sentenced to Prison on Convictions for Fraud, Misapplication, Money Laundering and False Report

Theodore J. Longust, age 51, formerly from Columbia, Illinois, was sentenced to a total of 121 months in prison as a result of his convictions in a nine-count indictment. Longust was an employee of Scott Credit Union in the commercial loan department from November 7, 2005 through December 8, 2014, as its business relationship manager. He embezzled credit union funds by creating fraudulent loans, paying loans by the misapplication of funds from other loans, increasing credit limits on loans that did not have the requisite board approval, issuing business loans without the required documentation or security and issuing letters of credit without the required documentation and security. Longust also knowingly submitted a false report to the credit unon for the third quarter of 2014 that misstated loan balances and omitted loan amounts and underreported loans of over $12,000,000. There was evidence at sentencing that the overall loss to Scott Credit Union, which included criminal and civil losses, was approximately $25.8 million. Criminal direct losses were determined to be $13,719,947.21. The court ordered Longust to pay restitution of $5,012,362.52 to the credit union and $9,114,560.69 to CUMIS Mutual, its bonding company. The safety and soundness of Scott Credit Union has not been adversely affected by the criminal conduct.  

Former Assistant Vice President of Bank Sentenced To Over Six Years in Prison for Embezzling More Than $1 Million

A Bergen County, New Jersey, woman was sentenced to 81 months in prison for embezzling more than $1 million while she worked at a bank in Fort Lee, New Jersey. Miye Chon, a/k/a/ “Karen Chon,” 36, was employed by BankAsiana, a federally insured financial institution, as an operations officer and later as an assistant vice president and operations officer at the Fort Lee branch until the bank was acquired by Wilshire Bank in October 2013. She had access to customer accounts and the bank’s internal account records, computer system and vault. Over several years, Chon stole more than $1 million from the bank’s customer accounts by regularly making unauthorized transfers from customer certificate of deposit (CD) accounts into BankAsiana’s vault cash account and then physically removing cash from the bank’s vault.

She did this on dozens of occasions, typically taking tens of thousands of dollars at a time. One time, she converted $100,000 from a customer’s CD account. As part of the scheme, Chon also opened up a bank account in an individual’s name and forged checks using that individual’s name without permission.

Bank Loan Officer Who Demanded Kickbacks as Part of Multi-Million Dollar Mortgage Fraud Scheme Sentenced to Federal Prison

Paul Ryan, 49, a former loan officer at Broadway Federal Bank, who took more than $350,000 in kickbacks in exchange for considering mortgage applications submitted by churches in relation to a fraud scheme that resulted in losses of at least $4.2 million, was sentenced to 18 months in federal prison. During the time he worked at the bank, from early 2007 until March 2010, the bank paid rebates to brokers who brought loans applications to the bank. Ryan “demanded from the brokers that all or part of that rebate amount be paid to him...intending to be rewarded and influenced in his processing and approval of these church loans,” according to court documents. He worked with the brokers and provided a template for presenting financial information for the churches that ensured the loan applications would be approved. Based on this false information, the bank issued loans to the churches.

Jury Finds Texas Lawyer and Others Guilty Of International Money Laundering and Fraud Conspiracies

According to court documents, Perry Don Cortese (53, Little River, Texas), Priscilla Ann Ellis (51, Killeen, Texas) and Kenietta Rayshawn Johnson (35, Leavenworth, Kansas) were members of an international criminal organization that defrauded dozens of victims across the United States and then laundered the funds, much of it sent overseas.  Many victims were law firms solicited online to perform legal work, provided counterfeit cashier’s checks for deposit into the firms’ trust accounts, and then directed to wire money to third-party shell businesses controlled by the conspirators.  Others were title companies defrauded in phony real estate transactions.  Other victims were targeted and defrauded by fake suitors on dating websites.  Hackers were also hired to compromise both individual and corporate email accounts, ordering wire transfers from brokerage and business accounts to shell accounts controlled by conspirators.

Victims were instructed to wire money into funnel accounts held by “money mules.” The funds were then quickly moved to other accounts in the U.S. and around the world before victims could discover the fraud.  Bank records presented at trial indicate that, from 2012 to 2015, several millions dollars’ worth of wires were received.  Conspirators in Canada, Nigeria, South Korea, Senegal and elsewhere helped coordinate the fraud and money laundering activity from abroad.

Cortese, a licensed attorney in Texas, worked for the conspirators by laundering victim money through his interest on lawyers trust accounts (IOLTAs).  He also met with individuals in person to retrieve cash withdrawn from receiver accounts. Cortese recruited his paralegal and others to open such accounts to launder funds.  The evidence further showed that Johnson, then a bank employee at Capital One, helped create counterfeit checks and monitor money flows between accounts controlled by conspirators.

These cases serve as a reminder that compliance officers must always be:  semper vigilans!  

FinCEN Advisory on Cyber-Events and Cyber-Enabled Crime Part 2 - What Should Be Reported in a Cyber-Related SAR

Written by Shari R. Pogach, Regulatory Paralegal, NCBSO

As we’ve previously blogged, last week the Financial Crimes Enforcement Network (FinCEN) issued FIN-2016-A005, its guidance to financial institutions on reporting cyber-related events and cyber-enabled crime.  So what kind of information should a credit union include in a suspicious activity report (SAR) when reporting such activity? 

First, FinCEN reminds filers that SARs are to be complete, accurate and incorporate all relevant information regarding suspicious activity, including cyber-related information.  Why?  Since today’s financial transactions increasingly occur through the use of electronic systems and resources, any illicit financial activity will often have a digital footprint leading back to the individuals, their associates, their activity and any related suspicious transactions.  So any SAR (including a voluntary SAR) should include any available cyber-related information reporting any suspicious activity. Examples of cyber-related information include:  IP addresses with time stamps, virtual-wallet information, device identifiers and cyber-event information. FinCEN states that financial institutions should document and give a detailed description of the suspicious activity reported.  SAR narratives should include descriptive cyber-related information as well as any cyber-related identifiers where there is not a pre-designated SAR field.

So when possible a cyber-related event SAR should include:

• Description and magnitude of the event
• Known or suspected time, location, and characteristics or signatures of the event
• Indicators of compromise
• Relevant IP addresses and their timestamps
• Device identifiers
• Methodologies used
• Other information the institution believes is relevant

FinCEN’s advisory includes an attachment of frequently asked questions (FAQs) with specific details and technical specifications on completing SARs concerning cyber-events and cyber-enabled crime.  The agency states these FAQs supersede its 2001 FAQs on computer intrusion as the new document provides new information and additional details. As one example, the new guidance notes that cyber-events and cyber-enabled crime can involve event-specific information.  Still, FinCEN requests that SAR filers be consistent and use common and accepted terminology.  One resource filers can use is the Glossary of Key Information Security Terms (May 2013), a publication issued by the National Institute of Standards and Technology (NIST).  The guidance also clarifies how a financial institution is to report when it experiences numerous cyber-events; what it should do in instances of continuous scanning or probing of an institution’s systems or network; and whether to report when an otherwise reportable cyber-event is unsuccessful.

FinCEN recommends institutions circulate the advisory with: cybersecurity units, network administrators, risk departments, fraud prevention units, BSA/AML management, AML intelligence units and AML analysts/investigators. According to the agency, it is not* creating any new obligation or expectation requirement for financial institutions to collect cyber-related information as a matter of course. (*wink)

FinCEN Advisory Alert: SARs Required for Certain Cyber Activity + Compliance Trivia!

Written by Shereefat Balogun, Regulatory Compliance Counsel

Woah, we’re ending cyber security month with a bang!  Just last week, we blogged on the two massive cyberattacks that hit Netflix, Amazon, PayPal, Twitter, and others.  In the wake of the increasing attacks, FinCEN recently issued an advisory outlining credit unions’ SAR obligations as they relate to cyber-events and cyber-enabled crime.

As many may know, especially those who just earned the NAFCU Certified Bank Secrecy Officer designation (woo hoo!), any illegal or suspicious activity can form the grounds of a SAR (Suspicious Activity Report, or as was used throughout our BSA Seminar “Something Ain’t Right”) filing. In certain cases credit unions are required to file a SAR.  In particular, when criminal or suspicious activity from someone outside of the credit union that totals $5K or more and you have a suspect, you must file a SAR. For criminal or suspicious activity from an outsider totaling $25K or more, even if the credit union can’t identify a potential suspect, the credit union is required to file a SAR.  See, 12 C.F.R. 1020.320.

Since cyber events targeting financial institutions often constitute criminal activity, FinCEN is requiring credit unions and other financial institutions to report cyber-events and cyber-enabled crimes. The advisory is careful to say that this “does not change existing BSA requirements or other regulatory obligations” and credit unions “should continue to follow federal and state requirements and guidance on cyber-related reporting and compliance obligations.” But as applied to cyber-events and cyber-enabled crimes, the advisory clarifies that credit unions are required to report a cyber-event that involves $5,000 or more.  The advisory generally defines a “cyber-event” as an attempt to compromise or gain unauthorized electronic access to electronic systems and information.  The advisory further defines a “cyber-enabled crime” as illegal activities, such as fraud, money laundering, or identity theft, carried out by electronic systems and devices.

Unlike money laundering and terrorist financing or other financial crimes, the dollar amount at stake in a cyber-event or cyber-enabled event may not be readily apparent.  But based on the guidance and examples used, it appears that just about any unauthorized access that exposes or compromises member accounts could qualify as activity that would trigger the SAR obligation where the credit union “reasonably suspects” the amount at stake meets an applicable SAR threshold .  The FinCEN advisory states that in determining the dollar amount involved in the cyber-event, the credit union should consider the funds and assets involved in or put at risk by the cyber-event.  The advisory provides non-exhaustive examples of situations in which SAR reporting of cyber-events is mandatory:

Example 1: Through a malware intrusion (a type of cyber-event), cybercriminals gain access to a bank’s systems and information. Following its detection, the bank determines the cyber-event put $500,000 of customer funds at risk, based on the system s and/or information targeted by the cyber-event. Accordingly, the bank reasonably suspects the intrusion was in part intended to enable the perpetrators to conduct unauthorized transactions using customers’ funds.

The bank must file a SAR because it has reason to suspect the cybercriminals, through the malware-intrusion, intended to conduct or could have conducted unauthorized transactions aggregating or involving at least $5,000 in funds or assets. As explained in the next section, the bank should include all available information in the SAR relevant to the suspicious activity, including cyber-related information such as a description and signatures of the cyber-event, attack vectors, command-and-control nodes, etc.

Example 2: Through a cyber-event, cybercriminals gain access to a financial institution’s systems/networks. The cyber-event exposes sensitive customer information such as account numbers, credit card numbers, balances, limits, scores, histories, online-banking credentials, passwords/PINs, challenge questions and answers, or other similar information useful or necessary to conduct, affect, or facilitate transactions.

By evaluating the cyber-event and the type of information sought by its perpetrators, the financial institution reasonably suspects the cyber-event may have targeted information for the purpose of conducting, facilitating, or affecting transactions aggregating to at least $5,000. For instance, the financial institution could reasonably suspect the cybercriminals intended to steal and sell the exposed sensitive customer information to other criminals for financial exploitation to include unauthorized transactions at the institution. As further described below, the targeted financial institution should file a SAR to report all relevant information, including cyber-related information and information pertaining to any related unauthorized transactions.

The advisory also notes that credit unions should, in addition to the requirements set forth in the advisory, be familiar with existing guidance and NCUA’s cyber-related SAR-filing obligations. For example, in December 1997, NCUA issued Regulatory Alert, No. 97-RA12, providing guidance for reporting computer-related crimes.

As I mentioned during my presentation last week, BSA is sometimes said to be one of the most burdensome set of rules.  And this new advisory seems to add more to our reporting obligations.  But, as we emphasized during each session of the BSA seminar, BSA compliance officers are the gatekeepers who can help reduce the risk of a credit union being used to accomplish these financial crimes, and help law enforcement detect and stop them.  

We will publish another blog detailing the information that needs to be included in a cyber-related SAR filing.

Trivia Question: What are the timing requirements for a SAR filing? When does the clock start? Books/Manuals closed!

Dispelling Those Pesky BSA Reporting Myths; October BSA Blast; Programming Note

Written by Shari R. Pogach, Regulatory Paralegal

In August, Thomas P. Ott was selected to the associate director of enforcement for the Financial Crimes Enforcement Network (FinCEN).  In this capacity, Mr. Ott oversees FinCEN’s Bank Secrecy Act (BSA) compliance and enforcement program.  During a speech given a gaming industry conference in Las Vegas, Nevada, Mr. Ott talked about the importance and high value of Suspicious Activity Reports (SARs) to law enforcement and to regulators.  He specifically wanted to dispel some of what he referred to as the “common ‘myths’ and misconceptions” about SAR filings.  Although the speech was oriented to the gaming industry, I thought his comments would also be of interest to the BSA compliance folks in credit union land.

 “Myth #1: No one reads the SARs we file.

I can understand the origin of this myth. Everyone wants to know and be sure that their SAR filings are serving their purpose; assisting law enforcement investigations and stopping illicit behavior. There are certainly important reasons for some of the silence on this: SAR confidentiality, law enforcement sensitivities, intelligence concerns, among other reasons all can make it difficult to give feedback on specific filings by financial institutions. However, it bears repeating what both our former Director and my immediate predecessor have stated at conferences in the past: these files don’t go into a “black hole,” but rather are used to confront serious threats. Not every SAR results in a criminal prosecution. But, as a former prosecutor, I routinely used the same BSA data that your casinos and card clubs report to FinCEN to build my cases. We exercised the “enterprise theory” of investigation and prosecution to target entire conspiracies and organizations at all levels—including leadership. Now, in my role at FinCEN, I see how important our partner regulators and stakeholders also view this data.

Myth #2: Low-dollar SARs are meaningless to law enforcement.

This is a common myth across all financial sectors. And, I think this myth may stem from not fully appreciating or understanding how valuable a complete and accurately filed SAR can be in an investigation. It’s easy to think that filing a SAR on suspicious activity that has a low dollar amount, or even on an attempted transaction, may not look like it has the same appeal as one filed on a transaction for millions of dollars, but that is only part of the picture.

What does this mean for your SAR filed on a low-dollar amount transaction? Well, regardless of the amount, the reporting aids in expanding the scope of ongoing investigations by pointing to the identities of previously unknown subjects, exposing accounts and hidden financial relationships, or revealing other information such as common addresses or phone numbers that connect seemingly unrelated participants in a criminal or terrorist organization and, in some cases, even confirming the location of suspects. The reporting—even of transactions involving low dollar amounts—has served to unmask relationships between illicit actors and their financing networks, enabling law enforcement to target the underlying conduct of concern, and to disrupt their ability to operate. Your filing may just be the source of a missing piece of information that is needed in an investigation.

Law enforcement also uses the reporting to identify significant relationships, patterns, and trends. Your filings contribute to a more comprehensive picture that informs our understanding and analysis of criminal typologies. FinCEN includes an Intelligence Division that uses SARs and other reports to conduct strategic analysis to identify new trends and emerging threats in illicit finance. It assesses AML compliance across industries, identifying new illicit finance trends and developing typologies for illicit activity. The Intelligence Division then compiles much of this analysis into finished¬¬ intelligence products that are disseminated across FinCEN, the law enforcement community, and the federal government.

[I’ve left myth #3 out as it was specific to the gaming industry.]

Myth #4: SARs are subjective; based on the AML program size and risk-appetite of my institution.

This myth suggests that filing SARs are a matter of opinion, or that it’s relative to the make-up of the institution. But if that were true, then there is no way a financial institution can ever violate the statute—the defense would just be: “in my subjective opinion, that’s not SAR-worthy.” We would be left just to agree to disagree. Obviously, an effective AML system cannot work like that. Similarly, some financial institutions hold on to the myth that their AML program should be based on their risk appetite or risk tolerance. This view may be compounded by the misperception that SAR filings can be proportionally based on the size of an AML program.

These related myths are also contradicted by the rule [31 CFR 1021.320(a)(2)], that says “knows, suspects, or has a reason to suspect” illicit activity. So if you have a reason to suspect it, then you are required to file. It is that simple. Filing SARs does not depend on an AML program’s perceived risk appetite and it cannot be curtailed because of perceived AML program resource deficiencies.

This observation is not meant to spur specious or “defensive” filings; to the contrary, suspicious activity monitoring and SAR filing do require some judgment. Decisions are not always clear-cut. There are going to be times when someone says, “yeah, I think you probably should have filed a SAR, but it was not unreasonable to think otherwise.” If you act reasonably, and do your investigation, and—and this is important—think through and document your reasons for not filing a SAR, then we are not going to second-guess those reasonable decisions, even if FinCEN or an examiner may have made a different decision. However, I must emphasize financial institutions like yours and those of your clients must have appropriate risk-based AML programs in place.” (Emphasis is mine.)

The law enforcement community and government regulators continue to stress the importance of your SAR filings to their investigations.  They want as much information as possible to help build their cases.  Keep filing those SARs!

***

BSA Blast.  The October 2016 issue of the BSA Blast is available today. (NAFCU login required).  The articles in this issue cover: Treasury’s Office of Foreign Assets Control (OFAC) designation of a payment processor as a transnational money launderer for mail fraudsters and recent enforcement actions for Bank Secrecy Act (BSA)/anti-money laundering (AML) and OFAC weaknesses and violations.  Also included is a new BSA quiz on FinCEN’s guidance regarding email fraud schemes.

***

Programming Note. It’s time for some learning! Your compliance questions will be answered but we appreciate your patience as the team will be in and out of the office giving presentations this week at NAFCU’s concurrent BSA Seminar and Regulatory Compliance Seminar in New Orleans. 

Whale and Spear Phishing Examples and Red Flags; Credit Unions and the Higher Road

Written by Shari R. Pogach, Regulatory Paralegal

I know you’ve all heard about the digital con games that target businesses and individuals and their email accounts.  The endgame goal is to get funds wire transferred into the criminal hacker’s account, usually to a bank located in Asia.  The Financial Crimes Enforcement Network (FinCEN) recently issued an advisory, FIN-2016-A003, to help financial institutions to guard against email phishing fraud that has involved $3.1 billion since 2013.  And, that’s just the 22,000 reported cases.

The two main types of email phishing fraud are:

• When a company’s business email is compromised; and
• When a victim’s personal email account is compromised.

What happens is the bad guys hack into a person’s email (either business or personal) and get as much information as they can about his or her financial institutions, account details, contacts and other related information.  Those stolen details are then used to email instructions that appear to be from the accountholder to get the financial institution to initiate an unauthorized wire transfer of funds into the criminals’ domestic or foreign bank accounts.

The advisory gives examples of the types of scenarios used and a red flag list to help identify possible email phishing fraud.  Here are a few email phishing fraud red flag triggers:

• Seemingly legitimate emailed transaction instructions using different language, timing and amounts than previously verified instructions.
• Instructions coming from an email account that looks very similar to the victim’s email account but has been slightly altered by adding, changing or deleting characters.
• Instructions that direct the payments to a known beneficiary but the beneficiary’s account information is now different.
• The instructions direct payment to a beneficiary where there is no prior payment history or documented relationship to the customer and the payment is significantly higher than payments to other beneficiaries the customer has paid in the past.
• Instructions are delivered in such a way that gives limited time or opportunity to confirm the transaction’s authenticity.
• The instructions come from an employee who is a newly authorized person on the customer’s account or someone who hasn’t previously sent wire transfer instructions.

FinCEN stresses no single transactional red flag indicates suspicious activity, additional questions and further investigation may be necessary to determine if a transaction is indeed suspicious.  It is also recommended the advisory should be widely shared within the institution with its:  cybersecurity and risk departments; fraud prevention units; BSA/AML management; AML intelligence units; and AML analysts/investigators.

***

Speaking of fraud, Wells Fargo was all over the headlines last week with its historic fine for unlawful sales practices.  Just more bad bank behavior. I think our CEO said it best in his Berger Leadership Blog that this is what differentiates us and makes the credit union industry so stellar – putting members first instead of profits.  Take a moment to read his post and give yourself a pat on the back today as you start the week.

Common Issues and Problems in BSA Enforcement Actions

Written by Shari R. Pogach, Regulatory Paralegal

I attended the 2016 Mid-Atlantic Anti-Money Laundering Conference a couple of weeks ago. This conference is put on and sponsored by law enforcement agencies to share the latest trends in illicit and money laundering cases.

One panel discussion covered compliance challenges the financial industry faces in Bank Secrecy Act (BSA) compliance. During this session a panelist highlighted common issues and problems found in regulatory enforcement actions involving banks.  Regulators continue to find issues and problems with weak or poor internal controls, transaction monitoring and suspicious activity reporting such as: 

Internal Controls

 Risk assessments are too narrowly focused.

• Using incorrect customer risk ratings.
• A failure to obtain and verify Customer Identification Program information.
• Lack of documentation of customer due diligence and enhanced due diligence.

Transaction Monitoring/Suspicious Activity Reporting

• Using manual transaction monitoring.
• Institution has outgrown its monitoring systems.
• Model validation issues.
• Using caps on the numbers of alerts.

Regulators have found that institutions purchase expensive monitoring systems but then do not tailor the system to the institution’s customer base or transaction size. Often alerts are tweaked in accordance with an institution’s staffing levels rather than to its appropriate level of risk.  The effectiveness of manual transaction monitoring in terms of an institution’s transaction volume is also questionable.

The panel expressed that is acceptable to have alert suppressions with the appropriate justification but such a decision needs to be documented. And, an institution should not continue an alert suppression forever without an update of the analytics or the customer information.  What if the parameters have changed? 

Although the information presented here comes from the banking side, it still serves as a useful reminder of the more common BSA compliance failings. Credit unions looking for reminders on these points might review the following sections of the Federal Financial Institutions Examination Council’s (FFIEC’s) Bank Secrecy Act/Anti-Money Laundering (BSA/AML) Examination Manual:

• Risk Assessment-Overview, FFIEC BSA/AML Examination Manual
• Customer Identification Program Overview, FFIEC BSA/AML Examination Manual
• Customer Due Diligence-Overview, FFIEC BSA/AML Examination Manual
• “Transaction Monitoring” and “Systems to Identify, Research, and Report Suspicious Activity” sections of the Suspicious Activity Reporting-Overview, FFIEC BSA/AML Examination Manual

So You Want to Service Marijuana Businesses? BSA Expectations for Marijuana- Related Businesses

Written by Shereefat Balogun, Regulatory Compliance Counsel

Currently, about 20 states and the District of Columbia have legalized certain marijuana-related activity.  For example, Alaska, Colorado, Oregon, Washington, and Washington D.C., have legalized recreational and medicinal marijuana for adults.  Moreover, it is anticipated that more states will enact laws allowing for the legalization of marijuana.  In light of these developments, it is important for credit unions that offer, or are thinking about offering, marijuana related business accounts to be reminded of their compliance obligations particularly under the Bank Secrecy Act (BSA).  Warning, the regulators are not making it easy here.

As an initial matter, marijuana is still illegal under federal law.  That said, in 2014, the Financial Crimes Enforcement Network’s (FinCEN) created strict guidelines for credit unions seeking to service marijuana-related businesses.  The guidance set forth new due diligence requirements for opening an account for a marijuana-related business.  As part of its member due diligence, a credit union deciding to provide financial services to these businesses is required to:

• Verify with the appropriate authorities whether the business is duly licensed and registered;

• Review the license application (and related documentation) submitted by the business for obtaining a state license to operate its marijuana-related business;

• Request from state licensing and enforcement authorities available information about the business and related parties;

• Develop an understanding of the normal and expected activity for the business, including the types of products to be sold and the type of customers to be served (e.g., medical versus recreational members);

• Conduct ongoing monitoring of publicly available sources for adverse information relating to the business and related parties;

• Conduct ongoing monitoring for suspicious activity; and

• Update information obtained as part of member due diligence on a periodic basis commensurate with the risk.

See, FinCEN Guidance, 2014-G001.

Along with the above requirements, as part of its due diligence, a credit union is expected to consider whether a marijuana-related business implicates any of the eight priorities defined by the DOJ, in the infamous “Cole Memo”.  The Cole Memo notes that the DOJ is committed to prosecuting any individual or entity that interferes with any of its eight delineated priorities including:

• Preventing proceeds from the sale of marijuana from going to criminal enterprises, gangs, and cartels;
• Preventing state-authorized marijuana activity from being used as pretext for the trafficking of other illegal drugs or other illegal activity.

See, Department of Justice, Guidance Regarding Marijuana Enforcement.   

The DOJ issued a supplemental memo the same day FinCEN issued its guidance.  The memo reiterates the DOJ's 2013 position and generally reaffirms FinCEN's guidance.  In short, credit unions are expected to monitor and ensure marijuana-related businesses do not violate the eight priorities set forth in the Cole Memo, as well as stay in compliance with the member due diligence requirements outlined by FinCEN. 

If you thought that was it, there is more.  SAR filing obligations remain!  While some states allow businesses to sell marijuana, federal law still makes it a crime.  Thus, credit unions must file a SAR on activity involving a marijuana-related business.  Credit unions are advised to review the guidance relating to SAR reporting and filing requirements, as well as some of the red flags to look out for. 

And there’s more- the CTR.  Consistent with BSA/AML reporting requirements, credit unions are also required to file a CTR in connection with marijuana-related businesses. And importantly, a business engaged in marijuana- related activity is not eligible for a CTR exemption under 31 C.F.R. 1020.315(b)(6). See, FinCEN Guidance, 2014-G001.

And there’s more….. No, that’s it…for now.

On a final note, it is worth noting that while FinCEN seems to have given a pass to credit unions interested in banking marijuana-related businesses, so long as the above conditions are met; and while, NCUA has instructed its examiners to follow the guidance, other hurdles make servicing these businesses challenging and unclear.  Aside from the additional regulatory requirements and associated costs to participate in this activity, credit unions thinking about exploring this opportunity cannot avoid the fact that marijuana is still technically illegal- federally speaking. The guidance doesn’t address the legal issue of whether a credit union is violating federal law in providing services to marijuana businesses.  Moreover, credit unions that bank marijuana-related businesses may not have access to the Federal Reserve System, as illustrated in the case of Fourth Corner Credit Union in Colorado.   The credit union sued the Kansas Federal Reserve Bank after it refused to open an account for the credit union.  In dismissing the case earlier this year, the court held that it could not use its authority to require the Fed to facilitate a federal offense. The credit union filed a separate action against NCUA for not providing it with federal share insurance.  Apparently, NCUA had concerns over the credit union’s ability to mitigate the risk of banking only marijuana businesses.

To learn more about marijuana-related businesses, the compliance risks, and what your credit union can do to mitigate those risks, come join us at NAFCU’s BSA Seminar in New Orleans from October 24 – 28.  In addition to learning more about marijuana-related businesses, you can expect a full week of everything you’ve ever wanted to know about BSA.  Check out the full agenda and sessions.  We have limited seating – so register now!

From Community Hero to $18.6 Million Credit Union Embezzler; July BSA Blast

Written by Shari R. Pogach, Regulatory Paralegal

The importance of internal controls to a credit union is illustrated by this disquieting case. A credit union’s size and complexity is not representative of the severity of the potential risk if the wrong staff member gains access to critical controls.

Former Fenton  businessman Michael LaJoice was honored in 2013 with a Fenton Community Hero Award for his charitable giving and helping others. In January 2016, the businessman and accountant walked into the Oakland County Sheriff’s Office and stated that as the chief financial officer, he had embezzled about $20 million over a dozen years from Clarkston Brandon Community Credit Union. LaJoice was jailed in January on 14 counts of embezzlement charges.                  

How did he do it? Well according to court documents filed this June with the Eastern District of Michigan U.S. District Court, LaJoice started as an account manager and later became the credit union’s chief financial officer in June 2015.  He was responsible for the credit union’s accounting functions, which included the financial statements, making general ledger entries and ACH transfers, tracking investments and reconciling the corporate account statements.

LaJoice issued cashier’s checks from various accounts at the credit union without permission. These checks were then deposited into LaJoice’s bank accounts at multiple other financial institutions.  The checks were made payable to the financial institutions as well as to fictitious individuals and LaJoice typically deposited the checks by ATMs.  The funds came from the credit union’s investment general ledger, which LaJoice was responsible for balancing.  Once the funds were in his accounts, LaJoice would clear the credit union’s ledger to delete the corresponding transaction.  He would then wire transfer the funds from his personal accounts to other accounts, including his business account. 

By creating fictitious investments in certificates of deposits and bonds at a bank in Miami, LaJoice was able to hide his activities. These fictitious investments were given to auditors and state examiners conducting annual financial audits at the credit union to show that its books were balanced. 

The court filing states LaJoice used the stolen monies to pay cash to build his new, custom-built home worth more than a million dollars, purchase several new vehicles and real properties, and to market his dance studio.   LaJoice’s attorney is continuing negotiations for resolution on the two criminal and two civil cases against LaJoice in federal and state courts. 

Clarkston Brandon Community Credit Union was later merged into another Michigan credit union.

***

BSA Blast. It’s out! The July 2016 issue of the BSA Blast is available (NAFCU login required).  Articles in this issue include: an overview of the Financial Crimes Enforcement Network’s (FinCEN”s) rule on customer due diligence requirements on beneficial ownership; and a recent enforcement action against a casino card club for repeated Bank Secrecy Act (BSA) violations. Included with newsletter is a new BSA quiz that can be used for training staff on the Customer Due Diligence rule.

Bank Secrecy Act: Red Flags of Money Laundering

Written by Shereefat Balogun, Regulatory Compliance Counsel

So we all know that credit unions are required to file a Suspicious Activity Report (SAR) where a member appears to be engaged in illegal or suspicious activity.  While, we all know the general SAR requirements, there are many questions about what activity is considered suspicious; or more precisely what are the “red flags” of money laundering.  In light of the looming concerns in this area and increased regulatory scrutiny around the failure to file a SAR in certain instances, this post will provide a non-exhaustive list of some of the common indicators of money laundering activity that your credit union can prepare for. 

As an initial matter, the BSA/AML regime requires credit unions to file a SAR if it involves at least $5k and the credit union has reason to suspect that the transaction: (i) involves funds derived from money laundering or any other illegal activity; (ii) is designed to evade the BSA or its implementing regulations; or (iii) has no apparent business or lawful purpose, or is not the type of transaction that the member would normally be expected to engage in.  See, 12 CFR 748.1.  Credit unions are encouraged to develop appropriate policies, procedures, and processes that monitor and identify unusual or suspicious activity.  But what is suspicious? The following are examples of possible situations that may indicate money laundering.  Two considerations should be noted: one, this list is non-exhaustive.  Two, the presence of a red flag is not conclusive evidence of criminal activity.  Rather, the presence of a red flag should prompt additional investigation and scrutiny in order to determine whether a SAR should be filed.

Avoiding Recordkeeping and Reporting Requirements

• Member asks about record-keeping or reporting requirements
• Member discourages employee from filing required reports or complying with recordkeeping requirements
• Member reluctant to proceed with cash transaction after being told it must be reported

Suspicious Customer Identification Behavior

• Member uses unusual or suspicious identification documents, or refuses to produce originals for verification
• Member refuses to provide personal background information when opening an account
• Member’s permanent address is outside of the credit union’s service area
• Member indicates that he/she does not want a statement of account or nay mail sent to his/her address
• A business member is reluctant to provide information about the nature and purpose of its business, expected account activity, or the names of its officers and directors

Suspicious Cash Transactions

• Member regularly uses ATMs to make several deposits below the reporting threshold
• Member comes in with another member and they go to different tellers to conduct currency transactions under the reporting threshold
• Member opens different accounts under different names, and then makes several cash deposits under the reporting threshold
• Member deposits cash into several accounts in amounts below the reporting threshold and subsequently transfers the funds into one account and wire transfers them overseas
• Member attempts to take back a portion of a cash deposit that exceeds the reporting threshold after being told a CTR must be filed
• Member makes numerous purchases of monetary instruments with cash in amounts less than the reporting threshold
• Member purchases a number of prepaid cards for large amounts, inconsistent with normal account activity

Suspicious Activity in Credit Transactions

• Member suddenly pays down or pays off a large loan with no credible explanation as to where the funds came from
• Member purchases certificates of deposit and uses them as loan collateral
• Loans are made for, or paid on behalf of, a third party with no plausible explanation
• Member’s loan proceeds are unexpectedly transferred offshore or member requests that loan proceeds be wired transferred

Suspicious Employee Activity

• Employee lives a lavish lifestyle that cannot be supported by his salary
• Employee fails to adhere to credit union’s internal policies, procedures, and processes and frequently overrides internal controls
• Employee is reluctant to take a vacation

Again, this post lists just some of the various transactions and activities that may indicate potential money laundering.  For a more comprehensive list, check the FFIEC’s BSA/AML Examination Manual, Appendix F. 

As an aside, our members have been letting us know that this year’s examination has focused a lot on BSA compliance.  Indeed, NCUA’s Letter to Credit Union 16-CU-01 identifies BSA as an examination priority for 2016.  Below are some resources your credit union can rely on to be prepared. 

• NCUA Examiner's Guide
• AIRES BSA Questionnaire
• NCUA Compliance Self-Assessment Guide
• Interagency Statement on Enforcement of BSA AML Requirements

As always, if you have any questions relating to this article or any other BSA issue, please contact NAFCU’s regulatory compliance team.  We’re here for you!

Wait!!! While we're on the topic of BSA, have you registered for NAFCU's upcoming BSA seminar?  We’ll be holding our first in-person, BSA Seminar in New Orleans from October 24 – 28.  You can expect a full week of everything you’ve ever wanted to know about BSA, but didn’t have time to ask. It’s designed for just credit union professionals. You’ll find no erroneous “bank” information that doesn’t apply to credit unions. Check out the full agenda and sessions.

There’s an optional, pre-conference workshop to help get you up-to-speed on BSA fundamentals – it’s perfect if you’re new to BSA or just want a refresher. And at the end of the week, you’ll have the opportunity to get certified when you sit and pass the NAFCU Certified Bank Secrecy Officer (NCBSO) exam.

This seminar, and the certification, is an excellent way to demonstrate to NCUA and FinCEN you’re dedicated to compliance and to protecting your credit union against financial crime. It was designed by NAFCU’s Director of Education Devon Lyon, former director of BSA at State Department Federal Credit Union – so the curriculum is extremely relevant at both a strategic and tactical level. You’ll walk away ready to master your AML responsibilities. And of course, it fulfills your yearly BSA training requirement!

We have limited seating – so register early!

 

Oldie but Goodie – Record Retention

Written by Brandy Bruyere, Director of Regulatory Compliance

It has been a while since we blogged about a “frequently asked question” – how long do certain records need to be retained? As with most things involving the law, the answer is “it depends.”

First, for federally-insured credit unions, Part 749 of NCUA’s regulations contains guidance that is not terribly prescriptive. In fact, Appendix A to Part 749 notes the importance of state law in determining how long to keep particular records:

1. What Are the Recommended Minimum Retention Times?

Record destruction may impact the credit union's legal standing to collect on loans or defend itself in court. Since each state can impose its own rules, it is prudent for a credit union to consider consulting with local counsel when setting minimum retention periods. A record pertaining to a member's account that is not considered a vital record may be destroyed once it is verified by the supervisory committee. Individual Share and Loan Ledgers should be retained permanently. Records, for a particular period, should not be destroyed until both a comprehensive annual audit by the supervisory committee and a supervisory examination by the NCUA have been made for that period. (Emphasis added.)

For example, states set statutes of limitations that determine how long a person has to bring a civil suit against another party. These time periods vary by state, and even vary by type of claim/lawsuit so this is one way a state may “impose its own rules” that impacts a credit union’s recordkeeping. Power of attorney recordkeeping requirements are another example.

That being said, the NCUA guidance also notes that certain records should be retained permanently, including:

• The FCU’s charter, bylaws and amendments to these documents
• Minutes of membership meetings and meetings of the board, credit committee and supervisory committee
• Copies of the FCU’s call report (NCUA Form 5300 or 5310) and the Credit Union Profile Report (NCUA Form 4501) or its equivalent
• One copy of each supervisory committee annual audit report and attachments
• Supervisory committee records of account verification
• Journal and cash record
• General ledger
• Copies of periodic statements or the individual share and loan ledger (meaning, “a complete record of the account should be kept permanently)
• Bank reconcilements
• Listing of records destroyed

Part 749 also addresses vital records preservation and can be helpful when reviewing recordkeeping policies and procedures.

From a federal regulatory perspective, specific rules often have their own record retention provisions. Here are some examples:

Regulation Z addresses record retention in section 1026.25. The rule contains a general 2 year record retention requirement, with some longer retention periods for other specific documents. For example, there is a three year record retention requirement for information relating to loan originator compensation and the ability to repay/qualified mortgage rule. For loans subject to TRID, credit unions must retain evidence of compliance for three years, but all Closing Disclosures, including revised Closing Disclosures, must be retained for five years post-consummation.

Regulation B has a particular records retention rule found in §1002.12 and a requirement to keep in the application file a copy of any written notice that was required to be mailed under the regulation. There are more specific requirements relating to business credit, keeping records longer if the credit union knows it is under investigation by a regulator or state’s attorney general, and requires credit unions to keep records relating to prescreened offers of credit for 25 months so it may be worth reviewing in full. The rule’s commentary discusses keeping computerized records of notice.

Bank Secrecy Act. The BSA/AML examination manual contains an appendix on record retention requirements. Some records must be kept for 5 years, such as purchases of monetary instruments or funds transfers of $3,000 or more (although there are some exceptions here). Records under the credit union’s customer identification program (CIP) must be retained for five years after the account is closed.  Other BSA provisions are not subject to a specific record retention timeframe. However, to ease compliance, many credit unions keep all BSA-related records for 5 years rather than having to sort out which items are specifically required to be kept for 5 years and which are not.

Other federal rules. Here are a few other federal regulations with specific recordkeeping provisions:

• Regulation E, section 1005.13(b) (generally, two years from the time of providing disclosures)
• Truth in Savings, section 707.9(c) (generally, two years from the time of providing disclosures)
• Regulation X contains a few recordkeeping requirements. One example relates to mortgage servicing under RESPA, located at section 1024.38(c) (generally, until one year after the date a mortgage is discharged or servicing is transferred to another servicer). Other provisions have a five year retention period.
• Regulation C, section 1003.5(d) (modified register must be available to the public for 3 years, and the disclosure statement for 5 years
• Regulation CC, funds availability, section 229.21(g) (generally, at least two years)
• Fair Credit Reporting Act/Regulation V – Section 615(d)(3) requires credit unions to retain records relating to prescreened offers of credit for three years. Additionally, Appendix E of Regulation V contains guidelines on the accuracy and integrity of data reported to consumer reporting agencies (“Maintaining records for a reasonable period of time, not less than any applicable recordkeeping requirement, in order to substantiate the accuracy of any information about consumers it furnishes that is subject to a direct dispute…”)
• Flood insurance (record of receipt of the notice of special flood hazards and availability of flood insurance must be kept for as long as the credit union owns the loan)
• IRS Form 1099 (generally 3 years from the reporting due date, but four years for federal withholding information and filings under Form 1099-C for cancellation of debts, see p. 13 of this guide). The IRS generally requires that employment tax records are kept for four years.

Final thoughts. Again, this is not an exhaustive list, and besides federal regulatory requirements, there can be many good reasons to keep records for longer. Records can be key to success in litigation should the credit union be involved in a legal action such as enforcing a debt or defending against a civil suit. Records can also help demonstrate the credit union’s typical practices or how a credit union generally addresses an issue. Records often contain institutional knowledge, helping explain past decisions or provide context to existing policies and procedures. This does not mean everything needs to be retained forever though – record retention is a balance and outside specific regulatory requirements, this process often involves some decision making as well.

Bank Teller Busted; B.E.C. Scheme; BSA Blast; GPS

Written by Shari R. Pogach, Regulatory Paralegal

The fraudsters, they keep on a-coming…………

A former SunTrust Bank teller was sentenced to 18 months in prison due to her cashing fraudulently obtained tax refund checks for a fee as part of a stolen identity tax refund fraud conspiracy.  Court documents indicate that between February 2013 and May 2014, Vicky Wheeler, 55, worked as a teller at a SunTrust Bank branch in Columbus, Georgia.  According to the Department of Justice news release, Wheeler was approached by several co-conspirators and asked to cash fraudulently obtained tax refund checks.  She was told the refund checks were generated from tax returns that were filed using stolen identities.  For her part, Wheeler made false entries on the faces of the checks to appear as though she had received proper identification to cash the checks.  But Wheeler never got any identification to cash the checks.  She received and cashed approximately 361 fraudulent tax refund checks.  These included U.S. Treasury checks and refund checks issued by financial institutions claiming $780,760.17 in tax refunds.  Wheeler was sentenced to 18 months in prison.

***

The FBI has issued a notice indicating a “dramatic” rise in the business email compromise scam or B.E.C. scheme that targets businesses.  This is where company email is spoofed or social engineering is used to assume the identity of the CEO, a company attorney or trusted vendor. The perpetrators research employees who manage money and use language specific to the company they are targeting and then request a wire fraud transfer using dollar amounts that lend legitimacy to the request. Globally, law enforcement has received victim complaints from every U.S. state and in at least 79 countries.  The FBI has seen a 270 percent increase in identified victims and exposed loss since January 2015. 

 

 

***

BSA Blast.  It’s out!  The April 2016 issue of the BSA Blast is available (NAFCU login required).  Articles in this issue include: a review of the FinCEN’s enforcement actions during first quarter 2016 and its guidance on the anti-money laundering (AML) compliance obligations for a money services business (MSB) and its agents. The guidance can be helpful for those credit unions wishing to provide services to MSBs. And, the issue contains a new BSA quiz that covers BSA fundamentals and can be used for staff training.

***

NAFCU's Credit Union Compliance GPS.  The 2016 edition of the Credit Union Compliance GPS (GPS) is here! This must-have electronic compliance reference tool has been updated with the 2015 regulatory changes impacting the credit union industry.  It includes over 40 pages on important new regulatory compliance requirements that credit union compliance professionals need to incorporate into a credit union’s day-to-day operations. At just $399 for NAFCU members and $499 for non-members, and over 600 pages, this electronic compliance reference tool is a bargain!

Deconstructing TRID’s Application to Construction Loans: Disclosing AP Table in Single Combined Disclosures; BSA Webcast Series

Written by Shereefat Balogun, Regulatory Compliance Counsel

It has been over five months since the implementation of the Consumer Financial Protection Bureau’s (CFPB) TILA-RESPA Integrated Disclosure (TRID) rules, yet many credit unions are still worried about disclosure requirements, particularly as they apply to construction-to-permanent loans. One issue that credit unions have had questions about is the Adjustable Payment Table under §1026.37(i) and how it should be completed if a construction-to-permanent loan is disclosed as a single transaction with one set of disclosures. Some have had some confusion as to whether the table is even required in every circumstance.

Generally, the “Adjustable Payment Table” (the “AP Table”) described in 1026.37(i) is only required if the periodic principal and interest payment may change after consummation based on a loan term other than a change to the interest rate, or the transaction contains a seasonal payment product feature. If the transaction does not include either of these loan terms, then the table should not be disclosed on the Loan Estimate.

If the creditor is required to disclose the AP Table because the periodic principal and interest payment will change after consummation, for reasons other than a change to the interest rate, or if the transaction contains a seasonal payment feature, then Section 1026.37(i)(1) through (4) requires a creditor to disclose on the Loan Estimate the periods during which the following features will be in effect: (i) interest only; (ii) optional payment; (iii) step payment; and (iv) seasonal payment product features. The periods required to be disclosed should be disclosed by describing the number of payments counting from the first periodic payment due after consummation.

In the context of a construction-to-permanent loan, if the creditor chooses to disclose this loan as a single transaction with one set of disclosures, the AP Table must be disclosed. Note that, in the construction phase of this loan, the borrower will typically make interest-only payments. Once the construction phase is complete and the permanent phase starts, the borrower will transition into making regular periodic principal and interest payments. Accordingly, with construction-to-permanent loans transactions, there will always be a payment change after consummation that will not be based on a change to the interest rate.

When a creditor elects to disclose a construction-to-permanent loan as a single transaction, the AP table is disclosed pursuant to §1026.37(i), with particular adherence to §§1026.37(i)(1) and (5). The rule provides in relevant part:

(i) Adjustable payment table. If the periodic principal and interest payment may change after consummation but not based on an adjustment to the interest rate, or if the transaction is a seasonal payment product as described in paragraph (a)(10)(ii)(E) of this section, a separate table under the master heading “Closing Cost Details” required by paragraph (f) of this section and under the heading “Adjustable Payment (AP) Table” that contains the following information and satisfies the following requirements:

(1) Interest only payments. Whether the transaction is an interest only product pursuant to paragraph (a)(10)(ii)(B) of this section as an affirmative or negative answer to the question “Interest Only Payments?” and, if an affirmative answer is disclosed, the period during which interest only periodic payments are scheduled.

…

(5) Principal and interest payments. Under the subheading “Principal and Interest Payments,” which subheading is immediately preceded by the applicable unit-period, the following information:

(i) The number of the payment of the first periodic principal and interest payment that may change under the terms of the legal obligation disclosed under this paragraph (i), counting from the first periodic payment due after consummation, and the amount or range of the periodic principal and interest payment for such payment, labeled “First Change/Amount”;

(ii) The frequency of subsequent changes to the periodic principal and interest payment, labeled “Subsequent Changes”; and

(iii) The maximum periodic principal and interest payment that may occur during the term of the transaction, and the first periodic principal and interest payment that can reach such maximum, counting from the first periodic payment due after consummation, labeled “Maximum Payment.”

12 CFR 1026.37(i)(1) and (5)(emphasis added).

As way of illustration, if the interest-only period during the 12-month construction phase has a rate that adjusts monthly, in disclosing whether there are interest-only payments as required under §1026.37(i)(1), the creditor should state “yes for your first 12 months”. Moreover, under §1026.37(i)(5)(i), the monthly principal and interest payments disclosure labeled “First Change” or “Amount” must disclose the range of minimum and maximum payments that will be made at the second payment.

Note that this general rule applies whether the construction and permanent phases have fixed rates or adjustable rates, or one phase is fixed and the other is adjustable. The key is to remember that the loan is considered a single transaction; and within that single transaction there is a change in payment after consummation as a result of the transition from construction to permanent, which therefore requires the AP Table and the corresponding disclosures under Section 1026.37(i).

On a final note, many creditors have criticized the CFPB for its lack of clear guidance on TRID’s application to construction loans and specifically cite the absence of sample forms and minimal reference to construction loans in the commentary. While some credit unions have considered whether to continue offering construction loans, TRID and Regulation Z's disclosure requirements and guidance generally apply to covered construction loans, except where otherwise mentioned. This is the case even if the guidance or rule provision is not directly on construction loans. And of course, for NAFCU members, if you have any questions on any specific disclosure requirements, please feel free to contact NAFCU’s Regulatory Compliance team, and we would be happy to address any of your specific concerns.

###

BSA: Reports & Training for CU Boards

Live Webcast: Tuesday April 19 | 2:00 p.m. – 3:30 p.m. EST

Part of the BSA Webcast Series

It’s vital to understand the roles and responsibilities of credit union board members regarding the Bank Secrecy Act (BSA). Attend this webcast to understand your board’s BSA duties such as risk assessments, policy reviews, and updates, as well as recommended additional training needs. You’ll also get tips for in-house training and learn how to properly report SARs to your board.

Man Walks into HSBC Mexican Branch with Bag Full of Cash…….; Custodian Services Authority

Written by Shari R. Pogach, Regulatory Paralegal

…..and says he’s a shrimp farmer.  So the HSBC branch, located in Sinaloa, a Mexican state known for much drug-related violence, opens a private wealth account for this 19-year old man with his bag of thousands of dollars in cash.  That’s not all the court-appointed compliance monitor’s crew of investigators discovered.  They visited a site in Mexico where HSBC loaned funds to finance the construction of a factory.  At the supposed factory site instead was a mansion with a staff of servants.  Apparently local bank staff had made a site visit and still signed off on the loan.

Basic Customer Identification Program (CIP) 101 – know your customer, his or her expected activities and any money-laundering risks. And, your compliance departments should be asking basic questions, and flagging suspicious transactions and customers.  

According to The Wall Street Journal, sources familiar with the monitor’s findings indicate that in spite of working to get the bank’s compliance systems up to snuff, HSBC still struggles to meet the terms of its deferred prosecution agreement.  The bank’s financial crime compliance costs in 2015 were $2.9 billion and its financial compliance staff is now up to 9,000.

HSBC Chief Legal Officer Stuart Levey has stated that with operations in 71 countries, the bank will continually face financial-crime risks but that it’s a never-ending process and “frankly we’ll always find ways in which we’re slightly falling short.”  But HSBC is determined to meet the settlement terms and does not believe it will be prosecuted after 2017.

Stay tuned!

***

NCUA Issues Legal Opinion Letter on Credit Union Custodian Services. On March 28, 2016, the NCUA Office of General Counsel issued a new legal opinion letter confirming the authority of federal credit unions to place member funds in deposit accounts at institutions insured by the FDIC and to serve as custodian for that FDIC-insured account. Under the Federal Credit Union Act, federal credit unions may generally deposit funds in national banks or FDIC-insured state chartered banks and may act as custodians for member funds as an incidental power. In addition to confirming this authority, the legal opinion letter sets forth six requirements federal credit unions must satisfy in order to offer this service to members. You can find the letter here.

Two Utes Walk Into a Credit Union to Open Accounts…

Written by Elizabeth M. Young LaBerge, Regulatory Compliance Counsel

Laywers love To Kill a Mockingbird. I need both hands to count the number of lawyers I know who have dogs or children named Atticus. Personally, I have always advocated for My Cousin Vinny as the better movie about trial work. So when a wave of questions about ute accounts youth accounts came in to the Regulatory Compliance team  recently, I could not resist.

The Federal Credit Union Act expressly provides that a federal credit union (FCU) may issue shares in a minor's name, subject to conditions prescribed by the bylaws. See, 12 U.S.C. § 1765. NCUA’s Federal Credit Union Standard Bylaws permit minors to own shares, but points to state law with regards to their rights to transact business with the federal credit union:

“Article XV. Minors

Section 1. Minors permitted to own shares. Shares may be issued in the name of a minor. State law governs the rights of minors to transact business with this credit union.”

See, 12 C.F.R. Part 701, Appendix A, Article XV, Section 1. The standard bylaws direct an FCU to the state law in their jurisdiction regarding the rights of a minor because whether or not a minor has legal ability to enter into a binding agreement, i.e. the legal capacity to contract, is determined by law in each state. If an FCU were to enter into a contract, for example - an account agreement, with someone who did not have capacity to do so at the time the agreement was made, the agreement could become void, possibly even years later. For this reason, most credit unions require a parent or adult to also be on the account, to ensure that an enforceable agreement is in place. An FCU considering youth accounts or writing a policy regarding youth accounts should speak with local counsel who can advise it on the law regarding minority and capacity to contract in the credit union’s jurisdiction.

NAFCU members have also asked about performing Customer Identification Program (CIP) procedures on youth accounts. When a parent opens the account for the minor because the minor does not have the legal capacity to make an agreement under state law, the customer for an account is usually the parent. Below is from the CIP Overview section of the FFIEC’s Bank Secrecy Act/Anti-Money Laundering Examination Manual:

“The CIP rule applies to a ‘customer.’ A customer is a ‘person’ (an individual, a corporation, partnership, a trust, an estate, or any other entity recognized as a legal person) who opens a new account, an individual who opens a new account for another individual who lacks legal capacity, and an individual who opens a new account for an entity that is not a legal person (e.g., a civic club).”

(Emphasis added.) Even if not needed for CIP reasons, many credit unions request the minor’s SSN and/or birth certificate to document the account and to ensure the minor is actually a minor.

 If a state’s laws and the credit union’s policies permit the minor to open the account on his or her own behalf, then the minor is the customer. In this case, the FCU should perform CIP regarding the minor as it would on any other customer.

 One final consideration with regard to youth accounts is the Children’s Online Privacy Protection Act (COPPA). COPPA imposes certain requirements on operators of websites or online services directed to children. Credit unions are subject to COPPA if they operate a website or online service directed to children, or have actual knowledge that they are collecting or maintaining personal information from a child online. COPPA could apply to a credit union’s internet-based services, such as online banking. A credit union could be unintentionally accessing a minor’s personal information through cookies or similar devices which may collect nonpublic personal information. Making COPPA determinations generally requires an analysis of the specific facts and circumstances surrounding a credit union’s online activities against the requirements of COPPA. Thus, a credit union may want to work with local counsel to see if COPPA applies. The FTC’s website has an excellent overview of COPPA.

Vinny Gambini may have been great at cross-examination, but he was terrible at managing his reputation. Don’t make the same mistake! Check out NAFCU’s new webcast:

How to Manage Reputation Risk: A Deep Dive into Murky Waters

Live Webcast: Wednesday, March 30 | 2:00 p.m. – 3:30 p.m. EST

Part of the Risk Webcast Series

Enterprise Risk Management (ERM) is becoming a more prominent management strategy in the credit union industry. This webcast focuses on the importance of reputation management and NCUA’s requirements and expectations. You’ll work through real examples of risk scenarios that could significantly impact your reputation, such as data breaches and social media attacks. Learn how to properly implement a reputation risk plan and how to defend your credit union.

Agencies Issue Guidance on Applying Customer Identification Program Requirements to Holders of Prepaid Cards

Written by Benjamin M. Litchfield, Regulatory Compliance Counsel

On March 21, 2016, the federal banking agencies, FinCEN, and NCUA issued interagency guidance on applying customer identification program (CIP) requirements to certain prepaid cards issued by banks, savings associations, or credit unions. In general, the guidance states that financial institutions should apply CIP to general purpose prepaid cards that provide a cardholder with the ability to reload funds or access to credit or overdraft features.

The agencies believe that the issuance of these types of prepaid cards establishes a formal banking relationship that is equivalent to opening an account for purposes of the CIP rule. For prepaid cards that require the purchaser to contact the issuing bank or credit union in order to active these types of features, the agencies “believe that an account is not established until a reload, credit, or overdraft feature is activated by cardholder registration.”

For purposes of complying with the CIP rule, the guidance states that banks and credit unions should treat the cardholder as the bank or credit union’s customer even if the cardholder is not the named account holder. This is typically the case when the prepaid program is run by a third-party intermediary who uses a pooled account to fund the prepaid cards. Therefore, the fact that the funds are held in a pooled account “should not affect the status of the cardholder as the bank customer, assuming the cardholder has established an account with the bank [or credit union] by activating the reloadable functionalities…” of the card.

The guidance also discusses how the CIP rule applies to specific prepaid card programs such as payroll, government benefit cards, and health benefit cards. For payroll cards, the guidance states that the bank or credit union should treat the employer as its customer and does not need to apply its CIP to each employee unless the card allows the employee to access credit through the card or reload the payroll card from sources other than the employer. In these cases, the bank or credit union would be required to treat the employee as its customer and apply its CIP to the employee.

For government benefit cards, the guidance reminds banks and credit unions that government agencies are not typically considered “customers” for CIP purposes and therefore the institution is not normally required to apply its CIP to government benefit cards. That being said, if the card program allows the cardholder-beneficiary to load non-government funds onto the card or provides access to credit, then a customer relationship is established and the institution must perform its CIP on the cardholder-beneficiary.

For health benefit cards, the guidance discusses CIP requirements for health savings accounts, flexible spending arrangements, and health reimbursement arrangements. Since employees typically establish health savings accounts, the guidance states that the bank or credit union should treat the employee establishing the account as the institution’s customer for CIP purposes. On the other hand, for flexible spending arrangements and health reimbursement arrangements, the guidance states that banks or credit unions should treat employer as the institution’s customer since no person other than the employer establishes these types of accounts.

Finally, the guidance notes that for banks or credit unions that work with third-party program managers that design, manage, and operate prepaid card programs, the institutions should have “well-constructed, enforceable contracts” with third-party program managers that clearly outline CIP obligations and ensure the bank or credit union has access to all CIP information collected by the third-party program manager.

Ultimately, it is unclear whether this guidance will be particularly useful to credit unions since credit unions may not typically provide services to nonmembers. For credit unions operating prepaid programs, these types of services are usually offered to members whose identities have already been verified at the time the member opened his or her initial share account. That being said, the guidance may be useful to credit unions that offer payroll cards to employees of their business members or for credit unions that may want to administer government benefit programs for state or local governments.

***

Programming Note: This is just a reminder that NAFCU will be closing at 12:00pm today in celebration of the holiday weekend. We wish a happy holiday to those of you and your families who may celebrate the holiday. Personally, I’m looking forward to the discounted candy sales on Monday.

BSA/AML Compliance Requirements: Frequently Asked Questions This Week; NAFCU’s new BSA Seminar + Certification is Here!

Written by Shereefat Balogun, Regulatory Compliance Counsel

This week NAFCU hosted its annual Regulatory Compliance School, focusing on the most important regulatory compliance issues facing credit unions. Today’s session will cover the Bank Secrecy Act (BSA) and OFAC (Office of Foreign Assets Control) regulatory framework. However, attendees seemed all too anxious and could not wait to ask their BSA/AML related questions- and understandably so. With an increase in enforcement actions for BSA/AML violations, ongoing OFAC sanctions and impending rules on customer due diligence, credit unions, and other financial institutions, are working hard to keep up with their compliance requirements under the BSA/AML regime. Today’s “FAQs” were inspired by the many BSA/AML related questions and concerns raised throughout the week.

Q: Does a credit union have an obligation to reconcile conflicting identification information provided by a member? We have a member who recently filled out a change of address form, and the SSN he put down is completely different from the one he gave to open this account. Is there any responsibility on the credit union’s part to take any action concerning this discrepancy?

A: Yes, the credit union does have an obligation to address any discrepancies as it pertains to identifying information.  Generally, before opening an account for a customer, the credit union must be able to form a reasonable belief that it knows the true identity of the customer based on the information gathered. The conflicting information may have been made in error.  In any event, the CIP procedures must specify how the credit union will resolve the discrepancies.  If the information is indeed conflicting and can’t be reconciled, the credit union may have an obligation to file a SAR.

Each credit union must have a written CIP that allows it to form a reasonable belief that it knows the true identity of each customer.  The CIP must contain procedures for opening an account that specify the identifying information that will be obtained from each customer.  The credit union must obtain, at a minimum, the following four pieces of information from the customer prior to opening an account:

• Name
• DOB for individuals
• Address
• Identification Number

In addition to gathering the four pieces of information outlined above, the credit union is required to verify the identity of the customer using the information gathered.  In verifying the information, the credit union may use documents and/or non-documentary methods, if its CIP procedures allow for that.  If there are discrepancies in the information, this may create a challenge in the credit union’s ability to form a reasonable belief that it  knows the true identity of a member.  The CIP procedures should outline steps the credit union will take to properly, and more accurately, identify an individual.  The conflicting information may have been made in error.  In any event, the CIP procedures must specify how the credit union will resolve discrepancies using documents and/or non-documentary information.   This may include calling the member to address inconsistencies, relying on other sources such as public databases, or checking references with other banks and/or credit unions.  If the information is indeed conflicting and can’t be reconciled, the credit union may have an obligation to file a SAR. Also note that the credit union is well within their right to put the account on hold while it reconciles the information.

 

Q: Can a credit union accept a current passport instead of a taxpayer identification number or social security number at account opening?

A: Generally, credit unions must obtain an identification number before opening an account for a prospective member.  For US persons, this would be a taxpayer identification number.  For non-US persons, a current passport would suffice.  It appears, however, that a credit union may accept other forms of ID if its CIP procedures provide for that, especially where the customer has applied for a taxpayer identification number, but has not yet received one.  Generally, before opening an account for a customer, the credit union must be able to form a reasonable belief that it knows the true identity of the customer based on the information gathered. The relevant rules can be found in 31 CFR 1020.220.

Before opening an account for a customer, a credit union must collect identifying information, including an identification number.  For a U.S. person, this will be a taxpayer identification number.  For a non-U.S. person, one or more of the following will be acceptable: (i) a taxpayer identification number; (ii) passport number and country of issuance; (iii) alien identification card number; or (iv) number and country of issuance of any other government-issued document evidencing nationality or residence and bearing a photograph or similar safeguard.

The rule does make an exception for individuals who are applying for a taxpayer identification number.  According to the rule, a credit union’s CIP may include procedures for opening an account for someone who has applied, but not received a taxpayer identification number.  This may include accepting other forms of identification number, including a current passport.  However, the procedures must ensure that the individual obtains the taxpayer identification number within a reasonable period of time after the account is opened.

(B) Exception for persons applying for a taxpayer identification number. Instead of obtaining a taxpayer identification number from a customer prior to opening the account, the CIP may include procedures for opening an account for a customer that has applied for, but has not received, a taxpayer identification number. In this case, the CIP must include procedures to confirm that the application was filed before the customer opens the account and to obtain the taxpayer identification number within a reasonable period of time after the account is opened.  31 CFR 1020.220(a)(2)(i)(B)(emphasis added.).

Also, the rules provide credit unions with the ability to verify identification through non-documentary methods.  The credit union’s CIP must specify the situations where a credit union would use non-documentary methods to verify a customer’s identity and how to handle them, including when a customer doesn’t have all the necessary documents at the time he/she comes in to open the account.

 

Q: Is a credit union required to file a CTR where a member withdraws $9,500 in cash from a rep payee account and $700 from his personal account on the same day? 

A: The answer to your question can be found in Treasury’s BSA/AML regulations, 31 CFR 1010.  Yes, in this situation, the credit union is required to file a CTR because, although there were multiple transactions, the transactions: (i) resulted in a cash withdrawal in excess of $10k; (ii) occurred during the same business day; and (iii) were made by the same person.

31 CFR 1010.311 requires that a credit union report cash transactions in excess of $10,000 during the same business day. Indeed, the rule states:

Each financial institution other than a casino shall file a report of each deposit, withdrawal, exchange of currency or other payment or transfer, by, through, or to such financial institution which involves a transaction in currency of more than $10,000, except as otherwise provided in this section.  31 CFR 1010.311 (emphasis added.).

Moreover, the amount over $10,000 can be either in one transaction or a combination of cash transactions.  The credit union should treat the multiple transactions as a single transaction if the credit union knows that the transactions are by the same person. The rule provides:

(b) Multiple transactions. In the case of financial institutions other than casinos, for purposes of the transactions in currency reporting requirements in this chapter, multiple currency transactions shall be treated as a single transaction if the financial institution has knowledge that they are by or on behalf of any person and result in either cash in or cash out totaling more than $10,000 during any one business day (or in the case of the U.S. Postal Service, any one day). Deposits made at night or over a weekend or holiday shall be treated as if received on the next business day following the deposit.  31 CFR 1010.313 (b)(emphasis added.).

Here, although the first cash withdrawal of $9,500 was made from a rep payee account, and thus was not his own personal account and not his own personal funds, the aggregate amount withdrew on that day was in excess of $10,000 and was made by the same person.  The credit union was asked to give a single person more than $10,000 in cash on a single day. The fact that the transactions involved multiple, or different, accounts is irrelevant.  Accordingly, the credit union should file the CTR with FinCEN.

 

Q: What steps should a credit union take when it gets an “OFAC hit”?

A: OFAC’s (Office of Foreign Assets Control) regulations prohibit all US persons from engaging in transactions with certain specified persons and countries. Specifically, credit unions must: (i) block accounts and other assets of “Specifically Designated Nationals” (SDNs) and “Blocked Persons”; and (ii) block or reject prohibited transactions with SDNs and Blocked Persons.

Generally, if the credit union gets an “OFAC” hit, the credit union needs to confirm that the individual that was flagged is indeed the individual on the SDN list. Treasury has a hotline dedicated to providing assistance with making a determination if the person is the same. If the person or entity is indeed the same included on the SDN list, the credit union cannot open the account; but rather must block the transaction and account, and also report the blocked transaction/account to OFAC.

While not required by specific regulation, NCUA expects that a credit union will establish and maintain an effective, written OFAC compliance program commensurate with its OFAC risk profile. Amongst other things, the policies, procedures and processes should address how the credit union will identify and review transactions and accounts for possible OFAC violations. The policies and procedures should also define the credit union’s criteria for comparing names provided on the OFAC “SDN” list with the names in the credit union’s files or transactions and for identifying transactions or accounts involving sanctioned countries. Furthermore, the policies and procedures should address how the credit union will determine whether an initial OFAC hit is a valid match or a false hit.

 

Q: Where can I go for assistance in developing our BSA/AML risk-based model? The rules don’t say anything. I’ve checked the FFIEC BSA/AML examination manual and it doesn’t say much on how the risk based model program should look like.

A: Honestly, the guide or the rules will not go into that level of detail. Here’s the reason. Generally, governments around the world feel that the risk-based approach is preferable to a more prescriptive approach in the BSA/AML space because it is:

1. Flexible- AML/BSA risks vary across jurisdictions, customers and products; and
2. Effective- Credit unions are better equipped than legislators to effectively assess and mitigate specific BSA/AML risks they face.

Notwithstanding the lack of specific guidance, however, there are four main things a credit union’s risk assessment should consider:

1. Members- Who are you selling your products or offering services to? Individuals or private companies? Foreign public officials? Money Servicing Businesses?
2. Products and Services- What products and services are you offering that may be vulnerable to money laundering? Online banking? Private banking? Correspondent banking? Wire transfers?
3. Geographical Location- In what countries do your members reside and what are their countries of citizenship? Where are your corporate customers headquartered and where do they conduct their business? Are you engaging in transactions involved with countries included on any government lists?

Generally, some member types , products and services, and geographical locations pose higher risks than others, and thus your program wants to properly identify those and tailor its monitoring accordingly.

As indicated above, we received a substantial number of BSA/AML inquiries. Indeed, compliance with the BSA/AML rules remains a top priority for financial institutions. NAFCU is here to assist you as you navigate through the rules and will keep you abreast of emerging challenges, and regulatory developments. In fact, the industry is still awaiting FinCEN’s final rule on Customer Due Diligence and beneficial ownership requirements, which is expected this year. We will keep you posted.

###

NAFCU’s new BSA Seminar + Certification is Here!

We’ve had hundreds of requests from credit unions to provide more BSA training, and I’m excited to announce, it’s here. We’ll be holding our first in-person, BSA Seminar in New Orleans October 24 – 28. If those dates and location sound familiar to you, it’s not déjà vu. We’ll be running this BSA Seminar concurrently to our Regulatory Compliance Seminar. While they are two separate educational events, the networking aspects will be co-mingled, making it an awesome way to build your network of credit union and BSA professionals from around the country.

You can expect a full week of everything you’ve ever wanted to know about BSA, but didn’t have time to ask. It’s designed for just credit union professionals. You’ll find no erroneous “bank” information that doesn’t apply to credit unions. Check out the full agenda and sessions.

There’s an optional, pre-conference workshop to help get you up-to-speed on BSA fundamentals – it’s perfect if you’re new to BSA or just want a refresher. And at the end of the week, you’ll have the opportunity to get certified when you sit and pass the NAFCU Certified Bank Secrecy Officer (NCBSO) exam.

This seminar, and the certification, is an excellent way to demonstrate to NCUA and FinCEN you’re dedicated to compliance and to protecting your credit union against financial crime. It was designed by NAFCU’s Director of Education Devon Lyon, former director of BSA at State Department Federal Credit Union – so the curriculum is extremely relevant at both a strategic and tactical level. You’ll walk away ready to master your AML responsibilities. And of course, it fulfills your yearly BSA training requirement!

We have limited seating – so register early!

Identity Theft Still a Huge Issue for Consumers According to FTC Data; Programming Note

Written by Shari R. Pogach, Regulatory Paralegal

Identity theft continues to be a huge problem for consumers. According to the Federal Trade Commission’s (FTC) annual summary of consumer complaints in its Consumer Sentinel Network Data Book for January – December 2015, identity theft complaints were the second most reported by consumers in 2015. And, identity theft complaints increased more than 47 percent from 2014. The identity theft complaints dealt with: 45 percent were related to tax or wage ID theft, 2) 16 percent concerned credit card fraud and 3) 10 percent were related to phones or utilities.

The top ten complaint categories for 2015:

1. Debt Collection
2. Identity Theft
3. Impostor Scams
4. Telephone and Mobile Services
5. Prizes, Sweepstakes and Lotteries
6. Banks and Lenders
7. Shop-at-Home and Catalog Sales
8. Auto-Related Complaints
9. Television and Electronic Media
10. Credit Bureaus, Information Furnishers and Report Users

Consumers also continue to complain about financial institutions with such complaints making up 4 percent of the total of 3,083,379 complaints collected in 2015. Complaints regarding financial institutions ranged from: “Deceptive or predatory mortgage lending practices; problems with modification of mortgage terms; miscellaneous customer service and account issues with bank or credit union products, including payday loans, student loans, auto title loans, fees and overdraft charges; other finance company lending products, services and practices; etc.”

The FTC’s data book breaks down the top ten consumer complaints by state and then the top six identity theft type complaints by state. Florida, Georgia and Michigan were the top three states for fraud and other complaints. Missouri, Connecticut and Florida were the top three states for identity theft complaints. This data comes from consumer complaints made directly to the FTC as well as those received by state and federal law enforcement agencies, national consumer protection organizations and non-governmental organizations.

***

Programming Note. It’s time for school! Your compliance questions will be answered but we appreciate your patience as the team will be in and out of the office giving presentations this week at NAFCU’s 2016 Regulatory Compliance School. And, be sure to send out good luck wishes to those attendees testing to obtain their NAFCU Certified Compliance Officer (NCCO) designation.

HSBC - Still Naughty After All These Years; NAFCU Compliance Skills 101

Written by Shari R. Pogach, Regulatory Paralegal

The global British bank, HSBC Holdings PLC (HSBC), just can’t seem to get out of its own way. In its recently released Annual Report and Accounts 2015 available here, the bank admitted that its court-appointed monitor is still not happy with HSBC’s progress in ramping up its anti-money laundering and sanctions programs to meet United States Bank Secrecy Act requirements. Here is an excerpt from page 116:

“In January 2016, the Monitor delivered his second annual follow-up review report based on various thematic and country reviews he had conducted over the course of 2015. In his report, the Monitor concluded that, in 2015, HSBC made progress in developing an effective and sustainable financial crime compliance programme. However, he expressed significant concerns about the pace of that progress, instances of potential financial crime and systems and controls deficiencies, whether HSBC is on track to meet its goal to the Monitor’s satisfaction within the five-year period of the US DPA [deferred prosecution agreement]  and, pending further review and discussion with HSBC, did not certify as to HSBC’s implementation of and adherence to remedial measures specified in the US DPA.”

(Emphasis added.)

The British press is also reporting that there may still be criminal activity at HSBC. Apparently an investigation is being called for to look into “shady” activity between the representatives of the Maldives government and former British Prime Minister Tony Blair’s wife, Cherie Blair’s law firm – Omnia Strategy. As the law firm’s bank, HSBC accepted a £210,000 payment from “a suspected conman and terrorist for the Maldives’ autocratic president, Abdulla Yameen.” It has been suggested that the bank’s anti-money laundering systems should have blocked this payment.

As I indicated in this prior blog post, under the terms of the U.S. deferred prosecution agreement, the Department of Justice has sole discretion to determine whether the bank has breached the agreement. Potential consequences could include more terms and conditions, an extension of the agreement or criminal prosecution. HSBC could also face restrictions on its ability to process U.S. dollar payments through the United States or lose its banking license in the U.S.

It will be interesting to see how this all plays out…..

***

NAFCU Credit Union Compliance 101: Building Blocks for Compliance Skills: NAFCU’s Regulatory Compliance team has developed an e-manual for our compliance peeps. It’s a great resource with links to resources and tips on enhancing your job function skills. Want a sample chapter sneak peek? Just go here. But at the NAFCU member price of $99 and the nonmember price of $149, why not just get your very own copy of this practical electronic compliance resource here!

FinCEN Issues Advisory on FATF’s October 2015 Update; CUSO Registry Webinar

Written by Eliott C. Ponte, Regulatory Compliance Counsel

On January 19, the Financial Crimes Enforcement Network (FinCEN) issued an advisory, FIN-2016-A001, to provide guidance on the list of jurisdictions identified by the Financial Action Task Force (FATF).  The release of this advisory comes in response to FATF updating its list of jurisdiction with strategic Anti-Money Laundering and Counter-Terrorist Financing (AML/CTF) deficiencies.

FATF is an inter-governmental policymaking body that proposes international standards and policies to combat money laundering and terrorist financing.  Since the late 1980’s, FATF has issued several recommendations that aim to protect the international financial system from money laundering and financing of terrorism risks.  Moreover, FATF encourages greater compliance with the anti-money laundering standards.  Most recently, FATF published two statements identifying those jurisdictions that are deemed to have “strategic deficiencies” in their anti-money laundering and counter terrorist financing regimes. 

FinCENs advisory acknowledges FATF’s update and provides guidance for financial institutions engaging with listed jurisdiction.  These jurisdictions appear in two documents: (1) “FATF Public Statement”, which consists of  jurisdictions that are subject to FATF’s call for countermeasures or are subject to Enhanced Due Diligence due to their Anti-Money Laundering and Counter-Terrorist Financing (AML/CFT) deficiencies; and, (2) “Improving Global AML/CFT Compliance: On-going Process,” which consists of jurisdictions identified by FATF to have AML/CFT deficiencies.

Based on FATF’s recent changes, FinCEN is recommending that financial institutions impose countermeasures or consider the risk arising due to a lack of sufficient progress in addressing AML/CFT deficiencies in the countries of Iran and the Democratic People’s Republic of Korea.  FinCEN is also recommending that institutions apply enhanced due diligence for the country of Myanmar.  FinCEN notes, however, that the country of Aleria has made progress in addressing its FATF action plan.  As a result, Algeria has been removed from the “FATF Public Statement” and now includes this jurisdiction in its “Improving Global AML/CFT Compliance: On-going Process” document.  The list of these countries in this document include Afghanistan, Algeria, Angola, Bosnia and Herzegovina, Guyana, Iraq, Lao PDR, Panama, Papua New Guinea, Syria, Uganda, and Yemen.

FinCEN instructs financial institutions to continue to apply countermeasures to protect against AML/CFT risks. For more information, credit unions should consult the FinCEN Advisory.

***

CUSO Registry Webinar

Tomorrow, the NCUA will host a free webinar on how to use the new CUSO Registry system.  The webinar is schedule to start at 2:30 P.M. EST.  NAFCU Blog Readers can register online for this free webinar here. Questions about the registry may be submitted in advance by emailing your question to [email protected]. The NCUA requests that the subject line of the email read, “CUSO Registry Training.”

A Little BSA, A Little OFAC; January BSA Blast; Programming Note

Written by Shari R. Pogach, Regulatory Paralegal

Compliance with Bank Secrecy Act (BSA) and the Office of Foreign Assets Control (OFAC) requirements continues to be an issue for some financial institutions. Towards the end of 2015, the Board of Governors of the Federal Reserve System posted enforcement actions against three banks: The Bank of Nova Scotia of Toronto, Canada; East West Bank of Pasadena, California; and Habib Bank Limited of Karachi, Pakistan. Each bank had varying degrees of problems with its BSA and anti-money laundering (AML) compliance programs as well as OFAC compliance. All are now subject to monitoring, reporting and transaction lookback review as a result of the deficiencies. It is sometimes helpful to review what someone else has or is doing wrong to ensure your own compliance program is up to snuff.

Cuba and Iran Sanctions

We all know there have been significant changes announced to U.S. policy concerning Cuba and Iran. As a result, there have also been some changes to the OFAC requirements for both countries. I thought it might be help to post the following FAQs from OFAC on the changes:

Changes to the Cuba Sanctions - Frequently Asked Questions, and

Frequently Asked Questions Relating to the Lifting of Certain U.S. Sanctions Under the Joint Comprehensive Plan of Action (JCPOA) on Implementation Day.

***
BSA Blast: The January 2016 quarterly issue of the BSA Blast is now available (a NAFCU login required). This issue takes a look at the enforcement actions against Deutsche Bank AG for U.S. sanctions violations and reviews recent speeches made by the Financial Crimes Enforcement Network Director Jennifer Shasky Calvery. The issue also includes a new BSA quiz for staff training on OFAC reporting and record keeping requirements.
***
NAFCU Webcast: Register for this live webcast, Bank Bribery Issues from a Board Member’s Perspective, on Wednesday, January 27, from 2-3:30pm EST. The role of a credit union board member is more significant than ever. And, a director has the ultimate decision making authority and responsibility for controlling the direct operations of the credit union, which also means understanding the internal and external entities that affect decision making. Join us for an in-depth look at rules, regulations and best practices regarding bank bribery issues that every director needs to know. During the webcast, we will review examples and case studies of Bank Secrecy Act (BSA) violations, explore ethics rules and required policies for internal dealings, and more
***
Programming Note: Winter Storm Jonas is coming so NAFCU is closing at 12 noon today to ensure folks get home safely. But never fear, for those not impacted by Jonas, the Regulatory Compliance team will still be available to answer your questions remotely.

FinCEN Regulatory Impact Assessment on CDD Proposal; CFPB Issues Letter on TRID Enforcement and Liability

Written by Brandy Bruyere, Director of Regulatory Compliance

I hope everyone had a wonderful New Year! After a couple of long holiday weekends, I thought we would start off 2016 with FinCEN/the BSA and a recent development relating to TRID. Remember that time FinCEN proposed explicit customer due diligence requirements for beneficial owners of legal entities? These rules were originally slated to become final this past summer, but so far, FinCEN has not finalized the proposal. According to the Department of Treasury's fall rulemaking agenda, the proposal could be finalized as early as this month but when NAFCU reached out to FinCEN to confirm, an agency spokesperson indicated that they are “still in the comment analysis stage.”

On December 23, FinCEN released its Regulatory Impact Assessment (RIA) for this proposed rule which highlighted costs of the rule compared to benefits “using an upper bound for costs based on estimated and hypothetical values.” Overall, FinCEN concluded that so long as the CDD proposal would reduce illicit by a minimum of 0.57 percent annually between 2016 and 2025, the rule would “achieve [a] positive net benefit.” Here are some noteworthy items from FinCEN’s costs analysis.

Staff time for completing CDD requirements (page 5) - FinCEN estimates that it would require, on average, 20 minutes to fulfill the beneficial ownership identification, verification and recordkeeping requirements in the proposal.

Annual costs to small institutions (page 6) – FinCEN estimates that the proposal “would result in a cost to a small bank of between approximately $2000 and $4000 per year at account opening”

Training (Page 7) – FinCEN said the following about the costs associated with training staff to implement the proposal: “Assuming that a small financial institution has 125 employees and that the training would take one hour, and applying the wage assumptions used in the RIA, this would result in an estimated cost of between $1250 and $2500, depending on the percentage of employees trained, for the first year that the rule would be in effect…The amount of necessary training would decrease thereafter.” (Emphasis added.)

Here is a table provide on page 10 summarizing FinCEN’s estimates for total costs for training across all institutions, in the millions:

Note, the “client” column represents estimated costs to the member due to increased time to open accounts and similar impacts.

Information Technology costs (page 25, footnote)  – FinCEN included some specifics on reported information technology costs associated with the proposal. One large bank estimated IT costs to be about $20 million, a mid-sized bank estimated these costs to range from $3 million to $5 million, and a small credit union estimated its costs would be between $50,000 and $70,000. 

The RIA goes on to explain how the “benefits” of the CDD proposal were evaluated, noting the difficulty in placing a qualitative dollar amount of benefit to compare to costs.

***

CFPB Issues Letter on TRID Enforcement and Liability. In response to a letter from the Mortgage Bankers Association, last week CFPB Director Richard Cordray sent this letter discussing TRID liability. Here are some excerpts with hyperlinks included:

“…As with any change of this scale, despite the best of efforts, there inevitably will be inadvertent errors in the early days. That is why the Bureau and other regulators have made clear that our initial examinations for compliance with the rule will be sensitive to the progress industry has made…All of the regulators have indicated that their examinations for compliance in the first few months of implementing [TRID] will be corrective and diagnostic, rather than punitive…

[…]

In addition to the cure provisions contained in the rule the Truth in Lending Act itself contains provisions for the correction of errors. These provisions continue to apply to the integrated disclosures. For example, TILA has long permitted creditors to cure violations, provided the creditor notifies the borrower of the error and makes appropriate adjustments to the account before the creditor receives notice of the violation from the borrower. 15 U.S.C. 1640(b). Similarly, TILA contains an exception from liability for unintentional errors, subject to certain conditions. 15 U.S.C. 1640(c).

Furthermore, while [TRID] does integrate the TILA disclosures with the disclosures required under [RESPA], it did not change the prior, fundamental principles of liability under either TILA or RESPA. Therefore, for non-high-cost mortgages:

There is no general TILA assignee liability unless the violation is apparent on the face of the disclosure documents and the assignment is voluntary. 15 U.S.C. 1641(e).

By statute, TILA limits statutory damages for mortgage disclosures, in both individual and class actions to failure to provide a closed-set of disclosures. 15 U.S.C. 1640(a).

Formatting errors and the like are unlikely to give rise to private liability unless the formatting interferes with the clear and conspicuous disclosure of one of the TILA disclosures listed as giving rise to statutory and class action damages in 15 U.S.C. 1640(a).

The listed disclosures in 15 U.S.C. 1640(a) that give rise to statutory and class action damages to not include either the RESPA disclosures or the new Dodd-Frank Act disclosures, including the Total Cash to Close and Total Interest Percentage.

[…]

Accordingly, the Bureau believes that if investors were to reject loans on the basis of formatting and other minor errors, as you indicate has been occurring, they would be rejecting loans for reasons unrelated to potential liability associated with [TRID]…”

The full letter is available here:  CFPB response to MBA TRID letter

NAFCU continues to call on the CFPB to provide greater clarity on TRID. While this clarification on the scope of TRID liability is a step in the right direction, NAFCU hopes that the CFPB will follow this course into 2016 by more proactively resolving ambiguities raised by the industry in official guidance.

Palate Cleanser. We took Nolan to Ohio for the holidays, he had a great time. He also got to see first hand how in mommy's hometown, tractors are much more versatile than here in the DC suburbs - they can take you to the local convenience store! In a somewhat related note, my high school alma mater's annual tradition made the local news last spring, when I shared it with some folks here in DC they thought it was an article from The Onion but nope, this is a real news story about "drive your tractor to school" day. Enjoy!

Fighting Financial Institution Fraud

Written by Shari R. Pogach, Regulatory Paralegal

It’s been a busy, busy week here in Washington, DC, so here’s something a little lighter for you as we head into the last weekend before Christmas.

The Internal Revenue Service (IRS) puts out an annual report that highlights successful criminal investigation enforcement actions achieved during a fiscal year. As you would think, these investigations focus on tax-related identity theft, money laundering, public corruption, cybercrime and terrorist financing. But here’s what caught my eye. In its fiscal year 2015 annual report there is a section on the IRS Illegal Source Financial Crimes Program, which includes all tax, tax-related, money laundering and currency violations.

Under this program, the IRS investigates criminal violations involving financial institution fraud.  And, apparently the “ability to bring income tax and money laundering charges augments prosecutors’ effectiveness in combating fraud committed against financial institutions, whether the violators work within or outside of the institution.” Two successful fraud investigations in fiscal year 2015 involved credit unions:

“Former Federal Credit Union Employee Sentenced for Bank Fraud and Filing False Tax Returns

On March 25, 2015, in Valdosta, Georgia, Kelly Yawn was sentenced to 41 months in prison and ordered to pay $628,539 in restitution to the fraud victims and $139,865 to the IRS. On Jan. 6, 2015, Yawn pleaded guilty to bank fraud and filing false tax returns. Between February 2008 and November 2011, while employed by a federal credit union Yawn accessed the credit union’s computer system to prevent electronic transactions (ACH) and written share drafts from posting to her account. Using that scheme, Yawn was able to misdirect for her own benefit more than 900 share drafts and more than 1,200 ACH transactions, totaling more than $499,000 that were paid from credit union funds. Yawn took additional actions to cover up the transactions so that they would not be discovered by the credit union or outside auditors by posting fraudulent deposits to credit union accounts. Yawn also filed federal income tax returns for 2008 through 2011 and failed to include the money she received from the scheme on her federal tax returns as income in those years.

Ohio Man Sentenced for Defrauding Credit Union

On Feb. 23, 2015, in Cleveland, Ohio, John Struna, of Concord Township, was sentenced to 43 months in prison and ordered to pay more than $2.3 million in restitution. Struna was also ordered to forfeit a restaurant he owned, a condominium and a 2014 Mazda. Struna previously pleaded guilty to conspiracy to commit bank fraud, bank fraud, making false statements and money laundering. Struna defrauded the Taupa Lithuanian Credit Union, based in Cleveland, out of $2.3 million. Credit union CEO Alex Spirikaitis, former teller Michael Ruksenas and Vytas Apanavicius were previously found guilty for their roles in conspiracies related to defrauding the credit union. Struna maintained both personal and corporate accounts at Taupa dating back to 1995. He began a conspiracy with Spirikaitis in 2002 and continued through 2013, during which time Spirikaitis caused Taupa to make approximately 46 fraudulent transfers into Struna’s accounts. In 2011, Struna requested and received $112,105 from Spirikaitis for the purchase of a condominium located in Fort Myers, Florida. At no time did Struna submit any credit applications or loan documents. The fraudulent transfers totaled approximately $2.3 million. From 2002 through 2013, Struna repaid only approximately $15,000 of the $2.3 million Spirikaitis transferred into his accounts.”

The IRS report is worth scanning as within the other case example descriptions are indicators of how criminals perpetrated their criminal activity through financial institutions even when not actively defrauding the institution itself.